kernel: update bcma and ssb to version master-2012-04-12 from wireless-testing

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@31278 3c298f89-4303-0410-b956-a3cf2f4a3e73

22 files changed, 19985 insertions, 2773 deletions

diff --git a/target/linux/generic/patches-2.6.30/025-bcma_backport.patch b/target/linux/generic/patches-2.6.30/025-bcma_backport.patch
index a95db6eb92..0ff18fb21e 100644
--- a/target/linux/generic/patches-2.6.30/025-bcma_backport.patch
+++ b/target/linux/generic/patches-2.6.30/025-bcma_backport.patch
@@ -103,7 +103,7 @@
 +
 +config BCMA_DRIVER_PCI_HOSTMODE
 +	bool "Driver for PCI core working in hostmode"
-+	depends on BCMA && MIPS
++	depends on BCMA && MIPS && BCMA_HOST_PCI
 +	help
 +	  PCI core hostmode operation (external PCI bus).
 +
@@ -172,7 +172,7 @@
 +- Create kernel Documentation (use info from README)
 --- /dev/null
 +++ b/drivers/bcma/bcma_private.h
-@@ -0,0 +1,54 @@
+@@ -0,0 +1,59 @@
 +#ifndef LINUX_BCMA_PRIVATE_H_
 +#define LINUX_BCMA_PRIVATE_H_
 +
@@ -188,12 +188,13 @@
 +struct bcma_bus;
 +
 +/* main.c */
-+int bcma_bus_register(struct bcma_bus *bus);
++int __devinit bcma_bus_register(struct bcma_bus *bus);
 +void bcma_bus_unregister(struct bcma_bus *bus);
 +int __init bcma_bus_early_register(struct bcma_bus *bus,
 +				   struct bcma_device *core_cc,
 +				   struct bcma_device *core_mips);
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus);
 +int bcma_bus_resume(struct bcma_bus *bus);
 +#endif
 +
@@ -222,8 +223,12 @@
 +extern void __exit bcma_host_pci_exit(void);
 +#endif /* CONFIG_BCMA_HOST_PCI */
 +
++/* driver_pci.c */
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address);
++
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc);
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
 +
 +#endif
@@ -517,7 +522,7 @@
 +#endif /* CONFIG_BCMA_DRIVER_MIPS */
 --- /dev/null
 +++ b/drivers/bcma/driver_chipcommon_pmu.c
-@@ -0,0 +1,309 @@
+@@ -0,0 +1,310 @@
 +/*
 + * Broadcom specific AMBA
 + * ChipCommon Power Management Unit driver
@@ -599,6 +604,7 @@
 +		min_msk = 0x200D;
 +		max_msk = 0xFFFF;
 +		break;
++	case 0x4331:
 +	case 43224:
 +	case 43225:
 +		break;
@@ -829,13 +835,14 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/driver_pci.c
-@@ -0,0 +1,237 @@
+@@ -0,0 +1,225 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Core
 + *
-+ * Copyright 2005, Broadcom Corporation
++ * Copyright 2005, 2011, Broadcom Corporation
 + * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
 + *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
@@ -847,40 +854,41 @@
 + * R/W ops.
 + **************************************************/
 +
-+static u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
 +{
-+	pcicore_write32(pc, 0x130, address);
-+	pcicore_read32(pc, 0x130);
-+	return pcicore_read32(pc, 0x134);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_DATA);
 +}
 +
 +#if 0
 +static void bcma_pcie_write(struct bcma_drv_pci *pc, u32 address, u32 data)
 +{
-+	pcicore_write32(pc, 0x130, address);
-+	pcicore_read32(pc, 0x130);
-+	pcicore_write32(pc, 0x134, data);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_DATA, data);
 +}
 +#endif
 +
 +static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u8 phy)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	u32 v;
 +	int i;
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 28); /* Write Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	v |= (0x1F << 18);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++	v |= (BCMA_CORE_PCI_MDIODATA_BLK_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
 +	v |= (phy << 4);
-+	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +
 +	udelay(10);
 +	for (i = 0; i < 200; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
 +			break;
 +		msleep(1);
 +	}
@@ -888,79 +896,84 @@
 +
 +static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u8 device, u8 address)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	int max_retries = 10;
 +	u16 ret = 0;
 +	u32 v;
 +	int i;
 +
-+	v = 0x80; /* Enable Preamble Sequence */
-+	v |= 0x2; /* MDIO Clock Divisor */
-+	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
 +
 +	if (pc->core->id.rev >= 10) {
 +		max_retries = 200;
 +		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 +	}
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 29); /* Read Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	if (pc->core->id.rev < 10)
-+		v |= (u32)device << 22;
-+	v |= (u32)address << 18;
-+	pcicore_write32(pc, mdio_data, v);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_READ;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
++
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +	/* Wait for the device to complete the transaction */
 +	udelay(10);
 +	for (i = 0; i < max_retries; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */) {
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE) {
 +			udelay(10);
-+			ret = pcicore_read32(pc, mdio_data);
++			ret = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_DATA);
 +			break;
 +		}
 +		msleep(1);
 +	}
-+	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
 +	return ret;
 +}
 +
 +static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u8 device,
 +				u8 address, u16 data)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	int max_retries = 10;
 +	u32 v;
 +	int i;
 +
-+	v = 0x80; /* Enable Preamble Sequence */
-+	v |= 0x2; /* MDIO Clock Divisor */
-+	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
 +
 +	if (pc->core->id.rev >= 10) {
 +		max_retries = 200;
 +		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 +	}
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 28); /* Write Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	if (pc->core->id.rev < 10)
-+		v |= (u32)device << 22;
-+	v |= (u32)address << 18;
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
 +	v |= data;
-+	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +	/* Wait for the device to complete the transaction */
 +	udelay(10);
 +	for (i = 0; i < max_retries; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
 +			break;
 +		msleep(1);
 +	}
-+	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
 +}
 +
 +/**************************************************
@@ -969,72 +982,53 @@
 +
 +static u8 bcma_pcicore_polarity_workaround(struct bcma_drv_pci *pc)
 +{
-+	return (bcma_pcie_read(pc, 0x204) & 0x10) ? 0xC0 : 0x80;
++	u32 tmp;
++
++	tmp = bcma_pcie_read(pc, BCMA_CORE_PCI_PLP_STATUSREG);
++	if (tmp & BCMA_CORE_PCI_PLP_POLARITYINV_STAT)
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE |
++		       BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY;
++	else
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE;
 +}
 +
 +static void bcma_pcicore_serdes_workaround(struct bcma_drv_pci *pc)
 +{
-+	const u8 serdes_pll_device = 0x1D;
-+	const u8 serdes_rx_device = 0x1F;
 +	u16 tmp;
 +
-+	bcma_pcie_mdio_write(pc, serdes_rx_device, 1 /* Control */,
-+			      bcma_pcicore_polarity_workaround(pc));
-+	tmp = bcma_pcie_mdio_read(pc, serdes_pll_device, 1 /* Control */);
-+	if (tmp & 0x4000)
-+		bcma_pcie_mdio_write(pc, serdes_pll_device, 1, tmp & ~0x4000);
++	bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_RX,
++	                     BCMA_CORE_PCI_SERDES_RX_CTRL,
++			     bcma_pcicore_polarity_workaround(pc));
++	tmp = bcma_pcie_mdio_read(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++	                          BCMA_CORE_PCI_SERDES_PLL_CTRL);
++	if (tmp & BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN)
++		bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++		                     BCMA_CORE_PCI_SERDES_PLL_CTRL,
++		                     tmp & ~BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN);
 +}
 +
 +/**************************************************
 + * Init.
 + **************************************************/
 +
-+static void bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
++static void __devinit bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
 +{
 +	bcma_pcicore_serdes_workaround(pc);
 +}
 +
-+static bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
-+{
-+	struct bcma_bus *bus = pc->core->bus;
-+	u16 chipid_top;
-+
-+	chipid_top = (bus->chipinfo.id & 0xFF00);
-+	if (chipid_top != 0x4700 &&
-+	    chipid_top != 0x5300)
-+		return false;
-+
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
-+	if (bus->sprom.boardflags_lo & SSB_BFL_NOPCI)
-+		return false;
-+#endif /* CONFIG_SSB_DRIVER_PCICORE */
-+
-+#if 0
-+	/* TODO: on BCMA we use address from EROM instead of magic formula */
-+	u32 tmp;
-+	return !mips_busprobe32(tmp, (bus->mmio +
-+		(pc->core->core_index * BCMA_CORE_SIZE)));
-+#endif
-+
-+	return true;
-+}
-+
-+void bcma_core_pci_init(struct bcma_drv_pci *pc)
++void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
 +{
 +	if (pc->setup_done)
 +		return;
 +
-+	if (bcma_core_pci_is_in_hostmode(pc)) {
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	pc->hostmode = bcma_core_pci_is_in_hostmode(pc);
++	if (pc->hostmode)
 +		bcma_core_pci_hostmode_init(pc);
-+#else
-+		pr_err("Driver compiled without support for hostmode PCI\n");
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
-+	} else {
-+		bcma_core_pci_clientmode_init(pc);
-+	}
 +
-+	pc->setup_done = true;
++	if (!pc->hostmode)
++		bcma_core_pci_clientmode_init(pc);
 +}
 +
 +int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
@@ -1069,7 +1063,7 @@
 +EXPORT_SYMBOL_GPL(bcma_core_pci_irq_ctl);
 --- /dev/null
 +++ b/drivers/bcma/host_pci.c
-@@ -0,0 +1,299 @@
+@@ -0,0 +1,292 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Host
@@ -1226,8 +1220,8 @@
 +	.awrite32	= bcma_host_pci_awrite32,
 +};
 +
-+static int bcma_host_pci_probe(struct pci_dev *dev,
-+			     const struct pci_device_id *id)
++static int __devinit bcma_host_pci_probe(struct pci_dev *dev,
++					 const struct pci_device_id *id)
 +{
 +	struct bcma_bus *bus;
 +	int err = -ENOMEM;
@@ -1307,38 +1301,32 @@
 +}
 +
 +#ifdef CONFIG_PM
-+static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
++static int bcma_host_pci_suspend(struct device *dev)
 +{
-+	/* Host specific */
-+	pci_save_state(dev);
-+	pci_disable_device(dev);
-+	pci_set_power_state(dev, pci_choose_state(dev, state));
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	return 0;
++	bus->mapped_core = NULL;
++
++	return bcma_bus_suspend(bus);
 +}
 +
-+static int bcma_host_pci_resume(struct pci_dev *dev)
++static int bcma_host_pci_resume(struct device *dev)
 +{
-+	struct bcma_bus *bus = pci_get_drvdata(dev);
-+	int err;
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	/* Host specific */
-+	pci_set_power_state(dev, 0);
-+	err = pci_enable_device(dev);
-+	if (err)
-+		return err;
-+	pci_restore_state(dev);
++	return bcma_bus_resume(bus);
++}
 +
-+	/* Bus specific */
-+	err = bcma_bus_resume(bus);
-+	if (err)
-+		return err;
++static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
++			 bcma_host_pci_resume);
++#define BCMA_PM_OPS	(&bcma_pm_ops)
 +
-+	return 0;
-+}
 +#else /* CONFIG_PM */
-+# define bcma_host_pci_suspend	NULL
-+# define bcma_host_pci_resume	NULL
++
++#define BCMA_PM_OPS     NULL
++
 +#endif /* CONFIG_PM */
 +
 +static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
@@ -1356,8 +1344,7 @@
 +	.id_table = bcma_pci_bridge_tbl,
 +	.probe = bcma_host_pci_probe,
 +	.remove = bcma_host_pci_remove,
-+	.suspend = bcma_host_pci_suspend,
-+	.resume = bcma_host_pci_resume,
++	.driver.pm = BCMA_PM_OPS,
 +};
 +
 +int __init bcma_host_pci_init(void)
@@ -1371,7 +1358,7 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/main.c
-@@ -0,0 +1,354 @@
+@@ -0,0 +1,387 @@
 +/*
 + * Broadcom specific AMBA
 + * Bus subsystem
@@ -1387,6 +1374,12 @@
 +MODULE_DESCRIPTION("Broadcom's specific AMBA driver");
 +MODULE_LICENSE("GPL");
 +
++/* contains the number the next bus should get. */
++static unsigned int bcma_bus_next_num = 0;
++
++/* bcma_buses_mutex locks the bcma_bus_next_num */
++static DEFINE_MUTEX(bcma_buses_mutex);
++
 +static int bcma_bus_match(struct device *dev, struct device_driver *drv);
 +static int bcma_device_probe(struct device *dev);
 +static int bcma_device_remove(struct device *dev);
@@ -1429,7 +1422,7 @@
 +	.dev_attrs	= bcma_device_attrs,
 +};
 +
-+static struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
++struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
 +{
 +	struct bcma_device *core;
 +
@@ -1439,6 +1432,7 @@
 +	}
 +	return NULL;
 +}
++EXPORT_SYMBOL_GPL(bcma_find_core);
 +
 +static void bcma_release_core_dev(struct device *dev)
 +{
@@ -1467,7 +1461,7 @@
 +
 +		core->dev.release = bcma_release_core_dev;
 +		core->dev.bus = &bcma_bus_type;
-+		dev_set_name(&core->dev, "bcma%d:%d", 0/*bus->num*/, dev_id);
++		dev_set_name(&core->dev, "bcma%d:%d", bus->num, dev_id);
 +
 +		switch (bus->hosttype) {
 +		case BCMA_HOSTTYPE_PCI:
@@ -1506,11 +1500,15 @@
 +	}
 +}
 +
-+int bcma_bus_register(struct bcma_bus *bus)
++int __devinit bcma_bus_register(struct bcma_bus *bus)
 +{
 +	int err;
 +	struct bcma_device *core;
 +
++	mutex_lock(&bcma_buses_mutex);
++	bus->num = bcma_bus_next_num++;
++	mutex_unlock(&bcma_buses_mutex);
++
 +	/* Scan for devices (cores) */
 +	err = bcma_bus_scan(bus);
 +	if (err) {
@@ -1543,10 +1541,8 @@
 +	err = bcma_sprom_get(bus);
 +	if (err == -ENOENT) {
 +		pr_err("No SPROM available\n");
-+	} else if (err) {
++	} else if (err)
 +		pr_err("Failed to get SPROM: %d\n", err);
-+		return -ENOENT;
-+	}
 +
 +	/* Register found cores */
 +	bcma_register_cores(bus);
@@ -1615,6 +1611,21 @@
 +}
 +
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->suspend)
++				adrv->suspend(core);
++		}
++	}
++	return 0;
++}
++
 +int bcma_bus_resume(struct bcma_bus *bus)
 +{
 +	struct bcma_device *core;
@@ -1626,6 +1637,15 @@
 +		bcma_core_chipcommon_init(&bus->drv_cc);
 +	}
 +
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->resume)
++				adrv->resume(core);
++		}
++	}
++
 +	return 0;
 +}
 +#endif
@@ -1728,7 +1748,7 @@
 +module_exit(bcma_modexit)
 --- /dev/null
 +++ b/drivers/bcma/scan.c
-@@ -0,0 +1,486 @@
+@@ -0,0 +1,507 @@
 +/*
 + * Broadcom specific AMBA
 + * Bus scanning
@@ -1943,6 +1963,17 @@
 +	return NULL;
 +}
 +
++static struct bcma_device *bcma_find_core_reverse(struct bcma_bus *bus, u16 coreid)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry_reverse(core, &bus->cores, list) {
++		if (core->id.id == coreid)
++			return core;
++	}
++	return NULL;
++}
++
 +static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
 +			      struct bcma_device_id *match, int core_num,
 +			      struct bcma_device *core)
@@ -2084,6 +2115,7 @@
 +void bcma_init_bus(struct bcma_bus *bus)
 +{
 +	s32 tmp;
++	struct bcma_chipinfo *chipinfo = &(bus->chipinfo);
 +
 +	if (bus->init_done)
 +		return;
@@ -2094,9 +2126,12 @@
 +	bcma_scan_switch_core(bus, BCMA_ADDR_BASE);
 +
 +	tmp = bcma_scan_read32(bus, 0, BCMA_CC_ID);
-+	bus->chipinfo.id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
-+	bus->chipinfo.rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
-+	bus->chipinfo.pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	chipinfo->id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
++	chipinfo->rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
++	chipinfo->pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	pr_info("Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
++		chipinfo->id, chipinfo->rev, chipinfo->pkg);
++
 +	bus->init_done = true;
 +}
 +
@@ -2123,6 +2158,7 @@
 +	bcma_scan_switch_core(bus, erombase);
 +
 +	while (eromptr < eromend) {
++		struct bcma_device *other_core;
 +		struct bcma_device *core = kzalloc(sizeof(*core), GFP_KERNEL);
 +		if (!core)
 +			return -ENOMEM;
@@ -2130,18 +2166,23 @@
 +		core->bus = bus;
 +
 +		err = bcma_get_next_core(bus, &eromptr, NULL, core_num, core);
-+		if (err == -ENODEV) {
-+			core_num++;
-+			continue;
-+		} else if (err == -ENXIO)
-+			continue;
-+		else if (err == -ESPIPE)
-+			break;
-+		else if (err < 0)
++		if (err < 0) {
++			kfree(core);
++			if (err == -ENODEV) {
++				core_num++;
++				continue;
++			} else if (err == -ENXIO) {
++				continue;
++			} else if (err == -ESPIPE) {
++				break;
++			}
 +			return err;
++		}
 +
 +		core->core_index = core_num++;
 +		bus->nr_cores++;
++		other_core = bcma_find_core_reverse(bus, core->id.id);
++		core->core_unit = (other_core == NULL) ? 0 : other_core->core_unit + 1;
 +
 +		pr_info("Core %d found: %s "
 +			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
@@ -2276,7 +2317,7 @@
 +#endif /* BCMA_SCAN_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma.h
-@@ -0,0 +1,298 @@
+@@ -0,0 +1,307 @@
 +#ifndef LINUX_BCMA_H_
 +#define LINUX_BCMA_H_
 +
@@ -2415,6 +2456,7 @@
 +	bool dev_registered;
 +
 +	u8 core_index;
++	u8 core_unit;
 +
 +	u32 addr;
 +	u32 wrap;
@@ -2441,7 +2483,7 @@
 +
 +	int (*probe)(struct bcma_device *dev);
 +	void (*remove)(struct bcma_device *dev);
-+	int (*suspend)(struct bcma_device *dev, pm_message_t state);
++	int (*suspend)(struct bcma_device *dev);
 +	int (*resume)(struct bcma_device *dev);
 +	void (*shutdown)(struct bcma_device *dev);
 +
@@ -2454,6 +2496,12 @@
 +
 +extern void bcma_driver_unregister(struct bcma_driver *drv);
 +
++/* Set a fallback SPROM.
++ * See kdoc at the function definition for complete documentation. */
++extern int bcma_arch_register_fallback_sprom(
++		int (*sprom_callback)(struct bcma_bus *bus,
++		struct ssb_sprom *out));
++
 +struct bcma_bus {
 +	/* The MMIO area. */
 +	void __iomem *mmio;
@@ -2474,6 +2522,7 @@
 +	struct list_head cores;
 +	u8 nr_cores;
 +	u8 init_done:1;
++	u8 num;
 +
 +	struct bcma_drv_cc drv_cc;
 +	struct bcma_drv_pci drv_pci;
@@ -2561,6 +2610,7 @@
 +	bcma_write16(cc, offset, (bcma_read16(cc, offset) & mask) | set);
 +}
 +
++extern struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid);
 +extern bool bcma_core_is_enabled(struct bcma_device *core);
 +extern void bcma_core_disable(struct bcma_device *core, u32 flags);
 +extern int bcma_core_enable(struct bcma_device *core, u32 flags);
@@ -2577,7 +2627,7 @@
 +#endif /* LINUX_BCMA_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_driver_chipcommon.h
-@@ -0,0 +1,391 @@
+@@ -0,0 +1,415 @@
 +#ifndef LINUX_BCMA_DRIVER_CC_H_
 +#define LINUX_BCMA_DRIVER_CC_H_
 +
@@ -2636,6 +2686,9 @@
 +#define	 BCMA_CC_OTPS_HW_PROTECT	0x00000001
 +#define	 BCMA_CC_OTPS_SW_PROTECT	0x00000002
 +#define	 BCMA_CC_OTPS_CID_PROTECT	0x00000004
++#define  BCMA_CC_OTPS_GU_PROG_IND	0x00000F00	/* General Use programmed indication */
++#define  BCMA_CC_OTPS_GU_PROG_IND_SHIFT	8
++#define  BCMA_CC_OTPS_GU_PROG_HW	0x00000100	/* HW region programmed */
 +#define BCMA_CC_OTPC			0x0014		/* OTP control */
 +#define	 BCMA_CC_OTPC_RECWAIT		0xFF000000
 +#define	 BCMA_CC_OTPC_PROGWAIT		0x00FFFF00
@@ -2652,6 +2705,8 @@
 +#define	 BCMA_CC_OTPP_READ		0x40000000
 +#define	 BCMA_CC_OTPP_START		0x80000000
 +#define	 BCMA_CC_OTPP_BUSY		0x80000000
++#define BCMA_CC_OTPL			0x001C		/* OTP layout */
++#define  BCMA_CC_OTPL_GURGN_OFFSET	0x00000FFF	/* offset of general use region */
 +#define BCMA_CC_IRQSTAT			0x0020
 +#define BCMA_CC_IRQMASK			0x0024
 +#define	 BCMA_CC_IRQ_GPIO		0x00000001	/* gpio intr */
@@ -2659,6 +2714,10 @@
 +#define	 BCMA_CC_IRQ_WDRESET		0x80000000	/* watchdog reset occurred */
 +#define BCMA_CC_CHIPCTL			0x0028		/* Rev >= 11 only */
 +#define BCMA_CC_CHIPSTAT		0x002C		/* Rev >= 11 only */
++#define  BCMA_CC_CHIPST_4313_SPROM_PRESENT	1
++#define  BCMA_CC_CHIPST_4313_OTP_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_SPROM_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_OTP_PRESENT	4
 +#define BCMA_CC_JCMD			0x0030		/* Rev >= 10 only */
 +#define  BCMA_CC_JCMD_START		0x80000000
 +#define  BCMA_CC_JCMD_BUSY		0x80000000
@@ -2761,6 +2820,22 @@
 +#define BCMA_CC_FLASH_CFG		0x0128
 +#define  BCMA_CC_FLASH_CFG_DS		0x0010	/* Data size, 0=8bit, 1=16bit */
 +#define BCMA_CC_FLASH_WAITCNT		0x012C
++#define BCMA_CC_SROM_CONTROL		0x0190
++#define  BCMA_CC_SROM_CONTROL_START	0x80000000
++#define  BCMA_CC_SROM_CONTROL_BUSY	0x80000000
++#define  BCMA_CC_SROM_CONTROL_OPCODE	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OP_READ	0x00000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRITE	0x20000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRDIS	0x40000000
++#define  BCMA_CC_SROM_CONTROL_OP_WREN	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OTPSEL	0x00000010
++#define  BCMA_CC_SROM_CONTROL_LOCK	0x00000008
++#define  BCMA_CC_SROM_CONTROL_SIZE_MASK	0x00000006
++#define  BCMA_CC_SROM_CONTROL_SIZE_1K	0x00000000
++#define  BCMA_CC_SROM_CONTROL_SIZE_4K	0x00000002
++#define  BCMA_CC_SROM_CONTROL_SIZE_16K	0x00000004
++#define  BCMA_CC_SROM_CONTROL_SIZE_SHIFT	1
++#define  BCMA_CC_SROM_CONTROL_PRESENT	0x00000001
 +/* 0x1E0 is defined as shared BCMA_CLKCTLST */
 +#define BCMA_CC_HW_WORKAROUND		0x01E4 /* Hardware workaround (rev >= 20) */
 +#define BCMA_CC_UART0_DATA		0x0300
@@ -2820,7 +2895,6 @@
 +#define BCMA_CC_PLLCTL_ADDR		0x0660
 +#define BCMA_CC_PLLCTL_DATA		0x0664
 +#define BCMA_CC_SPROM			0x0800 /* SPROM beginning */
-+#define BCMA_CC_SPROM_PCIE6		0x0830 /* SPROM beginning on PCIe rev >= 6 */
 +
 +/* Divider allocation in 4716/47162/5356 */
 +#define BCMA_CC_PMU5_MAINPLL_CPU	1
@@ -2971,7 +3045,7 @@
 +#endif /* LINUX_BCMA_DRIVER_CC_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_driver_pci.h
-@@ -0,0 +1,91 @@
+@@ -0,0 +1,214 @@
 +#ifndef LINUX_BCMA_DRIVER_PCI_H_
 +#define LINUX_BCMA_DRIVER_PCI_H_
 +
@@ -3027,6 +3101,35 @@
 +#define  BCMA_CORE_PCI_SBTOPCI1_MASK		0xFC000000
 +#define BCMA_CORE_PCI_SBTOPCI2			0x0108	/* Backplane to PCI translation 2 (sbtopci2) */
 +#define  BCMA_CORE_PCI_SBTOPCI2_MASK		0xC0000000
++#define BCMA_CORE_PCI_CONFIG_ADDR		0x0120	/* pcie config space access */
++#define BCMA_CORE_PCI_CONFIG_DATA		0x0124	/* pcie config space access */
++#define BCMA_CORE_PCI_MDIO_CONTROL		0x0128	/* controls the mdio access */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_MASK	0x7f	/* clock to be used on MDIO */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL	0x2
++#define  BCMA_CORE_PCI_MDIOCTL_PREAM_EN		0x80	/* Enable preamble sequnce */
++#define  BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE	0x100	/* Tranaction complete */
++#define BCMA_CORE_PCI_MDIO_DATA			0x012c	/* Data to the mdio access */
++#define  BCMA_CORE_PCI_MDIODATA_MASK		0x0000ffff /* data 2 bytes */
++#define  BCMA_CORE_PCI_MDIODATA_TA		0x00020000 /* Turnaround */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD	18	/* Regaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK_OLD	0x003c0000 /* Regaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD	22	/* Physmedia devaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK_OLD	0x0fc00000 /* Physmedia devaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF	18	/* Regaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK	0x007c0000 /* Regaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF	23	/* Physmedia devaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK	0x0f800000 /* Physmedia devaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_WRITE		0x10000000 /* write Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_READ		0x20000000 /* Read Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_START		0x40000000 /* start of Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_ADDR	0x0	/* dev address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_BLK_ADDR	0x1F	/* blk address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_PLL		0x1d	/* SERDES PLL Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_TX		0x1e	/* SERDES TX Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_RX		0x1f	/* SERDES RX Dev */
++#define BCMA_CORE_PCI_PCIEIND_ADDR		0x0130	/* indirect access to the internal register */
++#define BCMA_CORE_PCI_PCIEIND_DATA		0x0134	/* Data to/from the internal regsiter */
++#define BCMA_CORE_PCI_CLKREQENCTRL		0x0138	/*  >= rev 6, Clkreq rdma control */
 +#define BCMA_CORE_PCI_PCICFG0			0x0400	/* PCI config space 0 (rev >= 8) */
 +#define BCMA_CORE_PCI_PCICFG1			0x0500	/* PCI config space 1 (rev >= 8) */
 +#define BCMA_CORE_PCI_PCICFG2			0x0600	/* PCI config space 2 (rev >= 8) */
@@ -3046,26 +3149,120 @@
 +#define  BCMA_CORE_PCI_SBTOPCI_RC_READL		0x00000010 /* Memory read line */
 +#define  BCMA_CORE_PCI_SBTOPCI_RC_READM		0x00000020 /* Memory read multiple */
 +
++/* PCIE protocol PHY diagnostic registers */
++#define BCMA_CORE_PCI_PLP_MODEREG		0x200	/* Mode */
++#define BCMA_CORE_PCI_PLP_STATUSREG		0x204	/* Status */
++#define  BCMA_CORE_PCI_PLP_POLARITYINV_STAT	0x10	/* Status reg PCIE_PLP_STATUSREG */
++#define BCMA_CORE_PCI_PLP_LTSSMCTRLREG		0x208	/* LTSSM control */
++#define BCMA_CORE_PCI_PLP_LTLINKNUMREG		0x20c	/* Link Training Link number */
++#define BCMA_CORE_PCI_PLP_LTLANENUMREG		0x210	/* Link Training Lane number */
++#define BCMA_CORE_PCI_PLP_LTNFTSREG		0x214	/* Link Training N_FTS */
++#define BCMA_CORE_PCI_PLP_ATTNREG		0x218	/* Attention */
++#define BCMA_CORE_PCI_PLP_ATTNMASKREG		0x21C	/* Attention Mask */
++#define BCMA_CORE_PCI_PLP_RXERRCTR		0x220	/* Rx Error */
++#define BCMA_CORE_PCI_PLP_RXFRMERRCTR		0x224	/* Rx Framing Error */
++#define BCMA_CORE_PCI_PLP_RXERRTHRESHREG	0x228	/* Rx Error threshold */
++#define BCMA_CORE_PCI_PLP_TESTCTRLREG		0x22C	/* Test Control reg */
++#define BCMA_CORE_PCI_PLP_SERDESCTRLOVRDREG	0x230	/* SERDES Control Override */
++#define BCMA_CORE_PCI_PLP_TIMINGOVRDREG		0x234	/* Timing param override */
++#define BCMA_CORE_PCI_PLP_RXTXSMDIAGREG		0x238	/* RXTX State Machine Diag */
++#define BCMA_CORE_PCI_PLP_LTSSMDIAGREG		0x23C	/* LTSSM State Machine Diag */
++
++/* PCIE protocol DLLP diagnostic registers */
++#define BCMA_CORE_PCI_DLLP_LCREG		0x100	/* Link Control */
++#define BCMA_CORE_PCI_DLLP_LSREG		0x104	/* Link Status */
++#define BCMA_CORE_PCI_DLLP_LAREG		0x108	/* Link Attention */
++#define  BCMA_CORE_PCI_DLLP_LSREG_LINKUP	(1 << 16)
++#define BCMA_CORE_PCI_DLLP_LAMASKREG		0x10C	/* Link Attention Mask */
++#define BCMA_CORE_PCI_DLLP_NEXTTXSEQNUMREG	0x110	/* Next Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_ACKEDTXSEQNUMREG	0x114	/* Acked Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_PURGEDTXSEQNUMREG	0x118	/* Purged Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_RXSEQNUMREG		0x11C	/* Rx Sequence Number */
++#define BCMA_CORE_PCI_DLLP_LRREG		0x120	/* Link Replay */
++#define BCMA_CORE_PCI_DLLP_LACKTOREG		0x124	/* Link Ack Timeout */
++#define BCMA_CORE_PCI_DLLP_PMTHRESHREG		0x128	/* Power Management Threshold */
++#define BCMA_CORE_PCI_DLLP_RTRYWPREG		0x12C	/* Retry buffer write ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYRPREG		0x130	/* Retry buffer Read ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYPPREG		0x134	/* Retry buffer Purged ptr */
++#define BCMA_CORE_PCI_DLLP_RTRRWREG		0x138	/* Retry buffer Read/Write */
++#define BCMA_CORE_PCI_DLLP_ECTHRESHREG		0x13C	/* Error Count Threshold */
++#define BCMA_CORE_PCI_DLLP_TLPERRCTRREG		0x140	/* TLP Error Counter */
++#define BCMA_CORE_PCI_DLLP_ERRCTRREG		0x144	/* Error Counter */
++#define BCMA_CORE_PCI_DLLP_NAKRXCTRREG		0x148	/* NAK Received Counter */
++#define BCMA_CORE_PCI_DLLP_TESTREG		0x14C	/* Test */
++#define BCMA_CORE_PCI_DLLP_PKTBIST		0x150	/* Packet BIST */
++#define BCMA_CORE_PCI_DLLP_PCIE11		0x154	/* DLLP PCIE 1.1 reg */
++
++/* SERDES RX registers */
++#define BCMA_CORE_PCI_SERDES_RX_CTRL		1	/* Rx cntrl */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE	0x80	/* rxpolarity_force */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY	0x40	/* rxpolarity_value */
++#define BCMA_CORE_PCI_SERDES_RX_TIMER1		2	/* Rx Timer1 */
++#define BCMA_CORE_PCI_SERDES_RX_CDR		6	/* CDR */
++#define BCMA_CORE_PCI_SERDES_RX_CDRBW		7	/* CDR BW */
++
++/* SERDES PLL registers */
++#define BCMA_CORE_PCI_SERDES_PLL_CTRL		1	/* PLL control reg */
++#define BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN	0x4000	/* bit 14 is FREQDET on */
++
 +/* PCIcore specific boardflags */
 +#define BCMA_CORE_PCI_BFL_NOPCI			0x00000400 /* Board leaves PCI floating */
 +
++/* PCIE Config space accessing MACROS */
++#define BCMA_CORE_PCI_CFG_BUS_SHIFT		24	/* Bus shift */
++#define BCMA_CORE_PCI_CFG_SLOT_SHIFT		19	/* Slot/Device shift */
++#define BCMA_CORE_PCI_CFG_FUN_SHIFT		16	/* Function shift */
++#define BCMA_CORE_PCI_CFG_OFF_SHIFT		0	/* Register shift */
++
++#define BCMA_CORE_PCI_CFG_BUS_MASK		0xff	/* Bus mask */
++#define BCMA_CORE_PCI_CFG_SLOT_MASK		0x1f	/* Slot/Device mask */
++#define BCMA_CORE_PCI_CFG_FUN_MASK		7	/* Function mask */
++#define BCMA_CORE_PCI_CFG_OFF_MASK		0xfff	/* Register mask */
++
++/* PCIE Root Capability Register bits (Host mode only) */
++#define BCMA_CORE_PCI_RC_CRS_VISIBILITY		0x0001
++
++struct bcma_drv_pci;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++struct bcma_drv_pci_host {
++	struct bcma_drv_pci *pdev;
++
++	u32 host_cfg_addr;
++	spinlock_t cfgspace_lock;
++
++	struct pci_controller pci_controller;
++	struct pci_ops pci_ops;
++	struct resource mem_resource;
++	struct resource io_resource;
++};
++#endif
++
 +struct bcma_drv_pci {
 +	struct bcma_device *core;
 +	u8 setup_done:1;
++	u8 hostmode:1;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	struct bcma_drv_pci_host *host_controller;
++#endif
 +};
 +
 +/* Register access */
 +#define pcicore_read32(pc, offset)		bcma_read32((pc)->core, offset)
 +#define pcicore_write32(pc, offset, val)	bcma_write32((pc)->core, offset, val)
 +
-+extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
++extern void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc);
 +extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
 +				 struct bcma_device *core, bool enable);
 +
++extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
++extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
++
 +#endif /* LINUX_BCMA_DRIVER_PCI_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_regs.h
-@@ -0,0 +1,59 @@
+@@ -0,0 +1,86 @@
 +#ifndef LINUX_BCMA_REGS_H_
 +#define LINUX_BCMA_REGS_H_
 +
@@ -3124,6 +3321,33 @@
 +#define  BCMA_PCI_GPIO_XTAL		0x40	/* PCI config space GPIO 14 for Xtal powerup */
 +#define  BCMA_PCI_GPIO_PLL		0x80	/* PCI config space GPIO 15 for PLL powerdown */
 +
++/* SiliconBackplane Address Map.
++ * All regions may not exist on all chips.
++ */
++#define BCMA_SOC_SDRAM_BASE		0x00000000U	/* Physical SDRAM */
++#define BCMA_SOC_PCI_MEM		0x08000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI_MEM_SZ		(64 * 1024 * 1024)
++#define BCMA_SOC_PCI_CFG		0x0c000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_SDRAM_SWAPPED		0x10000000U	/* Byteswapped Physical SDRAM */
++#define BCMA_SOC_SDRAM_R2		0x80000000U	/* Region 2 for sdram (512 MB) */
++
++
++#define BCMA_SOC_PCI_DMA		0x40000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA2		0x80000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA_SZ		0x40000000U	/* Client Mode sb2pcitranslation2 size in bytes */
++#define BCMA_SOC_PCIE_DMA_L32		0x00000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), low 32 bits
++							 */
++#define BCMA_SOC_PCIE_DMA_H32		0x80000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
++#define BCMA_SOC_PCI1_MEM		0x40000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI1_CFG		0x44000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_PCIE1_DMA_H32		0xc0000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
 +#endif /* LINUX_BCMA_REGS_H_ */
 --- a/include/linux/mod_devicetable.h
 +++ b/include/linux/mod_devicetable.h
@@ -3191,11 +3415,13 @@
  			 sizeof(struct virtio_device_id), "virtio",
 --- /dev/null
 +++ b/drivers/bcma/sprom.c
-@@ -0,0 +1,247 @@
+@@ -0,0 +1,450 @@
 +/*
 + * Broadcom specific AMBA
 + * SPROM reading
 + *
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
@@ -3208,7 +3434,57 @@
 +#include <linux/dma-mapping.h>
 +#include <linux/slab.h>
 +
-+#define SPOFF(offset)	((offset) / sizeof(u16))
++static int(*get_fallback_sprom)(struct bcma_bus *dev, struct ssb_sprom *out);
++
++/**
++ * bcma_arch_register_fallback_sprom - Registers a method providing a
++ * fallback SPROM if no SPROM is found.
++ *
++ * @sprom_callback: The callback function.
++ *
++ * With this function the architecture implementation may register a
++ * callback handler which fills the SPROM data structure. The fallback is
++ * used for PCI based BCMA devices, where no valid SPROM can be found
++ * in the shadow registers and to provide the SPROM for SoCs where BCMA is
++ * to controll the system bus.
++ *
++ * This function is useful for weird architectures that have a half-assed
++ * BCMA device hardwired to their PCI bus.
++ *
++ * This function is available for architecture code, only. So it is not
++ * exported.
++ */
++int bcma_arch_register_fallback_sprom(int (*sprom_callback)(struct bcma_bus *bus,
++				     struct ssb_sprom *out))
++{
++	if (get_fallback_sprom)
++		return -EEXIST;
++	get_fallback_sprom = sprom_callback;
++
++	return 0;
++}
++
++static int bcma_fill_sprom_with_fallback(struct bcma_bus *bus,
++					 struct ssb_sprom *out)
++{
++	int err;
++
++	if (!get_fallback_sprom) {
++		err = -ENOENT;
++		goto fail;
++	}
++
++	err = get_fallback_sprom(bus, out);
++	if (err)
++		goto fail;
++
++	pr_debug("Using SPROM revision %d provided by"
++		 " platform.\n", bus->sprom.revision);
++	return 0;
++fail:
++	pr_warning("Using fallback SPROM failed (err %d)\n", err);
++	return err;
++}
 +
 +/**************************************************
 + * R/W ops.
@@ -3318,10 +3594,21 @@
 + * SPROM extraction.
 + **************************************************/
 +
++#define SPOFF(offset)	((offset) / sizeof(u16))
++
++#define SPEX(_field, _offset, _mask, _shift)	\
++	bus->sprom._field = ((sprom[SPOFF(_offset)] & (_mask)) >> (_shift))
++
 +static void bcma_sprom_extract_r8(struct bcma_bus *bus, const u16 *sprom)
 +{
-+	u16 v;
++	u16 v, o;
 +	int i;
++	u16 pwr_info_offset[] = {
++		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
++		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
++	};
++	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
++			ARRAY_SIZE(bus->sprom.core_pwr_info));
 +
 +	bus->sprom.revision = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] &
 +		SSB_SPROM_REVISION_REV;
@@ -3331,85 +3618,229 @@
 +		*(((__be16 *)bus->sprom.il0mac) + i) = cpu_to_be16(v);
 +	}
 +
-+	bus->sprom.board_rev = sprom[SPOFF(SSB_SPROM8_BOARDREV)];
-+
-+	bus->sprom.txpid2g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G0) >> SSB_SPROM4_TXPID2G0_SHIFT;
-+	bus->sprom.txpid2g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G1) >> SSB_SPROM4_TXPID2G1_SHIFT;
-+	bus->sprom.txpid2g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G2) >> SSB_SPROM4_TXPID2G2_SHIFT;
-+	bus->sprom.txpid2g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G3) >> SSB_SPROM4_TXPID2G3_SHIFT;
-+
-+	bus->sprom.txpid5gl[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL0) >> SSB_SPROM4_TXPID5GL0_SHIFT;
-+	bus->sprom.txpid5gl[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL1) >> SSB_SPROM4_TXPID5GL1_SHIFT;
-+	bus->sprom.txpid5gl[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL2) >> SSB_SPROM4_TXPID5GL2_SHIFT;
-+	bus->sprom.txpid5gl[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL3) >> SSB_SPROM4_TXPID5GL3_SHIFT;
-+
-+	bus->sprom.txpid5g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G0) >> SSB_SPROM4_TXPID5G0_SHIFT;
-+	bus->sprom.txpid5g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G1) >> SSB_SPROM4_TXPID5G1_SHIFT;
-+	bus->sprom.txpid5g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G2) >> SSB_SPROM4_TXPID5G2_SHIFT;
-+	bus->sprom.txpid5g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G3) >> SSB_SPROM4_TXPID5G3_SHIFT;
-+
-+	bus->sprom.txpid5gh[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH0) >> SSB_SPROM4_TXPID5GH0_SHIFT;
-+	bus->sprom.txpid5gh[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH1) >> SSB_SPROM4_TXPID5GH1_SHIFT;
-+	bus->sprom.txpid5gh[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH2) >> SSB_SPROM4_TXPID5GH2_SHIFT;
-+	bus->sprom.txpid5gh[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH3) >> SSB_SPROM4_TXPID5GH3_SHIFT;
-+
-+	bus->sprom.boardflags_lo = sprom[SPOFF(SSB_SPROM8_BFLLO)];
-+	bus->sprom.boardflags_hi = sprom[SPOFF(SSB_SPROM8_BFLHI)];
-+	bus->sprom.boardflags2_lo = sprom[SPOFF(SSB_SPROM8_BFL2LO)];
-+	bus->sprom.boardflags2_hi = sprom[SPOFF(SSB_SPROM8_BFL2HI)];
-+
-+	bus->sprom.country_code = sprom[SPOFF(SSB_SPROM8_CCODE)];
-+
-+	bus->sprom.fem.ghz2.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz2.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz2.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz2.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz2.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
-+
-+	bus->sprom.fem.ghz5.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz5.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz5.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz5.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz5.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
++	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
++
++	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
++	     SSB_SPROM4_TXPID2G0_SHIFT);
++	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
++	     SSB_SPROM4_TXPID2G1_SHIFT);
++	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
++	     SSB_SPROM4_TXPID2G2_SHIFT);
++	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
++	     SSB_SPROM4_TXPID2G3_SHIFT);
++
++	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
++	     SSB_SPROM4_TXPID5GL0_SHIFT);
++	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
++	     SSB_SPROM4_TXPID5GL1_SHIFT);
++	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
++	     SSB_SPROM4_TXPID5GL2_SHIFT);
++	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
++	     SSB_SPROM4_TXPID5GL3_SHIFT);
++
++	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
++	     SSB_SPROM4_TXPID5G0_SHIFT);
++	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
++	     SSB_SPROM4_TXPID5G1_SHIFT);
++	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
++	     SSB_SPROM4_TXPID5G2_SHIFT);
++	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
++	     SSB_SPROM4_TXPID5G3_SHIFT);
++
++	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
++	     SSB_SPROM4_TXPID5GH0_SHIFT);
++	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
++	     SSB_SPROM4_TXPID5GH1_SHIFT);
++	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
++	     SSB_SPROM4_TXPID5GH2_SHIFT);
++	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
++	     SSB_SPROM4_TXPID5GH3_SHIFT);
++
++	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
++	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
++	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
++	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
++
++	SPEX(country_code, SSB_SPROM8_CCODE, ~0, 0);
++
++	/* Extract cores power info info */
++	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
++		o = pwr_info_offset[i];
++		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_MAXP, 0);
++
++		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
++
++		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GH_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
++
++		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
++	}
++
++	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++
++	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++}
++
++/*
++ * Indicates the presence of external SPROM.
++ */
++static bool bcma_sprom_ext_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 srom_control;
++	u32 present_mask;
++
++	if (bus->drv_cc.core->id.rev >= 31) {
++		if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
++			return false;
++
++		srom_control = bcma_read32(bus->drv_cc.core,
++					   BCMA_CC_SROM_CONTROL);
++		return srom_control & BCMA_CC_SROM_CONTROL_PRESENT;
++	}
++
++	/* older chipcommon revisions use chip status register */
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present_mask = BCMA_CC_CHIPST_4313_SPROM_PRESENT;
++		break;
++
++	case 0x4331:
++		present_mask = BCMA_CC_CHIPST_4331_SPROM_PRESENT;
++		break;
++
++	default:
++		return true;
++	}
++
++	return chip_status & present_mask;
++}
++
++/*
++ * Indicates that on-chip OTP memory is present and enabled.
++ */
++static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 otpsize = 0;
++	bool present;
++
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present = chip_status & BCMA_CC_CHIPST_4313_OTP_PRESENT;
++		break;
++
++	case 0x4331:
++		present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
++		break;
++
++	case 43224:
++	case 43225:
++		/* for these chips OTP is always available */
++		present = true;
++		break;
++
++	default:
++		present = false;
++		break;
++	}
++
++	if (present) {
++		otpsize = bus->drv_cc.capabilities & BCMA_CC_CAP_OTPS;
++		otpsize >>= BCMA_CC_CAP_OTPS_SHIFT;
++	}
++
++	return otpsize != 0;
++}
++
++/*
++ * Verify OTP is filled and determine the byte
++ * offset where SPROM data is located.
++ *
++ * On error, returns 0; byte offset otherwise.
++ */
++static int bcma_sprom_onchip_offset(struct bcma_bus *bus)
++{
++	struct bcma_device *cc = bus->drv_cc.core;
++	u32 offset;
++
++	/* verify OTP status */
++	if ((bcma_read32(cc, BCMA_CC_OTPS) & BCMA_CC_OTPS_GU_PROG_HW) == 0)
++		return 0;
++
++	/* obtain bit offset from otplayout register */
++	offset = (bcma_read32(cc, BCMA_CC_OTPL) & BCMA_CC_OTPL_GURGN_OFFSET);
++	return BCMA_CC_SPROM + (offset >> 3);
 +}
 +
 +int bcma_sprom_get(struct bcma_bus *bus)
 +{
-+	u16 offset;
++	u16 offset = BCMA_CC_SPROM;
 +	u16 *sprom;
 +	int err = 0;
 +
 +	if (!bus->drv_cc.core)
 +		return -EOPNOTSUPP;
 +
-+	if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
-+		return -ENOENT;
++	if (!bcma_sprom_ext_available(bus)) {
++		/*
++		 * External SPROM takes precedence so check
++		 * on-chip OTP only when no external SPROM
++		 * is present.
++		 */
++		if (bcma_sprom_onchip_available(bus)) {
++			/* determine offset */
++			offset = bcma_sprom_onchip_offset(bus);
++		}
++		if (!offset) {
++			/*
++			 * Maybe there is no SPROM on the device?
++			 * Now we ask the arch code if there is some sprom
++			 * available for this device in some other storage.
++			 */
++			err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
++			return err;
++		}
++	}
 +
 +	sprom = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
 +			GFP_KERNEL);
@@ -3419,11 +3850,7 @@
 +	if (bus->chipinfo.id == 0x4331)
 +		bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
 +
-+	/* Most cards have SPROM moved by additional offset 0x30 (48 dwords).
-+	 * According to brcm80211 this applies to cards with PCIe rev >= 6
-+	 * TODO: understand this condition and use it */
-+	offset = (bus->chipinfo.id == 0x4331) ? BCMA_CC_SPROM :
-+		BCMA_CC_SPROM_PCIE6;
++	pr_debug("SPROM offset 0x%x\n", offset);
 +	bcma_sprom_read(bus, offset, sprom);
 +
 +	if (bus->chipinfo.id == 0x4331)
@@ -3441,21 +3868,596 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/driver_pci_host.c
-@@ -0,0 +1,14 @@
+@@ -0,0 +1,589 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Core in hostmode
 + *
++ * Copyright 2005 - 2011, Broadcom Corporation
++ * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
 +#include "bcma_private.h"
++#include <linux/pci.h>
++#include <linux/export.h>
 +#include <linux/bcma/bcma.h>
++#include <asm/paccess.h>
++
++/* Probe a 32bit value on the bus and catch bus exceptions.
++ * Returns nonzero on a bus exception.
++ * This is MIPS specific */
++#define mips_busprobe32(val, addr)	get_dbe((val), ((u32 *)(addr)))
++
++/* Assume one-hot slot wiring */
++#define BCMA_PCI_SLOT_MAX	16
++#define	PCI_CONFIG_SPACE_SIZE	256
++
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	u16 chipid_top;
++	u32 tmp;
++
++	chipid_top = (bus->chipinfo.id & 0xFF00);
++	if (chipid_top != 0x4700 &&
++	    chipid_top != 0x5300)
++		return false;
++
++	if (bus->sprom.boardflags_lo & BCMA_CORE_PCI_BFL_NOPCI) {
++		pr_info("This PCI core is disabled and not working\n");
++		return false;
++	}
 +
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++	bcma_core_enable(pc->core, 0);
++
++	return !mips_busprobe32(tmp, pc->core->io_addr);
++}
++
++static u32 bcma_pcie_read_config(struct bcma_drv_pci *pc, u32 address)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_DATA);
++}
++
++static void bcma_pcie_write_config(struct bcma_drv_pci *pc, u32 address,
++				   u32 data)
 +{
-+	pr_err("No support for PCI core in hostmode yet\n");
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_DATA, data);
++}
++
++static u32 bcma_get_cfgspace_addr(struct bcma_drv_pci *pc, unsigned int dev,
++			     unsigned int func, unsigned int off)
++{
++	u32 addr = 0;
++
++	/* Issue config commands only when the data link is up (atleast
++	 * one external pcie device is present).
++	 */
++	if (dev >= 2 || !(bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_LSREG)
++			  & BCMA_CORE_PCI_DLLP_LSREG_LINKUP))
++		goto out;
++
++	/* Type 0 transaction */
++	/* Slide the PCI window to the appropriate slot */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++	/* Calculate the address */
++	addr = pc->host_controller->host_cfg_addr;
++	addr |= (dev << BCMA_CORE_PCI_CFG_SLOT_SHIFT);
++	addr |= (func << BCMA_CORE_PCI_CFG_FUN_SHIFT);
++	addr |= (off & ~3);
++
++out:
++	return addr;
++}
++
++static int bcma_extpci_read_config(struct bcma_drv_pci *pc, unsigned int dev,
++				  unsigned int func, unsigned int off,
++				  void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr, val;
++	void __iomem *mmio = 0;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* we support only two functions on device 0 */
++		if (func > 1)
++			return -EINVAL;
++
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off >= PCI_CONFIG_SPACE_SIZE) {
++			addr = (func << 12);
++			addr |= (off & 0x0FFF);
++			val = bcma_pcie_read_config(pc, addr);
++		} else {
++			addr = BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			val = pcicore_read32(pc, addr);
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++
++		val = readl(mmio);
++	}
++	val >>= (8 * (off & 3));
++
++	switch (len) {
++	case 1:
++		*((u8 *)buf) = (u8)val;
++		break;
++	case 2:
++		*((u16 *)buf) = (u16)val;
++		break;
++	case 4:
++		*((u32 *)buf) = (u32)val;
++		break;
++	}
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
++				   unsigned int func, unsigned int off,
++				   const void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr = 0, val = 0;
++	void __iomem *mmio = 0;
++	u16 chipid = pc->core->bus->chipinfo.id;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off < PCI_CONFIG_SPACE_SIZE) {
++			addr = pc->core->addr + BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			mmio = ioremap_nocache(addr, len);
++			if (!mmio)
++				goto out;
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++	}
++
++	switch (len) {
++	case 1:
++		val = readl(mmio);
++		val &= ~(0xFF << (8 * (off & 3)));
++		val |= *((const u8 *)buf) << (8 * (off & 3));
++		break;
++	case 2:
++		val = readl(mmio);
++		val &= ~(0xFFFF << (8 * (off & 3)));
++		val |= *((const u16 *)buf) << (8 * (off & 3));
++		break;
++	case 4:
++		val = *((const u32 *)buf);
++		break;
++	}
++	if (dev == 0 && !addr) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		addr = (func << 12);
++		addr |= (off & 0x0FFF);
++		bcma_pcie_write_config(pc, addr, val);
++	} else {
++		writel(val, mmio);
++
++		if (chipid == 0x4716 || chipid == 0x4748)
++			readl(mmio);
++	}
++
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_core_pci_hostmode_read_config(struct pci_bus *bus,
++					      unsigned int devfn,
++					      int reg, int size, u32 *val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_read_config(pc, PCI_SLOT(devfn),
++				     PCI_FUNC(devfn), reg, val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++static int bcma_core_pci_hostmode_write_config(struct pci_bus *bus,
++					       unsigned int devfn,
++					       int reg, int size, u32 val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_write_config(pc, PCI_SLOT(devfn),
++				      PCI_FUNC(devfn), reg, &val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++/* return cap_offset if requested capability exists in the PCI config space */
++static u8 __devinit bcma_find_pci_capability(struct bcma_drv_pci *pc,
++					     unsigned int dev,
++					     unsigned int func, u8 req_cap_id,
++					     unsigned char *buf, u32 *buflen)
++{
++	u8 cap_id;
++	u8 cap_ptr = 0;
++	u32 bufsize;
++	u8 byte_val;
++
++	/* check for Header type 0 */
++	bcma_extpci_read_config(pc, dev, func, PCI_HEADER_TYPE, &byte_val,
++				sizeof(u8));
++	if ((byte_val & 0x7f) != PCI_HEADER_TYPE_NORMAL)
++		return cap_ptr;
++
++	/* check if the capability pointer field exists */
++	bcma_extpci_read_config(pc, dev, func, PCI_STATUS, &byte_val,
++				sizeof(u8));
++	if (!(byte_val & PCI_STATUS_CAP_LIST))
++		return cap_ptr;
++
++	/* check if the capability pointer is 0x00 */
++	bcma_extpci_read_config(pc, dev, func, PCI_CAPABILITY_LIST, &cap_ptr,
++				sizeof(u8));
++	if (cap_ptr == 0x00)
++		return cap_ptr;
++
++	/* loop thr'u the capability list and see if the requested capabilty
++	 * exists */
++	bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id, sizeof(u8));
++	while (cap_id != req_cap_id) {
++		bcma_extpci_read_config(pc, dev, func, cap_ptr + 1, &cap_ptr,
++					sizeof(u8));
++		if (cap_ptr == 0x00)
++			return cap_ptr;
++		bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id,
++					sizeof(u8));
++	}
++
++	/* found the caller requested capability */
++	if ((buf != NULL) && (buflen != NULL)) {
++		u8 cap_data;
++
++		bufsize = *buflen;
++		if (!bufsize)
++			return cap_ptr;
++
++		*buflen = 0;
++
++		/* copy the cpability data excluding cap ID and next ptr */
++		cap_data = cap_ptr + 2;
++		if ((bufsize + cap_data)  > PCI_CONFIG_SPACE_SIZE)
++			bufsize = PCI_CONFIG_SPACE_SIZE - cap_data;
++		*buflen = bufsize;
++		while (bufsize--) {
++			bcma_extpci_read_config(pc, dev, func, cap_data, buf,
++						sizeof(u8));
++			cap_data++;
++			buf++;
++		}
++	}
++
++	return cap_ptr;
++}
++
++/* If the root port is capable of returning Config Request
++ * Retry Status (CRS) Completion Status to software then
++ * enable the feature.
++ */
++static void __devinit bcma_core_pci_enable_crs(struct bcma_drv_pci *pc)
++{
++	u8 cap_ptr, root_ctrl, root_cap, dev;
++	u16 val16;
++	int i;
++
++	cap_ptr = bcma_find_pci_capability(pc, 0, 0, PCI_CAP_ID_EXP, NULL,
++					   NULL);
++	root_cap = cap_ptr + PCI_EXP_RTCAP;
++	bcma_extpci_read_config(pc, 0, 0, root_cap, &val16, sizeof(u16));
++	if (val16 & BCMA_CORE_PCI_RC_CRS_VISIBILITY) {
++		/* Enable CRS software visibility */
++		root_ctrl = cap_ptr + PCI_EXP_RTCTL;
++		val16 = PCI_EXP_RTCTL_CRSSVE;
++		bcma_extpci_read_config(pc, 0, 0, root_ctrl, &val16,
++					sizeof(u16));
++
++		/* Initiate a configuration request to read the vendor id
++		 * field of the device function's config space header after
++		 * 100 ms wait time from the end of Reset. If the device is
++		 * not done with its internal initialization, it must at
++		 * least return a completion TLP, with a completion status
++		 * of "Configuration Request Retry Status (CRS)". The root
++		 * complex must complete the request to the host by returning
++		 * a read-data value of 0001h for the Vendor ID field and
++		 * all 1s for any additional bytes included in the request.
++		 * Poll using the config reads for max wait time of 1 sec or
++		 * until we receive the successful completion status. Repeat
++		 * the procedure for all the devices.
++		 */
++		for (dev = 1; dev < BCMA_PCI_SLOT_MAX; dev++) {
++			for (i = 0; i < 100000; i++) {
++				bcma_extpci_read_config(pc, dev, 0,
++							PCI_VENDOR_ID, &val16,
++							sizeof(val16));
++				if (val16 != 0x1)
++					break;
++				udelay(10);
++			}
++			if (val16 == 0x1)
++				pr_err("PCI: Broken device in slot %d\n", dev);
++		}
++	}
++}
++
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	struct bcma_drv_pci_host *pc_host;
++	u32 tmp;
++	u32 pci_membase_1G;
++	unsigned long io_map_base;
++
++	pr_info("PCIEcore in host mode found\n");
++
++	pc_host = kzalloc(sizeof(*pc_host), GFP_KERNEL);
++	if (!pc_host)  {
++		pr_err("can not allocate memory");
++		return;
++	}
++
++	pc->host_controller = pc_host;
++	pc_host->pci_controller.io_resource = &pc_host->io_resource;
++	pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
++	pc_host->pci_controller.pci_ops = &pc_host->pci_ops;
++	pc_host->pdev = pc;
++
++	pci_membase_1G = BCMA_SOC_PCI_DMA;
++	pc_host->host_cfg_addr = BCMA_SOC_PCI_CFG;
++
++	pc_host->pci_ops.read = bcma_core_pci_hostmode_read_config;
++	pc_host->pci_ops.write = bcma_core_pci_hostmode_write_config;
++
++	pc_host->mem_resource.name = "BCMA PCIcore external memory",
++	pc_host->mem_resource.start = BCMA_SOC_PCI_DMA;
++	pc_host->mem_resource.end = BCMA_SOC_PCI_DMA + BCMA_SOC_PCI_DMA_SZ - 1;
++	pc_host->mem_resource.flags = IORESOURCE_MEM | IORESOURCE_PCI_FIXED;
++
++	pc_host->io_resource.name = "BCMA PCIcore external I/O",
++	pc_host->io_resource.start = 0x100;
++	pc_host->io_resource.end = 0x7FF;
++	pc_host->io_resource.flags = IORESOURCE_IO | IORESOURCE_PCI_FIXED;
++
++	/* Reset RC */
++	udelay(3000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST_OE);
++	udelay(1000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST |
++			BCMA_CORE_PCI_CTL_RST_OE);
++
++	/* 64 MB I/O access window. On 4716, use
++	 * sbtopcie0 to access the device registers. We
++	 * can't use address match 2 (1 GB window) region
++	 * as mips can't generate 64-bit address on the
++	 * backplane.
++	 */
++	if (bus->chipinfo.id == 0x4716 || bus->chipinfo.id == 0x4748) {
++		pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++		pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++					    BCMA_SOC_PCI_MEM_SZ - 1;
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_MEM | BCMA_SOC_PCI_MEM);
++	} else if (bus->chipinfo.id == 0x5300) {
++		tmp = BCMA_CORE_PCI_SBTOPCI_MEM;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_PREF;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_BURST;
++		if (pc->core->core_unit == 0) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE_DMA_H32;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI_MEM);
++		} else if (pc->core->core_unit == 1) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI1_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI1_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE1_DMA_H32;
++			pc_host->host_cfg_addr = BCMA_SOC_PCI1_CFG;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI1_MEM);
++		}
++	} else
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_IO);
++
++	/* 64 MB configuration access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++
++	/* 1 GB memory access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI2,
++			BCMA_CORE_PCI_SBTOPCI_MEM | pci_membase_1G);
++
++
++	/* As per PCI Express Base Spec 1.1 we need to wait for
++	 * at least 100 ms from the end of a reset (cold/warm/hot)
++	 * before issuing configuration requests to PCI Express
++	 * devices.
++	 */
++	udelay(100000);
++
++	bcma_core_pci_enable_crs(pc);
++
++	/* Enable PCI bridge BAR0 memory & master access */
++	tmp = PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
++	bcma_extpci_write_config(pc, 0, 0, PCI_COMMAND, &tmp, sizeof(tmp));
++
++	/* Enable PCI interrupts */
++	pcicore_write32(pc, BCMA_CORE_PCI_IMASK, BCMA_CORE_PCI_IMASK_INTA);
++
++	/* Ok, ready to run, register it to the system.
++	 * The following needs change, if we want to port hostmode
++	 * to non-MIPS platform. */
++	io_map_base = (unsigned long)ioremap_nocache(BCMA_SOC_PCI_MEM,
++						     0x04000000);
++	pc_host->pci_controller.io_map_base = io_map_base;
++	set_io_port_base(pc_host->pci_controller.io_map_base);
++	/* Give some time to the PCI controller to configure itself with the new
++	 * values. Not waiting at this point causes crashes of the machine. */
++	mdelay(10);
++	register_pci_controller(&pc_host->pci_controller);
++	return;
++}
++
++/* Early PCI fixup for a device on the PCI-core bridge. */
++static void bcma_core_pci_fixup_pcibridge(struct pci_dev *dev)
++{
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) != 0)
++		return;
++
++	pr_info("PCI: Fixing up bridge %s\n", pci_name(dev));
++
++	/* Enable PCI bridge bus mastering and memory space */
++	pci_set_master(dev);
++	if (pcibios_enable_device(dev, ~0) < 0) {
++		pr_err("PCI: BCMA bridge enable failed\n");
++		return;
++	}
++
++	/* Enable PCI bridge BAR1 prefetch and burst */
++	pci_write_config_dword(dev, BCMA_PCI_BAR1_CONTROL, 3);
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_pcibridge);
++
++/* Early PCI fixup for all PCI-cores to set the correct memory address. */
++static void bcma_core_pci_fixup_addresses(struct pci_dev *dev)
++{
++	struct resource *res;
++	int pos;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) == 0)
++		return;
++
++	pr_info("PCI: Fixing up addresses %s\n", pci_name(dev));
++
++	for (pos = 0; pos < 6; pos++) {
++		res = &dev->resource[pos];
++		if (res->flags & (IORESOURCE_IO | IORESOURCE_MEM))
++			pci_assign_resource(dev, pos);
++	}
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_addresses);
++
++/* This function is called when doing a pci_enable_device().
++ * We must first check if the device is a device on the PCI-core bridge. */
++int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++
++	pr_info("PCI: Fixing up device %s\n", pci_name(dev));
++
++	/* Fix up interrupt lines */
++	dev->irq = bcma_core_mips_irq(pc_host->pdev->core) + 2;
++	pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
++
++	return 0;
++}
++EXPORT_SYMBOL(bcma_core_pci_plat_dev_init);
++
++/* PCI device IRQ mapping. */
++int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++	return bcma_core_mips_irq(pc_host->pdev->core) + 2;
 +}
++EXPORT_SYMBOL(bcma_core_pci_pcibios_map_irq);
 --- /dev/null
 +++ b/drivers/bcma/driver_mips.c
 @@ -0,0 +1,256 @@
diff --git a/target/linux/generic/patches-2.6.30/941-ssb_update.patch b/target/linux/generic/patches-2.6.30/941-ssb_update.patch
index b27270aba5..b91f11d581 100644
--- a/target/linux/generic/patches-2.6.30/941-ssb_update.patch
+++ b/target/linux/generic/patches-2.6.30/941-ssb_update.patch
@@ -225,7 +225,17 @@
   * Copyright 2007, Broadcom Corporation
   *
   * Licensed under the GNU/GPL. See COPYING for details.
-@@ -28,6 +28,21 @@ static void ssb_chipco_pll_write(struct 
+@@ -12,6 +12,9 @@
+ #include <linux/ssb/ssb_regs.h>
+ #include <linux/ssb/ssb_driver_chipcommon.h>
+ #include <linux/delay.h>
++#ifdef CONFIG_BCM47XX
++#include <asm/mach-bcm47xx/nvram.h>
++#endif
+ 
+ #include "ssb_private.h"
+ 
+@@ -28,6 +31,21 @@ static void ssb_chipco_pll_write(struct
  	chipco_write32(cc, SSB_CHIPCO_PLLCTL_DATA, value);
  }
  
@@ -247,8 +257,39 @@
  struct pmu0_plltab_entry {
  	u16 freq;	/* Crystal frequency in kHz.*/
  	u8 xf;		/* Crystal frequency value for PMU control */
-@@ -317,6 +332,12 @@ static void ssb_pmu_pll_init(struct ssb_
+@@ -76,10 +94,6 @@ static void ssb_pmu0_pllinit_r0(struct s
+ 	u32 pmuctl, tmp, pllctl;
+ 	unsigned int i;
+ 
+-	if ((bus->chip_id == 0x5354) && !crystalfreq) {
+-		/* The 5354 crystal freq is 25MHz */
+-		crystalfreq = 25000;
+-	}
+ 	if (crystalfreq)
+ 		e = pmu0_plltab_find_entry(crystalfreq);
+ 	if (!e)
+@@ -305,7 +319,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 	u32 crystalfreq = 0; /* in kHz. 0 = keep default freq. */
+ 
+ 	if (bus->bustype == SSB_BUSTYPE_SSB) {
+-		/* TODO: The user may override the crystal frequency. */
++#ifdef CONFIG_BCM47XX
++		char buf[20];
++		if (nvram_getenv("xtalfreq", buf, sizeof(buf)) >= 0)
++			crystalfreq = simple_strtoul(buf, NULL, 0);
++#endif
+ 	}
+ 
+ 	switch (bus->chip_id) {
+@@ -314,9 +332,19 @@ static void ssb_pmu_pll_init(struct ssb_
+ 		ssb_pmu1_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4328:
++		ssb_pmu0_pllinit_r0(cc, crystalfreq);
++		break;
  	case 0x5354:
++		if (crystalfreq == 0)
++			crystalfreq = 25000;
  		ssb_pmu0_pllinit_r0(cc, crystalfreq);
  		break;
 +	case 0x4322:
@@ -260,7 +301,7 @@
  	default:
  		ssb_printk(KERN_ERR PFX
  			   "ERROR: PLL init unknown for device %04X\n",
-@@ -396,12 +417,15 @@ static void ssb_pmu_resources_init(struc
+@@ -396,12 +424,15 @@ static void ssb_pmu_resources_init(struc
  	u32 min_msk = 0, max_msk = 0;
  	unsigned int i;
  	const struct pmu_res_updown_tab_entry *updown_tab = NULL;
@@ -278,7 +319,7 @@
  		/* We keep the default settings:
  		 * min_msk = 0xCBB
  		 * max_msk = 0x7FFFF
-@@ -480,9 +504,9 @@ static void ssb_pmu_resources_init(struc
+@@ -480,9 +511,9 @@ static void ssb_pmu_resources_init(struc
  		chipco_write32(cc, SSB_CHIPCO_PMU_MAXRES_MSK, max_msk);
  }
  
@@ -289,7 +330,7 @@
  	u32 pmucap;
  
  	if (!(cc->capabilities & SSB_CHIPCO_CAP_PMU))
-@@ -494,15 +518,91 @@ void ssb_pmu_init(struct ssb_chipcommon 
+@@ -494,15 +525,122 @@ void ssb_pmu_init(struct ssb_chipcommon
  	ssb_dprintk(KERN_DEBUG PFX "Found rev %u PMU (capabilities 0x%08X)\n",
  		    cc->pmu.rev, pmucap);
  
@@ -390,6 +431,37 @@
 +
 +EXPORT_SYMBOL(ssb_pmu_set_ldo_voltage);
 +EXPORT_SYMBOL(ssb_pmu_set_ldo_paref);
++
++u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		/* 5354 chip uses a non programmable PLL of frequency 240MHz */
++		return 240000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU cpu clock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
++
++u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		return 120000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU controlclock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
 --- a/drivers/ssb/driver_gige.c
 +++ b/drivers/ssb/driver_gige.c
 @@ -3,7 +3,7 @@
@@ -574,7 +646,17 @@
  }
  
  static void ssb_mips_serial_init(struct ssb_mipscore *mcore)
-@@ -197,17 +253,23 @@ void ssb_mipscore_init(struct ssb_mipsco
+@@ -152,6 +208,9 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 	u32 pll_type, n, m, rate = 0;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_cpu_clock(&bus->chipco);
++
+ 	if (bus->extif.dev) {
+ 		ssb_extif_get_clockcontrol(&bus->extif, &pll_type, &n, &m);
+ 	} else if (bus->chipco.dev) {
+@@ -197,17 +256,23 @@ void ssb_mipscore_init(struct ssb_mipsco
  
  	/* Assign IRQs to all cores on the bus, start with irq line 2, because serial usually takes 1 */
  	for (irq = 2, i = 0; i < bus->nr_devices; i++) {
@@ -601,7 +683,7 @@
  		case SSB_DEV_PCI:
  		case SSB_DEV_ETHERNET:
  		case SSB_DEV_ETHERNET_GBIT:
-@@ -218,8 +280,14 @@ void ssb_mipscore_init(struct ssb_mipsco
+@@ -218,8 +283,14 @@ void ssb_mipscore_init(struct ssb_mipsco
  				set_irq(dev, irq++);
  				break;
  			}
@@ -639,6 +721,15 @@
  
  static inline
  u32 pcicore_read32(struct ssb_pcicore *pc, u16 offset)
+@@ -69,7 +74,7 @@ static u32 get_cfgspace_addr(struct ssb_
+ 	u32 tmp;
+ 
+ 	/* We do only have one cardbus device behind the bridge. */
+-	if (pc->cardbusmode && (dev >= 1))
++	if (pc->cardbusmode && (dev > 1))
+ 		goto out;
+ 
+ 	if (bus == 0) {
 @@ -246,20 +251,12 @@ static struct pci_controller ssb_pcicore
  	.pci_ops	= &ssb_pcicore_pciops,
  	.io_resource	= &ssb_pcicore_io_resource,
@@ -1098,27 +1189,7 @@
  int ssb_for_each_bus_call(unsigned long data,
  			  int (*func)(struct ssb_bus *bus, unsigned long data))
  {
-@@ -120,6 +142,19 @@ static void ssb_device_put(struct ssb_de
- 		put_device(dev->dev);
- }
- 
-+static inline struct ssb_driver *ssb_driver_get(struct ssb_driver *drv)
-+{
-+	if (drv)
-+		get_driver(&drv->drv);
-+	return drv;
-+}
-+
-+static inline void ssb_driver_put(struct ssb_driver *drv)
-+{
-+	if (drv)
-+		put_driver(&drv->drv);
-+}
-+
- static int ssb_device_resume(struct device *dev)
- {
- 	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
-@@ -190,90 +225,81 @@ int ssb_bus_suspend(struct ssb_bus *bus)
+@@ -190,90 +212,78 @@ int ssb_bus_suspend(struct ssb_bus *bus)
  EXPORT_SYMBOL(ssb_bus_suspend);
  
  #ifdef CONFIG_SSB_SPROM
@@ -1176,16 +1247,15 @@
 -			continue;
 -		drv = drv_to_ssb_drv(dev->dev->driver);
 -		if (!drv)
-+		sdrv = ssb_driver_get(drv_to_ssb_drv(sdev->dev->driver));
-+		if (!sdrv || SSB_WARN_ON(!sdrv->remove)) {
-+			ssb_device_put(sdev);
++		sdrv = drv_to_ssb_drv(sdev->dev->driver);
++		if (SSB_WARN_ON(!sdrv->remove))
  			continue;
 -		err = drv->suspend(dev, state);
 -		if (err) {
 -			ssb_printk(KERN_ERR PFX "Failed to freeze device %s\n",
 -				   dev_name(dev->dev));
 -			goto err_unwind;
- 		}
+-		}
 +		sdrv->remove(sdev);
 +		ctx->device_frozen[i] = 1;
  	}
@@ -1252,7 +1322,6 @@
 +				   dev_name(sdev->dev));
 +			result = err;
  		}
-+		ssb_driver_put(sdrv);
 +		ssb_device_put(sdev);
  	}
  
@@ -1261,7 +1330,7 @@
  }
  #endif /* CONFIG_SSB_SPROM */
  
-@@ -360,6 +386,35 @@ static int ssb_device_uevent(struct devi
+@@ -360,6 +370,35 @@ static int ssb_device_uevent(struct devi
  			     ssb_dev->id.revision);
  }
  
@@ -1297,7 +1366,7 @@
  static struct bus_type ssb_bustype = {
  	.name		= "ssb",
  	.match		= ssb_bus_match,
-@@ -369,6 +424,7 @@ static struct bus_type ssb_bustype = {
+@@ -369,6 +408,7 @@ static struct bus_type ssb_bustype = {
  	.suspend	= ssb_device_suspend,
  	.resume		= ssb_device_resume,
  	.uevent		= ssb_device_uevent,
@@ -1305,7 +1374,7 @@
  };
  
  static void ssb_buses_lock(void)
-@@ -461,6 +517,7 @@ static int ssb_devices_register(struct s
+@@ -461,6 +501,7 @@ static int ssb_devices_register(struct s
  #ifdef CONFIG_SSB_PCIHOST
  			sdev->irq = bus->host_pci->irq;
  			dev->parent = &bus->host_pci->dev;
@@ -1313,7 +1382,7 @@
  #endif
  			break;
  		case SSB_BUSTYPE_PCMCIA:
-@@ -469,8 +526,14 @@ static int ssb_devices_register(struct s
+@@ -469,8 +510,14 @@ static int ssb_devices_register(struct s
  			dev->parent = &bus->host_pcmcia->dev;
  #endif
  			break;
@@ -1328,7 +1397,7 @@
  			break;
  		}
  
-@@ -497,7 +560,7 @@ error:
+@@ -497,7 +544,7 @@ error:
  }
  
  /* Needs ssb_buses_lock() */
@@ -1337,7 +1406,7 @@
  {
  	struct ssb_bus *bus, *n;
  	int err = 0;
-@@ -708,9 +771,9 @@ out:
+@@ -708,9 +755,9 @@ out:
  	return err;
  }
  
@@ -1350,7 +1419,7 @@
  {
  	int err;
  
-@@ -724,12 +787,18 @@ static int ssb_bus_register(struct ssb_b
+@@ -724,12 +771,18 @@ static int ssb_bus_register(struct ssb_b
  	err = ssb_pci_xtal(bus, SSB_GPIO_XTAL | SSB_GPIO_PLL, 1);
  	if (err)
  		goto out;
@@ -1370,7 +1439,7 @@
  
  	/* Init PCI-host device (if any) */
  	err = ssb_pci_init(bus);
-@@ -776,6 +845,8 @@ err_pci_exit:
+@@ -776,6 +829,8 @@ err_pci_exit:
  	ssb_pci_exit(bus);
  err_unmap:
  	ssb_iounmap(bus);
@@ -1379,7 +1448,7 @@
  err_disable_xtal:
  	ssb_buses_unlock();
  	ssb_pci_xtal(bus, SSB_GPIO_XTAL | SSB_GPIO_PLL, 0);
-@@ -783,8 +854,8 @@ err_disable_xtal:
+@@ -783,8 +838,8 @@ err_disable_xtal:
  }
  
  #ifdef CONFIG_SSB_PCIHOST
@@ -1390,7 +1459,7 @@
  {
  	int err;
  
-@@ -796,6 +867,9 @@ int ssb_bus_pcibus_register(struct ssb_b
+@@ -796,6 +851,9 @@ int ssb_bus_pcibus_register(struct ssb_b
  	if (!err) {
  		ssb_printk(KERN_INFO PFX "Sonics Silicon Backplane found on "
  			   "PCI device %s\n", dev_name(&host_pci->dev));
@@ -1400,7 +1469,7 @@
  	}
  
  	return err;
-@@ -804,9 +878,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
+@@ -804,9 +862,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
  #endif /* CONFIG_SSB_PCIHOST */
  
  #ifdef CONFIG_SSB_PCMCIAHOST
@@ -1413,7 +1482,7 @@
  {
  	int err;
  
-@@ -825,9 +899,32 @@ int ssb_bus_pcmciabus_register(struct ss
+@@ -825,9 +883,32 @@ int ssb_bus_pcmciabus_register(struct ss
  EXPORT_SYMBOL(ssb_bus_pcmciabus_register);
  #endif /* CONFIG_SSB_PCMCIAHOST */
  
@@ -1449,7 +1518,7 @@
  {
  	int err;
  
-@@ -908,8 +1005,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
+@@ -908,8 +989,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
  	switch (plltype) {
  	case SSB_PLLTYPE_6: /* 100/200 or 120/240 only */
  		if (m & SSB_CHIPCO_CLK_T6_MMASK)
@@ -1460,7 +1529,17 @@
  	case SSB_PLLTYPE_1: /* 48Mhz base, 3 dividers */
  	case SSB_PLLTYPE_3: /* 25Mhz, 2 dividers */
  	case SSB_PLLTYPE_4: /* 48Mhz, 4 dividers */
-@@ -1024,23 +1121,22 @@ static u32 ssb_tmslow_reject_bitmask(str
+@@ -999,6 +1080,9 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
+ 	u32 plltype;
+ 	u32 clkctl_n, clkctl_m;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_controlclock(&bus->chipco);
++
+ 	if (ssb_extif_available(&bus->extif))
+ 		ssb_extif_get_clockcontrol(&bus->extif, &plltype,
+ 					   &clkctl_n, &clkctl_m);
+@@ -1024,23 +1108,22 @@ static u32 ssb_tmslow_reject_bitmask(str
  {
  	u32 rev = ssb_read32(dev, SSB_IDLOW) & SSB_IDLOW_SSBREV;
  
@@ -1491,7 +1570,7 @@
  }
  
  int ssb_device_is_enabled(struct ssb_device *dev)
-@@ -1099,10 +1195,10 @@ void ssb_device_enable(struct ssb_device
+@@ -1099,10 +1182,10 @@ void ssb_device_enable(struct ssb_device
  }
  EXPORT_SYMBOL(ssb_device_enable);
  
@@ -1505,7 +1584,7 @@
  {
  	int i;
  	u32 val;
-@@ -1110,7 +1206,7 @@ static int ssb_wait_bit(struct ssb_devic
+@@ -1110,7 +1193,7 @@ static int ssb_wait_bit(struct ssb_devic
  	for (i = 0; i < timeout; i++) {
  		val = ssb_read32(dev, reg);
  		if (set) {
@@ -1514,7 +1593,7 @@
  				return 0;
  		} else {
  			if (!(val & bitmask))
-@@ -1127,20 +1223,38 @@ static int ssb_wait_bit(struct ssb_devic
+@@ -1127,20 +1210,38 @@ static int ssb_wait_bit(struct ssb_devic
  
  void ssb_device_disable(struct ssb_device *dev, u32 core_specific_flags)
  {
@@ -1562,7 +1641,7 @@
  
  	ssb_write32(dev, SSB_TMSLOW,
  		    reject | SSB_TMSLOW_RESET |
-@@ -1149,13 +1263,34 @@ void ssb_device_disable(struct ssb_devic
+@@ -1149,13 +1250,34 @@ void ssb_device_disable(struct ssb_devic
  }
  EXPORT_SYMBOL(ssb_device_disable);
  
@@ -1598,7 +1677,7 @@
  	default:
  		__ssb_dma_not_implemented(dev);
  	}
-@@ -1272,20 +1407,20 @@ EXPORT_SYMBOL(ssb_bus_may_powerdown);
+@@ -1272,20 +1394,20 @@ EXPORT_SYMBOL(ssb_bus_may_powerdown);
  
  int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl)
  {
@@ -1623,7 +1702,7 @@
  	return 0;
  error:
  	ssb_printk(KERN_ERR PFX "Bus powerup failed\n");
-@@ -1293,6 +1428,37 @@ error:
+@@ -1293,6 +1415,37 @@ error:
  }
  EXPORT_SYMBOL(ssb_bus_powerup);
  
@@ -1661,7 +1740,7 @@
  u32 ssb_admatch_base(u32 adm)
  {
  	u32 base = 0;
-@@ -1358,8 +1524,10 @@ static int __init ssb_modinit(void)
+@@ -1358,8 +1511,10 @@ static int __init ssb_modinit(void)
  	ssb_buses_lock();
  	err = ssb_attach_queued_buses();
  	ssb_buses_unlock();
@@ -1673,7 +1752,7 @@
  
  	err = b43_pci_ssb_bridge_init();
  	if (err) {
-@@ -1375,7 +1543,7 @@ static int __init ssb_modinit(void)
+@@ -1375,7 +1530,7 @@ static int __init ssb_modinit(void)
  		/* don't fail SSB init because of this */
  		err = 0;
  	}
@@ -1720,7 +1799,7 @@
  
  static inline u8 ssb_crc8(u8 crc, u8 data)
  {
-@@ -247,7 +254,7 @@ static int sprom_do_read(struct ssb_bus 
+@@ -247,7 +254,7 @@ static int sprom_do_read(struct ssb_bus
  	int i;
  
  	for (i = 0; i < bus->sprom_size; i++)
@@ -1738,10 +1817,40 @@
  		mmiowb();
  		msleep(20);
  	}
-@@ -399,6 +406,46 @@ static void sprom_extract_r123(struct ss
- 	out->antenna_gain.ghz5.a3 = gain;
- }
+@@ -324,7 +331,6 @@ static void sprom_extract_r123(struct ss
+ {
+ 	int i;
+ 	u16 v;
+-	s8 gain;
+ 	u16 loc[3];
+ 
+ 	if (out->revision == 3)			/* rev 3 moved MAC */
+@@ -383,20 +389,52 @@ static void sprom_extract_r123(struct ss
+ 		SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
  
+ 	/* Extract the antenna gain values. */
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_BG,
+-				    SSB_SPROM1_AGAIN_BG_SHIFT);
+-	out->antenna_gain.ghz24.a0 = gain;
+-	out->antenna_gain.ghz24.a1 = gain;
+-	out->antenna_gain.ghz24.a2 = gain;
+-	out->antenna_gain.ghz24.a3 = gain;
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_A,
+-				    SSB_SPROM1_AGAIN_A_SHIFT);
+-	out->antenna_gain.ghz5.a0 = gain;
+-	out->antenna_gain.ghz5.a1 = gain;
+-	out->antenna_gain.ghz5.a2 = gain;
+-	out->antenna_gain.ghz5.a3 = gain;
++	out->antenna_gain.a0 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_BG,
++						    SSB_SPROM1_AGAIN_BG_SHIFT);
++	out->antenna_gain.a1 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_A,
++						    SSB_SPROM1_AGAIN_A_SHIFT);
++}
++
 +/* Revs 4 5 and 8 have partially shared layout */
 +static void sprom_extract_r458(struct ssb_sprom *out, const u16 *in)
 +{
@@ -1780,12 +1889,10 @@
 +	     SSB_SPROM4_TXPID5GH2, SSB_SPROM4_TXPID5GH2_SHIFT);
 +	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23,
 +	     SSB_SPROM4_TXPID5GH3, SSB_SPROM4_TXPID5GH3_SHIFT);
-+}
-+
+ }
+ 
  static void sprom_extract_r45(struct ssb_sprom *out, const u16 *in)
- {
- 	int i;
-@@ -421,10 +468,14 @@ static void sprom_extract_r45(struct ssb
+@@ -421,10 +459,14 @@ static void sprom_extract_r45(struct ssb
  		SPEX(country_code, SSB_SPROM4_CCODE, 0xFFFF, 0);
  		SPEX(boardflags_lo, SSB_SPROM4_BFLLO, 0xFFFF, 0);
  		SPEX(boardflags_hi, SSB_SPROM4_BFLHI, 0xFFFF, 0);
@@ -1800,15 +1907,30 @@
  	}
  	SPEX(ant_available_a, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_A,
  	     SSB_SPROM4_ANTAVAIL_A_SHIFT);
-@@ -464,22 +515,32 @@ static void sprom_extract_r45(struct ssb
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
+@@ -453,16 +495,16 @@ static void sprom_extract_r45(struct ssb
+ 	}
  
-+	sprom_extract_r458(out, in);
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN0, SSB_SPROM4_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN1, SSB_SPROM4_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN2, SSB_SPROM4_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN3, SSB_SPROM4_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
 +
++	sprom_extract_r458(out, in);
+ 
  	/* TODO - get remaining rev 4 stuff needed */
  }
- 
+@@ -470,16 +512,24 @@ static void sprom_extract_r45(struct ssb
  static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
  {
  	int i;
@@ -1835,7 +1957,7 @@
  	SPEX(ant_available_a, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_A,
  	     SSB_SPROM8_ANTAVAIL_A_SHIFT);
  	SPEX(ant_available_bg, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_BG,
-@@ -490,12 +551,55 @@ static void sprom_extract_r8(struct ssb_
+@@ -490,24 +540,122 @@ static void sprom_extract_r8(struct ssb_
  	SPEX(maxpwr_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_MAXP_A_MASK, 0);
  	SPEX(itssi_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_ITSSI_A,
  	     SSB_SPROM8_ITSSI_A_SHIFT);
@@ -1890,11 +2012,21 @@
 +	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
  
  	/* Extract the antenna gain values. */
- 	SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
-@@ -509,6 +613,63 @@ static void sprom_extract_r8(struct ssb_
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
- 
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
++
 +	/* Extract cores power info info */
 +	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
 +		o = pwr_info_offset[i];
@@ -1951,11 +2083,10 @@
 +		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
 +
 +	sprom_extract_r458(out, in);
-+
+ 
  	/* TODO - get remaining rev 8 stuff needed */
  }
- 
-@@ -521,36 +682,34 @@ static int sprom_extract(struct ssb_bus 
+@@ -521,36 +669,34 @@ static int sprom_extract(struct ssb_bus
  	ssb_dprintk(KERN_DEBUG PFX "SPROM revision %d detected.\n", out->revision);
  	memset(out->et0mac, 0xFF, 6);		/* preset et0 and et1 mac */
  	memset(out->et1mac, 0xFF, 6);
@@ -2013,7 +2144,7 @@
  	}
  
  	if (out->boardflags_lo == 0xFFFF)
-@@ -564,13 +723,34 @@ static int sprom_extract(struct ssb_bus 
+@@ -564,13 +710,34 @@ static int sprom_extract(struct ssb_bus
  static int ssb_pci_sprom_get(struct ssb_bus *bus,
  			     struct ssb_sprom *sprom)
  {
@@ -2051,7 +2182,7 @@
  	bus->sprom_size = SSB_SPROMSIZE_WORDS_R123;
  	sprom_do_read(bus, buf);
  	err = sprom_check_crc(buf, bus->sprom_size);
-@@ -580,17 +760,24 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -580,17 +747,24 @@ static int ssb_pci_sprom_get(struct ssb_
  		buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
  			      GFP_KERNEL);
  		if (!buf)
@@ -2081,7 +2212,7 @@
  				err = 0;
  				goto out_free;
  			}
-@@ -602,19 +789,15 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -602,19 +776,15 @@ static int ssb_pci_sprom_get(struct ssb_
  
  out_free:
  	kfree(buf);
@@ -2188,7 +2319,7 @@
  			   "Could not disable SPROM write access.\n");
  		failed = 1;
  	}
-@@ -617,134 +617,140 @@ static int ssb_pcmcia_sprom_check_crc(co
+@@ -617,134 +617,136 @@ static int ssb_pcmcia_sprom_check_crc(co
  	}						\
    } while (0)
  
@@ -2268,14 +2399,10 @@
 +	case SSB_PCMCIA_CIS_ANTGAIN:
 +		GOTO_ERROR_ON(tuple->TupleDataLen != 2,
 +			"antg tpl size");
-+		sprom->antenna_gain.ghz24.a0 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz24.a1 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz24.a2 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz24.a3 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz5.a0 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz5.a1 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz5.a2 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz5.a3 = tuple->TupleData[1];
++		sprom->antenna_gain.a0 = tuple->TupleData[1];
++		sprom->antenna_gain.a1 = tuple->TupleData[1];
++		sprom->antenna_gain.a2 = tuple->TupleData[1];
++		sprom->antenna_gain.a3 = tuple->TupleData[1];
 +		break;
 +	case SSB_PCMCIA_CIS_BFLAGS:
 +		GOTO_ERROR_ON((tuple->TupleDataLen != 3) &&
@@ -2493,7 +2620,7 @@
  	}
  	bus->mmio = NULL;
  	bus->mapped_device = NULL;
-@@ -230,6 +241,10 @@ static void __iomem *ssb_ioremap(struct 
+@@ -230,6 +241,10 @@ static void __iomem *ssb_ioremap(struct
  		SSB_BUG_ON(1); /* Can't reach this code. */
  #endif
  		break;
@@ -2526,7 +2653,17 @@
  			bus->chip_package = 0;
  		} else {
  			bus->chip_id = 0x4710;
-@@ -339,7 +356,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
+@@ -303,6 +320,9 @@ int ssb_bus_scan(struct ssb_bus *bus,
+ 			bus->chip_package = 0;
+ 		}
+ 	}
++	ssb_printk(KERN_INFO PFX "Found chip with id 0x%04X, rev 0x%02X and "
++		   "package 0x%02X\n", bus->chip_id, bus->chip_rev,
++		   bus->chip_package);
+ 	if (!bus->nr_devices)
+ 		bus->nr_devices = chipid_to_nrcores(bus->chip_id);
+ 	if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
+@@ -339,7 +359,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
  		dev->bus = bus;
  		dev->ops = bus->ops;
  
@@ -2535,7 +2672,7 @@
  			    "Core %d found: %s "
  			    "(cc 0x%03X, rev 0x%02X, vendor 0x%04X)\n",
  			    i, ssb_core_name(dev->id.coreid),
-@@ -407,6 +424,16 @@ int ssb_bus_scan(struct ssb_bus *bus,
+@@ -407,6 +427,16 @@ int ssb_bus_scan(struct ssb_bus *bus,
  			bus->pcicore.dev = dev;
  #endif /* CONFIG_SSB_DRIVER_PCICORE */
  			break;
@@ -2554,7 +2691,7 @@
  		}
 --- /dev/null
 +++ b/drivers/ssb/sdio.c
-@@ -0,0 +1,610 @@
+@@ -0,0 +1,606 @@
 +/*
 + * Sonics Silicon Backplane
 + * SDIO-Hostbus related functions
@@ -3108,14 +3245,10 @@
 +			case SSB_SDIO_CIS_ANTGAIN:
 +				GOTO_ERROR_ON(tuple->size != 2,
 +					      "antg tpl size");
-+				sprom->antenna_gain.ghz24.a0 = tuple->data[1];
-+				sprom->antenna_gain.ghz24.a1 = tuple->data[1];
-+				sprom->antenna_gain.ghz24.a2 = tuple->data[1];
-+				sprom->antenna_gain.ghz24.a3 = tuple->data[1];
-+				sprom->antenna_gain.ghz5.a0 = tuple->data[1];
-+				sprom->antenna_gain.ghz5.a1 = tuple->data[1];
-+				sprom->antenna_gain.ghz5.a2 = tuple->data[1];
-+				sprom->antenna_gain.ghz5.a3 = tuple->data[1];
++				sprom->antenna_gain.a0 = tuple->data[1];
++				sprom->antenna_gain.a1 = tuple->data[1];
++				sprom->antenna_gain.a2 = tuple->data[1];
++				sprom->antenna_gain.a3 = tuple->data[1];
 +				break;
 +			case SSB_SDIO_CIS_BFLAGS:
 +				GOTO_ERROR_ON((tuple->size != 3) &&
@@ -3413,12 +3546,16 @@
  static inline int b43_pci_ssb_bridge_init(void)
  {
  	return 0;
-@@ -156,6 +205,6 @@ static inline int b43_pci_ssb_bridge_ini
+@@ -156,6 +205,10 @@ static inline int b43_pci_ssb_bridge_ini
  static inline void b43_pci_ssb_bridge_exit(void)
  {
  }
 -#endif /* CONFIG_SSB_PCIHOST */
 +#endif /* CONFIG_SSB_B43_PCI_BRIDGE */
++
++/* driver_chipcommon_pmu.c */
++extern u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc);
++extern u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc);
  
  #endif /* LINUX_SSB_PRIVATE_H_ */
 --- a/include/linux/pci_ids.h
@@ -3440,23 +3577,26 @@
 +struct ssb_sprom_core_pwr_info {
 +	u8 itssi_2g, itssi_5g;
 +	u8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh;
-+	u16 pa_2g[3], pa_5gl[3], pa_5g[3], pa_5gh[3];
++	u16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4];
 +};
 +
  struct ssb_sprom {
  	u8 revision;
  	u8 il0mac[6];		/* MAC address for 802.11b/g */
-@@ -25,26 +31,64 @@ struct ssb_sprom {
+@@ -25,47 +31,164 @@ struct ssb_sprom {
  	u8 et1phyaddr;		/* MII address for enet1 */
  	u8 et0mdcport;		/* MDIO for enet0 */
  	u8 et1mdcport;		/* MDIO for enet1 */
 -	u8 board_rev;		/* Board revision number from SPROM. */
 +	u16 board_rev;		/* Board revision number from SPROM. */
++	u16 board_num;		/* Board number from SPROM. */
++	u16 board_type;		/* Board type from SPROM. */
  	u8 country_code;	/* Country Code */
 -	u8 ant_available_a;	/* A-PHY antenna available bits (up to 4) */
 -	u8 ant_available_bg;	/* B/G-PHY antenna available bits (up to 4) */
-+	u16 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
-+	u16 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
++	char alpha2[2];		/* Country Code as two chars like EU or US */
++	u8 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
++	u8 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
 +	u8 ant_available_a;	/* 2GHz antenna available bits (up to 4) */
 +	u8 ant_available_bg;	/* 5GHz antenna available bits (up to 4) */
  	u16 pa0b0;
@@ -3477,10 +3617,10 @@
  	u8 gpio3;		/* GPIO pin 3 */
 -	u16 maxpwr_a;		/* A-PHY Amplifier Max Power (in dBm Q5.2) */
 -	u16 maxpwr_bg;		/* B/G-PHY Amplifier Max Power (in dBm Q5.2) */
-+	u16 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
-+	u16 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
-+	u16 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
-+	u16 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
  	u8 itssi_a;		/* Idle TSSI Target for A-PHY */
  	u8 itssi_bg;		/* Idle TSSI Target for B/G-PHY */
 -	u16 boardflags_lo;	/* Boardflags (low 16 bits) */
@@ -3493,8 +3633,8 @@
 +	u8 txpid5gl[4];		/* 4.9 - 5.1GHz TX power index */
 +	u8 txpid5g[4];		/* 5.1 - 5.5GHz TX power index */
 +	u8 txpid5gh[4];		/* 5.5 - ...GHz TX power index */
-+	u8 rxpo2g;		/* 2GHz RX power offset */
-+	u8 rxpo5g;		/* 5GHz RX power offset */
++	s8 rxpo2g;		/* 2GHz RX power offset */
++	s8 rxpo5g;		/* 5GHz RX power offset */
 +	u8 rssisav2g;		/* 2GHz RSSI params */
 +	u8 rssismc2g;
 +	u8 rssismf2g;
@@ -3518,8 +3658,15 @@
  
  	/* Antenna gain values for up to 4 antennas
  	 * on each band. Values in dBm/4 (Q5.2). Negative gain means the
-@@ -58,14 +102,23 @@ struct ssb_sprom {
- 		} ghz5;		/* 5GHz band */
+ 	 * loss in the connectors is bigger than the gain. */
+ 	struct {
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz24;	/* 2.4GHz band */
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz5;		/* 5GHz band */
++		s8 a0, a1, a2, a3;
  	} antenna_gain;
  
 -	/* TODO - add any parameters needed from rev 2, 3, or 4 SPROMs */
@@ -3532,7 +3679,79 @@
 +		} ghz5;
 +	} fem;
 +
-+	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
++	u16 mcs2gpo[8];
++	u16 mcs5gpo[8];
++	u16 mcs5glpo[8];
++	u16 mcs5ghpo[8];
++	u8 opo;
++
++	u8 rxgainerr2ga[3];
++	u8 rxgainerr5gla[3];
++	u8 rxgainerr5gma[3];
++	u8 rxgainerr5gha[3];
++	u8 rxgainerr5gua[3];
++
++	u8 noiselvl2ga[3];
++	u8 noiselvl5gla[3];
++	u8 noiselvl5gma[3];
++	u8 noiselvl5gha[3];
++	u8 noiselvl5gua[3];
++
++	u8 regrev;
++	u8 txchain;
++	u8 rxchain;
++	u8 antswitch;
++	u16 cddpo;
++	u16 stbcpo;
++	u16 bw40po;
++	u16 bwduppo;
++
++	u8 tempthresh;
++	u8 tempoffset;
++	u16 rawtempsense;
++	u8 measpower;
++	u8 tempsense_slope;
++	u8 tempcorrx;
++	u8 tempsense_option;
++	u8 freqoffset_corr;
++	u8 iqcal_swp_dis;
++	u8 hw_iqcal_en;
++	u8 elna2g;
++	u8 elna5g;
++	u8 phycal_tempdelta;
++	u8 temps_period;
++	u8 temps_hysteresis;
++	u8 measpower1;
++	u8 measpower2;
++	u8 pcieingress_war;
++
++	/* power per rate from sromrev 9 */
++	u16 cckbw202gpo;
++	u16 cckbw20ul2gpo;
++	u32 legofdmbw202gpo;
++	u32 legofdmbw20ul2gpo;
++	u32 legofdmbw205glpo;
++	u32 legofdmbw20ul5glpo;
++	u32 legofdmbw205gmpo;
++	u32 legofdmbw20ul5gmpo;
++	u32 legofdmbw205ghpo;
++	u32 legofdmbw20ul5ghpo;
++	u32 mcsbw202gpo;
++	u32 mcsbw20ul2gpo;
++	u32 mcsbw402gpo;
++	u32 mcsbw205glpo;
++	u32 mcsbw20ul5glpo;
++	u32 mcsbw405glpo;
++	u32 mcsbw205gmpo;
++	u32 mcsbw20ul5gmpo;
++	u32 mcsbw405gmpo;
++	u32 mcsbw205ghpo;
++	u32 mcsbw20ul5ghpo;
++	u32 mcsbw405ghpo;
++	u16 mcs32po;
++	u16 legofdm40duppo;
++	u8 sar2g;
++	u8 sar5g;
  };
  
  /* Information about the PCB the circuitry is soldered on. */
@@ -3544,7 +3763,7 @@
  };
  
  
-@@ -137,7 +190,7 @@ struct ssb_device {
+@@ -137,7 +260,7 @@ struct ssb_device {
  	 * is an optimization. */
  	const struct ssb_bus_ops *ops;
  
@@ -3553,7 +3772,7 @@
  
  	struct ssb_bus *bus;
  	struct ssb_device_id id;
-@@ -195,10 +248,9 @@ struct ssb_driver {
+@@ -195,10 +318,9 @@ struct ssb_driver {
  #define drv_to_ssb_drv(_drv) container_of(_drv, struct ssb_driver, drv)
  
  extern int __ssb_driver_register(struct ssb_driver *drv, struct module *owner);
@@ -3567,7 +3786,7 @@
  extern void ssb_driver_unregister(struct ssb_driver *drv);
  
  
-@@ -208,6 +260,7 @@ enum ssb_bustype {
+@@ -208,6 +330,7 @@ enum ssb_bustype {
  	SSB_BUSTYPE_SSB,	/* This SSB bus is the system bus */
  	SSB_BUSTYPE_PCI,	/* SSB is connected to PCI bus */
  	SSB_BUSTYPE_PCMCIA,	/* SSB is connected to PCMCIA bus */
@@ -3575,7 +3794,7 @@
  };
  
  /* board_vendor */
-@@ -238,20 +291,33 @@ struct ssb_bus {
+@@ -238,20 +361,33 @@ struct ssb_bus {
  
  	const struct ssb_bus_ops *ops;
  
@@ -3617,7 +3836,7 @@
  
  #ifdef CONFIG_SSB_SPROM
  	/* Mutex to protect the SPROM writing. */
-@@ -260,7 +326,8 @@ struct ssb_bus {
+@@ -260,7 +396,8 @@ struct ssb_bus {
  
  	/* ID information about the Chip. */
  	u16 chip_id;
@@ -3627,7 +3846,7 @@
  	u16 sprom_size;		/* number of words in sprom */
  	u8 chip_package;
  
-@@ -306,6 +373,11 @@ struct ssb_bus {
+@@ -306,6 +443,11 @@ struct ssb_bus {
  #endif /* DEBUG */
  };
  
@@ -3639,7 +3858,7 @@
  /* The initialization-invariants. */
  struct ssb_init_invariants {
  	/* Versioning information about the PCB. */
-@@ -336,12 +408,23 @@ extern int ssb_bus_pcmciabus_register(st
+@@ -336,12 +478,23 @@ extern int ssb_bus_pcmciabus_register(st
  				      struct pcmcia_device *pcmcia_dev,
  				      unsigned long baseaddr);
  #endif /* CONFIG_SSB_PCMCIAHOST */
@@ -3664,7 +3883,7 @@
  
  /* Suspend a SSB bus.
   * Call this from the parent bus suspend routine. */
-@@ -612,6 +695,7 @@ extern int ssb_bus_may_powerdown(struct 
+@@ -612,6 +765,7 @@ extern int ssb_bus_may_powerdown(struct
   * Otherwise static always-on powercontrol will be used. */
  extern int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl);
  
@@ -4304,3 +4523,13 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
+--- a/include/linux/ssb/ssb_driver_gige.h
++++ b/include/linux/ssb/ssb_driver_gige.h
+@@ -2,6 +2,7 @@
+ #define LINUX_SSB_DRIVER_GIGE_H_
+ 
+ #include <linux/ssb/ssb.h>
++#include <linux/bug.h>
+ #include <linux/pci.h>
+ #include <linux/spinlock.h>
+ 
diff --git a/target/linux/generic/patches-2.6.31/025-bcma_backport.patch b/target/linux/generic/patches-2.6.31/025-bcma_backport.patch
index f713e2bf9b..c29842813f 100644
--- a/target/linux/generic/patches-2.6.31/025-bcma_backport.patch
+++ b/target/linux/generic/patches-2.6.31/025-bcma_backport.patch
@@ -103,7 +103,7 @@
 +
 +config BCMA_DRIVER_PCI_HOSTMODE
 +	bool "Driver for PCI core working in hostmode"
-+	depends on BCMA && MIPS
++	depends on BCMA && MIPS && BCMA_HOST_PCI
 +	help
 +	  PCI core hostmode operation (external PCI bus).
 +
@@ -172,7 +172,7 @@
 +- Create kernel Documentation (use info from README)
 --- /dev/null
 +++ b/drivers/bcma/bcma_private.h
-@@ -0,0 +1,54 @@
+@@ -0,0 +1,59 @@
 +#ifndef LINUX_BCMA_PRIVATE_H_
 +#define LINUX_BCMA_PRIVATE_H_
 +
@@ -188,12 +188,13 @@
 +struct bcma_bus;
 +
 +/* main.c */
-+int bcma_bus_register(struct bcma_bus *bus);
++int __devinit bcma_bus_register(struct bcma_bus *bus);
 +void bcma_bus_unregister(struct bcma_bus *bus);
 +int __init bcma_bus_early_register(struct bcma_bus *bus,
 +				   struct bcma_device *core_cc,
 +				   struct bcma_device *core_mips);
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus);
 +int bcma_bus_resume(struct bcma_bus *bus);
 +#endif
 +
@@ -222,8 +223,12 @@
 +extern void __exit bcma_host_pci_exit(void);
 +#endif /* CONFIG_BCMA_HOST_PCI */
 +
++/* driver_pci.c */
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address);
++
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc);
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
 +
 +#endif
@@ -517,7 +522,7 @@
 +#endif /* CONFIG_BCMA_DRIVER_MIPS */
 --- /dev/null
 +++ b/drivers/bcma/driver_chipcommon_pmu.c
-@@ -0,0 +1,309 @@
+@@ -0,0 +1,310 @@
 +/*
 + * Broadcom specific AMBA
 + * ChipCommon Power Management Unit driver
@@ -599,6 +604,7 @@
 +		min_msk = 0x200D;
 +		max_msk = 0xFFFF;
 +		break;
++	case 0x4331:
 +	case 43224:
 +	case 43225:
 +		break;
@@ -829,13 +835,14 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/driver_pci.c
-@@ -0,0 +1,237 @@
+@@ -0,0 +1,225 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Core
 + *
-+ * Copyright 2005, Broadcom Corporation
++ * Copyright 2005, 2011, Broadcom Corporation
 + * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
 + *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
@@ -847,40 +854,41 @@
 + * R/W ops.
 + **************************************************/
 +
-+static u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
 +{
-+	pcicore_write32(pc, 0x130, address);
-+	pcicore_read32(pc, 0x130);
-+	return pcicore_read32(pc, 0x134);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_DATA);
 +}
 +
 +#if 0
 +static void bcma_pcie_write(struct bcma_drv_pci *pc, u32 address, u32 data)
 +{
-+	pcicore_write32(pc, 0x130, address);
-+	pcicore_read32(pc, 0x130);
-+	pcicore_write32(pc, 0x134, data);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_DATA, data);
 +}
 +#endif
 +
 +static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u8 phy)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	u32 v;
 +	int i;
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 28); /* Write Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	v |= (0x1F << 18);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++	v |= (BCMA_CORE_PCI_MDIODATA_BLK_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
 +	v |= (phy << 4);
-+	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +
 +	udelay(10);
 +	for (i = 0; i < 200; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
 +			break;
 +		msleep(1);
 +	}
@@ -888,79 +896,84 @@
 +
 +static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u8 device, u8 address)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	int max_retries = 10;
 +	u16 ret = 0;
 +	u32 v;
 +	int i;
 +
-+	v = 0x80; /* Enable Preamble Sequence */
-+	v |= 0x2; /* MDIO Clock Divisor */
-+	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
 +
 +	if (pc->core->id.rev >= 10) {
 +		max_retries = 200;
 +		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 +	}
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 29); /* Read Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	if (pc->core->id.rev < 10)
-+		v |= (u32)device << 22;
-+	v |= (u32)address << 18;
-+	pcicore_write32(pc, mdio_data, v);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_READ;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
++
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +	/* Wait for the device to complete the transaction */
 +	udelay(10);
 +	for (i = 0; i < max_retries; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */) {
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE) {
 +			udelay(10);
-+			ret = pcicore_read32(pc, mdio_data);
++			ret = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_DATA);
 +			break;
 +		}
 +		msleep(1);
 +	}
-+	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
 +	return ret;
 +}
 +
 +static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u8 device,
 +				u8 address, u16 data)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	int max_retries = 10;
 +	u32 v;
 +	int i;
 +
-+	v = 0x80; /* Enable Preamble Sequence */
-+	v |= 0x2; /* MDIO Clock Divisor */
-+	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
 +
 +	if (pc->core->id.rev >= 10) {
 +		max_retries = 200;
 +		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 +	}
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 28); /* Write Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	if (pc->core->id.rev < 10)
-+		v |= (u32)device << 22;
-+	v |= (u32)address << 18;
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
 +	v |= data;
-+	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +	/* Wait for the device to complete the transaction */
 +	udelay(10);
 +	for (i = 0; i < max_retries; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
 +			break;
 +		msleep(1);
 +	}
-+	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
 +}
 +
 +/**************************************************
@@ -969,72 +982,53 @@
 +
 +static u8 bcma_pcicore_polarity_workaround(struct bcma_drv_pci *pc)
 +{
-+	return (bcma_pcie_read(pc, 0x204) & 0x10) ? 0xC0 : 0x80;
++	u32 tmp;
++
++	tmp = bcma_pcie_read(pc, BCMA_CORE_PCI_PLP_STATUSREG);
++	if (tmp & BCMA_CORE_PCI_PLP_POLARITYINV_STAT)
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE |
++		       BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY;
++	else
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE;
 +}
 +
 +static void bcma_pcicore_serdes_workaround(struct bcma_drv_pci *pc)
 +{
-+	const u8 serdes_pll_device = 0x1D;
-+	const u8 serdes_rx_device = 0x1F;
 +	u16 tmp;
 +
-+	bcma_pcie_mdio_write(pc, serdes_rx_device, 1 /* Control */,
-+			      bcma_pcicore_polarity_workaround(pc));
-+	tmp = bcma_pcie_mdio_read(pc, serdes_pll_device, 1 /* Control */);
-+	if (tmp & 0x4000)
-+		bcma_pcie_mdio_write(pc, serdes_pll_device, 1, tmp & ~0x4000);
++	bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_RX,
++	                     BCMA_CORE_PCI_SERDES_RX_CTRL,
++			     bcma_pcicore_polarity_workaround(pc));
++	tmp = bcma_pcie_mdio_read(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++	                          BCMA_CORE_PCI_SERDES_PLL_CTRL);
++	if (tmp & BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN)
++		bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++		                     BCMA_CORE_PCI_SERDES_PLL_CTRL,
++		                     tmp & ~BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN);
 +}
 +
 +/**************************************************
 + * Init.
 + **************************************************/
 +
-+static void bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
++static void __devinit bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
 +{
 +	bcma_pcicore_serdes_workaround(pc);
 +}
 +
-+static bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
-+{
-+	struct bcma_bus *bus = pc->core->bus;
-+	u16 chipid_top;
-+
-+	chipid_top = (bus->chipinfo.id & 0xFF00);
-+	if (chipid_top != 0x4700 &&
-+	    chipid_top != 0x5300)
-+		return false;
-+
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
-+	if (bus->sprom.boardflags_lo & SSB_BFL_NOPCI)
-+		return false;
-+#endif /* CONFIG_SSB_DRIVER_PCICORE */
-+
-+#if 0
-+	/* TODO: on BCMA we use address from EROM instead of magic formula */
-+	u32 tmp;
-+	return !mips_busprobe32(tmp, (bus->mmio +
-+		(pc->core->core_index * BCMA_CORE_SIZE)));
-+#endif
-+
-+	return true;
-+}
-+
-+void bcma_core_pci_init(struct bcma_drv_pci *pc)
++void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
 +{
 +	if (pc->setup_done)
 +		return;
 +
-+	if (bcma_core_pci_is_in_hostmode(pc)) {
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	pc->hostmode = bcma_core_pci_is_in_hostmode(pc);
++	if (pc->hostmode)
 +		bcma_core_pci_hostmode_init(pc);
-+#else
-+		pr_err("Driver compiled without support for hostmode PCI\n");
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
-+	} else {
-+		bcma_core_pci_clientmode_init(pc);
-+	}
 +
-+	pc->setup_done = true;
++	if (!pc->hostmode)
++		bcma_core_pci_clientmode_init(pc);
 +}
 +
 +int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
@@ -1069,7 +1063,7 @@
 +EXPORT_SYMBOL_GPL(bcma_core_pci_irq_ctl);
 --- /dev/null
 +++ b/drivers/bcma/host_pci.c
-@@ -0,0 +1,299 @@
+@@ -0,0 +1,292 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Host
@@ -1226,8 +1220,8 @@
 +	.awrite32	= bcma_host_pci_awrite32,
 +};
 +
-+static int bcma_host_pci_probe(struct pci_dev *dev,
-+			     const struct pci_device_id *id)
++static int __devinit bcma_host_pci_probe(struct pci_dev *dev,
++					 const struct pci_device_id *id)
 +{
 +	struct bcma_bus *bus;
 +	int err = -ENOMEM;
@@ -1307,38 +1301,32 @@
 +}
 +
 +#ifdef CONFIG_PM
-+static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
++static int bcma_host_pci_suspend(struct device *dev)
 +{
-+	/* Host specific */
-+	pci_save_state(dev);
-+	pci_disable_device(dev);
-+	pci_set_power_state(dev, pci_choose_state(dev, state));
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	return 0;
++	bus->mapped_core = NULL;
++
++	return bcma_bus_suspend(bus);
 +}
 +
-+static int bcma_host_pci_resume(struct pci_dev *dev)
++static int bcma_host_pci_resume(struct device *dev)
 +{
-+	struct bcma_bus *bus = pci_get_drvdata(dev);
-+	int err;
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	/* Host specific */
-+	pci_set_power_state(dev, 0);
-+	err = pci_enable_device(dev);
-+	if (err)
-+		return err;
-+	pci_restore_state(dev);
++	return bcma_bus_resume(bus);
++}
 +
-+	/* Bus specific */
-+	err = bcma_bus_resume(bus);
-+	if (err)
-+		return err;
++static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
++			 bcma_host_pci_resume);
++#define BCMA_PM_OPS	(&bcma_pm_ops)
 +
-+	return 0;
-+}
 +#else /* CONFIG_PM */
-+# define bcma_host_pci_suspend	NULL
-+# define bcma_host_pci_resume	NULL
++
++#define BCMA_PM_OPS     NULL
++
 +#endif /* CONFIG_PM */
 +
 +static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
@@ -1356,8 +1344,7 @@
 +	.id_table = bcma_pci_bridge_tbl,
 +	.probe = bcma_host_pci_probe,
 +	.remove = bcma_host_pci_remove,
-+	.suspend = bcma_host_pci_suspend,
-+	.resume = bcma_host_pci_resume,
++	.driver.pm = BCMA_PM_OPS,
 +};
 +
 +int __init bcma_host_pci_init(void)
@@ -1371,7 +1358,7 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/main.c
-@@ -0,0 +1,354 @@
+@@ -0,0 +1,387 @@
 +/*
 + * Broadcom specific AMBA
 + * Bus subsystem
@@ -1387,6 +1374,12 @@
 +MODULE_DESCRIPTION("Broadcom's specific AMBA driver");
 +MODULE_LICENSE("GPL");
 +
++/* contains the number the next bus should get. */
++static unsigned int bcma_bus_next_num = 0;
++
++/* bcma_buses_mutex locks the bcma_bus_next_num */
++static DEFINE_MUTEX(bcma_buses_mutex);
++
 +static int bcma_bus_match(struct device *dev, struct device_driver *drv);
 +static int bcma_device_probe(struct device *dev);
 +static int bcma_device_remove(struct device *dev);
@@ -1429,7 +1422,7 @@
 +	.dev_attrs	= bcma_device_attrs,
 +};
 +
-+static struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
++struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
 +{
 +	struct bcma_device *core;
 +
@@ -1439,6 +1432,7 @@
 +	}
 +	return NULL;
 +}
++EXPORT_SYMBOL_GPL(bcma_find_core);
 +
 +static void bcma_release_core_dev(struct device *dev)
 +{
@@ -1467,7 +1461,7 @@
 +
 +		core->dev.release = bcma_release_core_dev;
 +		core->dev.bus = &bcma_bus_type;
-+		dev_set_name(&core->dev, "bcma%d:%d", 0/*bus->num*/, dev_id);
++		dev_set_name(&core->dev, "bcma%d:%d", bus->num, dev_id);
 +
 +		switch (bus->hosttype) {
 +		case BCMA_HOSTTYPE_PCI:
@@ -1506,11 +1500,15 @@
 +	}
 +}
 +
-+int bcma_bus_register(struct bcma_bus *bus)
++int __devinit bcma_bus_register(struct bcma_bus *bus)
 +{
 +	int err;
 +	struct bcma_device *core;
 +
++	mutex_lock(&bcma_buses_mutex);
++	bus->num = bcma_bus_next_num++;
++	mutex_unlock(&bcma_buses_mutex);
++
 +	/* Scan for devices (cores) */
 +	err = bcma_bus_scan(bus);
 +	if (err) {
@@ -1543,10 +1541,8 @@
 +	err = bcma_sprom_get(bus);
 +	if (err == -ENOENT) {
 +		pr_err("No SPROM available\n");
-+	} else if (err) {
++	} else if (err)
 +		pr_err("Failed to get SPROM: %d\n", err);
-+		return -ENOENT;
-+	}
 +
 +	/* Register found cores */
 +	bcma_register_cores(bus);
@@ -1615,6 +1611,21 @@
 +}
 +
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->suspend)
++				adrv->suspend(core);
++		}
++	}
++	return 0;
++}
++
 +int bcma_bus_resume(struct bcma_bus *bus)
 +{
 +	struct bcma_device *core;
@@ -1626,6 +1637,15 @@
 +		bcma_core_chipcommon_init(&bus->drv_cc);
 +	}
 +
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->resume)
++				adrv->resume(core);
++		}
++	}
++
 +	return 0;
 +}
 +#endif
@@ -1728,7 +1748,7 @@
 +module_exit(bcma_modexit)
 --- /dev/null
 +++ b/drivers/bcma/scan.c
-@@ -0,0 +1,486 @@
+@@ -0,0 +1,507 @@
 +/*
 + * Broadcom specific AMBA
 + * Bus scanning
@@ -1943,6 +1963,17 @@
 +	return NULL;
 +}
 +
++static struct bcma_device *bcma_find_core_reverse(struct bcma_bus *bus, u16 coreid)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry_reverse(core, &bus->cores, list) {
++		if (core->id.id == coreid)
++			return core;
++	}
++	return NULL;
++}
++
 +static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
 +			      struct bcma_device_id *match, int core_num,
 +			      struct bcma_device *core)
@@ -2084,6 +2115,7 @@
 +void bcma_init_bus(struct bcma_bus *bus)
 +{
 +	s32 tmp;
++	struct bcma_chipinfo *chipinfo = &(bus->chipinfo);
 +
 +	if (bus->init_done)
 +		return;
@@ -2094,9 +2126,12 @@
 +	bcma_scan_switch_core(bus, BCMA_ADDR_BASE);
 +
 +	tmp = bcma_scan_read32(bus, 0, BCMA_CC_ID);
-+	bus->chipinfo.id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
-+	bus->chipinfo.rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
-+	bus->chipinfo.pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	chipinfo->id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
++	chipinfo->rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
++	chipinfo->pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	pr_info("Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
++		chipinfo->id, chipinfo->rev, chipinfo->pkg);
++
 +	bus->init_done = true;
 +}
 +
@@ -2123,6 +2158,7 @@
 +	bcma_scan_switch_core(bus, erombase);
 +
 +	while (eromptr < eromend) {
++		struct bcma_device *other_core;
 +		struct bcma_device *core = kzalloc(sizeof(*core), GFP_KERNEL);
 +		if (!core)
 +			return -ENOMEM;
@@ -2130,18 +2166,23 @@
 +		core->bus = bus;
 +
 +		err = bcma_get_next_core(bus, &eromptr, NULL, core_num, core);
-+		if (err == -ENODEV) {
-+			core_num++;
-+			continue;
-+		} else if (err == -ENXIO)
-+			continue;
-+		else if (err == -ESPIPE)
-+			break;
-+		else if (err < 0)
++		if (err < 0) {
++			kfree(core);
++			if (err == -ENODEV) {
++				core_num++;
++				continue;
++			} else if (err == -ENXIO) {
++				continue;
++			} else if (err == -ESPIPE) {
++				break;
++			}
 +			return err;
++		}
 +
 +		core->core_index = core_num++;
 +		bus->nr_cores++;
++		other_core = bcma_find_core_reverse(bus, core->id.id);
++		core->core_unit = (other_core == NULL) ? 0 : other_core->core_unit + 1;
 +
 +		pr_info("Core %d found: %s "
 +			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
@@ -2276,7 +2317,7 @@
 +#endif /* BCMA_SCAN_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma.h
-@@ -0,0 +1,298 @@
+@@ -0,0 +1,307 @@
 +#ifndef LINUX_BCMA_H_
 +#define LINUX_BCMA_H_
 +
@@ -2415,6 +2456,7 @@
 +	bool dev_registered;
 +
 +	u8 core_index;
++	u8 core_unit;
 +
 +	u32 addr;
 +	u32 wrap;
@@ -2441,7 +2483,7 @@
 +
 +	int (*probe)(struct bcma_device *dev);
 +	void (*remove)(struct bcma_device *dev);
-+	int (*suspend)(struct bcma_device *dev, pm_message_t state);
++	int (*suspend)(struct bcma_device *dev);
 +	int (*resume)(struct bcma_device *dev);
 +	void (*shutdown)(struct bcma_device *dev);
 +
@@ -2454,6 +2496,12 @@
 +
 +extern void bcma_driver_unregister(struct bcma_driver *drv);
 +
++/* Set a fallback SPROM.
++ * See kdoc at the function definition for complete documentation. */
++extern int bcma_arch_register_fallback_sprom(
++		int (*sprom_callback)(struct bcma_bus *bus,
++		struct ssb_sprom *out));
++
 +struct bcma_bus {
 +	/* The MMIO area. */
 +	void __iomem *mmio;
@@ -2474,6 +2522,7 @@
 +	struct list_head cores;
 +	u8 nr_cores;
 +	u8 init_done:1;
++	u8 num;
 +
 +	struct bcma_drv_cc drv_cc;
 +	struct bcma_drv_pci drv_pci;
@@ -2561,6 +2610,7 @@
 +	bcma_write16(cc, offset, (bcma_read16(cc, offset) & mask) | set);
 +}
 +
++extern struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid);
 +extern bool bcma_core_is_enabled(struct bcma_device *core);
 +extern void bcma_core_disable(struct bcma_device *core, u32 flags);
 +extern int bcma_core_enable(struct bcma_device *core, u32 flags);
@@ -2577,7 +2627,7 @@
 +#endif /* LINUX_BCMA_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_driver_chipcommon.h
-@@ -0,0 +1,391 @@
+@@ -0,0 +1,415 @@
 +#ifndef LINUX_BCMA_DRIVER_CC_H_
 +#define LINUX_BCMA_DRIVER_CC_H_
 +
@@ -2636,6 +2686,9 @@
 +#define	 BCMA_CC_OTPS_HW_PROTECT	0x00000001
 +#define	 BCMA_CC_OTPS_SW_PROTECT	0x00000002
 +#define	 BCMA_CC_OTPS_CID_PROTECT	0x00000004
++#define  BCMA_CC_OTPS_GU_PROG_IND	0x00000F00	/* General Use programmed indication */
++#define  BCMA_CC_OTPS_GU_PROG_IND_SHIFT	8
++#define  BCMA_CC_OTPS_GU_PROG_HW	0x00000100	/* HW region programmed */
 +#define BCMA_CC_OTPC			0x0014		/* OTP control */
 +#define	 BCMA_CC_OTPC_RECWAIT		0xFF000000
 +#define	 BCMA_CC_OTPC_PROGWAIT		0x00FFFF00
@@ -2652,6 +2705,8 @@
 +#define	 BCMA_CC_OTPP_READ		0x40000000
 +#define	 BCMA_CC_OTPP_START		0x80000000
 +#define	 BCMA_CC_OTPP_BUSY		0x80000000
++#define BCMA_CC_OTPL			0x001C		/* OTP layout */
++#define  BCMA_CC_OTPL_GURGN_OFFSET	0x00000FFF	/* offset of general use region */
 +#define BCMA_CC_IRQSTAT			0x0020
 +#define BCMA_CC_IRQMASK			0x0024
 +#define	 BCMA_CC_IRQ_GPIO		0x00000001	/* gpio intr */
@@ -2659,6 +2714,10 @@
 +#define	 BCMA_CC_IRQ_WDRESET		0x80000000	/* watchdog reset occurred */
 +#define BCMA_CC_CHIPCTL			0x0028		/* Rev >= 11 only */
 +#define BCMA_CC_CHIPSTAT		0x002C		/* Rev >= 11 only */
++#define  BCMA_CC_CHIPST_4313_SPROM_PRESENT	1
++#define  BCMA_CC_CHIPST_4313_OTP_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_SPROM_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_OTP_PRESENT	4
 +#define BCMA_CC_JCMD			0x0030		/* Rev >= 10 only */
 +#define  BCMA_CC_JCMD_START		0x80000000
 +#define  BCMA_CC_JCMD_BUSY		0x80000000
@@ -2761,6 +2820,22 @@
 +#define BCMA_CC_FLASH_CFG		0x0128
 +#define  BCMA_CC_FLASH_CFG_DS		0x0010	/* Data size, 0=8bit, 1=16bit */
 +#define BCMA_CC_FLASH_WAITCNT		0x012C
++#define BCMA_CC_SROM_CONTROL		0x0190
++#define  BCMA_CC_SROM_CONTROL_START	0x80000000
++#define  BCMA_CC_SROM_CONTROL_BUSY	0x80000000
++#define  BCMA_CC_SROM_CONTROL_OPCODE	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OP_READ	0x00000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRITE	0x20000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRDIS	0x40000000
++#define  BCMA_CC_SROM_CONTROL_OP_WREN	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OTPSEL	0x00000010
++#define  BCMA_CC_SROM_CONTROL_LOCK	0x00000008
++#define  BCMA_CC_SROM_CONTROL_SIZE_MASK	0x00000006
++#define  BCMA_CC_SROM_CONTROL_SIZE_1K	0x00000000
++#define  BCMA_CC_SROM_CONTROL_SIZE_4K	0x00000002
++#define  BCMA_CC_SROM_CONTROL_SIZE_16K	0x00000004
++#define  BCMA_CC_SROM_CONTROL_SIZE_SHIFT	1
++#define  BCMA_CC_SROM_CONTROL_PRESENT	0x00000001
 +/* 0x1E0 is defined as shared BCMA_CLKCTLST */
 +#define BCMA_CC_HW_WORKAROUND		0x01E4 /* Hardware workaround (rev >= 20) */
 +#define BCMA_CC_UART0_DATA		0x0300
@@ -2820,7 +2895,6 @@
 +#define BCMA_CC_PLLCTL_ADDR		0x0660
 +#define BCMA_CC_PLLCTL_DATA		0x0664
 +#define BCMA_CC_SPROM			0x0800 /* SPROM beginning */
-+#define BCMA_CC_SPROM_PCIE6		0x0830 /* SPROM beginning on PCIe rev >= 6 */
 +
 +/* Divider allocation in 4716/47162/5356 */
 +#define BCMA_CC_PMU5_MAINPLL_CPU	1
@@ -2971,7 +3045,7 @@
 +#endif /* LINUX_BCMA_DRIVER_CC_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_driver_pci.h
-@@ -0,0 +1,91 @@
+@@ -0,0 +1,214 @@
 +#ifndef LINUX_BCMA_DRIVER_PCI_H_
 +#define LINUX_BCMA_DRIVER_PCI_H_
 +
@@ -3027,6 +3101,35 @@
 +#define  BCMA_CORE_PCI_SBTOPCI1_MASK		0xFC000000
 +#define BCMA_CORE_PCI_SBTOPCI2			0x0108	/* Backplane to PCI translation 2 (sbtopci2) */
 +#define  BCMA_CORE_PCI_SBTOPCI2_MASK		0xC0000000
++#define BCMA_CORE_PCI_CONFIG_ADDR		0x0120	/* pcie config space access */
++#define BCMA_CORE_PCI_CONFIG_DATA		0x0124	/* pcie config space access */
++#define BCMA_CORE_PCI_MDIO_CONTROL		0x0128	/* controls the mdio access */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_MASK	0x7f	/* clock to be used on MDIO */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL	0x2
++#define  BCMA_CORE_PCI_MDIOCTL_PREAM_EN		0x80	/* Enable preamble sequnce */
++#define  BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE	0x100	/* Tranaction complete */
++#define BCMA_CORE_PCI_MDIO_DATA			0x012c	/* Data to the mdio access */
++#define  BCMA_CORE_PCI_MDIODATA_MASK		0x0000ffff /* data 2 bytes */
++#define  BCMA_CORE_PCI_MDIODATA_TA		0x00020000 /* Turnaround */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD	18	/* Regaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK_OLD	0x003c0000 /* Regaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD	22	/* Physmedia devaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK_OLD	0x0fc00000 /* Physmedia devaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF	18	/* Regaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK	0x007c0000 /* Regaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF	23	/* Physmedia devaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK	0x0f800000 /* Physmedia devaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_WRITE		0x10000000 /* write Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_READ		0x20000000 /* Read Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_START		0x40000000 /* start of Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_ADDR	0x0	/* dev address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_BLK_ADDR	0x1F	/* blk address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_PLL		0x1d	/* SERDES PLL Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_TX		0x1e	/* SERDES TX Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_RX		0x1f	/* SERDES RX Dev */
++#define BCMA_CORE_PCI_PCIEIND_ADDR		0x0130	/* indirect access to the internal register */
++#define BCMA_CORE_PCI_PCIEIND_DATA		0x0134	/* Data to/from the internal regsiter */
++#define BCMA_CORE_PCI_CLKREQENCTRL		0x0138	/*  >= rev 6, Clkreq rdma control */
 +#define BCMA_CORE_PCI_PCICFG0			0x0400	/* PCI config space 0 (rev >= 8) */
 +#define BCMA_CORE_PCI_PCICFG1			0x0500	/* PCI config space 1 (rev >= 8) */
 +#define BCMA_CORE_PCI_PCICFG2			0x0600	/* PCI config space 2 (rev >= 8) */
@@ -3046,26 +3149,120 @@
 +#define  BCMA_CORE_PCI_SBTOPCI_RC_READL		0x00000010 /* Memory read line */
 +#define  BCMA_CORE_PCI_SBTOPCI_RC_READM		0x00000020 /* Memory read multiple */
 +
++/* PCIE protocol PHY diagnostic registers */
++#define BCMA_CORE_PCI_PLP_MODEREG		0x200	/* Mode */
++#define BCMA_CORE_PCI_PLP_STATUSREG		0x204	/* Status */
++#define  BCMA_CORE_PCI_PLP_POLARITYINV_STAT	0x10	/* Status reg PCIE_PLP_STATUSREG */
++#define BCMA_CORE_PCI_PLP_LTSSMCTRLREG		0x208	/* LTSSM control */
++#define BCMA_CORE_PCI_PLP_LTLINKNUMREG		0x20c	/* Link Training Link number */
++#define BCMA_CORE_PCI_PLP_LTLANENUMREG		0x210	/* Link Training Lane number */
++#define BCMA_CORE_PCI_PLP_LTNFTSREG		0x214	/* Link Training N_FTS */
++#define BCMA_CORE_PCI_PLP_ATTNREG		0x218	/* Attention */
++#define BCMA_CORE_PCI_PLP_ATTNMASKREG		0x21C	/* Attention Mask */
++#define BCMA_CORE_PCI_PLP_RXERRCTR		0x220	/* Rx Error */
++#define BCMA_CORE_PCI_PLP_RXFRMERRCTR		0x224	/* Rx Framing Error */
++#define BCMA_CORE_PCI_PLP_RXERRTHRESHREG	0x228	/* Rx Error threshold */
++#define BCMA_CORE_PCI_PLP_TESTCTRLREG		0x22C	/* Test Control reg */
++#define BCMA_CORE_PCI_PLP_SERDESCTRLOVRDREG	0x230	/* SERDES Control Override */
++#define BCMA_CORE_PCI_PLP_TIMINGOVRDREG		0x234	/* Timing param override */
++#define BCMA_CORE_PCI_PLP_RXTXSMDIAGREG		0x238	/* RXTX State Machine Diag */
++#define BCMA_CORE_PCI_PLP_LTSSMDIAGREG		0x23C	/* LTSSM State Machine Diag */
++
++/* PCIE protocol DLLP diagnostic registers */
++#define BCMA_CORE_PCI_DLLP_LCREG		0x100	/* Link Control */
++#define BCMA_CORE_PCI_DLLP_LSREG		0x104	/* Link Status */
++#define BCMA_CORE_PCI_DLLP_LAREG		0x108	/* Link Attention */
++#define  BCMA_CORE_PCI_DLLP_LSREG_LINKUP	(1 << 16)
++#define BCMA_CORE_PCI_DLLP_LAMASKREG		0x10C	/* Link Attention Mask */
++#define BCMA_CORE_PCI_DLLP_NEXTTXSEQNUMREG	0x110	/* Next Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_ACKEDTXSEQNUMREG	0x114	/* Acked Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_PURGEDTXSEQNUMREG	0x118	/* Purged Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_RXSEQNUMREG		0x11C	/* Rx Sequence Number */
++#define BCMA_CORE_PCI_DLLP_LRREG		0x120	/* Link Replay */
++#define BCMA_CORE_PCI_DLLP_LACKTOREG		0x124	/* Link Ack Timeout */
++#define BCMA_CORE_PCI_DLLP_PMTHRESHREG		0x128	/* Power Management Threshold */
++#define BCMA_CORE_PCI_DLLP_RTRYWPREG		0x12C	/* Retry buffer write ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYRPREG		0x130	/* Retry buffer Read ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYPPREG		0x134	/* Retry buffer Purged ptr */
++#define BCMA_CORE_PCI_DLLP_RTRRWREG		0x138	/* Retry buffer Read/Write */
++#define BCMA_CORE_PCI_DLLP_ECTHRESHREG		0x13C	/* Error Count Threshold */
++#define BCMA_CORE_PCI_DLLP_TLPERRCTRREG		0x140	/* TLP Error Counter */
++#define BCMA_CORE_PCI_DLLP_ERRCTRREG		0x144	/* Error Counter */
++#define BCMA_CORE_PCI_DLLP_NAKRXCTRREG		0x148	/* NAK Received Counter */
++#define BCMA_CORE_PCI_DLLP_TESTREG		0x14C	/* Test */
++#define BCMA_CORE_PCI_DLLP_PKTBIST		0x150	/* Packet BIST */
++#define BCMA_CORE_PCI_DLLP_PCIE11		0x154	/* DLLP PCIE 1.1 reg */
++
++/* SERDES RX registers */
++#define BCMA_CORE_PCI_SERDES_RX_CTRL		1	/* Rx cntrl */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE	0x80	/* rxpolarity_force */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY	0x40	/* rxpolarity_value */
++#define BCMA_CORE_PCI_SERDES_RX_TIMER1		2	/* Rx Timer1 */
++#define BCMA_CORE_PCI_SERDES_RX_CDR		6	/* CDR */
++#define BCMA_CORE_PCI_SERDES_RX_CDRBW		7	/* CDR BW */
++
++/* SERDES PLL registers */
++#define BCMA_CORE_PCI_SERDES_PLL_CTRL		1	/* PLL control reg */
++#define BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN	0x4000	/* bit 14 is FREQDET on */
++
 +/* PCIcore specific boardflags */
 +#define BCMA_CORE_PCI_BFL_NOPCI			0x00000400 /* Board leaves PCI floating */
 +
++/* PCIE Config space accessing MACROS */
++#define BCMA_CORE_PCI_CFG_BUS_SHIFT		24	/* Bus shift */
++#define BCMA_CORE_PCI_CFG_SLOT_SHIFT		19	/* Slot/Device shift */
++#define BCMA_CORE_PCI_CFG_FUN_SHIFT		16	/* Function shift */
++#define BCMA_CORE_PCI_CFG_OFF_SHIFT		0	/* Register shift */
++
++#define BCMA_CORE_PCI_CFG_BUS_MASK		0xff	/* Bus mask */
++#define BCMA_CORE_PCI_CFG_SLOT_MASK		0x1f	/* Slot/Device mask */
++#define BCMA_CORE_PCI_CFG_FUN_MASK		7	/* Function mask */
++#define BCMA_CORE_PCI_CFG_OFF_MASK		0xfff	/* Register mask */
++
++/* PCIE Root Capability Register bits (Host mode only) */
++#define BCMA_CORE_PCI_RC_CRS_VISIBILITY		0x0001
++
++struct bcma_drv_pci;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++struct bcma_drv_pci_host {
++	struct bcma_drv_pci *pdev;
++
++	u32 host_cfg_addr;
++	spinlock_t cfgspace_lock;
++
++	struct pci_controller pci_controller;
++	struct pci_ops pci_ops;
++	struct resource mem_resource;
++	struct resource io_resource;
++};
++#endif
++
 +struct bcma_drv_pci {
 +	struct bcma_device *core;
 +	u8 setup_done:1;
++	u8 hostmode:1;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	struct bcma_drv_pci_host *host_controller;
++#endif
 +};
 +
 +/* Register access */
 +#define pcicore_read32(pc, offset)		bcma_read32((pc)->core, offset)
 +#define pcicore_write32(pc, offset, val)	bcma_write32((pc)->core, offset, val)
 +
-+extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
++extern void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc);
 +extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
 +				 struct bcma_device *core, bool enable);
 +
++extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
++extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
++
 +#endif /* LINUX_BCMA_DRIVER_PCI_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_regs.h
-@@ -0,0 +1,59 @@
+@@ -0,0 +1,86 @@
 +#ifndef LINUX_BCMA_REGS_H_
 +#define LINUX_BCMA_REGS_H_
 +
@@ -3124,6 +3321,33 @@
 +#define  BCMA_PCI_GPIO_XTAL		0x40	/* PCI config space GPIO 14 for Xtal powerup */
 +#define  BCMA_PCI_GPIO_PLL		0x80	/* PCI config space GPIO 15 for PLL powerdown */
 +
++/* SiliconBackplane Address Map.
++ * All regions may not exist on all chips.
++ */
++#define BCMA_SOC_SDRAM_BASE		0x00000000U	/* Physical SDRAM */
++#define BCMA_SOC_PCI_MEM		0x08000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI_MEM_SZ		(64 * 1024 * 1024)
++#define BCMA_SOC_PCI_CFG		0x0c000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_SDRAM_SWAPPED		0x10000000U	/* Byteswapped Physical SDRAM */
++#define BCMA_SOC_SDRAM_R2		0x80000000U	/* Region 2 for sdram (512 MB) */
++
++
++#define BCMA_SOC_PCI_DMA		0x40000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA2		0x80000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA_SZ		0x40000000U	/* Client Mode sb2pcitranslation2 size in bytes */
++#define BCMA_SOC_PCIE_DMA_L32		0x00000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), low 32 bits
++							 */
++#define BCMA_SOC_PCIE_DMA_H32		0x80000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
++#define BCMA_SOC_PCI1_MEM		0x40000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI1_CFG		0x44000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_PCIE1_DMA_H32		0xc0000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
 +#endif /* LINUX_BCMA_REGS_H_ */
 --- a/include/linux/mod_devicetable.h
 +++ b/include/linux/mod_devicetable.h
@@ -3191,11 +3415,13 @@
  			 sizeof(struct virtio_device_id), "virtio",
 --- /dev/null
 +++ b/drivers/bcma/sprom.c
-@@ -0,0 +1,247 @@
+@@ -0,0 +1,450 @@
 +/*
 + * Broadcom specific AMBA
 + * SPROM reading
 + *
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
@@ -3208,7 +3434,57 @@
 +#include <linux/dma-mapping.h>
 +#include <linux/slab.h>
 +
-+#define SPOFF(offset)	((offset) / sizeof(u16))
++static int(*get_fallback_sprom)(struct bcma_bus *dev, struct ssb_sprom *out);
++
++/**
++ * bcma_arch_register_fallback_sprom - Registers a method providing a
++ * fallback SPROM if no SPROM is found.
++ *
++ * @sprom_callback: The callback function.
++ *
++ * With this function the architecture implementation may register a
++ * callback handler which fills the SPROM data structure. The fallback is
++ * used for PCI based BCMA devices, where no valid SPROM can be found
++ * in the shadow registers and to provide the SPROM for SoCs where BCMA is
++ * to controll the system bus.
++ *
++ * This function is useful for weird architectures that have a half-assed
++ * BCMA device hardwired to their PCI bus.
++ *
++ * This function is available for architecture code, only. So it is not
++ * exported.
++ */
++int bcma_arch_register_fallback_sprom(int (*sprom_callback)(struct bcma_bus *bus,
++				     struct ssb_sprom *out))
++{
++	if (get_fallback_sprom)
++		return -EEXIST;
++	get_fallback_sprom = sprom_callback;
++
++	return 0;
++}
++
++static int bcma_fill_sprom_with_fallback(struct bcma_bus *bus,
++					 struct ssb_sprom *out)
++{
++	int err;
++
++	if (!get_fallback_sprom) {
++		err = -ENOENT;
++		goto fail;
++	}
++
++	err = get_fallback_sprom(bus, out);
++	if (err)
++		goto fail;
++
++	pr_debug("Using SPROM revision %d provided by"
++		 " platform.\n", bus->sprom.revision);
++	return 0;
++fail:
++	pr_warning("Using fallback SPROM failed (err %d)\n", err);
++	return err;
++}
 +
 +/**************************************************
 + * R/W ops.
@@ -3318,10 +3594,21 @@
 + * SPROM extraction.
 + **************************************************/
 +
++#define SPOFF(offset)	((offset) / sizeof(u16))
++
++#define SPEX(_field, _offset, _mask, _shift)	\
++	bus->sprom._field = ((sprom[SPOFF(_offset)] & (_mask)) >> (_shift))
++
 +static void bcma_sprom_extract_r8(struct bcma_bus *bus, const u16 *sprom)
 +{
-+	u16 v;
++	u16 v, o;
 +	int i;
++	u16 pwr_info_offset[] = {
++		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
++		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
++	};
++	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
++			ARRAY_SIZE(bus->sprom.core_pwr_info));
 +
 +	bus->sprom.revision = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] &
 +		SSB_SPROM_REVISION_REV;
@@ -3331,85 +3618,229 @@
 +		*(((__be16 *)bus->sprom.il0mac) + i) = cpu_to_be16(v);
 +	}
 +
-+	bus->sprom.board_rev = sprom[SPOFF(SSB_SPROM8_BOARDREV)];
-+
-+	bus->sprom.txpid2g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G0) >> SSB_SPROM4_TXPID2G0_SHIFT;
-+	bus->sprom.txpid2g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G1) >> SSB_SPROM4_TXPID2G1_SHIFT;
-+	bus->sprom.txpid2g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G2) >> SSB_SPROM4_TXPID2G2_SHIFT;
-+	bus->sprom.txpid2g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G3) >> SSB_SPROM4_TXPID2G3_SHIFT;
-+
-+	bus->sprom.txpid5gl[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL0) >> SSB_SPROM4_TXPID5GL0_SHIFT;
-+	bus->sprom.txpid5gl[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL1) >> SSB_SPROM4_TXPID5GL1_SHIFT;
-+	bus->sprom.txpid5gl[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL2) >> SSB_SPROM4_TXPID5GL2_SHIFT;
-+	bus->sprom.txpid5gl[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL3) >> SSB_SPROM4_TXPID5GL3_SHIFT;
-+
-+	bus->sprom.txpid5g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G0) >> SSB_SPROM4_TXPID5G0_SHIFT;
-+	bus->sprom.txpid5g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G1) >> SSB_SPROM4_TXPID5G1_SHIFT;
-+	bus->sprom.txpid5g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G2) >> SSB_SPROM4_TXPID5G2_SHIFT;
-+	bus->sprom.txpid5g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G3) >> SSB_SPROM4_TXPID5G3_SHIFT;
-+
-+	bus->sprom.txpid5gh[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH0) >> SSB_SPROM4_TXPID5GH0_SHIFT;
-+	bus->sprom.txpid5gh[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH1) >> SSB_SPROM4_TXPID5GH1_SHIFT;
-+	bus->sprom.txpid5gh[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH2) >> SSB_SPROM4_TXPID5GH2_SHIFT;
-+	bus->sprom.txpid5gh[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH3) >> SSB_SPROM4_TXPID5GH3_SHIFT;
-+
-+	bus->sprom.boardflags_lo = sprom[SPOFF(SSB_SPROM8_BFLLO)];
-+	bus->sprom.boardflags_hi = sprom[SPOFF(SSB_SPROM8_BFLHI)];
-+	bus->sprom.boardflags2_lo = sprom[SPOFF(SSB_SPROM8_BFL2LO)];
-+	bus->sprom.boardflags2_hi = sprom[SPOFF(SSB_SPROM8_BFL2HI)];
-+
-+	bus->sprom.country_code = sprom[SPOFF(SSB_SPROM8_CCODE)];
-+
-+	bus->sprom.fem.ghz2.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz2.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz2.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz2.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz2.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
-+
-+	bus->sprom.fem.ghz5.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz5.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz5.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz5.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz5.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
++	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
++
++	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
++	     SSB_SPROM4_TXPID2G0_SHIFT);
++	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
++	     SSB_SPROM4_TXPID2G1_SHIFT);
++	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
++	     SSB_SPROM4_TXPID2G2_SHIFT);
++	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
++	     SSB_SPROM4_TXPID2G3_SHIFT);
++
++	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
++	     SSB_SPROM4_TXPID5GL0_SHIFT);
++	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
++	     SSB_SPROM4_TXPID5GL1_SHIFT);
++	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
++	     SSB_SPROM4_TXPID5GL2_SHIFT);
++	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
++	     SSB_SPROM4_TXPID5GL3_SHIFT);
++
++	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
++	     SSB_SPROM4_TXPID5G0_SHIFT);
++	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
++	     SSB_SPROM4_TXPID5G1_SHIFT);
++	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
++	     SSB_SPROM4_TXPID5G2_SHIFT);
++	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
++	     SSB_SPROM4_TXPID5G3_SHIFT);
++
++	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
++	     SSB_SPROM4_TXPID5GH0_SHIFT);
++	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
++	     SSB_SPROM4_TXPID5GH1_SHIFT);
++	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
++	     SSB_SPROM4_TXPID5GH2_SHIFT);
++	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
++	     SSB_SPROM4_TXPID5GH3_SHIFT);
++
++	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
++	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
++	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
++	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
++
++	SPEX(country_code, SSB_SPROM8_CCODE, ~0, 0);
++
++	/* Extract cores power info info */
++	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
++		o = pwr_info_offset[i];
++		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_MAXP, 0);
++
++		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
++
++		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GH_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
++
++		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
++	}
++
++	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++
++	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++}
++
++/*
++ * Indicates the presence of external SPROM.
++ */
++static bool bcma_sprom_ext_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 srom_control;
++	u32 present_mask;
++
++	if (bus->drv_cc.core->id.rev >= 31) {
++		if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
++			return false;
++
++		srom_control = bcma_read32(bus->drv_cc.core,
++					   BCMA_CC_SROM_CONTROL);
++		return srom_control & BCMA_CC_SROM_CONTROL_PRESENT;
++	}
++
++	/* older chipcommon revisions use chip status register */
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present_mask = BCMA_CC_CHIPST_4313_SPROM_PRESENT;
++		break;
++
++	case 0x4331:
++		present_mask = BCMA_CC_CHIPST_4331_SPROM_PRESENT;
++		break;
++
++	default:
++		return true;
++	}
++
++	return chip_status & present_mask;
++}
++
++/*
++ * Indicates that on-chip OTP memory is present and enabled.
++ */
++static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 otpsize = 0;
++	bool present;
++
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present = chip_status & BCMA_CC_CHIPST_4313_OTP_PRESENT;
++		break;
++
++	case 0x4331:
++		present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
++		break;
++
++	case 43224:
++	case 43225:
++		/* for these chips OTP is always available */
++		present = true;
++		break;
++
++	default:
++		present = false;
++		break;
++	}
++
++	if (present) {
++		otpsize = bus->drv_cc.capabilities & BCMA_CC_CAP_OTPS;
++		otpsize >>= BCMA_CC_CAP_OTPS_SHIFT;
++	}
++
++	return otpsize != 0;
++}
++
++/*
++ * Verify OTP is filled and determine the byte
++ * offset where SPROM data is located.
++ *
++ * On error, returns 0; byte offset otherwise.
++ */
++static int bcma_sprom_onchip_offset(struct bcma_bus *bus)
++{
++	struct bcma_device *cc = bus->drv_cc.core;
++	u32 offset;
++
++	/* verify OTP status */
++	if ((bcma_read32(cc, BCMA_CC_OTPS) & BCMA_CC_OTPS_GU_PROG_HW) == 0)
++		return 0;
++
++	/* obtain bit offset from otplayout register */
++	offset = (bcma_read32(cc, BCMA_CC_OTPL) & BCMA_CC_OTPL_GURGN_OFFSET);
++	return BCMA_CC_SPROM + (offset >> 3);
 +}
 +
 +int bcma_sprom_get(struct bcma_bus *bus)
 +{
-+	u16 offset;
++	u16 offset = BCMA_CC_SPROM;
 +	u16 *sprom;
 +	int err = 0;
 +
 +	if (!bus->drv_cc.core)
 +		return -EOPNOTSUPP;
 +
-+	if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
-+		return -ENOENT;
++	if (!bcma_sprom_ext_available(bus)) {
++		/*
++		 * External SPROM takes precedence so check
++		 * on-chip OTP only when no external SPROM
++		 * is present.
++		 */
++		if (bcma_sprom_onchip_available(bus)) {
++			/* determine offset */
++			offset = bcma_sprom_onchip_offset(bus);
++		}
++		if (!offset) {
++			/*
++			 * Maybe there is no SPROM on the device?
++			 * Now we ask the arch code if there is some sprom
++			 * available for this device in some other storage.
++			 */
++			err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
++			return err;
++		}
++	}
 +
 +	sprom = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
 +			GFP_KERNEL);
@@ -3419,11 +3850,7 @@
 +	if (bus->chipinfo.id == 0x4331)
 +		bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
 +
-+	/* Most cards have SPROM moved by additional offset 0x30 (48 dwords).
-+	 * According to brcm80211 this applies to cards with PCIe rev >= 6
-+	 * TODO: understand this condition and use it */
-+	offset = (bus->chipinfo.id == 0x4331) ? BCMA_CC_SPROM :
-+		BCMA_CC_SPROM_PCIE6;
++	pr_debug("SPROM offset 0x%x\n", offset);
 +	bcma_sprom_read(bus, offset, sprom);
 +
 +	if (bus->chipinfo.id == 0x4331)
@@ -3441,21 +3868,596 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/driver_pci_host.c
-@@ -0,0 +1,14 @@
+@@ -0,0 +1,589 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Core in hostmode
 + *
++ * Copyright 2005 - 2011, Broadcom Corporation
++ * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
 +#include "bcma_private.h"
++#include <linux/pci.h>
++#include <linux/export.h>
 +#include <linux/bcma/bcma.h>
++#include <asm/paccess.h>
++
++/* Probe a 32bit value on the bus and catch bus exceptions.
++ * Returns nonzero on a bus exception.
++ * This is MIPS specific */
++#define mips_busprobe32(val, addr)	get_dbe((val), ((u32 *)(addr)))
++
++/* Assume one-hot slot wiring */
++#define BCMA_PCI_SLOT_MAX	16
++#define	PCI_CONFIG_SPACE_SIZE	256
++
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	u16 chipid_top;
++	u32 tmp;
++
++	chipid_top = (bus->chipinfo.id & 0xFF00);
++	if (chipid_top != 0x4700 &&
++	    chipid_top != 0x5300)
++		return false;
++
++	if (bus->sprom.boardflags_lo & BCMA_CORE_PCI_BFL_NOPCI) {
++		pr_info("This PCI core is disabled and not working\n");
++		return false;
++	}
 +
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++	bcma_core_enable(pc->core, 0);
++
++	return !mips_busprobe32(tmp, pc->core->io_addr);
++}
++
++static u32 bcma_pcie_read_config(struct bcma_drv_pci *pc, u32 address)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_DATA);
++}
++
++static void bcma_pcie_write_config(struct bcma_drv_pci *pc, u32 address,
++				   u32 data)
 +{
-+	pr_err("No support for PCI core in hostmode yet\n");
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_DATA, data);
++}
++
++static u32 bcma_get_cfgspace_addr(struct bcma_drv_pci *pc, unsigned int dev,
++			     unsigned int func, unsigned int off)
++{
++	u32 addr = 0;
++
++	/* Issue config commands only when the data link is up (atleast
++	 * one external pcie device is present).
++	 */
++	if (dev >= 2 || !(bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_LSREG)
++			  & BCMA_CORE_PCI_DLLP_LSREG_LINKUP))
++		goto out;
++
++	/* Type 0 transaction */
++	/* Slide the PCI window to the appropriate slot */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++	/* Calculate the address */
++	addr = pc->host_controller->host_cfg_addr;
++	addr |= (dev << BCMA_CORE_PCI_CFG_SLOT_SHIFT);
++	addr |= (func << BCMA_CORE_PCI_CFG_FUN_SHIFT);
++	addr |= (off & ~3);
++
++out:
++	return addr;
++}
++
++static int bcma_extpci_read_config(struct bcma_drv_pci *pc, unsigned int dev,
++				  unsigned int func, unsigned int off,
++				  void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr, val;
++	void __iomem *mmio = 0;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* we support only two functions on device 0 */
++		if (func > 1)
++			return -EINVAL;
++
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off >= PCI_CONFIG_SPACE_SIZE) {
++			addr = (func << 12);
++			addr |= (off & 0x0FFF);
++			val = bcma_pcie_read_config(pc, addr);
++		} else {
++			addr = BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			val = pcicore_read32(pc, addr);
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++
++		val = readl(mmio);
++	}
++	val >>= (8 * (off & 3));
++
++	switch (len) {
++	case 1:
++		*((u8 *)buf) = (u8)val;
++		break;
++	case 2:
++		*((u16 *)buf) = (u16)val;
++		break;
++	case 4:
++		*((u32 *)buf) = (u32)val;
++		break;
++	}
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
++				   unsigned int func, unsigned int off,
++				   const void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr = 0, val = 0;
++	void __iomem *mmio = 0;
++	u16 chipid = pc->core->bus->chipinfo.id;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off < PCI_CONFIG_SPACE_SIZE) {
++			addr = pc->core->addr + BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			mmio = ioremap_nocache(addr, len);
++			if (!mmio)
++				goto out;
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++	}
++
++	switch (len) {
++	case 1:
++		val = readl(mmio);
++		val &= ~(0xFF << (8 * (off & 3)));
++		val |= *((const u8 *)buf) << (8 * (off & 3));
++		break;
++	case 2:
++		val = readl(mmio);
++		val &= ~(0xFFFF << (8 * (off & 3)));
++		val |= *((const u16 *)buf) << (8 * (off & 3));
++		break;
++	case 4:
++		val = *((const u32 *)buf);
++		break;
++	}
++	if (dev == 0 && !addr) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		addr = (func << 12);
++		addr |= (off & 0x0FFF);
++		bcma_pcie_write_config(pc, addr, val);
++	} else {
++		writel(val, mmio);
++
++		if (chipid == 0x4716 || chipid == 0x4748)
++			readl(mmio);
++	}
++
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_core_pci_hostmode_read_config(struct pci_bus *bus,
++					      unsigned int devfn,
++					      int reg, int size, u32 *val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_read_config(pc, PCI_SLOT(devfn),
++				     PCI_FUNC(devfn), reg, val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++static int bcma_core_pci_hostmode_write_config(struct pci_bus *bus,
++					       unsigned int devfn,
++					       int reg, int size, u32 val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_write_config(pc, PCI_SLOT(devfn),
++				      PCI_FUNC(devfn), reg, &val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++/* return cap_offset if requested capability exists in the PCI config space */
++static u8 __devinit bcma_find_pci_capability(struct bcma_drv_pci *pc,
++					     unsigned int dev,
++					     unsigned int func, u8 req_cap_id,
++					     unsigned char *buf, u32 *buflen)
++{
++	u8 cap_id;
++	u8 cap_ptr = 0;
++	u32 bufsize;
++	u8 byte_val;
++
++	/* check for Header type 0 */
++	bcma_extpci_read_config(pc, dev, func, PCI_HEADER_TYPE, &byte_val,
++				sizeof(u8));
++	if ((byte_val & 0x7f) != PCI_HEADER_TYPE_NORMAL)
++		return cap_ptr;
++
++	/* check if the capability pointer field exists */
++	bcma_extpci_read_config(pc, dev, func, PCI_STATUS, &byte_val,
++				sizeof(u8));
++	if (!(byte_val & PCI_STATUS_CAP_LIST))
++		return cap_ptr;
++
++	/* check if the capability pointer is 0x00 */
++	bcma_extpci_read_config(pc, dev, func, PCI_CAPABILITY_LIST, &cap_ptr,
++				sizeof(u8));
++	if (cap_ptr == 0x00)
++		return cap_ptr;
++
++	/* loop thr'u the capability list and see if the requested capabilty
++	 * exists */
++	bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id, sizeof(u8));
++	while (cap_id != req_cap_id) {
++		bcma_extpci_read_config(pc, dev, func, cap_ptr + 1, &cap_ptr,
++					sizeof(u8));
++		if (cap_ptr == 0x00)
++			return cap_ptr;
++		bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id,
++					sizeof(u8));
++	}
++
++	/* found the caller requested capability */
++	if ((buf != NULL) && (buflen != NULL)) {
++		u8 cap_data;
++
++		bufsize = *buflen;
++		if (!bufsize)
++			return cap_ptr;
++
++		*buflen = 0;
++
++		/* copy the cpability data excluding cap ID and next ptr */
++		cap_data = cap_ptr + 2;
++		if ((bufsize + cap_data)  > PCI_CONFIG_SPACE_SIZE)
++			bufsize = PCI_CONFIG_SPACE_SIZE - cap_data;
++		*buflen = bufsize;
++		while (bufsize--) {
++			bcma_extpci_read_config(pc, dev, func, cap_data, buf,
++						sizeof(u8));
++			cap_data++;
++			buf++;
++		}
++	}
++
++	return cap_ptr;
++}
++
++/* If the root port is capable of returning Config Request
++ * Retry Status (CRS) Completion Status to software then
++ * enable the feature.
++ */
++static void __devinit bcma_core_pci_enable_crs(struct bcma_drv_pci *pc)
++{
++	u8 cap_ptr, root_ctrl, root_cap, dev;
++	u16 val16;
++	int i;
++
++	cap_ptr = bcma_find_pci_capability(pc, 0, 0, PCI_CAP_ID_EXP, NULL,
++					   NULL);
++	root_cap = cap_ptr + PCI_EXP_RTCAP;
++	bcma_extpci_read_config(pc, 0, 0, root_cap, &val16, sizeof(u16));
++	if (val16 & BCMA_CORE_PCI_RC_CRS_VISIBILITY) {
++		/* Enable CRS software visibility */
++		root_ctrl = cap_ptr + PCI_EXP_RTCTL;
++		val16 = PCI_EXP_RTCTL_CRSSVE;
++		bcma_extpci_read_config(pc, 0, 0, root_ctrl, &val16,
++					sizeof(u16));
++
++		/* Initiate a configuration request to read the vendor id
++		 * field of the device function's config space header after
++		 * 100 ms wait time from the end of Reset. If the device is
++		 * not done with its internal initialization, it must at
++		 * least return a completion TLP, with a completion status
++		 * of "Configuration Request Retry Status (CRS)". The root
++		 * complex must complete the request to the host by returning
++		 * a read-data value of 0001h for the Vendor ID field and
++		 * all 1s for any additional bytes included in the request.
++		 * Poll using the config reads for max wait time of 1 sec or
++		 * until we receive the successful completion status. Repeat
++		 * the procedure for all the devices.
++		 */
++		for (dev = 1; dev < BCMA_PCI_SLOT_MAX; dev++) {
++			for (i = 0; i < 100000; i++) {
++				bcma_extpci_read_config(pc, dev, 0,
++							PCI_VENDOR_ID, &val16,
++							sizeof(val16));
++				if (val16 != 0x1)
++					break;
++				udelay(10);
++			}
++			if (val16 == 0x1)
++				pr_err("PCI: Broken device in slot %d\n", dev);
++		}
++	}
++}
++
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	struct bcma_drv_pci_host *pc_host;
++	u32 tmp;
++	u32 pci_membase_1G;
++	unsigned long io_map_base;
++
++	pr_info("PCIEcore in host mode found\n");
++
++	pc_host = kzalloc(sizeof(*pc_host), GFP_KERNEL);
++	if (!pc_host)  {
++		pr_err("can not allocate memory");
++		return;
++	}
++
++	pc->host_controller = pc_host;
++	pc_host->pci_controller.io_resource = &pc_host->io_resource;
++	pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
++	pc_host->pci_controller.pci_ops = &pc_host->pci_ops;
++	pc_host->pdev = pc;
++
++	pci_membase_1G = BCMA_SOC_PCI_DMA;
++	pc_host->host_cfg_addr = BCMA_SOC_PCI_CFG;
++
++	pc_host->pci_ops.read = bcma_core_pci_hostmode_read_config;
++	pc_host->pci_ops.write = bcma_core_pci_hostmode_write_config;
++
++	pc_host->mem_resource.name = "BCMA PCIcore external memory",
++	pc_host->mem_resource.start = BCMA_SOC_PCI_DMA;
++	pc_host->mem_resource.end = BCMA_SOC_PCI_DMA + BCMA_SOC_PCI_DMA_SZ - 1;
++	pc_host->mem_resource.flags = IORESOURCE_MEM | IORESOURCE_PCI_FIXED;
++
++	pc_host->io_resource.name = "BCMA PCIcore external I/O",
++	pc_host->io_resource.start = 0x100;
++	pc_host->io_resource.end = 0x7FF;
++	pc_host->io_resource.flags = IORESOURCE_IO | IORESOURCE_PCI_FIXED;
++
++	/* Reset RC */
++	udelay(3000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST_OE);
++	udelay(1000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST |
++			BCMA_CORE_PCI_CTL_RST_OE);
++
++	/* 64 MB I/O access window. On 4716, use
++	 * sbtopcie0 to access the device registers. We
++	 * can't use address match 2 (1 GB window) region
++	 * as mips can't generate 64-bit address on the
++	 * backplane.
++	 */
++	if (bus->chipinfo.id == 0x4716 || bus->chipinfo.id == 0x4748) {
++		pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++		pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++					    BCMA_SOC_PCI_MEM_SZ - 1;
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_MEM | BCMA_SOC_PCI_MEM);
++	} else if (bus->chipinfo.id == 0x5300) {
++		tmp = BCMA_CORE_PCI_SBTOPCI_MEM;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_PREF;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_BURST;
++		if (pc->core->core_unit == 0) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE_DMA_H32;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI_MEM);
++		} else if (pc->core->core_unit == 1) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI1_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI1_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE1_DMA_H32;
++			pc_host->host_cfg_addr = BCMA_SOC_PCI1_CFG;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI1_MEM);
++		}
++	} else
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_IO);
++
++	/* 64 MB configuration access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++
++	/* 1 GB memory access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI2,
++			BCMA_CORE_PCI_SBTOPCI_MEM | pci_membase_1G);
++
++
++	/* As per PCI Express Base Spec 1.1 we need to wait for
++	 * at least 100 ms from the end of a reset (cold/warm/hot)
++	 * before issuing configuration requests to PCI Express
++	 * devices.
++	 */
++	udelay(100000);
++
++	bcma_core_pci_enable_crs(pc);
++
++	/* Enable PCI bridge BAR0 memory & master access */
++	tmp = PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
++	bcma_extpci_write_config(pc, 0, 0, PCI_COMMAND, &tmp, sizeof(tmp));
++
++	/* Enable PCI interrupts */
++	pcicore_write32(pc, BCMA_CORE_PCI_IMASK, BCMA_CORE_PCI_IMASK_INTA);
++
++	/* Ok, ready to run, register it to the system.
++	 * The following needs change, if we want to port hostmode
++	 * to non-MIPS platform. */
++	io_map_base = (unsigned long)ioremap_nocache(BCMA_SOC_PCI_MEM,
++						     0x04000000);
++	pc_host->pci_controller.io_map_base = io_map_base;
++	set_io_port_base(pc_host->pci_controller.io_map_base);
++	/* Give some time to the PCI controller to configure itself with the new
++	 * values. Not waiting at this point causes crashes of the machine. */
++	mdelay(10);
++	register_pci_controller(&pc_host->pci_controller);
++	return;
++}
++
++/* Early PCI fixup for a device on the PCI-core bridge. */
++static void bcma_core_pci_fixup_pcibridge(struct pci_dev *dev)
++{
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) != 0)
++		return;
++
++	pr_info("PCI: Fixing up bridge %s\n", pci_name(dev));
++
++	/* Enable PCI bridge bus mastering and memory space */
++	pci_set_master(dev);
++	if (pcibios_enable_device(dev, ~0) < 0) {
++		pr_err("PCI: BCMA bridge enable failed\n");
++		return;
++	}
++
++	/* Enable PCI bridge BAR1 prefetch and burst */
++	pci_write_config_dword(dev, BCMA_PCI_BAR1_CONTROL, 3);
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_pcibridge);
++
++/* Early PCI fixup for all PCI-cores to set the correct memory address. */
++static void bcma_core_pci_fixup_addresses(struct pci_dev *dev)
++{
++	struct resource *res;
++	int pos;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) == 0)
++		return;
++
++	pr_info("PCI: Fixing up addresses %s\n", pci_name(dev));
++
++	for (pos = 0; pos < 6; pos++) {
++		res = &dev->resource[pos];
++		if (res->flags & (IORESOURCE_IO | IORESOURCE_MEM))
++			pci_assign_resource(dev, pos);
++	}
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_addresses);
++
++/* This function is called when doing a pci_enable_device().
++ * We must first check if the device is a device on the PCI-core bridge. */
++int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++
++	pr_info("PCI: Fixing up device %s\n", pci_name(dev));
++
++	/* Fix up interrupt lines */
++	dev->irq = bcma_core_mips_irq(pc_host->pdev->core) + 2;
++	pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
++
++	return 0;
++}
++EXPORT_SYMBOL(bcma_core_pci_plat_dev_init);
++
++/* PCI device IRQ mapping. */
++int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++	return bcma_core_mips_irq(pc_host->pdev->core) + 2;
 +}
++EXPORT_SYMBOL(bcma_core_pci_pcibios_map_irq);
 --- /dev/null
 +++ b/drivers/bcma/driver_mips.c
 @@ -0,0 +1,256 @@
diff --git a/target/linux/generic/patches-2.6.31/941-ssb_update.patch b/target/linux/generic/patches-2.6.31/941-ssb_update.patch
index 82c0ff3d96..90eadc8345 100644
--- a/target/linux/generic/patches-2.6.31/941-ssb_update.patch
+++ b/target/linux/generic/patches-2.6.31/941-ssb_update.patch
@@ -225,7 +225,17 @@
   * Copyright 2007, Broadcom Corporation
   *
   * Licensed under the GNU/GPL. See COPYING for details.
-@@ -28,6 +28,21 @@ static void ssb_chipco_pll_write(struct 
+@@ -12,6 +12,9 @@
+ #include <linux/ssb/ssb_regs.h>
+ #include <linux/ssb/ssb_driver_chipcommon.h>
+ #include <linux/delay.h>
++#ifdef CONFIG_BCM47XX
++#include <asm/mach-bcm47xx/nvram.h>
++#endif
+ 
+ #include "ssb_private.h"
+ 
+@@ -28,6 +31,21 @@ static void ssb_chipco_pll_write(struct
  	chipco_write32(cc, SSB_CHIPCO_PLLCTL_DATA, value);
  }
  
@@ -247,8 +257,39 @@
  struct pmu0_plltab_entry {
  	u16 freq;	/* Crystal frequency in kHz.*/
  	u8 xf;		/* Crystal frequency value for PMU control */
-@@ -317,6 +332,12 @@ static void ssb_pmu_pll_init(struct ssb_
+@@ -76,10 +94,6 @@ static void ssb_pmu0_pllinit_r0(struct s
+ 	u32 pmuctl, tmp, pllctl;
+ 	unsigned int i;
+ 
+-	if ((bus->chip_id == 0x5354) && !crystalfreq) {
+-		/* The 5354 crystal freq is 25MHz */
+-		crystalfreq = 25000;
+-	}
+ 	if (crystalfreq)
+ 		e = pmu0_plltab_find_entry(crystalfreq);
+ 	if (!e)
+@@ -305,7 +319,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 	u32 crystalfreq = 0; /* in kHz. 0 = keep default freq. */
+ 
+ 	if (bus->bustype == SSB_BUSTYPE_SSB) {
+-		/* TODO: The user may override the crystal frequency. */
++#ifdef CONFIG_BCM47XX
++		char buf[20];
++		if (nvram_getenv("xtalfreq", buf, sizeof(buf)) >= 0)
++			crystalfreq = simple_strtoul(buf, NULL, 0);
++#endif
+ 	}
+ 
+ 	switch (bus->chip_id) {
+@@ -314,9 +332,19 @@ static void ssb_pmu_pll_init(struct ssb_
+ 		ssb_pmu1_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4328:
++		ssb_pmu0_pllinit_r0(cc, crystalfreq);
++		break;
  	case 0x5354:
++		if (crystalfreq == 0)
++			crystalfreq = 25000;
  		ssb_pmu0_pllinit_r0(cc, crystalfreq);
  		break;
 +	case 0x4322:
@@ -260,7 +301,7 @@
  	default:
  		ssb_printk(KERN_ERR PFX
  			   "ERROR: PLL init unknown for device %04X\n",
-@@ -396,12 +417,15 @@ static void ssb_pmu_resources_init(struc
+@@ -396,12 +424,15 @@ static void ssb_pmu_resources_init(struc
  	u32 min_msk = 0, max_msk = 0;
  	unsigned int i;
  	const struct pmu_res_updown_tab_entry *updown_tab = NULL;
@@ -278,7 +319,7 @@
  		/* We keep the default settings:
  		 * min_msk = 0xCBB
  		 * max_msk = 0x7FFFF
-@@ -480,9 +504,9 @@ static void ssb_pmu_resources_init(struc
+@@ -480,9 +511,9 @@ static void ssb_pmu_resources_init(struc
  		chipco_write32(cc, SSB_CHIPCO_PMU_MAXRES_MSK, max_msk);
  }
  
@@ -289,7 +330,7 @@
  	u32 pmucap;
  
  	if (!(cc->capabilities & SSB_CHIPCO_CAP_PMU))
-@@ -494,15 +518,91 @@ void ssb_pmu_init(struct ssb_chipcommon 
+@@ -494,15 +525,122 @@ void ssb_pmu_init(struct ssb_chipcommon
  	ssb_dprintk(KERN_DEBUG PFX "Found rev %u PMU (capabilities 0x%08X)\n",
  		    cc->pmu.rev, pmucap);
  
@@ -390,6 +431,37 @@
 +
 +EXPORT_SYMBOL(ssb_pmu_set_ldo_voltage);
 +EXPORT_SYMBOL(ssb_pmu_set_ldo_paref);
++
++u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		/* 5354 chip uses a non programmable PLL of frequency 240MHz */
++		return 240000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU cpu clock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
++
++u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		return 120000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU controlclock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
 --- a/drivers/ssb/driver_gige.c
 +++ b/drivers/ssb/driver_gige.c
 @@ -3,7 +3,7 @@
@@ -454,7 +526,17 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
-@@ -270,7 +270,6 @@ void ssb_mipscore_init(struct ssb_mipsco
+@@ -208,6 +208,9 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 	u32 pll_type, n, m, rate = 0;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_cpu_clock(&bus->chipco);
++
+ 	if (bus->extif.dev) {
+ 		ssb_extif_get_clockcontrol(&bus->extif, &pll_type, &n, &m);
+ 	} else if (bus->chipco.dev) {
+@@ -270,7 +273,6 @@ void ssb_mipscore_init(struct ssb_mipsco
  				set_irq(dev, irq++);
  			}
  			break;
@@ -462,7 +544,7 @@
  		case SSB_DEV_PCI:
  		case SSB_DEV_ETHERNET:
  		case SSB_DEV_ETHERNET_GBIT:
-@@ -281,6 +280,10 @@ void ssb_mipscore_init(struct ssb_mipsco
+@@ -281,6 +283,10 @@ void ssb_mipscore_init(struct ssb_mipsco
  				set_irq(dev, irq++);
  				break;
  			}
@@ -496,6 +578,15 @@
  
  static inline
  u32 pcicore_read32(struct ssb_pcicore *pc, u16 offset)
+@@ -69,7 +74,7 @@ static u32 get_cfgspace_addr(struct ssb_
+ 	u32 tmp;
+ 
+ 	/* We do only have one cardbus device behind the bridge. */
+-	if (pc->cardbusmode && (dev >= 1))
++	if (pc->cardbusmode && (dev > 1))
+ 		goto out;
+ 
+ 	if (bus == 0) {
 @@ -246,20 +251,12 @@ static struct pci_controller ssb_pcicore
  	.pci_ops	= &ssb_pcicore_pciops,
  	.io_resource	= &ssb_pcicore_io_resource,
@@ -955,27 +1046,7 @@
  int ssb_for_each_bus_call(unsigned long data,
  			  int (*func)(struct ssb_bus *bus, unsigned long data))
  {
-@@ -120,6 +142,19 @@ static void ssb_device_put(struct ssb_de
- 		put_device(dev->dev);
- }
- 
-+static inline struct ssb_driver *ssb_driver_get(struct ssb_driver *drv)
-+{
-+	if (drv)
-+		get_driver(&drv->drv);
-+	return drv;
-+}
-+
-+static inline void ssb_driver_put(struct ssb_driver *drv)
-+{
-+	if (drv)
-+		put_driver(&drv->drv);
-+}
-+
- static int ssb_device_resume(struct device *dev)
- {
- 	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
-@@ -190,90 +225,81 @@ int ssb_bus_suspend(struct ssb_bus *bus)
+@@ -190,90 +212,78 @@ int ssb_bus_suspend(struct ssb_bus *bus)
  EXPORT_SYMBOL(ssb_bus_suspend);
  
  #ifdef CONFIG_SSB_SPROM
@@ -1033,16 +1104,15 @@
 -			continue;
 -		drv = drv_to_ssb_drv(dev->dev->driver);
 -		if (!drv)
-+		sdrv = ssb_driver_get(drv_to_ssb_drv(sdev->dev->driver));
-+		if (!sdrv || SSB_WARN_ON(!sdrv->remove)) {
-+			ssb_device_put(sdev);
++		sdrv = drv_to_ssb_drv(sdev->dev->driver);
++		if (SSB_WARN_ON(!sdrv->remove))
  			continue;
 -		err = drv->suspend(dev, state);
 -		if (err) {
 -			ssb_printk(KERN_ERR PFX "Failed to freeze device %s\n",
 -				   dev_name(dev->dev));
 -			goto err_unwind;
- 		}
+-		}
 +		sdrv->remove(sdev);
 +		ctx->device_frozen[i] = 1;
  	}
@@ -1109,7 +1179,6 @@
 +				   dev_name(sdev->dev));
 +			result = err;
  		}
-+		ssb_driver_put(sdrv);
 +		ssb_device_put(sdev);
  	}
  
@@ -1118,7 +1187,7 @@
  }
  #endif /* CONFIG_SSB_SPROM */
  
-@@ -360,6 +386,35 @@ static int ssb_device_uevent(struct devi
+@@ -360,6 +370,35 @@ static int ssb_device_uevent(struct devi
  			     ssb_dev->id.revision);
  }
  
@@ -1154,7 +1223,7 @@
  static struct bus_type ssb_bustype = {
  	.name		= "ssb",
  	.match		= ssb_bus_match,
-@@ -369,6 +424,7 @@ static struct bus_type ssb_bustype = {
+@@ -369,6 +408,7 @@ static struct bus_type ssb_bustype = {
  	.suspend	= ssb_device_suspend,
  	.resume		= ssb_device_resume,
  	.uevent		= ssb_device_uevent,
@@ -1162,7 +1231,7 @@
  };
  
  static void ssb_buses_lock(void)
-@@ -461,6 +517,7 @@ static int ssb_devices_register(struct s
+@@ -461,6 +501,7 @@ static int ssb_devices_register(struct s
  #ifdef CONFIG_SSB_PCIHOST
  			sdev->irq = bus->host_pci->irq;
  			dev->parent = &bus->host_pci->dev;
@@ -1170,7 +1239,7 @@
  #endif
  			break;
  		case SSB_BUSTYPE_PCMCIA:
-@@ -469,8 +526,14 @@ static int ssb_devices_register(struct s
+@@ -469,8 +510,14 @@ static int ssb_devices_register(struct s
  			dev->parent = &bus->host_pcmcia->dev;
  #endif
  			break;
@@ -1185,7 +1254,7 @@
  			break;
  		}
  
-@@ -497,7 +560,7 @@ error:
+@@ -497,7 +544,7 @@ error:
  }
  
  /* Needs ssb_buses_lock() */
@@ -1194,7 +1263,7 @@
  {
  	struct ssb_bus *bus, *n;
  	int err = 0;
-@@ -708,9 +771,9 @@ out:
+@@ -708,9 +755,9 @@ out:
  	return err;
  }
  
@@ -1207,7 +1276,7 @@
  {
  	int err;
  
-@@ -724,12 +787,18 @@ static int ssb_bus_register(struct ssb_b
+@@ -724,12 +771,18 @@ static int ssb_bus_register(struct ssb_b
  	err = ssb_pci_xtal(bus, SSB_GPIO_XTAL | SSB_GPIO_PLL, 1);
  	if (err)
  		goto out;
@@ -1227,7 +1296,7 @@
  
  	/* Init PCI-host device (if any) */
  	err = ssb_pci_init(bus);
-@@ -776,6 +845,8 @@ err_pci_exit:
+@@ -776,6 +829,8 @@ err_pci_exit:
  	ssb_pci_exit(bus);
  err_unmap:
  	ssb_iounmap(bus);
@@ -1236,7 +1305,7 @@
  err_disable_xtal:
  	ssb_buses_unlock();
  	ssb_pci_xtal(bus, SSB_GPIO_XTAL | SSB_GPIO_PLL, 0);
-@@ -783,8 +854,8 @@ err_disable_xtal:
+@@ -783,8 +838,8 @@ err_disable_xtal:
  }
  
  #ifdef CONFIG_SSB_PCIHOST
@@ -1247,7 +1316,7 @@
  {
  	int err;
  
-@@ -796,6 +867,9 @@ int ssb_bus_pcibus_register(struct ssb_b
+@@ -796,6 +851,9 @@ int ssb_bus_pcibus_register(struct ssb_b
  	if (!err) {
  		ssb_printk(KERN_INFO PFX "Sonics Silicon Backplane found on "
  			   "PCI device %s\n", dev_name(&host_pci->dev));
@@ -1257,7 +1326,7 @@
  	}
  
  	return err;
-@@ -804,9 +878,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
+@@ -804,9 +862,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
  #endif /* CONFIG_SSB_PCIHOST */
  
  #ifdef CONFIG_SSB_PCMCIAHOST
@@ -1270,7 +1339,7 @@
  {
  	int err;
  
-@@ -825,9 +899,32 @@ int ssb_bus_pcmciabus_register(struct ss
+@@ -825,9 +883,32 @@ int ssb_bus_pcmciabus_register(struct ss
  EXPORT_SYMBOL(ssb_bus_pcmciabus_register);
  #endif /* CONFIG_SSB_PCMCIAHOST */
  
@@ -1306,7 +1375,7 @@
  {
  	int err;
  
-@@ -908,8 +1005,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
+@@ -908,8 +989,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
  	switch (plltype) {
  	case SSB_PLLTYPE_6: /* 100/200 or 120/240 only */
  		if (m & SSB_CHIPCO_CLK_T6_MMASK)
@@ -1317,7 +1386,17 @@
  	case SSB_PLLTYPE_1: /* 48Mhz base, 3 dividers */
  	case SSB_PLLTYPE_3: /* 25Mhz, 2 dividers */
  	case SSB_PLLTYPE_4: /* 48Mhz, 4 dividers */
-@@ -1024,23 +1121,22 @@ static u32 ssb_tmslow_reject_bitmask(str
+@@ -999,6 +1080,9 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
+ 	u32 plltype;
+ 	u32 clkctl_n, clkctl_m;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_controlclock(&bus->chipco);
++
+ 	if (ssb_extif_available(&bus->extif))
+ 		ssb_extif_get_clockcontrol(&bus->extif, &plltype,
+ 					   &clkctl_n, &clkctl_m);
+@@ -1024,23 +1108,22 @@ static u32 ssb_tmslow_reject_bitmask(str
  {
  	u32 rev = ssb_read32(dev, SSB_IDLOW) & SSB_IDLOW_SSBREV;
  
@@ -1348,7 +1427,7 @@
  }
  
  int ssb_device_is_enabled(struct ssb_device *dev)
-@@ -1099,10 +1195,10 @@ void ssb_device_enable(struct ssb_device
+@@ -1099,10 +1182,10 @@ void ssb_device_enable(struct ssb_device
  }
  EXPORT_SYMBOL(ssb_device_enable);
  
@@ -1362,7 +1441,7 @@
  {
  	int i;
  	u32 val;
-@@ -1110,7 +1206,7 @@ static int ssb_wait_bit(struct ssb_devic
+@@ -1110,7 +1193,7 @@ static int ssb_wait_bit(struct ssb_devic
  	for (i = 0; i < timeout; i++) {
  		val = ssb_read32(dev, reg);
  		if (set) {
@@ -1371,7 +1450,7 @@
  				return 0;
  		} else {
  			if (!(val & bitmask))
-@@ -1127,20 +1223,38 @@ static int ssb_wait_bit(struct ssb_devic
+@@ -1127,20 +1210,38 @@ static int ssb_wait_bit(struct ssb_devic
  
  void ssb_device_disable(struct ssb_device *dev, u32 core_specific_flags)
  {
@@ -1419,7 +1498,7 @@
  
  	ssb_write32(dev, SSB_TMSLOW,
  		    reject | SSB_TMSLOW_RESET |
-@@ -1149,13 +1263,34 @@ void ssb_device_disable(struct ssb_devic
+@@ -1149,13 +1250,34 @@ void ssb_device_disable(struct ssb_devic
  }
  EXPORT_SYMBOL(ssb_device_disable);
  
@@ -1455,7 +1534,7 @@
  	default:
  		__ssb_dma_not_implemented(dev);
  	}
-@@ -1272,20 +1407,20 @@ EXPORT_SYMBOL(ssb_bus_may_powerdown);
+@@ -1272,20 +1394,20 @@ EXPORT_SYMBOL(ssb_bus_may_powerdown);
  
  int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl)
  {
@@ -1480,7 +1559,7 @@
  	return 0;
  error:
  	ssb_printk(KERN_ERR PFX "Bus powerup failed\n");
-@@ -1293,6 +1428,37 @@ error:
+@@ -1293,6 +1415,37 @@ error:
  }
  EXPORT_SYMBOL(ssb_bus_powerup);
  
@@ -1518,7 +1597,7 @@
  u32 ssb_admatch_base(u32 adm)
  {
  	u32 base = 0;
-@@ -1358,8 +1524,10 @@ static int __init ssb_modinit(void)
+@@ -1358,8 +1511,10 @@ static int __init ssb_modinit(void)
  	ssb_buses_lock();
  	err = ssb_attach_queued_buses();
  	ssb_buses_unlock();
@@ -1530,7 +1609,7 @@
  
  	err = b43_pci_ssb_bridge_init();
  	if (err) {
-@@ -1375,7 +1543,7 @@ static int __init ssb_modinit(void)
+@@ -1375,7 +1530,7 @@ static int __init ssb_modinit(void)
  		/* don't fail SSB init because of this */
  		err = 0;
  	}
@@ -1577,7 +1656,7 @@
  
  static inline u8 ssb_crc8(u8 crc, u8 data)
  {
-@@ -247,7 +254,7 @@ static int sprom_do_read(struct ssb_bus 
+@@ -247,7 +254,7 @@ static int sprom_do_read(struct ssb_bus
  	int i;
  
  	for (i = 0; i < bus->sprom_size; i++)
@@ -1595,10 +1674,40 @@
  		mmiowb();
  		msleep(20);
  	}
-@@ -399,6 +406,46 @@ static void sprom_extract_r123(struct ss
- 	out->antenna_gain.ghz5.a3 = gain;
- }
+@@ -324,7 +331,6 @@ static void sprom_extract_r123(struct ss
+ {
+ 	int i;
+ 	u16 v;
+-	s8 gain;
+ 	u16 loc[3];
+ 
+ 	if (out->revision == 3)			/* rev 3 moved MAC */
+@@ -383,20 +389,52 @@ static void sprom_extract_r123(struct ss
+ 		SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
  
+ 	/* Extract the antenna gain values. */
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_BG,
+-				    SSB_SPROM1_AGAIN_BG_SHIFT);
+-	out->antenna_gain.ghz24.a0 = gain;
+-	out->antenna_gain.ghz24.a1 = gain;
+-	out->antenna_gain.ghz24.a2 = gain;
+-	out->antenna_gain.ghz24.a3 = gain;
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_A,
+-				    SSB_SPROM1_AGAIN_A_SHIFT);
+-	out->antenna_gain.ghz5.a0 = gain;
+-	out->antenna_gain.ghz5.a1 = gain;
+-	out->antenna_gain.ghz5.a2 = gain;
+-	out->antenna_gain.ghz5.a3 = gain;
++	out->antenna_gain.a0 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_BG,
++						    SSB_SPROM1_AGAIN_BG_SHIFT);
++	out->antenna_gain.a1 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_A,
++						    SSB_SPROM1_AGAIN_A_SHIFT);
++}
++
 +/* Revs 4 5 and 8 have partially shared layout */
 +static void sprom_extract_r458(struct ssb_sprom *out, const u16 *in)
 +{
@@ -1637,12 +1746,10 @@
 +	     SSB_SPROM4_TXPID5GH2, SSB_SPROM4_TXPID5GH2_SHIFT);
 +	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23,
 +	     SSB_SPROM4_TXPID5GH3, SSB_SPROM4_TXPID5GH3_SHIFT);
-+}
-+
+ }
+ 
  static void sprom_extract_r45(struct ssb_sprom *out, const u16 *in)
- {
- 	int i;
-@@ -421,10 +468,14 @@ static void sprom_extract_r45(struct ssb
+@@ -421,10 +459,14 @@ static void sprom_extract_r45(struct ssb
  		SPEX(country_code, SSB_SPROM4_CCODE, 0xFFFF, 0);
  		SPEX(boardflags_lo, SSB_SPROM4_BFLLO, 0xFFFF, 0);
  		SPEX(boardflags_hi, SSB_SPROM4_BFLHI, 0xFFFF, 0);
@@ -1657,15 +1764,30 @@
  	}
  	SPEX(ant_available_a, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_A,
  	     SSB_SPROM4_ANTAVAIL_A_SHIFT);
-@@ -464,22 +515,32 @@ static void sprom_extract_r45(struct ssb
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
+@@ -453,16 +495,16 @@ static void sprom_extract_r45(struct ssb
+ 	}
  
-+	sprom_extract_r458(out, in);
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN0, SSB_SPROM4_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN1, SSB_SPROM4_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN2, SSB_SPROM4_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN3, SSB_SPROM4_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
 +
++	sprom_extract_r458(out, in);
+ 
  	/* TODO - get remaining rev 4 stuff needed */
  }
- 
+@@ -470,16 +512,24 @@ static void sprom_extract_r45(struct ssb
  static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
  {
  	int i;
@@ -1692,7 +1814,7 @@
  	SPEX(ant_available_a, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_A,
  	     SSB_SPROM8_ANTAVAIL_A_SHIFT);
  	SPEX(ant_available_bg, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_BG,
-@@ -490,12 +551,55 @@ static void sprom_extract_r8(struct ssb_
+@@ -490,24 +540,122 @@ static void sprom_extract_r8(struct ssb_
  	SPEX(maxpwr_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_MAXP_A_MASK, 0);
  	SPEX(itssi_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_ITSSI_A,
  	     SSB_SPROM8_ITSSI_A_SHIFT);
@@ -1747,11 +1869,21 @@
 +	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
  
  	/* Extract the antenna gain values. */
- 	SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
-@@ -509,6 +613,63 @@ static void sprom_extract_r8(struct ssb_
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
- 
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
++
 +	/* Extract cores power info info */
 +	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
 +		o = pwr_info_offset[i];
@@ -1808,11 +1940,10 @@
 +		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
 +
 +	sprom_extract_r458(out, in);
-+
+ 
  	/* TODO - get remaining rev 8 stuff needed */
  }
- 
-@@ -521,36 +682,34 @@ static int sprom_extract(struct ssb_bus 
+@@ -521,36 +669,34 @@ static int sprom_extract(struct ssb_bus
  	ssb_dprintk(KERN_DEBUG PFX "SPROM revision %d detected.\n", out->revision);
  	memset(out->et0mac, 0xFF, 6);		/* preset et0 and et1 mac */
  	memset(out->et1mac, 0xFF, 6);
@@ -1870,7 +2001,7 @@
  	}
  
  	if (out->boardflags_lo == 0xFFFF)
-@@ -564,13 +723,34 @@ static int sprom_extract(struct ssb_bus 
+@@ -564,13 +710,34 @@ static int sprom_extract(struct ssb_bus
  static int ssb_pci_sprom_get(struct ssb_bus *bus,
  			     struct ssb_sprom *sprom)
  {
@@ -1908,7 +2039,7 @@
  	bus->sprom_size = SSB_SPROMSIZE_WORDS_R123;
  	sprom_do_read(bus, buf);
  	err = sprom_check_crc(buf, bus->sprom_size);
-@@ -580,17 +760,24 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -580,17 +747,24 @@ static int ssb_pci_sprom_get(struct ssb_
  		buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
  			      GFP_KERNEL);
  		if (!buf)
@@ -1938,7 +2069,7 @@
  				err = 0;
  				goto out_free;
  			}
-@@ -602,19 +789,15 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -602,19 +776,15 @@ static int ssb_pci_sprom_get(struct ssb_
  
  out_free:
  	kfree(buf);
@@ -2027,7 +2158,7 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
-@@ -617,136 +617,140 @@ static int ssb_pcmcia_sprom_check_crc(co
+@@ -617,136 +617,136 @@ static int ssb_pcmcia_sprom_check_crc(co
  	}						\
    } while (0)
  
@@ -2107,14 +2238,10 @@
 +	case SSB_PCMCIA_CIS_ANTGAIN:
 +		GOTO_ERROR_ON(tuple->TupleDataLen != 2,
 +			"antg tpl size");
-+		sprom->antenna_gain.ghz24.a0 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz24.a1 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz24.a2 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz24.a3 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz5.a0 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz5.a1 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz5.a2 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz5.a3 = tuple->TupleData[1];
++		sprom->antenna_gain.a0 = tuple->TupleData[1];
++		sprom->antenna_gain.a1 = tuple->TupleData[1];
++		sprom->antenna_gain.a2 = tuple->TupleData[1];
++		sprom->antenna_gain.a3 = tuple->TupleData[1];
 +		break;
 +	case SSB_PCMCIA_CIS_BFLAGS:
 +		GOTO_ERROR_ON((tuple->TupleDataLen != 3) &&
@@ -2334,7 +2461,7 @@
  	}
  	bus->mmio = NULL;
  	bus->mapped_device = NULL;
-@@ -230,6 +241,10 @@ static void __iomem *ssb_ioremap(struct 
+@@ -230,6 +241,10 @@ static void __iomem *ssb_ioremap(struct
  		SSB_BUG_ON(1); /* Can't reach this code. */
  #endif
  		break;
@@ -2367,7 +2494,17 @@
  			bus->chip_package = 0;
  		} else {
  			bus->chip_id = 0x4710;
-@@ -339,7 +356,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
+@@ -303,6 +320,9 @@ int ssb_bus_scan(struct ssb_bus *bus,
+ 			bus->chip_package = 0;
+ 		}
+ 	}
++	ssb_printk(KERN_INFO PFX "Found chip with id 0x%04X, rev 0x%02X and "
++		   "package 0x%02X\n", bus->chip_id, bus->chip_rev,
++		   bus->chip_package);
+ 	if (!bus->nr_devices)
+ 		bus->nr_devices = chipid_to_nrcores(bus->chip_id);
+ 	if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
+@@ -339,7 +359,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
  		dev->bus = bus;
  		dev->ops = bus->ops;
  
@@ -2376,7 +2513,7 @@
  			    "Core %d found: %s "
  			    "(cc 0x%03X, rev 0x%02X, vendor 0x%04X)\n",
  			    i, ssb_core_name(dev->id.coreid),
-@@ -407,6 +424,16 @@ int ssb_bus_scan(struct ssb_bus *bus,
+@@ -407,6 +427,16 @@ int ssb_bus_scan(struct ssb_bus *bus,
  			bus->pcicore.dev = dev;
  #endif /* CONFIG_SSB_DRIVER_PCICORE */
  			break;
@@ -2395,7 +2532,7 @@
  		}
 --- /dev/null
 +++ b/drivers/ssb/sdio.c
-@@ -0,0 +1,610 @@
+@@ -0,0 +1,606 @@
 +/*
 + * Sonics Silicon Backplane
 + * SDIO-Hostbus related functions
@@ -2949,14 +3086,10 @@
 +			case SSB_SDIO_CIS_ANTGAIN:
 +				GOTO_ERROR_ON(tuple->size != 2,
 +					      "antg tpl size");
-+				sprom->antenna_gain.ghz24.a0 = tuple->data[1];
-+				sprom->antenna_gain.ghz24.a1 = tuple->data[1];
-+				sprom->antenna_gain.ghz24.a2 = tuple->data[1];
-+				sprom->antenna_gain.ghz24.a3 = tuple->data[1];
-+				sprom->antenna_gain.ghz5.a0 = tuple->data[1];
-+				sprom->antenna_gain.ghz5.a1 = tuple->data[1];
-+				sprom->antenna_gain.ghz5.a2 = tuple->data[1];
-+				sprom->antenna_gain.ghz5.a3 = tuple->data[1];
++				sprom->antenna_gain.a0 = tuple->data[1];
++				sprom->antenna_gain.a1 = tuple->data[1];
++				sprom->antenna_gain.a2 = tuple->data[1];
++				sprom->antenna_gain.a3 = tuple->data[1];
 +				break;
 +			case SSB_SDIO_CIS_BFLAGS:
 +				GOTO_ERROR_ON((tuple->size != 3) &&
@@ -3221,12 +3354,16 @@
  static inline int b43_pci_ssb_bridge_init(void)
  {
  	return 0;
-@@ -156,6 +205,6 @@ static inline int b43_pci_ssb_bridge_ini
+@@ -156,6 +205,10 @@ static inline int b43_pci_ssb_bridge_ini
  static inline void b43_pci_ssb_bridge_exit(void)
  {
  }
 -#endif /* CONFIG_SSB_PCIHOST */
 +#endif /* CONFIG_SSB_B43_PCI_BRIDGE */
++
++/* driver_chipcommon_pmu.c */
++extern u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc);
++extern u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc);
  
  #endif /* LINUX_SSB_PRIVATE_H_ */
 --- a/include/linux/pci_ids.h
@@ -3248,23 +3385,26 @@
 +struct ssb_sprom_core_pwr_info {
 +	u8 itssi_2g, itssi_5g;
 +	u8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh;
-+	u16 pa_2g[3], pa_5gl[3], pa_5g[3], pa_5gh[3];
++	u16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4];
 +};
 +
  struct ssb_sprom {
  	u8 revision;
  	u8 il0mac[6];		/* MAC address for 802.11b/g */
-@@ -25,26 +31,64 @@ struct ssb_sprom {
+@@ -25,47 +31,164 @@ struct ssb_sprom {
  	u8 et1phyaddr;		/* MII address for enet1 */
  	u8 et0mdcport;		/* MDIO for enet0 */
  	u8 et1mdcport;		/* MDIO for enet1 */
 -	u8 board_rev;		/* Board revision number from SPROM. */
 +	u16 board_rev;		/* Board revision number from SPROM. */
++	u16 board_num;		/* Board number from SPROM. */
++	u16 board_type;		/* Board type from SPROM. */
  	u8 country_code;	/* Country Code */
 -	u8 ant_available_a;	/* A-PHY antenna available bits (up to 4) */
 -	u8 ant_available_bg;	/* B/G-PHY antenna available bits (up to 4) */
-+	u16 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
-+	u16 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
++	char alpha2[2];		/* Country Code as two chars like EU or US */
++	u8 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
++	u8 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
 +	u8 ant_available_a;	/* 2GHz antenna available bits (up to 4) */
 +	u8 ant_available_bg;	/* 5GHz antenna available bits (up to 4) */
  	u16 pa0b0;
@@ -3285,10 +3425,10 @@
  	u8 gpio3;		/* GPIO pin 3 */
 -	u16 maxpwr_a;		/* A-PHY Amplifier Max Power (in dBm Q5.2) */
 -	u16 maxpwr_bg;		/* B/G-PHY Amplifier Max Power (in dBm Q5.2) */
-+	u16 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
-+	u16 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
-+	u16 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
-+	u16 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
  	u8 itssi_a;		/* Idle TSSI Target for A-PHY */
  	u8 itssi_bg;		/* Idle TSSI Target for B/G-PHY */
 -	u16 boardflags_lo;	/* Boardflags (low 16 bits) */
@@ -3301,8 +3441,8 @@
 +	u8 txpid5gl[4];		/* 4.9 - 5.1GHz TX power index */
 +	u8 txpid5g[4];		/* 5.1 - 5.5GHz TX power index */
 +	u8 txpid5gh[4];		/* 5.5 - ...GHz TX power index */
-+	u8 rxpo2g;		/* 2GHz RX power offset */
-+	u8 rxpo5g;		/* 5GHz RX power offset */
++	s8 rxpo2g;		/* 2GHz RX power offset */
++	s8 rxpo5g;		/* 5GHz RX power offset */
 +	u8 rssisav2g;		/* 2GHz RSSI params */
 +	u8 rssismc2g;
 +	u8 rssismf2g;
@@ -3326,8 +3466,15 @@
  
  	/* Antenna gain values for up to 4 antennas
  	 * on each band. Values in dBm/4 (Q5.2). Negative gain means the
-@@ -58,14 +102,23 @@ struct ssb_sprom {
- 		} ghz5;		/* 5GHz band */
+ 	 * loss in the connectors is bigger than the gain. */
+ 	struct {
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz24;	/* 2.4GHz band */
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz5;		/* 5GHz band */
++		s8 a0, a1, a2, a3;
  	} antenna_gain;
  
 -	/* TODO - add any parameters needed from rev 2, 3, or 4 SPROMs */
@@ -3340,7 +3487,79 @@
 +		} ghz5;
 +	} fem;
 +
-+	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
++	u16 mcs2gpo[8];
++	u16 mcs5gpo[8];
++	u16 mcs5glpo[8];
++	u16 mcs5ghpo[8];
++	u8 opo;
++
++	u8 rxgainerr2ga[3];
++	u8 rxgainerr5gla[3];
++	u8 rxgainerr5gma[3];
++	u8 rxgainerr5gha[3];
++	u8 rxgainerr5gua[3];
++
++	u8 noiselvl2ga[3];
++	u8 noiselvl5gla[3];
++	u8 noiselvl5gma[3];
++	u8 noiselvl5gha[3];
++	u8 noiselvl5gua[3];
++
++	u8 regrev;
++	u8 txchain;
++	u8 rxchain;
++	u8 antswitch;
++	u16 cddpo;
++	u16 stbcpo;
++	u16 bw40po;
++	u16 bwduppo;
++
++	u8 tempthresh;
++	u8 tempoffset;
++	u16 rawtempsense;
++	u8 measpower;
++	u8 tempsense_slope;
++	u8 tempcorrx;
++	u8 tempsense_option;
++	u8 freqoffset_corr;
++	u8 iqcal_swp_dis;
++	u8 hw_iqcal_en;
++	u8 elna2g;
++	u8 elna5g;
++	u8 phycal_tempdelta;
++	u8 temps_period;
++	u8 temps_hysteresis;
++	u8 measpower1;
++	u8 measpower2;
++	u8 pcieingress_war;
++
++	/* power per rate from sromrev 9 */
++	u16 cckbw202gpo;
++	u16 cckbw20ul2gpo;
++	u32 legofdmbw202gpo;
++	u32 legofdmbw20ul2gpo;
++	u32 legofdmbw205glpo;
++	u32 legofdmbw20ul5glpo;
++	u32 legofdmbw205gmpo;
++	u32 legofdmbw20ul5gmpo;
++	u32 legofdmbw205ghpo;
++	u32 legofdmbw20ul5ghpo;
++	u32 mcsbw202gpo;
++	u32 mcsbw20ul2gpo;
++	u32 mcsbw402gpo;
++	u32 mcsbw205glpo;
++	u32 mcsbw20ul5glpo;
++	u32 mcsbw405glpo;
++	u32 mcsbw205gmpo;
++	u32 mcsbw20ul5gmpo;
++	u32 mcsbw405gmpo;
++	u32 mcsbw205ghpo;
++	u32 mcsbw20ul5ghpo;
++	u32 mcsbw405ghpo;
++	u16 mcs32po;
++	u16 legofdm40duppo;
++	u8 sar2g;
++	u8 sar5g;
  };
  
  /* Information about the PCB the circuitry is soldered on. */
@@ -3352,7 +3571,7 @@
  };
  
  
-@@ -137,7 +190,7 @@ struct ssb_device {
+@@ -137,7 +260,7 @@ struct ssb_device {
  	 * is an optimization. */
  	const struct ssb_bus_ops *ops;
  
@@ -3361,7 +3580,7 @@
  
  	struct ssb_bus *bus;
  	struct ssb_device_id id;
-@@ -195,10 +248,9 @@ struct ssb_driver {
+@@ -195,10 +318,9 @@ struct ssb_driver {
  #define drv_to_ssb_drv(_drv) container_of(_drv, struct ssb_driver, drv)
  
  extern int __ssb_driver_register(struct ssb_driver *drv, struct module *owner);
@@ -3375,7 +3594,7 @@
  extern void ssb_driver_unregister(struct ssb_driver *drv);
  
  
-@@ -208,6 +260,7 @@ enum ssb_bustype {
+@@ -208,6 +330,7 @@ enum ssb_bustype {
  	SSB_BUSTYPE_SSB,	/* This SSB bus is the system bus */
  	SSB_BUSTYPE_PCI,	/* SSB is connected to PCI bus */
  	SSB_BUSTYPE_PCMCIA,	/* SSB is connected to PCMCIA bus */
@@ -3383,7 +3602,7 @@
  };
  
  /* board_vendor */
-@@ -238,20 +291,33 @@ struct ssb_bus {
+@@ -238,20 +361,33 @@ struct ssb_bus {
  
  	const struct ssb_bus_ops *ops;
  
@@ -3425,7 +3644,7 @@
  
  #ifdef CONFIG_SSB_SPROM
  	/* Mutex to protect the SPROM writing. */
-@@ -260,7 +326,8 @@ struct ssb_bus {
+@@ -260,7 +396,8 @@ struct ssb_bus {
  
  	/* ID information about the Chip. */
  	u16 chip_id;
@@ -3435,7 +3654,7 @@
  	u16 sprom_size;		/* number of words in sprom */
  	u8 chip_package;
  
-@@ -306,6 +373,11 @@ struct ssb_bus {
+@@ -306,6 +443,11 @@ struct ssb_bus {
  #endif /* DEBUG */
  };
  
@@ -3447,7 +3666,7 @@
  /* The initialization-invariants. */
  struct ssb_init_invariants {
  	/* Versioning information about the PCB. */
-@@ -336,12 +408,23 @@ extern int ssb_bus_pcmciabus_register(st
+@@ -336,12 +478,23 @@ extern int ssb_bus_pcmciabus_register(st
  				      struct pcmcia_device *pcmcia_dev,
  				      unsigned long baseaddr);
  #endif /* CONFIG_SSB_PCMCIAHOST */
@@ -3472,7 +3691,7 @@
  
  /* Suspend a SSB bus.
   * Call this from the parent bus suspend routine. */
-@@ -612,6 +695,7 @@ extern int ssb_bus_may_powerdown(struct 
+@@ -612,6 +765,7 @@ extern int ssb_bus_may_powerdown(struct
   * Otherwise static always-on powercontrol will be used. */
  extern int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl);
  
@@ -4112,3 +4331,13 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
+--- a/include/linux/ssb/ssb_driver_gige.h
++++ b/include/linux/ssb/ssb_driver_gige.h
+@@ -2,6 +2,7 @@
+ #define LINUX_SSB_DRIVER_GIGE_H_
+ 
+ #include <linux/ssb/ssb.h>
++#include <linux/bug.h>
+ #include <linux/pci.h>
+ #include <linux/spinlock.h>
+ 
diff --git a/target/linux/generic/patches-2.6.32/025-bcma_backport.patch b/target/linux/generic/patches-2.6.32/025-bcma_backport.patch
index 3571bd1984..97c821843e 100644
--- a/target/linux/generic/patches-2.6.32/025-bcma_backport.patch
+++ b/target/linux/generic/patches-2.6.32/025-bcma_backport.patch
@@ -103,7 +103,7 @@
 +
 +config BCMA_DRIVER_PCI_HOSTMODE
 +	bool "Driver for PCI core working in hostmode"
-+	depends on BCMA && MIPS
++	depends on BCMA && MIPS && BCMA_HOST_PCI
 +	help
 +	  PCI core hostmode operation (external PCI bus).
 +
@@ -172,7 +172,7 @@
 +- Create kernel Documentation (use info from README)
 --- /dev/null
 +++ b/drivers/bcma/bcma_private.h
-@@ -0,0 +1,54 @@
+@@ -0,0 +1,59 @@
 +#ifndef LINUX_BCMA_PRIVATE_H_
 +#define LINUX_BCMA_PRIVATE_H_
 +
@@ -188,12 +188,13 @@
 +struct bcma_bus;
 +
 +/* main.c */
-+int bcma_bus_register(struct bcma_bus *bus);
++int __devinit bcma_bus_register(struct bcma_bus *bus);
 +void bcma_bus_unregister(struct bcma_bus *bus);
 +int __init bcma_bus_early_register(struct bcma_bus *bus,
 +				   struct bcma_device *core_cc,
 +				   struct bcma_device *core_mips);
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus);
 +int bcma_bus_resume(struct bcma_bus *bus);
 +#endif
 +
@@ -222,8 +223,12 @@
 +extern void __exit bcma_host_pci_exit(void);
 +#endif /* CONFIG_BCMA_HOST_PCI */
 +
++/* driver_pci.c */
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address);
++
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc);
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
 +
 +#endif
@@ -517,7 +522,7 @@
 +#endif /* CONFIG_BCMA_DRIVER_MIPS */
 --- /dev/null
 +++ b/drivers/bcma/driver_chipcommon_pmu.c
-@@ -0,0 +1,309 @@
+@@ -0,0 +1,310 @@
 +/*
 + * Broadcom specific AMBA
 + * ChipCommon Power Management Unit driver
@@ -599,6 +604,7 @@
 +		min_msk = 0x200D;
 +		max_msk = 0xFFFF;
 +		break;
++	case 0x4331:
 +	case 43224:
 +	case 43225:
 +		break;
@@ -829,13 +835,14 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/driver_pci.c
-@@ -0,0 +1,237 @@
+@@ -0,0 +1,225 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Core
 + *
-+ * Copyright 2005, Broadcom Corporation
++ * Copyright 2005, 2011, Broadcom Corporation
 + * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
 + *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
@@ -847,40 +854,41 @@
 + * R/W ops.
 + **************************************************/
 +
-+static u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
 +{
-+	pcicore_write32(pc, 0x130, address);
-+	pcicore_read32(pc, 0x130);
-+	return pcicore_read32(pc, 0x134);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_DATA);
 +}
 +
 +#if 0
 +static void bcma_pcie_write(struct bcma_drv_pci *pc, u32 address, u32 data)
 +{
-+	pcicore_write32(pc, 0x130, address);
-+	pcicore_read32(pc, 0x130);
-+	pcicore_write32(pc, 0x134, data);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_DATA, data);
 +}
 +#endif
 +
 +static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u8 phy)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	u32 v;
 +	int i;
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 28); /* Write Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	v |= (0x1F << 18);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++	v |= (BCMA_CORE_PCI_MDIODATA_BLK_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
 +	v |= (phy << 4);
-+	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +
 +	udelay(10);
 +	for (i = 0; i < 200; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
 +			break;
 +		msleep(1);
 +	}
@@ -888,79 +896,84 @@
 +
 +static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u8 device, u8 address)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	int max_retries = 10;
 +	u16 ret = 0;
 +	u32 v;
 +	int i;
 +
-+	v = 0x80; /* Enable Preamble Sequence */
-+	v |= 0x2; /* MDIO Clock Divisor */
-+	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
 +
 +	if (pc->core->id.rev >= 10) {
 +		max_retries = 200;
 +		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 +	}
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 29); /* Read Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	if (pc->core->id.rev < 10)
-+		v |= (u32)device << 22;
-+	v |= (u32)address << 18;
-+	pcicore_write32(pc, mdio_data, v);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_READ;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
++
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +	/* Wait for the device to complete the transaction */
 +	udelay(10);
 +	for (i = 0; i < max_retries; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */) {
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE) {
 +			udelay(10);
-+			ret = pcicore_read32(pc, mdio_data);
++			ret = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_DATA);
 +			break;
 +		}
 +		msleep(1);
 +	}
-+	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
 +	return ret;
 +}
 +
 +static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u8 device,
 +				u8 address, u16 data)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	int max_retries = 10;
 +	u32 v;
 +	int i;
 +
-+	v = 0x80; /* Enable Preamble Sequence */
-+	v |= 0x2; /* MDIO Clock Divisor */
-+	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
 +
 +	if (pc->core->id.rev >= 10) {
 +		max_retries = 200;
 +		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 +	}
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 28); /* Write Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	if (pc->core->id.rev < 10)
-+		v |= (u32)device << 22;
-+	v |= (u32)address << 18;
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
 +	v |= data;
-+	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +	/* Wait for the device to complete the transaction */
 +	udelay(10);
 +	for (i = 0; i < max_retries; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
 +			break;
 +		msleep(1);
 +	}
-+	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
 +}
 +
 +/**************************************************
@@ -969,72 +982,53 @@
 +
 +static u8 bcma_pcicore_polarity_workaround(struct bcma_drv_pci *pc)
 +{
-+	return (bcma_pcie_read(pc, 0x204) & 0x10) ? 0xC0 : 0x80;
++	u32 tmp;
++
++	tmp = bcma_pcie_read(pc, BCMA_CORE_PCI_PLP_STATUSREG);
++	if (tmp & BCMA_CORE_PCI_PLP_POLARITYINV_STAT)
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE |
++		       BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY;
++	else
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE;
 +}
 +
 +static void bcma_pcicore_serdes_workaround(struct bcma_drv_pci *pc)
 +{
-+	const u8 serdes_pll_device = 0x1D;
-+	const u8 serdes_rx_device = 0x1F;
 +	u16 tmp;
 +
-+	bcma_pcie_mdio_write(pc, serdes_rx_device, 1 /* Control */,
-+			      bcma_pcicore_polarity_workaround(pc));
-+	tmp = bcma_pcie_mdio_read(pc, serdes_pll_device, 1 /* Control */);
-+	if (tmp & 0x4000)
-+		bcma_pcie_mdio_write(pc, serdes_pll_device, 1, tmp & ~0x4000);
++	bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_RX,
++	                     BCMA_CORE_PCI_SERDES_RX_CTRL,
++			     bcma_pcicore_polarity_workaround(pc));
++	tmp = bcma_pcie_mdio_read(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++	                          BCMA_CORE_PCI_SERDES_PLL_CTRL);
++	if (tmp & BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN)
++		bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++		                     BCMA_CORE_PCI_SERDES_PLL_CTRL,
++		                     tmp & ~BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN);
 +}
 +
 +/**************************************************
 + * Init.
 + **************************************************/
 +
-+static void bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
++static void __devinit bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
 +{
 +	bcma_pcicore_serdes_workaround(pc);
 +}
 +
-+static bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
-+{
-+	struct bcma_bus *bus = pc->core->bus;
-+	u16 chipid_top;
-+
-+	chipid_top = (bus->chipinfo.id & 0xFF00);
-+	if (chipid_top != 0x4700 &&
-+	    chipid_top != 0x5300)
-+		return false;
-+
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
-+	if (bus->sprom.boardflags_lo & SSB_BFL_NOPCI)
-+		return false;
-+#endif /* CONFIG_SSB_DRIVER_PCICORE */
-+
-+#if 0
-+	/* TODO: on BCMA we use address from EROM instead of magic formula */
-+	u32 tmp;
-+	return !mips_busprobe32(tmp, (bus->mmio +
-+		(pc->core->core_index * BCMA_CORE_SIZE)));
-+#endif
-+
-+	return true;
-+}
-+
-+void bcma_core_pci_init(struct bcma_drv_pci *pc)
++void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
 +{
 +	if (pc->setup_done)
 +		return;
 +
-+	if (bcma_core_pci_is_in_hostmode(pc)) {
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	pc->hostmode = bcma_core_pci_is_in_hostmode(pc);
++	if (pc->hostmode)
 +		bcma_core_pci_hostmode_init(pc);
-+#else
-+		pr_err("Driver compiled without support for hostmode PCI\n");
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
-+	} else {
-+		bcma_core_pci_clientmode_init(pc);
-+	}
 +
-+	pc->setup_done = true;
++	if (!pc->hostmode)
++		bcma_core_pci_clientmode_init(pc);
 +}
 +
 +int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
@@ -1069,7 +1063,7 @@
 +EXPORT_SYMBOL_GPL(bcma_core_pci_irq_ctl);
 --- /dev/null
 +++ b/drivers/bcma/host_pci.c
-@@ -0,0 +1,299 @@
+@@ -0,0 +1,292 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Host
@@ -1226,8 +1220,8 @@
 +	.awrite32	= bcma_host_pci_awrite32,
 +};
 +
-+static int bcma_host_pci_probe(struct pci_dev *dev,
-+			     const struct pci_device_id *id)
++static int __devinit bcma_host_pci_probe(struct pci_dev *dev,
++					 const struct pci_device_id *id)
 +{
 +	struct bcma_bus *bus;
 +	int err = -ENOMEM;
@@ -1307,38 +1301,32 @@
 +}
 +
 +#ifdef CONFIG_PM
-+static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
++static int bcma_host_pci_suspend(struct device *dev)
 +{
-+	/* Host specific */
-+	pci_save_state(dev);
-+	pci_disable_device(dev);
-+	pci_set_power_state(dev, pci_choose_state(dev, state));
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	return 0;
++	bus->mapped_core = NULL;
++
++	return bcma_bus_suspend(bus);
 +}
 +
-+static int bcma_host_pci_resume(struct pci_dev *dev)
++static int bcma_host_pci_resume(struct device *dev)
 +{
-+	struct bcma_bus *bus = pci_get_drvdata(dev);
-+	int err;
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	/* Host specific */
-+	pci_set_power_state(dev, 0);
-+	err = pci_enable_device(dev);
-+	if (err)
-+		return err;
-+	pci_restore_state(dev);
++	return bcma_bus_resume(bus);
++}
 +
-+	/* Bus specific */
-+	err = bcma_bus_resume(bus);
-+	if (err)
-+		return err;
++static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
++			 bcma_host_pci_resume);
++#define BCMA_PM_OPS	(&bcma_pm_ops)
 +
-+	return 0;
-+}
 +#else /* CONFIG_PM */
-+# define bcma_host_pci_suspend	NULL
-+# define bcma_host_pci_resume	NULL
++
++#define BCMA_PM_OPS     NULL
++
 +#endif /* CONFIG_PM */
 +
 +static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
@@ -1356,8 +1344,7 @@
 +	.id_table = bcma_pci_bridge_tbl,
 +	.probe = bcma_host_pci_probe,
 +	.remove = bcma_host_pci_remove,
-+	.suspend = bcma_host_pci_suspend,
-+	.resume = bcma_host_pci_resume,
++	.driver.pm = BCMA_PM_OPS,
 +};
 +
 +int __init bcma_host_pci_init(void)
@@ -1371,7 +1358,7 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/main.c
-@@ -0,0 +1,354 @@
+@@ -0,0 +1,387 @@
 +/*
 + * Broadcom specific AMBA
 + * Bus subsystem
@@ -1387,6 +1374,12 @@
 +MODULE_DESCRIPTION("Broadcom's specific AMBA driver");
 +MODULE_LICENSE("GPL");
 +
++/* contains the number the next bus should get. */
++static unsigned int bcma_bus_next_num = 0;
++
++/* bcma_buses_mutex locks the bcma_bus_next_num */
++static DEFINE_MUTEX(bcma_buses_mutex);
++
 +static int bcma_bus_match(struct device *dev, struct device_driver *drv);
 +static int bcma_device_probe(struct device *dev);
 +static int bcma_device_remove(struct device *dev);
@@ -1429,7 +1422,7 @@
 +	.dev_attrs	= bcma_device_attrs,
 +};
 +
-+static struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
++struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
 +{
 +	struct bcma_device *core;
 +
@@ -1439,6 +1432,7 @@
 +	}
 +	return NULL;
 +}
++EXPORT_SYMBOL_GPL(bcma_find_core);
 +
 +static void bcma_release_core_dev(struct device *dev)
 +{
@@ -1467,7 +1461,7 @@
 +
 +		core->dev.release = bcma_release_core_dev;
 +		core->dev.bus = &bcma_bus_type;
-+		dev_set_name(&core->dev, "bcma%d:%d", 0/*bus->num*/, dev_id);
++		dev_set_name(&core->dev, "bcma%d:%d", bus->num, dev_id);
 +
 +		switch (bus->hosttype) {
 +		case BCMA_HOSTTYPE_PCI:
@@ -1506,11 +1500,15 @@
 +	}
 +}
 +
-+int bcma_bus_register(struct bcma_bus *bus)
++int __devinit bcma_bus_register(struct bcma_bus *bus)
 +{
 +	int err;
 +	struct bcma_device *core;
 +
++	mutex_lock(&bcma_buses_mutex);
++	bus->num = bcma_bus_next_num++;
++	mutex_unlock(&bcma_buses_mutex);
++
 +	/* Scan for devices (cores) */
 +	err = bcma_bus_scan(bus);
 +	if (err) {
@@ -1543,10 +1541,8 @@
 +	err = bcma_sprom_get(bus);
 +	if (err == -ENOENT) {
 +		pr_err("No SPROM available\n");
-+	} else if (err) {
++	} else if (err)
 +		pr_err("Failed to get SPROM: %d\n", err);
-+		return -ENOENT;
-+	}
 +
 +	/* Register found cores */
 +	bcma_register_cores(bus);
@@ -1615,6 +1611,21 @@
 +}
 +
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->suspend)
++				adrv->suspend(core);
++		}
++	}
++	return 0;
++}
++
 +int bcma_bus_resume(struct bcma_bus *bus)
 +{
 +	struct bcma_device *core;
@@ -1626,6 +1637,15 @@
 +		bcma_core_chipcommon_init(&bus->drv_cc);
 +	}
 +
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->resume)
++				adrv->resume(core);
++		}
++	}
++
 +	return 0;
 +}
 +#endif
@@ -1728,7 +1748,7 @@
 +module_exit(bcma_modexit)
 --- /dev/null
 +++ b/drivers/bcma/scan.c
-@@ -0,0 +1,486 @@
+@@ -0,0 +1,507 @@
 +/*
 + * Broadcom specific AMBA
 + * Bus scanning
@@ -1943,6 +1963,17 @@
 +	return NULL;
 +}
 +
++static struct bcma_device *bcma_find_core_reverse(struct bcma_bus *bus, u16 coreid)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry_reverse(core, &bus->cores, list) {
++		if (core->id.id == coreid)
++			return core;
++	}
++	return NULL;
++}
++
 +static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
 +			      struct bcma_device_id *match, int core_num,
 +			      struct bcma_device *core)
@@ -2084,6 +2115,7 @@
 +void bcma_init_bus(struct bcma_bus *bus)
 +{
 +	s32 tmp;
++	struct bcma_chipinfo *chipinfo = &(bus->chipinfo);
 +
 +	if (bus->init_done)
 +		return;
@@ -2094,9 +2126,12 @@
 +	bcma_scan_switch_core(bus, BCMA_ADDR_BASE);
 +
 +	tmp = bcma_scan_read32(bus, 0, BCMA_CC_ID);
-+	bus->chipinfo.id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
-+	bus->chipinfo.rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
-+	bus->chipinfo.pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	chipinfo->id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
++	chipinfo->rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
++	chipinfo->pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	pr_info("Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
++		chipinfo->id, chipinfo->rev, chipinfo->pkg);
++
 +	bus->init_done = true;
 +}
 +
@@ -2123,6 +2158,7 @@
 +	bcma_scan_switch_core(bus, erombase);
 +
 +	while (eromptr < eromend) {
++		struct bcma_device *other_core;
 +		struct bcma_device *core = kzalloc(sizeof(*core), GFP_KERNEL);
 +		if (!core)
 +			return -ENOMEM;
@@ -2130,18 +2166,23 @@
 +		core->bus = bus;
 +
 +		err = bcma_get_next_core(bus, &eromptr, NULL, core_num, core);
-+		if (err == -ENODEV) {
-+			core_num++;
-+			continue;
-+		} else if (err == -ENXIO)
-+			continue;
-+		else if (err == -ESPIPE)
-+			break;
-+		else if (err < 0)
++		if (err < 0) {
++			kfree(core);
++			if (err == -ENODEV) {
++				core_num++;
++				continue;
++			} else if (err == -ENXIO) {
++				continue;
++			} else if (err == -ESPIPE) {
++				break;
++			}
 +			return err;
++		}
 +
 +		core->core_index = core_num++;
 +		bus->nr_cores++;
++		other_core = bcma_find_core_reverse(bus, core->id.id);
++		core->core_unit = (other_core == NULL) ? 0 : other_core->core_unit + 1;
 +
 +		pr_info("Core %d found: %s "
 +			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
@@ -2276,7 +2317,7 @@
 +#endif /* BCMA_SCAN_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma.h
-@@ -0,0 +1,298 @@
+@@ -0,0 +1,307 @@
 +#ifndef LINUX_BCMA_H_
 +#define LINUX_BCMA_H_
 +
@@ -2415,6 +2456,7 @@
 +	bool dev_registered;
 +
 +	u8 core_index;
++	u8 core_unit;
 +
 +	u32 addr;
 +	u32 wrap;
@@ -2441,7 +2483,7 @@
 +
 +	int (*probe)(struct bcma_device *dev);
 +	void (*remove)(struct bcma_device *dev);
-+	int (*suspend)(struct bcma_device *dev, pm_message_t state);
++	int (*suspend)(struct bcma_device *dev);
 +	int (*resume)(struct bcma_device *dev);
 +	void (*shutdown)(struct bcma_device *dev);
 +
@@ -2454,6 +2496,12 @@
 +
 +extern void bcma_driver_unregister(struct bcma_driver *drv);
 +
++/* Set a fallback SPROM.
++ * See kdoc at the function definition for complete documentation. */
++extern int bcma_arch_register_fallback_sprom(
++		int (*sprom_callback)(struct bcma_bus *bus,
++		struct ssb_sprom *out));
++
 +struct bcma_bus {
 +	/* The MMIO area. */
 +	void __iomem *mmio;
@@ -2474,6 +2522,7 @@
 +	struct list_head cores;
 +	u8 nr_cores;
 +	u8 init_done:1;
++	u8 num;
 +
 +	struct bcma_drv_cc drv_cc;
 +	struct bcma_drv_pci drv_pci;
@@ -2561,6 +2610,7 @@
 +	bcma_write16(cc, offset, (bcma_read16(cc, offset) & mask) | set);
 +}
 +
++extern struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid);
 +extern bool bcma_core_is_enabled(struct bcma_device *core);
 +extern void bcma_core_disable(struct bcma_device *core, u32 flags);
 +extern int bcma_core_enable(struct bcma_device *core, u32 flags);
@@ -2577,7 +2627,7 @@
 +#endif /* LINUX_BCMA_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_driver_chipcommon.h
-@@ -0,0 +1,391 @@
+@@ -0,0 +1,415 @@
 +#ifndef LINUX_BCMA_DRIVER_CC_H_
 +#define LINUX_BCMA_DRIVER_CC_H_
 +
@@ -2636,6 +2686,9 @@
 +#define	 BCMA_CC_OTPS_HW_PROTECT	0x00000001
 +#define	 BCMA_CC_OTPS_SW_PROTECT	0x00000002
 +#define	 BCMA_CC_OTPS_CID_PROTECT	0x00000004
++#define  BCMA_CC_OTPS_GU_PROG_IND	0x00000F00	/* General Use programmed indication */
++#define  BCMA_CC_OTPS_GU_PROG_IND_SHIFT	8
++#define  BCMA_CC_OTPS_GU_PROG_HW	0x00000100	/* HW region programmed */
 +#define BCMA_CC_OTPC			0x0014		/* OTP control */
 +#define	 BCMA_CC_OTPC_RECWAIT		0xFF000000
 +#define	 BCMA_CC_OTPC_PROGWAIT		0x00FFFF00
@@ -2652,6 +2705,8 @@
 +#define	 BCMA_CC_OTPP_READ		0x40000000
 +#define	 BCMA_CC_OTPP_START		0x80000000
 +#define	 BCMA_CC_OTPP_BUSY		0x80000000
++#define BCMA_CC_OTPL			0x001C		/* OTP layout */
++#define  BCMA_CC_OTPL_GURGN_OFFSET	0x00000FFF	/* offset of general use region */
 +#define BCMA_CC_IRQSTAT			0x0020
 +#define BCMA_CC_IRQMASK			0x0024
 +#define	 BCMA_CC_IRQ_GPIO		0x00000001	/* gpio intr */
@@ -2659,6 +2714,10 @@
 +#define	 BCMA_CC_IRQ_WDRESET		0x80000000	/* watchdog reset occurred */
 +#define BCMA_CC_CHIPCTL			0x0028		/* Rev >= 11 only */
 +#define BCMA_CC_CHIPSTAT		0x002C		/* Rev >= 11 only */
++#define  BCMA_CC_CHIPST_4313_SPROM_PRESENT	1
++#define  BCMA_CC_CHIPST_4313_OTP_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_SPROM_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_OTP_PRESENT	4
 +#define BCMA_CC_JCMD			0x0030		/* Rev >= 10 only */
 +#define  BCMA_CC_JCMD_START		0x80000000
 +#define  BCMA_CC_JCMD_BUSY		0x80000000
@@ -2761,6 +2820,22 @@
 +#define BCMA_CC_FLASH_CFG		0x0128
 +#define  BCMA_CC_FLASH_CFG_DS		0x0010	/* Data size, 0=8bit, 1=16bit */
 +#define BCMA_CC_FLASH_WAITCNT		0x012C
++#define BCMA_CC_SROM_CONTROL		0x0190
++#define  BCMA_CC_SROM_CONTROL_START	0x80000000
++#define  BCMA_CC_SROM_CONTROL_BUSY	0x80000000
++#define  BCMA_CC_SROM_CONTROL_OPCODE	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OP_READ	0x00000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRITE	0x20000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRDIS	0x40000000
++#define  BCMA_CC_SROM_CONTROL_OP_WREN	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OTPSEL	0x00000010
++#define  BCMA_CC_SROM_CONTROL_LOCK	0x00000008
++#define  BCMA_CC_SROM_CONTROL_SIZE_MASK	0x00000006
++#define  BCMA_CC_SROM_CONTROL_SIZE_1K	0x00000000
++#define  BCMA_CC_SROM_CONTROL_SIZE_4K	0x00000002
++#define  BCMA_CC_SROM_CONTROL_SIZE_16K	0x00000004
++#define  BCMA_CC_SROM_CONTROL_SIZE_SHIFT	1
++#define  BCMA_CC_SROM_CONTROL_PRESENT	0x00000001
 +/* 0x1E0 is defined as shared BCMA_CLKCTLST */
 +#define BCMA_CC_HW_WORKAROUND		0x01E4 /* Hardware workaround (rev >= 20) */
 +#define BCMA_CC_UART0_DATA		0x0300
@@ -2820,7 +2895,6 @@
 +#define BCMA_CC_PLLCTL_ADDR		0x0660
 +#define BCMA_CC_PLLCTL_DATA		0x0664
 +#define BCMA_CC_SPROM			0x0800 /* SPROM beginning */
-+#define BCMA_CC_SPROM_PCIE6		0x0830 /* SPROM beginning on PCIe rev >= 6 */
 +
 +/* Divider allocation in 4716/47162/5356 */
 +#define BCMA_CC_PMU5_MAINPLL_CPU	1
@@ -2971,7 +3045,7 @@
 +#endif /* LINUX_BCMA_DRIVER_CC_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_driver_pci.h
-@@ -0,0 +1,91 @@
+@@ -0,0 +1,214 @@
 +#ifndef LINUX_BCMA_DRIVER_PCI_H_
 +#define LINUX_BCMA_DRIVER_PCI_H_
 +
@@ -3027,6 +3101,35 @@
 +#define  BCMA_CORE_PCI_SBTOPCI1_MASK		0xFC000000
 +#define BCMA_CORE_PCI_SBTOPCI2			0x0108	/* Backplane to PCI translation 2 (sbtopci2) */
 +#define  BCMA_CORE_PCI_SBTOPCI2_MASK		0xC0000000
++#define BCMA_CORE_PCI_CONFIG_ADDR		0x0120	/* pcie config space access */
++#define BCMA_CORE_PCI_CONFIG_DATA		0x0124	/* pcie config space access */
++#define BCMA_CORE_PCI_MDIO_CONTROL		0x0128	/* controls the mdio access */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_MASK	0x7f	/* clock to be used on MDIO */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL	0x2
++#define  BCMA_CORE_PCI_MDIOCTL_PREAM_EN		0x80	/* Enable preamble sequnce */
++#define  BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE	0x100	/* Tranaction complete */
++#define BCMA_CORE_PCI_MDIO_DATA			0x012c	/* Data to the mdio access */
++#define  BCMA_CORE_PCI_MDIODATA_MASK		0x0000ffff /* data 2 bytes */
++#define  BCMA_CORE_PCI_MDIODATA_TA		0x00020000 /* Turnaround */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD	18	/* Regaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK_OLD	0x003c0000 /* Regaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD	22	/* Physmedia devaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK_OLD	0x0fc00000 /* Physmedia devaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF	18	/* Regaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK	0x007c0000 /* Regaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF	23	/* Physmedia devaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK	0x0f800000 /* Physmedia devaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_WRITE		0x10000000 /* write Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_READ		0x20000000 /* Read Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_START		0x40000000 /* start of Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_ADDR	0x0	/* dev address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_BLK_ADDR	0x1F	/* blk address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_PLL		0x1d	/* SERDES PLL Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_TX		0x1e	/* SERDES TX Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_RX		0x1f	/* SERDES RX Dev */
++#define BCMA_CORE_PCI_PCIEIND_ADDR		0x0130	/* indirect access to the internal register */
++#define BCMA_CORE_PCI_PCIEIND_DATA		0x0134	/* Data to/from the internal regsiter */
++#define BCMA_CORE_PCI_CLKREQENCTRL		0x0138	/*  >= rev 6, Clkreq rdma control */
 +#define BCMA_CORE_PCI_PCICFG0			0x0400	/* PCI config space 0 (rev >= 8) */
 +#define BCMA_CORE_PCI_PCICFG1			0x0500	/* PCI config space 1 (rev >= 8) */
 +#define BCMA_CORE_PCI_PCICFG2			0x0600	/* PCI config space 2 (rev >= 8) */
@@ -3046,26 +3149,120 @@
 +#define  BCMA_CORE_PCI_SBTOPCI_RC_READL		0x00000010 /* Memory read line */
 +#define  BCMA_CORE_PCI_SBTOPCI_RC_READM		0x00000020 /* Memory read multiple */
 +
++/* PCIE protocol PHY diagnostic registers */
++#define BCMA_CORE_PCI_PLP_MODEREG		0x200	/* Mode */
++#define BCMA_CORE_PCI_PLP_STATUSREG		0x204	/* Status */
++#define  BCMA_CORE_PCI_PLP_POLARITYINV_STAT	0x10	/* Status reg PCIE_PLP_STATUSREG */
++#define BCMA_CORE_PCI_PLP_LTSSMCTRLREG		0x208	/* LTSSM control */
++#define BCMA_CORE_PCI_PLP_LTLINKNUMREG		0x20c	/* Link Training Link number */
++#define BCMA_CORE_PCI_PLP_LTLANENUMREG		0x210	/* Link Training Lane number */
++#define BCMA_CORE_PCI_PLP_LTNFTSREG		0x214	/* Link Training N_FTS */
++#define BCMA_CORE_PCI_PLP_ATTNREG		0x218	/* Attention */
++#define BCMA_CORE_PCI_PLP_ATTNMASKREG		0x21C	/* Attention Mask */
++#define BCMA_CORE_PCI_PLP_RXERRCTR		0x220	/* Rx Error */
++#define BCMA_CORE_PCI_PLP_RXFRMERRCTR		0x224	/* Rx Framing Error */
++#define BCMA_CORE_PCI_PLP_RXERRTHRESHREG	0x228	/* Rx Error threshold */
++#define BCMA_CORE_PCI_PLP_TESTCTRLREG		0x22C	/* Test Control reg */
++#define BCMA_CORE_PCI_PLP_SERDESCTRLOVRDREG	0x230	/* SERDES Control Override */
++#define BCMA_CORE_PCI_PLP_TIMINGOVRDREG		0x234	/* Timing param override */
++#define BCMA_CORE_PCI_PLP_RXTXSMDIAGREG		0x238	/* RXTX State Machine Diag */
++#define BCMA_CORE_PCI_PLP_LTSSMDIAGREG		0x23C	/* LTSSM State Machine Diag */
++
++/* PCIE protocol DLLP diagnostic registers */
++#define BCMA_CORE_PCI_DLLP_LCREG		0x100	/* Link Control */
++#define BCMA_CORE_PCI_DLLP_LSREG		0x104	/* Link Status */
++#define BCMA_CORE_PCI_DLLP_LAREG		0x108	/* Link Attention */
++#define  BCMA_CORE_PCI_DLLP_LSREG_LINKUP	(1 << 16)
++#define BCMA_CORE_PCI_DLLP_LAMASKREG		0x10C	/* Link Attention Mask */
++#define BCMA_CORE_PCI_DLLP_NEXTTXSEQNUMREG	0x110	/* Next Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_ACKEDTXSEQNUMREG	0x114	/* Acked Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_PURGEDTXSEQNUMREG	0x118	/* Purged Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_RXSEQNUMREG		0x11C	/* Rx Sequence Number */
++#define BCMA_CORE_PCI_DLLP_LRREG		0x120	/* Link Replay */
++#define BCMA_CORE_PCI_DLLP_LACKTOREG		0x124	/* Link Ack Timeout */
++#define BCMA_CORE_PCI_DLLP_PMTHRESHREG		0x128	/* Power Management Threshold */
++#define BCMA_CORE_PCI_DLLP_RTRYWPREG		0x12C	/* Retry buffer write ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYRPREG		0x130	/* Retry buffer Read ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYPPREG		0x134	/* Retry buffer Purged ptr */
++#define BCMA_CORE_PCI_DLLP_RTRRWREG		0x138	/* Retry buffer Read/Write */
++#define BCMA_CORE_PCI_DLLP_ECTHRESHREG		0x13C	/* Error Count Threshold */
++#define BCMA_CORE_PCI_DLLP_TLPERRCTRREG		0x140	/* TLP Error Counter */
++#define BCMA_CORE_PCI_DLLP_ERRCTRREG		0x144	/* Error Counter */
++#define BCMA_CORE_PCI_DLLP_NAKRXCTRREG		0x148	/* NAK Received Counter */
++#define BCMA_CORE_PCI_DLLP_TESTREG		0x14C	/* Test */
++#define BCMA_CORE_PCI_DLLP_PKTBIST		0x150	/* Packet BIST */
++#define BCMA_CORE_PCI_DLLP_PCIE11		0x154	/* DLLP PCIE 1.1 reg */
++
++/* SERDES RX registers */
++#define BCMA_CORE_PCI_SERDES_RX_CTRL		1	/* Rx cntrl */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE	0x80	/* rxpolarity_force */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY	0x40	/* rxpolarity_value */
++#define BCMA_CORE_PCI_SERDES_RX_TIMER1		2	/* Rx Timer1 */
++#define BCMA_CORE_PCI_SERDES_RX_CDR		6	/* CDR */
++#define BCMA_CORE_PCI_SERDES_RX_CDRBW		7	/* CDR BW */
++
++/* SERDES PLL registers */
++#define BCMA_CORE_PCI_SERDES_PLL_CTRL		1	/* PLL control reg */
++#define BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN	0x4000	/* bit 14 is FREQDET on */
++
 +/* PCIcore specific boardflags */
 +#define BCMA_CORE_PCI_BFL_NOPCI			0x00000400 /* Board leaves PCI floating */
 +
++/* PCIE Config space accessing MACROS */
++#define BCMA_CORE_PCI_CFG_BUS_SHIFT		24	/* Bus shift */
++#define BCMA_CORE_PCI_CFG_SLOT_SHIFT		19	/* Slot/Device shift */
++#define BCMA_CORE_PCI_CFG_FUN_SHIFT		16	/* Function shift */
++#define BCMA_CORE_PCI_CFG_OFF_SHIFT		0	/* Register shift */
++
++#define BCMA_CORE_PCI_CFG_BUS_MASK		0xff	/* Bus mask */
++#define BCMA_CORE_PCI_CFG_SLOT_MASK		0x1f	/* Slot/Device mask */
++#define BCMA_CORE_PCI_CFG_FUN_MASK		7	/* Function mask */
++#define BCMA_CORE_PCI_CFG_OFF_MASK		0xfff	/* Register mask */
++
++/* PCIE Root Capability Register bits (Host mode only) */
++#define BCMA_CORE_PCI_RC_CRS_VISIBILITY		0x0001
++
++struct bcma_drv_pci;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++struct bcma_drv_pci_host {
++	struct bcma_drv_pci *pdev;
++
++	u32 host_cfg_addr;
++	spinlock_t cfgspace_lock;
++
++	struct pci_controller pci_controller;
++	struct pci_ops pci_ops;
++	struct resource mem_resource;
++	struct resource io_resource;
++};
++#endif
++
 +struct bcma_drv_pci {
 +	struct bcma_device *core;
 +	u8 setup_done:1;
++	u8 hostmode:1;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	struct bcma_drv_pci_host *host_controller;
++#endif
 +};
 +
 +/* Register access */
 +#define pcicore_read32(pc, offset)		bcma_read32((pc)->core, offset)
 +#define pcicore_write32(pc, offset, val)	bcma_write32((pc)->core, offset, val)
 +
-+extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
++extern void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc);
 +extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
 +				 struct bcma_device *core, bool enable);
 +
++extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
++extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
++
 +#endif /* LINUX_BCMA_DRIVER_PCI_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_regs.h
-@@ -0,0 +1,59 @@
+@@ -0,0 +1,86 @@
 +#ifndef LINUX_BCMA_REGS_H_
 +#define LINUX_BCMA_REGS_H_
 +
@@ -3124,6 +3321,33 @@
 +#define  BCMA_PCI_GPIO_XTAL		0x40	/* PCI config space GPIO 14 for Xtal powerup */
 +#define  BCMA_PCI_GPIO_PLL		0x80	/* PCI config space GPIO 15 for PLL powerdown */
 +
++/* SiliconBackplane Address Map.
++ * All regions may not exist on all chips.
++ */
++#define BCMA_SOC_SDRAM_BASE		0x00000000U	/* Physical SDRAM */
++#define BCMA_SOC_PCI_MEM		0x08000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI_MEM_SZ		(64 * 1024 * 1024)
++#define BCMA_SOC_PCI_CFG		0x0c000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_SDRAM_SWAPPED		0x10000000U	/* Byteswapped Physical SDRAM */
++#define BCMA_SOC_SDRAM_R2		0x80000000U	/* Region 2 for sdram (512 MB) */
++
++
++#define BCMA_SOC_PCI_DMA		0x40000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA2		0x80000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA_SZ		0x40000000U	/* Client Mode sb2pcitranslation2 size in bytes */
++#define BCMA_SOC_PCIE_DMA_L32		0x00000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), low 32 bits
++							 */
++#define BCMA_SOC_PCIE_DMA_H32		0x80000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
++#define BCMA_SOC_PCI1_MEM		0x40000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI1_CFG		0x44000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_PCIE1_DMA_H32		0xc0000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
 +#endif /* LINUX_BCMA_REGS_H_ */
 --- a/include/linux/mod_devicetable.h
 +++ b/include/linux/mod_devicetable.h
@@ -3191,11 +3415,13 @@
  			 sizeof(struct virtio_device_id), "virtio",
 --- /dev/null
 +++ b/drivers/bcma/sprom.c
-@@ -0,0 +1,247 @@
+@@ -0,0 +1,450 @@
 +/*
 + * Broadcom specific AMBA
 + * SPROM reading
 + *
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
@@ -3208,7 +3434,57 @@
 +#include <linux/dma-mapping.h>
 +#include <linux/slab.h>
 +
-+#define SPOFF(offset)	((offset) / sizeof(u16))
++static int(*get_fallback_sprom)(struct bcma_bus *dev, struct ssb_sprom *out);
++
++/**
++ * bcma_arch_register_fallback_sprom - Registers a method providing a
++ * fallback SPROM if no SPROM is found.
++ *
++ * @sprom_callback: The callback function.
++ *
++ * With this function the architecture implementation may register a
++ * callback handler which fills the SPROM data structure. The fallback is
++ * used for PCI based BCMA devices, where no valid SPROM can be found
++ * in the shadow registers and to provide the SPROM for SoCs where BCMA is
++ * to controll the system bus.
++ *
++ * This function is useful for weird architectures that have a half-assed
++ * BCMA device hardwired to their PCI bus.
++ *
++ * This function is available for architecture code, only. So it is not
++ * exported.
++ */
++int bcma_arch_register_fallback_sprom(int (*sprom_callback)(struct bcma_bus *bus,
++				     struct ssb_sprom *out))
++{
++	if (get_fallback_sprom)
++		return -EEXIST;
++	get_fallback_sprom = sprom_callback;
++
++	return 0;
++}
++
++static int bcma_fill_sprom_with_fallback(struct bcma_bus *bus,
++					 struct ssb_sprom *out)
++{
++	int err;
++
++	if (!get_fallback_sprom) {
++		err = -ENOENT;
++		goto fail;
++	}
++
++	err = get_fallback_sprom(bus, out);
++	if (err)
++		goto fail;
++
++	pr_debug("Using SPROM revision %d provided by"
++		 " platform.\n", bus->sprom.revision);
++	return 0;
++fail:
++	pr_warning("Using fallback SPROM failed (err %d)\n", err);
++	return err;
++}
 +
 +/**************************************************
 + * R/W ops.
@@ -3318,10 +3594,21 @@
 + * SPROM extraction.
 + **************************************************/
 +
++#define SPOFF(offset)	((offset) / sizeof(u16))
++
++#define SPEX(_field, _offset, _mask, _shift)	\
++	bus->sprom._field = ((sprom[SPOFF(_offset)] & (_mask)) >> (_shift))
++
 +static void bcma_sprom_extract_r8(struct bcma_bus *bus, const u16 *sprom)
 +{
-+	u16 v;
++	u16 v, o;
 +	int i;
++	u16 pwr_info_offset[] = {
++		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
++		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
++	};
++	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
++			ARRAY_SIZE(bus->sprom.core_pwr_info));
 +
 +	bus->sprom.revision = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] &
 +		SSB_SPROM_REVISION_REV;
@@ -3331,85 +3618,229 @@
 +		*(((__be16 *)bus->sprom.il0mac) + i) = cpu_to_be16(v);
 +	}
 +
-+	bus->sprom.board_rev = sprom[SPOFF(SSB_SPROM8_BOARDREV)];
-+
-+	bus->sprom.txpid2g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G0) >> SSB_SPROM4_TXPID2G0_SHIFT;
-+	bus->sprom.txpid2g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G1) >> SSB_SPROM4_TXPID2G1_SHIFT;
-+	bus->sprom.txpid2g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G2) >> SSB_SPROM4_TXPID2G2_SHIFT;
-+	bus->sprom.txpid2g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G3) >> SSB_SPROM4_TXPID2G3_SHIFT;
-+
-+	bus->sprom.txpid5gl[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL0) >> SSB_SPROM4_TXPID5GL0_SHIFT;
-+	bus->sprom.txpid5gl[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL1) >> SSB_SPROM4_TXPID5GL1_SHIFT;
-+	bus->sprom.txpid5gl[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL2) >> SSB_SPROM4_TXPID5GL2_SHIFT;
-+	bus->sprom.txpid5gl[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL3) >> SSB_SPROM4_TXPID5GL3_SHIFT;
-+
-+	bus->sprom.txpid5g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G0) >> SSB_SPROM4_TXPID5G0_SHIFT;
-+	bus->sprom.txpid5g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G1) >> SSB_SPROM4_TXPID5G1_SHIFT;
-+	bus->sprom.txpid5g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G2) >> SSB_SPROM4_TXPID5G2_SHIFT;
-+	bus->sprom.txpid5g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G3) >> SSB_SPROM4_TXPID5G3_SHIFT;
-+
-+	bus->sprom.txpid5gh[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH0) >> SSB_SPROM4_TXPID5GH0_SHIFT;
-+	bus->sprom.txpid5gh[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH1) >> SSB_SPROM4_TXPID5GH1_SHIFT;
-+	bus->sprom.txpid5gh[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH2) >> SSB_SPROM4_TXPID5GH2_SHIFT;
-+	bus->sprom.txpid5gh[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH3) >> SSB_SPROM4_TXPID5GH3_SHIFT;
-+
-+	bus->sprom.boardflags_lo = sprom[SPOFF(SSB_SPROM8_BFLLO)];
-+	bus->sprom.boardflags_hi = sprom[SPOFF(SSB_SPROM8_BFLHI)];
-+	bus->sprom.boardflags2_lo = sprom[SPOFF(SSB_SPROM8_BFL2LO)];
-+	bus->sprom.boardflags2_hi = sprom[SPOFF(SSB_SPROM8_BFL2HI)];
-+
-+	bus->sprom.country_code = sprom[SPOFF(SSB_SPROM8_CCODE)];
-+
-+	bus->sprom.fem.ghz2.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz2.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz2.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz2.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz2.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
-+
-+	bus->sprom.fem.ghz5.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz5.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz5.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz5.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz5.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
++	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
++
++	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
++	     SSB_SPROM4_TXPID2G0_SHIFT);
++	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
++	     SSB_SPROM4_TXPID2G1_SHIFT);
++	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
++	     SSB_SPROM4_TXPID2G2_SHIFT);
++	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
++	     SSB_SPROM4_TXPID2G3_SHIFT);
++
++	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
++	     SSB_SPROM4_TXPID5GL0_SHIFT);
++	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
++	     SSB_SPROM4_TXPID5GL1_SHIFT);
++	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
++	     SSB_SPROM4_TXPID5GL2_SHIFT);
++	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
++	     SSB_SPROM4_TXPID5GL3_SHIFT);
++
++	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
++	     SSB_SPROM4_TXPID5G0_SHIFT);
++	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
++	     SSB_SPROM4_TXPID5G1_SHIFT);
++	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
++	     SSB_SPROM4_TXPID5G2_SHIFT);
++	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
++	     SSB_SPROM4_TXPID5G3_SHIFT);
++
++	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
++	     SSB_SPROM4_TXPID5GH0_SHIFT);
++	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
++	     SSB_SPROM4_TXPID5GH1_SHIFT);
++	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
++	     SSB_SPROM4_TXPID5GH2_SHIFT);
++	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
++	     SSB_SPROM4_TXPID5GH3_SHIFT);
++
++	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
++	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
++	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
++	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
++
++	SPEX(country_code, SSB_SPROM8_CCODE, ~0, 0);
++
++	/* Extract cores power info info */
++	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
++		o = pwr_info_offset[i];
++		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_MAXP, 0);
++
++		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
++
++		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GH_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
++
++		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
++	}
++
++	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++
++	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++}
++
++/*
++ * Indicates the presence of external SPROM.
++ */
++static bool bcma_sprom_ext_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 srom_control;
++	u32 present_mask;
++
++	if (bus->drv_cc.core->id.rev >= 31) {
++		if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
++			return false;
++
++		srom_control = bcma_read32(bus->drv_cc.core,
++					   BCMA_CC_SROM_CONTROL);
++		return srom_control & BCMA_CC_SROM_CONTROL_PRESENT;
++	}
++
++	/* older chipcommon revisions use chip status register */
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present_mask = BCMA_CC_CHIPST_4313_SPROM_PRESENT;
++		break;
++
++	case 0x4331:
++		present_mask = BCMA_CC_CHIPST_4331_SPROM_PRESENT;
++		break;
++
++	default:
++		return true;
++	}
++
++	return chip_status & present_mask;
++}
++
++/*
++ * Indicates that on-chip OTP memory is present and enabled.
++ */
++static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 otpsize = 0;
++	bool present;
++
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present = chip_status & BCMA_CC_CHIPST_4313_OTP_PRESENT;
++		break;
++
++	case 0x4331:
++		present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
++		break;
++
++	case 43224:
++	case 43225:
++		/* for these chips OTP is always available */
++		present = true;
++		break;
++
++	default:
++		present = false;
++		break;
++	}
++
++	if (present) {
++		otpsize = bus->drv_cc.capabilities & BCMA_CC_CAP_OTPS;
++		otpsize >>= BCMA_CC_CAP_OTPS_SHIFT;
++	}
++
++	return otpsize != 0;
++}
++
++/*
++ * Verify OTP is filled and determine the byte
++ * offset where SPROM data is located.
++ *
++ * On error, returns 0; byte offset otherwise.
++ */
++static int bcma_sprom_onchip_offset(struct bcma_bus *bus)
++{
++	struct bcma_device *cc = bus->drv_cc.core;
++	u32 offset;
++
++	/* verify OTP status */
++	if ((bcma_read32(cc, BCMA_CC_OTPS) & BCMA_CC_OTPS_GU_PROG_HW) == 0)
++		return 0;
++
++	/* obtain bit offset from otplayout register */
++	offset = (bcma_read32(cc, BCMA_CC_OTPL) & BCMA_CC_OTPL_GURGN_OFFSET);
++	return BCMA_CC_SPROM + (offset >> 3);
 +}
 +
 +int bcma_sprom_get(struct bcma_bus *bus)
 +{
-+	u16 offset;
++	u16 offset = BCMA_CC_SPROM;
 +	u16 *sprom;
 +	int err = 0;
 +
 +	if (!bus->drv_cc.core)
 +		return -EOPNOTSUPP;
 +
-+	if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
-+		return -ENOENT;
++	if (!bcma_sprom_ext_available(bus)) {
++		/*
++		 * External SPROM takes precedence so check
++		 * on-chip OTP only when no external SPROM
++		 * is present.
++		 */
++		if (bcma_sprom_onchip_available(bus)) {
++			/* determine offset */
++			offset = bcma_sprom_onchip_offset(bus);
++		}
++		if (!offset) {
++			/*
++			 * Maybe there is no SPROM on the device?
++			 * Now we ask the arch code if there is some sprom
++			 * available for this device in some other storage.
++			 */
++			err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
++			return err;
++		}
++	}
 +
 +	sprom = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
 +			GFP_KERNEL);
@@ -3419,11 +3850,7 @@
 +	if (bus->chipinfo.id == 0x4331)
 +		bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
 +
-+	/* Most cards have SPROM moved by additional offset 0x30 (48 dwords).
-+	 * According to brcm80211 this applies to cards with PCIe rev >= 6
-+	 * TODO: understand this condition and use it */
-+	offset = (bus->chipinfo.id == 0x4331) ? BCMA_CC_SPROM :
-+		BCMA_CC_SPROM_PCIE6;
++	pr_debug("SPROM offset 0x%x\n", offset);
 +	bcma_sprom_read(bus, offset, sprom);
 +
 +	if (bus->chipinfo.id == 0x4331)
@@ -3441,21 +3868,596 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/driver_pci_host.c
-@@ -0,0 +1,14 @@
+@@ -0,0 +1,589 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Core in hostmode
 + *
++ * Copyright 2005 - 2011, Broadcom Corporation
++ * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
 +#include "bcma_private.h"
++#include <linux/pci.h>
++#include <linux/export.h>
 +#include <linux/bcma/bcma.h>
++#include <asm/paccess.h>
++
++/* Probe a 32bit value on the bus and catch bus exceptions.
++ * Returns nonzero on a bus exception.
++ * This is MIPS specific */
++#define mips_busprobe32(val, addr)	get_dbe((val), ((u32 *)(addr)))
++
++/* Assume one-hot slot wiring */
++#define BCMA_PCI_SLOT_MAX	16
++#define	PCI_CONFIG_SPACE_SIZE	256
++
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	u16 chipid_top;
++	u32 tmp;
++
++	chipid_top = (bus->chipinfo.id & 0xFF00);
++	if (chipid_top != 0x4700 &&
++	    chipid_top != 0x5300)
++		return false;
++
++	if (bus->sprom.boardflags_lo & BCMA_CORE_PCI_BFL_NOPCI) {
++		pr_info("This PCI core is disabled and not working\n");
++		return false;
++	}
 +
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++	bcma_core_enable(pc->core, 0);
++
++	return !mips_busprobe32(tmp, pc->core->io_addr);
++}
++
++static u32 bcma_pcie_read_config(struct bcma_drv_pci *pc, u32 address)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_DATA);
++}
++
++static void bcma_pcie_write_config(struct bcma_drv_pci *pc, u32 address,
++				   u32 data)
 +{
-+	pr_err("No support for PCI core in hostmode yet\n");
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_DATA, data);
++}
++
++static u32 bcma_get_cfgspace_addr(struct bcma_drv_pci *pc, unsigned int dev,
++			     unsigned int func, unsigned int off)
++{
++	u32 addr = 0;
++
++	/* Issue config commands only when the data link is up (atleast
++	 * one external pcie device is present).
++	 */
++	if (dev >= 2 || !(bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_LSREG)
++			  & BCMA_CORE_PCI_DLLP_LSREG_LINKUP))
++		goto out;
++
++	/* Type 0 transaction */
++	/* Slide the PCI window to the appropriate slot */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++	/* Calculate the address */
++	addr = pc->host_controller->host_cfg_addr;
++	addr |= (dev << BCMA_CORE_PCI_CFG_SLOT_SHIFT);
++	addr |= (func << BCMA_CORE_PCI_CFG_FUN_SHIFT);
++	addr |= (off & ~3);
++
++out:
++	return addr;
++}
++
++static int bcma_extpci_read_config(struct bcma_drv_pci *pc, unsigned int dev,
++				  unsigned int func, unsigned int off,
++				  void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr, val;
++	void __iomem *mmio = 0;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* we support only two functions on device 0 */
++		if (func > 1)
++			return -EINVAL;
++
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off >= PCI_CONFIG_SPACE_SIZE) {
++			addr = (func << 12);
++			addr |= (off & 0x0FFF);
++			val = bcma_pcie_read_config(pc, addr);
++		} else {
++			addr = BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			val = pcicore_read32(pc, addr);
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++
++		val = readl(mmio);
++	}
++	val >>= (8 * (off & 3));
++
++	switch (len) {
++	case 1:
++		*((u8 *)buf) = (u8)val;
++		break;
++	case 2:
++		*((u16 *)buf) = (u16)val;
++		break;
++	case 4:
++		*((u32 *)buf) = (u32)val;
++		break;
++	}
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
++				   unsigned int func, unsigned int off,
++				   const void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr = 0, val = 0;
++	void __iomem *mmio = 0;
++	u16 chipid = pc->core->bus->chipinfo.id;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off < PCI_CONFIG_SPACE_SIZE) {
++			addr = pc->core->addr + BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			mmio = ioremap_nocache(addr, len);
++			if (!mmio)
++				goto out;
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++	}
++
++	switch (len) {
++	case 1:
++		val = readl(mmio);
++		val &= ~(0xFF << (8 * (off & 3)));
++		val |= *((const u8 *)buf) << (8 * (off & 3));
++		break;
++	case 2:
++		val = readl(mmio);
++		val &= ~(0xFFFF << (8 * (off & 3)));
++		val |= *((const u16 *)buf) << (8 * (off & 3));
++		break;
++	case 4:
++		val = *((const u32 *)buf);
++		break;
++	}
++	if (dev == 0 && !addr) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		addr = (func << 12);
++		addr |= (off & 0x0FFF);
++		bcma_pcie_write_config(pc, addr, val);
++	} else {
++		writel(val, mmio);
++
++		if (chipid == 0x4716 || chipid == 0x4748)
++			readl(mmio);
++	}
++
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_core_pci_hostmode_read_config(struct pci_bus *bus,
++					      unsigned int devfn,
++					      int reg, int size, u32 *val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_read_config(pc, PCI_SLOT(devfn),
++				     PCI_FUNC(devfn), reg, val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++static int bcma_core_pci_hostmode_write_config(struct pci_bus *bus,
++					       unsigned int devfn,
++					       int reg, int size, u32 val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_write_config(pc, PCI_SLOT(devfn),
++				      PCI_FUNC(devfn), reg, &val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++/* return cap_offset if requested capability exists in the PCI config space */
++static u8 __devinit bcma_find_pci_capability(struct bcma_drv_pci *pc,
++					     unsigned int dev,
++					     unsigned int func, u8 req_cap_id,
++					     unsigned char *buf, u32 *buflen)
++{
++	u8 cap_id;
++	u8 cap_ptr = 0;
++	u32 bufsize;
++	u8 byte_val;
++
++	/* check for Header type 0 */
++	bcma_extpci_read_config(pc, dev, func, PCI_HEADER_TYPE, &byte_val,
++				sizeof(u8));
++	if ((byte_val & 0x7f) != PCI_HEADER_TYPE_NORMAL)
++		return cap_ptr;
++
++	/* check if the capability pointer field exists */
++	bcma_extpci_read_config(pc, dev, func, PCI_STATUS, &byte_val,
++				sizeof(u8));
++	if (!(byte_val & PCI_STATUS_CAP_LIST))
++		return cap_ptr;
++
++	/* check if the capability pointer is 0x00 */
++	bcma_extpci_read_config(pc, dev, func, PCI_CAPABILITY_LIST, &cap_ptr,
++				sizeof(u8));
++	if (cap_ptr == 0x00)
++		return cap_ptr;
++
++	/* loop thr'u the capability list and see if the requested capabilty
++	 * exists */
++	bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id, sizeof(u8));
++	while (cap_id != req_cap_id) {
++		bcma_extpci_read_config(pc, dev, func, cap_ptr + 1, &cap_ptr,
++					sizeof(u8));
++		if (cap_ptr == 0x00)
++			return cap_ptr;
++		bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id,
++					sizeof(u8));
++	}
++
++	/* found the caller requested capability */
++	if ((buf != NULL) && (buflen != NULL)) {
++		u8 cap_data;
++
++		bufsize = *buflen;
++		if (!bufsize)
++			return cap_ptr;
++
++		*buflen = 0;
++
++		/* copy the cpability data excluding cap ID and next ptr */
++		cap_data = cap_ptr + 2;
++		if ((bufsize + cap_data)  > PCI_CONFIG_SPACE_SIZE)
++			bufsize = PCI_CONFIG_SPACE_SIZE - cap_data;
++		*buflen = bufsize;
++		while (bufsize--) {
++			bcma_extpci_read_config(pc, dev, func, cap_data, buf,
++						sizeof(u8));
++			cap_data++;
++			buf++;
++		}
++	}
++
++	return cap_ptr;
++}
++
++/* If the root port is capable of returning Config Request
++ * Retry Status (CRS) Completion Status to software then
++ * enable the feature.
++ */
++static void __devinit bcma_core_pci_enable_crs(struct bcma_drv_pci *pc)
++{
++	u8 cap_ptr, root_ctrl, root_cap, dev;
++	u16 val16;
++	int i;
++
++	cap_ptr = bcma_find_pci_capability(pc, 0, 0, PCI_CAP_ID_EXP, NULL,
++					   NULL);
++	root_cap = cap_ptr + PCI_EXP_RTCAP;
++	bcma_extpci_read_config(pc, 0, 0, root_cap, &val16, sizeof(u16));
++	if (val16 & BCMA_CORE_PCI_RC_CRS_VISIBILITY) {
++		/* Enable CRS software visibility */
++		root_ctrl = cap_ptr + PCI_EXP_RTCTL;
++		val16 = PCI_EXP_RTCTL_CRSSVE;
++		bcma_extpci_read_config(pc, 0, 0, root_ctrl, &val16,
++					sizeof(u16));
++
++		/* Initiate a configuration request to read the vendor id
++		 * field of the device function's config space header after
++		 * 100 ms wait time from the end of Reset. If the device is
++		 * not done with its internal initialization, it must at
++		 * least return a completion TLP, with a completion status
++		 * of "Configuration Request Retry Status (CRS)". The root
++		 * complex must complete the request to the host by returning
++		 * a read-data value of 0001h for the Vendor ID field and
++		 * all 1s for any additional bytes included in the request.
++		 * Poll using the config reads for max wait time of 1 sec or
++		 * until we receive the successful completion status. Repeat
++		 * the procedure for all the devices.
++		 */
++		for (dev = 1; dev < BCMA_PCI_SLOT_MAX; dev++) {
++			for (i = 0; i < 100000; i++) {
++				bcma_extpci_read_config(pc, dev, 0,
++							PCI_VENDOR_ID, &val16,
++							sizeof(val16));
++				if (val16 != 0x1)
++					break;
++				udelay(10);
++			}
++			if (val16 == 0x1)
++				pr_err("PCI: Broken device in slot %d\n", dev);
++		}
++	}
++}
++
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	struct bcma_drv_pci_host *pc_host;
++	u32 tmp;
++	u32 pci_membase_1G;
++	unsigned long io_map_base;
++
++	pr_info("PCIEcore in host mode found\n");
++
++	pc_host = kzalloc(sizeof(*pc_host), GFP_KERNEL);
++	if (!pc_host)  {
++		pr_err("can not allocate memory");
++		return;
++	}
++
++	pc->host_controller = pc_host;
++	pc_host->pci_controller.io_resource = &pc_host->io_resource;
++	pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
++	pc_host->pci_controller.pci_ops = &pc_host->pci_ops;
++	pc_host->pdev = pc;
++
++	pci_membase_1G = BCMA_SOC_PCI_DMA;
++	pc_host->host_cfg_addr = BCMA_SOC_PCI_CFG;
++
++	pc_host->pci_ops.read = bcma_core_pci_hostmode_read_config;
++	pc_host->pci_ops.write = bcma_core_pci_hostmode_write_config;
++
++	pc_host->mem_resource.name = "BCMA PCIcore external memory",
++	pc_host->mem_resource.start = BCMA_SOC_PCI_DMA;
++	pc_host->mem_resource.end = BCMA_SOC_PCI_DMA + BCMA_SOC_PCI_DMA_SZ - 1;
++	pc_host->mem_resource.flags = IORESOURCE_MEM | IORESOURCE_PCI_FIXED;
++
++	pc_host->io_resource.name = "BCMA PCIcore external I/O",
++	pc_host->io_resource.start = 0x100;
++	pc_host->io_resource.end = 0x7FF;
++	pc_host->io_resource.flags = IORESOURCE_IO | IORESOURCE_PCI_FIXED;
++
++	/* Reset RC */
++	udelay(3000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST_OE);
++	udelay(1000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST |
++			BCMA_CORE_PCI_CTL_RST_OE);
++
++	/* 64 MB I/O access window. On 4716, use
++	 * sbtopcie0 to access the device registers. We
++	 * can't use address match 2 (1 GB window) region
++	 * as mips can't generate 64-bit address on the
++	 * backplane.
++	 */
++	if (bus->chipinfo.id == 0x4716 || bus->chipinfo.id == 0x4748) {
++		pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++		pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++					    BCMA_SOC_PCI_MEM_SZ - 1;
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_MEM | BCMA_SOC_PCI_MEM);
++	} else if (bus->chipinfo.id == 0x5300) {
++		tmp = BCMA_CORE_PCI_SBTOPCI_MEM;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_PREF;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_BURST;
++		if (pc->core->core_unit == 0) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE_DMA_H32;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI_MEM);
++		} else if (pc->core->core_unit == 1) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI1_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI1_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE1_DMA_H32;
++			pc_host->host_cfg_addr = BCMA_SOC_PCI1_CFG;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI1_MEM);
++		}
++	} else
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_IO);
++
++	/* 64 MB configuration access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++
++	/* 1 GB memory access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI2,
++			BCMA_CORE_PCI_SBTOPCI_MEM | pci_membase_1G);
++
++
++	/* As per PCI Express Base Spec 1.1 we need to wait for
++	 * at least 100 ms from the end of a reset (cold/warm/hot)
++	 * before issuing configuration requests to PCI Express
++	 * devices.
++	 */
++	udelay(100000);
++
++	bcma_core_pci_enable_crs(pc);
++
++	/* Enable PCI bridge BAR0 memory & master access */
++	tmp = PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
++	bcma_extpci_write_config(pc, 0, 0, PCI_COMMAND, &tmp, sizeof(tmp));
++
++	/* Enable PCI interrupts */
++	pcicore_write32(pc, BCMA_CORE_PCI_IMASK, BCMA_CORE_PCI_IMASK_INTA);
++
++	/* Ok, ready to run, register it to the system.
++	 * The following needs change, if we want to port hostmode
++	 * to non-MIPS platform. */
++	io_map_base = (unsigned long)ioremap_nocache(BCMA_SOC_PCI_MEM,
++						     0x04000000);
++	pc_host->pci_controller.io_map_base = io_map_base;
++	set_io_port_base(pc_host->pci_controller.io_map_base);
++	/* Give some time to the PCI controller to configure itself with the new
++	 * values. Not waiting at this point causes crashes of the machine. */
++	mdelay(10);
++	register_pci_controller(&pc_host->pci_controller);
++	return;
++}
++
++/* Early PCI fixup for a device on the PCI-core bridge. */
++static void bcma_core_pci_fixup_pcibridge(struct pci_dev *dev)
++{
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) != 0)
++		return;
++
++	pr_info("PCI: Fixing up bridge %s\n", pci_name(dev));
++
++	/* Enable PCI bridge bus mastering and memory space */
++	pci_set_master(dev);
++	if (pcibios_enable_device(dev, ~0) < 0) {
++		pr_err("PCI: BCMA bridge enable failed\n");
++		return;
++	}
++
++	/* Enable PCI bridge BAR1 prefetch and burst */
++	pci_write_config_dword(dev, BCMA_PCI_BAR1_CONTROL, 3);
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_pcibridge);
++
++/* Early PCI fixup for all PCI-cores to set the correct memory address. */
++static void bcma_core_pci_fixup_addresses(struct pci_dev *dev)
++{
++	struct resource *res;
++	int pos;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) == 0)
++		return;
++
++	pr_info("PCI: Fixing up addresses %s\n", pci_name(dev));
++
++	for (pos = 0; pos < 6; pos++) {
++		res = &dev->resource[pos];
++		if (res->flags & (IORESOURCE_IO | IORESOURCE_MEM))
++			pci_assign_resource(dev, pos);
++	}
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_addresses);
++
++/* This function is called when doing a pci_enable_device().
++ * We must first check if the device is a device on the PCI-core bridge. */
++int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++
++	pr_info("PCI: Fixing up device %s\n", pci_name(dev));
++
++	/* Fix up interrupt lines */
++	dev->irq = bcma_core_mips_irq(pc_host->pdev->core) + 2;
++	pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
++
++	return 0;
++}
++EXPORT_SYMBOL(bcma_core_pci_plat_dev_init);
++
++/* PCI device IRQ mapping. */
++int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++	return bcma_core_mips_irq(pc_host->pdev->core) + 2;
 +}
++EXPORT_SYMBOL(bcma_core_pci_pcibios_map_irq);
 --- /dev/null
 +++ b/drivers/bcma/driver_mips.c
 @@ -0,0 +1,256 @@
diff --git a/target/linux/generic/patches-2.6.32/975-ssb_update.patch b/target/linux/generic/patches-2.6.32/975-ssb_update.patch
index 0564fa3c76..c5492d3e96 100644
--- a/target/linux/generic/patches-2.6.32/975-ssb_update.patch
+++ b/target/linux/generic/patches-2.6.32/975-ssb_update.patch
@@ -164,8 +164,49 @@
   * Copyright 2007, Broadcom Corporation
   *
   * Licensed under the GNU/GPL. See COPYING for details.
-@@ -332,6 +332,12 @@ static void ssb_pmu_pll_init(struct ssb_
+@@ -12,6 +12,9 @@
+ #include <linux/ssb/ssb_regs.h>
+ #include <linux/ssb/ssb_driver_chipcommon.h>
+ #include <linux/delay.h>
++#ifdef CONFIG_BCM47XX
++#include <asm/mach-bcm47xx/nvram.h>
++#endif
+ 
+ #include "ssb_private.h"
+ 
+@@ -91,10 +94,6 @@ static void ssb_pmu0_pllinit_r0(struct s
+ 	u32 pmuctl, tmp, pllctl;
+ 	unsigned int i;
+ 
+-	if ((bus->chip_id == 0x5354) && !crystalfreq) {
+-		/* The 5354 crystal freq is 25MHz */
+-		crystalfreq = 25000;
+-	}
+ 	if (crystalfreq)
+ 		e = pmu0_plltab_find_entry(crystalfreq);
+ 	if (!e)
+@@ -320,7 +319,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 	u32 crystalfreq = 0; /* in kHz. 0 = keep default freq. */
+ 
+ 	if (bus->bustype == SSB_BUSTYPE_SSB) {
+-		/* TODO: The user may override the crystal frequency. */
++#ifdef CONFIG_BCM47XX
++		char buf[20];
++		if (nvram_getenv("xtalfreq", buf, sizeof(buf)) >= 0)
++			crystalfreq = simple_strtoul(buf, NULL, 0);
++#endif
+ 	}
+ 
+ 	switch (bus->chip_id) {
+@@ -329,9 +332,19 @@ static void ssb_pmu_pll_init(struct ssb_
+ 		ssb_pmu1_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4328:
++		ssb_pmu0_pllinit_r0(cc, crystalfreq);
++		break;
  	case 0x5354:
++		if (crystalfreq == 0)
++			crystalfreq = 25000;
  		ssb_pmu0_pllinit_r0(cc, crystalfreq);
  		break;
 +	case 0x4322:
@@ -177,7 +218,7 @@
  	default:
  		ssb_printk(KERN_ERR PFX
  			   "ERROR: PLL init unknown for device %04X\n",
-@@ -411,12 +417,15 @@ static void ssb_pmu_resources_init(struc
+@@ -411,12 +424,15 @@ static void ssb_pmu_resources_init(struc
  	u32 min_msk = 0, max_msk = 0;
  	unsigned int i;
  	const struct pmu_res_updown_tab_entry *updown_tab = NULL;
@@ -195,7 +236,7 @@
  		/* We keep the default settings:
  		 * min_msk = 0xCBB
  		 * max_msk = 0x7FFFF
-@@ -495,9 +504,9 @@ static void ssb_pmu_resources_init(struc
+@@ -495,9 +511,9 @@ static void ssb_pmu_resources_init(struc
  		chipco_write32(cc, SSB_CHIPCO_PMU_MAXRES_MSK, max_msk);
  }
  
@@ -206,7 +247,7 @@
  	u32 pmucap;
  
  	if (!(cc->capabilities & SSB_CHIPCO_CAP_PMU))
-@@ -509,15 +518,12 @@ void ssb_pmu_init(struct ssb_chipcommon
+@@ -509,15 +525,12 @@ void ssb_pmu_init(struct ssb_chipcommon
  	ssb_dprintk(KERN_DEBUG PFX "Found rev %u PMU (capabilities 0x%08X)\n",
  		    cc->pmu.rev, pmucap);
  
@@ -228,6 +269,41 @@
  	ssb_pmu_pll_init(cc);
  	ssb_pmu_resources_init(cc);
  }
+@@ -600,3 +613,34 @@ void ssb_pmu_set_ldo_paref(struct ssb_ch
+ 
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_voltage);
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_paref);
++
++u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		/* 5354 chip uses a non programmable PLL of frequency 240MHz */
++		return 240000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU cpu clock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
++
++u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		return 120000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU controlclock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
 --- a/drivers/ssb/driver_gige.c
 +++ b/drivers/ssb/driver_gige.c
 @@ -3,7 +3,7 @@
@@ -292,7 +368,17 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
-@@ -270,7 +270,6 @@ void ssb_mipscore_init(struct ssb_mipsco
+@@ -208,6 +208,9 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 	u32 pll_type, n, m, rate = 0;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_cpu_clock(&bus->chipco);
++
+ 	if (bus->extif.dev) {
+ 		ssb_extif_get_clockcontrol(&bus->extif, &pll_type, &n, &m);
+ 	} else if (bus->chipco.dev) {
+@@ -270,7 +273,6 @@ void ssb_mipscore_init(struct ssb_mipsco
  				set_irq(dev, irq++);
  			}
  			break;
@@ -300,7 +386,7 @@
  		case SSB_DEV_PCI:
  		case SSB_DEV_ETHERNET:
  		case SSB_DEV_ETHERNET_GBIT:
-@@ -281,6 +280,10 @@ void ssb_mipscore_init(struct ssb_mipsco
+@@ -281,6 +283,10 @@ void ssb_mipscore_init(struct ssb_mipsco
  				set_irq(dev, irq++);
  				break;
  			}
@@ -334,6 +420,15 @@
  
  static inline
  u32 pcicore_read32(struct ssb_pcicore *pc, u16 offset)
+@@ -69,7 +74,7 @@ static u32 get_cfgspace_addr(struct ssb_
+ 	u32 tmp;
+ 
+ 	/* We do only have one cardbus device behind the bridge. */
+-	if (pc->cardbusmode && (dev >= 1))
++	if (pc->cardbusmode && (dev > 1))
+ 		goto out;
+ 
+ 	if (bus == 0) {
 @@ -246,20 +251,12 @@ static struct pci_controller ssb_pcicore
  	.pci_ops	= &ssb_pcicore_pciops,
  	.io_resource	= &ssb_pcicore_io_resource,
@@ -767,27 +862,7 @@
  
  #include <pcmcia/cs_types.h>
  #include <pcmcia/cs.h>
-@@ -140,6 +142,19 @@ static void ssb_device_put(struct ssb_de
- 		put_device(dev->dev);
- }
- 
-+static inline struct ssb_driver *ssb_driver_get(struct ssb_driver *drv)
-+{
-+	if (drv)
-+		get_driver(&drv->drv);
-+	return drv;
-+}
-+
-+static inline void ssb_driver_put(struct ssb_driver *drv)
-+{
-+	if (drv)
-+		put_driver(&drv->drv);
-+}
-+
- static int ssb_device_resume(struct device *dev)
- {
- 	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
-@@ -210,90 +225,81 @@ int ssb_bus_suspend(struct ssb_bus *bus)
+@@ -210,90 +212,78 @@ int ssb_bus_suspend(struct ssb_bus *bus)
  EXPORT_SYMBOL(ssb_bus_suspend);
  
  #ifdef CONFIG_SSB_SPROM
@@ -842,19 +917,18 @@
 -		if (!dev->dev ||
 -		    !dev->dev->driver ||
 -		    !device_is_registered(dev->dev))
-+		sdrv = ssb_driver_get(drv_to_ssb_drv(sdev->dev->driver));
-+		if (!sdrv || SSB_WARN_ON(!sdrv->remove)) {
-+			ssb_device_put(sdev);
- 			continue;
+-			continue;
 -		drv = drv_to_ssb_drv(dev->dev->driver);
 -		if (!drv)
--			continue;
++		sdrv = drv_to_ssb_drv(sdev->dev->driver);
++		if (SSB_WARN_ON(!sdrv->remove))
+ 			continue;
 -		err = drv->suspend(dev, state);
 -		if (err) {
 -			ssb_printk(KERN_ERR PFX "Failed to freeze device %s\n",
 -				   dev_name(dev->dev));
 -			goto err_unwind;
- 		}
+-		}
 +		sdrv->remove(sdev);
 +		ctx->device_frozen[i] = 1;
  	}
@@ -921,7 +995,6 @@
 +				   dev_name(sdev->dev));
 +			result = err;
  		}
-+		ssb_driver_put(sdrv);
 +		ssb_device_put(sdev);
  	}
  
@@ -930,7 +1003,7 @@
  }
  #endif /* CONFIG_SSB_SPROM */
  
-@@ -380,6 +386,35 @@ static int ssb_device_uevent(struct devi
+@@ -380,6 +370,35 @@ static int ssb_device_uevent(struct devi
  			     ssb_dev->id.revision);
  }
  
@@ -966,7 +1039,7 @@
  static struct bus_type ssb_bustype = {
  	.name		= "ssb",
  	.match		= ssb_bus_match,
-@@ -389,6 +424,7 @@ static struct bus_type ssb_bustype = {
+@@ -389,6 +408,7 @@ static struct bus_type ssb_bustype = {
  	.suspend	= ssb_device_suspend,
  	.resume		= ssb_device_resume,
  	.uevent		= ssb_device_uevent,
@@ -974,7 +1047,7 @@
  };
  
  static void ssb_buses_lock(void)
-@@ -481,6 +517,7 @@ static int ssb_devices_register(struct s
+@@ -481,6 +501,7 @@ static int ssb_devices_register(struct s
  #ifdef CONFIG_SSB_PCIHOST
  			sdev->irq = bus->host_pci->irq;
  			dev->parent = &bus->host_pci->dev;
@@ -982,7 +1055,7 @@
  #endif
  			break;
  		case SSB_BUSTYPE_PCMCIA:
-@@ -490,13 +527,13 @@ static int ssb_devices_register(struct s
+@@ -490,13 +511,13 @@ static int ssb_devices_register(struct s
  #endif
  			break;
  		case SSB_BUSTYPE_SDIO:
@@ -998,7 +1071,7 @@
  			break;
  		}
  
-@@ -523,7 +560,7 @@ error:
+@@ -523,7 +544,7 @@ error:
  }
  
  /* Needs ssb_buses_lock() */
@@ -1007,7 +1080,7 @@
  {
  	struct ssb_bus *bus, *n;
  	int err = 0;
-@@ -734,9 +771,9 @@ out:
+@@ -734,9 +755,9 @@ out:
  	return err;
  }
  
@@ -1020,7 +1093,7 @@
  {
  	int err;
  
-@@ -817,8 +854,8 @@ err_disable_xtal:
+@@ -817,8 +838,8 @@ err_disable_xtal:
  }
  
  #ifdef CONFIG_SSB_PCIHOST
@@ -1031,7 +1104,7 @@
  {
  	int err;
  
-@@ -830,6 +867,9 @@ int ssb_bus_pcibus_register(struct ssb_b
+@@ -830,6 +851,9 @@ int ssb_bus_pcibus_register(struct ssb_b
  	if (!err) {
  		ssb_printk(KERN_INFO PFX "Sonics Silicon Backplane found on "
  			   "PCI device %s\n", dev_name(&host_pci->dev));
@@ -1041,7 +1114,7 @@
  	}
  
  	return err;
-@@ -838,9 +878,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
+@@ -838,9 +862,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
  #endif /* CONFIG_SSB_PCIHOST */
  
  #ifdef CONFIG_SSB_PCMCIAHOST
@@ -1054,7 +1127,7 @@
  {
  	int err;
  
-@@ -860,8 +900,9 @@ EXPORT_SYMBOL(ssb_bus_pcmciabus_register
+@@ -860,8 +884,9 @@ EXPORT_SYMBOL(ssb_bus_pcmciabus_register
  #endif /* CONFIG_SSB_PCMCIAHOST */
  
  #ifdef CONFIG_SSB_SDIOHOST
@@ -1066,7 +1139,7 @@
  {
  	int err;
  
-@@ -881,9 +922,9 @@ int ssb_bus_sdiobus_register(struct ssb_
+@@ -881,9 +906,9 @@ int ssb_bus_sdiobus_register(struct ssb_
  EXPORT_SYMBOL(ssb_bus_sdiobus_register);
  #endif /* CONFIG_SSB_PCMCIAHOST */
  
@@ -1079,7 +1152,7 @@
  {
  	int err;
  
-@@ -964,8 +1005,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
+@@ -964,8 +989,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
  	switch (plltype) {
  	case SSB_PLLTYPE_6: /* 100/200 or 120/240 only */
  		if (m & SSB_CHIPCO_CLK_T6_MMASK)
@@ -1090,7 +1163,17 @@
  	case SSB_PLLTYPE_1: /* 48Mhz base, 3 dividers */
  	case SSB_PLLTYPE_3: /* 25Mhz, 2 dividers */
  	case SSB_PLLTYPE_4: /* 48Mhz, 4 dividers */
-@@ -1080,23 +1121,22 @@ static u32 ssb_tmslow_reject_bitmask(str
+@@ -1055,6 +1080,9 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
+ 	u32 plltype;
+ 	u32 clkctl_n, clkctl_m;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_controlclock(&bus->chipco);
++
+ 	if (ssb_extif_available(&bus->extif))
+ 		ssb_extif_get_clockcontrol(&bus->extif, &plltype,
+ 					   &clkctl_n, &clkctl_m);
+@@ -1080,23 +1108,22 @@ static u32 ssb_tmslow_reject_bitmask(str
  {
  	u32 rev = ssb_read32(dev, SSB_IDLOW) & SSB_IDLOW_SSBREV;
  
@@ -1121,7 +1204,7 @@
  }
  
  int ssb_device_is_enabled(struct ssb_device *dev)
-@@ -1155,10 +1195,10 @@ void ssb_device_enable(struct ssb_device
+@@ -1155,10 +1182,10 @@ void ssb_device_enable(struct ssb_device
  }
  EXPORT_SYMBOL(ssb_device_enable);
  
@@ -1135,7 +1218,7 @@
  {
  	int i;
  	u32 val;
-@@ -1166,7 +1206,7 @@ static int ssb_wait_bit(struct ssb_devic
+@@ -1166,7 +1193,7 @@ static int ssb_wait_bit(struct ssb_devic
  	for (i = 0; i < timeout; i++) {
  		val = ssb_read32(dev, reg);
  		if (set) {
@@ -1144,7 +1227,7 @@
  				return 0;
  		} else {
  			if (!(val & bitmask))
-@@ -1183,20 +1223,38 @@ static int ssb_wait_bit(struct ssb_devic
+@@ -1183,20 +1210,38 @@ static int ssb_wait_bit(struct ssb_devic
  
  void ssb_device_disable(struct ssb_device *dev, u32 core_specific_flags)
  {
@@ -1192,7 +1275,7 @@
  
  	ssb_write32(dev, SSB_TMSLOW,
  		    reject | SSB_TMSLOW_RESET |
-@@ -1205,13 +1263,34 @@ void ssb_device_disable(struct ssb_devic
+@@ -1205,13 +1250,34 @@ void ssb_device_disable(struct ssb_devic
  }
  EXPORT_SYMBOL(ssb_device_disable);
  
@@ -1228,7 +1311,7 @@
  	default:
  		__ssb_dma_not_implemented(dev);
  	}
-@@ -1328,20 +1407,20 @@ EXPORT_SYMBOL(ssb_bus_may_powerdown);
+@@ -1328,20 +1394,20 @@ EXPORT_SYMBOL(ssb_bus_may_powerdown);
  
  int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl)
  {
@@ -1253,7 +1336,7 @@
  	return 0;
  error:
  	ssb_printk(KERN_ERR PFX "Bus powerup failed\n");
-@@ -1349,6 +1428,37 @@ error:
+@@ -1349,6 +1415,37 @@ error:
  }
  EXPORT_SYMBOL(ssb_bus_powerup);
  
@@ -1319,10 +1402,40 @@
  /* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */
  #define SPEX16(_outvar, _offset, _mask, _shift)	\
  	out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift))
-@@ -405,6 +406,46 @@ static void sprom_extract_r123(struct ss
- 	out->antenna_gain.ghz5.a3 = gain;
- }
- 
+@@ -330,7 +331,6 @@ static void sprom_extract_r123(struct ss
+ {
+ 	int i;
+ 	u16 v;
+-	s8 gain;
+ 	u16 loc[3];
+ 
+ 	if (out->revision == 3)			/* rev 3 moved MAC */
+@@ -389,20 +389,52 @@ static void sprom_extract_r123(struct ss
+ 		SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_BG,
+-				    SSB_SPROM1_AGAIN_BG_SHIFT);
+-	out->antenna_gain.ghz24.a0 = gain;
+-	out->antenna_gain.ghz24.a1 = gain;
+-	out->antenna_gain.ghz24.a2 = gain;
+-	out->antenna_gain.ghz24.a3 = gain;
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_A,
+-				    SSB_SPROM1_AGAIN_A_SHIFT);
+-	out->antenna_gain.ghz5.a0 = gain;
+-	out->antenna_gain.ghz5.a1 = gain;
+-	out->antenna_gain.ghz5.a2 = gain;
+-	out->antenna_gain.ghz5.a3 = gain;
++	out->antenna_gain.a0 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_BG,
++						    SSB_SPROM1_AGAIN_BG_SHIFT);
++	out->antenna_gain.a1 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_A,
++						    SSB_SPROM1_AGAIN_A_SHIFT);
++}
++
 +/* Revs 4 5 and 8 have partially shared layout */
 +static void sprom_extract_r458(struct ssb_sprom *out, const u16 *in)
 +{
@@ -1361,12 +1474,10 @@
 +	     SSB_SPROM4_TXPID5GH2, SSB_SPROM4_TXPID5GH2_SHIFT);
 +	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23,
 +	     SSB_SPROM4_TXPID5GH3, SSB_SPROM4_TXPID5GH3_SHIFT);
-+}
-+
+ }
+ 
  static void sprom_extract_r45(struct ssb_sprom *out, const u16 *in)
- {
- 	int i;
-@@ -427,10 +468,14 @@ static void sprom_extract_r45(struct ssb
+@@ -427,10 +459,14 @@ static void sprom_extract_r45(struct ssb
  		SPEX(country_code, SSB_SPROM4_CCODE, 0xFFFF, 0);
  		SPEX(boardflags_lo, SSB_SPROM4_BFLLO, 0xFFFF, 0);
  		SPEX(boardflags_hi, SSB_SPROM4_BFLHI, 0xFFFF, 0);
@@ -1381,15 +1492,30 @@
  	}
  	SPEX(ant_available_a, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_A,
  	     SSB_SPROM4_ANTAVAIL_A_SHIFT);
-@@ -470,13 +515,21 @@ static void sprom_extract_r45(struct ssb
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
+@@ -459,16 +495,16 @@ static void sprom_extract_r45(struct ssb
+ 	}
  
-+	sprom_extract_r458(out, in);
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN0, SSB_SPROM4_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN1, SSB_SPROM4_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN2, SSB_SPROM4_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN3, SSB_SPROM4_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
 +
++	sprom_extract_r458(out, in);
+ 
  	/* TODO - get remaining rev 4 stuff needed */
  }
- 
+@@ -476,7 +512,13 @@ static void sprom_extract_r45(struct ssb
  static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
  {
  	int i;
@@ -1404,10 +1530,25 @@
  
  	/* extract the MAC address */
  	for (i = 0; i < 3; i++) {
-@@ -560,6 +613,63 @@ static void sprom_extract_r8(struct ssb_
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
- 
+@@ -549,16 +591,71 @@ static void sprom_extract_r8(struct ssb_
+ 	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
++
 +	/* Extract cores power info info */
 +	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
 +		o = pwr_info_offset[i];
@@ -1464,11 +1605,10 @@
 +		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
 +
 +	sprom_extract_r458(out, in);
-+
+ 
  	/* TODO - get remaining rev 8 stuff needed */
  }
- 
-@@ -572,37 +682,34 @@ static int sprom_extract(struct ssb_bus
+@@ -572,37 +669,34 @@ static int sprom_extract(struct ssb_bus
  	ssb_dprintk(KERN_DEBUG PFX "SPROM revision %d detected.\n", out->revision);
  	memset(out->et0mac, 0xFF, 6);		/* preset et0 and et1 mac */
  	memset(out->et1mac, 0xFF, 6);
@@ -1527,7 +1667,7 @@
  	}
  
  	if (out->boardflags_lo == 0xFFFF)
-@@ -616,15 +723,14 @@ static int sprom_extract(struct ssb_bus
+@@ -616,15 +710,14 @@ static int sprom_extract(struct ssb_bus
  static int ssb_pci_sprom_get(struct ssb_bus *bus,
  			     struct ssb_sprom *sprom)
  {
@@ -1545,7 +1685,7 @@
  		/*
  		 * get SPROM offset: SSB_SPROM_BASE1 except for
  		 * chipcommon rev >= 31 or chip ID is 0x4312 and
-@@ -644,7 +750,7 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -644,7 +737,7 @@ static int ssb_pci_sprom_get(struct ssb_
  
  	buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
  	if (!buf)
@@ -1554,7 +1694,7 @@
  	bus->sprom_size = SSB_SPROMSIZE_WORDS_R123;
  	sprom_do_read(bus, buf);
  	err = sprom_check_crc(buf, bus->sprom_size);
-@@ -654,17 +760,24 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -654,17 +747,24 @@ static int ssb_pci_sprom_get(struct ssb_
  		buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
  			      GFP_KERNEL);
  		if (!buf)
@@ -1584,7 +1724,7 @@
  				err = 0;
  				goto out_free;
  			}
-@@ -676,19 +789,15 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -676,19 +776,15 @@ static int ssb_pci_sprom_get(struct ssb_
  
  out_free:
  	kfree(buf);
@@ -1673,7 +1813,7 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
-@@ -617,136 +617,140 @@ static int ssb_pcmcia_sprom_check_crc(co
+@@ -617,136 +617,136 @@ static int ssb_pcmcia_sprom_check_crc(co
  	}						\
    } while (0)
  
@@ -1753,14 +1893,10 @@
 +	case SSB_PCMCIA_CIS_ANTGAIN:
 +		GOTO_ERROR_ON(tuple->TupleDataLen != 2,
 +			"antg tpl size");
-+		sprom->antenna_gain.ghz24.a0 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz24.a1 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz24.a2 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz24.a3 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz5.a0 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz5.a1 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz5.a2 = tuple->TupleData[1];
-+		sprom->antenna_gain.ghz5.a3 = tuple->TupleData[1];
++		sprom->antenna_gain.a0 = tuple->TupleData[1];
++		sprom->antenna_gain.a1 = tuple->TupleData[1];
++		sprom->antenna_gain.a2 = tuple->TupleData[1];
++		sprom->antenna_gain.a3 = tuple->TupleData[1];
 +		break;
 +	case SSB_PCMCIA_CIS_BFLAGS:
 +		GOTO_ERROR_ON((tuple->TupleDataLen != 3) &&
@@ -1961,7 +2097,17 @@
  			bus->chip_package = 0;
  		} else {
  			bus->chip_id = 0x4710;
-@@ -354,7 +356,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
+@@ -318,6 +320,9 @@ int ssb_bus_scan(struct ssb_bus *bus,
+ 			bus->chip_package = 0;
+ 		}
+ 	}
++	ssb_printk(KERN_INFO PFX "Found chip with id 0x%04X, rev 0x%02X and "
++		   "package 0x%02X\n", bus->chip_id, bus->chip_rev,
++		   bus->chip_package);
+ 	if (!bus->nr_devices)
+ 		bus->nr_devices = chipid_to_nrcores(bus->chip_id);
+ 	if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
+@@ -354,7 +359,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
  		dev->bus = bus;
  		dev->ops = bus->ops;
  
@@ -1970,7 +2116,7 @@
  			    "Core %d found: %s "
  			    "(cc 0x%03X, rev 0x%02X, vendor 0x%04X)\n",
  			    i, ssb_core_name(dev->id.coreid),
-@@ -422,6 +424,16 @@ int ssb_bus_scan(struct ssb_bus *bus,
+@@ -422,6 +427,16 @@ int ssb_bus_scan(struct ssb_bus *bus,
  			bus->pcicore.dev = dev;
  #endif /* CONFIG_SSB_DRIVER_PCICORE */
  			break;
@@ -2151,12 +2297,16 @@
  static inline int b43_pci_ssb_bridge_init(void)
  {
  	return 0;
-@@ -196,6 +205,6 @@ static inline int b43_pci_ssb_bridge_ini
+@@ -196,6 +205,10 @@ static inline int b43_pci_ssb_bridge_ini
  static inline void b43_pci_ssb_bridge_exit(void)
  {
  }
 -#endif /* CONFIG_SSB_PCIHOST */
 +#endif /* CONFIG_SSB_B43_PCI_BRIDGE */
++
++/* driver_chipcommon_pmu.c */
++extern u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc);
++extern u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc);
  
  #endif /* LINUX_SSB_PRIVATE_H_ */
 --- a/include/linux/ssb/ssb.h
@@ -2168,36 +2318,57 @@
 +struct ssb_sprom_core_pwr_info {
 +	u8 itssi_2g, itssi_5g;
 +	u8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh;
-+	u16 pa_2g[3], pa_5gl[3], pa_5g[3], pa_5gh[3];
++	u16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4];
 +};
 +
  struct ssb_sprom {
  	u8 revision;
  	u8 il0mac[6];		/* MAC address for 802.11b/g */
-@@ -25,8 +31,10 @@ struct ssb_sprom {
+@@ -25,8 +31,13 @@ struct ssb_sprom {
  	u8 et1phyaddr;		/* MII address for enet1 */
  	u8 et0mdcport;		/* MDIO for enet0 */
  	u8 et1mdcport;		/* MDIO for enet1 */
 -	u8 board_rev;		/* Board revision number from SPROM. */
 +	u16 board_rev;		/* Board revision number from SPROM. */
++	u16 board_num;		/* Board number from SPROM. */
++	u16 board_type;		/* Board type from SPROM. */
  	u8 country_code;	/* Country Code */
-+	u16 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
-+	u16 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
++	char alpha2[2];		/* Country Code as two chars like EU or US */
++	u8 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
++	u8 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
  	u8 ant_available_a;	/* 2GHz antenna available bits (up to 4) */
  	u8 ant_available_bg;	/* 5GHz antenna available bits (up to 4) */
  	u16 pa0b0;
-@@ -55,6 +63,10 @@ struct ssb_sprom {
+@@ -45,18 +56,22 @@ struct ssb_sprom {
+ 	u8 gpio1;		/* GPIO pin 1 */
+ 	u8 gpio2;		/* GPIO pin 2 */
+ 	u8 gpio3;		/* GPIO pin 3 */
+-	u16 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
+ 	u8 itssi_a;		/* Idle TSSI Target for A-PHY */
+ 	u8 itssi_bg;		/* Idle TSSI Target for B/G-PHY */
+ 	u8 tri2g;		/* 2.4GHz TX isolation */
  	u8 tri5gl;		/* 5.2GHz TX isolation */
  	u8 tri5g;		/* 5.3GHz TX isolation */
  	u8 tri5gh;		/* 5.8GHz TX isolation */
+-	u8 rxpo2g;		/* 2GHz RX power offset */
+-	u8 rxpo5g;		/* 5GHz RX power offset */
 +	u8 txpid2g[4];		/* 2GHz TX power index */
 +	u8 txpid5gl[4];		/* 4.9 - 5.1GHz TX power index */
 +	u8 txpid5g[4];		/* 5.1 - 5.5GHz TX power index */
 +	u8 txpid5gh[4];		/* 5.5 - ...GHz TX power index */
- 	u8 rxpo2g;		/* 2GHz RX power offset */
- 	u8 rxpo5g;		/* 5GHz RX power offset */
++	s8 rxpo2g;		/* 2GHz RX power offset */
++	s8 rxpo5g;		/* 5GHz RX power offset */
  	u8 rssisav2g;		/* 2GHz RSSI params */
-@@ -76,6 +88,8 @@ struct ssb_sprom {
+ 	u8 rssismc2g;
+ 	u8 rssismf2g;
+@@ -76,26 +91,104 @@ struct ssb_sprom {
  	u16 boardflags2_hi;	/* Board flags (bits 48-63) */
  	/* TODO store board flags in a single u64 */
  
@@ -2206,10 +2377,17 @@
  	/* Antenna gain values for up to 4 antennas
  	 * on each band. Values in dBm/4 (Q5.2). Negative gain means the
  	 * loss in the connectors is bigger than the gain. */
-@@ -88,6 +102,15 @@ struct ssb_sprom {
- 		} ghz5;		/* 5GHz band */
+ 	struct {
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz24;	/* 2.4GHz band */
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz5;		/* 5GHz band */
++		s8 a0, a1, a2, a3;
  	} antenna_gain;
  
+-	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
 +	struct {
 +		struct {
 +			u8 tssipos, extpa_gain, pdet_range, tr_iso, antswlut;
@@ -2219,10 +2397,82 @@
 +		} ghz5;
 +	} fem;
 +
- 	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
++	u16 mcs2gpo[8];
++	u16 mcs5gpo[8];
++	u16 mcs5glpo[8];
++	u16 mcs5ghpo[8];
++	u8 opo;
++
++	u8 rxgainerr2ga[3];
++	u8 rxgainerr5gla[3];
++	u8 rxgainerr5gma[3];
++	u8 rxgainerr5gha[3];
++	u8 rxgainerr5gua[3];
++
++	u8 noiselvl2ga[3];
++	u8 noiselvl5gla[3];
++	u8 noiselvl5gma[3];
++	u8 noiselvl5gha[3];
++	u8 noiselvl5gua[3];
++
++	u8 regrev;
++	u8 txchain;
++	u8 rxchain;
++	u8 antswitch;
++	u16 cddpo;
++	u16 stbcpo;
++	u16 bw40po;
++	u16 bwduppo;
++
++	u8 tempthresh;
++	u8 tempoffset;
++	u16 rawtempsense;
++	u8 measpower;
++	u8 tempsense_slope;
++	u8 tempcorrx;
++	u8 tempsense_option;
++	u8 freqoffset_corr;
++	u8 iqcal_swp_dis;
++	u8 hw_iqcal_en;
++	u8 elna2g;
++	u8 elna5g;
++	u8 phycal_tempdelta;
++	u8 temps_period;
++	u8 temps_hysteresis;
++	u8 measpower1;
++	u8 measpower2;
++	u8 pcieingress_war;
++
++	/* power per rate from sromrev 9 */
++	u16 cckbw202gpo;
++	u16 cckbw20ul2gpo;
++	u32 legofdmbw202gpo;
++	u32 legofdmbw20ul2gpo;
++	u32 legofdmbw205glpo;
++	u32 legofdmbw20ul5glpo;
++	u32 legofdmbw205gmpo;
++	u32 legofdmbw20ul5gmpo;
++	u32 legofdmbw205ghpo;
++	u32 legofdmbw20ul5ghpo;
++	u32 mcsbw202gpo;
++	u32 mcsbw20ul2gpo;
++	u32 mcsbw402gpo;
++	u32 mcsbw205glpo;
++	u32 mcsbw20ul5glpo;
++	u32 mcsbw405glpo;
++	u32 mcsbw205gmpo;
++	u32 mcsbw20ul5gmpo;
++	u32 mcsbw405gmpo;
++	u32 mcsbw205ghpo;
++	u32 mcsbw20ul5ghpo;
++	u32 mcsbw405ghpo;
++	u16 mcs32po;
++	u16 legofdm40duppo;
++	u8 sar2g;
++	u8 sar5g;
  };
  
-@@ -95,7 +118,7 @@ struct ssb_sprom {
+ /* Information about the PCB the circuitry is soldered on. */
  struct ssb_boardinfo {
  	u16 vendor;
  	u16 type;
@@ -2231,7 +2481,7 @@
  };
  
  
-@@ -167,7 +190,7 @@ struct ssb_device {
+@@ -167,7 +260,7 @@ struct ssb_device {
  	 * is an optimization. */
  	const struct ssb_bus_ops *ops;
  
@@ -2240,7 +2490,7 @@
  
  	struct ssb_bus *bus;
  	struct ssb_device_id id;
-@@ -225,10 +248,9 @@ struct ssb_driver {
+@@ -225,10 +318,9 @@ struct ssb_driver {
  #define drv_to_ssb_drv(_drv) container_of(_drv, struct ssb_driver, drv)
  
  extern int __ssb_driver_register(struct ssb_driver *drv, struct module *owner);
@@ -2254,7 +2504,7 @@
  extern void ssb_driver_unregister(struct ssb_driver *drv);
  
  
-@@ -269,7 +291,8 @@ struct ssb_bus {
+@@ -269,7 +361,8 @@ struct ssb_bus {
  
  	const struct ssb_bus_ops *ops;
  
@@ -2264,7 +2514,7 @@
  	struct ssb_device *mapped_device;
  	union {
  		/* Currently mapped PCMCIA segment. (bustype == SSB_BUSTYPE_PCMCIA only) */
-@@ -281,14 +304,17 @@ struct ssb_bus {
+@@ -281,14 +374,17 @@ struct ssb_bus {
  	 * On PCMCIA-host busses this is used to protect the whole MMIO access. */
  	spinlock_t bar_lock;
  
@@ -2289,7 +2539,7 @@
  
  	/* See enum ssb_quirks */
  	unsigned int quirks;
-@@ -300,7 +326,7 @@ struct ssb_bus {
+@@ -300,7 +396,7 @@ struct ssb_bus {
  
  	/* ID information about the Chip. */
  	u16 chip_id;
@@ -2298,7 +2548,7 @@
  	u16 sprom_offset;
  	u16 sprom_size;		/* number of words in sprom */
  	u8 chip_package;
-@@ -396,7 +422,9 @@ extern bool ssb_is_sprom_available(struc
+@@ -396,7 +492,9 @@ extern bool ssb_is_sprom_available(struc
  
  /* Set a fallback SPROM.
   * See kdoc at the function definition for complete documentation. */
@@ -2309,7 +2559,7 @@
  
  /* Suspend a SSB bus.
   * Call this from the parent bus suspend routine. */
-@@ -667,6 +695,7 @@ extern int ssb_bus_may_powerdown(struct
+@@ -667,6 +765,7 @@ extern int ssb_bus_may_powerdown(struct
   * Otherwise static always-on powercontrol will be used. */
  extern int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl);
  
@@ -2930,3 +3180,32 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   *
+@@ -551,14 +551,10 @@ int ssb_sdio_get_invariants(struct ssb_b
+ 			case SSB_SDIO_CIS_ANTGAIN:
+ 				GOTO_ERROR_ON(tuple->size != 2,
+ 					      "antg tpl size");
+-				sprom->antenna_gain.ghz24.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a3 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a3 = tuple->data[1];
++				sprom->antenna_gain.a0 = tuple->data[1];
++				sprom->antenna_gain.a1 = tuple->data[1];
++				sprom->antenna_gain.a2 = tuple->data[1];
++				sprom->antenna_gain.a3 = tuple->data[1];
+ 				break;
+ 			case SSB_SDIO_CIS_BFLAGS:
+ 				GOTO_ERROR_ON((tuple->size != 3) &&
+--- a/include/linux/ssb/ssb_driver_gige.h
++++ b/include/linux/ssb/ssb_driver_gige.h
+@@ -2,6 +2,7 @@
+ #define LINUX_SSB_DRIVER_GIGE_H_
+ 
+ #include <linux/ssb/ssb.h>
++#include <linux/bug.h>
+ #include <linux/pci.h>
+ #include <linux/spinlock.h>
+ 
diff --git a/target/linux/generic/patches-2.6.36/025-bcma_backport.patch b/target/linux/generic/patches-2.6.36/025-bcma_backport.patch
index eb64b85826..0506caee1e 100644
--- a/target/linux/generic/patches-2.6.36/025-bcma_backport.patch
+++ b/target/linux/generic/patches-2.6.36/025-bcma_backport.patch
@@ -103,7 +103,7 @@
 +
 +config BCMA_DRIVER_PCI_HOSTMODE
 +	bool "Driver for PCI core working in hostmode"
-+	depends on BCMA && MIPS
++	depends on BCMA && MIPS && BCMA_HOST_PCI
 +	help
 +	  PCI core hostmode operation (external PCI bus).
 +
@@ -172,7 +172,7 @@
 +- Create kernel Documentation (use info from README)
 --- /dev/null
 +++ b/drivers/bcma/bcma_private.h
-@@ -0,0 +1,54 @@
+@@ -0,0 +1,59 @@
 +#ifndef LINUX_BCMA_PRIVATE_H_
 +#define LINUX_BCMA_PRIVATE_H_
 +
@@ -188,12 +188,13 @@
 +struct bcma_bus;
 +
 +/* main.c */
-+int bcma_bus_register(struct bcma_bus *bus);
++int __devinit bcma_bus_register(struct bcma_bus *bus);
 +void bcma_bus_unregister(struct bcma_bus *bus);
 +int __init bcma_bus_early_register(struct bcma_bus *bus,
 +				   struct bcma_device *core_cc,
 +				   struct bcma_device *core_mips);
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus);
 +int bcma_bus_resume(struct bcma_bus *bus);
 +#endif
 +
@@ -222,8 +223,12 @@
 +extern void __exit bcma_host_pci_exit(void);
 +#endif /* CONFIG_BCMA_HOST_PCI */
 +
++/* driver_pci.c */
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address);
++
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc);
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
 +
 +#endif
@@ -517,7 +522,7 @@
 +#endif /* CONFIG_BCMA_DRIVER_MIPS */
 --- /dev/null
 +++ b/drivers/bcma/driver_chipcommon_pmu.c
-@@ -0,0 +1,309 @@
+@@ -0,0 +1,310 @@
 +/*
 + * Broadcom specific AMBA
 + * ChipCommon Power Management Unit driver
@@ -599,6 +604,7 @@
 +		min_msk = 0x200D;
 +		max_msk = 0xFFFF;
 +		break;
++	case 0x4331:
 +	case 43224:
 +	case 43225:
 +		break;
@@ -829,13 +835,14 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/driver_pci.c
-@@ -0,0 +1,237 @@
+@@ -0,0 +1,225 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Core
 + *
-+ * Copyright 2005, Broadcom Corporation
++ * Copyright 2005, 2011, Broadcom Corporation
 + * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
 + *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
@@ -847,40 +854,41 @@
 + * R/W ops.
 + **************************************************/
 +
-+static u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
 +{
-+	pcicore_write32(pc, 0x130, address);
-+	pcicore_read32(pc, 0x130);
-+	return pcicore_read32(pc, 0x134);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_DATA);
 +}
 +
 +#if 0
 +static void bcma_pcie_write(struct bcma_drv_pci *pc, u32 address, u32 data)
 +{
-+	pcicore_write32(pc, 0x130, address);
-+	pcicore_read32(pc, 0x130);
-+	pcicore_write32(pc, 0x134, data);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_DATA, data);
 +}
 +#endif
 +
 +static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u8 phy)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	u32 v;
 +	int i;
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 28); /* Write Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	v |= (0x1F << 18);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++	v |= (BCMA_CORE_PCI_MDIODATA_BLK_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
 +	v |= (phy << 4);
-+	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +
 +	udelay(10);
 +	for (i = 0; i < 200; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
 +			break;
 +		msleep(1);
 +	}
@@ -888,79 +896,84 @@
 +
 +static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u8 device, u8 address)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	int max_retries = 10;
 +	u16 ret = 0;
 +	u32 v;
 +	int i;
 +
-+	v = 0x80; /* Enable Preamble Sequence */
-+	v |= 0x2; /* MDIO Clock Divisor */
-+	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
 +
 +	if (pc->core->id.rev >= 10) {
 +		max_retries = 200;
 +		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 +	}
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 29); /* Read Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	if (pc->core->id.rev < 10)
-+		v |= (u32)device << 22;
-+	v |= (u32)address << 18;
-+	pcicore_write32(pc, mdio_data, v);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_READ;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
++
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +	/* Wait for the device to complete the transaction */
 +	udelay(10);
 +	for (i = 0; i < max_retries; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */) {
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE) {
 +			udelay(10);
-+			ret = pcicore_read32(pc, mdio_data);
++			ret = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_DATA);
 +			break;
 +		}
 +		msleep(1);
 +	}
-+	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
 +	return ret;
 +}
 +
 +static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u8 device,
 +				u8 address, u16 data)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	int max_retries = 10;
 +	u32 v;
 +	int i;
 +
-+	v = 0x80; /* Enable Preamble Sequence */
-+	v |= 0x2; /* MDIO Clock Divisor */
-+	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
 +
 +	if (pc->core->id.rev >= 10) {
 +		max_retries = 200;
 +		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 +	}
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 28); /* Write Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	if (pc->core->id.rev < 10)
-+		v |= (u32)device << 22;
-+	v |= (u32)address << 18;
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
 +	v |= data;
-+	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +	/* Wait for the device to complete the transaction */
 +	udelay(10);
 +	for (i = 0; i < max_retries; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
 +			break;
 +		msleep(1);
 +	}
-+	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
 +}
 +
 +/**************************************************
@@ -969,72 +982,53 @@
 +
 +static u8 bcma_pcicore_polarity_workaround(struct bcma_drv_pci *pc)
 +{
-+	return (bcma_pcie_read(pc, 0x204) & 0x10) ? 0xC0 : 0x80;
++	u32 tmp;
++
++	tmp = bcma_pcie_read(pc, BCMA_CORE_PCI_PLP_STATUSREG);
++	if (tmp & BCMA_CORE_PCI_PLP_POLARITYINV_STAT)
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE |
++		       BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY;
++	else
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE;
 +}
 +
 +static void bcma_pcicore_serdes_workaround(struct bcma_drv_pci *pc)
 +{
-+	const u8 serdes_pll_device = 0x1D;
-+	const u8 serdes_rx_device = 0x1F;
 +	u16 tmp;
 +
-+	bcma_pcie_mdio_write(pc, serdes_rx_device, 1 /* Control */,
-+			      bcma_pcicore_polarity_workaround(pc));
-+	tmp = bcma_pcie_mdio_read(pc, serdes_pll_device, 1 /* Control */);
-+	if (tmp & 0x4000)
-+		bcma_pcie_mdio_write(pc, serdes_pll_device, 1, tmp & ~0x4000);
++	bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_RX,
++	                     BCMA_CORE_PCI_SERDES_RX_CTRL,
++			     bcma_pcicore_polarity_workaround(pc));
++	tmp = bcma_pcie_mdio_read(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++	                          BCMA_CORE_PCI_SERDES_PLL_CTRL);
++	if (tmp & BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN)
++		bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++		                     BCMA_CORE_PCI_SERDES_PLL_CTRL,
++		                     tmp & ~BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN);
 +}
 +
 +/**************************************************
 + * Init.
 + **************************************************/
 +
-+static void bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
++static void __devinit bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
 +{
 +	bcma_pcicore_serdes_workaround(pc);
 +}
 +
-+static bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
-+{
-+	struct bcma_bus *bus = pc->core->bus;
-+	u16 chipid_top;
-+
-+	chipid_top = (bus->chipinfo.id & 0xFF00);
-+	if (chipid_top != 0x4700 &&
-+	    chipid_top != 0x5300)
-+		return false;
-+
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
-+	if (bus->sprom.boardflags_lo & SSB_BFL_NOPCI)
-+		return false;
-+#endif /* CONFIG_SSB_DRIVER_PCICORE */
-+
-+#if 0
-+	/* TODO: on BCMA we use address from EROM instead of magic formula */
-+	u32 tmp;
-+	return !mips_busprobe32(tmp, (bus->mmio +
-+		(pc->core->core_index * BCMA_CORE_SIZE)));
-+#endif
-+
-+	return true;
-+}
-+
-+void bcma_core_pci_init(struct bcma_drv_pci *pc)
++void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
 +{
 +	if (pc->setup_done)
 +		return;
 +
-+	if (bcma_core_pci_is_in_hostmode(pc)) {
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	pc->hostmode = bcma_core_pci_is_in_hostmode(pc);
++	if (pc->hostmode)
 +		bcma_core_pci_hostmode_init(pc);
-+#else
-+		pr_err("Driver compiled without support for hostmode PCI\n");
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
-+	} else {
-+		bcma_core_pci_clientmode_init(pc);
-+	}
 +
-+	pc->setup_done = true;
++	if (!pc->hostmode)
++		bcma_core_pci_clientmode_init(pc);
 +}
 +
 +int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
@@ -1069,7 +1063,7 @@
 +EXPORT_SYMBOL_GPL(bcma_core_pci_irq_ctl);
 --- /dev/null
 +++ b/drivers/bcma/host_pci.c
-@@ -0,0 +1,299 @@
+@@ -0,0 +1,292 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Host
@@ -1226,8 +1220,8 @@
 +	.awrite32	= bcma_host_pci_awrite32,
 +};
 +
-+static int bcma_host_pci_probe(struct pci_dev *dev,
-+			     const struct pci_device_id *id)
++static int __devinit bcma_host_pci_probe(struct pci_dev *dev,
++					 const struct pci_device_id *id)
 +{
 +	struct bcma_bus *bus;
 +	int err = -ENOMEM;
@@ -1307,38 +1301,32 @@
 +}
 +
 +#ifdef CONFIG_PM
-+static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
++static int bcma_host_pci_suspend(struct device *dev)
 +{
-+	/* Host specific */
-+	pci_save_state(dev);
-+	pci_disable_device(dev);
-+	pci_set_power_state(dev, pci_choose_state(dev, state));
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	return 0;
++	bus->mapped_core = NULL;
++
++	return bcma_bus_suspend(bus);
 +}
 +
-+static int bcma_host_pci_resume(struct pci_dev *dev)
++static int bcma_host_pci_resume(struct device *dev)
 +{
-+	struct bcma_bus *bus = pci_get_drvdata(dev);
-+	int err;
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	/* Host specific */
-+	pci_set_power_state(dev, 0);
-+	err = pci_enable_device(dev);
-+	if (err)
-+		return err;
-+	pci_restore_state(dev);
++	return bcma_bus_resume(bus);
++}
 +
-+	/* Bus specific */
-+	err = bcma_bus_resume(bus);
-+	if (err)
-+		return err;
++static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
++			 bcma_host_pci_resume);
++#define BCMA_PM_OPS	(&bcma_pm_ops)
 +
-+	return 0;
-+}
 +#else /* CONFIG_PM */
-+# define bcma_host_pci_suspend	NULL
-+# define bcma_host_pci_resume	NULL
++
++#define BCMA_PM_OPS     NULL
++
 +#endif /* CONFIG_PM */
 +
 +static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
@@ -1356,8 +1344,7 @@
 +	.id_table = bcma_pci_bridge_tbl,
 +	.probe = bcma_host_pci_probe,
 +	.remove = bcma_host_pci_remove,
-+	.suspend = bcma_host_pci_suspend,
-+	.resume = bcma_host_pci_resume,
++	.driver.pm = BCMA_PM_OPS,
 +};
 +
 +int __init bcma_host_pci_init(void)
@@ -1371,7 +1358,7 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/main.c
-@@ -0,0 +1,354 @@
+@@ -0,0 +1,387 @@
 +/*
 + * Broadcom specific AMBA
 + * Bus subsystem
@@ -1387,6 +1374,12 @@
 +MODULE_DESCRIPTION("Broadcom's specific AMBA driver");
 +MODULE_LICENSE("GPL");
 +
++/* contains the number the next bus should get. */
++static unsigned int bcma_bus_next_num = 0;
++
++/* bcma_buses_mutex locks the bcma_bus_next_num */
++static DEFINE_MUTEX(bcma_buses_mutex);
++
 +static int bcma_bus_match(struct device *dev, struct device_driver *drv);
 +static int bcma_device_probe(struct device *dev);
 +static int bcma_device_remove(struct device *dev);
@@ -1429,7 +1422,7 @@
 +	.dev_attrs	= bcma_device_attrs,
 +};
 +
-+static struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
++struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
 +{
 +	struct bcma_device *core;
 +
@@ -1439,6 +1432,7 @@
 +	}
 +	return NULL;
 +}
++EXPORT_SYMBOL_GPL(bcma_find_core);
 +
 +static void bcma_release_core_dev(struct device *dev)
 +{
@@ -1467,7 +1461,7 @@
 +
 +		core->dev.release = bcma_release_core_dev;
 +		core->dev.bus = &bcma_bus_type;
-+		dev_set_name(&core->dev, "bcma%d:%d", 0/*bus->num*/, dev_id);
++		dev_set_name(&core->dev, "bcma%d:%d", bus->num, dev_id);
 +
 +		switch (bus->hosttype) {
 +		case BCMA_HOSTTYPE_PCI:
@@ -1506,11 +1500,15 @@
 +	}
 +}
 +
-+int bcma_bus_register(struct bcma_bus *bus)
++int __devinit bcma_bus_register(struct bcma_bus *bus)
 +{
 +	int err;
 +	struct bcma_device *core;
 +
++	mutex_lock(&bcma_buses_mutex);
++	bus->num = bcma_bus_next_num++;
++	mutex_unlock(&bcma_buses_mutex);
++
 +	/* Scan for devices (cores) */
 +	err = bcma_bus_scan(bus);
 +	if (err) {
@@ -1543,10 +1541,8 @@
 +	err = bcma_sprom_get(bus);
 +	if (err == -ENOENT) {
 +		pr_err("No SPROM available\n");
-+	} else if (err) {
++	} else if (err)
 +		pr_err("Failed to get SPROM: %d\n", err);
-+		return -ENOENT;
-+	}
 +
 +	/* Register found cores */
 +	bcma_register_cores(bus);
@@ -1615,6 +1611,21 @@
 +}
 +
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->suspend)
++				adrv->suspend(core);
++		}
++	}
++	return 0;
++}
++
 +int bcma_bus_resume(struct bcma_bus *bus)
 +{
 +	struct bcma_device *core;
@@ -1626,6 +1637,15 @@
 +		bcma_core_chipcommon_init(&bus->drv_cc);
 +	}
 +
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->resume)
++				adrv->resume(core);
++		}
++	}
++
 +	return 0;
 +}
 +#endif
@@ -1728,7 +1748,7 @@
 +module_exit(bcma_modexit)
 --- /dev/null
 +++ b/drivers/bcma/scan.c
-@@ -0,0 +1,486 @@
+@@ -0,0 +1,507 @@
 +/*
 + * Broadcom specific AMBA
 + * Bus scanning
@@ -1943,6 +1963,17 @@
 +	return NULL;
 +}
 +
++static struct bcma_device *bcma_find_core_reverse(struct bcma_bus *bus, u16 coreid)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry_reverse(core, &bus->cores, list) {
++		if (core->id.id == coreid)
++			return core;
++	}
++	return NULL;
++}
++
 +static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
 +			      struct bcma_device_id *match, int core_num,
 +			      struct bcma_device *core)
@@ -2084,6 +2115,7 @@
 +void bcma_init_bus(struct bcma_bus *bus)
 +{
 +	s32 tmp;
++	struct bcma_chipinfo *chipinfo = &(bus->chipinfo);
 +
 +	if (bus->init_done)
 +		return;
@@ -2094,9 +2126,12 @@
 +	bcma_scan_switch_core(bus, BCMA_ADDR_BASE);
 +
 +	tmp = bcma_scan_read32(bus, 0, BCMA_CC_ID);
-+	bus->chipinfo.id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
-+	bus->chipinfo.rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
-+	bus->chipinfo.pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	chipinfo->id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
++	chipinfo->rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
++	chipinfo->pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	pr_info("Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
++		chipinfo->id, chipinfo->rev, chipinfo->pkg);
++
 +	bus->init_done = true;
 +}
 +
@@ -2123,6 +2158,7 @@
 +	bcma_scan_switch_core(bus, erombase);
 +
 +	while (eromptr < eromend) {
++		struct bcma_device *other_core;
 +		struct bcma_device *core = kzalloc(sizeof(*core), GFP_KERNEL);
 +		if (!core)
 +			return -ENOMEM;
@@ -2130,18 +2166,23 @@
 +		core->bus = bus;
 +
 +		err = bcma_get_next_core(bus, &eromptr, NULL, core_num, core);
-+		if (err == -ENODEV) {
-+			core_num++;
-+			continue;
-+		} else if (err == -ENXIO)
-+			continue;
-+		else if (err == -ESPIPE)
-+			break;
-+		else if (err < 0)
++		if (err < 0) {
++			kfree(core);
++			if (err == -ENODEV) {
++				core_num++;
++				continue;
++			} else if (err == -ENXIO) {
++				continue;
++			} else if (err == -ESPIPE) {
++				break;
++			}
 +			return err;
++		}
 +
 +		core->core_index = core_num++;
 +		bus->nr_cores++;
++		other_core = bcma_find_core_reverse(bus, core->id.id);
++		core->core_unit = (other_core == NULL) ? 0 : other_core->core_unit + 1;
 +
 +		pr_info("Core %d found: %s "
 +			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
@@ -2276,7 +2317,7 @@
 +#endif /* BCMA_SCAN_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma.h
-@@ -0,0 +1,298 @@
+@@ -0,0 +1,307 @@
 +#ifndef LINUX_BCMA_H_
 +#define LINUX_BCMA_H_
 +
@@ -2415,6 +2456,7 @@
 +	bool dev_registered;
 +
 +	u8 core_index;
++	u8 core_unit;
 +
 +	u32 addr;
 +	u32 wrap;
@@ -2441,7 +2483,7 @@
 +
 +	int (*probe)(struct bcma_device *dev);
 +	void (*remove)(struct bcma_device *dev);
-+	int (*suspend)(struct bcma_device *dev, pm_message_t state);
++	int (*suspend)(struct bcma_device *dev);
 +	int (*resume)(struct bcma_device *dev);
 +	void (*shutdown)(struct bcma_device *dev);
 +
@@ -2454,6 +2496,12 @@
 +
 +extern void bcma_driver_unregister(struct bcma_driver *drv);
 +
++/* Set a fallback SPROM.
++ * See kdoc at the function definition for complete documentation. */
++extern int bcma_arch_register_fallback_sprom(
++		int (*sprom_callback)(struct bcma_bus *bus,
++		struct ssb_sprom *out));
++
 +struct bcma_bus {
 +	/* The MMIO area. */
 +	void __iomem *mmio;
@@ -2474,6 +2522,7 @@
 +	struct list_head cores;
 +	u8 nr_cores;
 +	u8 init_done:1;
++	u8 num;
 +
 +	struct bcma_drv_cc drv_cc;
 +	struct bcma_drv_pci drv_pci;
@@ -2561,6 +2610,7 @@
 +	bcma_write16(cc, offset, (bcma_read16(cc, offset) & mask) | set);
 +}
 +
++extern struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid);
 +extern bool bcma_core_is_enabled(struct bcma_device *core);
 +extern void bcma_core_disable(struct bcma_device *core, u32 flags);
 +extern int bcma_core_enable(struct bcma_device *core, u32 flags);
@@ -2577,7 +2627,7 @@
 +#endif /* LINUX_BCMA_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_driver_chipcommon.h
-@@ -0,0 +1,391 @@
+@@ -0,0 +1,415 @@
 +#ifndef LINUX_BCMA_DRIVER_CC_H_
 +#define LINUX_BCMA_DRIVER_CC_H_
 +
@@ -2636,6 +2686,9 @@
 +#define	 BCMA_CC_OTPS_HW_PROTECT	0x00000001
 +#define	 BCMA_CC_OTPS_SW_PROTECT	0x00000002
 +#define	 BCMA_CC_OTPS_CID_PROTECT	0x00000004
++#define  BCMA_CC_OTPS_GU_PROG_IND	0x00000F00	/* General Use programmed indication */
++#define  BCMA_CC_OTPS_GU_PROG_IND_SHIFT	8
++#define  BCMA_CC_OTPS_GU_PROG_HW	0x00000100	/* HW region programmed */
 +#define BCMA_CC_OTPC			0x0014		/* OTP control */
 +#define	 BCMA_CC_OTPC_RECWAIT		0xFF000000
 +#define	 BCMA_CC_OTPC_PROGWAIT		0x00FFFF00
@@ -2652,6 +2705,8 @@
 +#define	 BCMA_CC_OTPP_READ		0x40000000
 +#define	 BCMA_CC_OTPP_START		0x80000000
 +#define	 BCMA_CC_OTPP_BUSY		0x80000000
++#define BCMA_CC_OTPL			0x001C		/* OTP layout */
++#define  BCMA_CC_OTPL_GURGN_OFFSET	0x00000FFF	/* offset of general use region */
 +#define BCMA_CC_IRQSTAT			0x0020
 +#define BCMA_CC_IRQMASK			0x0024
 +#define	 BCMA_CC_IRQ_GPIO		0x00000001	/* gpio intr */
@@ -2659,6 +2714,10 @@
 +#define	 BCMA_CC_IRQ_WDRESET		0x80000000	/* watchdog reset occurred */
 +#define BCMA_CC_CHIPCTL			0x0028		/* Rev >= 11 only */
 +#define BCMA_CC_CHIPSTAT		0x002C		/* Rev >= 11 only */
++#define  BCMA_CC_CHIPST_4313_SPROM_PRESENT	1
++#define  BCMA_CC_CHIPST_4313_OTP_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_SPROM_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_OTP_PRESENT	4
 +#define BCMA_CC_JCMD			0x0030		/* Rev >= 10 only */
 +#define  BCMA_CC_JCMD_START		0x80000000
 +#define  BCMA_CC_JCMD_BUSY		0x80000000
@@ -2761,6 +2820,22 @@
 +#define BCMA_CC_FLASH_CFG		0x0128
 +#define  BCMA_CC_FLASH_CFG_DS		0x0010	/* Data size, 0=8bit, 1=16bit */
 +#define BCMA_CC_FLASH_WAITCNT		0x012C
++#define BCMA_CC_SROM_CONTROL		0x0190
++#define  BCMA_CC_SROM_CONTROL_START	0x80000000
++#define  BCMA_CC_SROM_CONTROL_BUSY	0x80000000
++#define  BCMA_CC_SROM_CONTROL_OPCODE	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OP_READ	0x00000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRITE	0x20000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRDIS	0x40000000
++#define  BCMA_CC_SROM_CONTROL_OP_WREN	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OTPSEL	0x00000010
++#define  BCMA_CC_SROM_CONTROL_LOCK	0x00000008
++#define  BCMA_CC_SROM_CONTROL_SIZE_MASK	0x00000006
++#define  BCMA_CC_SROM_CONTROL_SIZE_1K	0x00000000
++#define  BCMA_CC_SROM_CONTROL_SIZE_4K	0x00000002
++#define  BCMA_CC_SROM_CONTROL_SIZE_16K	0x00000004
++#define  BCMA_CC_SROM_CONTROL_SIZE_SHIFT	1
++#define  BCMA_CC_SROM_CONTROL_PRESENT	0x00000001
 +/* 0x1E0 is defined as shared BCMA_CLKCTLST */
 +#define BCMA_CC_HW_WORKAROUND		0x01E4 /* Hardware workaround (rev >= 20) */
 +#define BCMA_CC_UART0_DATA		0x0300
@@ -2820,7 +2895,6 @@
 +#define BCMA_CC_PLLCTL_ADDR		0x0660
 +#define BCMA_CC_PLLCTL_DATA		0x0664
 +#define BCMA_CC_SPROM			0x0800 /* SPROM beginning */
-+#define BCMA_CC_SPROM_PCIE6		0x0830 /* SPROM beginning on PCIe rev >= 6 */
 +
 +/* Divider allocation in 4716/47162/5356 */
 +#define BCMA_CC_PMU5_MAINPLL_CPU	1
@@ -2971,7 +3045,7 @@
 +#endif /* LINUX_BCMA_DRIVER_CC_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_driver_pci.h
-@@ -0,0 +1,91 @@
+@@ -0,0 +1,214 @@
 +#ifndef LINUX_BCMA_DRIVER_PCI_H_
 +#define LINUX_BCMA_DRIVER_PCI_H_
 +
@@ -3027,6 +3101,35 @@
 +#define  BCMA_CORE_PCI_SBTOPCI1_MASK		0xFC000000
 +#define BCMA_CORE_PCI_SBTOPCI2			0x0108	/* Backplane to PCI translation 2 (sbtopci2) */
 +#define  BCMA_CORE_PCI_SBTOPCI2_MASK		0xC0000000
++#define BCMA_CORE_PCI_CONFIG_ADDR		0x0120	/* pcie config space access */
++#define BCMA_CORE_PCI_CONFIG_DATA		0x0124	/* pcie config space access */
++#define BCMA_CORE_PCI_MDIO_CONTROL		0x0128	/* controls the mdio access */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_MASK	0x7f	/* clock to be used on MDIO */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL	0x2
++#define  BCMA_CORE_PCI_MDIOCTL_PREAM_EN		0x80	/* Enable preamble sequnce */
++#define  BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE	0x100	/* Tranaction complete */
++#define BCMA_CORE_PCI_MDIO_DATA			0x012c	/* Data to the mdio access */
++#define  BCMA_CORE_PCI_MDIODATA_MASK		0x0000ffff /* data 2 bytes */
++#define  BCMA_CORE_PCI_MDIODATA_TA		0x00020000 /* Turnaround */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD	18	/* Regaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK_OLD	0x003c0000 /* Regaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD	22	/* Physmedia devaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK_OLD	0x0fc00000 /* Physmedia devaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF	18	/* Regaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK	0x007c0000 /* Regaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF	23	/* Physmedia devaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK	0x0f800000 /* Physmedia devaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_WRITE		0x10000000 /* write Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_READ		0x20000000 /* Read Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_START		0x40000000 /* start of Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_ADDR	0x0	/* dev address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_BLK_ADDR	0x1F	/* blk address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_PLL		0x1d	/* SERDES PLL Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_TX		0x1e	/* SERDES TX Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_RX		0x1f	/* SERDES RX Dev */
++#define BCMA_CORE_PCI_PCIEIND_ADDR		0x0130	/* indirect access to the internal register */
++#define BCMA_CORE_PCI_PCIEIND_DATA		0x0134	/* Data to/from the internal regsiter */
++#define BCMA_CORE_PCI_CLKREQENCTRL		0x0138	/*  >= rev 6, Clkreq rdma control */
 +#define BCMA_CORE_PCI_PCICFG0			0x0400	/* PCI config space 0 (rev >= 8) */
 +#define BCMA_CORE_PCI_PCICFG1			0x0500	/* PCI config space 1 (rev >= 8) */
 +#define BCMA_CORE_PCI_PCICFG2			0x0600	/* PCI config space 2 (rev >= 8) */
@@ -3046,26 +3149,120 @@
 +#define  BCMA_CORE_PCI_SBTOPCI_RC_READL		0x00000010 /* Memory read line */
 +#define  BCMA_CORE_PCI_SBTOPCI_RC_READM		0x00000020 /* Memory read multiple */
 +
++/* PCIE protocol PHY diagnostic registers */
++#define BCMA_CORE_PCI_PLP_MODEREG		0x200	/* Mode */
++#define BCMA_CORE_PCI_PLP_STATUSREG		0x204	/* Status */
++#define  BCMA_CORE_PCI_PLP_POLARITYINV_STAT	0x10	/* Status reg PCIE_PLP_STATUSREG */
++#define BCMA_CORE_PCI_PLP_LTSSMCTRLREG		0x208	/* LTSSM control */
++#define BCMA_CORE_PCI_PLP_LTLINKNUMREG		0x20c	/* Link Training Link number */
++#define BCMA_CORE_PCI_PLP_LTLANENUMREG		0x210	/* Link Training Lane number */
++#define BCMA_CORE_PCI_PLP_LTNFTSREG		0x214	/* Link Training N_FTS */
++#define BCMA_CORE_PCI_PLP_ATTNREG		0x218	/* Attention */
++#define BCMA_CORE_PCI_PLP_ATTNMASKREG		0x21C	/* Attention Mask */
++#define BCMA_CORE_PCI_PLP_RXERRCTR		0x220	/* Rx Error */
++#define BCMA_CORE_PCI_PLP_RXFRMERRCTR		0x224	/* Rx Framing Error */
++#define BCMA_CORE_PCI_PLP_RXERRTHRESHREG	0x228	/* Rx Error threshold */
++#define BCMA_CORE_PCI_PLP_TESTCTRLREG		0x22C	/* Test Control reg */
++#define BCMA_CORE_PCI_PLP_SERDESCTRLOVRDREG	0x230	/* SERDES Control Override */
++#define BCMA_CORE_PCI_PLP_TIMINGOVRDREG		0x234	/* Timing param override */
++#define BCMA_CORE_PCI_PLP_RXTXSMDIAGREG		0x238	/* RXTX State Machine Diag */
++#define BCMA_CORE_PCI_PLP_LTSSMDIAGREG		0x23C	/* LTSSM State Machine Diag */
++
++/* PCIE protocol DLLP diagnostic registers */
++#define BCMA_CORE_PCI_DLLP_LCREG		0x100	/* Link Control */
++#define BCMA_CORE_PCI_DLLP_LSREG		0x104	/* Link Status */
++#define BCMA_CORE_PCI_DLLP_LAREG		0x108	/* Link Attention */
++#define  BCMA_CORE_PCI_DLLP_LSREG_LINKUP	(1 << 16)
++#define BCMA_CORE_PCI_DLLP_LAMASKREG		0x10C	/* Link Attention Mask */
++#define BCMA_CORE_PCI_DLLP_NEXTTXSEQNUMREG	0x110	/* Next Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_ACKEDTXSEQNUMREG	0x114	/* Acked Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_PURGEDTXSEQNUMREG	0x118	/* Purged Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_RXSEQNUMREG		0x11C	/* Rx Sequence Number */
++#define BCMA_CORE_PCI_DLLP_LRREG		0x120	/* Link Replay */
++#define BCMA_CORE_PCI_DLLP_LACKTOREG		0x124	/* Link Ack Timeout */
++#define BCMA_CORE_PCI_DLLP_PMTHRESHREG		0x128	/* Power Management Threshold */
++#define BCMA_CORE_PCI_DLLP_RTRYWPREG		0x12C	/* Retry buffer write ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYRPREG		0x130	/* Retry buffer Read ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYPPREG		0x134	/* Retry buffer Purged ptr */
++#define BCMA_CORE_PCI_DLLP_RTRRWREG		0x138	/* Retry buffer Read/Write */
++#define BCMA_CORE_PCI_DLLP_ECTHRESHREG		0x13C	/* Error Count Threshold */
++#define BCMA_CORE_PCI_DLLP_TLPERRCTRREG		0x140	/* TLP Error Counter */
++#define BCMA_CORE_PCI_DLLP_ERRCTRREG		0x144	/* Error Counter */
++#define BCMA_CORE_PCI_DLLP_NAKRXCTRREG		0x148	/* NAK Received Counter */
++#define BCMA_CORE_PCI_DLLP_TESTREG		0x14C	/* Test */
++#define BCMA_CORE_PCI_DLLP_PKTBIST		0x150	/* Packet BIST */
++#define BCMA_CORE_PCI_DLLP_PCIE11		0x154	/* DLLP PCIE 1.1 reg */
++
++/* SERDES RX registers */
++#define BCMA_CORE_PCI_SERDES_RX_CTRL		1	/* Rx cntrl */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE	0x80	/* rxpolarity_force */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY	0x40	/* rxpolarity_value */
++#define BCMA_CORE_PCI_SERDES_RX_TIMER1		2	/* Rx Timer1 */
++#define BCMA_CORE_PCI_SERDES_RX_CDR		6	/* CDR */
++#define BCMA_CORE_PCI_SERDES_RX_CDRBW		7	/* CDR BW */
++
++/* SERDES PLL registers */
++#define BCMA_CORE_PCI_SERDES_PLL_CTRL		1	/* PLL control reg */
++#define BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN	0x4000	/* bit 14 is FREQDET on */
++
 +/* PCIcore specific boardflags */
 +#define BCMA_CORE_PCI_BFL_NOPCI			0x00000400 /* Board leaves PCI floating */
 +
++/* PCIE Config space accessing MACROS */
++#define BCMA_CORE_PCI_CFG_BUS_SHIFT		24	/* Bus shift */
++#define BCMA_CORE_PCI_CFG_SLOT_SHIFT		19	/* Slot/Device shift */
++#define BCMA_CORE_PCI_CFG_FUN_SHIFT		16	/* Function shift */
++#define BCMA_CORE_PCI_CFG_OFF_SHIFT		0	/* Register shift */
++
++#define BCMA_CORE_PCI_CFG_BUS_MASK		0xff	/* Bus mask */
++#define BCMA_CORE_PCI_CFG_SLOT_MASK		0x1f	/* Slot/Device mask */
++#define BCMA_CORE_PCI_CFG_FUN_MASK		7	/* Function mask */
++#define BCMA_CORE_PCI_CFG_OFF_MASK		0xfff	/* Register mask */
++
++/* PCIE Root Capability Register bits (Host mode only) */
++#define BCMA_CORE_PCI_RC_CRS_VISIBILITY		0x0001
++
++struct bcma_drv_pci;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++struct bcma_drv_pci_host {
++	struct bcma_drv_pci *pdev;
++
++	u32 host_cfg_addr;
++	spinlock_t cfgspace_lock;
++
++	struct pci_controller pci_controller;
++	struct pci_ops pci_ops;
++	struct resource mem_resource;
++	struct resource io_resource;
++};
++#endif
++
 +struct bcma_drv_pci {
 +	struct bcma_device *core;
 +	u8 setup_done:1;
++	u8 hostmode:1;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	struct bcma_drv_pci_host *host_controller;
++#endif
 +};
 +
 +/* Register access */
 +#define pcicore_read32(pc, offset)		bcma_read32((pc)->core, offset)
 +#define pcicore_write32(pc, offset, val)	bcma_write32((pc)->core, offset, val)
 +
-+extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
++extern void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc);
 +extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
 +				 struct bcma_device *core, bool enable);
 +
++extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
++extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
++
 +#endif /* LINUX_BCMA_DRIVER_PCI_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_regs.h
-@@ -0,0 +1,59 @@
+@@ -0,0 +1,86 @@
 +#ifndef LINUX_BCMA_REGS_H_
 +#define LINUX_BCMA_REGS_H_
 +
@@ -3124,6 +3321,33 @@
 +#define  BCMA_PCI_GPIO_XTAL		0x40	/* PCI config space GPIO 14 for Xtal powerup */
 +#define  BCMA_PCI_GPIO_PLL		0x80	/* PCI config space GPIO 15 for PLL powerdown */
 +
++/* SiliconBackplane Address Map.
++ * All regions may not exist on all chips.
++ */
++#define BCMA_SOC_SDRAM_BASE		0x00000000U	/* Physical SDRAM */
++#define BCMA_SOC_PCI_MEM		0x08000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI_MEM_SZ		(64 * 1024 * 1024)
++#define BCMA_SOC_PCI_CFG		0x0c000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_SDRAM_SWAPPED		0x10000000U	/* Byteswapped Physical SDRAM */
++#define BCMA_SOC_SDRAM_R2		0x80000000U	/* Region 2 for sdram (512 MB) */
++
++
++#define BCMA_SOC_PCI_DMA		0x40000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA2		0x80000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA_SZ		0x40000000U	/* Client Mode sb2pcitranslation2 size in bytes */
++#define BCMA_SOC_PCIE_DMA_L32		0x00000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), low 32 bits
++							 */
++#define BCMA_SOC_PCIE_DMA_H32		0x80000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
++#define BCMA_SOC_PCI1_MEM		0x40000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI1_CFG		0x44000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_PCIE1_DMA_H32		0xc0000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
 +#endif /* LINUX_BCMA_REGS_H_ */
 --- a/include/linux/mod_devicetable.h
 +++ b/include/linux/mod_devicetable.h
@@ -3191,11 +3415,13 @@
  			 sizeof(struct virtio_device_id), "virtio",
 --- /dev/null
 +++ b/drivers/bcma/sprom.c
-@@ -0,0 +1,247 @@
+@@ -0,0 +1,450 @@
 +/*
 + * Broadcom specific AMBA
 + * SPROM reading
 + *
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
@@ -3208,7 +3434,57 @@
 +#include <linux/dma-mapping.h>
 +#include <linux/slab.h>
 +
-+#define SPOFF(offset)	((offset) / sizeof(u16))
++static int(*get_fallback_sprom)(struct bcma_bus *dev, struct ssb_sprom *out);
++
++/**
++ * bcma_arch_register_fallback_sprom - Registers a method providing a
++ * fallback SPROM if no SPROM is found.
++ *
++ * @sprom_callback: The callback function.
++ *
++ * With this function the architecture implementation may register a
++ * callback handler which fills the SPROM data structure. The fallback is
++ * used for PCI based BCMA devices, where no valid SPROM can be found
++ * in the shadow registers and to provide the SPROM for SoCs where BCMA is
++ * to controll the system bus.
++ *
++ * This function is useful for weird architectures that have a half-assed
++ * BCMA device hardwired to their PCI bus.
++ *
++ * This function is available for architecture code, only. So it is not
++ * exported.
++ */
++int bcma_arch_register_fallback_sprom(int (*sprom_callback)(struct bcma_bus *bus,
++				     struct ssb_sprom *out))
++{
++	if (get_fallback_sprom)
++		return -EEXIST;
++	get_fallback_sprom = sprom_callback;
++
++	return 0;
++}
++
++static int bcma_fill_sprom_with_fallback(struct bcma_bus *bus,
++					 struct ssb_sprom *out)
++{
++	int err;
++
++	if (!get_fallback_sprom) {
++		err = -ENOENT;
++		goto fail;
++	}
++
++	err = get_fallback_sprom(bus, out);
++	if (err)
++		goto fail;
++
++	pr_debug("Using SPROM revision %d provided by"
++		 " platform.\n", bus->sprom.revision);
++	return 0;
++fail:
++	pr_warn("Using fallback SPROM failed (err %d)\n", err);
++	return err;
++}
 +
 +/**************************************************
 + * R/W ops.
@@ -3318,10 +3594,21 @@
 + * SPROM extraction.
 + **************************************************/
 +
++#define SPOFF(offset)	((offset) / sizeof(u16))
++
++#define SPEX(_field, _offset, _mask, _shift)	\
++	bus->sprom._field = ((sprom[SPOFF(_offset)] & (_mask)) >> (_shift))
++
 +static void bcma_sprom_extract_r8(struct bcma_bus *bus, const u16 *sprom)
 +{
-+	u16 v;
++	u16 v, o;
 +	int i;
++	u16 pwr_info_offset[] = {
++		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
++		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
++	};
++	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
++			ARRAY_SIZE(bus->sprom.core_pwr_info));
 +
 +	bus->sprom.revision = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] &
 +		SSB_SPROM_REVISION_REV;
@@ -3331,85 +3618,229 @@
 +		*(((__be16 *)bus->sprom.il0mac) + i) = cpu_to_be16(v);
 +	}
 +
-+	bus->sprom.board_rev = sprom[SPOFF(SSB_SPROM8_BOARDREV)];
-+
-+	bus->sprom.txpid2g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G0) >> SSB_SPROM4_TXPID2G0_SHIFT;
-+	bus->sprom.txpid2g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G1) >> SSB_SPROM4_TXPID2G1_SHIFT;
-+	bus->sprom.txpid2g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G2) >> SSB_SPROM4_TXPID2G2_SHIFT;
-+	bus->sprom.txpid2g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G3) >> SSB_SPROM4_TXPID2G3_SHIFT;
-+
-+	bus->sprom.txpid5gl[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL0) >> SSB_SPROM4_TXPID5GL0_SHIFT;
-+	bus->sprom.txpid5gl[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL1) >> SSB_SPROM4_TXPID5GL1_SHIFT;
-+	bus->sprom.txpid5gl[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL2) >> SSB_SPROM4_TXPID5GL2_SHIFT;
-+	bus->sprom.txpid5gl[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL3) >> SSB_SPROM4_TXPID5GL3_SHIFT;
-+
-+	bus->sprom.txpid5g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G0) >> SSB_SPROM4_TXPID5G0_SHIFT;
-+	bus->sprom.txpid5g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G1) >> SSB_SPROM4_TXPID5G1_SHIFT;
-+	bus->sprom.txpid5g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G2) >> SSB_SPROM4_TXPID5G2_SHIFT;
-+	bus->sprom.txpid5g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G3) >> SSB_SPROM4_TXPID5G3_SHIFT;
-+
-+	bus->sprom.txpid5gh[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH0) >> SSB_SPROM4_TXPID5GH0_SHIFT;
-+	bus->sprom.txpid5gh[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH1) >> SSB_SPROM4_TXPID5GH1_SHIFT;
-+	bus->sprom.txpid5gh[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH2) >> SSB_SPROM4_TXPID5GH2_SHIFT;
-+	bus->sprom.txpid5gh[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH3) >> SSB_SPROM4_TXPID5GH3_SHIFT;
-+
-+	bus->sprom.boardflags_lo = sprom[SPOFF(SSB_SPROM8_BFLLO)];
-+	bus->sprom.boardflags_hi = sprom[SPOFF(SSB_SPROM8_BFLHI)];
-+	bus->sprom.boardflags2_lo = sprom[SPOFF(SSB_SPROM8_BFL2LO)];
-+	bus->sprom.boardflags2_hi = sprom[SPOFF(SSB_SPROM8_BFL2HI)];
-+
-+	bus->sprom.country_code = sprom[SPOFF(SSB_SPROM8_CCODE)];
-+
-+	bus->sprom.fem.ghz2.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz2.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz2.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz2.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz2.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
-+
-+	bus->sprom.fem.ghz5.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz5.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz5.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz5.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz5.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
++	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
++
++	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
++	     SSB_SPROM4_TXPID2G0_SHIFT);
++	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
++	     SSB_SPROM4_TXPID2G1_SHIFT);
++	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
++	     SSB_SPROM4_TXPID2G2_SHIFT);
++	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
++	     SSB_SPROM4_TXPID2G3_SHIFT);
++
++	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
++	     SSB_SPROM4_TXPID5GL0_SHIFT);
++	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
++	     SSB_SPROM4_TXPID5GL1_SHIFT);
++	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
++	     SSB_SPROM4_TXPID5GL2_SHIFT);
++	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
++	     SSB_SPROM4_TXPID5GL3_SHIFT);
++
++	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
++	     SSB_SPROM4_TXPID5G0_SHIFT);
++	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
++	     SSB_SPROM4_TXPID5G1_SHIFT);
++	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
++	     SSB_SPROM4_TXPID5G2_SHIFT);
++	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
++	     SSB_SPROM4_TXPID5G3_SHIFT);
++
++	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
++	     SSB_SPROM4_TXPID5GH0_SHIFT);
++	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
++	     SSB_SPROM4_TXPID5GH1_SHIFT);
++	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
++	     SSB_SPROM4_TXPID5GH2_SHIFT);
++	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
++	     SSB_SPROM4_TXPID5GH3_SHIFT);
++
++	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
++	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
++	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
++	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
++
++	SPEX(country_code, SSB_SPROM8_CCODE, ~0, 0);
++
++	/* Extract cores power info info */
++	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
++		o = pwr_info_offset[i];
++		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_MAXP, 0);
++
++		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
++
++		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GH_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
++
++		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
++	}
++
++	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++
++	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++}
++
++/*
++ * Indicates the presence of external SPROM.
++ */
++static bool bcma_sprom_ext_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 srom_control;
++	u32 present_mask;
++
++	if (bus->drv_cc.core->id.rev >= 31) {
++		if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
++			return false;
++
++		srom_control = bcma_read32(bus->drv_cc.core,
++					   BCMA_CC_SROM_CONTROL);
++		return srom_control & BCMA_CC_SROM_CONTROL_PRESENT;
++	}
++
++	/* older chipcommon revisions use chip status register */
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present_mask = BCMA_CC_CHIPST_4313_SPROM_PRESENT;
++		break;
++
++	case 0x4331:
++		present_mask = BCMA_CC_CHIPST_4331_SPROM_PRESENT;
++		break;
++
++	default:
++		return true;
++	}
++
++	return chip_status & present_mask;
++}
++
++/*
++ * Indicates that on-chip OTP memory is present and enabled.
++ */
++static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 otpsize = 0;
++	bool present;
++
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present = chip_status & BCMA_CC_CHIPST_4313_OTP_PRESENT;
++		break;
++
++	case 0x4331:
++		present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
++		break;
++
++	case 43224:
++	case 43225:
++		/* for these chips OTP is always available */
++		present = true;
++		break;
++
++	default:
++		present = false;
++		break;
++	}
++
++	if (present) {
++		otpsize = bus->drv_cc.capabilities & BCMA_CC_CAP_OTPS;
++		otpsize >>= BCMA_CC_CAP_OTPS_SHIFT;
++	}
++
++	return otpsize != 0;
++}
++
++/*
++ * Verify OTP is filled and determine the byte
++ * offset where SPROM data is located.
++ *
++ * On error, returns 0; byte offset otherwise.
++ */
++static int bcma_sprom_onchip_offset(struct bcma_bus *bus)
++{
++	struct bcma_device *cc = bus->drv_cc.core;
++	u32 offset;
++
++	/* verify OTP status */
++	if ((bcma_read32(cc, BCMA_CC_OTPS) & BCMA_CC_OTPS_GU_PROG_HW) == 0)
++		return 0;
++
++	/* obtain bit offset from otplayout register */
++	offset = (bcma_read32(cc, BCMA_CC_OTPL) & BCMA_CC_OTPL_GURGN_OFFSET);
++	return BCMA_CC_SPROM + (offset >> 3);
 +}
 +
 +int bcma_sprom_get(struct bcma_bus *bus)
 +{
-+	u16 offset;
++	u16 offset = BCMA_CC_SPROM;
 +	u16 *sprom;
 +	int err = 0;
 +
 +	if (!bus->drv_cc.core)
 +		return -EOPNOTSUPP;
 +
-+	if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
-+		return -ENOENT;
++	if (!bcma_sprom_ext_available(bus)) {
++		/*
++		 * External SPROM takes precedence so check
++		 * on-chip OTP only when no external SPROM
++		 * is present.
++		 */
++		if (bcma_sprom_onchip_available(bus)) {
++			/* determine offset */
++			offset = bcma_sprom_onchip_offset(bus);
++		}
++		if (!offset) {
++			/*
++			 * Maybe there is no SPROM on the device?
++			 * Now we ask the arch code if there is some sprom
++			 * available for this device in some other storage.
++			 */
++			err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
++			return err;
++		}
++	}
 +
 +	sprom = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
 +			GFP_KERNEL);
@@ -3419,11 +3850,7 @@
 +	if (bus->chipinfo.id == 0x4331)
 +		bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
 +
-+	/* Most cards have SPROM moved by additional offset 0x30 (48 dwords).
-+	 * According to brcm80211 this applies to cards with PCIe rev >= 6
-+	 * TODO: understand this condition and use it */
-+	offset = (bus->chipinfo.id == 0x4331) ? BCMA_CC_SPROM :
-+		BCMA_CC_SPROM_PCIE6;
++	pr_debug("SPROM offset 0x%x\n", offset);
 +	bcma_sprom_read(bus, offset, sprom);
 +
 +	if (bus->chipinfo.id == 0x4331)
@@ -3441,21 +3868,596 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/driver_pci_host.c
-@@ -0,0 +1,14 @@
+@@ -0,0 +1,589 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Core in hostmode
 + *
++ * Copyright 2005 - 2011, Broadcom Corporation
++ * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
 +#include "bcma_private.h"
++#include <linux/pci.h>
++#include <linux/export.h>
 +#include <linux/bcma/bcma.h>
++#include <asm/paccess.h>
++
++/* Probe a 32bit value on the bus and catch bus exceptions.
++ * Returns nonzero on a bus exception.
++ * This is MIPS specific */
++#define mips_busprobe32(val, addr)	get_dbe((val), ((u32 *)(addr)))
++
++/* Assume one-hot slot wiring */
++#define BCMA_PCI_SLOT_MAX	16
++#define	PCI_CONFIG_SPACE_SIZE	256
++
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	u16 chipid_top;
++	u32 tmp;
++
++	chipid_top = (bus->chipinfo.id & 0xFF00);
++	if (chipid_top != 0x4700 &&
++	    chipid_top != 0x5300)
++		return false;
++
++	if (bus->sprom.boardflags_lo & BCMA_CORE_PCI_BFL_NOPCI) {
++		pr_info("This PCI core is disabled and not working\n");
++		return false;
++	}
 +
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++	bcma_core_enable(pc->core, 0);
++
++	return !mips_busprobe32(tmp, pc->core->io_addr);
++}
++
++static u32 bcma_pcie_read_config(struct bcma_drv_pci *pc, u32 address)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_DATA);
++}
++
++static void bcma_pcie_write_config(struct bcma_drv_pci *pc, u32 address,
++				   u32 data)
 +{
-+	pr_err("No support for PCI core in hostmode yet\n");
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_DATA, data);
++}
++
++static u32 bcma_get_cfgspace_addr(struct bcma_drv_pci *pc, unsigned int dev,
++			     unsigned int func, unsigned int off)
++{
++	u32 addr = 0;
++
++	/* Issue config commands only when the data link is up (atleast
++	 * one external pcie device is present).
++	 */
++	if (dev >= 2 || !(bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_LSREG)
++			  & BCMA_CORE_PCI_DLLP_LSREG_LINKUP))
++		goto out;
++
++	/* Type 0 transaction */
++	/* Slide the PCI window to the appropriate slot */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++	/* Calculate the address */
++	addr = pc->host_controller->host_cfg_addr;
++	addr |= (dev << BCMA_CORE_PCI_CFG_SLOT_SHIFT);
++	addr |= (func << BCMA_CORE_PCI_CFG_FUN_SHIFT);
++	addr |= (off & ~3);
++
++out:
++	return addr;
++}
++
++static int bcma_extpci_read_config(struct bcma_drv_pci *pc, unsigned int dev,
++				  unsigned int func, unsigned int off,
++				  void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr, val;
++	void __iomem *mmio = 0;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* we support only two functions on device 0 */
++		if (func > 1)
++			return -EINVAL;
++
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off >= PCI_CONFIG_SPACE_SIZE) {
++			addr = (func << 12);
++			addr |= (off & 0x0FFF);
++			val = bcma_pcie_read_config(pc, addr);
++		} else {
++			addr = BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			val = pcicore_read32(pc, addr);
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++
++		val = readl(mmio);
++	}
++	val >>= (8 * (off & 3));
++
++	switch (len) {
++	case 1:
++		*((u8 *)buf) = (u8)val;
++		break;
++	case 2:
++		*((u16 *)buf) = (u16)val;
++		break;
++	case 4:
++		*((u32 *)buf) = (u32)val;
++		break;
++	}
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
++				   unsigned int func, unsigned int off,
++				   const void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr = 0, val = 0;
++	void __iomem *mmio = 0;
++	u16 chipid = pc->core->bus->chipinfo.id;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off < PCI_CONFIG_SPACE_SIZE) {
++			addr = pc->core->addr + BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			mmio = ioremap_nocache(addr, len);
++			if (!mmio)
++				goto out;
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++	}
++
++	switch (len) {
++	case 1:
++		val = readl(mmio);
++		val &= ~(0xFF << (8 * (off & 3)));
++		val |= *((const u8 *)buf) << (8 * (off & 3));
++		break;
++	case 2:
++		val = readl(mmio);
++		val &= ~(0xFFFF << (8 * (off & 3)));
++		val |= *((const u16 *)buf) << (8 * (off & 3));
++		break;
++	case 4:
++		val = *((const u32 *)buf);
++		break;
++	}
++	if (dev == 0 && !addr) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		addr = (func << 12);
++		addr |= (off & 0x0FFF);
++		bcma_pcie_write_config(pc, addr, val);
++	} else {
++		writel(val, mmio);
++
++		if (chipid == 0x4716 || chipid == 0x4748)
++			readl(mmio);
++	}
++
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_core_pci_hostmode_read_config(struct pci_bus *bus,
++					      unsigned int devfn,
++					      int reg, int size, u32 *val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_read_config(pc, PCI_SLOT(devfn),
++				     PCI_FUNC(devfn), reg, val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++static int bcma_core_pci_hostmode_write_config(struct pci_bus *bus,
++					       unsigned int devfn,
++					       int reg, int size, u32 val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_write_config(pc, PCI_SLOT(devfn),
++				      PCI_FUNC(devfn), reg, &val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++/* return cap_offset if requested capability exists in the PCI config space */
++static u8 __devinit bcma_find_pci_capability(struct bcma_drv_pci *pc,
++					     unsigned int dev,
++					     unsigned int func, u8 req_cap_id,
++					     unsigned char *buf, u32 *buflen)
++{
++	u8 cap_id;
++	u8 cap_ptr = 0;
++	u32 bufsize;
++	u8 byte_val;
++
++	/* check for Header type 0 */
++	bcma_extpci_read_config(pc, dev, func, PCI_HEADER_TYPE, &byte_val,
++				sizeof(u8));
++	if ((byte_val & 0x7f) != PCI_HEADER_TYPE_NORMAL)
++		return cap_ptr;
++
++	/* check if the capability pointer field exists */
++	bcma_extpci_read_config(pc, dev, func, PCI_STATUS, &byte_val,
++				sizeof(u8));
++	if (!(byte_val & PCI_STATUS_CAP_LIST))
++		return cap_ptr;
++
++	/* check if the capability pointer is 0x00 */
++	bcma_extpci_read_config(pc, dev, func, PCI_CAPABILITY_LIST, &cap_ptr,
++				sizeof(u8));
++	if (cap_ptr == 0x00)
++		return cap_ptr;
++
++	/* loop thr'u the capability list and see if the requested capabilty
++	 * exists */
++	bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id, sizeof(u8));
++	while (cap_id != req_cap_id) {
++		bcma_extpci_read_config(pc, dev, func, cap_ptr + 1, &cap_ptr,
++					sizeof(u8));
++		if (cap_ptr == 0x00)
++			return cap_ptr;
++		bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id,
++					sizeof(u8));
++	}
++
++	/* found the caller requested capability */
++	if ((buf != NULL) && (buflen != NULL)) {
++		u8 cap_data;
++
++		bufsize = *buflen;
++		if (!bufsize)
++			return cap_ptr;
++
++		*buflen = 0;
++
++		/* copy the cpability data excluding cap ID and next ptr */
++		cap_data = cap_ptr + 2;
++		if ((bufsize + cap_data)  > PCI_CONFIG_SPACE_SIZE)
++			bufsize = PCI_CONFIG_SPACE_SIZE - cap_data;
++		*buflen = bufsize;
++		while (bufsize--) {
++			bcma_extpci_read_config(pc, dev, func, cap_data, buf,
++						sizeof(u8));
++			cap_data++;
++			buf++;
++		}
++	}
++
++	return cap_ptr;
++}
++
++/* If the root port is capable of returning Config Request
++ * Retry Status (CRS) Completion Status to software then
++ * enable the feature.
++ */
++static void __devinit bcma_core_pci_enable_crs(struct bcma_drv_pci *pc)
++{
++	u8 cap_ptr, root_ctrl, root_cap, dev;
++	u16 val16;
++	int i;
++
++	cap_ptr = bcma_find_pci_capability(pc, 0, 0, PCI_CAP_ID_EXP, NULL,
++					   NULL);
++	root_cap = cap_ptr + PCI_EXP_RTCAP;
++	bcma_extpci_read_config(pc, 0, 0, root_cap, &val16, sizeof(u16));
++	if (val16 & BCMA_CORE_PCI_RC_CRS_VISIBILITY) {
++		/* Enable CRS software visibility */
++		root_ctrl = cap_ptr + PCI_EXP_RTCTL;
++		val16 = PCI_EXP_RTCTL_CRSSVE;
++		bcma_extpci_read_config(pc, 0, 0, root_ctrl, &val16,
++					sizeof(u16));
++
++		/* Initiate a configuration request to read the vendor id
++		 * field of the device function's config space header after
++		 * 100 ms wait time from the end of Reset. If the device is
++		 * not done with its internal initialization, it must at
++		 * least return a completion TLP, with a completion status
++		 * of "Configuration Request Retry Status (CRS)". The root
++		 * complex must complete the request to the host by returning
++		 * a read-data value of 0001h for the Vendor ID field and
++		 * all 1s for any additional bytes included in the request.
++		 * Poll using the config reads for max wait time of 1 sec or
++		 * until we receive the successful completion status. Repeat
++		 * the procedure for all the devices.
++		 */
++		for (dev = 1; dev < BCMA_PCI_SLOT_MAX; dev++) {
++			for (i = 0; i < 100000; i++) {
++				bcma_extpci_read_config(pc, dev, 0,
++							PCI_VENDOR_ID, &val16,
++							sizeof(val16));
++				if (val16 != 0x1)
++					break;
++				udelay(10);
++			}
++			if (val16 == 0x1)
++				pr_err("PCI: Broken device in slot %d\n", dev);
++		}
++	}
++}
++
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	struct bcma_drv_pci_host *pc_host;
++	u32 tmp;
++	u32 pci_membase_1G;
++	unsigned long io_map_base;
++
++	pr_info("PCIEcore in host mode found\n");
++
++	pc_host = kzalloc(sizeof(*pc_host), GFP_KERNEL);
++	if (!pc_host)  {
++		pr_err("can not allocate memory");
++		return;
++	}
++
++	pc->host_controller = pc_host;
++	pc_host->pci_controller.io_resource = &pc_host->io_resource;
++	pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
++	pc_host->pci_controller.pci_ops = &pc_host->pci_ops;
++	pc_host->pdev = pc;
++
++	pci_membase_1G = BCMA_SOC_PCI_DMA;
++	pc_host->host_cfg_addr = BCMA_SOC_PCI_CFG;
++
++	pc_host->pci_ops.read = bcma_core_pci_hostmode_read_config;
++	pc_host->pci_ops.write = bcma_core_pci_hostmode_write_config;
++
++	pc_host->mem_resource.name = "BCMA PCIcore external memory",
++	pc_host->mem_resource.start = BCMA_SOC_PCI_DMA;
++	pc_host->mem_resource.end = BCMA_SOC_PCI_DMA + BCMA_SOC_PCI_DMA_SZ - 1;
++	pc_host->mem_resource.flags = IORESOURCE_MEM | IORESOURCE_PCI_FIXED;
++
++	pc_host->io_resource.name = "BCMA PCIcore external I/O",
++	pc_host->io_resource.start = 0x100;
++	pc_host->io_resource.end = 0x7FF;
++	pc_host->io_resource.flags = IORESOURCE_IO | IORESOURCE_PCI_FIXED;
++
++	/* Reset RC */
++	udelay(3000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST_OE);
++	udelay(1000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST |
++			BCMA_CORE_PCI_CTL_RST_OE);
++
++	/* 64 MB I/O access window. On 4716, use
++	 * sbtopcie0 to access the device registers. We
++	 * can't use address match 2 (1 GB window) region
++	 * as mips can't generate 64-bit address on the
++	 * backplane.
++	 */
++	if (bus->chipinfo.id == 0x4716 || bus->chipinfo.id == 0x4748) {
++		pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++		pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++					    BCMA_SOC_PCI_MEM_SZ - 1;
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_MEM | BCMA_SOC_PCI_MEM);
++	} else if (bus->chipinfo.id == 0x5300) {
++		tmp = BCMA_CORE_PCI_SBTOPCI_MEM;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_PREF;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_BURST;
++		if (pc->core->core_unit == 0) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE_DMA_H32;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI_MEM);
++		} else if (pc->core->core_unit == 1) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI1_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI1_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE1_DMA_H32;
++			pc_host->host_cfg_addr = BCMA_SOC_PCI1_CFG;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI1_MEM);
++		}
++	} else
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_IO);
++
++	/* 64 MB configuration access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++
++	/* 1 GB memory access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI2,
++			BCMA_CORE_PCI_SBTOPCI_MEM | pci_membase_1G);
++
++
++	/* As per PCI Express Base Spec 1.1 we need to wait for
++	 * at least 100 ms from the end of a reset (cold/warm/hot)
++	 * before issuing configuration requests to PCI Express
++	 * devices.
++	 */
++	udelay(100000);
++
++	bcma_core_pci_enable_crs(pc);
++
++	/* Enable PCI bridge BAR0 memory & master access */
++	tmp = PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
++	bcma_extpci_write_config(pc, 0, 0, PCI_COMMAND, &tmp, sizeof(tmp));
++
++	/* Enable PCI interrupts */
++	pcicore_write32(pc, BCMA_CORE_PCI_IMASK, BCMA_CORE_PCI_IMASK_INTA);
++
++	/* Ok, ready to run, register it to the system.
++	 * The following needs change, if we want to port hostmode
++	 * to non-MIPS platform. */
++	io_map_base = (unsigned long)ioremap_nocache(BCMA_SOC_PCI_MEM,
++						     0x04000000);
++	pc_host->pci_controller.io_map_base = io_map_base;
++	set_io_port_base(pc_host->pci_controller.io_map_base);
++	/* Give some time to the PCI controller to configure itself with the new
++	 * values. Not waiting at this point causes crashes of the machine. */
++	mdelay(10);
++	register_pci_controller(&pc_host->pci_controller);
++	return;
++}
++
++/* Early PCI fixup for a device on the PCI-core bridge. */
++static void bcma_core_pci_fixup_pcibridge(struct pci_dev *dev)
++{
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) != 0)
++		return;
++
++	pr_info("PCI: Fixing up bridge %s\n", pci_name(dev));
++
++	/* Enable PCI bridge bus mastering and memory space */
++	pci_set_master(dev);
++	if (pcibios_enable_device(dev, ~0) < 0) {
++		pr_err("PCI: BCMA bridge enable failed\n");
++		return;
++	}
++
++	/* Enable PCI bridge BAR1 prefetch and burst */
++	pci_write_config_dword(dev, BCMA_PCI_BAR1_CONTROL, 3);
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_pcibridge);
++
++/* Early PCI fixup for all PCI-cores to set the correct memory address. */
++static void bcma_core_pci_fixup_addresses(struct pci_dev *dev)
++{
++	struct resource *res;
++	int pos;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) == 0)
++		return;
++
++	pr_info("PCI: Fixing up addresses %s\n", pci_name(dev));
++
++	for (pos = 0; pos < 6; pos++) {
++		res = &dev->resource[pos];
++		if (res->flags & (IORESOURCE_IO | IORESOURCE_MEM))
++			pci_assign_resource(dev, pos);
++	}
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_addresses);
++
++/* This function is called when doing a pci_enable_device().
++ * We must first check if the device is a device on the PCI-core bridge. */
++int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++
++	pr_info("PCI: Fixing up device %s\n", pci_name(dev));
++
++	/* Fix up interrupt lines */
++	dev->irq = bcma_core_mips_irq(pc_host->pdev->core) + 2;
++	pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
++
++	return 0;
++}
++EXPORT_SYMBOL(bcma_core_pci_plat_dev_init);
++
++/* PCI device IRQ mapping. */
++int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++	return bcma_core_mips_irq(pc_host->pdev->core) + 2;
 +}
++EXPORT_SYMBOL(bcma_core_pci_pcibios_map_irq);
 --- /dev/null
 +++ b/drivers/bcma/driver_mips.c
 @@ -0,0 +1,256 @@
diff --git a/target/linux/generic/patches-2.6.36/941-ssb_update.patch b/target/linux/generic/patches-2.6.36/941-ssb_update.patch
index 9f8dfb8782..f549184c4b 100644
--- a/target/linux/generic/patches-2.6.36/941-ssb_update.patch
+++ b/target/linux/generic/patches-2.6.36/941-ssb_update.patch
@@ -17,7 +17,49 @@
  #include <linux/ssb/ssb.h>
  #include <linux/ssb/ssb_regs.h>
  #include <linux/ssb/ssb_driver_gige.h>
-@@ -384,6 +385,35 @@ static int ssb_device_uevent(struct devi
+@@ -140,19 +141,6 @@ static void ssb_device_put(struct ssb_de
+ 		put_device(dev->dev);
+ }
+ 
+-static inline struct ssb_driver *ssb_driver_get(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		get_driver(&drv->drv);
+-	return drv;
+-}
+-
+-static inline void ssb_driver_put(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		put_driver(&drv->drv);
+-}
+-
+ static int ssb_device_resume(struct device *dev)
+ {
+ 	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
+@@ -250,11 +238,9 @@ int ssb_devices_freeze(struct ssb_bus *b
+ 			ssb_device_put(sdev);
+ 			continue;
+ 		}
+-		sdrv = ssb_driver_get(drv_to_ssb_drv(sdev->dev->driver));
+-		if (!sdrv || SSB_WARN_ON(!sdrv->remove)) {
+-			ssb_device_put(sdev);
++		sdrv = drv_to_ssb_drv(sdev->dev->driver);
++		if (SSB_WARN_ON(!sdrv->remove))
+ 			continue;
+-		}
+ 		sdrv->remove(sdev);
+ 		ctx->device_frozen[i] = 1;
+ 	}
+@@ -293,7 +279,6 @@ int ssb_devices_thaw(struct ssb_freeze_c
+ 				   dev_name(sdev->dev));
+ 			result = err;
+ 		}
+-		ssb_driver_put(sdrv);
+ 		ssb_device_put(sdev);
+ 	}
+ 
+@@ -384,6 +369,35 @@ static int ssb_device_uevent(struct devi
  			     ssb_dev->id.revision);
  }
  
@@ -53,7 +95,7 @@
  static struct bus_type ssb_bustype = {
  	.name		= "ssb",
  	.match		= ssb_bus_match,
-@@ -393,6 +423,7 @@ static struct bus_type ssb_bustype = {
+@@ -393,6 +407,7 @@ static struct bus_type ssb_bustype = {
  	.suspend	= ssb_device_suspend,
  	.resume		= ssb_device_resume,
  	.uevent		= ssb_device_uevent,
@@ -61,7 +103,7 @@
  };
  
  static void ssb_buses_lock(void)
-@@ -528,7 +559,7 @@ error:
+@@ -528,7 +543,7 @@ error:
  }
  
  /* Needs ssb_buses_lock() */
@@ -70,7 +112,7 @@
  {
  	struct ssb_bus *bus, *n;
  	int err = 0;
-@@ -739,9 +770,9 @@ out:
+@@ -739,9 +754,9 @@ out:
  	return err;
  }
  
@@ -83,7 +125,7 @@
  {
  	int err;
  
-@@ -822,8 +853,8 @@ err_disable_xtal:
+@@ -822,8 +837,8 @@ err_disable_xtal:
  }
  
  #ifdef CONFIG_SSB_PCIHOST
@@ -94,7 +136,7 @@
  {
  	int err;
  
-@@ -846,9 +877,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
+@@ -846,9 +861,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
  #endif /* CONFIG_SSB_PCIHOST */
  
  #ifdef CONFIG_SSB_PCMCIAHOST
@@ -107,7 +149,7 @@
  {
  	int err;
  
-@@ -868,8 +899,9 @@ EXPORT_SYMBOL(ssb_bus_pcmciabus_register
+@@ -868,8 +883,9 @@ EXPORT_SYMBOL(ssb_bus_pcmciabus_register
  #endif /* CONFIG_SSB_PCMCIAHOST */
  
  #ifdef CONFIG_SSB_SDIOHOST
@@ -119,7 +161,7 @@
  {
  	int err;
  
-@@ -889,9 +921,9 @@ int ssb_bus_sdiobus_register(struct ssb_
+@@ -889,9 +905,9 @@ int ssb_bus_sdiobus_register(struct ssb_
  EXPORT_SYMBOL(ssb_bus_sdiobus_register);
  #endif /* CONFIG_SSB_PCMCIAHOST */
  
@@ -132,7 +174,7 @@
  {
  	int err;
  
-@@ -972,8 +1004,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
+@@ -972,8 +988,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
  	switch (plltype) {
  	case SSB_PLLTYPE_6: /* 100/200 or 120/240 only */
  		if (m & SSB_CHIPCO_CLK_T6_MMASK)
@@ -143,7 +185,17 @@
  	case SSB_PLLTYPE_1: /* 48Mhz base, 3 dividers */
  	case SSB_PLLTYPE_3: /* 25Mhz, 2 dividers */
  	case SSB_PLLTYPE_4: /* 48Mhz, 4 dividers */
-@@ -1088,23 +1120,22 @@ static u32 ssb_tmslow_reject_bitmask(str
+@@ -1063,6 +1079,9 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
+ 	u32 plltype;
+ 	u32 clkctl_n, clkctl_m;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_controlclock(&bus->chipco);
++
+ 	if (ssb_extif_available(&bus->extif))
+ 		ssb_extif_get_clockcontrol(&bus->extif, &plltype,
+ 					   &clkctl_n, &clkctl_m);
+@@ -1088,23 +1107,22 @@ static u32 ssb_tmslow_reject_bitmask(str
  {
  	u32 rev = ssb_read32(dev, SSB_IDLOW) & SSB_IDLOW_SSBREV;
  
@@ -174,7 +226,7 @@
  }
  
  int ssb_device_is_enabled(struct ssb_device *dev)
-@@ -1163,10 +1194,10 @@ void ssb_device_enable(struct ssb_device
+@@ -1163,10 +1181,10 @@ void ssb_device_enable(struct ssb_device
  }
  EXPORT_SYMBOL(ssb_device_enable);
  
@@ -188,7 +240,7 @@
  {
  	int i;
  	u32 val;
-@@ -1174,7 +1205,7 @@ static int ssb_wait_bit(struct ssb_devic
+@@ -1174,7 +1192,7 @@ static int ssb_wait_bit(struct ssb_devic
  	for (i = 0; i < timeout; i++) {
  		val = ssb_read32(dev, reg);
  		if (set) {
@@ -197,7 +249,7 @@
  				return 0;
  		} else {
  			if (!(val & bitmask))
-@@ -1191,20 +1222,38 @@ static int ssb_wait_bit(struct ssb_devic
+@@ -1191,20 +1209,38 @@ static int ssb_wait_bit(struct ssb_devic
  
  void ssb_device_disable(struct ssb_device *dev, u32 core_specific_flags)
  {
@@ -245,7 +297,7 @@
  
  	ssb_write32(dev, SSB_TMSLOW,
  		    reject | SSB_TMSLOW_RESET |
-@@ -1213,13 +1262,34 @@ void ssb_device_disable(struct ssb_devic
+@@ -1213,13 +1249,34 @@ void ssb_device_disable(struct ssb_devic
  }
  EXPORT_SYMBOL(ssb_device_disable);
  
@@ -281,7 +333,7 @@
  	default:
  		__ssb_dma_not_implemented(dev);
  	}
-@@ -1262,20 +1332,20 @@ EXPORT_SYMBOL(ssb_bus_may_powerdown);
+@@ -1262,20 +1319,20 @@ EXPORT_SYMBOL(ssb_bus_may_powerdown);
  
  int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl)
  {
@@ -306,7 +358,7 @@
  	return 0;
  error:
  	ssb_printk(KERN_ERR PFX "Bus powerup failed\n");
-@@ -1283,6 +1353,37 @@ error:
+@@ -1283,6 +1340,37 @@ error:
  }
  EXPORT_SYMBOL(ssb_bus_powerup);
  
@@ -355,10 +407,40 @@
   * Copyright (C) 2005 Martin Langer <martin-langer@gmx.de>
   * Copyright (C) 2005 Stefano Brivio <st3@riseup.net>
   * Copyright (C) 2005 Danny van Dyk <kugelfang@gentoo.org>
-@@ -406,6 +406,46 @@ static void sprom_extract_r123(struct ss
- 	out->antenna_gain.ghz5.a3 = gain;
- }
- 
+@@ -331,7 +331,6 @@ static void sprom_extract_r123(struct ss
+ {
+ 	int i;
+ 	u16 v;
+-	s8 gain;
+ 	u16 loc[3];
+ 
+ 	if (out->revision == 3)			/* rev 3 moved MAC */
+@@ -390,20 +389,52 @@ static void sprom_extract_r123(struct ss
+ 		SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_BG,
+-				    SSB_SPROM1_AGAIN_BG_SHIFT);
+-	out->antenna_gain.ghz24.a0 = gain;
+-	out->antenna_gain.ghz24.a1 = gain;
+-	out->antenna_gain.ghz24.a2 = gain;
+-	out->antenna_gain.ghz24.a3 = gain;
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_A,
+-				    SSB_SPROM1_AGAIN_A_SHIFT);
+-	out->antenna_gain.ghz5.a0 = gain;
+-	out->antenna_gain.ghz5.a1 = gain;
+-	out->antenna_gain.ghz5.a2 = gain;
+-	out->antenna_gain.ghz5.a3 = gain;
++	out->antenna_gain.a0 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_BG,
++						    SSB_SPROM1_AGAIN_BG_SHIFT);
++	out->antenna_gain.a1 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_A,
++						    SSB_SPROM1_AGAIN_A_SHIFT);
++}
++
 +/* Revs 4 5 and 8 have partially shared layout */
 +static void sprom_extract_r458(struct ssb_sprom *out, const u16 *in)
 +{
@@ -397,12 +479,10 @@
 +	     SSB_SPROM4_TXPID5GH2, SSB_SPROM4_TXPID5GH2_SHIFT);
 +	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23,
 +	     SSB_SPROM4_TXPID5GH3, SSB_SPROM4_TXPID5GH3_SHIFT);
-+}
-+
+ }
+ 
  static void sprom_extract_r45(struct ssb_sprom *out, const u16 *in)
- {
- 	int i;
-@@ -428,10 +468,14 @@ static void sprom_extract_r45(struct ssb
+@@ -428,10 +459,14 @@ static void sprom_extract_r45(struct ssb
  		SPEX(country_code, SSB_SPROM4_CCODE, 0xFFFF, 0);
  		SPEX(boardflags_lo, SSB_SPROM4_BFLLO, 0xFFFF, 0);
  		SPEX(boardflags_hi, SSB_SPROM4_BFLHI, 0xFFFF, 0);
@@ -417,15 +497,30 @@
  	}
  	SPEX(ant_available_a, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_A,
  	     SSB_SPROM4_ANTAVAIL_A_SHIFT);
-@@ -471,13 +515,21 @@ static void sprom_extract_r45(struct ssb
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
+@@ -460,16 +495,16 @@ static void sprom_extract_r45(struct ssb
+ 	}
  
-+	sprom_extract_r458(out, in);
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN0, SSB_SPROM4_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN1, SSB_SPROM4_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN2, SSB_SPROM4_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN3, SSB_SPROM4_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
 +
++	sprom_extract_r458(out, in);
+ 
  	/* TODO - get remaining rev 4 stuff needed */
  }
- 
+@@ -477,7 +512,13 @@ static void sprom_extract_r45(struct ssb
  static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
  {
  	int i;
@@ -440,10 +535,25 @@
  
  	/* extract the MAC address */
  	for (i = 0; i < 3; i++) {
-@@ -561,6 +613,63 @@ static void sprom_extract_r8(struct ssb_
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
- 
+@@ -550,16 +591,71 @@ static void sprom_extract_r8(struct ssb_
+ 	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
++
 +	/* Extract cores power info info */
 +	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
 +		o = pwr_info_offset[i];
@@ -500,11 +610,10 @@
 +		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
 +
 +	sprom_extract_r458(out, in);
-+
+ 
  	/* TODO - get remaining rev 8 stuff needed */
  }
- 
-@@ -573,37 +682,34 @@ static int sprom_extract(struct ssb_bus
+@@ -573,37 +669,34 @@ static int sprom_extract(struct ssb_bus
  	ssb_dprintk(KERN_DEBUG PFX "SPROM revision %d detected.\n", out->revision);
  	memset(out->et0mac, 0xFF, 6);		/* preset et0 and et1 mac */
  	memset(out->et1mac, 0xFF, 6);
@@ -563,7 +672,7 @@
  	}
  
  	if (out->boardflags_lo == 0xFFFF)
-@@ -617,15 +723,14 @@ static int sprom_extract(struct ssb_bus
+@@ -617,15 +710,14 @@ static int sprom_extract(struct ssb_bus
  static int ssb_pci_sprom_get(struct ssb_bus *bus,
  			     struct ssb_sprom *sprom)
  {
@@ -581,7 +690,7 @@
  		/*
  		 * get SPROM offset: SSB_SPROM_BASE1 except for
  		 * chipcommon rev >= 31 or chip ID is 0x4312 and
-@@ -645,7 +750,7 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -645,7 +737,7 @@ static int ssb_pci_sprom_get(struct ssb_
  
  	buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
  	if (!buf)
@@ -590,7 +699,7 @@
  	bus->sprom_size = SSB_SPROMSIZE_WORDS_R123;
  	sprom_do_read(bus, buf);
  	err = sprom_check_crc(buf, bus->sprom_size);
-@@ -655,17 +760,24 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -655,17 +747,24 @@ static int ssb_pci_sprom_get(struct ssb_
  		buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
  			      GFP_KERNEL);
  		if (!buf)
@@ -620,7 +729,7 @@
  				err = 0;
  				goto out_free;
  			}
-@@ -677,19 +789,15 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -677,19 +776,15 @@ static int ssb_pci_sprom_get(struct ssb_
  
  out_free:
  	kfree(buf);
@@ -725,7 +834,17 @@
  			bus->chip_package = 0;
  		} else {
  			bus->chip_id = 0x4710;
-@@ -406,10 +408,10 @@ int ssb_bus_scan(struct ssb_bus *bus,
+@@ -317,6 +319,9 @@ int ssb_bus_scan(struct ssb_bus *bus,
+ 			bus->chip_package = 0;
+ 		}
+ 	}
++	ssb_printk(KERN_INFO PFX "Found chip with id 0x%04X, rev 0x%02X and "
++		   "package 0x%02X\n", bus->chip_id, bus->chip_rev,
++		   bus->chip_package);
+ 	if (!bus->nr_devices)
+ 		bus->nr_devices = chipid_to_nrcores(bus->chip_id);
+ 	if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
+@@ -406,10 +411,10 @@ int ssb_bus_scan(struct ssb_bus *bus,
  				/* Ignore PCI cores on PCI-E cards.
  				 * Ignore PCI-E cores on PCI cards. */
  				if (dev->id.coreid == SSB_DEV_PCI) {
@@ -738,7 +857,7 @@
  						continue;
  				}
  			}
-@@ -421,6 +423,16 @@ int ssb_bus_scan(struct ssb_bus *bus,
+@@ -421,6 +426,16 @@ int ssb_bus_scan(struct ssb_bus *bus,
  			bus->pcicore.dev = dev;
  #endif /* CONFIG_SSB_DRIVER_PCICORE */
  			break;
@@ -764,36 +883,57 @@
 +struct ssb_sprom_core_pwr_info {
 +	u8 itssi_2g, itssi_5g;
 +	u8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh;
-+	u16 pa_2g[3], pa_5gl[3], pa_5g[3], pa_5gh[3];
++	u16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4];
 +};
 +
  struct ssb_sprom {
  	u8 revision;
  	u8 il0mac[6];		/* MAC address for 802.11b/g */
-@@ -25,8 +31,10 @@ struct ssb_sprom {
+@@ -25,8 +31,13 @@ struct ssb_sprom {
  	u8 et1phyaddr;		/* MII address for enet1 */
  	u8 et0mdcport;		/* MDIO for enet0 */
  	u8 et1mdcport;		/* MDIO for enet1 */
 -	u8 board_rev;		/* Board revision number from SPROM. */
 +	u16 board_rev;		/* Board revision number from SPROM. */
++	u16 board_num;		/* Board number from SPROM. */
++	u16 board_type;		/* Board type from SPROM. */
  	u8 country_code;	/* Country Code */
-+	u16 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
-+	u16 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
++	char alpha2[2];		/* Country Code as two chars like EU or US */
++	u8 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
++	u8 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
  	u8 ant_available_a;	/* 2GHz antenna available bits (up to 4) */
  	u8 ant_available_bg;	/* 5GHz antenna available bits (up to 4) */
  	u16 pa0b0;
-@@ -55,6 +63,10 @@ struct ssb_sprom {
+@@ -45,18 +56,22 @@ struct ssb_sprom {
+ 	u8 gpio1;		/* GPIO pin 1 */
+ 	u8 gpio2;		/* GPIO pin 2 */
+ 	u8 gpio3;		/* GPIO pin 3 */
+-	u16 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
+ 	u8 itssi_a;		/* Idle TSSI Target for A-PHY */
+ 	u8 itssi_bg;		/* Idle TSSI Target for B/G-PHY */
+ 	u8 tri2g;		/* 2.4GHz TX isolation */
  	u8 tri5gl;		/* 5.2GHz TX isolation */
  	u8 tri5g;		/* 5.3GHz TX isolation */
  	u8 tri5gh;		/* 5.8GHz TX isolation */
+-	u8 rxpo2g;		/* 2GHz RX power offset */
+-	u8 rxpo5g;		/* 5GHz RX power offset */
 +	u8 txpid2g[4];		/* 2GHz TX power index */
 +	u8 txpid5gl[4];		/* 4.9 - 5.1GHz TX power index */
 +	u8 txpid5g[4];		/* 5.1 - 5.5GHz TX power index */
 +	u8 txpid5gh[4];		/* 5.5 - ...GHz TX power index */
- 	u8 rxpo2g;		/* 2GHz RX power offset */
- 	u8 rxpo5g;		/* 5GHz RX power offset */
++	s8 rxpo2g;		/* 2GHz RX power offset */
++	s8 rxpo5g;		/* 5GHz RX power offset */
  	u8 rssisav2g;		/* 2GHz RSSI params */
-@@ -76,6 +88,8 @@ struct ssb_sprom {
+ 	u8 rssismc2g;
+ 	u8 rssismf2g;
+@@ -76,26 +91,104 @@ struct ssb_sprom {
  	u16 boardflags2_hi;	/* Board flags (bits 48-63) */
  	/* TODO store board flags in a single u64 */
  
@@ -802,10 +942,17 @@
  	/* Antenna gain values for up to 4 antennas
  	 * on each band. Values in dBm/4 (Q5.2). Negative gain means the
  	 * loss in the connectors is bigger than the gain. */
-@@ -88,6 +102,15 @@ struct ssb_sprom {
- 		} ghz5;		/* 5GHz band */
+ 	struct {
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz24;	/* 2.4GHz band */
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz5;		/* 5GHz band */
++		s8 a0, a1, a2, a3;
  	} antenna_gain;
  
+-	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
 +	struct {
 +		struct {
 +			u8 tssipos, extpa_gain, pdet_range, tr_iso, antswlut;
@@ -815,10 +962,82 @@
 +		} ghz5;
 +	} fem;
 +
- 	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
++	u16 mcs2gpo[8];
++	u16 mcs5gpo[8];
++	u16 mcs5glpo[8];
++	u16 mcs5ghpo[8];
++	u8 opo;
++
++	u8 rxgainerr2ga[3];
++	u8 rxgainerr5gla[3];
++	u8 rxgainerr5gma[3];
++	u8 rxgainerr5gha[3];
++	u8 rxgainerr5gua[3];
++
++	u8 noiselvl2ga[3];
++	u8 noiselvl5gla[3];
++	u8 noiselvl5gma[3];
++	u8 noiselvl5gha[3];
++	u8 noiselvl5gua[3];
++
++	u8 regrev;
++	u8 txchain;
++	u8 rxchain;
++	u8 antswitch;
++	u16 cddpo;
++	u16 stbcpo;
++	u16 bw40po;
++	u16 bwduppo;
++
++	u8 tempthresh;
++	u8 tempoffset;
++	u16 rawtempsense;
++	u8 measpower;
++	u8 tempsense_slope;
++	u8 tempcorrx;
++	u8 tempsense_option;
++	u8 freqoffset_corr;
++	u8 iqcal_swp_dis;
++	u8 hw_iqcal_en;
++	u8 elna2g;
++	u8 elna5g;
++	u8 phycal_tempdelta;
++	u8 temps_period;
++	u8 temps_hysteresis;
++	u8 measpower1;
++	u8 measpower2;
++	u8 pcieingress_war;
++
++	/* power per rate from sromrev 9 */
++	u16 cckbw202gpo;
++	u16 cckbw20ul2gpo;
++	u32 legofdmbw202gpo;
++	u32 legofdmbw20ul2gpo;
++	u32 legofdmbw205glpo;
++	u32 legofdmbw20ul5glpo;
++	u32 legofdmbw205gmpo;
++	u32 legofdmbw20ul5gmpo;
++	u32 legofdmbw205ghpo;
++	u32 legofdmbw20ul5ghpo;
++	u32 mcsbw202gpo;
++	u32 mcsbw20ul2gpo;
++	u32 mcsbw402gpo;
++	u32 mcsbw205glpo;
++	u32 mcsbw20ul5glpo;
++	u32 mcsbw405glpo;
++	u32 mcsbw205gmpo;
++	u32 mcsbw20ul5gmpo;
++	u32 mcsbw405gmpo;
++	u32 mcsbw205ghpo;
++	u32 mcsbw20ul5ghpo;
++	u32 mcsbw405ghpo;
++	u16 mcs32po;
++	u16 legofdm40duppo;
++	u8 sar2g;
++	u8 sar5g;
  };
  
-@@ -95,7 +118,7 @@ struct ssb_sprom {
+ /* Information about the PCB the circuitry is soldered on. */
  struct ssb_boardinfo {
  	u16 vendor;
  	u16 type;
@@ -827,7 +1046,7 @@
  };
  
  
-@@ -225,10 +248,9 @@ struct ssb_driver {
+@@ -225,10 +318,9 @@ struct ssb_driver {
  #define drv_to_ssb_drv(_drv) container_of(_drv, struct ssb_driver, drv)
  
  extern int __ssb_driver_register(struct ssb_driver *drv, struct module *owner);
@@ -841,7 +1060,7 @@
  extern void ssb_driver_unregister(struct ssb_driver *drv);
  
  
-@@ -304,7 +326,7 @@ struct ssb_bus {
+@@ -304,7 +396,7 @@ struct ssb_bus {
  
  	/* ID information about the Chip. */
  	u16 chip_id;
@@ -850,7 +1069,7 @@
  	u16 sprom_offset;
  	u16 sprom_size;		/* number of words in sprom */
  	u8 chip_package;
-@@ -400,7 +422,9 @@ extern bool ssb_is_sprom_available(struc
+@@ -400,7 +492,9 @@ extern bool ssb_is_sprom_available(struc
  
  /* Set a fallback SPROM.
   * See kdoc at the function definition for complete documentation. */
@@ -861,7 +1080,7 @@
  
  /* Suspend a SSB bus.
   * Call this from the parent bus suspend routine. */
-@@ -514,6 +538,7 @@ extern int ssb_bus_may_powerdown(struct
+@@ -514,6 +608,7 @@ extern int ssb_bus_may_powerdown(struct
   * Otherwise static always-on powercontrol will be used. */
  extern int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl);
  
@@ -871,7 +1090,15 @@
  extern u32 ssb_admatch_base(u32 adm);
 --- a/include/linux/ssb/ssb_driver_gige.h
 +++ b/include/linux/ssb/ssb_driver_gige.h
-@@ -96,16 +96,21 @@ static inline bool ssb_gige_must_flush_p
+@@ -2,6 +2,7 @@
+ #define LINUX_SSB_DRIVER_GIGE_H_
+ 
+ #include <linux/ssb/ssb.h>
++#include <linux/bug.h>
+ #include <linux/pci.h>
+ #include <linux/spinlock.h>
+ 
+@@ -96,16 +97,21 @@ static inline bool ssb_gige_must_flush_p
  	return 0;
  }
  
@@ -1215,7 +1442,53 @@
   * Copyright 2007, Broadcom Corporation
   *
   * Licensed under the GNU/GPL. See COPYING for details.
-@@ -417,12 +417,14 @@ static void ssb_pmu_resources_init(struc
+@@ -12,6 +12,9 @@
+ #include <linux/ssb/ssb_regs.h>
+ #include <linux/ssb/ssb_driver_chipcommon.h>
+ #include <linux/delay.h>
++#ifdef CONFIG_BCM47XX
++#include <asm/mach-bcm47xx/nvram.h>
++#endif
+ 
+ #include "ssb_private.h"
+ 
+@@ -91,10 +94,6 @@ static void ssb_pmu0_pllinit_r0(struct s
+ 	u32 pmuctl, tmp, pllctl;
+ 	unsigned int i;
+ 
+-	if ((bus->chip_id == 0x5354) && !crystalfreq) {
+-		/* The 5354 crystal freq is 25MHz */
+-		crystalfreq = 25000;
+-	}
+ 	if (crystalfreq)
+ 		e = pmu0_plltab_find_entry(crystalfreq);
+ 	if (!e)
+@@ -320,7 +319,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 	u32 crystalfreq = 0; /* in kHz. 0 = keep default freq. */
+ 
+ 	if (bus->bustype == SSB_BUSTYPE_SSB) {
+-		/* TODO: The user may override the crystal frequency. */
++#ifdef CONFIG_BCM47XX
++		char buf[20];
++		if (nvram_getenv("xtalfreq", buf, sizeof(buf)) >= 0)
++			crystalfreq = simple_strtoul(buf, NULL, 0);
++#endif
+ 	}
+ 
+ 	switch (bus->chip_id) {
+@@ -329,7 +332,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 		ssb_pmu1_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4328:
++		ssb_pmu0_pllinit_r0(cc, crystalfreq);
++		break;
+ 	case 0x5354:
++		if (crystalfreq == 0)
++			crystalfreq = 25000;
+ 		ssb_pmu0_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4322:
+@@ -417,12 +424,14 @@ static void ssb_pmu_resources_init(struc
  	u32 min_msk = 0, max_msk = 0;
  	unsigned int i;
  	const struct pmu_res_updown_tab_entry *updown_tab = NULL;
@@ -1232,6 +1505,41 @@
  	case 0x4322:
  		/* We keep the default settings:
  		 * min_msk = 0xCBB
+@@ -604,3 +613,34 @@ void ssb_pmu_set_ldo_paref(struct ssb_ch
+ 
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_voltage);
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_paref);
++
++u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		/* 5354 chip uses a non programmable PLL of frequency 240MHz */
++		return 240000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU cpu clock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
++
++u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		return 120000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU controlclock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
 --- a/drivers/ssb/driver_gige.c
 +++ b/drivers/ssb/driver_gige.c
 @@ -3,7 +3,7 @@
@@ -1300,6 +1608,15 @@
  
  static inline
  u32 pcicore_read32(struct ssb_pcicore *pc, u16 offset)
+@@ -69,7 +74,7 @@ static u32 get_cfgspace_addr(struct ssb_
+ 	u32 tmp;
+ 
+ 	/* We do only have one cardbus device behind the bridge. */
+-	if (pc->cardbusmode && (dev >= 1))
++	if (pc->cardbusmode && (dev > 1))
+ 		goto out;
+ 
+ 	if (bus == 0) {
 @@ -309,7 +314,7 @@ int ssb_pcicore_pcibios_map_irq(const st
  	return ssb_mips_irq(extpci_core->dev) + 2;
  }
@@ -1746,6 +2063,15 @@
  
  
  /* core.c */
+@@ -206,4 +207,8 @@ static inline void b43_pci_ssb_bridge_ex
+ }
+ #endif /* CONFIG_SSB_B43_PCI_BRIDGE */
+ 
++/* driver_chipcommon_pmu.c */
++extern u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc);
++extern u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc);
++
+ #endif /* LINUX_SSB_PRIVATE_H_ */
 --- a/include/linux/ssb/ssb_driver_chipcommon.h
 +++ b/include/linux/ssb/ssb_driver_chipcommon.h
 @@ -8,7 +8,7 @@
@@ -1828,6 +2154,16 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
+@@ -208,6 +208,9 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 	u32 pll_type, n, m, rate = 0;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_cpu_clock(&bus->chipco);
++
+ 	if (bus->extif.dev) {
+ 		ssb_extif_get_clockcontrol(&bus->extif, &pll_type, &n, &m);
+ 	} else if (bus->chipco.dev) {
 --- a/drivers/ssb/embedded.c
 +++ b/drivers/ssb/embedded.c
 @@ -3,7 +3,7 @@
@@ -1850,6 +2186,25 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
+@@ -677,14 +677,10 @@ static int ssb_pcmcia_do_get_invariants(
+ 	case SSB_PCMCIA_CIS_ANTGAIN:
+ 		GOTO_ERROR_ON(tuple->TupleDataLen != 2,
+ 			"antg tpl size");
+-		sprom->antenna_gain.ghz24.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a3 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a3 = tuple->TupleData[1];
++		sprom->antenna_gain.a0 = tuple->TupleData[1];
++		sprom->antenna_gain.a1 = tuple->TupleData[1];
++		sprom->antenna_gain.a2 = tuple->TupleData[1];
++		sprom->antenna_gain.a3 = tuple->TupleData[1];
+ 		break;
+ 	case SSB_PCMCIA_CIS_BFLAGS:
+ 		GOTO_ERROR_ON((tuple->TupleDataLen != 3) &&
 --- a/drivers/ssb/sdio.c
 +++ b/drivers/ssb/sdio.c
 @@ -6,7 +6,7 @@
@@ -1861,3 +2216,22 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   *
+@@ -551,14 +551,10 @@ int ssb_sdio_get_invariants(struct ssb_b
+ 			case SSB_SDIO_CIS_ANTGAIN:
+ 				GOTO_ERROR_ON(tuple->size != 2,
+ 					      "antg tpl size");
+-				sprom->antenna_gain.ghz24.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a3 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a3 = tuple->data[1];
++				sprom->antenna_gain.a0 = tuple->data[1];
++				sprom->antenna_gain.a1 = tuple->data[1];
++				sprom->antenna_gain.a2 = tuple->data[1];
++				sprom->antenna_gain.a3 = tuple->data[1];
+ 				break;
+ 			case SSB_SDIO_CIS_BFLAGS:
+ 				GOTO_ERROR_ON((tuple->size != 3) &&
diff --git a/target/linux/generic/patches-2.6.37/020-ssb_update.patch b/target/linux/generic/patches-2.6.37/020-ssb_update.patch
index c894d55dbb..f91861df90 100644
--- a/target/linux/generic/patches-2.6.37/020-ssb_update.patch
+++ b/target/linux/generic/patches-2.6.37/020-ssb_update.patch
@@ -17,7 +17,49 @@
  #include <linux/ssb/ssb.h>
  #include <linux/ssb/ssb_regs.h>
  #include <linux/ssb/ssb_driver_gige.h>
-@@ -383,6 +384,35 @@ static int ssb_device_uevent(struct devi
+@@ -139,19 +140,6 @@ static void ssb_device_put(struct ssb_de
+ 		put_device(dev->dev);
+ }
+ 
+-static inline struct ssb_driver *ssb_driver_get(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		get_driver(&drv->drv);
+-	return drv;
+-}
+-
+-static inline void ssb_driver_put(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		put_driver(&drv->drv);
+-}
+-
+ static int ssb_device_resume(struct device *dev)
+ {
+ 	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
+@@ -249,11 +237,9 @@ int ssb_devices_freeze(struct ssb_bus *b
+ 			ssb_device_put(sdev);
+ 			continue;
+ 		}
+-		sdrv = ssb_driver_get(drv_to_ssb_drv(sdev->dev->driver));
+-		if (!sdrv || SSB_WARN_ON(!sdrv->remove)) {
+-			ssb_device_put(sdev);
++		sdrv = drv_to_ssb_drv(sdev->dev->driver);
++		if (SSB_WARN_ON(!sdrv->remove))
+ 			continue;
+-		}
+ 		sdrv->remove(sdev);
+ 		ctx->device_frozen[i] = 1;
+ 	}
+@@ -292,7 +278,6 @@ int ssb_devices_thaw(struct ssb_freeze_c
+ 				   dev_name(sdev->dev));
+ 			result = err;
+ 		}
+-		ssb_driver_put(sdrv);
+ 		ssb_device_put(sdev);
+ 	}
+ 
+@@ -383,6 +368,35 @@ static int ssb_device_uevent(struct devi
  			     ssb_dev->id.revision);
  }
  
@@ -53,7 +95,7 @@
  static struct bus_type ssb_bustype = {
  	.name		= "ssb",
  	.match		= ssb_bus_match,
-@@ -392,6 +422,7 @@ static struct bus_type ssb_bustype = {
+@@ -392,6 +406,7 @@ static struct bus_type ssb_bustype = {
  	.suspend	= ssb_device_suspend,
  	.resume		= ssb_device_resume,
  	.uevent		= ssb_device_uevent,
@@ -61,7 +103,7 @@
  };
  
  static void ssb_buses_lock(void)
-@@ -527,7 +558,7 @@ error:
+@@ -527,7 +542,7 @@ error:
  }
  
  /* Needs ssb_buses_lock() */
@@ -70,7 +112,7 @@
  {
  	struct ssb_bus *bus, *n;
  	int err = 0;
-@@ -738,9 +769,9 @@ out:
+@@ -738,9 +753,9 @@ out:
  	return err;
  }
  
@@ -83,7 +125,7 @@
  {
  	int err;
  
-@@ -821,8 +852,8 @@ err_disable_xtal:
+@@ -821,8 +836,8 @@ err_disable_xtal:
  }
  
  #ifdef CONFIG_SSB_PCIHOST
@@ -94,7 +136,7 @@
  {
  	int err;
  
-@@ -845,9 +876,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
+@@ -845,9 +860,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
  #endif /* CONFIG_SSB_PCIHOST */
  
  #ifdef CONFIG_SSB_PCMCIAHOST
@@ -107,7 +149,7 @@
  {
  	int err;
  
-@@ -867,8 +898,9 @@ EXPORT_SYMBOL(ssb_bus_pcmciabus_register
+@@ -867,8 +882,9 @@ EXPORT_SYMBOL(ssb_bus_pcmciabus_register
  #endif /* CONFIG_SSB_PCMCIAHOST */
  
  #ifdef CONFIG_SSB_SDIOHOST
@@ -119,7 +161,7 @@
  {
  	int err;
  
-@@ -888,9 +920,9 @@ int ssb_bus_sdiobus_register(struct ssb_
+@@ -888,9 +904,9 @@ int ssb_bus_sdiobus_register(struct ssb_
  EXPORT_SYMBOL(ssb_bus_sdiobus_register);
  #endif /* CONFIG_SSB_PCMCIAHOST */
  
@@ -132,7 +174,7 @@
  {
  	int err;
  
-@@ -971,8 +1003,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
+@@ -971,8 +987,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
  	switch (plltype) {
  	case SSB_PLLTYPE_6: /* 100/200 or 120/240 only */
  		if (m & SSB_CHIPCO_CLK_T6_MMASK)
@@ -143,7 +185,17 @@
  	case SSB_PLLTYPE_1: /* 48Mhz base, 3 dividers */
  	case SSB_PLLTYPE_3: /* 25Mhz, 2 dividers */
  	case SSB_PLLTYPE_4: /* 48Mhz, 4 dividers */
-@@ -1087,23 +1119,22 @@ static u32 ssb_tmslow_reject_bitmask(str
+@@ -1062,6 +1078,9 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
+ 	u32 plltype;
+ 	u32 clkctl_n, clkctl_m;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_controlclock(&bus->chipco);
++
+ 	if (ssb_extif_available(&bus->extif))
+ 		ssb_extif_get_clockcontrol(&bus->extif, &plltype,
+ 					   &clkctl_n, &clkctl_m);
+@@ -1087,23 +1106,22 @@ static u32 ssb_tmslow_reject_bitmask(str
  {
  	u32 rev = ssb_read32(dev, SSB_IDLOW) & SSB_IDLOW_SSBREV;
  
@@ -174,7 +226,7 @@
  }
  
  int ssb_device_is_enabled(struct ssb_device *dev)
-@@ -1162,10 +1193,10 @@ void ssb_device_enable(struct ssb_device
+@@ -1162,10 +1180,10 @@ void ssb_device_enable(struct ssb_device
  }
  EXPORT_SYMBOL(ssb_device_enable);
  
@@ -188,7 +240,7 @@
  {
  	int i;
  	u32 val;
-@@ -1173,7 +1204,7 @@ static int ssb_wait_bit(struct ssb_devic
+@@ -1173,7 +1191,7 @@ static int ssb_wait_bit(struct ssb_devic
  	for (i = 0; i < timeout; i++) {
  		val = ssb_read32(dev, reg);
  		if (set) {
@@ -197,7 +249,7 @@
  				return 0;
  		} else {
  			if (!(val & bitmask))
-@@ -1190,20 +1221,38 @@ static int ssb_wait_bit(struct ssb_devic
+@@ -1190,20 +1208,38 @@ static int ssb_wait_bit(struct ssb_devic
  
  void ssb_device_disable(struct ssb_device *dev, u32 core_specific_flags)
  {
@@ -245,7 +297,7 @@
  
  	ssb_write32(dev, SSB_TMSLOW,
  		    reject | SSB_TMSLOW_RESET |
-@@ -1212,13 +1261,34 @@ void ssb_device_disable(struct ssb_devic
+@@ -1212,13 +1248,34 @@ void ssb_device_disable(struct ssb_devic
  }
  EXPORT_SYMBOL(ssb_device_disable);
  
@@ -281,7 +333,7 @@
  	default:
  		__ssb_dma_not_implemented(dev);
  	}
-@@ -1261,20 +1331,20 @@ EXPORT_SYMBOL(ssb_bus_may_powerdown);
+@@ -1261,20 +1318,20 @@ EXPORT_SYMBOL(ssb_bus_may_powerdown);
  
  int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl)
  {
@@ -306,7 +358,7 @@
  	return 0;
  error:
  	ssb_printk(KERN_ERR PFX "Bus powerup failed\n");
-@@ -1282,6 +1352,37 @@ error:
+@@ -1282,6 +1339,37 @@ error:
  }
  EXPORT_SYMBOL(ssb_bus_powerup);
  
@@ -355,10 +407,40 @@
   * Copyright (C) 2005 Martin Langer <martin-langer@gmx.de>
   * Copyright (C) 2005 Stefano Brivio <st3@riseup.net>
   * Copyright (C) 2005 Danny van Dyk <kugelfang@gentoo.org>
-@@ -406,6 +406,46 @@ static void sprom_extract_r123(struct ss
- 	out->antenna_gain.ghz5.a3 = gain;
- }
- 
+@@ -331,7 +331,6 @@ static void sprom_extract_r123(struct ss
+ {
+ 	int i;
+ 	u16 v;
+-	s8 gain;
+ 	u16 loc[3];
+ 
+ 	if (out->revision == 3)			/* rev 3 moved MAC */
+@@ -390,20 +389,52 @@ static void sprom_extract_r123(struct ss
+ 		SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_BG,
+-				    SSB_SPROM1_AGAIN_BG_SHIFT);
+-	out->antenna_gain.ghz24.a0 = gain;
+-	out->antenna_gain.ghz24.a1 = gain;
+-	out->antenna_gain.ghz24.a2 = gain;
+-	out->antenna_gain.ghz24.a3 = gain;
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_A,
+-				    SSB_SPROM1_AGAIN_A_SHIFT);
+-	out->antenna_gain.ghz5.a0 = gain;
+-	out->antenna_gain.ghz5.a1 = gain;
+-	out->antenna_gain.ghz5.a2 = gain;
+-	out->antenna_gain.ghz5.a3 = gain;
++	out->antenna_gain.a0 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_BG,
++						    SSB_SPROM1_AGAIN_BG_SHIFT);
++	out->antenna_gain.a1 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_A,
++						    SSB_SPROM1_AGAIN_A_SHIFT);
++}
++
 +/* Revs 4 5 and 8 have partially shared layout */
 +static void sprom_extract_r458(struct ssb_sprom *out, const u16 *in)
 +{
@@ -397,12 +479,10 @@
 +	     SSB_SPROM4_TXPID5GH2, SSB_SPROM4_TXPID5GH2_SHIFT);
 +	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23,
 +	     SSB_SPROM4_TXPID5GH3, SSB_SPROM4_TXPID5GH3_SHIFT);
-+}
-+
+ }
+ 
  static void sprom_extract_r45(struct ssb_sprom *out, const u16 *in)
- {
- 	int i;
-@@ -428,10 +468,14 @@ static void sprom_extract_r45(struct ssb
+@@ -428,10 +459,14 @@ static void sprom_extract_r45(struct ssb
  		SPEX(country_code, SSB_SPROM4_CCODE, 0xFFFF, 0);
  		SPEX(boardflags_lo, SSB_SPROM4_BFLLO, 0xFFFF, 0);
  		SPEX(boardflags_hi, SSB_SPROM4_BFLHI, 0xFFFF, 0);
@@ -417,15 +497,30 @@
  	}
  	SPEX(ant_available_a, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_A,
  	     SSB_SPROM4_ANTAVAIL_A_SHIFT);
-@@ -471,13 +515,21 @@ static void sprom_extract_r45(struct ssb
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
+@@ -460,16 +495,16 @@ static void sprom_extract_r45(struct ssb
+ 	}
  
-+	sprom_extract_r458(out, in);
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN0, SSB_SPROM4_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN1, SSB_SPROM4_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN2, SSB_SPROM4_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN3, SSB_SPROM4_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
 +
++	sprom_extract_r458(out, in);
+ 
  	/* TODO - get remaining rev 4 stuff needed */
  }
- 
+@@ -477,7 +512,13 @@ static void sprom_extract_r45(struct ssb
  static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
  {
  	int i;
@@ -440,10 +535,25 @@
  
  	/* extract the MAC address */
  	for (i = 0; i < 3; i++) {
-@@ -561,6 +613,63 @@ static void sprom_extract_r8(struct ssb_
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
- 
+@@ -550,16 +591,71 @@ static void sprom_extract_r8(struct ssb_
+ 	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
++
 +	/* Extract cores power info info */
 +	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
 +		o = pwr_info_offset[i];
@@ -500,11 +610,10 @@
 +		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
 +
 +	sprom_extract_r458(out, in);
-+
+ 
  	/* TODO - get remaining rev 8 stuff needed */
  }
- 
-@@ -573,37 +682,34 @@ static int sprom_extract(struct ssb_bus
+@@ -573,37 +669,34 @@ static int sprom_extract(struct ssb_bus
  	ssb_dprintk(KERN_DEBUG PFX "SPROM revision %d detected.\n", out->revision);
  	memset(out->et0mac, 0xFF, 6);		/* preset et0 and et1 mac */
  	memset(out->et1mac, 0xFF, 6);
@@ -563,7 +672,7 @@
  	}
  
  	if (out->boardflags_lo == 0xFFFF)
-@@ -617,15 +723,14 @@ static int sprom_extract(struct ssb_bus
+@@ -617,15 +710,14 @@ static int sprom_extract(struct ssb_bus
  static int ssb_pci_sprom_get(struct ssb_bus *bus,
  			     struct ssb_sprom *sprom)
  {
@@ -581,7 +690,7 @@
  		/*
  		 * get SPROM offset: SSB_SPROM_BASE1 except for
  		 * chipcommon rev >= 31 or chip ID is 0x4312 and
-@@ -645,7 +750,7 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -645,7 +737,7 @@ static int ssb_pci_sprom_get(struct ssb_
  
  	buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
  	if (!buf)
@@ -590,7 +699,7 @@
  	bus->sprom_size = SSB_SPROMSIZE_WORDS_R123;
  	sprom_do_read(bus, buf);
  	err = sprom_check_crc(buf, bus->sprom_size);
-@@ -655,17 +760,24 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -655,17 +747,24 @@ static int ssb_pci_sprom_get(struct ssb_
  		buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
  			      GFP_KERNEL);
  		if (!buf)
@@ -620,7 +729,7 @@
  				err = 0;
  				goto out_free;
  			}
-@@ -677,19 +789,15 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -677,19 +776,15 @@ static int ssb_pci_sprom_get(struct ssb_
  
  out_free:
  	kfree(buf);
@@ -725,7 +834,17 @@
  			bus->chip_package = 0;
  		} else {
  			bus->chip_id = 0x4710;
-@@ -405,10 +407,10 @@ int ssb_bus_scan(struct ssb_bus *bus,
+@@ -316,6 +318,9 @@ int ssb_bus_scan(struct ssb_bus *bus,
+ 			bus->chip_package = 0;
+ 		}
+ 	}
++	ssb_printk(KERN_INFO PFX "Found chip with id 0x%04X, rev 0x%02X and "
++		   "package 0x%02X\n", bus->chip_id, bus->chip_rev,
++		   bus->chip_package);
+ 	if (!bus->nr_devices)
+ 		bus->nr_devices = chipid_to_nrcores(bus->chip_id);
+ 	if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
+@@ -405,10 +410,10 @@ int ssb_bus_scan(struct ssb_bus *bus,
  				/* Ignore PCI cores on PCI-E cards.
  				 * Ignore PCI-E cores on PCI cards. */
  				if (dev->id.coreid == SSB_DEV_PCI) {
@@ -738,7 +857,7 @@
  						continue;
  				}
  			}
-@@ -420,6 +422,16 @@ int ssb_bus_scan(struct ssb_bus *bus,
+@@ -420,6 +425,16 @@ int ssb_bus_scan(struct ssb_bus *bus,
  			bus->pcicore.dev = dev;
  #endif /* CONFIG_SSB_DRIVER_PCICORE */
  			break;
@@ -764,36 +883,57 @@
 +struct ssb_sprom_core_pwr_info {
 +	u8 itssi_2g, itssi_5g;
 +	u8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh;
-+	u16 pa_2g[3], pa_5gl[3], pa_5g[3], pa_5gh[3];
++	u16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4];
 +};
 +
  struct ssb_sprom {
  	u8 revision;
  	u8 il0mac[6];		/* MAC address for 802.11b/g */
-@@ -25,8 +31,10 @@ struct ssb_sprom {
+@@ -25,8 +31,13 @@ struct ssb_sprom {
  	u8 et1phyaddr;		/* MII address for enet1 */
  	u8 et0mdcport;		/* MDIO for enet0 */
  	u8 et1mdcport;		/* MDIO for enet1 */
 -	u8 board_rev;		/* Board revision number from SPROM. */
 +	u16 board_rev;		/* Board revision number from SPROM. */
++	u16 board_num;		/* Board number from SPROM. */
++	u16 board_type;		/* Board type from SPROM. */
  	u8 country_code;	/* Country Code */
-+	u16 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
-+	u16 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
++	char alpha2[2];		/* Country Code as two chars like EU or US */
++	u8 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
++	u8 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
  	u8 ant_available_a;	/* 2GHz antenna available bits (up to 4) */
  	u8 ant_available_bg;	/* 5GHz antenna available bits (up to 4) */
  	u16 pa0b0;
-@@ -55,6 +63,10 @@ struct ssb_sprom {
+@@ -45,18 +56,22 @@ struct ssb_sprom {
+ 	u8 gpio1;		/* GPIO pin 1 */
+ 	u8 gpio2;		/* GPIO pin 2 */
+ 	u8 gpio3;		/* GPIO pin 3 */
+-	u16 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
+ 	u8 itssi_a;		/* Idle TSSI Target for A-PHY */
+ 	u8 itssi_bg;		/* Idle TSSI Target for B/G-PHY */
+ 	u8 tri2g;		/* 2.4GHz TX isolation */
  	u8 tri5gl;		/* 5.2GHz TX isolation */
  	u8 tri5g;		/* 5.3GHz TX isolation */
  	u8 tri5gh;		/* 5.8GHz TX isolation */
+-	u8 rxpo2g;		/* 2GHz RX power offset */
+-	u8 rxpo5g;		/* 5GHz RX power offset */
 +	u8 txpid2g[4];		/* 2GHz TX power index */
 +	u8 txpid5gl[4];		/* 4.9 - 5.1GHz TX power index */
 +	u8 txpid5g[4];		/* 5.1 - 5.5GHz TX power index */
 +	u8 txpid5gh[4];		/* 5.5 - ...GHz TX power index */
- 	u8 rxpo2g;		/* 2GHz RX power offset */
- 	u8 rxpo5g;		/* 5GHz RX power offset */
++	s8 rxpo2g;		/* 2GHz RX power offset */
++	s8 rxpo5g;		/* 5GHz RX power offset */
  	u8 rssisav2g;		/* 2GHz RSSI params */
-@@ -76,6 +88,8 @@ struct ssb_sprom {
+ 	u8 rssismc2g;
+ 	u8 rssismf2g;
+@@ -76,26 +91,104 @@ struct ssb_sprom {
  	u16 boardflags2_hi;	/* Board flags (bits 48-63) */
  	/* TODO store board flags in a single u64 */
  
@@ -802,10 +942,17 @@
  	/* Antenna gain values for up to 4 antennas
  	 * on each band. Values in dBm/4 (Q5.2). Negative gain means the
  	 * loss in the connectors is bigger than the gain. */
-@@ -88,6 +102,15 @@ struct ssb_sprom {
- 		} ghz5;		/* 5GHz band */
+ 	struct {
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz24;	/* 2.4GHz band */
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz5;		/* 5GHz band */
++		s8 a0, a1, a2, a3;
  	} antenna_gain;
  
+-	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
 +	struct {
 +		struct {
 +			u8 tssipos, extpa_gain, pdet_range, tr_iso, antswlut;
@@ -815,10 +962,82 @@
 +		} ghz5;
 +	} fem;
 +
- 	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
++	u16 mcs2gpo[8];
++	u16 mcs5gpo[8];
++	u16 mcs5glpo[8];
++	u16 mcs5ghpo[8];
++	u8 opo;
++
++	u8 rxgainerr2ga[3];
++	u8 rxgainerr5gla[3];
++	u8 rxgainerr5gma[3];
++	u8 rxgainerr5gha[3];
++	u8 rxgainerr5gua[3];
++
++	u8 noiselvl2ga[3];
++	u8 noiselvl5gla[3];
++	u8 noiselvl5gma[3];
++	u8 noiselvl5gha[3];
++	u8 noiselvl5gua[3];
++
++	u8 regrev;
++	u8 txchain;
++	u8 rxchain;
++	u8 antswitch;
++	u16 cddpo;
++	u16 stbcpo;
++	u16 bw40po;
++	u16 bwduppo;
++
++	u8 tempthresh;
++	u8 tempoffset;
++	u16 rawtempsense;
++	u8 measpower;
++	u8 tempsense_slope;
++	u8 tempcorrx;
++	u8 tempsense_option;
++	u8 freqoffset_corr;
++	u8 iqcal_swp_dis;
++	u8 hw_iqcal_en;
++	u8 elna2g;
++	u8 elna5g;
++	u8 phycal_tempdelta;
++	u8 temps_period;
++	u8 temps_hysteresis;
++	u8 measpower1;
++	u8 measpower2;
++	u8 pcieingress_war;
++
++	/* power per rate from sromrev 9 */
++	u16 cckbw202gpo;
++	u16 cckbw20ul2gpo;
++	u32 legofdmbw202gpo;
++	u32 legofdmbw20ul2gpo;
++	u32 legofdmbw205glpo;
++	u32 legofdmbw20ul5glpo;
++	u32 legofdmbw205gmpo;
++	u32 legofdmbw20ul5gmpo;
++	u32 legofdmbw205ghpo;
++	u32 legofdmbw20ul5ghpo;
++	u32 mcsbw202gpo;
++	u32 mcsbw20ul2gpo;
++	u32 mcsbw402gpo;
++	u32 mcsbw205glpo;
++	u32 mcsbw20ul5glpo;
++	u32 mcsbw405glpo;
++	u32 mcsbw205gmpo;
++	u32 mcsbw20ul5gmpo;
++	u32 mcsbw405gmpo;
++	u32 mcsbw205ghpo;
++	u32 mcsbw20ul5ghpo;
++	u32 mcsbw405ghpo;
++	u16 mcs32po;
++	u16 legofdm40duppo;
++	u8 sar2g;
++	u8 sar5g;
  };
  
-@@ -95,7 +118,7 @@ struct ssb_sprom {
+ /* Information about the PCB the circuitry is soldered on. */
  struct ssb_boardinfo {
  	u16 vendor;
  	u16 type;
@@ -827,7 +1046,7 @@
  };
  
  
-@@ -225,10 +248,9 @@ struct ssb_driver {
+@@ -225,10 +318,9 @@ struct ssb_driver {
  #define drv_to_ssb_drv(_drv) container_of(_drv, struct ssb_driver, drv)
  
  extern int __ssb_driver_register(struct ssb_driver *drv, struct module *owner);
@@ -841,7 +1060,7 @@
  extern void ssb_driver_unregister(struct ssb_driver *drv);
  
  
-@@ -304,7 +326,7 @@ struct ssb_bus {
+@@ -304,7 +396,7 @@ struct ssb_bus {
  
  	/* ID information about the Chip. */
  	u16 chip_id;
@@ -850,7 +1069,7 @@
  	u16 sprom_offset;
  	u16 sprom_size;		/* number of words in sprom */
  	u8 chip_package;
-@@ -400,7 +422,9 @@ extern bool ssb_is_sprom_available(struc
+@@ -400,7 +492,9 @@ extern bool ssb_is_sprom_available(struc
  
  /* Set a fallback SPROM.
   * See kdoc at the function definition for complete documentation. */
@@ -861,7 +1080,7 @@
  
  /* Suspend a SSB bus.
   * Call this from the parent bus suspend routine. */
-@@ -514,6 +538,7 @@ extern int ssb_bus_may_powerdown(struct
+@@ -514,6 +608,7 @@ extern int ssb_bus_may_powerdown(struct
   * Otherwise static always-on powercontrol will be used. */
  extern int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl);
  
@@ -1187,7 +1406,53 @@
   * Copyright 2007, Broadcom Corporation
   *
   * Licensed under the GNU/GPL. See COPYING for details.
-@@ -417,12 +417,14 @@ static void ssb_pmu_resources_init(struc
+@@ -12,6 +12,9 @@
+ #include <linux/ssb/ssb_regs.h>
+ #include <linux/ssb/ssb_driver_chipcommon.h>
+ #include <linux/delay.h>
++#ifdef CONFIG_BCM47XX
++#include <asm/mach-bcm47xx/nvram.h>
++#endif
+ 
+ #include "ssb_private.h"
+ 
+@@ -91,10 +94,6 @@ static void ssb_pmu0_pllinit_r0(struct s
+ 	u32 pmuctl, tmp, pllctl;
+ 	unsigned int i;
+ 
+-	if ((bus->chip_id == 0x5354) && !crystalfreq) {
+-		/* The 5354 crystal freq is 25MHz */
+-		crystalfreq = 25000;
+-	}
+ 	if (crystalfreq)
+ 		e = pmu0_plltab_find_entry(crystalfreq);
+ 	if (!e)
+@@ -320,7 +319,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 	u32 crystalfreq = 0; /* in kHz. 0 = keep default freq. */
+ 
+ 	if (bus->bustype == SSB_BUSTYPE_SSB) {
+-		/* TODO: The user may override the crystal frequency. */
++#ifdef CONFIG_BCM47XX
++		char buf[20];
++		if (nvram_getenv("xtalfreq", buf, sizeof(buf)) >= 0)
++			crystalfreq = simple_strtoul(buf, NULL, 0);
++#endif
+ 	}
+ 
+ 	switch (bus->chip_id) {
+@@ -329,7 +332,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 		ssb_pmu1_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4328:
++		ssb_pmu0_pllinit_r0(cc, crystalfreq);
++		break;
+ 	case 0x5354:
++		if (crystalfreq == 0)
++			crystalfreq = 25000;
+ 		ssb_pmu0_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4322:
+@@ -417,12 +424,14 @@ static void ssb_pmu_resources_init(struc
  	u32 min_msk = 0, max_msk = 0;
  	unsigned int i;
  	const struct pmu_res_updown_tab_entry *updown_tab = NULL;
@@ -1204,6 +1469,41 @@
  	case 0x4322:
  		/* We keep the default settings:
  		 * min_msk = 0xCBB
+@@ -604,3 +613,34 @@ void ssb_pmu_set_ldo_paref(struct ssb_ch
+ 
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_voltage);
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_paref);
++
++u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		/* 5354 chip uses a non programmable PLL of frequency 240MHz */
++		return 240000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU cpu clock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
++
++u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		return 120000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU controlclock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
 --- a/drivers/ssb/driver_gige.c
 +++ b/drivers/ssb/driver_gige.c
 @@ -3,7 +3,7 @@
@@ -1272,6 +1572,15 @@
  
  static inline
  u32 pcicore_read32(struct ssb_pcicore *pc, u16 offset)
+@@ -69,7 +74,7 @@ static u32 get_cfgspace_addr(struct ssb_
+ 	u32 tmp;
+ 
+ 	/* We do only have one cardbus device behind the bridge. */
+-	if (pc->cardbusmode && (dev >= 1))
++	if (pc->cardbusmode && (dev > 1))
+ 		goto out;
+ 
+ 	if (bus == 0) {
 @@ -309,7 +314,7 @@ int ssb_pcicore_pcibios_map_irq(const st
  	return ssb_mips_irq(extpci_core->dev) + 2;
  }
@@ -1718,6 +2027,15 @@
  
  
  /* core.c */
+@@ -206,4 +207,8 @@ static inline void b43_pci_ssb_bridge_ex
+ }
+ #endif /* CONFIG_SSB_B43_PCI_BRIDGE */
+ 
++/* driver_chipcommon_pmu.c */
++extern u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc);
++extern u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc);
++
+ #endif /* LINUX_SSB_PRIVATE_H_ */
 --- a/include/linux/ssb/ssb_driver_chipcommon.h
 +++ b/include/linux/ssb/ssb_driver_chipcommon.h
 @@ -8,7 +8,7 @@
@@ -1800,6 +2118,16 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
+@@ -208,6 +208,9 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 	u32 pll_type, n, m, rate = 0;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_cpu_clock(&bus->chipco);
++
+ 	if (bus->extif.dev) {
+ 		ssb_extif_get_clockcontrol(&bus->extif, &pll_type, &n, &m);
+ 	} else if (bus->chipco.dev) {
 --- a/drivers/ssb/embedded.c
 +++ b/drivers/ssb/embedded.c
 @@ -3,7 +3,7 @@
@@ -1822,6 +2150,25 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
+@@ -676,14 +676,10 @@ static int ssb_pcmcia_do_get_invariants(
+ 	case SSB_PCMCIA_CIS_ANTGAIN:
+ 		GOTO_ERROR_ON(tuple->TupleDataLen != 2,
+ 			"antg tpl size");
+-		sprom->antenna_gain.ghz24.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a3 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a3 = tuple->TupleData[1];
++		sprom->antenna_gain.a0 = tuple->TupleData[1];
++		sprom->antenna_gain.a1 = tuple->TupleData[1];
++		sprom->antenna_gain.a2 = tuple->TupleData[1];
++		sprom->antenna_gain.a3 = tuple->TupleData[1];
+ 		break;
+ 	case SSB_PCMCIA_CIS_BFLAGS:
+ 		GOTO_ERROR_ON((tuple->TupleDataLen != 3) &&
 --- a/drivers/ssb/sdio.c
 +++ b/drivers/ssb/sdio.c
 @@ -6,7 +6,7 @@
@@ -1833,3 +2180,32 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   *
+@@ -551,14 +551,10 @@ int ssb_sdio_get_invariants(struct ssb_b
+ 			case SSB_SDIO_CIS_ANTGAIN:
+ 				GOTO_ERROR_ON(tuple->size != 2,
+ 					      "antg tpl size");
+-				sprom->antenna_gain.ghz24.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a3 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a3 = tuple->data[1];
++				sprom->antenna_gain.a0 = tuple->data[1];
++				sprom->antenna_gain.a1 = tuple->data[1];
++				sprom->antenna_gain.a2 = tuple->data[1];
++				sprom->antenna_gain.a3 = tuple->data[1];
+ 				break;
+ 			case SSB_SDIO_CIS_BFLAGS:
+ 				GOTO_ERROR_ON((tuple->size != 3) &&
+--- a/include/linux/ssb/ssb_driver_gige.h
++++ b/include/linux/ssb/ssb_driver_gige.h
+@@ -2,6 +2,7 @@
+ #define LINUX_SSB_DRIVER_GIGE_H_
+ 
+ #include <linux/ssb/ssb.h>
++#include <linux/bug.h>
+ #include <linux/pci.h>
+ #include <linux/spinlock.h>
+ 
diff --git a/target/linux/generic/patches-2.6.37/025-bcma_backport.patch b/target/linux/generic/patches-2.6.37/025-bcma_backport.patch
index c3312a2004..bd316548c2 100644
--- a/target/linux/generic/patches-2.6.37/025-bcma_backport.patch
+++ b/target/linux/generic/patches-2.6.37/025-bcma_backport.patch
@@ -103,7 +103,7 @@
 +
 +config BCMA_DRIVER_PCI_HOSTMODE
 +	bool "Driver for PCI core working in hostmode"
-+	depends on BCMA && MIPS
++	depends on BCMA && MIPS && BCMA_HOST_PCI
 +	help
 +	  PCI core hostmode operation (external PCI bus).
 +
@@ -172,7 +172,7 @@
 +- Create kernel Documentation (use info from README)
 --- /dev/null
 +++ b/drivers/bcma/bcma_private.h
-@@ -0,0 +1,54 @@
+@@ -0,0 +1,59 @@
 +#ifndef LINUX_BCMA_PRIVATE_H_
 +#define LINUX_BCMA_PRIVATE_H_
 +
@@ -188,12 +188,13 @@
 +struct bcma_bus;
 +
 +/* main.c */
-+int bcma_bus_register(struct bcma_bus *bus);
++int __devinit bcma_bus_register(struct bcma_bus *bus);
 +void bcma_bus_unregister(struct bcma_bus *bus);
 +int __init bcma_bus_early_register(struct bcma_bus *bus,
 +				   struct bcma_device *core_cc,
 +				   struct bcma_device *core_mips);
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus);
 +int bcma_bus_resume(struct bcma_bus *bus);
 +#endif
 +
@@ -222,8 +223,12 @@
 +extern void __exit bcma_host_pci_exit(void);
 +#endif /* CONFIG_BCMA_HOST_PCI */
 +
++/* driver_pci.c */
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address);
++
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc);
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
 +
 +#endif
@@ -517,7 +522,7 @@
 +#endif /* CONFIG_BCMA_DRIVER_MIPS */
 --- /dev/null
 +++ b/drivers/bcma/driver_chipcommon_pmu.c
-@@ -0,0 +1,309 @@
+@@ -0,0 +1,310 @@
 +/*
 + * Broadcom specific AMBA
 + * ChipCommon Power Management Unit driver
@@ -599,6 +604,7 @@
 +		min_msk = 0x200D;
 +		max_msk = 0xFFFF;
 +		break;
++	case 0x4331:
 +	case 43224:
 +	case 43225:
 +		break;
@@ -829,13 +835,14 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/driver_pci.c
-@@ -0,0 +1,237 @@
+@@ -0,0 +1,225 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Core
 + *
-+ * Copyright 2005, Broadcom Corporation
++ * Copyright 2005, 2011, Broadcom Corporation
 + * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
 + *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
@@ -847,40 +854,41 @@
 + * R/W ops.
 + **************************************************/
 +
-+static u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
 +{
-+	pcicore_write32(pc, 0x130, address);
-+	pcicore_read32(pc, 0x130);
-+	return pcicore_read32(pc, 0x134);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_DATA);
 +}
 +
 +#if 0
 +static void bcma_pcie_write(struct bcma_drv_pci *pc, u32 address, u32 data)
 +{
-+	pcicore_write32(pc, 0x130, address);
-+	pcicore_read32(pc, 0x130);
-+	pcicore_write32(pc, 0x134, data);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_DATA, data);
 +}
 +#endif
 +
 +static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u8 phy)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	u32 v;
 +	int i;
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 28); /* Write Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	v |= (0x1F << 18);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++	v |= (BCMA_CORE_PCI_MDIODATA_BLK_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
 +	v |= (phy << 4);
-+	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +
 +	udelay(10);
 +	for (i = 0; i < 200; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
 +			break;
 +		msleep(1);
 +	}
@@ -888,79 +896,84 @@
 +
 +static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u8 device, u8 address)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	int max_retries = 10;
 +	u16 ret = 0;
 +	u32 v;
 +	int i;
 +
-+	v = 0x80; /* Enable Preamble Sequence */
-+	v |= 0x2; /* MDIO Clock Divisor */
-+	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
 +
 +	if (pc->core->id.rev >= 10) {
 +		max_retries = 200;
 +		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 +	}
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 29); /* Read Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	if (pc->core->id.rev < 10)
-+		v |= (u32)device << 22;
-+	v |= (u32)address << 18;
-+	pcicore_write32(pc, mdio_data, v);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_READ;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
++
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +	/* Wait for the device to complete the transaction */
 +	udelay(10);
 +	for (i = 0; i < max_retries; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */) {
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE) {
 +			udelay(10);
-+			ret = pcicore_read32(pc, mdio_data);
++			ret = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_DATA);
 +			break;
 +		}
 +		msleep(1);
 +	}
-+	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
 +	return ret;
 +}
 +
 +static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u8 device,
 +				u8 address, u16 data)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	int max_retries = 10;
 +	u32 v;
 +	int i;
 +
-+	v = 0x80; /* Enable Preamble Sequence */
-+	v |= 0x2; /* MDIO Clock Divisor */
-+	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
 +
 +	if (pc->core->id.rev >= 10) {
 +		max_retries = 200;
 +		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 +	}
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 28); /* Write Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	if (pc->core->id.rev < 10)
-+		v |= (u32)device << 22;
-+	v |= (u32)address << 18;
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
 +	v |= data;
-+	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +	/* Wait for the device to complete the transaction */
 +	udelay(10);
 +	for (i = 0; i < max_retries; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
 +			break;
 +		msleep(1);
 +	}
-+	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
 +}
 +
 +/**************************************************
@@ -969,72 +982,53 @@
 +
 +static u8 bcma_pcicore_polarity_workaround(struct bcma_drv_pci *pc)
 +{
-+	return (bcma_pcie_read(pc, 0x204) & 0x10) ? 0xC0 : 0x80;
++	u32 tmp;
++
++	tmp = bcma_pcie_read(pc, BCMA_CORE_PCI_PLP_STATUSREG);
++	if (tmp & BCMA_CORE_PCI_PLP_POLARITYINV_STAT)
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE |
++		       BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY;
++	else
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE;
 +}
 +
 +static void bcma_pcicore_serdes_workaround(struct bcma_drv_pci *pc)
 +{
-+	const u8 serdes_pll_device = 0x1D;
-+	const u8 serdes_rx_device = 0x1F;
 +	u16 tmp;
 +
-+	bcma_pcie_mdio_write(pc, serdes_rx_device, 1 /* Control */,
-+			      bcma_pcicore_polarity_workaround(pc));
-+	tmp = bcma_pcie_mdio_read(pc, serdes_pll_device, 1 /* Control */);
-+	if (tmp & 0x4000)
-+		bcma_pcie_mdio_write(pc, serdes_pll_device, 1, tmp & ~0x4000);
++	bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_RX,
++	                     BCMA_CORE_PCI_SERDES_RX_CTRL,
++			     bcma_pcicore_polarity_workaround(pc));
++	tmp = bcma_pcie_mdio_read(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++	                          BCMA_CORE_PCI_SERDES_PLL_CTRL);
++	if (tmp & BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN)
++		bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++		                     BCMA_CORE_PCI_SERDES_PLL_CTRL,
++		                     tmp & ~BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN);
 +}
 +
 +/**************************************************
 + * Init.
 + **************************************************/
 +
-+static void bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
++static void __devinit bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
 +{
 +	bcma_pcicore_serdes_workaround(pc);
 +}
 +
-+static bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
-+{
-+	struct bcma_bus *bus = pc->core->bus;
-+	u16 chipid_top;
-+
-+	chipid_top = (bus->chipinfo.id & 0xFF00);
-+	if (chipid_top != 0x4700 &&
-+	    chipid_top != 0x5300)
-+		return false;
-+
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
-+	if (bus->sprom.boardflags_lo & SSB_BFL_NOPCI)
-+		return false;
-+#endif /* CONFIG_SSB_DRIVER_PCICORE */
-+
-+#if 0
-+	/* TODO: on BCMA we use address from EROM instead of magic formula */
-+	u32 tmp;
-+	return !mips_busprobe32(tmp, (bus->mmio +
-+		(pc->core->core_index * BCMA_CORE_SIZE)));
-+#endif
-+
-+	return true;
-+}
-+
-+void bcma_core_pci_init(struct bcma_drv_pci *pc)
++void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
 +{
 +	if (pc->setup_done)
 +		return;
 +
-+	if (bcma_core_pci_is_in_hostmode(pc)) {
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	pc->hostmode = bcma_core_pci_is_in_hostmode(pc);
++	if (pc->hostmode)
 +		bcma_core_pci_hostmode_init(pc);
-+#else
-+		pr_err("Driver compiled without support for hostmode PCI\n");
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
-+	} else {
-+		bcma_core_pci_clientmode_init(pc);
-+	}
 +
-+	pc->setup_done = true;
++	if (!pc->hostmode)
++		bcma_core_pci_clientmode_init(pc);
 +}
 +
 +int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
@@ -1069,7 +1063,7 @@
 +EXPORT_SYMBOL_GPL(bcma_core_pci_irq_ctl);
 --- /dev/null
 +++ b/drivers/bcma/host_pci.c
-@@ -0,0 +1,299 @@
+@@ -0,0 +1,292 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Host
@@ -1226,8 +1220,8 @@
 +	.awrite32	= bcma_host_pci_awrite32,
 +};
 +
-+static int bcma_host_pci_probe(struct pci_dev *dev,
-+			     const struct pci_device_id *id)
++static int __devinit bcma_host_pci_probe(struct pci_dev *dev,
++					 const struct pci_device_id *id)
 +{
 +	struct bcma_bus *bus;
 +	int err = -ENOMEM;
@@ -1307,38 +1301,32 @@
 +}
 +
 +#ifdef CONFIG_PM
-+static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
++static int bcma_host_pci_suspend(struct device *dev)
 +{
-+	/* Host specific */
-+	pci_save_state(dev);
-+	pci_disable_device(dev);
-+	pci_set_power_state(dev, pci_choose_state(dev, state));
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	return 0;
++	bus->mapped_core = NULL;
++
++	return bcma_bus_suspend(bus);
 +}
 +
-+static int bcma_host_pci_resume(struct pci_dev *dev)
++static int bcma_host_pci_resume(struct device *dev)
 +{
-+	struct bcma_bus *bus = pci_get_drvdata(dev);
-+	int err;
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	/* Host specific */
-+	pci_set_power_state(dev, 0);
-+	err = pci_enable_device(dev);
-+	if (err)
-+		return err;
-+	pci_restore_state(dev);
++	return bcma_bus_resume(bus);
++}
 +
-+	/* Bus specific */
-+	err = bcma_bus_resume(bus);
-+	if (err)
-+		return err;
++static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
++			 bcma_host_pci_resume);
++#define BCMA_PM_OPS	(&bcma_pm_ops)
 +
-+	return 0;
-+}
 +#else /* CONFIG_PM */
-+# define bcma_host_pci_suspend	NULL
-+# define bcma_host_pci_resume	NULL
++
++#define BCMA_PM_OPS     NULL
++
 +#endif /* CONFIG_PM */
 +
 +static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
@@ -1356,8 +1344,7 @@
 +	.id_table = bcma_pci_bridge_tbl,
 +	.probe = bcma_host_pci_probe,
 +	.remove = bcma_host_pci_remove,
-+	.suspend = bcma_host_pci_suspend,
-+	.resume = bcma_host_pci_resume,
++	.driver.pm = BCMA_PM_OPS,
 +};
 +
 +int __init bcma_host_pci_init(void)
@@ -1371,7 +1358,7 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/main.c
-@@ -0,0 +1,354 @@
+@@ -0,0 +1,387 @@
 +/*
 + * Broadcom specific AMBA
 + * Bus subsystem
@@ -1387,6 +1374,12 @@
 +MODULE_DESCRIPTION("Broadcom's specific AMBA driver");
 +MODULE_LICENSE("GPL");
 +
++/* contains the number the next bus should get. */
++static unsigned int bcma_bus_next_num = 0;
++
++/* bcma_buses_mutex locks the bcma_bus_next_num */
++static DEFINE_MUTEX(bcma_buses_mutex);
++
 +static int bcma_bus_match(struct device *dev, struct device_driver *drv);
 +static int bcma_device_probe(struct device *dev);
 +static int bcma_device_remove(struct device *dev);
@@ -1429,7 +1422,7 @@
 +	.dev_attrs	= bcma_device_attrs,
 +};
 +
-+static struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
++struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
 +{
 +	struct bcma_device *core;
 +
@@ -1439,6 +1432,7 @@
 +	}
 +	return NULL;
 +}
++EXPORT_SYMBOL_GPL(bcma_find_core);
 +
 +static void bcma_release_core_dev(struct device *dev)
 +{
@@ -1467,7 +1461,7 @@
 +
 +		core->dev.release = bcma_release_core_dev;
 +		core->dev.bus = &bcma_bus_type;
-+		dev_set_name(&core->dev, "bcma%d:%d", 0/*bus->num*/, dev_id);
++		dev_set_name(&core->dev, "bcma%d:%d", bus->num, dev_id);
 +
 +		switch (bus->hosttype) {
 +		case BCMA_HOSTTYPE_PCI:
@@ -1506,11 +1500,15 @@
 +	}
 +}
 +
-+int bcma_bus_register(struct bcma_bus *bus)
++int __devinit bcma_bus_register(struct bcma_bus *bus)
 +{
 +	int err;
 +	struct bcma_device *core;
 +
++	mutex_lock(&bcma_buses_mutex);
++	bus->num = bcma_bus_next_num++;
++	mutex_unlock(&bcma_buses_mutex);
++
 +	/* Scan for devices (cores) */
 +	err = bcma_bus_scan(bus);
 +	if (err) {
@@ -1543,10 +1541,8 @@
 +	err = bcma_sprom_get(bus);
 +	if (err == -ENOENT) {
 +		pr_err("No SPROM available\n");
-+	} else if (err) {
++	} else if (err)
 +		pr_err("Failed to get SPROM: %d\n", err);
-+		return -ENOENT;
-+	}
 +
 +	/* Register found cores */
 +	bcma_register_cores(bus);
@@ -1615,6 +1611,21 @@
 +}
 +
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->suspend)
++				adrv->suspend(core);
++		}
++	}
++	return 0;
++}
++
 +int bcma_bus_resume(struct bcma_bus *bus)
 +{
 +	struct bcma_device *core;
@@ -1626,6 +1637,15 @@
 +		bcma_core_chipcommon_init(&bus->drv_cc);
 +	}
 +
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->resume)
++				adrv->resume(core);
++		}
++	}
++
 +	return 0;
 +}
 +#endif
@@ -1728,7 +1748,7 @@
 +module_exit(bcma_modexit)
 --- /dev/null
 +++ b/drivers/bcma/scan.c
-@@ -0,0 +1,486 @@
+@@ -0,0 +1,507 @@
 +/*
 + * Broadcom specific AMBA
 + * Bus scanning
@@ -1943,6 +1963,17 @@
 +	return NULL;
 +}
 +
++static struct bcma_device *bcma_find_core_reverse(struct bcma_bus *bus, u16 coreid)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry_reverse(core, &bus->cores, list) {
++		if (core->id.id == coreid)
++			return core;
++	}
++	return NULL;
++}
++
 +static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
 +			      struct bcma_device_id *match, int core_num,
 +			      struct bcma_device *core)
@@ -2084,6 +2115,7 @@
 +void bcma_init_bus(struct bcma_bus *bus)
 +{
 +	s32 tmp;
++	struct bcma_chipinfo *chipinfo = &(bus->chipinfo);
 +
 +	if (bus->init_done)
 +		return;
@@ -2094,9 +2126,12 @@
 +	bcma_scan_switch_core(bus, BCMA_ADDR_BASE);
 +
 +	tmp = bcma_scan_read32(bus, 0, BCMA_CC_ID);
-+	bus->chipinfo.id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
-+	bus->chipinfo.rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
-+	bus->chipinfo.pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	chipinfo->id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
++	chipinfo->rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
++	chipinfo->pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	pr_info("Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
++		chipinfo->id, chipinfo->rev, chipinfo->pkg);
++
 +	bus->init_done = true;
 +}
 +
@@ -2123,6 +2158,7 @@
 +	bcma_scan_switch_core(bus, erombase);
 +
 +	while (eromptr < eromend) {
++		struct bcma_device *other_core;
 +		struct bcma_device *core = kzalloc(sizeof(*core), GFP_KERNEL);
 +		if (!core)
 +			return -ENOMEM;
@@ -2130,18 +2166,23 @@
 +		core->bus = bus;
 +
 +		err = bcma_get_next_core(bus, &eromptr, NULL, core_num, core);
-+		if (err == -ENODEV) {
-+			core_num++;
-+			continue;
-+		} else if (err == -ENXIO)
-+			continue;
-+		else if (err == -ESPIPE)
-+			break;
-+		else if (err < 0)
++		if (err < 0) {
++			kfree(core);
++			if (err == -ENODEV) {
++				core_num++;
++				continue;
++			} else if (err == -ENXIO) {
++				continue;
++			} else if (err == -ESPIPE) {
++				break;
++			}
 +			return err;
++		}
 +
 +		core->core_index = core_num++;
 +		bus->nr_cores++;
++		other_core = bcma_find_core_reverse(bus, core->id.id);
++		core->core_unit = (other_core == NULL) ? 0 : other_core->core_unit + 1;
 +
 +		pr_info("Core %d found: %s "
 +			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
@@ -2276,7 +2317,7 @@
 +#endif /* BCMA_SCAN_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma.h
-@@ -0,0 +1,298 @@
+@@ -0,0 +1,307 @@
 +#ifndef LINUX_BCMA_H_
 +#define LINUX_BCMA_H_
 +
@@ -2415,6 +2456,7 @@
 +	bool dev_registered;
 +
 +	u8 core_index;
++	u8 core_unit;
 +
 +	u32 addr;
 +	u32 wrap;
@@ -2441,7 +2483,7 @@
 +
 +	int (*probe)(struct bcma_device *dev);
 +	void (*remove)(struct bcma_device *dev);
-+	int (*suspend)(struct bcma_device *dev, pm_message_t state);
++	int (*suspend)(struct bcma_device *dev);
 +	int (*resume)(struct bcma_device *dev);
 +	void (*shutdown)(struct bcma_device *dev);
 +
@@ -2454,6 +2496,12 @@
 +
 +extern void bcma_driver_unregister(struct bcma_driver *drv);
 +
++/* Set a fallback SPROM.
++ * See kdoc at the function definition for complete documentation. */
++extern int bcma_arch_register_fallback_sprom(
++		int (*sprom_callback)(struct bcma_bus *bus,
++		struct ssb_sprom *out));
++
 +struct bcma_bus {
 +	/* The MMIO area. */
 +	void __iomem *mmio;
@@ -2474,6 +2522,7 @@
 +	struct list_head cores;
 +	u8 nr_cores;
 +	u8 init_done:1;
++	u8 num;
 +
 +	struct bcma_drv_cc drv_cc;
 +	struct bcma_drv_pci drv_pci;
@@ -2561,6 +2610,7 @@
 +	bcma_write16(cc, offset, (bcma_read16(cc, offset) & mask) | set);
 +}
 +
++extern struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid);
 +extern bool bcma_core_is_enabled(struct bcma_device *core);
 +extern void bcma_core_disable(struct bcma_device *core, u32 flags);
 +extern int bcma_core_enable(struct bcma_device *core, u32 flags);
@@ -2577,7 +2627,7 @@
 +#endif /* LINUX_BCMA_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_driver_chipcommon.h
-@@ -0,0 +1,391 @@
+@@ -0,0 +1,415 @@
 +#ifndef LINUX_BCMA_DRIVER_CC_H_
 +#define LINUX_BCMA_DRIVER_CC_H_
 +
@@ -2636,6 +2686,9 @@
 +#define	 BCMA_CC_OTPS_HW_PROTECT	0x00000001
 +#define	 BCMA_CC_OTPS_SW_PROTECT	0x00000002
 +#define	 BCMA_CC_OTPS_CID_PROTECT	0x00000004
++#define  BCMA_CC_OTPS_GU_PROG_IND	0x00000F00	/* General Use programmed indication */
++#define  BCMA_CC_OTPS_GU_PROG_IND_SHIFT	8
++#define  BCMA_CC_OTPS_GU_PROG_HW	0x00000100	/* HW region programmed */
 +#define BCMA_CC_OTPC			0x0014		/* OTP control */
 +#define	 BCMA_CC_OTPC_RECWAIT		0xFF000000
 +#define	 BCMA_CC_OTPC_PROGWAIT		0x00FFFF00
@@ -2652,6 +2705,8 @@
 +#define	 BCMA_CC_OTPP_READ		0x40000000
 +#define	 BCMA_CC_OTPP_START		0x80000000
 +#define	 BCMA_CC_OTPP_BUSY		0x80000000
++#define BCMA_CC_OTPL			0x001C		/* OTP layout */
++#define  BCMA_CC_OTPL_GURGN_OFFSET	0x00000FFF	/* offset of general use region */
 +#define BCMA_CC_IRQSTAT			0x0020
 +#define BCMA_CC_IRQMASK			0x0024
 +#define	 BCMA_CC_IRQ_GPIO		0x00000001	/* gpio intr */
@@ -2659,6 +2714,10 @@
 +#define	 BCMA_CC_IRQ_WDRESET		0x80000000	/* watchdog reset occurred */
 +#define BCMA_CC_CHIPCTL			0x0028		/* Rev >= 11 only */
 +#define BCMA_CC_CHIPSTAT		0x002C		/* Rev >= 11 only */
++#define  BCMA_CC_CHIPST_4313_SPROM_PRESENT	1
++#define  BCMA_CC_CHIPST_4313_OTP_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_SPROM_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_OTP_PRESENT	4
 +#define BCMA_CC_JCMD			0x0030		/* Rev >= 10 only */
 +#define  BCMA_CC_JCMD_START		0x80000000
 +#define  BCMA_CC_JCMD_BUSY		0x80000000
@@ -2761,6 +2820,22 @@
 +#define BCMA_CC_FLASH_CFG		0x0128
 +#define  BCMA_CC_FLASH_CFG_DS		0x0010	/* Data size, 0=8bit, 1=16bit */
 +#define BCMA_CC_FLASH_WAITCNT		0x012C
++#define BCMA_CC_SROM_CONTROL		0x0190
++#define  BCMA_CC_SROM_CONTROL_START	0x80000000
++#define  BCMA_CC_SROM_CONTROL_BUSY	0x80000000
++#define  BCMA_CC_SROM_CONTROL_OPCODE	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OP_READ	0x00000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRITE	0x20000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRDIS	0x40000000
++#define  BCMA_CC_SROM_CONTROL_OP_WREN	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OTPSEL	0x00000010
++#define  BCMA_CC_SROM_CONTROL_LOCK	0x00000008
++#define  BCMA_CC_SROM_CONTROL_SIZE_MASK	0x00000006
++#define  BCMA_CC_SROM_CONTROL_SIZE_1K	0x00000000
++#define  BCMA_CC_SROM_CONTROL_SIZE_4K	0x00000002
++#define  BCMA_CC_SROM_CONTROL_SIZE_16K	0x00000004
++#define  BCMA_CC_SROM_CONTROL_SIZE_SHIFT	1
++#define  BCMA_CC_SROM_CONTROL_PRESENT	0x00000001
 +/* 0x1E0 is defined as shared BCMA_CLKCTLST */
 +#define BCMA_CC_HW_WORKAROUND		0x01E4 /* Hardware workaround (rev >= 20) */
 +#define BCMA_CC_UART0_DATA		0x0300
@@ -2820,7 +2895,6 @@
 +#define BCMA_CC_PLLCTL_ADDR		0x0660
 +#define BCMA_CC_PLLCTL_DATA		0x0664
 +#define BCMA_CC_SPROM			0x0800 /* SPROM beginning */
-+#define BCMA_CC_SPROM_PCIE6		0x0830 /* SPROM beginning on PCIe rev >= 6 */
 +
 +/* Divider allocation in 4716/47162/5356 */
 +#define BCMA_CC_PMU5_MAINPLL_CPU	1
@@ -2971,7 +3045,7 @@
 +#endif /* LINUX_BCMA_DRIVER_CC_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_driver_pci.h
-@@ -0,0 +1,91 @@
+@@ -0,0 +1,214 @@
 +#ifndef LINUX_BCMA_DRIVER_PCI_H_
 +#define LINUX_BCMA_DRIVER_PCI_H_
 +
@@ -3027,6 +3101,35 @@
 +#define  BCMA_CORE_PCI_SBTOPCI1_MASK		0xFC000000
 +#define BCMA_CORE_PCI_SBTOPCI2			0x0108	/* Backplane to PCI translation 2 (sbtopci2) */
 +#define  BCMA_CORE_PCI_SBTOPCI2_MASK		0xC0000000
++#define BCMA_CORE_PCI_CONFIG_ADDR		0x0120	/* pcie config space access */
++#define BCMA_CORE_PCI_CONFIG_DATA		0x0124	/* pcie config space access */
++#define BCMA_CORE_PCI_MDIO_CONTROL		0x0128	/* controls the mdio access */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_MASK	0x7f	/* clock to be used on MDIO */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL	0x2
++#define  BCMA_CORE_PCI_MDIOCTL_PREAM_EN		0x80	/* Enable preamble sequnce */
++#define  BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE	0x100	/* Tranaction complete */
++#define BCMA_CORE_PCI_MDIO_DATA			0x012c	/* Data to the mdio access */
++#define  BCMA_CORE_PCI_MDIODATA_MASK		0x0000ffff /* data 2 bytes */
++#define  BCMA_CORE_PCI_MDIODATA_TA		0x00020000 /* Turnaround */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD	18	/* Regaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK_OLD	0x003c0000 /* Regaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD	22	/* Physmedia devaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK_OLD	0x0fc00000 /* Physmedia devaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF	18	/* Regaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK	0x007c0000 /* Regaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF	23	/* Physmedia devaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK	0x0f800000 /* Physmedia devaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_WRITE		0x10000000 /* write Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_READ		0x20000000 /* Read Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_START		0x40000000 /* start of Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_ADDR	0x0	/* dev address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_BLK_ADDR	0x1F	/* blk address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_PLL		0x1d	/* SERDES PLL Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_TX		0x1e	/* SERDES TX Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_RX		0x1f	/* SERDES RX Dev */
++#define BCMA_CORE_PCI_PCIEIND_ADDR		0x0130	/* indirect access to the internal register */
++#define BCMA_CORE_PCI_PCIEIND_DATA		0x0134	/* Data to/from the internal regsiter */
++#define BCMA_CORE_PCI_CLKREQENCTRL		0x0138	/*  >= rev 6, Clkreq rdma control */
 +#define BCMA_CORE_PCI_PCICFG0			0x0400	/* PCI config space 0 (rev >= 8) */
 +#define BCMA_CORE_PCI_PCICFG1			0x0500	/* PCI config space 1 (rev >= 8) */
 +#define BCMA_CORE_PCI_PCICFG2			0x0600	/* PCI config space 2 (rev >= 8) */
@@ -3046,26 +3149,120 @@
 +#define  BCMA_CORE_PCI_SBTOPCI_RC_READL		0x00000010 /* Memory read line */
 +#define  BCMA_CORE_PCI_SBTOPCI_RC_READM		0x00000020 /* Memory read multiple */
 +
++/* PCIE protocol PHY diagnostic registers */
++#define BCMA_CORE_PCI_PLP_MODEREG		0x200	/* Mode */
++#define BCMA_CORE_PCI_PLP_STATUSREG		0x204	/* Status */
++#define  BCMA_CORE_PCI_PLP_POLARITYINV_STAT	0x10	/* Status reg PCIE_PLP_STATUSREG */
++#define BCMA_CORE_PCI_PLP_LTSSMCTRLREG		0x208	/* LTSSM control */
++#define BCMA_CORE_PCI_PLP_LTLINKNUMREG		0x20c	/* Link Training Link number */
++#define BCMA_CORE_PCI_PLP_LTLANENUMREG		0x210	/* Link Training Lane number */
++#define BCMA_CORE_PCI_PLP_LTNFTSREG		0x214	/* Link Training N_FTS */
++#define BCMA_CORE_PCI_PLP_ATTNREG		0x218	/* Attention */
++#define BCMA_CORE_PCI_PLP_ATTNMASKREG		0x21C	/* Attention Mask */
++#define BCMA_CORE_PCI_PLP_RXERRCTR		0x220	/* Rx Error */
++#define BCMA_CORE_PCI_PLP_RXFRMERRCTR		0x224	/* Rx Framing Error */
++#define BCMA_CORE_PCI_PLP_RXERRTHRESHREG	0x228	/* Rx Error threshold */
++#define BCMA_CORE_PCI_PLP_TESTCTRLREG		0x22C	/* Test Control reg */
++#define BCMA_CORE_PCI_PLP_SERDESCTRLOVRDREG	0x230	/* SERDES Control Override */
++#define BCMA_CORE_PCI_PLP_TIMINGOVRDREG		0x234	/* Timing param override */
++#define BCMA_CORE_PCI_PLP_RXTXSMDIAGREG		0x238	/* RXTX State Machine Diag */
++#define BCMA_CORE_PCI_PLP_LTSSMDIAGREG		0x23C	/* LTSSM State Machine Diag */
++
++/* PCIE protocol DLLP diagnostic registers */
++#define BCMA_CORE_PCI_DLLP_LCREG		0x100	/* Link Control */
++#define BCMA_CORE_PCI_DLLP_LSREG		0x104	/* Link Status */
++#define BCMA_CORE_PCI_DLLP_LAREG		0x108	/* Link Attention */
++#define  BCMA_CORE_PCI_DLLP_LSREG_LINKUP	(1 << 16)
++#define BCMA_CORE_PCI_DLLP_LAMASKREG		0x10C	/* Link Attention Mask */
++#define BCMA_CORE_PCI_DLLP_NEXTTXSEQNUMREG	0x110	/* Next Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_ACKEDTXSEQNUMREG	0x114	/* Acked Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_PURGEDTXSEQNUMREG	0x118	/* Purged Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_RXSEQNUMREG		0x11C	/* Rx Sequence Number */
++#define BCMA_CORE_PCI_DLLP_LRREG		0x120	/* Link Replay */
++#define BCMA_CORE_PCI_DLLP_LACKTOREG		0x124	/* Link Ack Timeout */
++#define BCMA_CORE_PCI_DLLP_PMTHRESHREG		0x128	/* Power Management Threshold */
++#define BCMA_CORE_PCI_DLLP_RTRYWPREG		0x12C	/* Retry buffer write ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYRPREG		0x130	/* Retry buffer Read ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYPPREG		0x134	/* Retry buffer Purged ptr */
++#define BCMA_CORE_PCI_DLLP_RTRRWREG		0x138	/* Retry buffer Read/Write */
++#define BCMA_CORE_PCI_DLLP_ECTHRESHREG		0x13C	/* Error Count Threshold */
++#define BCMA_CORE_PCI_DLLP_TLPERRCTRREG		0x140	/* TLP Error Counter */
++#define BCMA_CORE_PCI_DLLP_ERRCTRREG		0x144	/* Error Counter */
++#define BCMA_CORE_PCI_DLLP_NAKRXCTRREG		0x148	/* NAK Received Counter */
++#define BCMA_CORE_PCI_DLLP_TESTREG		0x14C	/* Test */
++#define BCMA_CORE_PCI_DLLP_PKTBIST		0x150	/* Packet BIST */
++#define BCMA_CORE_PCI_DLLP_PCIE11		0x154	/* DLLP PCIE 1.1 reg */
++
++/* SERDES RX registers */
++#define BCMA_CORE_PCI_SERDES_RX_CTRL		1	/* Rx cntrl */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE	0x80	/* rxpolarity_force */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY	0x40	/* rxpolarity_value */
++#define BCMA_CORE_PCI_SERDES_RX_TIMER1		2	/* Rx Timer1 */
++#define BCMA_CORE_PCI_SERDES_RX_CDR		6	/* CDR */
++#define BCMA_CORE_PCI_SERDES_RX_CDRBW		7	/* CDR BW */
++
++/* SERDES PLL registers */
++#define BCMA_CORE_PCI_SERDES_PLL_CTRL		1	/* PLL control reg */
++#define BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN	0x4000	/* bit 14 is FREQDET on */
++
 +/* PCIcore specific boardflags */
 +#define BCMA_CORE_PCI_BFL_NOPCI			0x00000400 /* Board leaves PCI floating */
 +
++/* PCIE Config space accessing MACROS */
++#define BCMA_CORE_PCI_CFG_BUS_SHIFT		24	/* Bus shift */
++#define BCMA_CORE_PCI_CFG_SLOT_SHIFT		19	/* Slot/Device shift */
++#define BCMA_CORE_PCI_CFG_FUN_SHIFT		16	/* Function shift */
++#define BCMA_CORE_PCI_CFG_OFF_SHIFT		0	/* Register shift */
++
++#define BCMA_CORE_PCI_CFG_BUS_MASK		0xff	/* Bus mask */
++#define BCMA_CORE_PCI_CFG_SLOT_MASK		0x1f	/* Slot/Device mask */
++#define BCMA_CORE_PCI_CFG_FUN_MASK		7	/* Function mask */
++#define BCMA_CORE_PCI_CFG_OFF_MASK		0xfff	/* Register mask */
++
++/* PCIE Root Capability Register bits (Host mode only) */
++#define BCMA_CORE_PCI_RC_CRS_VISIBILITY		0x0001
++
++struct bcma_drv_pci;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++struct bcma_drv_pci_host {
++	struct bcma_drv_pci *pdev;
++
++	u32 host_cfg_addr;
++	spinlock_t cfgspace_lock;
++
++	struct pci_controller pci_controller;
++	struct pci_ops pci_ops;
++	struct resource mem_resource;
++	struct resource io_resource;
++};
++#endif
++
 +struct bcma_drv_pci {
 +	struct bcma_device *core;
 +	u8 setup_done:1;
++	u8 hostmode:1;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	struct bcma_drv_pci_host *host_controller;
++#endif
 +};
 +
 +/* Register access */
 +#define pcicore_read32(pc, offset)		bcma_read32((pc)->core, offset)
 +#define pcicore_write32(pc, offset, val)	bcma_write32((pc)->core, offset, val)
 +
-+extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
++extern void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc);
 +extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
 +				 struct bcma_device *core, bool enable);
 +
++extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
++extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
++
 +#endif /* LINUX_BCMA_DRIVER_PCI_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_regs.h
-@@ -0,0 +1,59 @@
+@@ -0,0 +1,86 @@
 +#ifndef LINUX_BCMA_REGS_H_
 +#define LINUX_BCMA_REGS_H_
 +
@@ -3124,6 +3321,33 @@
 +#define  BCMA_PCI_GPIO_XTAL		0x40	/* PCI config space GPIO 14 for Xtal powerup */
 +#define  BCMA_PCI_GPIO_PLL		0x80	/* PCI config space GPIO 15 for PLL powerdown */
 +
++/* SiliconBackplane Address Map.
++ * All regions may not exist on all chips.
++ */
++#define BCMA_SOC_SDRAM_BASE		0x00000000U	/* Physical SDRAM */
++#define BCMA_SOC_PCI_MEM		0x08000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI_MEM_SZ		(64 * 1024 * 1024)
++#define BCMA_SOC_PCI_CFG		0x0c000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_SDRAM_SWAPPED		0x10000000U	/* Byteswapped Physical SDRAM */
++#define BCMA_SOC_SDRAM_R2		0x80000000U	/* Region 2 for sdram (512 MB) */
++
++
++#define BCMA_SOC_PCI_DMA		0x40000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA2		0x80000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA_SZ		0x40000000U	/* Client Mode sb2pcitranslation2 size in bytes */
++#define BCMA_SOC_PCIE_DMA_L32		0x00000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), low 32 bits
++							 */
++#define BCMA_SOC_PCIE_DMA_H32		0x80000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
++#define BCMA_SOC_PCI1_MEM		0x40000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI1_CFG		0x44000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_PCIE1_DMA_H32		0xc0000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
 +#endif /* LINUX_BCMA_REGS_H_ */
 --- a/include/linux/mod_devicetable.h
 +++ b/include/linux/mod_devicetable.h
@@ -3191,11 +3415,13 @@
  			 sizeof(struct virtio_device_id), "virtio",
 --- /dev/null
 +++ b/drivers/bcma/sprom.c
-@@ -0,0 +1,247 @@
+@@ -0,0 +1,450 @@
 +/*
 + * Broadcom specific AMBA
 + * SPROM reading
 + *
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
@@ -3208,7 +3434,57 @@
 +#include <linux/dma-mapping.h>
 +#include <linux/slab.h>
 +
-+#define SPOFF(offset)	((offset) / sizeof(u16))
++static int(*get_fallback_sprom)(struct bcma_bus *dev, struct ssb_sprom *out);
++
++/**
++ * bcma_arch_register_fallback_sprom - Registers a method providing a
++ * fallback SPROM if no SPROM is found.
++ *
++ * @sprom_callback: The callback function.
++ *
++ * With this function the architecture implementation may register a
++ * callback handler which fills the SPROM data structure. The fallback is
++ * used for PCI based BCMA devices, where no valid SPROM can be found
++ * in the shadow registers and to provide the SPROM for SoCs where BCMA is
++ * to controll the system bus.
++ *
++ * This function is useful for weird architectures that have a half-assed
++ * BCMA device hardwired to their PCI bus.
++ *
++ * This function is available for architecture code, only. So it is not
++ * exported.
++ */
++int bcma_arch_register_fallback_sprom(int (*sprom_callback)(struct bcma_bus *bus,
++				     struct ssb_sprom *out))
++{
++	if (get_fallback_sprom)
++		return -EEXIST;
++	get_fallback_sprom = sprom_callback;
++
++	return 0;
++}
++
++static int bcma_fill_sprom_with_fallback(struct bcma_bus *bus,
++					 struct ssb_sprom *out)
++{
++	int err;
++
++	if (!get_fallback_sprom) {
++		err = -ENOENT;
++		goto fail;
++	}
++
++	err = get_fallback_sprom(bus, out);
++	if (err)
++		goto fail;
++
++	pr_debug("Using SPROM revision %d provided by"
++		 " platform.\n", bus->sprom.revision);
++	return 0;
++fail:
++	pr_warn("Using fallback SPROM failed (err %d)\n", err);
++	return err;
++}
 +
 +/**************************************************
 + * R/W ops.
@@ -3318,10 +3594,21 @@
 + * SPROM extraction.
 + **************************************************/
 +
++#define SPOFF(offset)	((offset) / sizeof(u16))
++
++#define SPEX(_field, _offset, _mask, _shift)	\
++	bus->sprom._field = ((sprom[SPOFF(_offset)] & (_mask)) >> (_shift))
++
 +static void bcma_sprom_extract_r8(struct bcma_bus *bus, const u16 *sprom)
 +{
-+	u16 v;
++	u16 v, o;
 +	int i;
++	u16 pwr_info_offset[] = {
++		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
++		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
++	};
++	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
++			ARRAY_SIZE(bus->sprom.core_pwr_info));
 +
 +	bus->sprom.revision = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] &
 +		SSB_SPROM_REVISION_REV;
@@ -3331,85 +3618,229 @@
 +		*(((__be16 *)bus->sprom.il0mac) + i) = cpu_to_be16(v);
 +	}
 +
-+	bus->sprom.board_rev = sprom[SPOFF(SSB_SPROM8_BOARDREV)];
-+
-+	bus->sprom.txpid2g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G0) >> SSB_SPROM4_TXPID2G0_SHIFT;
-+	bus->sprom.txpid2g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G1) >> SSB_SPROM4_TXPID2G1_SHIFT;
-+	bus->sprom.txpid2g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G2) >> SSB_SPROM4_TXPID2G2_SHIFT;
-+	bus->sprom.txpid2g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G3) >> SSB_SPROM4_TXPID2G3_SHIFT;
-+
-+	bus->sprom.txpid5gl[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL0) >> SSB_SPROM4_TXPID5GL0_SHIFT;
-+	bus->sprom.txpid5gl[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL1) >> SSB_SPROM4_TXPID5GL1_SHIFT;
-+	bus->sprom.txpid5gl[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL2) >> SSB_SPROM4_TXPID5GL2_SHIFT;
-+	bus->sprom.txpid5gl[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL3) >> SSB_SPROM4_TXPID5GL3_SHIFT;
-+
-+	bus->sprom.txpid5g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G0) >> SSB_SPROM4_TXPID5G0_SHIFT;
-+	bus->sprom.txpid5g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G1) >> SSB_SPROM4_TXPID5G1_SHIFT;
-+	bus->sprom.txpid5g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G2) >> SSB_SPROM4_TXPID5G2_SHIFT;
-+	bus->sprom.txpid5g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G3) >> SSB_SPROM4_TXPID5G3_SHIFT;
-+
-+	bus->sprom.txpid5gh[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH0) >> SSB_SPROM4_TXPID5GH0_SHIFT;
-+	bus->sprom.txpid5gh[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH1) >> SSB_SPROM4_TXPID5GH1_SHIFT;
-+	bus->sprom.txpid5gh[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH2) >> SSB_SPROM4_TXPID5GH2_SHIFT;
-+	bus->sprom.txpid5gh[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH3) >> SSB_SPROM4_TXPID5GH3_SHIFT;
-+
-+	bus->sprom.boardflags_lo = sprom[SPOFF(SSB_SPROM8_BFLLO)];
-+	bus->sprom.boardflags_hi = sprom[SPOFF(SSB_SPROM8_BFLHI)];
-+	bus->sprom.boardflags2_lo = sprom[SPOFF(SSB_SPROM8_BFL2LO)];
-+	bus->sprom.boardflags2_hi = sprom[SPOFF(SSB_SPROM8_BFL2HI)];
-+
-+	bus->sprom.country_code = sprom[SPOFF(SSB_SPROM8_CCODE)];
-+
-+	bus->sprom.fem.ghz2.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz2.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz2.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz2.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz2.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
-+
-+	bus->sprom.fem.ghz5.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz5.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz5.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz5.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz5.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
++	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
++
++	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
++	     SSB_SPROM4_TXPID2G0_SHIFT);
++	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
++	     SSB_SPROM4_TXPID2G1_SHIFT);
++	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
++	     SSB_SPROM4_TXPID2G2_SHIFT);
++	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
++	     SSB_SPROM4_TXPID2G3_SHIFT);
++
++	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
++	     SSB_SPROM4_TXPID5GL0_SHIFT);
++	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
++	     SSB_SPROM4_TXPID5GL1_SHIFT);
++	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
++	     SSB_SPROM4_TXPID5GL2_SHIFT);
++	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
++	     SSB_SPROM4_TXPID5GL3_SHIFT);
++
++	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
++	     SSB_SPROM4_TXPID5G0_SHIFT);
++	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
++	     SSB_SPROM4_TXPID5G1_SHIFT);
++	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
++	     SSB_SPROM4_TXPID5G2_SHIFT);
++	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
++	     SSB_SPROM4_TXPID5G3_SHIFT);
++
++	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
++	     SSB_SPROM4_TXPID5GH0_SHIFT);
++	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
++	     SSB_SPROM4_TXPID5GH1_SHIFT);
++	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
++	     SSB_SPROM4_TXPID5GH2_SHIFT);
++	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
++	     SSB_SPROM4_TXPID5GH3_SHIFT);
++
++	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
++	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
++	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
++	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
++
++	SPEX(country_code, SSB_SPROM8_CCODE, ~0, 0);
++
++	/* Extract cores power info info */
++	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
++		o = pwr_info_offset[i];
++		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_MAXP, 0);
++
++		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
++
++		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GH_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
++
++		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
++	}
++
++	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++
++	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++}
++
++/*
++ * Indicates the presence of external SPROM.
++ */
++static bool bcma_sprom_ext_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 srom_control;
++	u32 present_mask;
++
++	if (bus->drv_cc.core->id.rev >= 31) {
++		if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
++			return false;
++
++		srom_control = bcma_read32(bus->drv_cc.core,
++					   BCMA_CC_SROM_CONTROL);
++		return srom_control & BCMA_CC_SROM_CONTROL_PRESENT;
++	}
++
++	/* older chipcommon revisions use chip status register */
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present_mask = BCMA_CC_CHIPST_4313_SPROM_PRESENT;
++		break;
++
++	case 0x4331:
++		present_mask = BCMA_CC_CHIPST_4331_SPROM_PRESENT;
++		break;
++
++	default:
++		return true;
++	}
++
++	return chip_status & present_mask;
++}
++
++/*
++ * Indicates that on-chip OTP memory is present and enabled.
++ */
++static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 otpsize = 0;
++	bool present;
++
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present = chip_status & BCMA_CC_CHIPST_4313_OTP_PRESENT;
++		break;
++
++	case 0x4331:
++		present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
++		break;
++
++	case 43224:
++	case 43225:
++		/* for these chips OTP is always available */
++		present = true;
++		break;
++
++	default:
++		present = false;
++		break;
++	}
++
++	if (present) {
++		otpsize = bus->drv_cc.capabilities & BCMA_CC_CAP_OTPS;
++		otpsize >>= BCMA_CC_CAP_OTPS_SHIFT;
++	}
++
++	return otpsize != 0;
++}
++
++/*
++ * Verify OTP is filled and determine the byte
++ * offset where SPROM data is located.
++ *
++ * On error, returns 0; byte offset otherwise.
++ */
++static int bcma_sprom_onchip_offset(struct bcma_bus *bus)
++{
++	struct bcma_device *cc = bus->drv_cc.core;
++	u32 offset;
++
++	/* verify OTP status */
++	if ((bcma_read32(cc, BCMA_CC_OTPS) & BCMA_CC_OTPS_GU_PROG_HW) == 0)
++		return 0;
++
++	/* obtain bit offset from otplayout register */
++	offset = (bcma_read32(cc, BCMA_CC_OTPL) & BCMA_CC_OTPL_GURGN_OFFSET);
++	return BCMA_CC_SPROM + (offset >> 3);
 +}
 +
 +int bcma_sprom_get(struct bcma_bus *bus)
 +{
-+	u16 offset;
++	u16 offset = BCMA_CC_SPROM;
 +	u16 *sprom;
 +	int err = 0;
 +
 +	if (!bus->drv_cc.core)
 +		return -EOPNOTSUPP;
 +
-+	if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
-+		return -ENOENT;
++	if (!bcma_sprom_ext_available(bus)) {
++		/*
++		 * External SPROM takes precedence so check
++		 * on-chip OTP only when no external SPROM
++		 * is present.
++		 */
++		if (bcma_sprom_onchip_available(bus)) {
++			/* determine offset */
++			offset = bcma_sprom_onchip_offset(bus);
++		}
++		if (!offset) {
++			/*
++			 * Maybe there is no SPROM on the device?
++			 * Now we ask the arch code if there is some sprom
++			 * available for this device in some other storage.
++			 */
++			err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
++			return err;
++		}
++	}
 +
 +	sprom = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
 +			GFP_KERNEL);
@@ -3419,11 +3850,7 @@
 +	if (bus->chipinfo.id == 0x4331)
 +		bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
 +
-+	/* Most cards have SPROM moved by additional offset 0x30 (48 dwords).
-+	 * According to brcm80211 this applies to cards with PCIe rev >= 6
-+	 * TODO: understand this condition and use it */
-+	offset = (bus->chipinfo.id == 0x4331) ? BCMA_CC_SPROM :
-+		BCMA_CC_SPROM_PCIE6;
++	pr_debug("SPROM offset 0x%x\n", offset);
 +	bcma_sprom_read(bus, offset, sprom);
 +
 +	if (bus->chipinfo.id == 0x4331)
@@ -3441,21 +3868,596 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/driver_pci_host.c
-@@ -0,0 +1,14 @@
+@@ -0,0 +1,589 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Core in hostmode
 + *
++ * Copyright 2005 - 2011, Broadcom Corporation
++ * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
 +#include "bcma_private.h"
++#include <linux/pci.h>
++#include <linux/export.h>
 +#include <linux/bcma/bcma.h>
++#include <asm/paccess.h>
++
++/* Probe a 32bit value on the bus and catch bus exceptions.
++ * Returns nonzero on a bus exception.
++ * This is MIPS specific */
++#define mips_busprobe32(val, addr)	get_dbe((val), ((u32 *)(addr)))
++
++/* Assume one-hot slot wiring */
++#define BCMA_PCI_SLOT_MAX	16
++#define	PCI_CONFIG_SPACE_SIZE	256
++
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	u16 chipid_top;
++	u32 tmp;
++
++	chipid_top = (bus->chipinfo.id & 0xFF00);
++	if (chipid_top != 0x4700 &&
++	    chipid_top != 0x5300)
++		return false;
++
++	if (bus->sprom.boardflags_lo & BCMA_CORE_PCI_BFL_NOPCI) {
++		pr_info("This PCI core is disabled and not working\n");
++		return false;
++	}
 +
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++	bcma_core_enable(pc->core, 0);
++
++	return !mips_busprobe32(tmp, pc->core->io_addr);
++}
++
++static u32 bcma_pcie_read_config(struct bcma_drv_pci *pc, u32 address)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_DATA);
++}
++
++static void bcma_pcie_write_config(struct bcma_drv_pci *pc, u32 address,
++				   u32 data)
 +{
-+	pr_err("No support for PCI core in hostmode yet\n");
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_DATA, data);
++}
++
++static u32 bcma_get_cfgspace_addr(struct bcma_drv_pci *pc, unsigned int dev,
++			     unsigned int func, unsigned int off)
++{
++	u32 addr = 0;
++
++	/* Issue config commands only when the data link is up (atleast
++	 * one external pcie device is present).
++	 */
++	if (dev >= 2 || !(bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_LSREG)
++			  & BCMA_CORE_PCI_DLLP_LSREG_LINKUP))
++		goto out;
++
++	/* Type 0 transaction */
++	/* Slide the PCI window to the appropriate slot */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++	/* Calculate the address */
++	addr = pc->host_controller->host_cfg_addr;
++	addr |= (dev << BCMA_CORE_PCI_CFG_SLOT_SHIFT);
++	addr |= (func << BCMA_CORE_PCI_CFG_FUN_SHIFT);
++	addr |= (off & ~3);
++
++out:
++	return addr;
++}
++
++static int bcma_extpci_read_config(struct bcma_drv_pci *pc, unsigned int dev,
++				  unsigned int func, unsigned int off,
++				  void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr, val;
++	void __iomem *mmio = 0;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* we support only two functions on device 0 */
++		if (func > 1)
++			return -EINVAL;
++
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off >= PCI_CONFIG_SPACE_SIZE) {
++			addr = (func << 12);
++			addr |= (off & 0x0FFF);
++			val = bcma_pcie_read_config(pc, addr);
++		} else {
++			addr = BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			val = pcicore_read32(pc, addr);
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++
++		val = readl(mmio);
++	}
++	val >>= (8 * (off & 3));
++
++	switch (len) {
++	case 1:
++		*((u8 *)buf) = (u8)val;
++		break;
++	case 2:
++		*((u16 *)buf) = (u16)val;
++		break;
++	case 4:
++		*((u32 *)buf) = (u32)val;
++		break;
++	}
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
++				   unsigned int func, unsigned int off,
++				   const void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr = 0, val = 0;
++	void __iomem *mmio = 0;
++	u16 chipid = pc->core->bus->chipinfo.id;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off < PCI_CONFIG_SPACE_SIZE) {
++			addr = pc->core->addr + BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			mmio = ioremap_nocache(addr, len);
++			if (!mmio)
++				goto out;
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++	}
++
++	switch (len) {
++	case 1:
++		val = readl(mmio);
++		val &= ~(0xFF << (8 * (off & 3)));
++		val |= *((const u8 *)buf) << (8 * (off & 3));
++		break;
++	case 2:
++		val = readl(mmio);
++		val &= ~(0xFFFF << (8 * (off & 3)));
++		val |= *((const u16 *)buf) << (8 * (off & 3));
++		break;
++	case 4:
++		val = *((const u32 *)buf);
++		break;
++	}
++	if (dev == 0 && !addr) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		addr = (func << 12);
++		addr |= (off & 0x0FFF);
++		bcma_pcie_write_config(pc, addr, val);
++	} else {
++		writel(val, mmio);
++
++		if (chipid == 0x4716 || chipid == 0x4748)
++			readl(mmio);
++	}
++
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_core_pci_hostmode_read_config(struct pci_bus *bus,
++					      unsigned int devfn,
++					      int reg, int size, u32 *val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_read_config(pc, PCI_SLOT(devfn),
++				     PCI_FUNC(devfn), reg, val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++static int bcma_core_pci_hostmode_write_config(struct pci_bus *bus,
++					       unsigned int devfn,
++					       int reg, int size, u32 val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_write_config(pc, PCI_SLOT(devfn),
++				      PCI_FUNC(devfn), reg, &val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++/* return cap_offset if requested capability exists in the PCI config space */
++static u8 __devinit bcma_find_pci_capability(struct bcma_drv_pci *pc,
++					     unsigned int dev,
++					     unsigned int func, u8 req_cap_id,
++					     unsigned char *buf, u32 *buflen)
++{
++	u8 cap_id;
++	u8 cap_ptr = 0;
++	u32 bufsize;
++	u8 byte_val;
++
++	/* check for Header type 0 */
++	bcma_extpci_read_config(pc, dev, func, PCI_HEADER_TYPE, &byte_val,
++				sizeof(u8));
++	if ((byte_val & 0x7f) != PCI_HEADER_TYPE_NORMAL)
++		return cap_ptr;
++
++	/* check if the capability pointer field exists */
++	bcma_extpci_read_config(pc, dev, func, PCI_STATUS, &byte_val,
++				sizeof(u8));
++	if (!(byte_val & PCI_STATUS_CAP_LIST))
++		return cap_ptr;
++
++	/* check if the capability pointer is 0x00 */
++	bcma_extpci_read_config(pc, dev, func, PCI_CAPABILITY_LIST, &cap_ptr,
++				sizeof(u8));
++	if (cap_ptr == 0x00)
++		return cap_ptr;
++
++	/* loop thr'u the capability list and see if the requested capabilty
++	 * exists */
++	bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id, sizeof(u8));
++	while (cap_id != req_cap_id) {
++		bcma_extpci_read_config(pc, dev, func, cap_ptr + 1, &cap_ptr,
++					sizeof(u8));
++		if (cap_ptr == 0x00)
++			return cap_ptr;
++		bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id,
++					sizeof(u8));
++	}
++
++	/* found the caller requested capability */
++	if ((buf != NULL) && (buflen != NULL)) {
++		u8 cap_data;
++
++		bufsize = *buflen;
++		if (!bufsize)
++			return cap_ptr;
++
++		*buflen = 0;
++
++		/* copy the cpability data excluding cap ID and next ptr */
++		cap_data = cap_ptr + 2;
++		if ((bufsize + cap_data)  > PCI_CONFIG_SPACE_SIZE)
++			bufsize = PCI_CONFIG_SPACE_SIZE - cap_data;
++		*buflen = bufsize;
++		while (bufsize--) {
++			bcma_extpci_read_config(pc, dev, func, cap_data, buf,
++						sizeof(u8));
++			cap_data++;
++			buf++;
++		}
++	}
++
++	return cap_ptr;
++}
++
++/* If the root port is capable of returning Config Request
++ * Retry Status (CRS) Completion Status to software then
++ * enable the feature.
++ */
++static void __devinit bcma_core_pci_enable_crs(struct bcma_drv_pci *pc)
++{
++	u8 cap_ptr, root_ctrl, root_cap, dev;
++	u16 val16;
++	int i;
++
++	cap_ptr = bcma_find_pci_capability(pc, 0, 0, PCI_CAP_ID_EXP, NULL,
++					   NULL);
++	root_cap = cap_ptr + PCI_EXP_RTCAP;
++	bcma_extpci_read_config(pc, 0, 0, root_cap, &val16, sizeof(u16));
++	if (val16 & BCMA_CORE_PCI_RC_CRS_VISIBILITY) {
++		/* Enable CRS software visibility */
++		root_ctrl = cap_ptr + PCI_EXP_RTCTL;
++		val16 = PCI_EXP_RTCTL_CRSSVE;
++		bcma_extpci_read_config(pc, 0, 0, root_ctrl, &val16,
++					sizeof(u16));
++
++		/* Initiate a configuration request to read the vendor id
++		 * field of the device function's config space header after
++		 * 100 ms wait time from the end of Reset. If the device is
++		 * not done with its internal initialization, it must at
++		 * least return a completion TLP, with a completion status
++		 * of "Configuration Request Retry Status (CRS)". The root
++		 * complex must complete the request to the host by returning
++		 * a read-data value of 0001h for the Vendor ID field and
++		 * all 1s for any additional bytes included in the request.
++		 * Poll using the config reads for max wait time of 1 sec or
++		 * until we receive the successful completion status. Repeat
++		 * the procedure for all the devices.
++		 */
++		for (dev = 1; dev < BCMA_PCI_SLOT_MAX; dev++) {
++			for (i = 0; i < 100000; i++) {
++				bcma_extpci_read_config(pc, dev, 0,
++							PCI_VENDOR_ID, &val16,
++							sizeof(val16));
++				if (val16 != 0x1)
++					break;
++				udelay(10);
++			}
++			if (val16 == 0x1)
++				pr_err("PCI: Broken device in slot %d\n", dev);
++		}
++	}
++}
++
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	struct bcma_drv_pci_host *pc_host;
++	u32 tmp;
++	u32 pci_membase_1G;
++	unsigned long io_map_base;
++
++	pr_info("PCIEcore in host mode found\n");
++
++	pc_host = kzalloc(sizeof(*pc_host), GFP_KERNEL);
++	if (!pc_host)  {
++		pr_err("can not allocate memory");
++		return;
++	}
++
++	pc->host_controller = pc_host;
++	pc_host->pci_controller.io_resource = &pc_host->io_resource;
++	pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
++	pc_host->pci_controller.pci_ops = &pc_host->pci_ops;
++	pc_host->pdev = pc;
++
++	pci_membase_1G = BCMA_SOC_PCI_DMA;
++	pc_host->host_cfg_addr = BCMA_SOC_PCI_CFG;
++
++	pc_host->pci_ops.read = bcma_core_pci_hostmode_read_config;
++	pc_host->pci_ops.write = bcma_core_pci_hostmode_write_config;
++
++	pc_host->mem_resource.name = "BCMA PCIcore external memory",
++	pc_host->mem_resource.start = BCMA_SOC_PCI_DMA;
++	pc_host->mem_resource.end = BCMA_SOC_PCI_DMA + BCMA_SOC_PCI_DMA_SZ - 1;
++	pc_host->mem_resource.flags = IORESOURCE_MEM | IORESOURCE_PCI_FIXED;
++
++	pc_host->io_resource.name = "BCMA PCIcore external I/O",
++	pc_host->io_resource.start = 0x100;
++	pc_host->io_resource.end = 0x7FF;
++	pc_host->io_resource.flags = IORESOURCE_IO | IORESOURCE_PCI_FIXED;
++
++	/* Reset RC */
++	udelay(3000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST_OE);
++	udelay(1000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST |
++			BCMA_CORE_PCI_CTL_RST_OE);
++
++	/* 64 MB I/O access window. On 4716, use
++	 * sbtopcie0 to access the device registers. We
++	 * can't use address match 2 (1 GB window) region
++	 * as mips can't generate 64-bit address on the
++	 * backplane.
++	 */
++	if (bus->chipinfo.id == 0x4716 || bus->chipinfo.id == 0x4748) {
++		pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++		pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++					    BCMA_SOC_PCI_MEM_SZ - 1;
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_MEM | BCMA_SOC_PCI_MEM);
++	} else if (bus->chipinfo.id == 0x5300) {
++		tmp = BCMA_CORE_PCI_SBTOPCI_MEM;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_PREF;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_BURST;
++		if (pc->core->core_unit == 0) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE_DMA_H32;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI_MEM);
++		} else if (pc->core->core_unit == 1) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI1_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI1_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE1_DMA_H32;
++			pc_host->host_cfg_addr = BCMA_SOC_PCI1_CFG;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI1_MEM);
++		}
++	} else
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_IO);
++
++	/* 64 MB configuration access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++
++	/* 1 GB memory access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI2,
++			BCMA_CORE_PCI_SBTOPCI_MEM | pci_membase_1G);
++
++
++	/* As per PCI Express Base Spec 1.1 we need to wait for
++	 * at least 100 ms from the end of a reset (cold/warm/hot)
++	 * before issuing configuration requests to PCI Express
++	 * devices.
++	 */
++	udelay(100000);
++
++	bcma_core_pci_enable_crs(pc);
++
++	/* Enable PCI bridge BAR0 memory & master access */
++	tmp = PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
++	bcma_extpci_write_config(pc, 0, 0, PCI_COMMAND, &tmp, sizeof(tmp));
++
++	/* Enable PCI interrupts */
++	pcicore_write32(pc, BCMA_CORE_PCI_IMASK, BCMA_CORE_PCI_IMASK_INTA);
++
++	/* Ok, ready to run, register it to the system.
++	 * The following needs change, if we want to port hostmode
++	 * to non-MIPS platform. */
++	io_map_base = (unsigned long)ioremap_nocache(BCMA_SOC_PCI_MEM,
++						     0x04000000);
++	pc_host->pci_controller.io_map_base = io_map_base;
++	set_io_port_base(pc_host->pci_controller.io_map_base);
++	/* Give some time to the PCI controller to configure itself with the new
++	 * values. Not waiting at this point causes crashes of the machine. */
++	mdelay(10);
++	register_pci_controller(&pc_host->pci_controller);
++	return;
++}
++
++/* Early PCI fixup for a device on the PCI-core bridge. */
++static void bcma_core_pci_fixup_pcibridge(struct pci_dev *dev)
++{
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) != 0)
++		return;
++
++	pr_info("PCI: Fixing up bridge %s\n", pci_name(dev));
++
++	/* Enable PCI bridge bus mastering and memory space */
++	pci_set_master(dev);
++	if (pcibios_enable_device(dev, ~0) < 0) {
++		pr_err("PCI: BCMA bridge enable failed\n");
++		return;
++	}
++
++	/* Enable PCI bridge BAR1 prefetch and burst */
++	pci_write_config_dword(dev, BCMA_PCI_BAR1_CONTROL, 3);
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_pcibridge);
++
++/* Early PCI fixup for all PCI-cores to set the correct memory address. */
++static void bcma_core_pci_fixup_addresses(struct pci_dev *dev)
++{
++	struct resource *res;
++	int pos;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) == 0)
++		return;
++
++	pr_info("PCI: Fixing up addresses %s\n", pci_name(dev));
++
++	for (pos = 0; pos < 6; pos++) {
++		res = &dev->resource[pos];
++		if (res->flags & (IORESOURCE_IO | IORESOURCE_MEM))
++			pci_assign_resource(dev, pos);
++	}
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_addresses);
++
++/* This function is called when doing a pci_enable_device().
++ * We must first check if the device is a device on the PCI-core bridge. */
++int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++
++	pr_info("PCI: Fixing up device %s\n", pci_name(dev));
++
++	/* Fix up interrupt lines */
++	dev->irq = bcma_core_mips_irq(pc_host->pdev->core) + 2;
++	pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
++
++	return 0;
++}
++EXPORT_SYMBOL(bcma_core_pci_plat_dev_init);
++
++/* PCI device IRQ mapping. */
++int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++	return bcma_core_mips_irq(pc_host->pdev->core) + 2;
 +}
++EXPORT_SYMBOL(bcma_core_pci_pcibios_map_irq);
 --- /dev/null
 +++ b/drivers/bcma/driver_mips.c
 @@ -0,0 +1,256 @@
diff --git a/target/linux/generic/patches-2.6.38/020-ssb_update.patch b/target/linux/generic/patches-2.6.38/020-ssb_update.patch
index 8269ac3447..8578f75310 100644
--- a/target/linux/generic/patches-2.6.38/020-ssb_update.patch
+++ b/target/linux/generic/patches-2.6.38/020-ssb_update.patch
@@ -17,7 +17,49 @@
  #include <linux/ssb/ssb.h>
  #include <linux/ssb/ssb_regs.h>
  #include <linux/ssb/ssb_driver_gige.h>
-@@ -557,7 +558,7 @@ error:
+@@ -139,19 +140,6 @@ static void ssb_device_put(struct ssb_de
+ 		put_device(dev->dev);
+ }
+ 
+-static inline struct ssb_driver *ssb_driver_get(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		get_driver(&drv->drv);
+-	return drv;
+-}
+-
+-static inline void ssb_driver_put(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		put_driver(&drv->drv);
+-}
+-
+ static int ssb_device_resume(struct device *dev)
+ {
+ 	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
+@@ -249,11 +237,9 @@ int ssb_devices_freeze(struct ssb_bus *b
+ 			ssb_device_put(sdev);
+ 			continue;
+ 		}
+-		sdrv = ssb_driver_get(drv_to_ssb_drv(sdev->dev->driver));
+-		if (!sdrv || SSB_WARN_ON(!sdrv->remove)) {
+-			ssb_device_put(sdev);
++		sdrv = drv_to_ssb_drv(sdev->dev->driver);
++		if (SSB_WARN_ON(!sdrv->remove))
+ 			continue;
+-		}
+ 		sdrv->remove(sdev);
+ 		ctx->device_frozen[i] = 1;
+ 	}
+@@ -292,7 +278,6 @@ int ssb_devices_thaw(struct ssb_freeze_c
+ 				   dev_name(sdev->dev));
+ 			result = err;
+ 		}
+-		ssb_driver_put(sdrv);
+ 		ssb_device_put(sdev);
+ 	}
+ 
+@@ -557,7 +542,7 @@ error:
  }
  
  /* Needs ssb_buses_lock() */
@@ -26,7 +68,7 @@
  {
  	struct ssb_bus *bus, *n;
  	int err = 0;
-@@ -768,9 +769,9 @@ out:
+@@ -768,9 +753,9 @@ out:
  	return err;
  }
  
@@ -39,7 +81,7 @@
  {
  	int err;
  
-@@ -851,8 +852,8 @@ err_disable_xtal:
+@@ -851,8 +836,8 @@ err_disable_xtal:
  }
  
  #ifdef CONFIG_SSB_PCIHOST
@@ -50,7 +92,7 @@
  {
  	int err;
  
-@@ -875,9 +876,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
+@@ -875,9 +860,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
  #endif /* CONFIG_SSB_PCIHOST */
  
  #ifdef CONFIG_SSB_PCMCIAHOST
@@ -63,7 +105,7 @@
  {
  	int err;
  
-@@ -897,8 +898,9 @@ EXPORT_SYMBOL(ssb_bus_pcmciabus_register
+@@ -897,8 +882,9 @@ EXPORT_SYMBOL(ssb_bus_pcmciabus_register
  #endif /* CONFIG_SSB_PCMCIAHOST */
  
  #ifdef CONFIG_SSB_SDIOHOST
@@ -75,7 +117,7 @@
  {
  	int err;
  
-@@ -918,9 +920,9 @@ int ssb_bus_sdiobus_register(struct ssb_
+@@ -918,9 +904,9 @@ int ssb_bus_sdiobus_register(struct ssb_
  EXPORT_SYMBOL(ssb_bus_sdiobus_register);
  #endif /* CONFIG_SSB_PCMCIAHOST */
  
@@ -88,7 +130,7 @@
  {
  	int err;
  
-@@ -1001,8 +1003,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
+@@ -1001,8 +987,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
  	switch (plltype) {
  	case SSB_PLLTYPE_6: /* 100/200 or 120/240 only */
  		if (m & SSB_CHIPCO_CLK_T6_MMASK)
@@ -99,7 +141,17 @@
  	case SSB_PLLTYPE_1: /* 48Mhz base, 3 dividers */
  	case SSB_PLLTYPE_3: /* 25Mhz, 2 dividers */
  	case SSB_PLLTYPE_4: /* 48Mhz, 4 dividers */
-@@ -1117,23 +1119,22 @@ static u32 ssb_tmslow_reject_bitmask(str
+@@ -1092,6 +1078,9 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
+ 	u32 plltype;
+ 	u32 clkctl_n, clkctl_m;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_controlclock(&bus->chipco);
++
+ 	if (ssb_extif_available(&bus->extif))
+ 		ssb_extif_get_clockcontrol(&bus->extif, &plltype,
+ 					   &clkctl_n, &clkctl_m);
+@@ -1117,23 +1106,22 @@ static u32 ssb_tmslow_reject_bitmask(str
  {
  	u32 rev = ssb_read32(dev, SSB_IDLOW) & SSB_IDLOW_SSBREV;
  
@@ -130,7 +182,7 @@
  }
  
  int ssb_device_is_enabled(struct ssb_device *dev)
-@@ -1192,10 +1193,10 @@ void ssb_device_enable(struct ssb_device
+@@ -1192,10 +1180,10 @@ void ssb_device_enable(struct ssb_device
  }
  EXPORT_SYMBOL(ssb_device_enable);
  
@@ -144,7 +196,7 @@
  {
  	int i;
  	u32 val;
-@@ -1203,7 +1204,7 @@ static int ssb_wait_bit(struct ssb_devic
+@@ -1203,7 +1191,7 @@ static int ssb_wait_bit(struct ssb_devic
  	for (i = 0; i < timeout; i++) {
  		val = ssb_read32(dev, reg);
  		if (set) {
@@ -153,7 +205,7 @@
  				return 0;
  		} else {
  			if (!(val & bitmask))
-@@ -1220,20 +1221,38 @@ static int ssb_wait_bit(struct ssb_devic
+@@ -1220,20 +1208,38 @@ static int ssb_wait_bit(struct ssb_devic
  
  void ssb_device_disable(struct ssb_device *dev, u32 core_specific_flags)
  {
@@ -201,7 +253,7 @@
  
  	ssb_write32(dev, SSB_TMSLOW,
  		    reject | SSB_TMSLOW_RESET |
-@@ -1242,13 +1261,34 @@ void ssb_device_disable(struct ssb_devic
+@@ -1242,13 +1248,34 @@ void ssb_device_disable(struct ssb_devic
  }
  EXPORT_SYMBOL(ssb_device_disable);
  
@@ -237,7 +289,7 @@
  	default:
  		__ssb_dma_not_implemented(dev);
  	}
-@@ -1291,20 +1331,20 @@ EXPORT_SYMBOL(ssb_bus_may_powerdown);
+@@ -1291,20 +1318,20 @@ EXPORT_SYMBOL(ssb_bus_may_powerdown);
  
  int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl)
  {
@@ -262,7 +314,7 @@
  	return 0;
  error:
  	ssb_printk(KERN_ERR PFX "Bus powerup failed\n");
-@@ -1312,6 +1352,37 @@ error:
+@@ -1312,6 +1339,37 @@ error:
  }
  EXPORT_SYMBOL(ssb_bus_powerup);
  
@@ -311,7 +363,42 @@
   * Copyright (C) 2005 Martin Langer <martin-langer@gmx.de>
   * Copyright (C) 2005 Stefano Brivio <st3@riseup.net>
   * Copyright (C) 2005 Danny van Dyk <kugelfang@gentoo.org>
-@@ -468,10 +468,14 @@ static void sprom_extract_r45(struct ssb
+@@ -331,7 +331,6 @@ static void sprom_extract_r123(struct ss
+ {
+ 	int i;
+ 	u16 v;
+-	s8 gain;
+ 	u16 loc[3];
+ 
+ 	if (out->revision == 3)			/* rev 3 moved MAC */
+@@ -390,20 +389,12 @@ static void sprom_extract_r123(struct ss
+ 		SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_BG,
+-				    SSB_SPROM1_AGAIN_BG_SHIFT);
+-	out->antenna_gain.ghz24.a0 = gain;
+-	out->antenna_gain.ghz24.a1 = gain;
+-	out->antenna_gain.ghz24.a2 = gain;
+-	out->antenna_gain.ghz24.a3 = gain;
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_A,
+-				    SSB_SPROM1_AGAIN_A_SHIFT);
+-	out->antenna_gain.ghz5.a0 = gain;
+-	out->antenna_gain.ghz5.a1 = gain;
+-	out->antenna_gain.ghz5.a2 = gain;
+-	out->antenna_gain.ghz5.a3 = gain;
++	out->antenna_gain.a0 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_BG,
++						    SSB_SPROM1_AGAIN_BG_SHIFT);
++	out->antenna_gain.a1 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_A,
++						    SSB_SPROM1_AGAIN_A_SHIFT);
+ }
+ 
+ /* Revs 4 5 and 8 have partially shared layout */
+@@ -468,10 +459,14 @@ static void sprom_extract_r45(struct ssb
  		SPEX(country_code, SSB_SPROM4_CCODE, 0xFFFF, 0);
  		SPEX(boardflags_lo, SSB_SPROM4_BFLLO, 0xFFFF, 0);
  		SPEX(boardflags_hi, SSB_SPROM4_BFLHI, 0xFFFF, 0);
@@ -326,7 +413,28 @@
  	}
  	SPEX(ant_available_a, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_A,
  	     SSB_SPROM4_ANTAVAIL_A_SHIFT);
-@@ -519,7 +523,13 @@ static void sprom_extract_r45(struct ssb
+@@ -500,16 +495,14 @@ static void sprom_extract_r45(struct ssb
+ 	}
+ 
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN0, SSB_SPROM4_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN1, SSB_SPROM4_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN2, SSB_SPROM4_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN3, SSB_SPROM4_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
+ 
+ 	sprom_extract_r458(out, in);
+ 
+@@ -519,7 +512,13 @@ static void sprom_extract_r45(struct ssb
  static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
  {
  	int i;
@@ -341,10 +449,25 @@
  
  	/* extract the MAC address */
  	for (i = 0; i < 3; i++) {
-@@ -603,6 +613,61 @@ static void sprom_extract_r8(struct ssb_
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
- 
+@@ -592,16 +591,69 @@ static void sprom_extract_r8(struct ssb_
+ 	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
++
 +	/* Extract cores power info info */
 +	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
 +		o = pwr_info_offset[i];
@@ -399,11 +522,10 @@
 +		SSB_SROM8_FEM_TR_ISO, SSB_SROM8_FEM_TR_ISO_SHIFT);
 +	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G,
 +		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
-+
+ 
  	sprom_extract_r458(out, in);
  
- 	/* TODO - get remaining rev 8 stuff needed */
-@@ -641,7 +706,7 @@ static int sprom_extract(struct ssb_bus
+@@ -641,7 +693,7 @@ static int sprom_extract(struct ssb_bus
  		break;
  	default:
  		ssb_printk(KERN_WARNING PFX "Unsupported SPROM"
@@ -412,7 +534,7 @@
  			   " v1\n", out->revision);
  		out->revision = 1;
  		sprom_extract_r123(out, in);
-@@ -658,7 +723,6 @@ static int sprom_extract(struct ssb_bus
+@@ -658,7 +710,6 @@ static int sprom_extract(struct ssb_bus
  static int ssb_pci_sprom_get(struct ssb_bus *bus,
  			     struct ssb_sprom *sprom)
  {
@@ -420,7 +542,7 @@
  	int err;
  	u16 *buf;
  
-@@ -666,7 +730,7 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -666,7 +717,7 @@ static int ssb_pci_sprom_get(struct ssb_
  		ssb_printk(KERN_ERR PFX "No SPROM available!\n");
  		return -ENODEV;
  	}
@@ -429,7 +551,7 @@
  		/*
  		 * get SPROM offset: SSB_SPROM_BASE1 except for
  		 * chipcommon rev >= 31 or chip ID is 0x4312 and
-@@ -703,10 +767,17 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -703,10 +754,17 @@ static int ssb_pci_sprom_get(struct ssb_
  		if (err) {
  			/* All CRC attempts failed.
  			 * Maybe there is no SPROM on the device?
@@ -451,7 +573,7 @@
  				err = 0;
  				goto out_free;
  			}
-@@ -724,12 +795,9 @@ out_free:
+@@ -724,12 +782,9 @@ out_free:
  static void ssb_pci_get_boardinfo(struct ssb_bus *bus,
  				  struct ssb_boardinfo *bi)
  {
@@ -738,7 +860,53 @@
   * Copyright 2007, Broadcom Corporation
   *
   * Licensed under the GNU/GPL. See COPYING for details.
-@@ -417,12 +417,14 @@ static void ssb_pmu_resources_init(struc
+@@ -12,6 +12,9 @@
+ #include <linux/ssb/ssb_regs.h>
+ #include <linux/ssb/ssb_driver_chipcommon.h>
+ #include <linux/delay.h>
++#ifdef CONFIG_BCM47XX
++#include <asm/mach-bcm47xx/nvram.h>
++#endif
+ 
+ #include "ssb_private.h"
+ 
+@@ -91,10 +94,6 @@ static void ssb_pmu0_pllinit_r0(struct s
+ 	u32 pmuctl, tmp, pllctl;
+ 	unsigned int i;
+ 
+-	if ((bus->chip_id == 0x5354) && !crystalfreq) {
+-		/* The 5354 crystal freq is 25MHz */
+-		crystalfreq = 25000;
+-	}
+ 	if (crystalfreq)
+ 		e = pmu0_plltab_find_entry(crystalfreq);
+ 	if (!e)
+@@ -320,7 +319,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 	u32 crystalfreq = 0; /* in kHz. 0 = keep default freq. */
+ 
+ 	if (bus->bustype == SSB_BUSTYPE_SSB) {
+-		/* TODO: The user may override the crystal frequency. */
++#ifdef CONFIG_BCM47XX
++		char buf[20];
++		if (nvram_getenv("xtalfreq", buf, sizeof(buf)) >= 0)
++			crystalfreq = simple_strtoul(buf, NULL, 0);
++#endif
+ 	}
+ 
+ 	switch (bus->chip_id) {
+@@ -329,7 +332,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 		ssb_pmu1_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4328:
++		ssb_pmu0_pllinit_r0(cc, crystalfreq);
++		break;
+ 	case 0x5354:
++		if (crystalfreq == 0)
++			crystalfreq = 25000;
+ 		ssb_pmu0_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4322:
+@@ -417,12 +424,14 @@ static void ssb_pmu_resources_init(struc
  	u32 min_msk = 0, max_msk = 0;
  	unsigned int i;
  	const struct pmu_res_updown_tab_entry *updown_tab = NULL;
@@ -755,6 +923,41 @@
  	case 0x4322:
  		/* We keep the default settings:
  		 * min_msk = 0xCBB
+@@ -604,3 +613,34 @@ void ssb_pmu_set_ldo_paref(struct ssb_ch
+ 
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_voltage);
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_paref);
++
++u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		/* 5354 chip uses a non programmable PLL of frequency 240MHz */
++		return 240000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU cpu clock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
++
++u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		return 120000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU controlclock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
 --- a/drivers/ssb/driver_gige.c
 +++ b/drivers/ssb/driver_gige.c
 @@ -3,7 +3,7 @@
@@ -823,6 +1026,15 @@
  
  static inline
  u32 pcicore_read32(struct ssb_pcicore *pc, u16 offset)
+@@ -69,7 +74,7 @@ static u32 get_cfgspace_addr(struct ssb_
+ 	u32 tmp;
+ 
+ 	/* We do only have one cardbus device behind the bridge. */
+-	if (pc->cardbusmode && (dev >= 1))
++	if (pc->cardbusmode && (dev > 1))
+ 		goto out;
+ 
+ 	if (bus == 0) {
 @@ -309,7 +314,7 @@ int ssb_pcicore_pcibios_map_irq(const st
  	return ssb_mips_irq(extpci_core->dev) + 2;
  }
@@ -1229,6 +1441,16 @@
  			bus->chip_package = 0;
  		} else {
  			bus->chip_id = 0x4710;
+@@ -316,6 +318,9 @@ int ssb_bus_scan(struct ssb_bus *bus,
+ 			bus->chip_package = 0;
+ 		}
+ 	}
++	ssb_printk(KERN_INFO PFX "Found chip with id 0x%04X, rev 0x%02X and "
++		   "package 0x%02X\n", bus->chip_id, bus->chip_rev,
++		   bus->chip_package);
+ 	if (!bus->nr_devices)
+ 		bus->nr_devices = chipid_to_nrcores(bus->chip_id);
+ 	if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
 --- a/drivers/ssb/sprom.c
 +++ b/drivers/ssb/sprom.c
 @@ -2,7 +2,7 @@
@@ -1333,6 +1555,15 @@
  
  
  /* core.c */
+@@ -206,4 +207,8 @@ static inline void b43_pci_ssb_bridge_ex
+ }
+ #endif /* CONFIG_SSB_B43_PCI_BRIDGE */
+ 
++/* driver_chipcommon_pmu.c */
++extern u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc);
++extern u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc);
++
+ #endif /* LINUX_SSB_PRIVATE_H_ */
 --- a/include/linux/ssb/ssb.h
 +++ b/include/linux/ssb/ssb.h
 @@ -16,6 +16,12 @@ struct pcmcia_device;
@@ -1342,25 +1573,54 @@
 +struct ssb_sprom_core_pwr_info {
 +	u8 itssi_2g, itssi_5g;
 +	u8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh;
-+	u16 pa_2g[3], pa_5gl[3], pa_5g[3], pa_5gh[3];
++	u16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4];
 +};
 +
  struct ssb_sprom {
  	u8 revision;
  	u8 il0mac[6];		/* MAC address for 802.11b/g */
-@@ -25,8 +31,10 @@ struct ssb_sprom {
+@@ -25,8 +31,13 @@ struct ssb_sprom {
  	u8 et1phyaddr;		/* MII address for enet1 */
  	u8 et0mdcport;		/* MDIO for enet0 */
  	u8 et1mdcport;		/* MDIO for enet1 */
 -	u8 board_rev;		/* Board revision number from SPROM. */
 +	u16 board_rev;		/* Board revision number from SPROM. */
++	u16 board_num;		/* Board number from SPROM. */
++	u16 board_type;		/* Board type from SPROM. */
  	u8 country_code;	/* Country Code */
-+	u16 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
-+	u16 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
++	char alpha2[2];		/* Country Code as two chars like EU or US */
++	u8 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
++	u8 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
  	u8 ant_available_a;	/* 2GHz antenna available bits (up to 4) */
  	u8 ant_available_bg;	/* 5GHz antenna available bits (up to 4) */
  	u16 pa0b0;
-@@ -80,6 +88,8 @@ struct ssb_sprom {
+@@ -45,10 +56,10 @@ struct ssb_sprom {
+ 	u8 gpio1;		/* GPIO pin 1 */
+ 	u8 gpio2;		/* GPIO pin 2 */
+ 	u8 gpio3;		/* GPIO pin 3 */
+-	u16 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
+ 	u8 itssi_a;		/* Idle TSSI Target for A-PHY */
+ 	u8 itssi_bg;		/* Idle TSSI Target for B/G-PHY */
+ 	u8 tri2g;		/* 2.4GHz TX isolation */
+@@ -59,8 +70,8 @@ struct ssb_sprom {
+ 	u8 txpid5gl[4];		/* 4.9 - 5.1GHz TX power index */
+ 	u8 txpid5g[4];		/* 5.1 - 5.5GHz TX power index */
+ 	u8 txpid5gh[4];		/* 5.5 - ...GHz TX power index */
+-	u8 rxpo2g;		/* 2GHz RX power offset */
+-	u8 rxpo5g;		/* 5GHz RX power offset */
++	s8 rxpo2g;		/* 2GHz RX power offset */
++	s8 rxpo5g;		/* 5GHz RX power offset */
+ 	u8 rssisav2g;		/* 2GHz RSSI params */
+ 	u8 rssismc2g;
+ 	u8 rssismf2g;
+@@ -80,26 +91,104 @@ struct ssb_sprom {
  	u16 boardflags2_hi;	/* Board flags (bits 48-63) */
  	/* TODO store board flags in a single u64 */
  
@@ -1369,10 +1629,17 @@
  	/* Antenna gain values for up to 4 antennas
  	 * on each band. Values in dBm/4 (Q5.2). Negative gain means the
  	 * loss in the connectors is bigger than the gain. */
-@@ -92,6 +102,15 @@ struct ssb_sprom {
- 		} ghz5;		/* 5GHz band */
+ 	struct {
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz24;	/* 2.4GHz band */
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz5;		/* 5GHz band */
++		s8 a0, a1, a2, a3;
  	} antenna_gain;
  
+-	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
 +	struct {
 +		struct {
 +			u8 tssipos, extpa_gain, pdet_range, tr_iso, antswlut;
@@ -1382,10 +1649,82 @@
 +		} ghz5;
 +	} fem;
 +
- 	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
++	u16 mcs2gpo[8];
++	u16 mcs5gpo[8];
++	u16 mcs5glpo[8];
++	u16 mcs5ghpo[8];
++	u8 opo;
++
++	u8 rxgainerr2ga[3];
++	u8 rxgainerr5gla[3];
++	u8 rxgainerr5gma[3];
++	u8 rxgainerr5gha[3];
++	u8 rxgainerr5gua[3];
++
++	u8 noiselvl2ga[3];
++	u8 noiselvl5gla[3];
++	u8 noiselvl5gma[3];
++	u8 noiselvl5gha[3];
++	u8 noiselvl5gua[3];
++
++	u8 regrev;
++	u8 txchain;
++	u8 rxchain;
++	u8 antswitch;
++	u16 cddpo;
++	u16 stbcpo;
++	u16 bw40po;
++	u16 bwduppo;
++
++	u8 tempthresh;
++	u8 tempoffset;
++	u16 rawtempsense;
++	u8 measpower;
++	u8 tempsense_slope;
++	u8 tempcorrx;
++	u8 tempsense_option;
++	u8 freqoffset_corr;
++	u8 iqcal_swp_dis;
++	u8 hw_iqcal_en;
++	u8 elna2g;
++	u8 elna5g;
++	u8 phycal_tempdelta;
++	u8 temps_period;
++	u8 temps_hysteresis;
++	u8 measpower1;
++	u8 measpower2;
++	u8 pcieingress_war;
++
++	/* power per rate from sromrev 9 */
++	u16 cckbw202gpo;
++	u16 cckbw20ul2gpo;
++	u32 legofdmbw202gpo;
++	u32 legofdmbw20ul2gpo;
++	u32 legofdmbw205glpo;
++	u32 legofdmbw20ul5glpo;
++	u32 legofdmbw205gmpo;
++	u32 legofdmbw20ul5gmpo;
++	u32 legofdmbw205ghpo;
++	u32 legofdmbw20ul5ghpo;
++	u32 mcsbw202gpo;
++	u32 mcsbw20ul2gpo;
++	u32 mcsbw402gpo;
++	u32 mcsbw205glpo;
++	u32 mcsbw20ul5glpo;
++	u32 mcsbw405glpo;
++	u32 mcsbw205gmpo;
++	u32 mcsbw20ul5gmpo;
++	u32 mcsbw405gmpo;
++	u32 mcsbw205ghpo;
++	u32 mcsbw20ul5ghpo;
++	u32 mcsbw405ghpo;
++	u16 mcs32po;
++	u16 legofdm40duppo;
++	u8 sar2g;
++	u8 sar5g;
  };
  
-@@ -99,7 +118,7 @@ struct ssb_sprom {
+ /* Information about the PCB the circuitry is soldered on. */
  struct ssb_boardinfo {
  	u16 vendor;
  	u16 type;
@@ -1394,7 +1733,7 @@
  };
  
  
-@@ -229,10 +248,9 @@ struct ssb_driver {
+@@ -229,10 +318,9 @@ struct ssb_driver {
  #define drv_to_ssb_drv(_drv) container_of(_drv, struct ssb_driver, drv)
  
  extern int __ssb_driver_register(struct ssb_driver *drv, struct module *owner);
@@ -1408,7 +1747,7 @@
  extern void ssb_driver_unregister(struct ssb_driver *drv);
  
  
-@@ -308,7 +326,7 @@ struct ssb_bus {
+@@ -308,7 +396,7 @@ struct ssb_bus {
  
  	/* ID information about the Chip. */
  	u16 chip_id;
@@ -1417,7 +1756,7 @@
  	u16 sprom_offset;
  	u16 sprom_size;		/* number of words in sprom */
  	u8 chip_package;
-@@ -404,7 +422,9 @@ extern bool ssb_is_sprom_available(struc
+@@ -404,7 +492,9 @@ extern bool ssb_is_sprom_available(struc
  
  /* Set a fallback SPROM.
   * See kdoc at the function definition for complete documentation. */
@@ -1428,7 +1767,7 @@
  
  /* Suspend a SSB bus.
   * Call this from the parent bus suspend routine. */
-@@ -518,6 +538,7 @@ extern int ssb_bus_may_powerdown(struct
+@@ -518,6 +608,7 @@ extern int ssb_bus_may_powerdown(struct
   * Otherwise static always-on powercontrol will be used. */
  extern int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl);
  
@@ -1518,6 +1857,16 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
+@@ -208,6 +208,9 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 	u32 pll_type, n, m, rate = 0;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_cpu_clock(&bus->chipco);
++
+ 	if (bus->extif.dev) {
+ 		ssb_extif_get_clockcontrol(&bus->extif, &pll_type, &n, &m);
+ 	} else if (bus->chipco.dev) {
 --- a/drivers/ssb/embedded.c
 +++ b/drivers/ssb/embedded.c
 @@ -3,7 +3,7 @@
@@ -1540,6 +1889,25 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
+@@ -676,14 +676,10 @@ static int ssb_pcmcia_do_get_invariants(
+ 	case SSB_PCMCIA_CIS_ANTGAIN:
+ 		GOTO_ERROR_ON(tuple->TupleDataLen != 2,
+ 			"antg tpl size");
+-		sprom->antenna_gain.ghz24.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a3 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a3 = tuple->TupleData[1];
++		sprom->antenna_gain.a0 = tuple->TupleData[1];
++		sprom->antenna_gain.a1 = tuple->TupleData[1];
++		sprom->antenna_gain.a2 = tuple->TupleData[1];
++		sprom->antenna_gain.a3 = tuple->TupleData[1];
+ 		break;
+ 	case SSB_PCMCIA_CIS_BFLAGS:
+ 		GOTO_ERROR_ON((tuple->TupleDataLen != 3) &&
 --- a/drivers/ssb/sdio.c
 +++ b/drivers/ssb/sdio.c
 @@ -6,7 +6,7 @@
@@ -1551,3 +1919,32 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   *
+@@ -551,14 +551,10 @@ int ssb_sdio_get_invariants(struct ssb_b
+ 			case SSB_SDIO_CIS_ANTGAIN:
+ 				GOTO_ERROR_ON(tuple->size != 2,
+ 					      "antg tpl size");
+-				sprom->antenna_gain.ghz24.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a3 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a3 = tuple->data[1];
++				sprom->antenna_gain.a0 = tuple->data[1];
++				sprom->antenna_gain.a1 = tuple->data[1];
++				sprom->antenna_gain.a2 = tuple->data[1];
++				sprom->antenna_gain.a3 = tuple->data[1];
+ 				break;
+ 			case SSB_SDIO_CIS_BFLAGS:
+ 				GOTO_ERROR_ON((tuple->size != 3) &&
+--- a/include/linux/ssb/ssb_driver_gige.h
++++ b/include/linux/ssb/ssb_driver_gige.h
+@@ -2,6 +2,7 @@
+ #define LINUX_SSB_DRIVER_GIGE_H_
+ 
+ #include <linux/ssb/ssb.h>
++#include <linux/bug.h>
+ #include <linux/pci.h>
+ #include <linux/spinlock.h>
+ 
diff --git a/target/linux/generic/patches-2.6.38/025-bcma_backport.patch b/target/linux/generic/patches-2.6.38/025-bcma_backport.patch
index 60fefaf452..db2292ad96 100644
--- a/target/linux/generic/patches-2.6.38/025-bcma_backport.patch
+++ b/target/linux/generic/patches-2.6.38/025-bcma_backport.patch
@@ -103,7 +103,7 @@
 +
 +config BCMA_DRIVER_PCI_HOSTMODE
 +	bool "Driver for PCI core working in hostmode"
-+	depends on BCMA && MIPS
++	depends on BCMA && MIPS && BCMA_HOST_PCI
 +	help
 +	  PCI core hostmode operation (external PCI bus).
 +
@@ -172,7 +172,7 @@
 +- Create kernel Documentation (use info from README)
 --- /dev/null
 +++ b/drivers/bcma/bcma_private.h
-@@ -0,0 +1,54 @@
+@@ -0,0 +1,59 @@
 +#ifndef LINUX_BCMA_PRIVATE_H_
 +#define LINUX_BCMA_PRIVATE_H_
 +
@@ -188,12 +188,13 @@
 +struct bcma_bus;
 +
 +/* main.c */
-+int bcma_bus_register(struct bcma_bus *bus);
++int __devinit bcma_bus_register(struct bcma_bus *bus);
 +void bcma_bus_unregister(struct bcma_bus *bus);
 +int __init bcma_bus_early_register(struct bcma_bus *bus,
 +				   struct bcma_device *core_cc,
 +				   struct bcma_device *core_mips);
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus);
 +int bcma_bus_resume(struct bcma_bus *bus);
 +#endif
 +
@@ -222,8 +223,12 @@
 +extern void __exit bcma_host_pci_exit(void);
 +#endif /* CONFIG_BCMA_HOST_PCI */
 +
++/* driver_pci.c */
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address);
++
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc);
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
 +
 +#endif
@@ -517,7 +522,7 @@
 +#endif /* CONFIG_BCMA_DRIVER_MIPS */
 --- /dev/null
 +++ b/drivers/bcma/driver_chipcommon_pmu.c
-@@ -0,0 +1,309 @@
+@@ -0,0 +1,310 @@
 +/*
 + * Broadcom specific AMBA
 + * ChipCommon Power Management Unit driver
@@ -599,6 +604,7 @@
 +		min_msk = 0x200D;
 +		max_msk = 0xFFFF;
 +		break;
++	case 0x4331:
 +	case 43224:
 +	case 43225:
 +		break;
@@ -829,13 +835,14 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/driver_pci.c
-@@ -0,0 +1,237 @@
+@@ -0,0 +1,225 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Core
 + *
-+ * Copyright 2005, Broadcom Corporation
++ * Copyright 2005, 2011, Broadcom Corporation
 + * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
 + *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
@@ -847,40 +854,41 @@
 + * R/W ops.
 + **************************************************/
 +
-+static u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
 +{
-+	pcicore_write32(pc, 0x130, address);
-+	pcicore_read32(pc, 0x130);
-+	return pcicore_read32(pc, 0x134);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_DATA);
 +}
 +
 +#if 0
 +static void bcma_pcie_write(struct bcma_drv_pci *pc, u32 address, u32 data)
 +{
-+	pcicore_write32(pc, 0x130, address);
-+	pcicore_read32(pc, 0x130);
-+	pcicore_write32(pc, 0x134, data);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_DATA, data);
 +}
 +#endif
 +
 +static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u8 phy)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	u32 v;
 +	int i;
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 28); /* Write Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	v |= (0x1F << 18);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++	v |= (BCMA_CORE_PCI_MDIODATA_BLK_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
 +	v |= (phy << 4);
-+	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +
 +	udelay(10);
 +	for (i = 0; i < 200; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
 +			break;
 +		msleep(1);
 +	}
@@ -888,79 +896,84 @@
 +
 +static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u8 device, u8 address)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	int max_retries = 10;
 +	u16 ret = 0;
 +	u32 v;
 +	int i;
 +
-+	v = 0x80; /* Enable Preamble Sequence */
-+	v |= 0x2; /* MDIO Clock Divisor */
-+	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
 +
 +	if (pc->core->id.rev >= 10) {
 +		max_retries = 200;
 +		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 +	}
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 29); /* Read Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	if (pc->core->id.rev < 10)
-+		v |= (u32)device << 22;
-+	v |= (u32)address << 18;
-+	pcicore_write32(pc, mdio_data, v);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_READ;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
++
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +	/* Wait for the device to complete the transaction */
 +	udelay(10);
 +	for (i = 0; i < max_retries; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */) {
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE) {
 +			udelay(10);
-+			ret = pcicore_read32(pc, mdio_data);
++			ret = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_DATA);
 +			break;
 +		}
 +		msleep(1);
 +	}
-+	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
 +	return ret;
 +}
 +
 +static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u8 device,
 +				u8 address, u16 data)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	int max_retries = 10;
 +	u32 v;
 +	int i;
 +
-+	v = 0x80; /* Enable Preamble Sequence */
-+	v |= 0x2; /* MDIO Clock Divisor */
-+	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
 +
 +	if (pc->core->id.rev >= 10) {
 +		max_retries = 200;
 +		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 +	}
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 28); /* Write Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	if (pc->core->id.rev < 10)
-+		v |= (u32)device << 22;
-+	v |= (u32)address << 18;
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
 +	v |= data;
-+	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +	/* Wait for the device to complete the transaction */
 +	udelay(10);
 +	for (i = 0; i < max_retries; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
 +			break;
 +		msleep(1);
 +	}
-+	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
 +}
 +
 +/**************************************************
@@ -969,72 +982,53 @@
 +
 +static u8 bcma_pcicore_polarity_workaround(struct bcma_drv_pci *pc)
 +{
-+	return (bcma_pcie_read(pc, 0x204) & 0x10) ? 0xC0 : 0x80;
++	u32 tmp;
++
++	tmp = bcma_pcie_read(pc, BCMA_CORE_PCI_PLP_STATUSREG);
++	if (tmp & BCMA_CORE_PCI_PLP_POLARITYINV_STAT)
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE |
++		       BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY;
++	else
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE;
 +}
 +
 +static void bcma_pcicore_serdes_workaround(struct bcma_drv_pci *pc)
 +{
-+	const u8 serdes_pll_device = 0x1D;
-+	const u8 serdes_rx_device = 0x1F;
 +	u16 tmp;
 +
-+	bcma_pcie_mdio_write(pc, serdes_rx_device, 1 /* Control */,
-+			      bcma_pcicore_polarity_workaround(pc));
-+	tmp = bcma_pcie_mdio_read(pc, serdes_pll_device, 1 /* Control */);
-+	if (tmp & 0x4000)
-+		bcma_pcie_mdio_write(pc, serdes_pll_device, 1, tmp & ~0x4000);
++	bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_RX,
++	                     BCMA_CORE_PCI_SERDES_RX_CTRL,
++			     bcma_pcicore_polarity_workaround(pc));
++	tmp = bcma_pcie_mdio_read(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++	                          BCMA_CORE_PCI_SERDES_PLL_CTRL);
++	if (tmp & BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN)
++		bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++		                     BCMA_CORE_PCI_SERDES_PLL_CTRL,
++		                     tmp & ~BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN);
 +}
 +
 +/**************************************************
 + * Init.
 + **************************************************/
 +
-+static void bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
++static void __devinit bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
 +{
 +	bcma_pcicore_serdes_workaround(pc);
 +}
 +
-+static bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
-+{
-+	struct bcma_bus *bus = pc->core->bus;
-+	u16 chipid_top;
-+
-+	chipid_top = (bus->chipinfo.id & 0xFF00);
-+	if (chipid_top != 0x4700 &&
-+	    chipid_top != 0x5300)
-+		return false;
-+
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
-+	if (bus->sprom.boardflags_lo & SSB_BFL_NOPCI)
-+		return false;
-+#endif /* CONFIG_SSB_DRIVER_PCICORE */
-+
-+#if 0
-+	/* TODO: on BCMA we use address from EROM instead of magic formula */
-+	u32 tmp;
-+	return !mips_busprobe32(tmp, (bus->mmio +
-+		(pc->core->core_index * BCMA_CORE_SIZE)));
-+#endif
-+
-+	return true;
-+}
-+
-+void bcma_core_pci_init(struct bcma_drv_pci *pc)
++void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
 +{
 +	if (pc->setup_done)
 +		return;
 +
-+	if (bcma_core_pci_is_in_hostmode(pc)) {
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	pc->hostmode = bcma_core_pci_is_in_hostmode(pc);
++	if (pc->hostmode)
 +		bcma_core_pci_hostmode_init(pc);
-+#else
-+		pr_err("Driver compiled without support for hostmode PCI\n");
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
-+	} else {
-+		bcma_core_pci_clientmode_init(pc);
-+	}
 +
-+	pc->setup_done = true;
++	if (!pc->hostmode)
++		bcma_core_pci_clientmode_init(pc);
 +}
 +
 +int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
@@ -1069,7 +1063,7 @@
 +EXPORT_SYMBOL_GPL(bcma_core_pci_irq_ctl);
 --- /dev/null
 +++ b/drivers/bcma/host_pci.c
-@@ -0,0 +1,299 @@
+@@ -0,0 +1,292 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Host
@@ -1226,8 +1220,8 @@
 +	.awrite32	= bcma_host_pci_awrite32,
 +};
 +
-+static int bcma_host_pci_probe(struct pci_dev *dev,
-+			     const struct pci_device_id *id)
++static int __devinit bcma_host_pci_probe(struct pci_dev *dev,
++					 const struct pci_device_id *id)
 +{
 +	struct bcma_bus *bus;
 +	int err = -ENOMEM;
@@ -1307,38 +1301,32 @@
 +}
 +
 +#ifdef CONFIG_PM
-+static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
++static int bcma_host_pci_suspend(struct device *dev)
 +{
-+	/* Host specific */
-+	pci_save_state(dev);
-+	pci_disable_device(dev);
-+	pci_set_power_state(dev, pci_choose_state(dev, state));
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	return 0;
++	bus->mapped_core = NULL;
++
++	return bcma_bus_suspend(bus);
 +}
 +
-+static int bcma_host_pci_resume(struct pci_dev *dev)
++static int bcma_host_pci_resume(struct device *dev)
 +{
-+	struct bcma_bus *bus = pci_get_drvdata(dev);
-+	int err;
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	/* Host specific */
-+	pci_set_power_state(dev, 0);
-+	err = pci_enable_device(dev);
-+	if (err)
-+		return err;
-+	pci_restore_state(dev);
++	return bcma_bus_resume(bus);
++}
 +
-+	/* Bus specific */
-+	err = bcma_bus_resume(bus);
-+	if (err)
-+		return err;
++static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
++			 bcma_host_pci_resume);
++#define BCMA_PM_OPS	(&bcma_pm_ops)
 +
-+	return 0;
-+}
 +#else /* CONFIG_PM */
-+# define bcma_host_pci_suspend	NULL
-+# define bcma_host_pci_resume	NULL
++
++#define BCMA_PM_OPS     NULL
++
 +#endif /* CONFIG_PM */
 +
 +static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
@@ -1356,8 +1344,7 @@
 +	.id_table = bcma_pci_bridge_tbl,
 +	.probe = bcma_host_pci_probe,
 +	.remove = bcma_host_pci_remove,
-+	.suspend = bcma_host_pci_suspend,
-+	.resume = bcma_host_pci_resume,
++	.driver.pm = BCMA_PM_OPS,
 +};
 +
 +int __init bcma_host_pci_init(void)
@@ -1371,7 +1358,7 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/main.c
-@@ -0,0 +1,354 @@
+@@ -0,0 +1,387 @@
 +/*
 + * Broadcom specific AMBA
 + * Bus subsystem
@@ -1387,6 +1374,12 @@
 +MODULE_DESCRIPTION("Broadcom's specific AMBA driver");
 +MODULE_LICENSE("GPL");
 +
++/* contains the number the next bus should get. */
++static unsigned int bcma_bus_next_num = 0;
++
++/* bcma_buses_mutex locks the bcma_bus_next_num */
++static DEFINE_MUTEX(bcma_buses_mutex);
++
 +static int bcma_bus_match(struct device *dev, struct device_driver *drv);
 +static int bcma_device_probe(struct device *dev);
 +static int bcma_device_remove(struct device *dev);
@@ -1429,7 +1422,7 @@
 +	.dev_attrs	= bcma_device_attrs,
 +};
 +
-+static struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
++struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
 +{
 +	struct bcma_device *core;
 +
@@ -1439,6 +1432,7 @@
 +	}
 +	return NULL;
 +}
++EXPORT_SYMBOL_GPL(bcma_find_core);
 +
 +static void bcma_release_core_dev(struct device *dev)
 +{
@@ -1467,7 +1461,7 @@
 +
 +		core->dev.release = bcma_release_core_dev;
 +		core->dev.bus = &bcma_bus_type;
-+		dev_set_name(&core->dev, "bcma%d:%d", 0/*bus->num*/, dev_id);
++		dev_set_name(&core->dev, "bcma%d:%d", bus->num, dev_id);
 +
 +		switch (bus->hosttype) {
 +		case BCMA_HOSTTYPE_PCI:
@@ -1506,11 +1500,15 @@
 +	}
 +}
 +
-+int bcma_bus_register(struct bcma_bus *bus)
++int __devinit bcma_bus_register(struct bcma_bus *bus)
 +{
 +	int err;
 +	struct bcma_device *core;
 +
++	mutex_lock(&bcma_buses_mutex);
++	bus->num = bcma_bus_next_num++;
++	mutex_unlock(&bcma_buses_mutex);
++
 +	/* Scan for devices (cores) */
 +	err = bcma_bus_scan(bus);
 +	if (err) {
@@ -1543,10 +1541,8 @@
 +	err = bcma_sprom_get(bus);
 +	if (err == -ENOENT) {
 +		pr_err("No SPROM available\n");
-+	} else if (err) {
++	} else if (err)
 +		pr_err("Failed to get SPROM: %d\n", err);
-+		return -ENOENT;
-+	}
 +
 +	/* Register found cores */
 +	bcma_register_cores(bus);
@@ -1615,6 +1611,21 @@
 +}
 +
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->suspend)
++				adrv->suspend(core);
++		}
++	}
++	return 0;
++}
++
 +int bcma_bus_resume(struct bcma_bus *bus)
 +{
 +	struct bcma_device *core;
@@ -1626,6 +1637,15 @@
 +		bcma_core_chipcommon_init(&bus->drv_cc);
 +	}
 +
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->resume)
++				adrv->resume(core);
++		}
++	}
++
 +	return 0;
 +}
 +#endif
@@ -1728,7 +1748,7 @@
 +module_exit(bcma_modexit)
 --- /dev/null
 +++ b/drivers/bcma/scan.c
-@@ -0,0 +1,486 @@
+@@ -0,0 +1,507 @@
 +/*
 + * Broadcom specific AMBA
 + * Bus scanning
@@ -1943,6 +1963,17 @@
 +	return NULL;
 +}
 +
++static struct bcma_device *bcma_find_core_reverse(struct bcma_bus *bus, u16 coreid)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry_reverse(core, &bus->cores, list) {
++		if (core->id.id == coreid)
++			return core;
++	}
++	return NULL;
++}
++
 +static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
 +			      struct bcma_device_id *match, int core_num,
 +			      struct bcma_device *core)
@@ -2084,6 +2115,7 @@
 +void bcma_init_bus(struct bcma_bus *bus)
 +{
 +	s32 tmp;
++	struct bcma_chipinfo *chipinfo = &(bus->chipinfo);
 +
 +	if (bus->init_done)
 +		return;
@@ -2094,9 +2126,12 @@
 +	bcma_scan_switch_core(bus, BCMA_ADDR_BASE);
 +
 +	tmp = bcma_scan_read32(bus, 0, BCMA_CC_ID);
-+	bus->chipinfo.id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
-+	bus->chipinfo.rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
-+	bus->chipinfo.pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	chipinfo->id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
++	chipinfo->rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
++	chipinfo->pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	pr_info("Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
++		chipinfo->id, chipinfo->rev, chipinfo->pkg);
++
 +	bus->init_done = true;
 +}
 +
@@ -2123,6 +2158,7 @@
 +	bcma_scan_switch_core(bus, erombase);
 +
 +	while (eromptr < eromend) {
++		struct bcma_device *other_core;
 +		struct bcma_device *core = kzalloc(sizeof(*core), GFP_KERNEL);
 +		if (!core)
 +			return -ENOMEM;
@@ -2130,18 +2166,23 @@
 +		core->bus = bus;
 +
 +		err = bcma_get_next_core(bus, &eromptr, NULL, core_num, core);
-+		if (err == -ENODEV) {
-+			core_num++;
-+			continue;
-+		} else if (err == -ENXIO)
-+			continue;
-+		else if (err == -ESPIPE)
-+			break;
-+		else if (err < 0)
++		if (err < 0) {
++			kfree(core);
++			if (err == -ENODEV) {
++				core_num++;
++				continue;
++			} else if (err == -ENXIO) {
++				continue;
++			} else if (err == -ESPIPE) {
++				break;
++			}
 +			return err;
++		}
 +
 +		core->core_index = core_num++;
 +		bus->nr_cores++;
++		other_core = bcma_find_core_reverse(bus, core->id.id);
++		core->core_unit = (other_core == NULL) ? 0 : other_core->core_unit + 1;
 +
 +		pr_info("Core %d found: %s "
 +			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
@@ -2276,7 +2317,7 @@
 +#endif /* BCMA_SCAN_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma.h
-@@ -0,0 +1,298 @@
+@@ -0,0 +1,307 @@
 +#ifndef LINUX_BCMA_H_
 +#define LINUX_BCMA_H_
 +
@@ -2415,6 +2456,7 @@
 +	bool dev_registered;
 +
 +	u8 core_index;
++	u8 core_unit;
 +
 +	u32 addr;
 +	u32 wrap;
@@ -2441,7 +2483,7 @@
 +
 +	int (*probe)(struct bcma_device *dev);
 +	void (*remove)(struct bcma_device *dev);
-+	int (*suspend)(struct bcma_device *dev, pm_message_t state);
++	int (*suspend)(struct bcma_device *dev);
 +	int (*resume)(struct bcma_device *dev);
 +	void (*shutdown)(struct bcma_device *dev);
 +
@@ -2454,6 +2496,12 @@
 +
 +extern void bcma_driver_unregister(struct bcma_driver *drv);
 +
++/* Set a fallback SPROM.
++ * See kdoc at the function definition for complete documentation. */
++extern int bcma_arch_register_fallback_sprom(
++		int (*sprom_callback)(struct bcma_bus *bus,
++		struct ssb_sprom *out));
++
 +struct bcma_bus {
 +	/* The MMIO area. */
 +	void __iomem *mmio;
@@ -2474,6 +2522,7 @@
 +	struct list_head cores;
 +	u8 nr_cores;
 +	u8 init_done:1;
++	u8 num;
 +
 +	struct bcma_drv_cc drv_cc;
 +	struct bcma_drv_pci drv_pci;
@@ -2561,6 +2610,7 @@
 +	bcma_write16(cc, offset, (bcma_read16(cc, offset) & mask) | set);
 +}
 +
++extern struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid);
 +extern bool bcma_core_is_enabled(struct bcma_device *core);
 +extern void bcma_core_disable(struct bcma_device *core, u32 flags);
 +extern int bcma_core_enable(struct bcma_device *core, u32 flags);
@@ -2577,7 +2627,7 @@
 +#endif /* LINUX_BCMA_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_driver_chipcommon.h
-@@ -0,0 +1,391 @@
+@@ -0,0 +1,415 @@
 +#ifndef LINUX_BCMA_DRIVER_CC_H_
 +#define LINUX_BCMA_DRIVER_CC_H_
 +
@@ -2636,6 +2686,9 @@
 +#define	 BCMA_CC_OTPS_HW_PROTECT	0x00000001
 +#define	 BCMA_CC_OTPS_SW_PROTECT	0x00000002
 +#define	 BCMA_CC_OTPS_CID_PROTECT	0x00000004
++#define  BCMA_CC_OTPS_GU_PROG_IND	0x00000F00	/* General Use programmed indication */
++#define  BCMA_CC_OTPS_GU_PROG_IND_SHIFT	8
++#define  BCMA_CC_OTPS_GU_PROG_HW	0x00000100	/* HW region programmed */
 +#define BCMA_CC_OTPC			0x0014		/* OTP control */
 +#define	 BCMA_CC_OTPC_RECWAIT		0xFF000000
 +#define	 BCMA_CC_OTPC_PROGWAIT		0x00FFFF00
@@ -2652,6 +2705,8 @@
 +#define	 BCMA_CC_OTPP_READ		0x40000000
 +#define	 BCMA_CC_OTPP_START		0x80000000
 +#define	 BCMA_CC_OTPP_BUSY		0x80000000
++#define BCMA_CC_OTPL			0x001C		/* OTP layout */
++#define  BCMA_CC_OTPL_GURGN_OFFSET	0x00000FFF	/* offset of general use region */
 +#define BCMA_CC_IRQSTAT			0x0020
 +#define BCMA_CC_IRQMASK			0x0024
 +#define	 BCMA_CC_IRQ_GPIO		0x00000001	/* gpio intr */
@@ -2659,6 +2714,10 @@
 +#define	 BCMA_CC_IRQ_WDRESET		0x80000000	/* watchdog reset occurred */
 +#define BCMA_CC_CHIPCTL			0x0028		/* Rev >= 11 only */
 +#define BCMA_CC_CHIPSTAT		0x002C		/* Rev >= 11 only */
++#define  BCMA_CC_CHIPST_4313_SPROM_PRESENT	1
++#define  BCMA_CC_CHIPST_4313_OTP_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_SPROM_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_OTP_PRESENT	4
 +#define BCMA_CC_JCMD			0x0030		/* Rev >= 10 only */
 +#define  BCMA_CC_JCMD_START		0x80000000
 +#define  BCMA_CC_JCMD_BUSY		0x80000000
@@ -2761,6 +2820,22 @@
 +#define BCMA_CC_FLASH_CFG		0x0128
 +#define  BCMA_CC_FLASH_CFG_DS		0x0010	/* Data size, 0=8bit, 1=16bit */
 +#define BCMA_CC_FLASH_WAITCNT		0x012C
++#define BCMA_CC_SROM_CONTROL		0x0190
++#define  BCMA_CC_SROM_CONTROL_START	0x80000000
++#define  BCMA_CC_SROM_CONTROL_BUSY	0x80000000
++#define  BCMA_CC_SROM_CONTROL_OPCODE	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OP_READ	0x00000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRITE	0x20000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRDIS	0x40000000
++#define  BCMA_CC_SROM_CONTROL_OP_WREN	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OTPSEL	0x00000010
++#define  BCMA_CC_SROM_CONTROL_LOCK	0x00000008
++#define  BCMA_CC_SROM_CONTROL_SIZE_MASK	0x00000006
++#define  BCMA_CC_SROM_CONTROL_SIZE_1K	0x00000000
++#define  BCMA_CC_SROM_CONTROL_SIZE_4K	0x00000002
++#define  BCMA_CC_SROM_CONTROL_SIZE_16K	0x00000004
++#define  BCMA_CC_SROM_CONTROL_SIZE_SHIFT	1
++#define  BCMA_CC_SROM_CONTROL_PRESENT	0x00000001
 +/* 0x1E0 is defined as shared BCMA_CLKCTLST */
 +#define BCMA_CC_HW_WORKAROUND		0x01E4 /* Hardware workaround (rev >= 20) */
 +#define BCMA_CC_UART0_DATA		0x0300
@@ -2820,7 +2895,6 @@
 +#define BCMA_CC_PLLCTL_ADDR		0x0660
 +#define BCMA_CC_PLLCTL_DATA		0x0664
 +#define BCMA_CC_SPROM			0x0800 /* SPROM beginning */
-+#define BCMA_CC_SPROM_PCIE6		0x0830 /* SPROM beginning on PCIe rev >= 6 */
 +
 +/* Divider allocation in 4716/47162/5356 */
 +#define BCMA_CC_PMU5_MAINPLL_CPU	1
@@ -2971,7 +3045,7 @@
 +#endif /* LINUX_BCMA_DRIVER_CC_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_driver_pci.h
-@@ -0,0 +1,91 @@
+@@ -0,0 +1,214 @@
 +#ifndef LINUX_BCMA_DRIVER_PCI_H_
 +#define LINUX_BCMA_DRIVER_PCI_H_
 +
@@ -3027,6 +3101,35 @@
 +#define  BCMA_CORE_PCI_SBTOPCI1_MASK		0xFC000000
 +#define BCMA_CORE_PCI_SBTOPCI2			0x0108	/* Backplane to PCI translation 2 (sbtopci2) */
 +#define  BCMA_CORE_PCI_SBTOPCI2_MASK		0xC0000000
++#define BCMA_CORE_PCI_CONFIG_ADDR		0x0120	/* pcie config space access */
++#define BCMA_CORE_PCI_CONFIG_DATA		0x0124	/* pcie config space access */
++#define BCMA_CORE_PCI_MDIO_CONTROL		0x0128	/* controls the mdio access */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_MASK	0x7f	/* clock to be used on MDIO */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL	0x2
++#define  BCMA_CORE_PCI_MDIOCTL_PREAM_EN		0x80	/* Enable preamble sequnce */
++#define  BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE	0x100	/* Tranaction complete */
++#define BCMA_CORE_PCI_MDIO_DATA			0x012c	/* Data to the mdio access */
++#define  BCMA_CORE_PCI_MDIODATA_MASK		0x0000ffff /* data 2 bytes */
++#define  BCMA_CORE_PCI_MDIODATA_TA		0x00020000 /* Turnaround */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD	18	/* Regaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK_OLD	0x003c0000 /* Regaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD	22	/* Physmedia devaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK_OLD	0x0fc00000 /* Physmedia devaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF	18	/* Regaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK	0x007c0000 /* Regaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF	23	/* Physmedia devaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK	0x0f800000 /* Physmedia devaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_WRITE		0x10000000 /* write Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_READ		0x20000000 /* Read Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_START		0x40000000 /* start of Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_ADDR	0x0	/* dev address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_BLK_ADDR	0x1F	/* blk address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_PLL		0x1d	/* SERDES PLL Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_TX		0x1e	/* SERDES TX Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_RX		0x1f	/* SERDES RX Dev */
++#define BCMA_CORE_PCI_PCIEIND_ADDR		0x0130	/* indirect access to the internal register */
++#define BCMA_CORE_PCI_PCIEIND_DATA		0x0134	/* Data to/from the internal regsiter */
++#define BCMA_CORE_PCI_CLKREQENCTRL		0x0138	/*  >= rev 6, Clkreq rdma control */
 +#define BCMA_CORE_PCI_PCICFG0			0x0400	/* PCI config space 0 (rev >= 8) */
 +#define BCMA_CORE_PCI_PCICFG1			0x0500	/* PCI config space 1 (rev >= 8) */
 +#define BCMA_CORE_PCI_PCICFG2			0x0600	/* PCI config space 2 (rev >= 8) */
@@ -3046,26 +3149,120 @@
 +#define  BCMA_CORE_PCI_SBTOPCI_RC_READL		0x00000010 /* Memory read line */
 +#define  BCMA_CORE_PCI_SBTOPCI_RC_READM		0x00000020 /* Memory read multiple */
 +
++/* PCIE protocol PHY diagnostic registers */
++#define BCMA_CORE_PCI_PLP_MODEREG		0x200	/* Mode */
++#define BCMA_CORE_PCI_PLP_STATUSREG		0x204	/* Status */
++#define  BCMA_CORE_PCI_PLP_POLARITYINV_STAT	0x10	/* Status reg PCIE_PLP_STATUSREG */
++#define BCMA_CORE_PCI_PLP_LTSSMCTRLREG		0x208	/* LTSSM control */
++#define BCMA_CORE_PCI_PLP_LTLINKNUMREG		0x20c	/* Link Training Link number */
++#define BCMA_CORE_PCI_PLP_LTLANENUMREG		0x210	/* Link Training Lane number */
++#define BCMA_CORE_PCI_PLP_LTNFTSREG		0x214	/* Link Training N_FTS */
++#define BCMA_CORE_PCI_PLP_ATTNREG		0x218	/* Attention */
++#define BCMA_CORE_PCI_PLP_ATTNMASKREG		0x21C	/* Attention Mask */
++#define BCMA_CORE_PCI_PLP_RXERRCTR		0x220	/* Rx Error */
++#define BCMA_CORE_PCI_PLP_RXFRMERRCTR		0x224	/* Rx Framing Error */
++#define BCMA_CORE_PCI_PLP_RXERRTHRESHREG	0x228	/* Rx Error threshold */
++#define BCMA_CORE_PCI_PLP_TESTCTRLREG		0x22C	/* Test Control reg */
++#define BCMA_CORE_PCI_PLP_SERDESCTRLOVRDREG	0x230	/* SERDES Control Override */
++#define BCMA_CORE_PCI_PLP_TIMINGOVRDREG		0x234	/* Timing param override */
++#define BCMA_CORE_PCI_PLP_RXTXSMDIAGREG		0x238	/* RXTX State Machine Diag */
++#define BCMA_CORE_PCI_PLP_LTSSMDIAGREG		0x23C	/* LTSSM State Machine Diag */
++
++/* PCIE protocol DLLP diagnostic registers */
++#define BCMA_CORE_PCI_DLLP_LCREG		0x100	/* Link Control */
++#define BCMA_CORE_PCI_DLLP_LSREG		0x104	/* Link Status */
++#define BCMA_CORE_PCI_DLLP_LAREG		0x108	/* Link Attention */
++#define  BCMA_CORE_PCI_DLLP_LSREG_LINKUP	(1 << 16)
++#define BCMA_CORE_PCI_DLLP_LAMASKREG		0x10C	/* Link Attention Mask */
++#define BCMA_CORE_PCI_DLLP_NEXTTXSEQNUMREG	0x110	/* Next Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_ACKEDTXSEQNUMREG	0x114	/* Acked Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_PURGEDTXSEQNUMREG	0x118	/* Purged Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_RXSEQNUMREG		0x11C	/* Rx Sequence Number */
++#define BCMA_CORE_PCI_DLLP_LRREG		0x120	/* Link Replay */
++#define BCMA_CORE_PCI_DLLP_LACKTOREG		0x124	/* Link Ack Timeout */
++#define BCMA_CORE_PCI_DLLP_PMTHRESHREG		0x128	/* Power Management Threshold */
++#define BCMA_CORE_PCI_DLLP_RTRYWPREG		0x12C	/* Retry buffer write ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYRPREG		0x130	/* Retry buffer Read ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYPPREG		0x134	/* Retry buffer Purged ptr */
++#define BCMA_CORE_PCI_DLLP_RTRRWREG		0x138	/* Retry buffer Read/Write */
++#define BCMA_CORE_PCI_DLLP_ECTHRESHREG		0x13C	/* Error Count Threshold */
++#define BCMA_CORE_PCI_DLLP_TLPERRCTRREG		0x140	/* TLP Error Counter */
++#define BCMA_CORE_PCI_DLLP_ERRCTRREG		0x144	/* Error Counter */
++#define BCMA_CORE_PCI_DLLP_NAKRXCTRREG		0x148	/* NAK Received Counter */
++#define BCMA_CORE_PCI_DLLP_TESTREG		0x14C	/* Test */
++#define BCMA_CORE_PCI_DLLP_PKTBIST		0x150	/* Packet BIST */
++#define BCMA_CORE_PCI_DLLP_PCIE11		0x154	/* DLLP PCIE 1.1 reg */
++
++/* SERDES RX registers */
++#define BCMA_CORE_PCI_SERDES_RX_CTRL		1	/* Rx cntrl */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE	0x80	/* rxpolarity_force */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY	0x40	/* rxpolarity_value */
++#define BCMA_CORE_PCI_SERDES_RX_TIMER1		2	/* Rx Timer1 */
++#define BCMA_CORE_PCI_SERDES_RX_CDR		6	/* CDR */
++#define BCMA_CORE_PCI_SERDES_RX_CDRBW		7	/* CDR BW */
++
++/* SERDES PLL registers */
++#define BCMA_CORE_PCI_SERDES_PLL_CTRL		1	/* PLL control reg */
++#define BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN	0x4000	/* bit 14 is FREQDET on */
++
 +/* PCIcore specific boardflags */
 +#define BCMA_CORE_PCI_BFL_NOPCI			0x00000400 /* Board leaves PCI floating */
 +
++/* PCIE Config space accessing MACROS */
++#define BCMA_CORE_PCI_CFG_BUS_SHIFT		24	/* Bus shift */
++#define BCMA_CORE_PCI_CFG_SLOT_SHIFT		19	/* Slot/Device shift */
++#define BCMA_CORE_PCI_CFG_FUN_SHIFT		16	/* Function shift */
++#define BCMA_CORE_PCI_CFG_OFF_SHIFT		0	/* Register shift */
++
++#define BCMA_CORE_PCI_CFG_BUS_MASK		0xff	/* Bus mask */
++#define BCMA_CORE_PCI_CFG_SLOT_MASK		0x1f	/* Slot/Device mask */
++#define BCMA_CORE_PCI_CFG_FUN_MASK		7	/* Function mask */
++#define BCMA_CORE_PCI_CFG_OFF_MASK		0xfff	/* Register mask */
++
++/* PCIE Root Capability Register bits (Host mode only) */
++#define BCMA_CORE_PCI_RC_CRS_VISIBILITY		0x0001
++
++struct bcma_drv_pci;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++struct bcma_drv_pci_host {
++	struct bcma_drv_pci *pdev;
++
++	u32 host_cfg_addr;
++	spinlock_t cfgspace_lock;
++
++	struct pci_controller pci_controller;
++	struct pci_ops pci_ops;
++	struct resource mem_resource;
++	struct resource io_resource;
++};
++#endif
++
 +struct bcma_drv_pci {
 +	struct bcma_device *core;
 +	u8 setup_done:1;
++	u8 hostmode:1;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	struct bcma_drv_pci_host *host_controller;
++#endif
 +};
 +
 +/* Register access */
 +#define pcicore_read32(pc, offset)		bcma_read32((pc)->core, offset)
 +#define pcicore_write32(pc, offset, val)	bcma_write32((pc)->core, offset, val)
 +
-+extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
++extern void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc);
 +extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
 +				 struct bcma_device *core, bool enable);
 +
++extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
++extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
++
 +#endif /* LINUX_BCMA_DRIVER_PCI_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_regs.h
-@@ -0,0 +1,59 @@
+@@ -0,0 +1,86 @@
 +#ifndef LINUX_BCMA_REGS_H_
 +#define LINUX_BCMA_REGS_H_
 +
@@ -3124,6 +3321,33 @@
 +#define  BCMA_PCI_GPIO_XTAL		0x40	/* PCI config space GPIO 14 for Xtal powerup */
 +#define  BCMA_PCI_GPIO_PLL		0x80	/* PCI config space GPIO 15 for PLL powerdown */
 +
++/* SiliconBackplane Address Map.
++ * All regions may not exist on all chips.
++ */
++#define BCMA_SOC_SDRAM_BASE		0x00000000U	/* Physical SDRAM */
++#define BCMA_SOC_PCI_MEM		0x08000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI_MEM_SZ		(64 * 1024 * 1024)
++#define BCMA_SOC_PCI_CFG		0x0c000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_SDRAM_SWAPPED		0x10000000U	/* Byteswapped Physical SDRAM */
++#define BCMA_SOC_SDRAM_R2		0x80000000U	/* Region 2 for sdram (512 MB) */
++
++
++#define BCMA_SOC_PCI_DMA		0x40000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA2		0x80000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA_SZ		0x40000000U	/* Client Mode sb2pcitranslation2 size in bytes */
++#define BCMA_SOC_PCIE_DMA_L32		0x00000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), low 32 bits
++							 */
++#define BCMA_SOC_PCIE_DMA_H32		0x80000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
++#define BCMA_SOC_PCI1_MEM		0x40000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI1_CFG		0x44000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_PCIE1_DMA_H32		0xc0000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
 +#endif /* LINUX_BCMA_REGS_H_ */
 --- a/include/linux/mod_devicetable.h
 +++ b/include/linux/mod_devicetable.h
@@ -3191,11 +3415,13 @@
  			 sizeof(struct virtio_device_id), "virtio",
 --- /dev/null
 +++ b/drivers/bcma/sprom.c
-@@ -0,0 +1,247 @@
+@@ -0,0 +1,450 @@
 +/*
 + * Broadcom specific AMBA
 + * SPROM reading
 + *
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
@@ -3208,7 +3434,57 @@
 +#include <linux/dma-mapping.h>
 +#include <linux/slab.h>
 +
-+#define SPOFF(offset)	((offset) / sizeof(u16))
++static int(*get_fallback_sprom)(struct bcma_bus *dev, struct ssb_sprom *out);
++
++/**
++ * bcma_arch_register_fallback_sprom - Registers a method providing a
++ * fallback SPROM if no SPROM is found.
++ *
++ * @sprom_callback: The callback function.
++ *
++ * With this function the architecture implementation may register a
++ * callback handler which fills the SPROM data structure. The fallback is
++ * used for PCI based BCMA devices, where no valid SPROM can be found
++ * in the shadow registers and to provide the SPROM for SoCs where BCMA is
++ * to controll the system bus.
++ *
++ * This function is useful for weird architectures that have a half-assed
++ * BCMA device hardwired to their PCI bus.
++ *
++ * This function is available for architecture code, only. So it is not
++ * exported.
++ */
++int bcma_arch_register_fallback_sprom(int (*sprom_callback)(struct bcma_bus *bus,
++				     struct ssb_sprom *out))
++{
++	if (get_fallback_sprom)
++		return -EEXIST;
++	get_fallback_sprom = sprom_callback;
++
++	return 0;
++}
++
++static int bcma_fill_sprom_with_fallback(struct bcma_bus *bus,
++					 struct ssb_sprom *out)
++{
++	int err;
++
++	if (!get_fallback_sprom) {
++		err = -ENOENT;
++		goto fail;
++	}
++
++	err = get_fallback_sprom(bus, out);
++	if (err)
++		goto fail;
++
++	pr_debug("Using SPROM revision %d provided by"
++		 " platform.\n", bus->sprom.revision);
++	return 0;
++fail:
++	pr_warn("Using fallback SPROM failed (err %d)\n", err);
++	return err;
++}
 +
 +/**************************************************
 + * R/W ops.
@@ -3318,10 +3594,21 @@
 + * SPROM extraction.
 + **************************************************/
 +
++#define SPOFF(offset)	((offset) / sizeof(u16))
++
++#define SPEX(_field, _offset, _mask, _shift)	\
++	bus->sprom._field = ((sprom[SPOFF(_offset)] & (_mask)) >> (_shift))
++
 +static void bcma_sprom_extract_r8(struct bcma_bus *bus, const u16 *sprom)
 +{
-+	u16 v;
++	u16 v, o;
 +	int i;
++	u16 pwr_info_offset[] = {
++		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
++		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
++	};
++	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
++			ARRAY_SIZE(bus->sprom.core_pwr_info));
 +
 +	bus->sprom.revision = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] &
 +		SSB_SPROM_REVISION_REV;
@@ -3331,85 +3618,229 @@
 +		*(((__be16 *)bus->sprom.il0mac) + i) = cpu_to_be16(v);
 +	}
 +
-+	bus->sprom.board_rev = sprom[SPOFF(SSB_SPROM8_BOARDREV)];
-+
-+	bus->sprom.txpid2g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G0) >> SSB_SPROM4_TXPID2G0_SHIFT;
-+	bus->sprom.txpid2g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G1) >> SSB_SPROM4_TXPID2G1_SHIFT;
-+	bus->sprom.txpid2g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G2) >> SSB_SPROM4_TXPID2G2_SHIFT;
-+	bus->sprom.txpid2g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G3) >> SSB_SPROM4_TXPID2G3_SHIFT;
-+
-+	bus->sprom.txpid5gl[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL0) >> SSB_SPROM4_TXPID5GL0_SHIFT;
-+	bus->sprom.txpid5gl[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL1) >> SSB_SPROM4_TXPID5GL1_SHIFT;
-+	bus->sprom.txpid5gl[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL2) >> SSB_SPROM4_TXPID5GL2_SHIFT;
-+	bus->sprom.txpid5gl[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL3) >> SSB_SPROM4_TXPID5GL3_SHIFT;
-+
-+	bus->sprom.txpid5g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G0) >> SSB_SPROM4_TXPID5G0_SHIFT;
-+	bus->sprom.txpid5g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G1) >> SSB_SPROM4_TXPID5G1_SHIFT;
-+	bus->sprom.txpid5g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G2) >> SSB_SPROM4_TXPID5G2_SHIFT;
-+	bus->sprom.txpid5g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G3) >> SSB_SPROM4_TXPID5G3_SHIFT;
-+
-+	bus->sprom.txpid5gh[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH0) >> SSB_SPROM4_TXPID5GH0_SHIFT;
-+	bus->sprom.txpid5gh[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH1) >> SSB_SPROM4_TXPID5GH1_SHIFT;
-+	bus->sprom.txpid5gh[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH2) >> SSB_SPROM4_TXPID5GH2_SHIFT;
-+	bus->sprom.txpid5gh[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH3) >> SSB_SPROM4_TXPID5GH3_SHIFT;
-+
-+	bus->sprom.boardflags_lo = sprom[SPOFF(SSB_SPROM8_BFLLO)];
-+	bus->sprom.boardflags_hi = sprom[SPOFF(SSB_SPROM8_BFLHI)];
-+	bus->sprom.boardflags2_lo = sprom[SPOFF(SSB_SPROM8_BFL2LO)];
-+	bus->sprom.boardflags2_hi = sprom[SPOFF(SSB_SPROM8_BFL2HI)];
-+
-+	bus->sprom.country_code = sprom[SPOFF(SSB_SPROM8_CCODE)];
-+
-+	bus->sprom.fem.ghz2.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz2.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz2.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz2.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz2.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
-+
-+	bus->sprom.fem.ghz5.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz5.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz5.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz5.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz5.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
++	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
++
++	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
++	     SSB_SPROM4_TXPID2G0_SHIFT);
++	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
++	     SSB_SPROM4_TXPID2G1_SHIFT);
++	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
++	     SSB_SPROM4_TXPID2G2_SHIFT);
++	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
++	     SSB_SPROM4_TXPID2G3_SHIFT);
++
++	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
++	     SSB_SPROM4_TXPID5GL0_SHIFT);
++	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
++	     SSB_SPROM4_TXPID5GL1_SHIFT);
++	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
++	     SSB_SPROM4_TXPID5GL2_SHIFT);
++	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
++	     SSB_SPROM4_TXPID5GL3_SHIFT);
++
++	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
++	     SSB_SPROM4_TXPID5G0_SHIFT);
++	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
++	     SSB_SPROM4_TXPID5G1_SHIFT);
++	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
++	     SSB_SPROM4_TXPID5G2_SHIFT);
++	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
++	     SSB_SPROM4_TXPID5G3_SHIFT);
++
++	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
++	     SSB_SPROM4_TXPID5GH0_SHIFT);
++	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
++	     SSB_SPROM4_TXPID5GH1_SHIFT);
++	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
++	     SSB_SPROM4_TXPID5GH2_SHIFT);
++	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
++	     SSB_SPROM4_TXPID5GH3_SHIFT);
++
++	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
++	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
++	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
++	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
++
++	SPEX(country_code, SSB_SPROM8_CCODE, ~0, 0);
++
++	/* Extract cores power info info */
++	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
++		o = pwr_info_offset[i];
++		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_MAXP, 0);
++
++		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
++
++		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GH_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
++
++		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
++	}
++
++	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++
++	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++}
++
++/*
++ * Indicates the presence of external SPROM.
++ */
++static bool bcma_sprom_ext_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 srom_control;
++	u32 present_mask;
++
++	if (bus->drv_cc.core->id.rev >= 31) {
++		if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
++			return false;
++
++		srom_control = bcma_read32(bus->drv_cc.core,
++					   BCMA_CC_SROM_CONTROL);
++		return srom_control & BCMA_CC_SROM_CONTROL_PRESENT;
++	}
++
++	/* older chipcommon revisions use chip status register */
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present_mask = BCMA_CC_CHIPST_4313_SPROM_PRESENT;
++		break;
++
++	case 0x4331:
++		present_mask = BCMA_CC_CHIPST_4331_SPROM_PRESENT;
++		break;
++
++	default:
++		return true;
++	}
++
++	return chip_status & present_mask;
++}
++
++/*
++ * Indicates that on-chip OTP memory is present and enabled.
++ */
++static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 otpsize = 0;
++	bool present;
++
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present = chip_status & BCMA_CC_CHIPST_4313_OTP_PRESENT;
++		break;
++
++	case 0x4331:
++		present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
++		break;
++
++	case 43224:
++	case 43225:
++		/* for these chips OTP is always available */
++		present = true;
++		break;
++
++	default:
++		present = false;
++		break;
++	}
++
++	if (present) {
++		otpsize = bus->drv_cc.capabilities & BCMA_CC_CAP_OTPS;
++		otpsize >>= BCMA_CC_CAP_OTPS_SHIFT;
++	}
++
++	return otpsize != 0;
++}
++
++/*
++ * Verify OTP is filled and determine the byte
++ * offset where SPROM data is located.
++ *
++ * On error, returns 0; byte offset otherwise.
++ */
++static int bcma_sprom_onchip_offset(struct bcma_bus *bus)
++{
++	struct bcma_device *cc = bus->drv_cc.core;
++	u32 offset;
++
++	/* verify OTP status */
++	if ((bcma_read32(cc, BCMA_CC_OTPS) & BCMA_CC_OTPS_GU_PROG_HW) == 0)
++		return 0;
++
++	/* obtain bit offset from otplayout register */
++	offset = (bcma_read32(cc, BCMA_CC_OTPL) & BCMA_CC_OTPL_GURGN_OFFSET);
++	return BCMA_CC_SPROM + (offset >> 3);
 +}
 +
 +int bcma_sprom_get(struct bcma_bus *bus)
 +{
-+	u16 offset;
++	u16 offset = BCMA_CC_SPROM;
 +	u16 *sprom;
 +	int err = 0;
 +
 +	if (!bus->drv_cc.core)
 +		return -EOPNOTSUPP;
 +
-+	if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
-+		return -ENOENT;
++	if (!bcma_sprom_ext_available(bus)) {
++		/*
++		 * External SPROM takes precedence so check
++		 * on-chip OTP only when no external SPROM
++		 * is present.
++		 */
++		if (bcma_sprom_onchip_available(bus)) {
++			/* determine offset */
++			offset = bcma_sprom_onchip_offset(bus);
++		}
++		if (!offset) {
++			/*
++			 * Maybe there is no SPROM on the device?
++			 * Now we ask the arch code if there is some sprom
++			 * available for this device in some other storage.
++			 */
++			err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
++			return err;
++		}
++	}
 +
 +	sprom = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
 +			GFP_KERNEL);
@@ -3419,11 +3850,7 @@
 +	if (bus->chipinfo.id == 0x4331)
 +		bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
 +
-+	/* Most cards have SPROM moved by additional offset 0x30 (48 dwords).
-+	 * According to brcm80211 this applies to cards with PCIe rev >= 6
-+	 * TODO: understand this condition and use it */
-+	offset = (bus->chipinfo.id == 0x4331) ? BCMA_CC_SPROM :
-+		BCMA_CC_SPROM_PCIE6;
++	pr_debug("SPROM offset 0x%x\n", offset);
 +	bcma_sprom_read(bus, offset, sprom);
 +
 +	if (bus->chipinfo.id == 0x4331)
@@ -3441,21 +3868,596 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/driver_pci_host.c
-@@ -0,0 +1,14 @@
+@@ -0,0 +1,589 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Core in hostmode
 + *
++ * Copyright 2005 - 2011, Broadcom Corporation
++ * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
 +#include "bcma_private.h"
++#include <linux/pci.h>
++#include <linux/export.h>
 +#include <linux/bcma/bcma.h>
++#include <asm/paccess.h>
++
++/* Probe a 32bit value on the bus and catch bus exceptions.
++ * Returns nonzero on a bus exception.
++ * This is MIPS specific */
++#define mips_busprobe32(val, addr)	get_dbe((val), ((u32 *)(addr)))
++
++/* Assume one-hot slot wiring */
++#define BCMA_PCI_SLOT_MAX	16
++#define	PCI_CONFIG_SPACE_SIZE	256
++
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	u16 chipid_top;
++	u32 tmp;
++
++	chipid_top = (bus->chipinfo.id & 0xFF00);
++	if (chipid_top != 0x4700 &&
++	    chipid_top != 0x5300)
++		return false;
++
++	if (bus->sprom.boardflags_lo & BCMA_CORE_PCI_BFL_NOPCI) {
++		pr_info("This PCI core is disabled and not working\n");
++		return false;
++	}
 +
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++	bcma_core_enable(pc->core, 0);
++
++	return !mips_busprobe32(tmp, pc->core->io_addr);
++}
++
++static u32 bcma_pcie_read_config(struct bcma_drv_pci *pc, u32 address)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_DATA);
++}
++
++static void bcma_pcie_write_config(struct bcma_drv_pci *pc, u32 address,
++				   u32 data)
 +{
-+	pr_err("No support for PCI core in hostmode yet\n");
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_DATA, data);
++}
++
++static u32 bcma_get_cfgspace_addr(struct bcma_drv_pci *pc, unsigned int dev,
++			     unsigned int func, unsigned int off)
++{
++	u32 addr = 0;
++
++	/* Issue config commands only when the data link is up (atleast
++	 * one external pcie device is present).
++	 */
++	if (dev >= 2 || !(bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_LSREG)
++			  & BCMA_CORE_PCI_DLLP_LSREG_LINKUP))
++		goto out;
++
++	/* Type 0 transaction */
++	/* Slide the PCI window to the appropriate slot */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++	/* Calculate the address */
++	addr = pc->host_controller->host_cfg_addr;
++	addr |= (dev << BCMA_CORE_PCI_CFG_SLOT_SHIFT);
++	addr |= (func << BCMA_CORE_PCI_CFG_FUN_SHIFT);
++	addr |= (off & ~3);
++
++out:
++	return addr;
++}
++
++static int bcma_extpci_read_config(struct bcma_drv_pci *pc, unsigned int dev,
++				  unsigned int func, unsigned int off,
++				  void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr, val;
++	void __iomem *mmio = 0;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* we support only two functions on device 0 */
++		if (func > 1)
++			return -EINVAL;
++
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off >= PCI_CONFIG_SPACE_SIZE) {
++			addr = (func << 12);
++			addr |= (off & 0x0FFF);
++			val = bcma_pcie_read_config(pc, addr);
++		} else {
++			addr = BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			val = pcicore_read32(pc, addr);
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++
++		val = readl(mmio);
++	}
++	val >>= (8 * (off & 3));
++
++	switch (len) {
++	case 1:
++		*((u8 *)buf) = (u8)val;
++		break;
++	case 2:
++		*((u16 *)buf) = (u16)val;
++		break;
++	case 4:
++		*((u32 *)buf) = (u32)val;
++		break;
++	}
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
++				   unsigned int func, unsigned int off,
++				   const void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr = 0, val = 0;
++	void __iomem *mmio = 0;
++	u16 chipid = pc->core->bus->chipinfo.id;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off < PCI_CONFIG_SPACE_SIZE) {
++			addr = pc->core->addr + BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			mmio = ioremap_nocache(addr, len);
++			if (!mmio)
++				goto out;
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++	}
++
++	switch (len) {
++	case 1:
++		val = readl(mmio);
++		val &= ~(0xFF << (8 * (off & 3)));
++		val |= *((const u8 *)buf) << (8 * (off & 3));
++		break;
++	case 2:
++		val = readl(mmio);
++		val &= ~(0xFFFF << (8 * (off & 3)));
++		val |= *((const u16 *)buf) << (8 * (off & 3));
++		break;
++	case 4:
++		val = *((const u32 *)buf);
++		break;
++	}
++	if (dev == 0 && !addr) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		addr = (func << 12);
++		addr |= (off & 0x0FFF);
++		bcma_pcie_write_config(pc, addr, val);
++	} else {
++		writel(val, mmio);
++
++		if (chipid == 0x4716 || chipid == 0x4748)
++			readl(mmio);
++	}
++
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_core_pci_hostmode_read_config(struct pci_bus *bus,
++					      unsigned int devfn,
++					      int reg, int size, u32 *val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_read_config(pc, PCI_SLOT(devfn),
++				     PCI_FUNC(devfn), reg, val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++static int bcma_core_pci_hostmode_write_config(struct pci_bus *bus,
++					       unsigned int devfn,
++					       int reg, int size, u32 val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_write_config(pc, PCI_SLOT(devfn),
++				      PCI_FUNC(devfn), reg, &val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++/* return cap_offset if requested capability exists in the PCI config space */
++static u8 __devinit bcma_find_pci_capability(struct bcma_drv_pci *pc,
++					     unsigned int dev,
++					     unsigned int func, u8 req_cap_id,
++					     unsigned char *buf, u32 *buflen)
++{
++	u8 cap_id;
++	u8 cap_ptr = 0;
++	u32 bufsize;
++	u8 byte_val;
++
++	/* check for Header type 0 */
++	bcma_extpci_read_config(pc, dev, func, PCI_HEADER_TYPE, &byte_val,
++				sizeof(u8));
++	if ((byte_val & 0x7f) != PCI_HEADER_TYPE_NORMAL)
++		return cap_ptr;
++
++	/* check if the capability pointer field exists */
++	bcma_extpci_read_config(pc, dev, func, PCI_STATUS, &byte_val,
++				sizeof(u8));
++	if (!(byte_val & PCI_STATUS_CAP_LIST))
++		return cap_ptr;
++
++	/* check if the capability pointer is 0x00 */
++	bcma_extpci_read_config(pc, dev, func, PCI_CAPABILITY_LIST, &cap_ptr,
++				sizeof(u8));
++	if (cap_ptr == 0x00)
++		return cap_ptr;
++
++	/* loop thr'u the capability list and see if the requested capabilty
++	 * exists */
++	bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id, sizeof(u8));
++	while (cap_id != req_cap_id) {
++		bcma_extpci_read_config(pc, dev, func, cap_ptr + 1, &cap_ptr,
++					sizeof(u8));
++		if (cap_ptr == 0x00)
++			return cap_ptr;
++		bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id,
++					sizeof(u8));
++	}
++
++	/* found the caller requested capability */
++	if ((buf != NULL) && (buflen != NULL)) {
++		u8 cap_data;
++
++		bufsize = *buflen;
++		if (!bufsize)
++			return cap_ptr;
++
++		*buflen = 0;
++
++		/* copy the cpability data excluding cap ID and next ptr */
++		cap_data = cap_ptr + 2;
++		if ((bufsize + cap_data)  > PCI_CONFIG_SPACE_SIZE)
++			bufsize = PCI_CONFIG_SPACE_SIZE - cap_data;
++		*buflen = bufsize;
++		while (bufsize--) {
++			bcma_extpci_read_config(pc, dev, func, cap_data, buf,
++						sizeof(u8));
++			cap_data++;
++			buf++;
++		}
++	}
++
++	return cap_ptr;
++}
++
++/* If the root port is capable of returning Config Request
++ * Retry Status (CRS) Completion Status to software then
++ * enable the feature.
++ */
++static void __devinit bcma_core_pci_enable_crs(struct bcma_drv_pci *pc)
++{
++	u8 cap_ptr, root_ctrl, root_cap, dev;
++	u16 val16;
++	int i;
++
++	cap_ptr = bcma_find_pci_capability(pc, 0, 0, PCI_CAP_ID_EXP, NULL,
++					   NULL);
++	root_cap = cap_ptr + PCI_EXP_RTCAP;
++	bcma_extpci_read_config(pc, 0, 0, root_cap, &val16, sizeof(u16));
++	if (val16 & BCMA_CORE_PCI_RC_CRS_VISIBILITY) {
++		/* Enable CRS software visibility */
++		root_ctrl = cap_ptr + PCI_EXP_RTCTL;
++		val16 = PCI_EXP_RTCTL_CRSSVE;
++		bcma_extpci_read_config(pc, 0, 0, root_ctrl, &val16,
++					sizeof(u16));
++
++		/* Initiate a configuration request to read the vendor id
++		 * field of the device function's config space header after
++		 * 100 ms wait time from the end of Reset. If the device is
++		 * not done with its internal initialization, it must at
++		 * least return a completion TLP, with a completion status
++		 * of "Configuration Request Retry Status (CRS)". The root
++		 * complex must complete the request to the host by returning
++		 * a read-data value of 0001h for the Vendor ID field and
++		 * all 1s for any additional bytes included in the request.
++		 * Poll using the config reads for max wait time of 1 sec or
++		 * until we receive the successful completion status. Repeat
++		 * the procedure for all the devices.
++		 */
++		for (dev = 1; dev < BCMA_PCI_SLOT_MAX; dev++) {
++			for (i = 0; i < 100000; i++) {
++				bcma_extpci_read_config(pc, dev, 0,
++							PCI_VENDOR_ID, &val16,
++							sizeof(val16));
++				if (val16 != 0x1)
++					break;
++				udelay(10);
++			}
++			if (val16 == 0x1)
++				pr_err("PCI: Broken device in slot %d\n", dev);
++		}
++	}
++}
++
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	struct bcma_drv_pci_host *pc_host;
++	u32 tmp;
++	u32 pci_membase_1G;
++	unsigned long io_map_base;
++
++	pr_info("PCIEcore in host mode found\n");
++
++	pc_host = kzalloc(sizeof(*pc_host), GFP_KERNEL);
++	if (!pc_host)  {
++		pr_err("can not allocate memory");
++		return;
++	}
++
++	pc->host_controller = pc_host;
++	pc_host->pci_controller.io_resource = &pc_host->io_resource;
++	pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
++	pc_host->pci_controller.pci_ops = &pc_host->pci_ops;
++	pc_host->pdev = pc;
++
++	pci_membase_1G = BCMA_SOC_PCI_DMA;
++	pc_host->host_cfg_addr = BCMA_SOC_PCI_CFG;
++
++	pc_host->pci_ops.read = bcma_core_pci_hostmode_read_config;
++	pc_host->pci_ops.write = bcma_core_pci_hostmode_write_config;
++
++	pc_host->mem_resource.name = "BCMA PCIcore external memory",
++	pc_host->mem_resource.start = BCMA_SOC_PCI_DMA;
++	pc_host->mem_resource.end = BCMA_SOC_PCI_DMA + BCMA_SOC_PCI_DMA_SZ - 1;
++	pc_host->mem_resource.flags = IORESOURCE_MEM | IORESOURCE_PCI_FIXED;
++
++	pc_host->io_resource.name = "BCMA PCIcore external I/O",
++	pc_host->io_resource.start = 0x100;
++	pc_host->io_resource.end = 0x7FF;
++	pc_host->io_resource.flags = IORESOURCE_IO | IORESOURCE_PCI_FIXED;
++
++	/* Reset RC */
++	udelay(3000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST_OE);
++	udelay(1000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST |
++			BCMA_CORE_PCI_CTL_RST_OE);
++
++	/* 64 MB I/O access window. On 4716, use
++	 * sbtopcie0 to access the device registers. We
++	 * can't use address match 2 (1 GB window) region
++	 * as mips can't generate 64-bit address on the
++	 * backplane.
++	 */
++	if (bus->chipinfo.id == 0x4716 || bus->chipinfo.id == 0x4748) {
++		pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++		pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++					    BCMA_SOC_PCI_MEM_SZ - 1;
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_MEM | BCMA_SOC_PCI_MEM);
++	} else if (bus->chipinfo.id == 0x5300) {
++		tmp = BCMA_CORE_PCI_SBTOPCI_MEM;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_PREF;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_BURST;
++		if (pc->core->core_unit == 0) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE_DMA_H32;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI_MEM);
++		} else if (pc->core->core_unit == 1) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI1_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI1_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE1_DMA_H32;
++			pc_host->host_cfg_addr = BCMA_SOC_PCI1_CFG;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI1_MEM);
++		}
++	} else
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_IO);
++
++	/* 64 MB configuration access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++
++	/* 1 GB memory access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI2,
++			BCMA_CORE_PCI_SBTOPCI_MEM | pci_membase_1G);
++
++
++	/* As per PCI Express Base Spec 1.1 we need to wait for
++	 * at least 100 ms from the end of a reset (cold/warm/hot)
++	 * before issuing configuration requests to PCI Express
++	 * devices.
++	 */
++	udelay(100000);
++
++	bcma_core_pci_enable_crs(pc);
++
++	/* Enable PCI bridge BAR0 memory & master access */
++	tmp = PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
++	bcma_extpci_write_config(pc, 0, 0, PCI_COMMAND, &tmp, sizeof(tmp));
++
++	/* Enable PCI interrupts */
++	pcicore_write32(pc, BCMA_CORE_PCI_IMASK, BCMA_CORE_PCI_IMASK_INTA);
++
++	/* Ok, ready to run, register it to the system.
++	 * The following needs change, if we want to port hostmode
++	 * to non-MIPS platform. */
++	io_map_base = (unsigned long)ioremap_nocache(BCMA_SOC_PCI_MEM,
++						     0x04000000);
++	pc_host->pci_controller.io_map_base = io_map_base;
++	set_io_port_base(pc_host->pci_controller.io_map_base);
++	/* Give some time to the PCI controller to configure itself with the new
++	 * values. Not waiting at this point causes crashes of the machine. */
++	mdelay(10);
++	register_pci_controller(&pc_host->pci_controller);
++	return;
++}
++
++/* Early PCI fixup for a device on the PCI-core bridge. */
++static void bcma_core_pci_fixup_pcibridge(struct pci_dev *dev)
++{
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) != 0)
++		return;
++
++	pr_info("PCI: Fixing up bridge %s\n", pci_name(dev));
++
++	/* Enable PCI bridge bus mastering and memory space */
++	pci_set_master(dev);
++	if (pcibios_enable_device(dev, ~0) < 0) {
++		pr_err("PCI: BCMA bridge enable failed\n");
++		return;
++	}
++
++	/* Enable PCI bridge BAR1 prefetch and burst */
++	pci_write_config_dword(dev, BCMA_PCI_BAR1_CONTROL, 3);
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_pcibridge);
++
++/* Early PCI fixup for all PCI-cores to set the correct memory address. */
++static void bcma_core_pci_fixup_addresses(struct pci_dev *dev)
++{
++	struct resource *res;
++	int pos;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) == 0)
++		return;
++
++	pr_info("PCI: Fixing up addresses %s\n", pci_name(dev));
++
++	for (pos = 0; pos < 6; pos++) {
++		res = &dev->resource[pos];
++		if (res->flags & (IORESOURCE_IO | IORESOURCE_MEM))
++			pci_assign_resource(dev, pos);
++	}
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_addresses);
++
++/* This function is called when doing a pci_enable_device().
++ * We must first check if the device is a device on the PCI-core bridge. */
++int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++
++	pr_info("PCI: Fixing up device %s\n", pci_name(dev));
++
++	/* Fix up interrupt lines */
++	dev->irq = bcma_core_mips_irq(pc_host->pdev->core) + 2;
++	pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
++
++	return 0;
++}
++EXPORT_SYMBOL(bcma_core_pci_plat_dev_init);
++
++/* PCI device IRQ mapping. */
++int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++	return bcma_core_mips_irq(pc_host->pdev->core) + 2;
 +}
++EXPORT_SYMBOL(bcma_core_pci_pcibios_map_irq);
 --- /dev/null
 +++ b/drivers/bcma/driver_mips.c
 @@ -0,0 +1,256 @@
diff --git a/target/linux/generic/patches-2.6.39/020-ssb_update.patch b/target/linux/generic/patches-2.6.39/020-ssb_update.patch
index d89b64b9d9..404201a782 100644
--- a/target/linux/generic/patches-2.6.39/020-ssb_update.patch
+++ b/target/linux/generic/patches-2.6.39/020-ssb_update.patch
@@ -118,7 +118,53 @@
   * Copyright 2007, Broadcom Corporation
   *
   * Licensed under the GNU/GPL. See COPYING for details.
-@@ -417,12 +417,14 @@ static void ssb_pmu_resources_init(struc
+@@ -12,6 +12,9 @@
+ #include <linux/ssb/ssb_regs.h>
+ #include <linux/ssb/ssb_driver_chipcommon.h>
+ #include <linux/delay.h>
++#ifdef CONFIG_BCM47XX
++#include <asm/mach-bcm47xx/nvram.h>
++#endif
+ 
+ #include "ssb_private.h"
+ 
+@@ -91,10 +94,6 @@ static void ssb_pmu0_pllinit_r0(struct s
+ 	u32 pmuctl, tmp, pllctl;
+ 	unsigned int i;
+ 
+-	if ((bus->chip_id == 0x5354) && !crystalfreq) {
+-		/* The 5354 crystal freq is 25MHz */
+-		crystalfreq = 25000;
+-	}
+ 	if (crystalfreq)
+ 		e = pmu0_plltab_find_entry(crystalfreq);
+ 	if (!e)
+@@ -320,7 +319,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 	u32 crystalfreq = 0; /* in kHz. 0 = keep default freq. */
+ 
+ 	if (bus->bustype == SSB_BUSTYPE_SSB) {
+-		/* TODO: The user may override the crystal frequency. */
++#ifdef CONFIG_BCM47XX
++		char buf[20];
++		if (nvram_getenv("xtalfreq", buf, sizeof(buf)) >= 0)
++			crystalfreq = simple_strtoul(buf, NULL, 0);
++#endif
+ 	}
+ 
+ 	switch (bus->chip_id) {
+@@ -329,7 +332,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 		ssb_pmu1_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4328:
++		ssb_pmu0_pllinit_r0(cc, crystalfreq);
++		break;
+ 	case 0x5354:
++		if (crystalfreq == 0)
++			crystalfreq = 25000;
+ 		ssb_pmu0_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4322:
+@@ -417,12 +424,14 @@ static void ssb_pmu_resources_init(struc
  	u32 min_msk = 0, max_msk = 0;
  	unsigned int i;
  	const struct pmu_res_updown_tab_entry *updown_tab = NULL;
@@ -135,6 +181,41 @@
  	case 0x4322:
  		/* We keep the default settings:
  		 * min_msk = 0xCBB
+@@ -604,3 +613,34 @@ void ssb_pmu_set_ldo_paref(struct ssb_ch
+ 
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_voltage);
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_paref);
++
++u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		/* 5354 chip uses a non programmable PLL of frequency 240MHz */
++		return 240000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU cpu clock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
++
++u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		return 120000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU controlclock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
 --- a/drivers/ssb/driver_gige.c
 +++ b/drivers/ssb/driver_gige.c
 @@ -3,7 +3,7 @@
@@ -203,6 +284,15 @@
  
  static inline
  u32 pcicore_read32(struct ssb_pcicore *pc, u16 offset)
+@@ -69,7 +74,7 @@ static u32 get_cfgspace_addr(struct ssb_
+ 	u32 tmp;
+ 
+ 	/* We do only have one cardbus device behind the bridge. */
+-	if (pc->cardbusmode && (dev >= 1))
++	if (pc->cardbusmode && (dev > 1))
+ 		goto out;
+ 
+ 	if (bus == 0) {
 @@ -309,7 +314,7 @@ int ssb_pcicore_pcibios_map_irq(const st
  	return ssb_mips_irq(extpci_core->dev) + 2;
  }
@@ -564,7 +654,49 @@
  #include <linux/ssb/ssb.h>
  #include <linux/ssb/ssb_regs.h>
  #include <linux/ssb/ssb_driver_gige.h>
-@@ -557,7 +558,7 @@ error:
+@@ -139,19 +140,6 @@ static void ssb_device_put(struct ssb_de
+ 		put_device(dev->dev);
+ }
+ 
+-static inline struct ssb_driver *ssb_driver_get(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		get_driver(&drv->drv);
+-	return drv;
+-}
+-
+-static inline void ssb_driver_put(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		put_driver(&drv->drv);
+-}
+-
+ static int ssb_device_resume(struct device *dev)
+ {
+ 	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
+@@ -249,11 +237,9 @@ int ssb_devices_freeze(struct ssb_bus *b
+ 			ssb_device_put(sdev);
+ 			continue;
+ 		}
+-		sdrv = ssb_driver_get(drv_to_ssb_drv(sdev->dev->driver));
+-		if (!sdrv || SSB_WARN_ON(!sdrv->remove)) {
+-			ssb_device_put(sdev);
++		sdrv = drv_to_ssb_drv(sdev->dev->driver);
++		if (SSB_WARN_ON(!sdrv->remove))
+ 			continue;
+-		}
+ 		sdrv->remove(sdev);
+ 		ctx->device_frozen[i] = 1;
+ 	}
+@@ -292,7 +278,6 @@ int ssb_devices_thaw(struct ssb_freeze_c
+ 				   dev_name(sdev->dev));
+ 			result = err;
+ 		}
+-		ssb_driver_put(sdrv);
+ 		ssb_device_put(sdev);
+ 	}
+ 
+@@ -557,7 +542,7 @@ error:
  }
  
  /* Needs ssb_buses_lock() */
@@ -573,7 +705,7 @@
  {
  	struct ssb_bus *bus, *n;
  	int err = 0;
-@@ -768,9 +769,9 @@ out:
+@@ -768,9 +753,9 @@ out:
  	return err;
  }
  
@@ -586,7 +718,7 @@
  {
  	int err;
  
-@@ -851,8 +852,8 @@ err_disable_xtal:
+@@ -851,8 +836,8 @@ err_disable_xtal:
  }
  
  #ifdef CONFIG_SSB_PCIHOST
@@ -597,7 +729,7 @@
  {
  	int err;
  
-@@ -875,9 +876,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
+@@ -875,9 +860,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
  #endif /* CONFIG_SSB_PCIHOST */
  
  #ifdef CONFIG_SSB_PCMCIAHOST
@@ -610,7 +742,7 @@
  {
  	int err;
  
-@@ -897,8 +898,9 @@ EXPORT_SYMBOL(ssb_bus_pcmciabus_register
+@@ -897,8 +882,9 @@ EXPORT_SYMBOL(ssb_bus_pcmciabus_register
  #endif /* CONFIG_SSB_PCMCIAHOST */
  
  #ifdef CONFIG_SSB_SDIOHOST
@@ -622,7 +754,7 @@
  {
  	int err;
  
-@@ -918,9 +920,9 @@ int ssb_bus_sdiobus_register(struct ssb_
+@@ -918,9 +904,9 @@ int ssb_bus_sdiobus_register(struct ssb_
  EXPORT_SYMBOL(ssb_bus_sdiobus_register);
  #endif /* CONFIG_SSB_PCMCIAHOST */
  
@@ -635,7 +767,7 @@
  {
  	int err;
  
-@@ -1001,8 +1003,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
+@@ -1001,8 +987,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
  	switch (plltype) {
  	case SSB_PLLTYPE_6: /* 100/200 or 120/240 only */
  		if (m & SSB_CHIPCO_CLK_T6_MMASK)
@@ -646,7 +778,17 @@
  	case SSB_PLLTYPE_1: /* 48Mhz base, 3 dividers */
  	case SSB_PLLTYPE_3: /* 25Mhz, 2 dividers */
  	case SSB_PLLTYPE_4: /* 48Mhz, 4 dividers */
-@@ -1117,23 +1119,22 @@ static u32 ssb_tmslow_reject_bitmask(str
+@@ -1092,6 +1078,9 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
+ 	u32 plltype;
+ 	u32 clkctl_n, clkctl_m;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_controlclock(&bus->chipco);
++
+ 	if (ssb_extif_available(&bus->extif))
+ 		ssb_extif_get_clockcontrol(&bus->extif, &plltype,
+ 					   &clkctl_n, &clkctl_m);
+@@ -1117,23 +1106,22 @@ static u32 ssb_tmslow_reject_bitmask(str
  {
  	u32 rev = ssb_read32(dev, SSB_IDLOW) & SSB_IDLOW_SSBREV;
  
@@ -677,7 +819,7 @@
  }
  
  int ssb_device_is_enabled(struct ssb_device *dev)
-@@ -1260,13 +1261,34 @@ void ssb_device_disable(struct ssb_devic
+@@ -1260,13 +1248,34 @@ void ssb_device_disable(struct ssb_devic
  }
  EXPORT_SYMBOL(ssb_device_disable);
  
@@ -713,7 +855,7 @@
  	default:
  		__ssb_dma_not_implemented(dev);
  	}
-@@ -1309,20 +1331,20 @@ EXPORT_SYMBOL(ssb_bus_may_powerdown);
+@@ -1309,20 +1318,20 @@ EXPORT_SYMBOL(ssb_bus_may_powerdown);
  
  int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl)
  {
@@ -738,7 +880,7 @@
  	return 0;
  error:
  	ssb_printk(KERN_ERR PFX "Bus powerup failed\n");
-@@ -1330,6 +1352,37 @@ error:
+@@ -1330,6 +1339,37 @@ error:
  }
  EXPORT_SYMBOL(ssb_bus_powerup);
  
@@ -787,7 +929,63 @@
   * Copyright (C) 2005 Martin Langer <martin-langer@gmx.de>
   * Copyright (C) 2005 Stefano Brivio <st3@riseup.net>
   * Copyright (C) 2005 Danny van Dyk <kugelfang@gentoo.org>
-@@ -523,7 +523,13 @@ static void sprom_extract_r45(struct ssb
+@@ -331,7 +331,6 @@ static void sprom_extract_r123(struct ss
+ {
+ 	int i;
+ 	u16 v;
+-	s8 gain;
+ 	u16 loc[3];
+ 
+ 	if (out->revision == 3)			/* rev 3 moved MAC */
+@@ -390,20 +389,12 @@ static void sprom_extract_r123(struct ss
+ 		SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_BG,
+-				    SSB_SPROM1_AGAIN_BG_SHIFT);
+-	out->antenna_gain.ghz24.a0 = gain;
+-	out->antenna_gain.ghz24.a1 = gain;
+-	out->antenna_gain.ghz24.a2 = gain;
+-	out->antenna_gain.ghz24.a3 = gain;
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_A,
+-				    SSB_SPROM1_AGAIN_A_SHIFT);
+-	out->antenna_gain.ghz5.a0 = gain;
+-	out->antenna_gain.ghz5.a1 = gain;
+-	out->antenna_gain.ghz5.a2 = gain;
+-	out->antenna_gain.ghz5.a3 = gain;
++	out->antenna_gain.a0 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_BG,
++						    SSB_SPROM1_AGAIN_BG_SHIFT);
++	out->antenna_gain.a1 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_A,
++						    SSB_SPROM1_AGAIN_A_SHIFT);
+ }
+ 
+ /* Revs 4 5 and 8 have partially shared layout */
+@@ -504,16 +495,14 @@ static void sprom_extract_r45(struct ssb
+ 	}
+ 
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN0, SSB_SPROM4_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN1, SSB_SPROM4_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN2, SSB_SPROM4_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN3, SSB_SPROM4_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
+ 
+ 	sprom_extract_r458(out, in);
+ 
+@@ -523,7 +512,13 @@ static void sprom_extract_r45(struct ssb
  static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
  {
  	int i;
@@ -802,10 +1000,25 @@
  
  	/* extract the MAC address */
  	for (i = 0; i < 3; i++) {
-@@ -607,6 +613,61 @@ static void sprom_extract_r8(struct ssb_
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
- 
+@@ -596,16 +591,69 @@ static void sprom_extract_r8(struct ssb_
+ 	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
++
 +	/* Extract cores power info info */
 +	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
 +		o = pwr_info_offset[i];
@@ -860,11 +1073,10 @@
 +		SSB_SROM8_FEM_TR_ISO, SSB_SROM8_FEM_TR_ISO_SHIFT);
 +	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G,
 +		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
-+
+ 
  	sprom_extract_r458(out, in);
  
- 	/* TODO - get remaining rev 8 stuff needed */
-@@ -662,7 +723,6 @@ static int sprom_extract(struct ssb_bus
+@@ -662,7 +710,6 @@ static int sprom_extract(struct ssb_bus
  static int ssb_pci_sprom_get(struct ssb_bus *bus,
  			     struct ssb_sprom *sprom)
  {
@@ -872,7 +1084,7 @@
  	int err;
  	u16 *buf;
  
-@@ -707,10 +767,17 @@ static int ssb_pci_sprom_get(struct ssb_
+@@ -707,10 +754,17 @@ static int ssb_pci_sprom_get(struct ssb_
  		if (err) {
  			/* All CRC attempts failed.
  			 * Maybe there is no SPROM on the device?
@@ -894,7 +1106,7 @@
  				err = 0;
  				goto out_free;
  			}
-@@ -728,12 +795,9 @@ out_free:
+@@ -728,12 +782,9 @@ out_free:
  static void ssb_pci_get_boardinfo(struct ssb_bus *bus,
  				  struct ssb_boardinfo *bi)
  {
@@ -974,6 +1186,16 @@
  			bus->chip_package = 0;
  		} else {
  			bus->chip_id = 0x4710;
+@@ -316,6 +318,9 @@ int ssb_bus_scan(struct ssb_bus *bus,
+ 			bus->chip_package = 0;
+ 		}
+ 	}
++	ssb_printk(KERN_INFO PFX "Found chip with id 0x%04X, rev 0x%02X and "
++		   "package 0x%02X\n", bus->chip_id, bus->chip_rev,
++		   bus->chip_package);
+ 	if (!bus->nr_devices)
+ 		bus->nr_devices = chipid_to_nrcores(bus->chip_id);
+ 	if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
 --- a/drivers/ssb/sprom.c
 +++ b/drivers/ssb/sprom.c
 @@ -2,7 +2,7 @@
@@ -1069,6 +1291,15 @@
  
  
  /* core.c */
+@@ -206,4 +207,8 @@ static inline void b43_pci_ssb_bridge_ex
+ }
+ #endif /* CONFIG_SSB_B43_PCI_BRIDGE */
+ 
++/* driver_chipcommon_pmu.c */
++extern u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc);
++extern u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc);
++
+ #endif /* LINUX_SSB_PRIVATE_H_ */
 --- a/include/linux/ssb/ssb.h
 +++ b/include/linux/ssb/ssb.h
 @@ -16,6 +16,12 @@ struct pcmcia_device;
@@ -1078,25 +1309,54 @@
 +struct ssb_sprom_core_pwr_info {
 +	u8 itssi_2g, itssi_5g;
 +	u8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh;
-+	u16 pa_2g[3], pa_5gl[3], pa_5g[3], pa_5gh[3];
++	u16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4];
 +};
 +
  struct ssb_sprom {
  	u8 revision;
  	u8 il0mac[6];		/* MAC address for 802.11b/g */
-@@ -25,8 +31,10 @@ struct ssb_sprom {
+@@ -25,8 +31,13 @@ struct ssb_sprom {
  	u8 et1phyaddr;		/* MII address for enet1 */
  	u8 et0mdcport;		/* MDIO for enet0 */
  	u8 et1mdcport;		/* MDIO for enet1 */
 -	u8 board_rev;		/* Board revision number from SPROM. */
 +	u16 board_rev;		/* Board revision number from SPROM. */
++	u16 board_num;		/* Board number from SPROM. */
++	u16 board_type;		/* Board type from SPROM. */
  	u8 country_code;	/* Country Code */
-+	u16 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
-+	u16 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
++	char alpha2[2];		/* Country Code as two chars like EU or US */
++	u8 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
++	u8 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
  	u8 ant_available_a;	/* 2GHz antenna available bits (up to 4) */
  	u8 ant_available_bg;	/* 5GHz antenna available bits (up to 4) */
  	u16 pa0b0;
-@@ -80,6 +88,8 @@ struct ssb_sprom {
+@@ -45,10 +56,10 @@ struct ssb_sprom {
+ 	u8 gpio1;		/* GPIO pin 1 */
+ 	u8 gpio2;		/* GPIO pin 2 */
+ 	u8 gpio3;		/* GPIO pin 3 */
+-	u16 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
+ 	u8 itssi_a;		/* Idle TSSI Target for A-PHY */
+ 	u8 itssi_bg;		/* Idle TSSI Target for B/G-PHY */
+ 	u8 tri2g;		/* 2.4GHz TX isolation */
+@@ -59,8 +70,8 @@ struct ssb_sprom {
+ 	u8 txpid5gl[4];		/* 4.9 - 5.1GHz TX power index */
+ 	u8 txpid5g[4];		/* 5.1 - 5.5GHz TX power index */
+ 	u8 txpid5gh[4];		/* 5.5 - ...GHz TX power index */
+-	u8 rxpo2g;		/* 2GHz RX power offset */
+-	u8 rxpo5g;		/* 5GHz RX power offset */
++	s8 rxpo2g;		/* 2GHz RX power offset */
++	s8 rxpo5g;		/* 5GHz RX power offset */
+ 	u8 rssisav2g;		/* 2GHz RSSI params */
+ 	u8 rssismc2g;
+ 	u8 rssismf2g;
+@@ -80,26 +91,104 @@ struct ssb_sprom {
  	u16 boardflags2_hi;	/* Board flags (bits 48-63) */
  	/* TODO store board flags in a single u64 */
  
@@ -1105,10 +1365,17 @@
  	/* Antenna gain values for up to 4 antennas
  	 * on each band. Values in dBm/4 (Q5.2). Negative gain means the
  	 * loss in the connectors is bigger than the gain. */
-@@ -92,6 +102,15 @@ struct ssb_sprom {
- 		} ghz5;		/* 5GHz band */
+ 	struct {
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz24;	/* 2.4GHz band */
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz5;		/* 5GHz band */
++		s8 a0, a1, a2, a3;
  	} antenna_gain;
  
+-	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
 +	struct {
 +		struct {
 +			u8 tssipos, extpa_gain, pdet_range, tr_iso, antswlut;
@@ -1118,10 +1385,82 @@
 +		} ghz5;
 +	} fem;
 +
- 	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
++	u16 mcs2gpo[8];
++	u16 mcs5gpo[8];
++	u16 mcs5glpo[8];
++	u16 mcs5ghpo[8];
++	u8 opo;
++
++	u8 rxgainerr2ga[3];
++	u8 rxgainerr5gla[3];
++	u8 rxgainerr5gma[3];
++	u8 rxgainerr5gha[3];
++	u8 rxgainerr5gua[3];
++
++	u8 noiselvl2ga[3];
++	u8 noiselvl5gla[3];
++	u8 noiselvl5gma[3];
++	u8 noiselvl5gha[3];
++	u8 noiselvl5gua[3];
++
++	u8 regrev;
++	u8 txchain;
++	u8 rxchain;
++	u8 antswitch;
++	u16 cddpo;
++	u16 stbcpo;
++	u16 bw40po;
++	u16 bwduppo;
++
++	u8 tempthresh;
++	u8 tempoffset;
++	u16 rawtempsense;
++	u8 measpower;
++	u8 tempsense_slope;
++	u8 tempcorrx;
++	u8 tempsense_option;
++	u8 freqoffset_corr;
++	u8 iqcal_swp_dis;
++	u8 hw_iqcal_en;
++	u8 elna2g;
++	u8 elna5g;
++	u8 phycal_tempdelta;
++	u8 temps_period;
++	u8 temps_hysteresis;
++	u8 measpower1;
++	u8 measpower2;
++	u8 pcieingress_war;
++
++	/* power per rate from sromrev 9 */
++	u16 cckbw202gpo;
++	u16 cckbw20ul2gpo;
++	u32 legofdmbw202gpo;
++	u32 legofdmbw20ul2gpo;
++	u32 legofdmbw205glpo;
++	u32 legofdmbw20ul5glpo;
++	u32 legofdmbw205gmpo;
++	u32 legofdmbw20ul5gmpo;
++	u32 legofdmbw205ghpo;
++	u32 legofdmbw20ul5ghpo;
++	u32 mcsbw202gpo;
++	u32 mcsbw20ul2gpo;
++	u32 mcsbw402gpo;
++	u32 mcsbw205glpo;
++	u32 mcsbw20ul5glpo;
++	u32 mcsbw405glpo;
++	u32 mcsbw205gmpo;
++	u32 mcsbw20ul5gmpo;
++	u32 mcsbw405gmpo;
++	u32 mcsbw205ghpo;
++	u32 mcsbw20ul5ghpo;
++	u32 mcsbw405ghpo;
++	u16 mcs32po;
++	u16 legofdm40duppo;
++	u8 sar2g;
++	u8 sar5g;
  };
  
-@@ -99,7 +118,7 @@ struct ssb_sprom {
+ /* Information about the PCB the circuitry is soldered on. */
  struct ssb_boardinfo {
  	u16 vendor;
  	u16 type;
@@ -1130,7 +1469,7 @@
  };
  
  
-@@ -229,10 +248,9 @@ struct ssb_driver {
+@@ -229,10 +318,9 @@ struct ssb_driver {
  #define drv_to_ssb_drv(_drv) container_of(_drv, struct ssb_driver, drv)
  
  extern int __ssb_driver_register(struct ssb_driver *drv, struct module *owner);
@@ -1144,7 +1483,7 @@
  extern void ssb_driver_unregister(struct ssb_driver *drv);
  
  
-@@ -308,7 +326,7 @@ struct ssb_bus {
+@@ -308,7 +396,7 @@ struct ssb_bus {
  
  	/* ID information about the Chip. */
  	u16 chip_id;
@@ -1153,7 +1492,7 @@
  	u16 sprom_offset;
  	u16 sprom_size;		/* number of words in sprom */
  	u8 chip_package;
-@@ -404,7 +422,9 @@ extern bool ssb_is_sprom_available(struc
+@@ -404,7 +492,9 @@ extern bool ssb_is_sprom_available(struc
  
  /* Set a fallback SPROM.
   * See kdoc at the function definition for complete documentation. */
@@ -1164,7 +1503,7 @@
  
  /* Suspend a SSB bus.
   * Call this from the parent bus suspend routine. */
-@@ -518,6 +538,7 @@ extern int ssb_bus_may_powerdown(struct
+@@ -518,6 +608,7 @@ extern int ssb_bus_may_powerdown(struct
   * Otherwise static always-on powercontrol will be used. */
  extern int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl);
  
@@ -1376,6 +1715,16 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
+@@ -208,6 +208,9 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 	u32 pll_type, n, m, rate = 0;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_cpu_clock(&bus->chipco);
++
+ 	if (bus->extif.dev) {
+ 		ssb_extif_get_clockcontrol(&bus->extif, &pll_type, &n, &m);
+ 	} else if (bus->chipco.dev) {
 --- a/drivers/ssb/embedded.c
 +++ b/drivers/ssb/embedded.c
 @@ -3,7 +3,7 @@
@@ -1398,6 +1747,25 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
+@@ -676,14 +676,10 @@ static int ssb_pcmcia_do_get_invariants(
+ 	case SSB_PCMCIA_CIS_ANTGAIN:
+ 		GOTO_ERROR_ON(tuple->TupleDataLen != 2,
+ 			"antg tpl size");
+-		sprom->antenna_gain.ghz24.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a3 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a3 = tuple->TupleData[1];
++		sprom->antenna_gain.a0 = tuple->TupleData[1];
++		sprom->antenna_gain.a1 = tuple->TupleData[1];
++		sprom->antenna_gain.a2 = tuple->TupleData[1];
++		sprom->antenna_gain.a3 = tuple->TupleData[1];
+ 		break;
+ 	case SSB_PCMCIA_CIS_BFLAGS:
+ 		GOTO_ERROR_ON((tuple->TupleDataLen != 3) &&
 --- a/drivers/ssb/sdio.c
 +++ b/drivers/ssb/sdio.c
 @@ -6,7 +6,7 @@
@@ -1409,3 +1777,32 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   *
+@@ -551,14 +551,10 @@ int ssb_sdio_get_invariants(struct ssb_b
+ 			case SSB_SDIO_CIS_ANTGAIN:
+ 				GOTO_ERROR_ON(tuple->size != 2,
+ 					      "antg tpl size");
+-				sprom->antenna_gain.ghz24.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a3 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a3 = tuple->data[1];
++				sprom->antenna_gain.a0 = tuple->data[1];
++				sprom->antenna_gain.a1 = tuple->data[1];
++				sprom->antenna_gain.a2 = tuple->data[1];
++				sprom->antenna_gain.a3 = tuple->data[1];
+ 				break;
+ 			case SSB_SDIO_CIS_BFLAGS:
+ 				GOTO_ERROR_ON((tuple->size != 3) &&
+--- a/include/linux/ssb/ssb_driver_gige.h
++++ b/include/linux/ssb/ssb_driver_gige.h
+@@ -2,6 +2,7 @@
+ #define LINUX_SSB_DRIVER_GIGE_H_
+ 
+ #include <linux/ssb/ssb.h>
++#include <linux/bug.h>
+ #include <linux/pci.h>
+ #include <linux/spinlock.h>
+ 
diff --git a/target/linux/generic/patches-2.6.39/025-bcma_backport.patch b/target/linux/generic/patches-2.6.39/025-bcma_backport.patch
index fa77868783..036f4199ad 100644
--- a/target/linux/generic/patches-2.6.39/025-bcma_backport.patch
+++ b/target/linux/generic/patches-2.6.39/025-bcma_backport.patch
@@ -103,7 +103,7 @@
 +
 +config BCMA_DRIVER_PCI_HOSTMODE
 +	bool "Driver for PCI core working in hostmode"
-+	depends on BCMA && MIPS
++	depends on BCMA && MIPS && BCMA_HOST_PCI
 +	help
 +	  PCI core hostmode operation (external PCI bus).
 +
@@ -172,7 +172,7 @@
 +- Create kernel Documentation (use info from README)
 --- /dev/null
 +++ b/drivers/bcma/bcma_private.h
-@@ -0,0 +1,54 @@
+@@ -0,0 +1,59 @@
 +#ifndef LINUX_BCMA_PRIVATE_H_
 +#define LINUX_BCMA_PRIVATE_H_
 +
@@ -188,12 +188,13 @@
 +struct bcma_bus;
 +
 +/* main.c */
-+int bcma_bus_register(struct bcma_bus *bus);
++int __devinit bcma_bus_register(struct bcma_bus *bus);
 +void bcma_bus_unregister(struct bcma_bus *bus);
 +int __init bcma_bus_early_register(struct bcma_bus *bus,
 +				   struct bcma_device *core_cc,
 +				   struct bcma_device *core_mips);
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus);
 +int bcma_bus_resume(struct bcma_bus *bus);
 +#endif
 +
@@ -222,8 +223,12 @@
 +extern void __exit bcma_host_pci_exit(void);
 +#endif /* CONFIG_BCMA_HOST_PCI */
 +
++/* driver_pci.c */
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address);
++
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc);
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
 +
 +#endif
@@ -517,7 +522,7 @@
 +#endif /* CONFIG_BCMA_DRIVER_MIPS */
 --- /dev/null
 +++ b/drivers/bcma/driver_chipcommon_pmu.c
-@@ -0,0 +1,309 @@
+@@ -0,0 +1,310 @@
 +/*
 + * Broadcom specific AMBA
 + * ChipCommon Power Management Unit driver
@@ -599,6 +604,7 @@
 +		min_msk = 0x200D;
 +		max_msk = 0xFFFF;
 +		break;
++	case 0x4331:
 +	case 43224:
 +	case 43225:
 +		break;
@@ -829,13 +835,14 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/driver_pci.c
-@@ -0,0 +1,237 @@
+@@ -0,0 +1,225 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Core
 + *
-+ * Copyright 2005, Broadcom Corporation
++ * Copyright 2005, 2011, Broadcom Corporation
 + * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
 + *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
@@ -847,40 +854,41 @@
 + * R/W ops.
 + **************************************************/
 +
-+static u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
 +{
-+	pcicore_write32(pc, 0x130, address);
-+	pcicore_read32(pc, 0x130);
-+	return pcicore_read32(pc, 0x134);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_DATA);
 +}
 +
 +#if 0
 +static void bcma_pcie_write(struct bcma_drv_pci *pc, u32 address, u32 data)
 +{
-+	pcicore_write32(pc, 0x130, address);
-+	pcicore_read32(pc, 0x130);
-+	pcicore_write32(pc, 0x134, data);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_DATA, data);
 +}
 +#endif
 +
 +static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u8 phy)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	u32 v;
 +	int i;
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 28); /* Write Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	v |= (0x1F << 18);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++	v |= (BCMA_CORE_PCI_MDIODATA_BLK_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
 +	v |= (phy << 4);
-+	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +
 +	udelay(10);
 +	for (i = 0; i < 200; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
 +			break;
 +		msleep(1);
 +	}
@@ -888,79 +896,84 @@
 +
 +static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u8 device, u8 address)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	int max_retries = 10;
 +	u16 ret = 0;
 +	u32 v;
 +	int i;
 +
-+	v = 0x80; /* Enable Preamble Sequence */
-+	v |= 0x2; /* MDIO Clock Divisor */
-+	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
 +
 +	if (pc->core->id.rev >= 10) {
 +		max_retries = 200;
 +		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 +	}
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 29); /* Read Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	if (pc->core->id.rev < 10)
-+		v |= (u32)device << 22;
-+	v |= (u32)address << 18;
-+	pcicore_write32(pc, mdio_data, v);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_READ;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
++
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +	/* Wait for the device to complete the transaction */
 +	udelay(10);
 +	for (i = 0; i < max_retries; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */) {
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE) {
 +			udelay(10);
-+			ret = pcicore_read32(pc, mdio_data);
++			ret = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_DATA);
 +			break;
 +		}
 +		msleep(1);
 +	}
-+	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
 +	return ret;
 +}
 +
 +static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u8 device,
 +				u8 address, u16 data)
 +{
-+	const u16 mdio_control = 0x128;
-+	const u16 mdio_data = 0x12C;
 +	int max_retries = 10;
 +	u32 v;
 +	int i;
 +
-+	v = 0x80; /* Enable Preamble Sequence */
-+	v |= 0x2; /* MDIO Clock Divisor */
-+	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
 +
 +	if (pc->core->id.rev >= 10) {
 +		max_retries = 200;
 +		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 +	}
 +
-+	v = (1 << 30); /* Start of Transaction */
-+	v |= (1 << 28); /* Write Transaction */
-+	v |= (1 << 17); /* Turnaround */
-+	if (pc->core->id.rev < 10)
-+		v |= (u32)device << 22;
-+	v |= (u32)address << 18;
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
 +	v |= data;
-+	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
 +	/* Wait for the device to complete the transaction */
 +	udelay(10);
 +	for (i = 0; i < max_retries; i++) {
-+		v = pcicore_read32(pc, mdio_control);
-+		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
 +			break;
 +		msleep(1);
 +	}
-+	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
 +}
 +
 +/**************************************************
@@ -969,72 +982,53 @@
 +
 +static u8 bcma_pcicore_polarity_workaround(struct bcma_drv_pci *pc)
 +{
-+	return (bcma_pcie_read(pc, 0x204) & 0x10) ? 0xC0 : 0x80;
++	u32 tmp;
++
++	tmp = bcma_pcie_read(pc, BCMA_CORE_PCI_PLP_STATUSREG);
++	if (tmp & BCMA_CORE_PCI_PLP_POLARITYINV_STAT)
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE |
++		       BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY;
++	else
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE;
 +}
 +
 +static void bcma_pcicore_serdes_workaround(struct bcma_drv_pci *pc)
 +{
-+	const u8 serdes_pll_device = 0x1D;
-+	const u8 serdes_rx_device = 0x1F;
 +	u16 tmp;
 +
-+	bcma_pcie_mdio_write(pc, serdes_rx_device, 1 /* Control */,
-+			      bcma_pcicore_polarity_workaround(pc));
-+	tmp = bcma_pcie_mdio_read(pc, serdes_pll_device, 1 /* Control */);
-+	if (tmp & 0x4000)
-+		bcma_pcie_mdio_write(pc, serdes_pll_device, 1, tmp & ~0x4000);
++	bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_RX,
++	                     BCMA_CORE_PCI_SERDES_RX_CTRL,
++			     bcma_pcicore_polarity_workaround(pc));
++	tmp = bcma_pcie_mdio_read(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++	                          BCMA_CORE_PCI_SERDES_PLL_CTRL);
++	if (tmp & BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN)
++		bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++		                     BCMA_CORE_PCI_SERDES_PLL_CTRL,
++		                     tmp & ~BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN);
 +}
 +
 +/**************************************************
 + * Init.
 + **************************************************/
 +
-+static void bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
++static void __devinit bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
 +{
 +	bcma_pcicore_serdes_workaround(pc);
 +}
 +
-+static bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
-+{
-+	struct bcma_bus *bus = pc->core->bus;
-+	u16 chipid_top;
-+
-+	chipid_top = (bus->chipinfo.id & 0xFF00);
-+	if (chipid_top != 0x4700 &&
-+	    chipid_top != 0x5300)
-+		return false;
-+
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
-+	if (bus->sprom.boardflags_lo & SSB_BFL_NOPCI)
-+		return false;
-+#endif /* CONFIG_SSB_DRIVER_PCICORE */
-+
-+#if 0
-+	/* TODO: on BCMA we use address from EROM instead of magic formula */
-+	u32 tmp;
-+	return !mips_busprobe32(tmp, (bus->mmio +
-+		(pc->core->core_index * BCMA_CORE_SIZE)));
-+#endif
-+
-+	return true;
-+}
-+
-+void bcma_core_pci_init(struct bcma_drv_pci *pc)
++void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
 +{
 +	if (pc->setup_done)
 +		return;
 +
-+	if (bcma_core_pci_is_in_hostmode(pc)) {
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	pc->hostmode = bcma_core_pci_is_in_hostmode(pc);
++	if (pc->hostmode)
 +		bcma_core_pci_hostmode_init(pc);
-+#else
-+		pr_err("Driver compiled without support for hostmode PCI\n");
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
-+	} else {
-+		bcma_core_pci_clientmode_init(pc);
-+	}
 +
-+	pc->setup_done = true;
++	if (!pc->hostmode)
++		bcma_core_pci_clientmode_init(pc);
 +}
 +
 +int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
@@ -1069,7 +1063,7 @@
 +EXPORT_SYMBOL_GPL(bcma_core_pci_irq_ctl);
 --- /dev/null
 +++ b/drivers/bcma/host_pci.c
-@@ -0,0 +1,299 @@
+@@ -0,0 +1,292 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Host
@@ -1226,8 +1220,8 @@
 +	.awrite32	= bcma_host_pci_awrite32,
 +};
 +
-+static int bcma_host_pci_probe(struct pci_dev *dev,
-+			     const struct pci_device_id *id)
++static int __devinit bcma_host_pci_probe(struct pci_dev *dev,
++					 const struct pci_device_id *id)
 +{
 +	struct bcma_bus *bus;
 +	int err = -ENOMEM;
@@ -1307,38 +1301,32 @@
 +}
 +
 +#ifdef CONFIG_PM
-+static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
++static int bcma_host_pci_suspend(struct device *dev)
 +{
-+	/* Host specific */
-+	pci_save_state(dev);
-+	pci_disable_device(dev);
-+	pci_set_power_state(dev, pci_choose_state(dev, state));
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	return 0;
++	bus->mapped_core = NULL;
++
++	return bcma_bus_suspend(bus);
 +}
 +
-+static int bcma_host_pci_resume(struct pci_dev *dev)
++static int bcma_host_pci_resume(struct device *dev)
 +{
-+	struct bcma_bus *bus = pci_get_drvdata(dev);
-+	int err;
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	/* Host specific */
-+	pci_set_power_state(dev, 0);
-+	err = pci_enable_device(dev);
-+	if (err)
-+		return err;
-+	pci_restore_state(dev);
++	return bcma_bus_resume(bus);
++}
 +
-+	/* Bus specific */
-+	err = bcma_bus_resume(bus);
-+	if (err)
-+		return err;
++static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
++			 bcma_host_pci_resume);
++#define BCMA_PM_OPS	(&bcma_pm_ops)
 +
-+	return 0;
-+}
 +#else /* CONFIG_PM */
-+# define bcma_host_pci_suspend	NULL
-+# define bcma_host_pci_resume	NULL
++
++#define BCMA_PM_OPS     NULL
++
 +#endif /* CONFIG_PM */
 +
 +static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
@@ -1356,8 +1344,7 @@
 +	.id_table = bcma_pci_bridge_tbl,
 +	.probe = bcma_host_pci_probe,
 +	.remove = bcma_host_pci_remove,
-+	.suspend = bcma_host_pci_suspend,
-+	.resume = bcma_host_pci_resume,
++	.driver.pm = BCMA_PM_OPS,
 +};
 +
 +int __init bcma_host_pci_init(void)
@@ -1371,7 +1358,7 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/main.c
-@@ -0,0 +1,354 @@
+@@ -0,0 +1,387 @@
 +/*
 + * Broadcom specific AMBA
 + * Bus subsystem
@@ -1387,6 +1374,12 @@
 +MODULE_DESCRIPTION("Broadcom's specific AMBA driver");
 +MODULE_LICENSE("GPL");
 +
++/* contains the number the next bus should get. */
++static unsigned int bcma_bus_next_num = 0;
++
++/* bcma_buses_mutex locks the bcma_bus_next_num */
++static DEFINE_MUTEX(bcma_buses_mutex);
++
 +static int bcma_bus_match(struct device *dev, struct device_driver *drv);
 +static int bcma_device_probe(struct device *dev);
 +static int bcma_device_remove(struct device *dev);
@@ -1429,7 +1422,7 @@
 +	.dev_attrs	= bcma_device_attrs,
 +};
 +
-+static struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
++struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
 +{
 +	struct bcma_device *core;
 +
@@ -1439,6 +1432,7 @@
 +	}
 +	return NULL;
 +}
++EXPORT_SYMBOL_GPL(bcma_find_core);
 +
 +static void bcma_release_core_dev(struct device *dev)
 +{
@@ -1467,7 +1461,7 @@
 +
 +		core->dev.release = bcma_release_core_dev;
 +		core->dev.bus = &bcma_bus_type;
-+		dev_set_name(&core->dev, "bcma%d:%d", 0/*bus->num*/, dev_id);
++		dev_set_name(&core->dev, "bcma%d:%d", bus->num, dev_id);
 +
 +		switch (bus->hosttype) {
 +		case BCMA_HOSTTYPE_PCI:
@@ -1506,11 +1500,15 @@
 +	}
 +}
 +
-+int bcma_bus_register(struct bcma_bus *bus)
++int __devinit bcma_bus_register(struct bcma_bus *bus)
 +{
 +	int err;
 +	struct bcma_device *core;
 +
++	mutex_lock(&bcma_buses_mutex);
++	bus->num = bcma_bus_next_num++;
++	mutex_unlock(&bcma_buses_mutex);
++
 +	/* Scan for devices (cores) */
 +	err = bcma_bus_scan(bus);
 +	if (err) {
@@ -1543,10 +1541,8 @@
 +	err = bcma_sprom_get(bus);
 +	if (err == -ENOENT) {
 +		pr_err("No SPROM available\n");
-+	} else if (err) {
++	} else if (err)
 +		pr_err("Failed to get SPROM: %d\n", err);
-+		return -ENOENT;
-+	}
 +
 +	/* Register found cores */
 +	bcma_register_cores(bus);
@@ -1615,6 +1611,21 @@
 +}
 +
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->suspend)
++				adrv->suspend(core);
++		}
++	}
++	return 0;
++}
++
 +int bcma_bus_resume(struct bcma_bus *bus)
 +{
 +	struct bcma_device *core;
@@ -1626,6 +1637,15 @@
 +		bcma_core_chipcommon_init(&bus->drv_cc);
 +	}
 +
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->resume)
++				adrv->resume(core);
++		}
++	}
++
 +	return 0;
 +}
 +#endif
@@ -1728,7 +1748,7 @@
 +module_exit(bcma_modexit)
 --- /dev/null
 +++ b/drivers/bcma/scan.c
-@@ -0,0 +1,486 @@
+@@ -0,0 +1,507 @@
 +/*
 + * Broadcom specific AMBA
 + * Bus scanning
@@ -1943,6 +1963,17 @@
 +	return NULL;
 +}
 +
++static struct bcma_device *bcma_find_core_reverse(struct bcma_bus *bus, u16 coreid)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry_reverse(core, &bus->cores, list) {
++		if (core->id.id == coreid)
++			return core;
++	}
++	return NULL;
++}
++
 +static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
 +			      struct bcma_device_id *match, int core_num,
 +			      struct bcma_device *core)
@@ -2084,6 +2115,7 @@
 +void bcma_init_bus(struct bcma_bus *bus)
 +{
 +	s32 tmp;
++	struct bcma_chipinfo *chipinfo = &(bus->chipinfo);
 +
 +	if (bus->init_done)
 +		return;
@@ -2094,9 +2126,12 @@
 +	bcma_scan_switch_core(bus, BCMA_ADDR_BASE);
 +
 +	tmp = bcma_scan_read32(bus, 0, BCMA_CC_ID);
-+	bus->chipinfo.id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
-+	bus->chipinfo.rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
-+	bus->chipinfo.pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	chipinfo->id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
++	chipinfo->rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
++	chipinfo->pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	pr_info("Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
++		chipinfo->id, chipinfo->rev, chipinfo->pkg);
++
 +	bus->init_done = true;
 +}
 +
@@ -2123,6 +2158,7 @@
 +	bcma_scan_switch_core(bus, erombase);
 +
 +	while (eromptr < eromend) {
++		struct bcma_device *other_core;
 +		struct bcma_device *core = kzalloc(sizeof(*core), GFP_KERNEL);
 +		if (!core)
 +			return -ENOMEM;
@@ -2130,18 +2166,23 @@
 +		core->bus = bus;
 +
 +		err = bcma_get_next_core(bus, &eromptr, NULL, core_num, core);
-+		if (err == -ENODEV) {
-+			core_num++;
-+			continue;
-+		} else if (err == -ENXIO)
-+			continue;
-+		else if (err == -ESPIPE)
-+			break;
-+		else if (err < 0)
++		if (err < 0) {
++			kfree(core);
++			if (err == -ENODEV) {
++				core_num++;
++				continue;
++			} else if (err == -ENXIO) {
++				continue;
++			} else if (err == -ESPIPE) {
++				break;
++			}
 +			return err;
++		}
 +
 +		core->core_index = core_num++;
 +		bus->nr_cores++;
++		other_core = bcma_find_core_reverse(bus, core->id.id);
++		core->core_unit = (other_core == NULL) ? 0 : other_core->core_unit + 1;
 +
 +		pr_info("Core %d found: %s "
 +			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
@@ -2276,7 +2317,7 @@
 +#endif /* BCMA_SCAN_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma.h
-@@ -0,0 +1,298 @@
+@@ -0,0 +1,307 @@
 +#ifndef LINUX_BCMA_H_
 +#define LINUX_BCMA_H_
 +
@@ -2415,6 +2456,7 @@
 +	bool dev_registered;
 +
 +	u8 core_index;
++	u8 core_unit;
 +
 +	u32 addr;
 +	u32 wrap;
@@ -2441,7 +2483,7 @@
 +
 +	int (*probe)(struct bcma_device *dev);
 +	void (*remove)(struct bcma_device *dev);
-+	int (*suspend)(struct bcma_device *dev, pm_message_t state);
++	int (*suspend)(struct bcma_device *dev);
 +	int (*resume)(struct bcma_device *dev);
 +	void (*shutdown)(struct bcma_device *dev);
 +
@@ -2454,6 +2496,12 @@
 +
 +extern void bcma_driver_unregister(struct bcma_driver *drv);
 +
++/* Set a fallback SPROM.
++ * See kdoc at the function definition for complete documentation. */
++extern int bcma_arch_register_fallback_sprom(
++		int (*sprom_callback)(struct bcma_bus *bus,
++		struct ssb_sprom *out));
++
 +struct bcma_bus {
 +	/* The MMIO area. */
 +	void __iomem *mmio;
@@ -2474,6 +2522,7 @@
 +	struct list_head cores;
 +	u8 nr_cores;
 +	u8 init_done:1;
++	u8 num;
 +
 +	struct bcma_drv_cc drv_cc;
 +	struct bcma_drv_pci drv_pci;
@@ -2561,6 +2610,7 @@
 +	bcma_write16(cc, offset, (bcma_read16(cc, offset) & mask) | set);
 +}
 +
++extern struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid);
 +extern bool bcma_core_is_enabled(struct bcma_device *core);
 +extern void bcma_core_disable(struct bcma_device *core, u32 flags);
 +extern int bcma_core_enable(struct bcma_device *core, u32 flags);
@@ -2577,7 +2627,7 @@
 +#endif /* LINUX_BCMA_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_driver_chipcommon.h
-@@ -0,0 +1,391 @@
+@@ -0,0 +1,415 @@
 +#ifndef LINUX_BCMA_DRIVER_CC_H_
 +#define LINUX_BCMA_DRIVER_CC_H_
 +
@@ -2636,6 +2686,9 @@
 +#define	 BCMA_CC_OTPS_HW_PROTECT	0x00000001
 +#define	 BCMA_CC_OTPS_SW_PROTECT	0x00000002
 +#define	 BCMA_CC_OTPS_CID_PROTECT	0x00000004
++#define  BCMA_CC_OTPS_GU_PROG_IND	0x00000F00	/* General Use programmed indication */
++#define  BCMA_CC_OTPS_GU_PROG_IND_SHIFT	8
++#define  BCMA_CC_OTPS_GU_PROG_HW	0x00000100	/* HW region programmed */
 +#define BCMA_CC_OTPC			0x0014		/* OTP control */
 +#define	 BCMA_CC_OTPC_RECWAIT		0xFF000000
 +#define	 BCMA_CC_OTPC_PROGWAIT		0x00FFFF00
@@ -2652,6 +2705,8 @@
 +#define	 BCMA_CC_OTPP_READ		0x40000000
 +#define	 BCMA_CC_OTPP_START		0x80000000
 +#define	 BCMA_CC_OTPP_BUSY		0x80000000
++#define BCMA_CC_OTPL			0x001C		/* OTP layout */
++#define  BCMA_CC_OTPL_GURGN_OFFSET	0x00000FFF	/* offset of general use region */
 +#define BCMA_CC_IRQSTAT			0x0020
 +#define BCMA_CC_IRQMASK			0x0024
 +#define	 BCMA_CC_IRQ_GPIO		0x00000001	/* gpio intr */
@@ -2659,6 +2714,10 @@
 +#define	 BCMA_CC_IRQ_WDRESET		0x80000000	/* watchdog reset occurred */
 +#define BCMA_CC_CHIPCTL			0x0028		/* Rev >= 11 only */
 +#define BCMA_CC_CHIPSTAT		0x002C		/* Rev >= 11 only */
++#define  BCMA_CC_CHIPST_4313_SPROM_PRESENT	1
++#define  BCMA_CC_CHIPST_4313_OTP_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_SPROM_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_OTP_PRESENT	4
 +#define BCMA_CC_JCMD			0x0030		/* Rev >= 10 only */
 +#define  BCMA_CC_JCMD_START		0x80000000
 +#define  BCMA_CC_JCMD_BUSY		0x80000000
@@ -2761,6 +2820,22 @@
 +#define BCMA_CC_FLASH_CFG		0x0128
 +#define  BCMA_CC_FLASH_CFG_DS		0x0010	/* Data size, 0=8bit, 1=16bit */
 +#define BCMA_CC_FLASH_WAITCNT		0x012C
++#define BCMA_CC_SROM_CONTROL		0x0190
++#define  BCMA_CC_SROM_CONTROL_START	0x80000000
++#define  BCMA_CC_SROM_CONTROL_BUSY	0x80000000
++#define  BCMA_CC_SROM_CONTROL_OPCODE	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OP_READ	0x00000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRITE	0x20000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRDIS	0x40000000
++#define  BCMA_CC_SROM_CONTROL_OP_WREN	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OTPSEL	0x00000010
++#define  BCMA_CC_SROM_CONTROL_LOCK	0x00000008
++#define  BCMA_CC_SROM_CONTROL_SIZE_MASK	0x00000006
++#define  BCMA_CC_SROM_CONTROL_SIZE_1K	0x00000000
++#define  BCMA_CC_SROM_CONTROL_SIZE_4K	0x00000002
++#define  BCMA_CC_SROM_CONTROL_SIZE_16K	0x00000004
++#define  BCMA_CC_SROM_CONTROL_SIZE_SHIFT	1
++#define  BCMA_CC_SROM_CONTROL_PRESENT	0x00000001
 +/* 0x1E0 is defined as shared BCMA_CLKCTLST */
 +#define BCMA_CC_HW_WORKAROUND		0x01E4 /* Hardware workaround (rev >= 20) */
 +#define BCMA_CC_UART0_DATA		0x0300
@@ -2820,7 +2895,6 @@
 +#define BCMA_CC_PLLCTL_ADDR		0x0660
 +#define BCMA_CC_PLLCTL_DATA		0x0664
 +#define BCMA_CC_SPROM			0x0800 /* SPROM beginning */
-+#define BCMA_CC_SPROM_PCIE6		0x0830 /* SPROM beginning on PCIe rev >= 6 */
 +
 +/* Divider allocation in 4716/47162/5356 */
 +#define BCMA_CC_PMU5_MAINPLL_CPU	1
@@ -2971,7 +3045,7 @@
 +#endif /* LINUX_BCMA_DRIVER_CC_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_driver_pci.h
-@@ -0,0 +1,91 @@
+@@ -0,0 +1,214 @@
 +#ifndef LINUX_BCMA_DRIVER_PCI_H_
 +#define LINUX_BCMA_DRIVER_PCI_H_
 +
@@ -3027,6 +3101,35 @@
 +#define  BCMA_CORE_PCI_SBTOPCI1_MASK		0xFC000000
 +#define BCMA_CORE_PCI_SBTOPCI2			0x0108	/* Backplane to PCI translation 2 (sbtopci2) */
 +#define  BCMA_CORE_PCI_SBTOPCI2_MASK		0xC0000000
++#define BCMA_CORE_PCI_CONFIG_ADDR		0x0120	/* pcie config space access */
++#define BCMA_CORE_PCI_CONFIG_DATA		0x0124	/* pcie config space access */
++#define BCMA_CORE_PCI_MDIO_CONTROL		0x0128	/* controls the mdio access */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_MASK	0x7f	/* clock to be used on MDIO */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL	0x2
++#define  BCMA_CORE_PCI_MDIOCTL_PREAM_EN		0x80	/* Enable preamble sequnce */
++#define  BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE	0x100	/* Tranaction complete */
++#define BCMA_CORE_PCI_MDIO_DATA			0x012c	/* Data to the mdio access */
++#define  BCMA_CORE_PCI_MDIODATA_MASK		0x0000ffff /* data 2 bytes */
++#define  BCMA_CORE_PCI_MDIODATA_TA		0x00020000 /* Turnaround */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD	18	/* Regaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK_OLD	0x003c0000 /* Regaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD	22	/* Physmedia devaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK_OLD	0x0fc00000 /* Physmedia devaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF	18	/* Regaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK	0x007c0000 /* Regaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF	23	/* Physmedia devaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK	0x0f800000 /* Physmedia devaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_WRITE		0x10000000 /* write Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_READ		0x20000000 /* Read Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_START		0x40000000 /* start of Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_ADDR	0x0	/* dev address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_BLK_ADDR	0x1F	/* blk address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_PLL		0x1d	/* SERDES PLL Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_TX		0x1e	/* SERDES TX Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_RX		0x1f	/* SERDES RX Dev */
++#define BCMA_CORE_PCI_PCIEIND_ADDR		0x0130	/* indirect access to the internal register */
++#define BCMA_CORE_PCI_PCIEIND_DATA		0x0134	/* Data to/from the internal regsiter */
++#define BCMA_CORE_PCI_CLKREQENCTRL		0x0138	/*  >= rev 6, Clkreq rdma control */
 +#define BCMA_CORE_PCI_PCICFG0			0x0400	/* PCI config space 0 (rev >= 8) */
 +#define BCMA_CORE_PCI_PCICFG1			0x0500	/* PCI config space 1 (rev >= 8) */
 +#define BCMA_CORE_PCI_PCICFG2			0x0600	/* PCI config space 2 (rev >= 8) */
@@ -3046,26 +3149,120 @@
 +#define  BCMA_CORE_PCI_SBTOPCI_RC_READL		0x00000010 /* Memory read line */
 +#define  BCMA_CORE_PCI_SBTOPCI_RC_READM		0x00000020 /* Memory read multiple */
 +
++/* PCIE protocol PHY diagnostic registers */
++#define BCMA_CORE_PCI_PLP_MODEREG		0x200	/* Mode */
++#define BCMA_CORE_PCI_PLP_STATUSREG		0x204	/* Status */
++#define  BCMA_CORE_PCI_PLP_POLARITYINV_STAT	0x10	/* Status reg PCIE_PLP_STATUSREG */
++#define BCMA_CORE_PCI_PLP_LTSSMCTRLREG		0x208	/* LTSSM control */
++#define BCMA_CORE_PCI_PLP_LTLINKNUMREG		0x20c	/* Link Training Link number */
++#define BCMA_CORE_PCI_PLP_LTLANENUMREG		0x210	/* Link Training Lane number */
++#define BCMA_CORE_PCI_PLP_LTNFTSREG		0x214	/* Link Training N_FTS */
++#define BCMA_CORE_PCI_PLP_ATTNREG		0x218	/* Attention */
++#define BCMA_CORE_PCI_PLP_ATTNMASKREG		0x21C	/* Attention Mask */
++#define BCMA_CORE_PCI_PLP_RXERRCTR		0x220	/* Rx Error */
++#define BCMA_CORE_PCI_PLP_RXFRMERRCTR		0x224	/* Rx Framing Error */
++#define BCMA_CORE_PCI_PLP_RXERRTHRESHREG	0x228	/* Rx Error threshold */
++#define BCMA_CORE_PCI_PLP_TESTCTRLREG		0x22C	/* Test Control reg */
++#define BCMA_CORE_PCI_PLP_SERDESCTRLOVRDREG	0x230	/* SERDES Control Override */
++#define BCMA_CORE_PCI_PLP_TIMINGOVRDREG		0x234	/* Timing param override */
++#define BCMA_CORE_PCI_PLP_RXTXSMDIAGREG		0x238	/* RXTX State Machine Diag */
++#define BCMA_CORE_PCI_PLP_LTSSMDIAGREG		0x23C	/* LTSSM State Machine Diag */
++
++/* PCIE protocol DLLP diagnostic registers */
++#define BCMA_CORE_PCI_DLLP_LCREG		0x100	/* Link Control */
++#define BCMA_CORE_PCI_DLLP_LSREG		0x104	/* Link Status */
++#define BCMA_CORE_PCI_DLLP_LAREG		0x108	/* Link Attention */
++#define  BCMA_CORE_PCI_DLLP_LSREG_LINKUP	(1 << 16)
++#define BCMA_CORE_PCI_DLLP_LAMASKREG		0x10C	/* Link Attention Mask */
++#define BCMA_CORE_PCI_DLLP_NEXTTXSEQNUMREG	0x110	/* Next Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_ACKEDTXSEQNUMREG	0x114	/* Acked Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_PURGEDTXSEQNUMREG	0x118	/* Purged Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_RXSEQNUMREG		0x11C	/* Rx Sequence Number */
++#define BCMA_CORE_PCI_DLLP_LRREG		0x120	/* Link Replay */
++#define BCMA_CORE_PCI_DLLP_LACKTOREG		0x124	/* Link Ack Timeout */
++#define BCMA_CORE_PCI_DLLP_PMTHRESHREG		0x128	/* Power Management Threshold */
++#define BCMA_CORE_PCI_DLLP_RTRYWPREG		0x12C	/* Retry buffer write ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYRPREG		0x130	/* Retry buffer Read ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYPPREG		0x134	/* Retry buffer Purged ptr */
++#define BCMA_CORE_PCI_DLLP_RTRRWREG		0x138	/* Retry buffer Read/Write */
++#define BCMA_CORE_PCI_DLLP_ECTHRESHREG		0x13C	/* Error Count Threshold */
++#define BCMA_CORE_PCI_DLLP_TLPERRCTRREG		0x140	/* TLP Error Counter */
++#define BCMA_CORE_PCI_DLLP_ERRCTRREG		0x144	/* Error Counter */
++#define BCMA_CORE_PCI_DLLP_NAKRXCTRREG		0x148	/* NAK Received Counter */
++#define BCMA_CORE_PCI_DLLP_TESTREG		0x14C	/* Test */
++#define BCMA_CORE_PCI_DLLP_PKTBIST		0x150	/* Packet BIST */
++#define BCMA_CORE_PCI_DLLP_PCIE11		0x154	/* DLLP PCIE 1.1 reg */
++
++/* SERDES RX registers */
++#define BCMA_CORE_PCI_SERDES_RX_CTRL		1	/* Rx cntrl */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE	0x80	/* rxpolarity_force */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY	0x40	/* rxpolarity_value */
++#define BCMA_CORE_PCI_SERDES_RX_TIMER1		2	/* Rx Timer1 */
++#define BCMA_CORE_PCI_SERDES_RX_CDR		6	/* CDR */
++#define BCMA_CORE_PCI_SERDES_RX_CDRBW		7	/* CDR BW */
++
++/* SERDES PLL registers */
++#define BCMA_CORE_PCI_SERDES_PLL_CTRL		1	/* PLL control reg */
++#define BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN	0x4000	/* bit 14 is FREQDET on */
++
 +/* PCIcore specific boardflags */
 +#define BCMA_CORE_PCI_BFL_NOPCI			0x00000400 /* Board leaves PCI floating */
 +
++/* PCIE Config space accessing MACROS */
++#define BCMA_CORE_PCI_CFG_BUS_SHIFT		24	/* Bus shift */
++#define BCMA_CORE_PCI_CFG_SLOT_SHIFT		19	/* Slot/Device shift */
++#define BCMA_CORE_PCI_CFG_FUN_SHIFT		16	/* Function shift */
++#define BCMA_CORE_PCI_CFG_OFF_SHIFT		0	/* Register shift */
++
++#define BCMA_CORE_PCI_CFG_BUS_MASK		0xff	/* Bus mask */
++#define BCMA_CORE_PCI_CFG_SLOT_MASK		0x1f	/* Slot/Device mask */
++#define BCMA_CORE_PCI_CFG_FUN_MASK		7	/* Function mask */
++#define BCMA_CORE_PCI_CFG_OFF_MASK		0xfff	/* Register mask */
++
++/* PCIE Root Capability Register bits (Host mode only) */
++#define BCMA_CORE_PCI_RC_CRS_VISIBILITY		0x0001
++
++struct bcma_drv_pci;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++struct bcma_drv_pci_host {
++	struct bcma_drv_pci *pdev;
++
++	u32 host_cfg_addr;
++	spinlock_t cfgspace_lock;
++
++	struct pci_controller pci_controller;
++	struct pci_ops pci_ops;
++	struct resource mem_resource;
++	struct resource io_resource;
++};
++#endif
++
 +struct bcma_drv_pci {
 +	struct bcma_device *core;
 +	u8 setup_done:1;
++	u8 hostmode:1;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	struct bcma_drv_pci_host *host_controller;
++#endif
 +};
 +
 +/* Register access */
 +#define pcicore_read32(pc, offset)		bcma_read32((pc)->core, offset)
 +#define pcicore_write32(pc, offset, val)	bcma_write32((pc)->core, offset, val)
 +
-+extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
++extern void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc);
 +extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
 +				 struct bcma_device *core, bool enable);
 +
++extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
++extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
++
 +#endif /* LINUX_BCMA_DRIVER_PCI_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_regs.h
-@@ -0,0 +1,59 @@
+@@ -0,0 +1,86 @@
 +#ifndef LINUX_BCMA_REGS_H_
 +#define LINUX_BCMA_REGS_H_
 +
@@ -3124,6 +3321,33 @@
 +#define  BCMA_PCI_GPIO_XTAL		0x40	/* PCI config space GPIO 14 for Xtal powerup */
 +#define  BCMA_PCI_GPIO_PLL		0x80	/* PCI config space GPIO 15 for PLL powerdown */
 +
++/* SiliconBackplane Address Map.
++ * All regions may not exist on all chips.
++ */
++#define BCMA_SOC_SDRAM_BASE		0x00000000U	/* Physical SDRAM */
++#define BCMA_SOC_PCI_MEM		0x08000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI_MEM_SZ		(64 * 1024 * 1024)
++#define BCMA_SOC_PCI_CFG		0x0c000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_SDRAM_SWAPPED		0x10000000U	/* Byteswapped Physical SDRAM */
++#define BCMA_SOC_SDRAM_R2		0x80000000U	/* Region 2 for sdram (512 MB) */
++
++
++#define BCMA_SOC_PCI_DMA		0x40000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA2		0x80000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA_SZ		0x40000000U	/* Client Mode sb2pcitranslation2 size in bytes */
++#define BCMA_SOC_PCIE_DMA_L32		0x00000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), low 32 bits
++							 */
++#define BCMA_SOC_PCIE_DMA_H32		0x80000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
++#define BCMA_SOC_PCI1_MEM		0x40000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI1_CFG		0x44000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_PCIE1_DMA_H32		0xc0000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
 +#endif /* LINUX_BCMA_REGS_H_ */
 --- a/include/linux/mod_devicetable.h
 +++ b/include/linux/mod_devicetable.h
@@ -3191,11 +3415,13 @@
  			 sizeof(struct virtio_device_id), "virtio",
 --- /dev/null
 +++ b/drivers/bcma/sprom.c
-@@ -0,0 +1,247 @@
+@@ -0,0 +1,450 @@
 +/*
 + * Broadcom specific AMBA
 + * SPROM reading
 + *
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
@@ -3208,7 +3434,57 @@
 +#include <linux/dma-mapping.h>
 +#include <linux/slab.h>
 +
-+#define SPOFF(offset)	((offset) / sizeof(u16))
++static int(*get_fallback_sprom)(struct bcma_bus *dev, struct ssb_sprom *out);
++
++/**
++ * bcma_arch_register_fallback_sprom - Registers a method providing a
++ * fallback SPROM if no SPROM is found.
++ *
++ * @sprom_callback: The callback function.
++ *
++ * With this function the architecture implementation may register a
++ * callback handler which fills the SPROM data structure. The fallback is
++ * used for PCI based BCMA devices, where no valid SPROM can be found
++ * in the shadow registers and to provide the SPROM for SoCs where BCMA is
++ * to controll the system bus.
++ *
++ * This function is useful for weird architectures that have a half-assed
++ * BCMA device hardwired to their PCI bus.
++ *
++ * This function is available for architecture code, only. So it is not
++ * exported.
++ */
++int bcma_arch_register_fallback_sprom(int (*sprom_callback)(struct bcma_bus *bus,
++				     struct ssb_sprom *out))
++{
++	if (get_fallback_sprom)
++		return -EEXIST;
++	get_fallback_sprom = sprom_callback;
++
++	return 0;
++}
++
++static int bcma_fill_sprom_with_fallback(struct bcma_bus *bus,
++					 struct ssb_sprom *out)
++{
++	int err;
++
++	if (!get_fallback_sprom) {
++		err = -ENOENT;
++		goto fail;
++	}
++
++	err = get_fallback_sprom(bus, out);
++	if (err)
++		goto fail;
++
++	pr_debug("Using SPROM revision %d provided by"
++		 " platform.\n", bus->sprom.revision);
++	return 0;
++fail:
++	pr_warn("Using fallback SPROM failed (err %d)\n", err);
++	return err;
++}
 +
 +/**************************************************
 + * R/W ops.
@@ -3318,10 +3594,21 @@
 + * SPROM extraction.
 + **************************************************/
 +
++#define SPOFF(offset)	((offset) / sizeof(u16))
++
++#define SPEX(_field, _offset, _mask, _shift)	\
++	bus->sprom._field = ((sprom[SPOFF(_offset)] & (_mask)) >> (_shift))
++
 +static void bcma_sprom_extract_r8(struct bcma_bus *bus, const u16 *sprom)
 +{
-+	u16 v;
++	u16 v, o;
 +	int i;
++	u16 pwr_info_offset[] = {
++		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
++		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
++	};
++	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
++			ARRAY_SIZE(bus->sprom.core_pwr_info));
 +
 +	bus->sprom.revision = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] &
 +		SSB_SPROM_REVISION_REV;
@@ -3331,85 +3618,229 @@
 +		*(((__be16 *)bus->sprom.il0mac) + i) = cpu_to_be16(v);
 +	}
 +
-+	bus->sprom.board_rev = sprom[SPOFF(SSB_SPROM8_BOARDREV)];
-+
-+	bus->sprom.txpid2g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G0) >> SSB_SPROM4_TXPID2G0_SHIFT;
-+	bus->sprom.txpid2g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G1) >> SSB_SPROM4_TXPID2G1_SHIFT;
-+	bus->sprom.txpid2g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G2) >> SSB_SPROM4_TXPID2G2_SHIFT;
-+	bus->sprom.txpid2g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G3) >> SSB_SPROM4_TXPID2G3_SHIFT;
-+
-+	bus->sprom.txpid5gl[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL0) >> SSB_SPROM4_TXPID5GL0_SHIFT;
-+	bus->sprom.txpid5gl[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL1) >> SSB_SPROM4_TXPID5GL1_SHIFT;
-+	bus->sprom.txpid5gl[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL2) >> SSB_SPROM4_TXPID5GL2_SHIFT;
-+	bus->sprom.txpid5gl[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL3) >> SSB_SPROM4_TXPID5GL3_SHIFT;
-+
-+	bus->sprom.txpid5g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G0) >> SSB_SPROM4_TXPID5G0_SHIFT;
-+	bus->sprom.txpid5g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G1) >> SSB_SPROM4_TXPID5G1_SHIFT;
-+	bus->sprom.txpid5g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G2) >> SSB_SPROM4_TXPID5G2_SHIFT;
-+	bus->sprom.txpid5g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G3) >> SSB_SPROM4_TXPID5G3_SHIFT;
-+
-+	bus->sprom.txpid5gh[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH0) >> SSB_SPROM4_TXPID5GH0_SHIFT;
-+	bus->sprom.txpid5gh[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH1) >> SSB_SPROM4_TXPID5GH1_SHIFT;
-+	bus->sprom.txpid5gh[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH2) >> SSB_SPROM4_TXPID5GH2_SHIFT;
-+	bus->sprom.txpid5gh[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH3) >> SSB_SPROM4_TXPID5GH3_SHIFT;
-+
-+	bus->sprom.boardflags_lo = sprom[SPOFF(SSB_SPROM8_BFLLO)];
-+	bus->sprom.boardflags_hi = sprom[SPOFF(SSB_SPROM8_BFLHI)];
-+	bus->sprom.boardflags2_lo = sprom[SPOFF(SSB_SPROM8_BFL2LO)];
-+	bus->sprom.boardflags2_hi = sprom[SPOFF(SSB_SPROM8_BFL2HI)];
-+
-+	bus->sprom.country_code = sprom[SPOFF(SSB_SPROM8_CCODE)];
-+
-+	bus->sprom.fem.ghz2.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz2.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz2.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz2.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz2.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
-+
-+	bus->sprom.fem.ghz5.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz5.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz5.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz5.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz5.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
++	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
++
++	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
++	     SSB_SPROM4_TXPID2G0_SHIFT);
++	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
++	     SSB_SPROM4_TXPID2G1_SHIFT);
++	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
++	     SSB_SPROM4_TXPID2G2_SHIFT);
++	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
++	     SSB_SPROM4_TXPID2G3_SHIFT);
++
++	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
++	     SSB_SPROM4_TXPID5GL0_SHIFT);
++	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
++	     SSB_SPROM4_TXPID5GL1_SHIFT);
++	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
++	     SSB_SPROM4_TXPID5GL2_SHIFT);
++	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
++	     SSB_SPROM4_TXPID5GL3_SHIFT);
++
++	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
++	     SSB_SPROM4_TXPID5G0_SHIFT);
++	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
++	     SSB_SPROM4_TXPID5G1_SHIFT);
++	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
++	     SSB_SPROM4_TXPID5G2_SHIFT);
++	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
++	     SSB_SPROM4_TXPID5G3_SHIFT);
++
++	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
++	     SSB_SPROM4_TXPID5GH0_SHIFT);
++	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
++	     SSB_SPROM4_TXPID5GH1_SHIFT);
++	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
++	     SSB_SPROM4_TXPID5GH2_SHIFT);
++	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
++	     SSB_SPROM4_TXPID5GH3_SHIFT);
++
++	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
++	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
++	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
++	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
++
++	SPEX(country_code, SSB_SPROM8_CCODE, ~0, 0);
++
++	/* Extract cores power info info */
++	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
++		o = pwr_info_offset[i];
++		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_MAXP, 0);
++
++		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
++
++		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GH_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
++
++		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
++	}
++
++	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++
++	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++}
++
++/*
++ * Indicates the presence of external SPROM.
++ */
++static bool bcma_sprom_ext_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 srom_control;
++	u32 present_mask;
++
++	if (bus->drv_cc.core->id.rev >= 31) {
++		if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
++			return false;
++
++		srom_control = bcma_read32(bus->drv_cc.core,
++					   BCMA_CC_SROM_CONTROL);
++		return srom_control & BCMA_CC_SROM_CONTROL_PRESENT;
++	}
++
++	/* older chipcommon revisions use chip status register */
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present_mask = BCMA_CC_CHIPST_4313_SPROM_PRESENT;
++		break;
++
++	case 0x4331:
++		present_mask = BCMA_CC_CHIPST_4331_SPROM_PRESENT;
++		break;
++
++	default:
++		return true;
++	}
++
++	return chip_status & present_mask;
++}
++
++/*
++ * Indicates that on-chip OTP memory is present and enabled.
++ */
++static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 otpsize = 0;
++	bool present;
++
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present = chip_status & BCMA_CC_CHIPST_4313_OTP_PRESENT;
++		break;
++
++	case 0x4331:
++		present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
++		break;
++
++	case 43224:
++	case 43225:
++		/* for these chips OTP is always available */
++		present = true;
++		break;
++
++	default:
++		present = false;
++		break;
++	}
++
++	if (present) {
++		otpsize = bus->drv_cc.capabilities & BCMA_CC_CAP_OTPS;
++		otpsize >>= BCMA_CC_CAP_OTPS_SHIFT;
++	}
++
++	return otpsize != 0;
++}
++
++/*
++ * Verify OTP is filled and determine the byte
++ * offset where SPROM data is located.
++ *
++ * On error, returns 0; byte offset otherwise.
++ */
++static int bcma_sprom_onchip_offset(struct bcma_bus *bus)
++{
++	struct bcma_device *cc = bus->drv_cc.core;
++	u32 offset;
++
++	/* verify OTP status */
++	if ((bcma_read32(cc, BCMA_CC_OTPS) & BCMA_CC_OTPS_GU_PROG_HW) == 0)
++		return 0;
++
++	/* obtain bit offset from otplayout register */
++	offset = (bcma_read32(cc, BCMA_CC_OTPL) & BCMA_CC_OTPL_GURGN_OFFSET);
++	return BCMA_CC_SPROM + (offset >> 3);
 +}
 +
 +int bcma_sprom_get(struct bcma_bus *bus)
 +{
-+	u16 offset;
++	u16 offset = BCMA_CC_SPROM;
 +	u16 *sprom;
 +	int err = 0;
 +
 +	if (!bus->drv_cc.core)
 +		return -EOPNOTSUPP;
 +
-+	if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
-+		return -ENOENT;
++	if (!bcma_sprom_ext_available(bus)) {
++		/*
++		 * External SPROM takes precedence so check
++		 * on-chip OTP only when no external SPROM
++		 * is present.
++		 */
++		if (bcma_sprom_onchip_available(bus)) {
++			/* determine offset */
++			offset = bcma_sprom_onchip_offset(bus);
++		}
++		if (!offset) {
++			/*
++			 * Maybe there is no SPROM on the device?
++			 * Now we ask the arch code if there is some sprom
++			 * available for this device in some other storage.
++			 */
++			err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
++			return err;
++		}
++	}
 +
 +	sprom = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
 +			GFP_KERNEL);
@@ -3419,11 +3850,7 @@
 +	if (bus->chipinfo.id == 0x4331)
 +		bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
 +
-+	/* Most cards have SPROM moved by additional offset 0x30 (48 dwords).
-+	 * According to brcm80211 this applies to cards with PCIe rev >= 6
-+	 * TODO: understand this condition and use it */
-+	offset = (bus->chipinfo.id == 0x4331) ? BCMA_CC_SPROM :
-+		BCMA_CC_SPROM_PCIE6;
++	pr_debug("SPROM offset 0x%x\n", offset);
 +	bcma_sprom_read(bus, offset, sprom);
 +
 +	if (bus->chipinfo.id == 0x4331)
@@ -3441,21 +3868,596 @@
 +}
 --- /dev/null
 +++ b/drivers/bcma/driver_pci_host.c
-@@ -0,0 +1,14 @@
+@@ -0,0 +1,589 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Core in hostmode
 + *
++ * Copyright 2005 - 2011, Broadcom Corporation
++ * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
 +#include "bcma_private.h"
++#include <linux/pci.h>
++#include <linux/export.h>
 +#include <linux/bcma/bcma.h>
++#include <asm/paccess.h>
++
++/* Probe a 32bit value on the bus and catch bus exceptions.
++ * Returns nonzero on a bus exception.
++ * This is MIPS specific */
++#define mips_busprobe32(val, addr)	get_dbe((val), ((u32 *)(addr)))
++
++/* Assume one-hot slot wiring */
++#define BCMA_PCI_SLOT_MAX	16
++#define	PCI_CONFIG_SPACE_SIZE	256
++
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	u16 chipid_top;
++	u32 tmp;
++
++	chipid_top = (bus->chipinfo.id & 0xFF00);
++	if (chipid_top != 0x4700 &&
++	    chipid_top != 0x5300)
++		return false;
++
++	if (bus->sprom.boardflags_lo & BCMA_CORE_PCI_BFL_NOPCI) {
++		pr_info("This PCI core is disabled and not working\n");
++		return false;
++	}
 +
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++	bcma_core_enable(pc->core, 0);
++
++	return !mips_busprobe32(tmp, pc->core->io_addr);
++}
++
++static u32 bcma_pcie_read_config(struct bcma_drv_pci *pc, u32 address)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_DATA);
++}
++
++static void bcma_pcie_write_config(struct bcma_drv_pci *pc, u32 address,
++				   u32 data)
 +{
-+	pr_err("No support for PCI core in hostmode yet\n");
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_DATA, data);
++}
++
++static u32 bcma_get_cfgspace_addr(struct bcma_drv_pci *pc, unsigned int dev,
++			     unsigned int func, unsigned int off)
++{
++	u32 addr = 0;
++
++	/* Issue config commands only when the data link is up (atleast
++	 * one external pcie device is present).
++	 */
++	if (dev >= 2 || !(bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_LSREG)
++			  & BCMA_CORE_PCI_DLLP_LSREG_LINKUP))
++		goto out;
++
++	/* Type 0 transaction */
++	/* Slide the PCI window to the appropriate slot */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++	/* Calculate the address */
++	addr = pc->host_controller->host_cfg_addr;
++	addr |= (dev << BCMA_CORE_PCI_CFG_SLOT_SHIFT);
++	addr |= (func << BCMA_CORE_PCI_CFG_FUN_SHIFT);
++	addr |= (off & ~3);
++
++out:
++	return addr;
++}
++
++static int bcma_extpci_read_config(struct bcma_drv_pci *pc, unsigned int dev,
++				  unsigned int func, unsigned int off,
++				  void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr, val;
++	void __iomem *mmio = 0;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* we support only two functions on device 0 */
++		if (func > 1)
++			return -EINVAL;
++
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off >= PCI_CONFIG_SPACE_SIZE) {
++			addr = (func << 12);
++			addr |= (off & 0x0FFF);
++			val = bcma_pcie_read_config(pc, addr);
++		} else {
++			addr = BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			val = pcicore_read32(pc, addr);
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++
++		val = readl(mmio);
++	}
++	val >>= (8 * (off & 3));
++
++	switch (len) {
++	case 1:
++		*((u8 *)buf) = (u8)val;
++		break;
++	case 2:
++		*((u16 *)buf) = (u16)val;
++		break;
++	case 4:
++		*((u32 *)buf) = (u32)val;
++		break;
++	}
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
++				   unsigned int func, unsigned int off,
++				   const void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr = 0, val = 0;
++	void __iomem *mmio = 0;
++	u16 chipid = pc->core->bus->chipinfo.id;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off < PCI_CONFIG_SPACE_SIZE) {
++			addr = pc->core->addr + BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			mmio = ioremap_nocache(addr, len);
++			if (!mmio)
++				goto out;
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++	}
++
++	switch (len) {
++	case 1:
++		val = readl(mmio);
++		val &= ~(0xFF << (8 * (off & 3)));
++		val |= *((const u8 *)buf) << (8 * (off & 3));
++		break;
++	case 2:
++		val = readl(mmio);
++		val &= ~(0xFFFF << (8 * (off & 3)));
++		val |= *((const u16 *)buf) << (8 * (off & 3));
++		break;
++	case 4:
++		val = *((const u32 *)buf);
++		break;
++	}
++	if (dev == 0 && !addr) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		addr = (func << 12);
++		addr |= (off & 0x0FFF);
++		bcma_pcie_write_config(pc, addr, val);
++	} else {
++		writel(val, mmio);
++
++		if (chipid == 0x4716 || chipid == 0x4748)
++			readl(mmio);
++	}
++
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_core_pci_hostmode_read_config(struct pci_bus *bus,
++					      unsigned int devfn,
++					      int reg, int size, u32 *val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_read_config(pc, PCI_SLOT(devfn),
++				     PCI_FUNC(devfn), reg, val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++static int bcma_core_pci_hostmode_write_config(struct pci_bus *bus,
++					       unsigned int devfn,
++					       int reg, int size, u32 val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_write_config(pc, PCI_SLOT(devfn),
++				      PCI_FUNC(devfn), reg, &val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++/* return cap_offset if requested capability exists in the PCI config space */
++static u8 __devinit bcma_find_pci_capability(struct bcma_drv_pci *pc,
++					     unsigned int dev,
++					     unsigned int func, u8 req_cap_id,
++					     unsigned char *buf, u32 *buflen)
++{
++	u8 cap_id;
++	u8 cap_ptr = 0;
++	u32 bufsize;
++	u8 byte_val;
++
++	/* check for Header type 0 */
++	bcma_extpci_read_config(pc, dev, func, PCI_HEADER_TYPE, &byte_val,
++				sizeof(u8));
++	if ((byte_val & 0x7f) != PCI_HEADER_TYPE_NORMAL)
++		return cap_ptr;
++
++	/* check if the capability pointer field exists */
++	bcma_extpci_read_config(pc, dev, func, PCI_STATUS, &byte_val,
++				sizeof(u8));
++	if (!(byte_val & PCI_STATUS_CAP_LIST))
++		return cap_ptr;
++
++	/* check if the capability pointer is 0x00 */
++	bcma_extpci_read_config(pc, dev, func, PCI_CAPABILITY_LIST, &cap_ptr,
++				sizeof(u8));
++	if (cap_ptr == 0x00)
++		return cap_ptr;
++
++	/* loop thr'u the capability list and see if the requested capabilty
++	 * exists */
++	bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id, sizeof(u8));
++	while (cap_id != req_cap_id) {
++		bcma_extpci_read_config(pc, dev, func, cap_ptr + 1, &cap_ptr,
++					sizeof(u8));
++		if (cap_ptr == 0x00)
++			return cap_ptr;
++		bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id,
++					sizeof(u8));
++	}
++
++	/* found the caller requested capability */
++	if ((buf != NULL) && (buflen != NULL)) {
++		u8 cap_data;
++
++		bufsize = *buflen;
++		if (!bufsize)
++			return cap_ptr;
++
++		*buflen = 0;
++
++		/* copy the cpability data excluding cap ID and next ptr */
++		cap_data = cap_ptr + 2;
++		if ((bufsize + cap_data)  > PCI_CONFIG_SPACE_SIZE)
++			bufsize = PCI_CONFIG_SPACE_SIZE - cap_data;
++		*buflen = bufsize;
++		while (bufsize--) {
++			bcma_extpci_read_config(pc, dev, func, cap_data, buf,
++						sizeof(u8));
++			cap_data++;
++			buf++;
++		}
++	}
++
++	return cap_ptr;
++}
++
++/* If the root port is capable of returning Config Request
++ * Retry Status (CRS) Completion Status to software then
++ * enable the feature.
++ */
++static void __devinit bcma_core_pci_enable_crs(struct bcma_drv_pci *pc)
++{
++	u8 cap_ptr, root_ctrl, root_cap, dev;
++	u16 val16;
++	int i;
++
++	cap_ptr = bcma_find_pci_capability(pc, 0, 0, PCI_CAP_ID_EXP, NULL,
++					   NULL);
++	root_cap = cap_ptr + PCI_EXP_RTCAP;
++	bcma_extpci_read_config(pc, 0, 0, root_cap, &val16, sizeof(u16));
++	if (val16 & BCMA_CORE_PCI_RC_CRS_VISIBILITY) {
++		/* Enable CRS software visibility */
++		root_ctrl = cap_ptr + PCI_EXP_RTCTL;
++		val16 = PCI_EXP_RTCTL_CRSSVE;
++		bcma_extpci_read_config(pc, 0, 0, root_ctrl, &val16,
++					sizeof(u16));
++
++		/* Initiate a configuration request to read the vendor id
++		 * field of the device function's config space header after
++		 * 100 ms wait time from the end of Reset. If the device is
++		 * not done with its internal initialization, it must at
++		 * least return a completion TLP, with a completion status
++		 * of "Configuration Request Retry Status (CRS)". The root
++		 * complex must complete the request to the host by returning
++		 * a read-data value of 0001h for the Vendor ID field and
++		 * all 1s for any additional bytes included in the request.
++		 * Poll using the config reads for max wait time of 1 sec or
++		 * until we receive the successful completion status. Repeat
++		 * the procedure for all the devices.
++		 */
++		for (dev = 1; dev < BCMA_PCI_SLOT_MAX; dev++) {
++			for (i = 0; i < 100000; i++) {
++				bcma_extpci_read_config(pc, dev, 0,
++							PCI_VENDOR_ID, &val16,
++							sizeof(val16));
++				if (val16 != 0x1)
++					break;
++				udelay(10);
++			}
++			if (val16 == 0x1)
++				pr_err("PCI: Broken device in slot %d\n", dev);
++		}
++	}
++}
++
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	struct bcma_drv_pci_host *pc_host;
++	u32 tmp;
++	u32 pci_membase_1G;
++	unsigned long io_map_base;
++
++	pr_info("PCIEcore in host mode found\n");
++
++	pc_host = kzalloc(sizeof(*pc_host), GFP_KERNEL);
++	if (!pc_host)  {
++		pr_err("can not allocate memory");
++		return;
++	}
++
++	pc->host_controller = pc_host;
++	pc_host->pci_controller.io_resource = &pc_host->io_resource;
++	pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
++	pc_host->pci_controller.pci_ops = &pc_host->pci_ops;
++	pc_host->pdev = pc;
++
++	pci_membase_1G = BCMA_SOC_PCI_DMA;
++	pc_host->host_cfg_addr = BCMA_SOC_PCI_CFG;
++
++	pc_host->pci_ops.read = bcma_core_pci_hostmode_read_config;
++	pc_host->pci_ops.write = bcma_core_pci_hostmode_write_config;
++
++	pc_host->mem_resource.name = "BCMA PCIcore external memory",
++	pc_host->mem_resource.start = BCMA_SOC_PCI_DMA;
++	pc_host->mem_resource.end = BCMA_SOC_PCI_DMA + BCMA_SOC_PCI_DMA_SZ - 1;
++	pc_host->mem_resource.flags = IORESOURCE_MEM | IORESOURCE_PCI_FIXED;
++
++	pc_host->io_resource.name = "BCMA PCIcore external I/O",
++	pc_host->io_resource.start = 0x100;
++	pc_host->io_resource.end = 0x7FF;
++	pc_host->io_resource.flags = IORESOURCE_IO | IORESOURCE_PCI_FIXED;
++
++	/* Reset RC */
++	udelay(3000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST_OE);
++	udelay(1000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST |
++			BCMA_CORE_PCI_CTL_RST_OE);
++
++	/* 64 MB I/O access window. On 4716, use
++	 * sbtopcie0 to access the device registers. We
++	 * can't use address match 2 (1 GB window) region
++	 * as mips can't generate 64-bit address on the
++	 * backplane.
++	 */
++	if (bus->chipinfo.id == 0x4716 || bus->chipinfo.id == 0x4748) {
++		pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++		pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++					    BCMA_SOC_PCI_MEM_SZ - 1;
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_MEM | BCMA_SOC_PCI_MEM);
++	} else if (bus->chipinfo.id == 0x5300) {
++		tmp = BCMA_CORE_PCI_SBTOPCI_MEM;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_PREF;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_BURST;
++		if (pc->core->core_unit == 0) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE_DMA_H32;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI_MEM);
++		} else if (pc->core->core_unit == 1) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI1_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI1_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE1_DMA_H32;
++			pc_host->host_cfg_addr = BCMA_SOC_PCI1_CFG;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI1_MEM);
++		}
++	} else
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_IO);
++
++	/* 64 MB configuration access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++
++	/* 1 GB memory access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI2,
++			BCMA_CORE_PCI_SBTOPCI_MEM | pci_membase_1G);
++
++
++	/* As per PCI Express Base Spec 1.1 we need to wait for
++	 * at least 100 ms from the end of a reset (cold/warm/hot)
++	 * before issuing configuration requests to PCI Express
++	 * devices.
++	 */
++	udelay(100000);
++
++	bcma_core_pci_enable_crs(pc);
++
++	/* Enable PCI bridge BAR0 memory & master access */
++	tmp = PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
++	bcma_extpci_write_config(pc, 0, 0, PCI_COMMAND, &tmp, sizeof(tmp));
++
++	/* Enable PCI interrupts */
++	pcicore_write32(pc, BCMA_CORE_PCI_IMASK, BCMA_CORE_PCI_IMASK_INTA);
++
++	/* Ok, ready to run, register it to the system.
++	 * The following needs change, if we want to port hostmode
++	 * to non-MIPS platform. */
++	io_map_base = (unsigned long)ioremap_nocache(BCMA_SOC_PCI_MEM,
++						     0x04000000);
++	pc_host->pci_controller.io_map_base = io_map_base;
++	set_io_port_base(pc_host->pci_controller.io_map_base);
++	/* Give some time to the PCI controller to configure itself with the new
++	 * values. Not waiting at this point causes crashes of the machine. */
++	mdelay(10);
++	register_pci_controller(&pc_host->pci_controller);
++	return;
++}
++
++/* Early PCI fixup for a device on the PCI-core bridge. */
++static void bcma_core_pci_fixup_pcibridge(struct pci_dev *dev)
++{
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) != 0)
++		return;
++
++	pr_info("PCI: Fixing up bridge %s\n", pci_name(dev));
++
++	/* Enable PCI bridge bus mastering and memory space */
++	pci_set_master(dev);
++	if (pcibios_enable_device(dev, ~0) < 0) {
++		pr_err("PCI: BCMA bridge enable failed\n");
++		return;
++	}
++
++	/* Enable PCI bridge BAR1 prefetch and burst */
++	pci_write_config_dword(dev, BCMA_PCI_BAR1_CONTROL, 3);
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_pcibridge);
++
++/* Early PCI fixup for all PCI-cores to set the correct memory address. */
++static void bcma_core_pci_fixup_addresses(struct pci_dev *dev)
++{
++	struct resource *res;
++	int pos;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) == 0)
++		return;
++
++	pr_info("PCI: Fixing up addresses %s\n", pci_name(dev));
++
++	for (pos = 0; pos < 6; pos++) {
++		res = &dev->resource[pos];
++		if (res->flags & (IORESOURCE_IO | IORESOURCE_MEM))
++			pci_assign_resource(dev, pos);
++	}
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_addresses);
++
++/* This function is called when doing a pci_enable_device().
++ * We must first check if the device is a device on the PCI-core bridge. */
++int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++
++	pr_info("PCI: Fixing up device %s\n", pci_name(dev));
++
++	/* Fix up interrupt lines */
++	dev->irq = bcma_core_mips_irq(pc_host->pdev->core) + 2;
++	pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
++
++	return 0;
++}
++EXPORT_SYMBOL(bcma_core_pci_plat_dev_init);
++
++/* PCI device IRQ mapping. */
++int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++	return bcma_core_mips_irq(pc_host->pdev->core) + 2;
 +}
++EXPORT_SYMBOL(bcma_core_pci_pcibios_map_irq);
 --- /dev/null
 +++ b/drivers/bcma/driver_mips.c
 @@ -0,0 +1,256 @@
diff --git a/target/linux/generic/patches-3.0/020-ssb_update.patch b/target/linux/generic/patches-3.0/020-ssb_update.patch
index 5a77154101..13709850d7 100644
--- a/target/linux/generic/patches-3.0/020-ssb_update.patch
+++ b/target/linux/generic/patches-3.0/020-ssb_update.patch
@@ -37,7 +37,53 @@
   * Copyright 2007, Broadcom Corporation
   *
   * Licensed under the GNU/GPL. See COPYING for details.
-@@ -417,9 +417,9 @@ static void ssb_pmu_resources_init(struc
+@@ -12,6 +12,9 @@
+ #include <linux/ssb/ssb_regs.h>
+ #include <linux/ssb/ssb_driver_chipcommon.h>
+ #include <linux/delay.h>
++#ifdef CONFIG_BCM47XX
++#include <asm/mach-bcm47xx/nvram.h>
++#endif
+ 
+ #include "ssb_private.h"
+ 
+@@ -91,10 +94,6 @@ static void ssb_pmu0_pllinit_r0(struct s
+ 	u32 pmuctl, tmp, pllctl;
+ 	unsigned int i;
+ 
+-	if ((bus->chip_id == 0x5354) && !crystalfreq) {
+-		/* The 5354 crystal freq is 25MHz */
+-		crystalfreq = 25000;
+-	}
+ 	if (crystalfreq)
+ 		e = pmu0_plltab_find_entry(crystalfreq);
+ 	if (!e)
+@@ -320,7 +319,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 	u32 crystalfreq = 0; /* in kHz. 0 = keep default freq. */
+ 
+ 	if (bus->bustype == SSB_BUSTYPE_SSB) {
+-		/* TODO: The user may override the crystal frequency. */
++#ifdef CONFIG_BCM47XX
++		char buf[20];
++		if (nvram_getenv("xtalfreq", buf, sizeof(buf)) >= 0)
++			crystalfreq = simple_strtoul(buf, NULL, 0);
++#endif
+ 	}
+ 
+ 	switch (bus->chip_id) {
+@@ -329,7 +332,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 		ssb_pmu1_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4328:
++		ssb_pmu0_pllinit_r0(cc, crystalfreq);
++		break;
+ 	case 0x5354:
++		if (crystalfreq == 0)
++			crystalfreq = 25000;
+ 		ssb_pmu0_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4322:
+@@ -417,9 +424,9 @@ static void ssb_pmu_resources_init(struc
  	u32 min_msk = 0, max_msk = 0;
  	unsigned int i;
  	const struct pmu_res_updown_tab_entry *updown_tab = NULL;
@@ -49,6 +95,41 @@
  
  	switch (bus->chip_id) {
  	case 0x4312:
+@@ -606,3 +613,34 @@ void ssb_pmu_set_ldo_paref(struct ssb_ch
+ 
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_voltage);
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_paref);
++
++u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		/* 5354 chip uses a non programmable PLL of frequency 240MHz */
++		return 240000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU cpu clock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
++
++u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		return 120000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU controlclock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
 --- a/drivers/ssb/driver_extif.c
 +++ b/drivers/ssb/driver_extif.c
 @@ -3,7 +3,7 @@
@@ -116,6 +197,16 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
+@@ -208,6 +208,9 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 	u32 pll_type, n, m, rate = 0;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_cpu_clock(&bus->chipco);
++
+ 	if (bus->extif.dev) {
+ 		ssb_extif_get_clockcontrol(&bus->extif, &pll_type, &n, &m);
+ 	} else if (bus->chipco.dev) {
 --- a/drivers/ssb/driver_pcicore.c
 +++ b/drivers/ssb/driver_pcicore.c
 @@ -3,7 +3,7 @@
@@ -127,6 +218,15 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
+@@ -74,7 +74,7 @@ static u32 get_cfgspace_addr(struct ssb_
+ 	u32 tmp;
+ 
+ 	/* We do only have one cardbus device behind the bridge. */
+-	if (pc->cardbusmode && (dev >= 1))
++	if (pc->cardbusmode && (dev > 1))
+ 		goto out;
+ 
+ 	if (bus == 0) {
 @@ -314,7 +314,7 @@ int ssb_pcicore_pcibios_map_irq(const st
  	return ssb_mips_irq(extpci_core->dev) + 2;
  }
@@ -193,7 +293,49 @@
  #include <linux/ssb/ssb.h>
  #include <linux/ssb/ssb_regs.h>
  #include <linux/ssb/ssb_driver_gige.h>
-@@ -557,7 +558,7 @@ error:
+@@ -139,19 +140,6 @@ static void ssb_device_put(struct ssb_de
+ 		put_device(dev->dev);
+ }
+ 
+-static inline struct ssb_driver *ssb_driver_get(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		get_driver(&drv->drv);
+-	return drv;
+-}
+-
+-static inline void ssb_driver_put(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		put_driver(&drv->drv);
+-}
+-
+ static int ssb_device_resume(struct device *dev)
+ {
+ 	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
+@@ -249,11 +237,9 @@ int ssb_devices_freeze(struct ssb_bus *b
+ 			ssb_device_put(sdev);
+ 			continue;
+ 		}
+-		sdrv = ssb_driver_get(drv_to_ssb_drv(sdev->dev->driver));
+-		if (!sdrv || SSB_WARN_ON(!sdrv->remove)) {
+-			ssb_device_put(sdev);
++		sdrv = drv_to_ssb_drv(sdev->dev->driver);
++		if (SSB_WARN_ON(!sdrv->remove))
+ 			continue;
+-		}
+ 		sdrv->remove(sdev);
+ 		ctx->device_frozen[i] = 1;
+ 	}
+@@ -292,7 +278,6 @@ int ssb_devices_thaw(struct ssb_freeze_c
+ 				   dev_name(sdev->dev));
+ 			result = err;
+ 		}
+-		ssb_driver_put(sdrv);
+ 		ssb_device_put(sdev);
+ 	}
+ 
+@@ -557,7 +542,7 @@ error:
  }
  
  /* Needs ssb_buses_lock() */
@@ -202,7 +344,7 @@
  {
  	struct ssb_bus *bus, *n;
  	int err = 0;
-@@ -768,9 +769,9 @@ out:
+@@ -768,9 +753,9 @@ out:
  	return err;
  }
  
@@ -215,7 +357,7 @@
  {
  	int err;
  
-@@ -851,8 +852,8 @@ err_disable_xtal:
+@@ -851,8 +836,8 @@ err_disable_xtal:
  }
  
  #ifdef CONFIG_SSB_PCIHOST
@@ -226,7 +368,7 @@
  {
  	int err;
  
-@@ -875,9 +876,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
+@@ -875,9 +860,9 @@ EXPORT_SYMBOL(ssb_bus_pcibus_register);
  #endif /* CONFIG_SSB_PCIHOST */
  
  #ifdef CONFIG_SSB_PCMCIAHOST
@@ -239,7 +381,7 @@
  {
  	int err;
  
-@@ -897,8 +898,9 @@ EXPORT_SYMBOL(ssb_bus_pcmciabus_register
+@@ -897,8 +882,9 @@ EXPORT_SYMBOL(ssb_bus_pcmciabus_register
  #endif /* CONFIG_SSB_PCMCIAHOST */
  
  #ifdef CONFIG_SSB_SDIOHOST
@@ -251,7 +393,7 @@
  {
  	int err;
  
-@@ -918,9 +920,9 @@ int ssb_bus_sdiobus_register(struct ssb_
+@@ -918,9 +904,9 @@ int ssb_bus_sdiobus_register(struct ssb_
  EXPORT_SYMBOL(ssb_bus_sdiobus_register);
  #endif /* CONFIG_SSB_PCMCIAHOST */
  
@@ -264,7 +406,7 @@
  {
  	int err;
  
-@@ -1001,8 +1003,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
+@@ -1001,8 +987,8 @@ u32 ssb_calc_clock_rate(u32 plltype, u32
  	switch (plltype) {
  	case SSB_PLLTYPE_6: /* 100/200 or 120/240 only */
  		if (m & SSB_CHIPCO_CLK_T6_MMASK)
@@ -275,7 +417,17 @@
  	case SSB_PLLTYPE_1: /* 48Mhz base, 3 dividers */
  	case SSB_PLLTYPE_3: /* 25Mhz, 2 dividers */
  	case SSB_PLLTYPE_4: /* 48Mhz, 4 dividers */
-@@ -1259,13 +1261,34 @@ void ssb_device_disable(struct ssb_devic
+@@ -1092,6 +1078,9 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
+ 	u32 plltype;
+ 	u32 clkctl_n, clkctl_m;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_controlclock(&bus->chipco);
++
+ 	if (ssb_extif_available(&bus->extif))
+ 		ssb_extif_get_clockcontrol(&bus->extif, &plltype,
+ 					   &clkctl_n, &clkctl_m);
+@@ -1259,13 +1248,34 @@ void ssb_device_disable(struct ssb_devic
  }
  EXPORT_SYMBOL(ssb_device_disable);
  
@@ -322,7 +474,63 @@
   * Copyright (C) 2005 Martin Langer <martin-langer@gmx.de>
   * Copyright (C) 2005 Stefano Brivio <st3@riseup.net>
   * Copyright (C) 2005 Danny van Dyk <kugelfang@gentoo.org>
-@@ -523,7 +523,13 @@ static void sprom_extract_r45(struct ssb
+@@ -331,7 +331,6 @@ static void sprom_extract_r123(struct ss
+ {
+ 	int i;
+ 	u16 v;
+-	s8 gain;
+ 	u16 loc[3];
+ 
+ 	if (out->revision == 3)			/* rev 3 moved MAC */
+@@ -390,20 +389,12 @@ static void sprom_extract_r123(struct ss
+ 		SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_BG,
+-				    SSB_SPROM1_AGAIN_BG_SHIFT);
+-	out->antenna_gain.ghz24.a0 = gain;
+-	out->antenna_gain.ghz24.a1 = gain;
+-	out->antenna_gain.ghz24.a2 = gain;
+-	out->antenna_gain.ghz24.a3 = gain;
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_A,
+-				    SSB_SPROM1_AGAIN_A_SHIFT);
+-	out->antenna_gain.ghz5.a0 = gain;
+-	out->antenna_gain.ghz5.a1 = gain;
+-	out->antenna_gain.ghz5.a2 = gain;
+-	out->antenna_gain.ghz5.a3 = gain;
++	out->antenna_gain.a0 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_BG,
++						    SSB_SPROM1_AGAIN_BG_SHIFT);
++	out->antenna_gain.a1 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_A,
++						    SSB_SPROM1_AGAIN_A_SHIFT);
+ }
+ 
+ /* Revs 4 5 and 8 have partially shared layout */
+@@ -504,16 +495,14 @@ static void sprom_extract_r45(struct ssb
+ 	}
+ 
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN0, SSB_SPROM4_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN1, SSB_SPROM4_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN2, SSB_SPROM4_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN3, SSB_SPROM4_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
+ 
+ 	sprom_extract_r458(out, in);
+ 
+@@ -523,7 +512,13 @@ static void sprom_extract_r45(struct ssb
  static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
  {
  	int i;
@@ -337,10 +545,25 @@
  
  	/* extract the MAC address */
  	for (i = 0; i < 3; i++) {
-@@ -607,6 +613,61 @@ static void sprom_extract_r8(struct ssb_
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
+@@ -596,16 +591,69 @@ static void sprom_extract_r8(struct ssb_
+ 	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
  
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
++
 +	/* Extract cores power info info */
 +	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
 +		o = pwr_info_offset[i];
@@ -395,11 +618,10 @@
 +		SSB_SROM8_FEM_TR_ISO, SSB_SROM8_FEM_TR_ISO_SHIFT);
 +	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G,
 +		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
-+
+ 
  	sprom_extract_r458(out, in);
  
- 	/* TODO - get remaining rev 8 stuff needed */
-@@ -734,12 +795,9 @@ out_free:
+@@ -734,12 +782,9 @@ out_free:
  static void ssb_pci_get_boardinfo(struct ssb_bus *bus,
  				  struct ssb_boardinfo *bi)
  {
@@ -457,6 +679,25 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
+@@ -676,14 +676,10 @@ static int ssb_pcmcia_do_get_invariants(
+ 	case SSB_PCMCIA_CIS_ANTGAIN:
+ 		GOTO_ERROR_ON(tuple->TupleDataLen != 2,
+ 			"antg tpl size");
+-		sprom->antenna_gain.ghz24.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a3 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a3 = tuple->TupleData[1];
++		sprom->antenna_gain.a0 = tuple->TupleData[1];
++		sprom->antenna_gain.a1 = tuple->TupleData[1];
++		sprom->antenna_gain.a2 = tuple->TupleData[1];
++		sprom->antenna_gain.a3 = tuple->TupleData[1];
+ 		break;
+ 	case SSB_PCMCIA_CIS_BFLAGS:
+ 		GOTO_ERROR_ON((tuple->TupleDataLen != 3) &&
 --- a/drivers/ssb/scan.c
 +++ b/drivers/ssb/scan.c
 @@ -2,7 +2,7 @@
@@ -478,6 +719,16 @@
  			bus->chip_package = 0;
  		} else {
  			bus->chip_id = 0x4710;
+@@ -319,6 +318,9 @@ int ssb_bus_scan(struct ssb_bus *bus,
+ 			bus->chip_package = 0;
+ 		}
+ 	}
++	ssb_printk(KERN_INFO PFX "Found chip with id 0x%04X, rev 0x%02X and "
++		   "package 0x%02X\n", bus->chip_id, bus->chip_rev,
++		   bus->chip_package);
+ 	if (!bus->nr_devices)
+ 		bus->nr_devices = chipid_to_nrcores(bus->chip_id);
+ 	if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
 --- a/drivers/ssb/sdio.c
 +++ b/drivers/ssb/sdio.c
 @@ -6,7 +6,7 @@
@@ -489,6 +740,25 @@
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   *
+@@ -551,14 +551,10 @@ int ssb_sdio_get_invariants(struct ssb_b
+ 			case SSB_SDIO_CIS_ANTGAIN:
+ 				GOTO_ERROR_ON(tuple->size != 2,
+ 					      "antg tpl size");
+-				sprom->antenna_gain.ghz24.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a3 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a3 = tuple->data[1];
++				sprom->antenna_gain.a0 = tuple->data[1];
++				sprom->antenna_gain.a1 = tuple->data[1];
++				sprom->antenna_gain.a2 = tuple->data[1];
++				sprom->antenna_gain.a3 = tuple->data[1];
+ 				break;
+ 			case SSB_SDIO_CIS_BFLAGS:
+ 				GOTO_ERROR_ON((tuple->size != 3) &&
 --- a/drivers/ssb/sprom.c
 +++ b/drivers/ssb/sprom.c
 @@ -2,7 +2,7 @@
@@ -509,25 +779,54 @@
 +struct ssb_sprom_core_pwr_info {
 +	u8 itssi_2g, itssi_5g;
 +	u8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh;
-+	u16 pa_2g[3], pa_5gl[3], pa_5g[3], pa_5gh[3];
++	u16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4];
 +};
 +
  struct ssb_sprom {
  	u8 revision;
  	u8 il0mac[6];		/* MAC address for 802.11b/g */
-@@ -25,8 +31,10 @@ struct ssb_sprom {
+@@ -25,8 +31,13 @@ struct ssb_sprom {
  	u8 et1phyaddr;		/* MII address for enet1 */
  	u8 et0mdcport;		/* MDIO for enet0 */
  	u8 et1mdcport;		/* MDIO for enet1 */
 -	u8 board_rev;		/* Board revision number from SPROM. */
 +	u16 board_rev;		/* Board revision number from SPROM. */
++	u16 board_num;		/* Board number from SPROM. */
++	u16 board_type;		/* Board type from SPROM. */
  	u8 country_code;	/* Country Code */
-+	u16 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
-+	u16 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
++	char alpha2[2];		/* Country Code as two chars like EU or US */
++	u8 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
++	u8 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
  	u8 ant_available_a;	/* 2GHz antenna available bits (up to 4) */
  	u8 ant_available_bg;	/* 5GHz antenna available bits (up to 4) */
  	u16 pa0b0;
-@@ -80,6 +88,8 @@ struct ssb_sprom {
+@@ -45,10 +56,10 @@ struct ssb_sprom {
+ 	u8 gpio1;		/* GPIO pin 1 */
+ 	u8 gpio2;		/* GPIO pin 2 */
+ 	u8 gpio3;		/* GPIO pin 3 */
+-	u16 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
+ 	u8 itssi_a;		/* Idle TSSI Target for A-PHY */
+ 	u8 itssi_bg;		/* Idle TSSI Target for B/G-PHY */
+ 	u8 tri2g;		/* 2.4GHz TX isolation */
+@@ -59,8 +70,8 @@ struct ssb_sprom {
+ 	u8 txpid5gl[4];		/* 4.9 - 5.1GHz TX power index */
+ 	u8 txpid5g[4];		/* 5.1 - 5.5GHz TX power index */
+ 	u8 txpid5gh[4];		/* 5.5 - ...GHz TX power index */
+-	u8 rxpo2g;		/* 2GHz RX power offset */
+-	u8 rxpo5g;		/* 5GHz RX power offset */
++	s8 rxpo2g;		/* 2GHz RX power offset */
++	s8 rxpo5g;		/* 5GHz RX power offset */
+ 	u8 rssisav2g;		/* 2GHz RSSI params */
+ 	u8 rssismc2g;
+ 	u8 rssismf2g;
+@@ -80,26 +91,104 @@ struct ssb_sprom {
  	u16 boardflags2_hi;	/* Board flags (bits 48-63) */
  	/* TODO store board flags in a single u64 */
  
@@ -536,10 +835,17 @@
  	/* Antenna gain values for up to 4 antennas
  	 * on each band. Values in dBm/4 (Q5.2). Negative gain means the
  	 * loss in the connectors is bigger than the gain. */
-@@ -92,6 +102,15 @@ struct ssb_sprom {
- 		} ghz5;		/* 5GHz band */
+ 	struct {
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz24;	/* 2.4GHz band */
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz5;		/* 5GHz band */
++		s8 a0, a1, a2, a3;
  	} antenna_gain;
  
+-	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
 +	struct {
 +		struct {
 +			u8 tssipos, extpa_gain, pdet_range, tr_iso, antswlut;
@@ -549,10 +855,82 @@
 +		} ghz5;
 +	} fem;
 +
- 	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
++	u16 mcs2gpo[8];
++	u16 mcs5gpo[8];
++	u16 mcs5glpo[8];
++	u16 mcs5ghpo[8];
++	u8 opo;
++
++	u8 rxgainerr2ga[3];
++	u8 rxgainerr5gla[3];
++	u8 rxgainerr5gma[3];
++	u8 rxgainerr5gha[3];
++	u8 rxgainerr5gua[3];
++
++	u8 noiselvl2ga[3];
++	u8 noiselvl5gla[3];
++	u8 noiselvl5gma[3];
++	u8 noiselvl5gha[3];
++	u8 noiselvl5gua[3];
++
++	u8 regrev;
++	u8 txchain;
++	u8 rxchain;
++	u8 antswitch;
++	u16 cddpo;
++	u16 stbcpo;
++	u16 bw40po;
++	u16 bwduppo;
++
++	u8 tempthresh;
++	u8 tempoffset;
++	u16 rawtempsense;
++	u8 measpower;
++	u8 tempsense_slope;
++	u8 tempcorrx;
++	u8 tempsense_option;
++	u8 freqoffset_corr;
++	u8 iqcal_swp_dis;
++	u8 hw_iqcal_en;
++	u8 elna2g;
++	u8 elna5g;
++	u8 phycal_tempdelta;
++	u8 temps_period;
++	u8 temps_hysteresis;
++	u8 measpower1;
++	u8 measpower2;
++	u8 pcieingress_war;
++
++	/* power per rate from sromrev 9 */
++	u16 cckbw202gpo;
++	u16 cckbw20ul2gpo;
++	u32 legofdmbw202gpo;
++	u32 legofdmbw20ul2gpo;
++	u32 legofdmbw205glpo;
++	u32 legofdmbw20ul5glpo;
++	u32 legofdmbw205gmpo;
++	u32 legofdmbw20ul5gmpo;
++	u32 legofdmbw205ghpo;
++	u32 legofdmbw20ul5ghpo;
++	u32 mcsbw202gpo;
++	u32 mcsbw20ul2gpo;
++	u32 mcsbw402gpo;
++	u32 mcsbw205glpo;
++	u32 mcsbw20ul5glpo;
++	u32 mcsbw405glpo;
++	u32 mcsbw205gmpo;
++	u32 mcsbw20ul5gmpo;
++	u32 mcsbw405gmpo;
++	u32 mcsbw205ghpo;
++	u32 mcsbw20ul5ghpo;
++	u32 mcsbw405ghpo;
++	u16 mcs32po;
++	u16 legofdm40duppo;
++	u8 sar2g;
++	u8 sar5g;
  };
  
-@@ -99,7 +118,7 @@ struct ssb_sprom {
+ /* Information about the PCB the circuitry is soldered on. */
  struct ssb_boardinfo {
  	u16 vendor;
  	u16 type;
@@ -561,7 +939,7 @@
  };
  
  
-@@ -229,10 +248,9 @@ struct ssb_driver {
+@@ -229,10 +318,9 @@ struct ssb_driver {
  #define drv_to_ssb_drv(_drv) container_of(_drv, struct ssb_driver, drv)
  
  extern int __ssb_driver_register(struct ssb_driver *drv, struct module *owner);
@@ -699,3 +1077,24 @@
  /* Values for SSB_SPROM1_BINF_CCODE */
  enum {
  	SSB_SPROM1CCODE_WORLD = 0,
+--- a/drivers/ssb/ssb_private.h
++++ b/drivers/ssb/ssb_private.h
+@@ -207,4 +207,8 @@ static inline void b43_pci_ssb_bridge_ex
+ }
+ #endif /* CONFIG_SSB_B43_PCI_BRIDGE */
+ 
++/* driver_chipcommon_pmu.c */
++extern u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc);
++extern u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc);
++
+ #endif /* LINUX_SSB_PRIVATE_H_ */
+--- a/include/linux/ssb/ssb_driver_gige.h
++++ b/include/linux/ssb/ssb_driver_gige.h
+@@ -2,6 +2,7 @@
+ #define LINUX_SSB_DRIVER_GIGE_H_
+ 
+ #include <linux/ssb/ssb.h>
++#include <linux/bug.h>
+ #include <linux/pci.h>
+ #include <linux/spinlock.h>
+ 
diff --git a/target/linux/generic/patches-3.0/025-bcma_backport.patch b/target/linux/generic/patches-3.0/025-bcma_backport.patch
index 95012ad8dd..3bbbbc6da9 100644
--- a/target/linux/generic/patches-3.0/025-bcma_backport.patch
+++ b/target/linux/generic/patches-3.0/025-bcma_backport.patch
@@ -18,7 +18,7 @@
  
 +config BCMA_DRIVER_PCI_HOSTMODE
 +	bool "Driver for PCI core working in hostmode"
-+	depends on BCMA && MIPS
++	depends on BCMA && MIPS && BCMA_HOST_PCI
 +	help
 +	  PCI core hostmode operation (external PCI bus).
 +
@@ -54,18 +54,19 @@
  ccflags-$(CONFIG_BCMA_DEBUG)		:= -DDEBUG
 --- a/drivers/bcma/bcma_private.h
 +++ b/drivers/bcma/bcma_private.h
-@@ -13,11 +13,33 @@
+@@ -13,11 +13,34 @@
  struct bcma_bus;
  
  /* main.c */
 -extern int bcma_bus_register(struct bcma_bus *bus);
 -extern void bcma_bus_unregister(struct bcma_bus *bus);
-+int bcma_bus_register(struct bcma_bus *bus);
++int __devinit bcma_bus_register(struct bcma_bus *bus);
 +void bcma_bus_unregister(struct bcma_bus *bus);
 +int __init bcma_bus_early_register(struct bcma_bus *bus,
 +				   struct bcma_device *core_cc,
 +				   struct bcma_device *core_mips);
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus);
 +int bcma_bus_resume(struct bcma_bus *bus);
 +#endif
  
@@ -90,12 +91,16 @@
  
  #ifdef CONFIG_BCMA_HOST_PCI
  /* host_pci.c */
-@@ -25,4 +47,8 @@ extern int __init bcma_host_pci_init(voi
+@@ -25,4 +48,12 @@ extern int __init bcma_host_pci_init(voi
  extern void __exit bcma_host_pci_exit(void);
  #endif /* CONFIG_BCMA_HOST_PCI */
  
++/* driver_pci.c */
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address);
++
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc);
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
 +
  #endif
@@ -360,15 +365,17 @@
  
  static void bcma_pmu_pll_init(struct bcma_drv_cc *cc)
  {
-@@ -53,6 +80,7 @@ static void bcma_pmu_resources_init(stru
+@@ -52,7 +79,9 @@ static void bcma_pmu_resources_init(stru
+ 		min_msk = 0x200D;
  		max_msk = 0xFFFF;
  		break;
++	case 0x4331:
  	case 43224:
 +	case 43225:
  		break;
  	default:
  		pr_err("PMU resource config unknown for device 0x%04X\n",
-@@ -74,6 +102,7 @@ void bcma_pmu_swreg_init(struct bcma_drv
+@@ -74,6 +103,7 @@ void bcma_pmu_swreg_init(struct bcma_drv
  	case 0x4313:
  	case 0x4331:
  	case 43224:
@@ -376,7 +383,7 @@
  		break;
  	default:
  		pr_err("PMU switch/regulators init unknown for device "
-@@ -81,6 +110,24 @@ void bcma_pmu_swreg_init(struct bcma_drv
+@@ -81,6 +111,24 @@ void bcma_pmu_swreg_init(struct bcma_drv
  	}
  }
  
@@ -401,7 +408,7 @@
  void bcma_pmu_workarounds(struct bcma_drv_cc *cc)
  {
  	struct bcma_bus *bus = cc->core->bus;
-@@ -90,17 +137,19 @@ void bcma_pmu_workarounds(struct bcma_dr
+@@ -90,17 +138,19 @@ void bcma_pmu_workarounds(struct bcma_dr
  		bcma_chipco_chipctl_maskset(cc, 0, ~0, 0x7);
  		break;
  	case 0x4331:
@@ -423,7 +430,7 @@
  	default:
  		pr_err("Workarounds unknown for device 0x%04X\n",
  			bus->chipinfo.id);
-@@ -132,3 +181,129 @@ void bcma_pmu_init(struct bcma_drv_cc *c
+@@ -132,3 +182,129 @@ void bcma_pmu_init(struct bcma_drv_cc *c
  	bcma_pmu_swreg_init(cc);
  	bcma_pmu_workarounds(cc);
  }
@@ -814,66 +821,252 @@
 +}
 --- a/drivers/bcma/driver_pci.c
 +++ b/drivers/bcma/driver_pci.c
-@@ -3,7 +3,7 @@
+@@ -2,8 +2,9 @@
+  * Broadcom specific AMBA
   * PCI Core
   *
-  * Copyright 2005, Broadcom Corporation
+- * Copyright 2005, Broadcom Corporation
 - * Copyright 2006, 2007, Michael Buesch <mb@bu3sch.de>
++ * Copyright 2005, 2011, Broadcom Corporation
 + * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
   *
   * Licensed under the GNU/GPL. See COPYING for details.
   */
-@@ -157,7 +157,81 @@ static void bcma_pcicore_serdes_workarou
+@@ -15,40 +16,41 @@
+  * R/W ops.
+  **************************************************/
+ 
+-static u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
+ {
+-	pcicore_write32(pc, 0x130, address);
+-	pcicore_read32(pc, 0x130);
+-	return pcicore_read32(pc, 0x134);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_DATA);
+ }
+ 
+ #if 0
+ static void bcma_pcie_write(struct bcma_drv_pci *pc, u32 address, u32 data)
+ {
+-	pcicore_write32(pc, 0x130, address);
+-	pcicore_read32(pc, 0x130);
+-	pcicore_write32(pc, 0x134, data);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_DATA, data);
+ }
+ #endif
+ 
+ static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u8 phy)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	u32 v;
+ 	int i;
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 28); /* Write Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	v |= (0x1F << 18);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++	v |= (BCMA_CORE_PCI_MDIODATA_BLK_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 	v |= (phy << 4);
+-	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 
+ 	udelay(10);
+ 	for (i = 0; i < 200; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
+ 			break;
+ 		msleep(1);
+ 	}
+@@ -56,79 +58,84 @@ static void bcma_pcie_mdio_set_phy(struc
+ 
+ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u8 device, u8 address)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	int max_retries = 10;
+ 	u16 ret = 0;
+ 	u32 v;
+ 	int i;
+ 
+-	v = 0x80; /* Enable Preamble Sequence */
+-	v |= 0x2; /* MDIO Clock Divisor */
+-	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
+ 
+ 	if (pc->core->id.rev >= 10) {
+ 		max_retries = 200;
+ 		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 29); /* Read Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	if (pc->core->id.rev < 10)
+-		v |= (u32)device << 22;
+-	v |= (u32)address << 18;
+-	pcicore_write32(pc, mdio_data, v);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_READ;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
++
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 	/* Wait for the device to complete the transaction */
+ 	udelay(10);
+ 	for (i = 0; i < max_retries; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */) {
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE) {
+ 			udelay(10);
+-			ret = pcicore_read32(pc, mdio_data);
++			ret = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_DATA);
+ 			break;
+ 		}
+ 		msleep(1);
+ 	}
+-	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
+ 	return ret;
+ }
+ 
+ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u8 device,
+ 				u8 address, u16 data)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	int max_retries = 10;
+ 	u32 v;
+ 	int i;
+ 
+-	v = 0x80; /* Enable Preamble Sequence */
+-	v |= 0x2; /* MDIO Clock Divisor */
+-	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
+ 
+ 	if (pc->core->id.rev >= 10) {
+ 		max_retries = 200;
+ 		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 28); /* Write Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	if (pc->core->id.rev < 10)
+-		v |= (u32)device << 22;
+-	v |= (u32)address << 18;
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 	v |= data;
+-	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 	/* Wait for the device to complete the transaction */
+ 	udelay(10);
+ 	for (i = 0; i < max_retries; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
+ 			break;
+ 		msleep(1);
+ 	}
+-	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
+ }
+ 
+ /**************************************************
+@@ -137,27 +144,82 @@ static void bcma_pcie_mdio_write(struct
+ 
+ static u8 bcma_pcicore_polarity_workaround(struct bcma_drv_pci *pc)
+ {
+-	return (bcma_pcie_read(pc, 0x204) & 0x10) ? 0xC0 : 0x80;
++	u32 tmp;
++
++	tmp = bcma_pcie_read(pc, BCMA_CORE_PCI_PLP_STATUSREG);
++	if (tmp & BCMA_CORE_PCI_PLP_POLARITYINV_STAT)
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE |
++		       BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY;
++	else
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE;
+ }
+ 
+ static void bcma_pcicore_serdes_workaround(struct bcma_drv_pci *pc)
+ {
+-	const u8 serdes_pll_device = 0x1D;
+-	const u8 serdes_rx_device = 0x1F;
+ 	u16 tmp;
+ 
+-	bcma_pcie_mdio_write(pc, serdes_rx_device, 1 /* Control */,
+-			      bcma_pcicore_polarity_workaround(pc));
+-	tmp = bcma_pcie_mdio_read(pc, serdes_pll_device, 1 /* Control */);
+-	if (tmp & 0x4000)
+-		bcma_pcie_mdio_write(pc, serdes_pll_device, 1, tmp & ~0x4000);
++	bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_RX,
++	                     BCMA_CORE_PCI_SERDES_RX_CTRL,
++			     bcma_pcicore_polarity_workaround(pc));
++	tmp = bcma_pcie_mdio_read(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++	                          BCMA_CORE_PCI_SERDES_PLL_CTRL);
++	if (tmp & BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN)
++		bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++		                     BCMA_CORE_PCI_SERDES_PLL_CTRL,
++		                     tmp & ~BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN);
+ }
+ 
+ /**************************************************
   * Init.
   **************************************************/
  
 -void bcma_core_pci_init(struct bcma_drv_pci *pc)
-+static void bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
++static void __devinit bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
  {
  	bcma_pcicore_serdes_workaround(pc);
  }
 +
-+static bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
-+{
-+	struct bcma_bus *bus = pc->core->bus;
-+	u16 chipid_top;
-+
-+	chipid_top = (bus->chipinfo.id & 0xFF00);
-+	if (chipid_top != 0x4700 &&
-+	    chipid_top != 0x5300)
-+		return false;
-+
-+#ifdef CONFIG_SSB_DRIVER_PCICORE
-+	if (bus->sprom.boardflags_lo & SSB_BFL_NOPCI)
-+		return false;
-+#endif /* CONFIG_SSB_DRIVER_PCICORE */
-+
-+#if 0
-+	/* TODO: on BCMA we use address from EROM instead of magic formula */
-+	u32 tmp;
-+	return !mips_busprobe32(tmp, (bus->mmio +
-+		(pc->core->core_index * BCMA_CORE_SIZE)));
-+#endif
-+
-+	return true;
-+}
-+
-+void bcma_core_pci_init(struct bcma_drv_pci *pc)
++void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
 +{
 +	if (pc->setup_done)
 +		return;
 +
-+	if (bcma_core_pci_is_in_hostmode(pc)) {
 +#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	pc->hostmode = bcma_core_pci_is_in_hostmode(pc);
++	if (pc->hostmode)
 +		bcma_core_pci_hostmode_init(pc);
-+#else
-+		pr_err("Driver compiled without support for hostmode PCI\n");
 +#endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
-+	} else {
-+		bcma_core_pci_clientmode_init(pc);
-+	}
 +
-+	pc->setup_done = true;
++	if (!pc->hostmode)
++		bcma_core_pci_clientmode_init(pc);
 +}
 +
 +int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
@@ -908,21 +1101,596 @@
 +EXPORT_SYMBOL_GPL(bcma_core_pci_irq_ctl);
 --- /dev/null
 +++ b/drivers/bcma/driver_pci_host.c
-@@ -0,0 +1,14 @@
+@@ -0,0 +1,589 @@
 +/*
 + * Broadcom specific AMBA
 + * PCI Core in hostmode
 + *
++ * Copyright 2005 - 2011, Broadcom Corporation
++ * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
 +#include "bcma_private.h"
++#include <linux/pci.h>
++#include <linux/export.h>
 +#include <linux/bcma/bcma.h>
++#include <asm/paccess.h>
 +
-+void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++/* Probe a 32bit value on the bus and catch bus exceptions.
++ * Returns nonzero on a bus exception.
++ * This is MIPS specific */
++#define mips_busprobe32(val, addr)	get_dbe((val), ((u32 *)(addr)))
++
++/* Assume one-hot slot wiring */
++#define BCMA_PCI_SLOT_MAX	16
++#define	PCI_CONFIG_SPACE_SIZE	256
++
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
 +{
-+	pr_err("No support for PCI core in hostmode yet\n");
++	struct bcma_bus *bus = pc->core->bus;
++	u16 chipid_top;
++	u32 tmp;
++
++	chipid_top = (bus->chipinfo.id & 0xFF00);
++	if (chipid_top != 0x4700 &&
++	    chipid_top != 0x5300)
++		return false;
++
++	if (bus->sprom.boardflags_lo & BCMA_CORE_PCI_BFL_NOPCI) {
++		pr_info("This PCI core is disabled and not working\n");
++		return false;
++	}
++
++	bcma_core_enable(pc->core, 0);
++
++	return !mips_busprobe32(tmp, pc->core->io_addr);
 +}
++
++static u32 bcma_pcie_read_config(struct bcma_drv_pci *pc, u32 address)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_DATA);
++}
++
++static void bcma_pcie_write_config(struct bcma_drv_pci *pc, u32 address,
++				   u32 data)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_DATA, data);
++}
++
++static u32 bcma_get_cfgspace_addr(struct bcma_drv_pci *pc, unsigned int dev,
++			     unsigned int func, unsigned int off)
++{
++	u32 addr = 0;
++
++	/* Issue config commands only when the data link is up (atleast
++	 * one external pcie device is present).
++	 */
++	if (dev >= 2 || !(bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_LSREG)
++			  & BCMA_CORE_PCI_DLLP_LSREG_LINKUP))
++		goto out;
++
++	/* Type 0 transaction */
++	/* Slide the PCI window to the appropriate slot */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++	/* Calculate the address */
++	addr = pc->host_controller->host_cfg_addr;
++	addr |= (dev << BCMA_CORE_PCI_CFG_SLOT_SHIFT);
++	addr |= (func << BCMA_CORE_PCI_CFG_FUN_SHIFT);
++	addr |= (off & ~3);
++
++out:
++	return addr;
++}
++
++static int bcma_extpci_read_config(struct bcma_drv_pci *pc, unsigned int dev,
++				  unsigned int func, unsigned int off,
++				  void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr, val;
++	void __iomem *mmio = 0;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* we support only two functions on device 0 */
++		if (func > 1)
++			return -EINVAL;
++
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off >= PCI_CONFIG_SPACE_SIZE) {
++			addr = (func << 12);
++			addr |= (off & 0x0FFF);
++			val = bcma_pcie_read_config(pc, addr);
++		} else {
++			addr = BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			val = pcicore_read32(pc, addr);
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++
++		val = readl(mmio);
++	}
++	val >>= (8 * (off & 3));
++
++	switch (len) {
++	case 1:
++		*((u8 *)buf) = (u8)val;
++		break;
++	case 2:
++		*((u16 *)buf) = (u16)val;
++		break;
++	case 4:
++		*((u32 *)buf) = (u32)val;
++		break;
++	}
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
++				   unsigned int func, unsigned int off,
++				   const void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr = 0, val = 0;
++	void __iomem *mmio = 0;
++	u16 chipid = pc->core->bus->chipinfo.id;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off < PCI_CONFIG_SPACE_SIZE) {
++			addr = pc->core->addr + BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			mmio = ioremap_nocache(addr, len);
++			if (!mmio)
++				goto out;
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++	}
++
++	switch (len) {
++	case 1:
++		val = readl(mmio);
++		val &= ~(0xFF << (8 * (off & 3)));
++		val |= *((const u8 *)buf) << (8 * (off & 3));
++		break;
++	case 2:
++		val = readl(mmio);
++		val &= ~(0xFFFF << (8 * (off & 3)));
++		val |= *((const u16 *)buf) << (8 * (off & 3));
++		break;
++	case 4:
++		val = *((const u32 *)buf);
++		break;
++	}
++	if (dev == 0 && !addr) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		addr = (func << 12);
++		addr |= (off & 0x0FFF);
++		bcma_pcie_write_config(pc, addr, val);
++	} else {
++		writel(val, mmio);
++
++		if (chipid == 0x4716 || chipid == 0x4748)
++			readl(mmio);
++	}
++
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_core_pci_hostmode_read_config(struct pci_bus *bus,
++					      unsigned int devfn,
++					      int reg, int size, u32 *val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_read_config(pc, PCI_SLOT(devfn),
++				     PCI_FUNC(devfn), reg, val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++static int bcma_core_pci_hostmode_write_config(struct pci_bus *bus,
++					       unsigned int devfn,
++					       int reg, int size, u32 val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_write_config(pc, PCI_SLOT(devfn),
++				      PCI_FUNC(devfn), reg, &val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++/* return cap_offset if requested capability exists in the PCI config space */
++static u8 __devinit bcma_find_pci_capability(struct bcma_drv_pci *pc,
++					     unsigned int dev,
++					     unsigned int func, u8 req_cap_id,
++					     unsigned char *buf, u32 *buflen)
++{
++	u8 cap_id;
++	u8 cap_ptr = 0;
++	u32 bufsize;
++	u8 byte_val;
++
++	/* check for Header type 0 */
++	bcma_extpci_read_config(pc, dev, func, PCI_HEADER_TYPE, &byte_val,
++				sizeof(u8));
++	if ((byte_val & 0x7f) != PCI_HEADER_TYPE_NORMAL)
++		return cap_ptr;
++
++	/* check if the capability pointer field exists */
++	bcma_extpci_read_config(pc, dev, func, PCI_STATUS, &byte_val,
++				sizeof(u8));
++	if (!(byte_val & PCI_STATUS_CAP_LIST))
++		return cap_ptr;
++
++	/* check if the capability pointer is 0x00 */
++	bcma_extpci_read_config(pc, dev, func, PCI_CAPABILITY_LIST, &cap_ptr,
++				sizeof(u8));
++	if (cap_ptr == 0x00)
++		return cap_ptr;
++
++	/* loop thr'u the capability list and see if the requested capabilty
++	 * exists */
++	bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id, sizeof(u8));
++	while (cap_id != req_cap_id) {
++		bcma_extpci_read_config(pc, dev, func, cap_ptr + 1, &cap_ptr,
++					sizeof(u8));
++		if (cap_ptr == 0x00)
++			return cap_ptr;
++		bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id,
++					sizeof(u8));
++	}
++
++	/* found the caller requested capability */
++	if ((buf != NULL) && (buflen != NULL)) {
++		u8 cap_data;
++
++		bufsize = *buflen;
++		if (!bufsize)
++			return cap_ptr;
++
++		*buflen = 0;
++
++		/* copy the cpability data excluding cap ID and next ptr */
++		cap_data = cap_ptr + 2;
++		if ((bufsize + cap_data)  > PCI_CONFIG_SPACE_SIZE)
++			bufsize = PCI_CONFIG_SPACE_SIZE - cap_data;
++		*buflen = bufsize;
++		while (bufsize--) {
++			bcma_extpci_read_config(pc, dev, func, cap_data, buf,
++						sizeof(u8));
++			cap_data++;
++			buf++;
++		}
++	}
++
++	return cap_ptr;
++}
++
++/* If the root port is capable of returning Config Request
++ * Retry Status (CRS) Completion Status to software then
++ * enable the feature.
++ */
++static void __devinit bcma_core_pci_enable_crs(struct bcma_drv_pci *pc)
++{
++	u8 cap_ptr, root_ctrl, root_cap, dev;
++	u16 val16;
++	int i;
++
++	cap_ptr = bcma_find_pci_capability(pc, 0, 0, PCI_CAP_ID_EXP, NULL,
++					   NULL);
++	root_cap = cap_ptr + PCI_EXP_RTCAP;
++	bcma_extpci_read_config(pc, 0, 0, root_cap, &val16, sizeof(u16));
++	if (val16 & BCMA_CORE_PCI_RC_CRS_VISIBILITY) {
++		/* Enable CRS software visibility */
++		root_ctrl = cap_ptr + PCI_EXP_RTCTL;
++		val16 = PCI_EXP_RTCTL_CRSSVE;
++		bcma_extpci_read_config(pc, 0, 0, root_ctrl, &val16,
++					sizeof(u16));
++
++		/* Initiate a configuration request to read the vendor id
++		 * field of the device function's config space header after
++		 * 100 ms wait time from the end of Reset. If the device is
++		 * not done with its internal initialization, it must at
++		 * least return a completion TLP, with a completion status
++		 * of "Configuration Request Retry Status (CRS)". The root
++		 * complex must complete the request to the host by returning
++		 * a read-data value of 0001h for the Vendor ID field and
++		 * all 1s for any additional bytes included in the request.
++		 * Poll using the config reads for max wait time of 1 sec or
++		 * until we receive the successful completion status. Repeat
++		 * the procedure for all the devices.
++		 */
++		for (dev = 1; dev < BCMA_PCI_SLOT_MAX; dev++) {
++			for (i = 0; i < 100000; i++) {
++				bcma_extpci_read_config(pc, dev, 0,
++							PCI_VENDOR_ID, &val16,
++							sizeof(val16));
++				if (val16 != 0x1)
++					break;
++				udelay(10);
++			}
++			if (val16 == 0x1)
++				pr_err("PCI: Broken device in slot %d\n", dev);
++		}
++	}
++}
++
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	struct bcma_drv_pci_host *pc_host;
++	u32 tmp;
++	u32 pci_membase_1G;
++	unsigned long io_map_base;
++
++	pr_info("PCIEcore in host mode found\n");
++
++	pc_host = kzalloc(sizeof(*pc_host), GFP_KERNEL);
++	if (!pc_host)  {
++		pr_err("can not allocate memory");
++		return;
++	}
++
++	pc->host_controller = pc_host;
++	pc_host->pci_controller.io_resource = &pc_host->io_resource;
++	pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
++	pc_host->pci_controller.pci_ops = &pc_host->pci_ops;
++	pc_host->pdev = pc;
++
++	pci_membase_1G = BCMA_SOC_PCI_DMA;
++	pc_host->host_cfg_addr = BCMA_SOC_PCI_CFG;
++
++	pc_host->pci_ops.read = bcma_core_pci_hostmode_read_config;
++	pc_host->pci_ops.write = bcma_core_pci_hostmode_write_config;
++
++	pc_host->mem_resource.name = "BCMA PCIcore external memory",
++	pc_host->mem_resource.start = BCMA_SOC_PCI_DMA;
++	pc_host->mem_resource.end = BCMA_SOC_PCI_DMA + BCMA_SOC_PCI_DMA_SZ - 1;
++	pc_host->mem_resource.flags = IORESOURCE_MEM | IORESOURCE_PCI_FIXED;
++
++	pc_host->io_resource.name = "BCMA PCIcore external I/O",
++	pc_host->io_resource.start = 0x100;
++	pc_host->io_resource.end = 0x7FF;
++	pc_host->io_resource.flags = IORESOURCE_IO | IORESOURCE_PCI_FIXED;
++
++	/* Reset RC */
++	udelay(3000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST_OE);
++	udelay(1000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST |
++			BCMA_CORE_PCI_CTL_RST_OE);
++
++	/* 64 MB I/O access window. On 4716, use
++	 * sbtopcie0 to access the device registers. We
++	 * can't use address match 2 (1 GB window) region
++	 * as mips can't generate 64-bit address on the
++	 * backplane.
++	 */
++	if (bus->chipinfo.id == 0x4716 || bus->chipinfo.id == 0x4748) {
++		pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++		pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++					    BCMA_SOC_PCI_MEM_SZ - 1;
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_MEM | BCMA_SOC_PCI_MEM);
++	} else if (bus->chipinfo.id == 0x5300) {
++		tmp = BCMA_CORE_PCI_SBTOPCI_MEM;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_PREF;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_BURST;
++		if (pc->core->core_unit == 0) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE_DMA_H32;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI_MEM);
++		} else if (pc->core->core_unit == 1) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI1_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI1_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE1_DMA_H32;
++			pc_host->host_cfg_addr = BCMA_SOC_PCI1_CFG;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI1_MEM);
++		}
++	} else
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_IO);
++
++	/* 64 MB configuration access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++
++	/* 1 GB memory access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI2,
++			BCMA_CORE_PCI_SBTOPCI_MEM | pci_membase_1G);
++
++
++	/* As per PCI Express Base Spec 1.1 we need to wait for
++	 * at least 100 ms from the end of a reset (cold/warm/hot)
++	 * before issuing configuration requests to PCI Express
++	 * devices.
++	 */
++	udelay(100000);
++
++	bcma_core_pci_enable_crs(pc);
++
++	/* Enable PCI bridge BAR0 memory & master access */
++	tmp = PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
++	bcma_extpci_write_config(pc, 0, 0, PCI_COMMAND, &tmp, sizeof(tmp));
++
++	/* Enable PCI interrupts */
++	pcicore_write32(pc, BCMA_CORE_PCI_IMASK, BCMA_CORE_PCI_IMASK_INTA);
++
++	/* Ok, ready to run, register it to the system.
++	 * The following needs change, if we want to port hostmode
++	 * to non-MIPS platform. */
++	io_map_base = (unsigned long)ioremap_nocache(BCMA_SOC_PCI_MEM,
++						     0x04000000);
++	pc_host->pci_controller.io_map_base = io_map_base;
++	set_io_port_base(pc_host->pci_controller.io_map_base);
++	/* Give some time to the PCI controller to configure itself with the new
++	 * values. Not waiting at this point causes crashes of the machine. */
++	mdelay(10);
++	register_pci_controller(&pc_host->pci_controller);
++	return;
++}
++
++/* Early PCI fixup for a device on the PCI-core bridge. */
++static void bcma_core_pci_fixup_pcibridge(struct pci_dev *dev)
++{
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) != 0)
++		return;
++
++	pr_info("PCI: Fixing up bridge %s\n", pci_name(dev));
++
++	/* Enable PCI bridge bus mastering and memory space */
++	pci_set_master(dev);
++	if (pcibios_enable_device(dev, ~0) < 0) {
++		pr_err("PCI: BCMA bridge enable failed\n");
++		return;
++	}
++
++	/* Enable PCI bridge BAR1 prefetch and burst */
++	pci_write_config_dword(dev, BCMA_PCI_BAR1_CONTROL, 3);
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_pcibridge);
++
++/* Early PCI fixup for all PCI-cores to set the correct memory address. */
++static void bcma_core_pci_fixup_addresses(struct pci_dev *dev)
++{
++	struct resource *res;
++	int pos;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) == 0)
++		return;
++
++	pr_info("PCI: Fixing up addresses %s\n", pci_name(dev));
++
++	for (pos = 0; pos < 6; pos++) {
++		res = &dev->resource[pos];
++		if (res->flags & (IORESOURCE_IO | IORESOURCE_MEM))
++			pci_assign_resource(dev, pos);
++	}
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_addresses);
++
++/* This function is called when doing a pci_enable_device().
++ * We must first check if the device is a device on the PCI-core bridge. */
++int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++
++	pr_info("PCI: Fixing up device %s\n", pci_name(dev));
++
++	/* Fix up interrupt lines */
++	dev->irq = bcma_core_mips_irq(pc_host->pdev->core) + 2;
++	pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
++
++	return 0;
++}
++EXPORT_SYMBOL(bcma_core_pci_plat_dev_init);
++
++/* PCI device IRQ mapping. */
++int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++	return bcma_core_mips_irq(pc_host->pdev->core) + 2;
++}
++EXPORT_SYMBOL(bcma_core_pci_pcibios_map_irq);
 --- a/drivers/bcma/host_pci.c
 +++ b/drivers/bcma/host_pci.c
 @@ -9,6 +9,7 @@
@@ -1053,7 +1821,7 @@
  
  static u32 bcma_host_pci_aread32(struct bcma_device *core, u16 offset)
  {
-@@ -87,6 +146,10 @@ const struct bcma_host_ops bcma_host_pci
+@@ -87,12 +146,16 @@ const struct bcma_host_ops bcma_host_pci
  	.write8		= bcma_host_pci_write8,
  	.write16	= bcma_host_pci_write16,
  	.write32	= bcma_host_pci_write32,
@@ -1064,43 +1832,45 @@
  	.aread32	= bcma_host_pci_aread32,
  	.awrite32	= bcma_host_pci_awrite32,
  };
-@@ -171,10 +234,46 @@ static void bcma_host_pci_remove(struct
+ 
+-static int bcma_host_pci_probe(struct pci_dev *dev,
+-			     const struct pci_device_id *id)
++static int __devinit bcma_host_pci_probe(struct pci_dev *dev,
++					 const struct pci_device_id *id)
+ {
+ 	struct bcma_bus *bus;
+ 	int err = -ENOMEM;
+@@ -171,10 +234,40 @@ static void bcma_host_pci_remove(struct
  	pci_set_drvdata(dev, NULL);
  }
  
 +#ifdef CONFIG_PM
-+static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
++static int bcma_host_pci_suspend(struct device *dev)
 +{
-+	/* Host specific */
-+	pci_save_state(dev);
-+	pci_disable_device(dev);
-+	pci_set_power_state(dev, pci_choose_state(dev, state));
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	return 0;
++	bus->mapped_core = NULL;
++
++	return bcma_bus_suspend(bus);
 +}
 +
-+static int bcma_host_pci_resume(struct pci_dev *dev)
++static int bcma_host_pci_resume(struct device *dev)
 +{
-+	struct bcma_bus *bus = pci_get_drvdata(dev);
-+	int err;
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	/* Host specific */
-+	pci_set_power_state(dev, 0);
-+	err = pci_enable_device(dev);
-+	if (err)
-+		return err;
-+	pci_restore_state(dev);
++	return bcma_bus_resume(bus);
++}
 +
-+	/* Bus specific */
-+	err = bcma_bus_resume(bus);
-+	if (err)
-+		return err;
++static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
++			 bcma_host_pci_resume);
++#define BCMA_PM_OPS	(&bcma_pm_ops)
 +
-+	return 0;
-+}
 +#else /* CONFIG_PM */
-+# define bcma_host_pci_suspend	NULL
-+# define bcma_host_pci_resume	NULL
++
++#define BCMA_PM_OPS     NULL
++
 +#endif /* CONFIG_PM */
 +
  static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
@@ -1111,12 +1881,11 @@
  	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4727) },
  	{ 0, },
  };
-@@ -185,6 +284,8 @@ static struct pci_driver bcma_pci_bridge
+@@ -185,6 +278,7 @@ static struct pci_driver bcma_pci_bridge
  	.id_table = bcma_pci_bridge_tbl,
  	.probe = bcma_host_pci_probe,
  	.remove = bcma_host_pci_remove,
-+	.suspend = bcma_host_pci_suspend,
-+	.resume = bcma_host_pci_resume,
++	.driver.pm = BCMA_PM_OPS,
  };
  
  int __init bcma_host_pci_init(void)
@@ -1308,7 +2077,7 @@
 +}
 --- a/drivers/bcma/main.c
 +++ b/drivers/bcma/main.c
-@@ -6,7 +6,9 @@
+@@ -6,14 +6,23 @@
   */
  
  #include "bcma_private.h"
@@ -1318,7 +2087,13 @@
  
  MODULE_DESCRIPTION("Broadcom's specific AMBA driver");
  MODULE_LICENSE("GPL");
-@@ -14,6 +16,7 @@ MODULE_LICENSE("GPL");
+ 
++/* contains the number the next bus should get. */
++static unsigned int bcma_bus_next_num = 0;
++
++/* bcma_buses_mutex locks the bcma_bus_next_num */
++static DEFINE_MUTEX(bcma_buses_mutex);
++
  static int bcma_bus_match(struct device *dev, struct device_driver *drv);
  static int bcma_device_probe(struct device *dev);
  static int bcma_device_remove(struct device *dev);
@@ -1326,7 +2101,7 @@
  
  static ssize_t manuf_show(struct device *dev, struct device_attribute *attr, char *buf)
  {
-@@ -48,6 +51,7 @@ static struct bus_type bcma_bus_type = {
+@@ -48,10 +57,11 @@ static struct bus_type bcma_bus_type = {
  	.match		= bcma_bus_match,
  	.probe		= bcma_device_probe,
  	.remove		= bcma_device_remove,
@@ -1334,7 +2109,17 @@
  	.dev_attrs	= bcma_device_attrs,
  };
  
-@@ -65,6 +69,10 @@ static struct bcma_device *bcma_find_cor
+-static struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
++struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
+ {
+ 	struct bcma_device *core;
+ 
+@@ -61,10 +71,15 @@ static struct bcma_device *bcma_find_cor
+ 	}
+ 	return NULL;
+ }
++EXPORT_SYMBOL_GPL(bcma_find_core);
+ 
  static void bcma_release_core_dev(struct device *dev)
  {
  	struct bcma_device *core = container_of(dev, struct bcma_device, dev);
@@ -1345,7 +2130,7 @@
  	kfree(core);
  }
  
-@@ -79,6 +87,7 @@ static int bcma_register_cores(struct bc
+@@ -79,18 +94,24 @@ static int bcma_register_cores(struct bc
  		case BCMA_CORE_CHIPCOMMON:
  		case BCMA_CORE_PCI:
  		case BCMA_CORE_PCIE:
@@ -1353,7 +2138,11 @@
  			continue;
  		}
  
-@@ -89,8 +98,13 @@ static int bcma_register_cores(struct bc
+ 		core->dev.release = bcma_release_core_dev;
+ 		core->dev.bus = &bcma_bus_type;
+-		dev_set_name(&core->dev, "bcma%d:%d", 0/*bus->num*/, dev_id);
++		dev_set_name(&core->dev, "bcma%d:%d", bus->num, dev_id);
+ 
  		switch (bus->hosttype) {
  		case BCMA_HOSTTYPE_PCI:
  			core->dev.parent = &bus->host_pci->dev;
@@ -1368,7 +2157,24 @@
  		case BCMA_HOSTTYPE_SDIO:
  			break;
  		}
-@@ -137,6 +151,13 @@ int bcma_bus_register(struct bcma_bus *b
+@@ -118,11 +139,15 @@ static void bcma_unregister_cores(struct
+ 	}
+ }
+ 
+-int bcma_bus_register(struct bcma_bus *bus)
++int __devinit bcma_bus_register(struct bcma_bus *bus)
+ {
+ 	int err;
+ 	struct bcma_device *core;
+ 
++	mutex_lock(&bcma_buses_mutex);
++	bus->num = bcma_bus_next_num++;
++	mutex_unlock(&bcma_buses_mutex);
++
+ 	/* Scan for devices (cores) */
+ 	err = bcma_bus_scan(bus);
+ 	if (err) {
+@@ -137,6 +162,13 @@ int bcma_bus_register(struct bcma_bus *b
  		bcma_core_chipcommon_init(&bus->drv_cc);
  	}
  
@@ -1382,7 +2188,7 @@
  	/* Init PCIE core */
  	core = bcma_find_core(bus, BCMA_CORE_PCIE);
  	if (core) {
-@@ -144,6 +165,15 @@ int bcma_bus_register(struct bcma_bus *b
+@@ -144,6 +176,13 @@ int bcma_bus_register(struct bcma_bus *b
  		bcma_core_pci_init(&bus->drv_pci);
  	}
  
@@ -1390,15 +2196,13 @@
 +	err = bcma_sprom_get(bus);
 +	if (err == -ENOENT) {
 +		pr_err("No SPROM available\n");
-+	} else if (err) {
++	} else if (err)
 +		pr_err("Failed to get SPROM: %d\n", err);
-+		return -ENOENT;
-+	}
 +
  	/* Register found cores */
  	bcma_register_cores(bus);
  
-@@ -151,13 +181,80 @@ int bcma_bus_register(struct bcma_bus *b
+@@ -151,13 +190,104 @@ int bcma_bus_register(struct bcma_bus *b
  
  	return 0;
  }
@@ -1464,6 +2268,21 @@
 +}
 +
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->suspend)
++				adrv->suspend(core);
++		}
++	}
++	return 0;
++}
++
 +int bcma_bus_resume(struct bcma_bus *bus)
 +{
 +	struct bcma_device *core;
@@ -1475,13 +2294,22 @@
 +		bcma_core_chipcommon_init(&bus->drv_cc);
 +	}
 +
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->resume)
++				adrv->resume(core);
++		}
++	}
++
 +	return 0;
 +}
 +#endif
  
  int __bcma_driver_register(struct bcma_driver *drv, struct module *owner)
  {
-@@ -217,6 +314,16 @@ static int bcma_device_remove(struct dev
+@@ -217,6 +347,16 @@ static int bcma_device_remove(struct dev
  	return 0;
  }
  
@@ -1500,7 +2328,7 @@
  	int err;
 --- a/drivers/bcma/scan.c
 +++ b/drivers/bcma/scan.c
-@@ -200,18 +200,162 @@ static s32 bcma_erom_get_addr_desc(struc
+@@ -200,18 +200,174 @@ static s32 bcma_erom_get_addr_desc(struc
  	return addrl;
  }
  
@@ -1511,7 +2339,7 @@
 -	u32 erombase;
 -	u32 __iomem *eromptr, *eromend;
 +	struct bcma_device *core;
- 
++
 +	list_for_each_entry(core, &bus->cores, list) {
 +		if (core->core_index == index)
 +			return core;
@@ -1519,6 +2347,17 @@
 +	return NULL;
 +}
 +
++static struct bcma_device *bcma_find_core_reverse(struct bcma_bus *bus, u16 coreid)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry_reverse(core, &bus->cores, list) {
++		if (core->id.id == coreid)
++			return core;
++	}
++	return NULL;
++}
+ 
 +static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
 +			      struct bcma_device_id *match, int core_num,
 +			      struct bcma_device *core)
@@ -1661,6 +2500,7 @@
 +{
  	s32 tmp;
 -	u8 i, j;
++	struct bcma_chipinfo *chipinfo = &(bus->chipinfo);
  
 -	int err;
 +	if (bus->init_done)
@@ -1668,10 +2508,19 @@
  
  	INIT_LIST_HEAD(&bus->cores);
  	bus->nr_cores = 0;
-@@ -222,9 +366,27 @@ int bcma_bus_scan(struct bcma_bus *bus)
- 	bus->chipinfo.id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
- 	bus->chipinfo.rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
- 	bus->chipinfo.pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
+@@ -219,142 +375,133 @@ int bcma_bus_scan(struct bcma_bus *bus)
+ 	bcma_scan_switch_core(bus, BCMA_ADDR_BASE);
+ 
+ 	tmp = bcma_scan_read32(bus, 0, BCMA_CC_ID);
+-	bus->chipinfo.id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
+-	bus->chipinfo.rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
+-	bus->chipinfo.pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	chipinfo->id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
++	chipinfo->rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
++	chipinfo->pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	pr_info("Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
++		chipinfo->id, chipinfo->rev, chipinfo->pkg);
++
 +	bus->init_done = true;
 +}
 +
@@ -1697,7 +2546,12 @@
  	eromend = eromptr + BCMA_CORE_SIZE / sizeof(u32);
  
  	bcma_scan_switch_core(bus, erombase);
-@@ -236,125 +398,89 @@ int bcma_bus_scan(struct bcma_bus *bus)
+ 
+ 	while (eromptr < eromend) {
++		struct bcma_device *other_core;
+ 		struct bcma_device *core = kzalloc(sizeof(*core), GFP_KERNEL);
+ 		if (!core)
+ 			return -ENOMEM;
  		INIT_LIST_HEAD(&core->list);
  		core->bus = bus;
  
@@ -1706,7 +2560,16 @@
 -		if (cia < 0) {
 -			bcma_erom_push_ent(&eromptr);
 -			if (bcma_erom_is_end(bus, &eromptr))
--				break;
++		err = bcma_get_next_core(bus, &eromptr, NULL, core_num, core);
++		if (err < 0) {
++			kfree(core);
++			if (err == -ENODEV) {
++				core_num++;
++				continue;
++			} else if (err == -ENXIO) {
++				continue;
++			} else if (err == -ESPIPE) {
+ 				break;
 -			err= -EILSEQ;
 -			goto out;
 -		}
@@ -1714,8 +2577,10 @@
 -		if (cib < 0) {
 -			err= -EILSEQ;
 -			goto out;
--		}
--
++			}
++			return err;
+ 		}
+ 
 -		/* parse CIs */
 -		core->id.class = (cia & SCAN_CIA_CLASS) >> SCAN_CIA_CLASS_SHIFT;
 -		core->id.id = (cia & SCAN_CIA_ID) >> SCAN_CIA_ID_SHIFT;
@@ -1730,32 +2595,33 @@
 -		     (core->id.id == 0xFFF)) ||
 -		    (ports[1] == 0)) {
 -			bcma_erom_skip_component(bus, &eromptr);
-+		err = bcma_get_next_core(bus, &eromptr, NULL, core_num, core);
-+		if (err == -ENODEV) {
-+			core_num++;
- 			continue;
+-			continue;
 -		}
--
++		core->core_index = core_num++;
++		bus->nr_cores++;
++		other_core = bcma_find_core_reverse(bus, core->id.id);
++		core->core_unit = (other_core == NULL) ? 0 : other_core->core_unit + 1;
+ 
 -		/* check if component is a core at all */
 -		if (wrappers[0] + wrappers[1] == 0) {
 -			/* we could save addrl of the router
 -			if (cid == BCMA_CORE_OOB_ROUTER)
 -			 */
 -			bcma_erom_skip_component(bus, &eromptr);
-+		} else if (err == -ENXIO)
- 			continue;
+-			continue;
 -		}
-+		else if (err == -ESPIPE)
-+			break;
-+		else if (err < 0)
-+			return err;
++		pr_info("Core %d found: %s "
++			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
++			core->core_index, bcma_device_name(&core->id),
++			core->id.manuf, core->id.id, core->id.rev,
++			core->id.class);
  
 -		if (bcma_erom_is_bridge(bus, &eromptr)) {
 -			bcma_erom_skip_component(bus, &eromptr);
 -			continue;
 -		}
-+		core->core_index = core_num++;
-+		bus->nr_cores++;
++		list_add(&core->list, &bus->cores);
++	}
  
 -		/* get & parse master ports */
 -		for (i = 0; i < ports[0]; i++) {
@@ -1765,11 +2631,8 @@
 -				goto out;
 -			}
 -		}
-+		pr_info("Core %d found: %s "
-+			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
-+			core->core_index, bcma_device_name(&core->id),
-+			core->id.manuf, core->id.id, core->id.rev,
-+			core->id.class);
++	if (bus->hosttype == BCMA_HOSTTYPE_SOC)
++		iounmap(eromptr);
  
 -		/* get & parse slave ports */
 -		for (i = 0; i < ports[1]; i++) {
@@ -1787,8 +2650,8 @@
 -				}
 -			}
 -		}
-+		list_add(&core->list, &bus->cores);
-+	}
++	return 0;
++}
  
 -		/* get & parse master wrappers */
 -		for (i = 0; i < wrappers[0]; i++) {
@@ -1806,8 +2669,12 @@
 -				}
 -			}
 -		}
-+	if (bus->hosttype == BCMA_HOSTTYPE_SOC)
-+		iounmap(eromptr);
++int __init bcma_bus_scan_early(struct bcma_bus *bus,
++			       struct bcma_device_id *match,
++			       struct bcma_device *core)
++{
++	u32 erombase;
++	u32 __iomem *eromptr, *eromend;
  
 -		/* get & parse slave wrappers */
 -		for (i = 0; i < wrappers[1]; i++) {
@@ -1826,16 +2693,6 @@
 -				}
 -			}
 -		}
-+	return 0;
-+}
-+
-+int __init bcma_bus_scan_early(struct bcma_bus *bus,
-+			       struct bcma_device_id *match,
-+			       struct bcma_device *core)
-+{
-+	u32 erombase;
-+	u32 __iomem *eromptr, *eromend;
- 
 +	int err = -ENODEV;
 +	int core_num = 0;
 +
@@ -1847,7 +2704,7 @@
 +	} else {
 +		eromptr = bus->mmio;
 +	}
-+
+ 
 +	eromend = eromptr + BCMA_CORE_SIZE / sizeof(u32);
 +
 +	bcma_scan_switch_core(bus, erombase);
@@ -1894,11 +2751,13 @@
  }
 --- /dev/null
 +++ b/drivers/bcma/sprom.c
-@@ -0,0 +1,247 @@
+@@ -0,0 +1,450 @@
 +/*
 + * Broadcom specific AMBA
 + * SPROM reading
 + *
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +
@@ -1911,7 +2770,57 @@
 +#include <linux/dma-mapping.h>
 +#include <linux/slab.h>
 +
-+#define SPOFF(offset)	((offset) / sizeof(u16))
++static int(*get_fallback_sprom)(struct bcma_bus *dev, struct ssb_sprom *out);
++
++/**
++ * bcma_arch_register_fallback_sprom - Registers a method providing a
++ * fallback SPROM if no SPROM is found.
++ *
++ * @sprom_callback: The callback function.
++ *
++ * With this function the architecture implementation may register a
++ * callback handler which fills the SPROM data structure. The fallback is
++ * used for PCI based BCMA devices, where no valid SPROM can be found
++ * in the shadow registers and to provide the SPROM for SoCs where BCMA is
++ * to controll the system bus.
++ *
++ * This function is useful for weird architectures that have a half-assed
++ * BCMA device hardwired to their PCI bus.
++ *
++ * This function is available for architecture code, only. So it is not
++ * exported.
++ */
++int bcma_arch_register_fallback_sprom(int (*sprom_callback)(struct bcma_bus *bus,
++				     struct ssb_sprom *out))
++{
++	if (get_fallback_sprom)
++		return -EEXIST;
++	get_fallback_sprom = sprom_callback;
++
++	return 0;
++}
++
++static int bcma_fill_sprom_with_fallback(struct bcma_bus *bus,
++					 struct ssb_sprom *out)
++{
++	int err;
++
++	if (!get_fallback_sprom) {
++		err = -ENOENT;
++		goto fail;
++	}
++
++	err = get_fallback_sprom(bus, out);
++	if (err)
++		goto fail;
++
++	pr_debug("Using SPROM revision %d provided by"
++		 " platform.\n", bus->sprom.revision);
++	return 0;
++fail:
++	pr_warn("Using fallback SPROM failed (err %d)\n", err);
++	return err;
++}
 +
 +/**************************************************
 + * R/W ops.
@@ -2021,10 +2930,21 @@
 + * SPROM extraction.
 + **************************************************/
 +
++#define SPOFF(offset)	((offset) / sizeof(u16))
++
++#define SPEX(_field, _offset, _mask, _shift)	\
++	bus->sprom._field = ((sprom[SPOFF(_offset)] & (_mask)) >> (_shift))
++
 +static void bcma_sprom_extract_r8(struct bcma_bus *bus, const u16 *sprom)
 +{
-+	u16 v;
++	u16 v, o;
 +	int i;
++	u16 pwr_info_offset[] = {
++		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
++		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
++	};
++	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
++			ARRAY_SIZE(bus->sprom.core_pwr_info));
 +
 +	bus->sprom.revision = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] &
 +		SSB_SPROM_REVISION_REV;
@@ -2034,85 +2954,229 @@
 +		*(((__be16 *)bus->sprom.il0mac) + i) = cpu_to_be16(v);
 +	}
 +
-+	bus->sprom.board_rev = sprom[SPOFF(SSB_SPROM8_BOARDREV)];
-+
-+	bus->sprom.txpid2g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G0) >> SSB_SPROM4_TXPID2G0_SHIFT;
-+	bus->sprom.txpid2g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G1) >> SSB_SPROM4_TXPID2G1_SHIFT;
-+	bus->sprom.txpid2g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G2) >> SSB_SPROM4_TXPID2G2_SHIFT;
-+	bus->sprom.txpid2g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G3) >> SSB_SPROM4_TXPID2G3_SHIFT;
-+
-+	bus->sprom.txpid5gl[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL0) >> SSB_SPROM4_TXPID5GL0_SHIFT;
-+	bus->sprom.txpid5gl[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL1) >> SSB_SPROM4_TXPID5GL1_SHIFT;
-+	bus->sprom.txpid5gl[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL2) >> SSB_SPROM4_TXPID5GL2_SHIFT;
-+	bus->sprom.txpid5gl[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL3) >> SSB_SPROM4_TXPID5GL3_SHIFT;
-+
-+	bus->sprom.txpid5g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G0) >> SSB_SPROM4_TXPID5G0_SHIFT;
-+	bus->sprom.txpid5g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G1) >> SSB_SPROM4_TXPID5G1_SHIFT;
-+	bus->sprom.txpid5g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G2) >> SSB_SPROM4_TXPID5G2_SHIFT;
-+	bus->sprom.txpid5g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G3) >> SSB_SPROM4_TXPID5G3_SHIFT;
-+
-+	bus->sprom.txpid5gh[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH0) >> SSB_SPROM4_TXPID5GH0_SHIFT;
-+	bus->sprom.txpid5gh[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH1) >> SSB_SPROM4_TXPID5GH1_SHIFT;
-+	bus->sprom.txpid5gh[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH2) >> SSB_SPROM4_TXPID5GH2_SHIFT;
-+	bus->sprom.txpid5gh[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH3) >> SSB_SPROM4_TXPID5GH3_SHIFT;
-+
-+	bus->sprom.boardflags_lo = sprom[SPOFF(SSB_SPROM8_BFLLO)];
-+	bus->sprom.boardflags_hi = sprom[SPOFF(SSB_SPROM8_BFLHI)];
-+	bus->sprom.boardflags2_lo = sprom[SPOFF(SSB_SPROM8_BFL2LO)];
-+	bus->sprom.boardflags2_hi = sprom[SPOFF(SSB_SPROM8_BFL2HI)];
-+
-+	bus->sprom.country_code = sprom[SPOFF(SSB_SPROM8_CCODE)];
-+
-+	bus->sprom.fem.ghz2.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz2.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz2.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz2.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz2.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
-+
-+	bus->sprom.fem.ghz5.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz5.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz5.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz5.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz5.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
++	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
++
++	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
++	     SSB_SPROM4_TXPID2G0_SHIFT);
++	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
++	     SSB_SPROM4_TXPID2G1_SHIFT);
++	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
++	     SSB_SPROM4_TXPID2G2_SHIFT);
++	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
++	     SSB_SPROM4_TXPID2G3_SHIFT);
++
++	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
++	     SSB_SPROM4_TXPID5GL0_SHIFT);
++	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
++	     SSB_SPROM4_TXPID5GL1_SHIFT);
++	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
++	     SSB_SPROM4_TXPID5GL2_SHIFT);
++	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
++	     SSB_SPROM4_TXPID5GL3_SHIFT);
++
++	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
++	     SSB_SPROM4_TXPID5G0_SHIFT);
++	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
++	     SSB_SPROM4_TXPID5G1_SHIFT);
++	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
++	     SSB_SPROM4_TXPID5G2_SHIFT);
++	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
++	     SSB_SPROM4_TXPID5G3_SHIFT);
++
++	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
++	     SSB_SPROM4_TXPID5GH0_SHIFT);
++	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
++	     SSB_SPROM4_TXPID5GH1_SHIFT);
++	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
++	     SSB_SPROM4_TXPID5GH2_SHIFT);
++	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
++	     SSB_SPROM4_TXPID5GH3_SHIFT);
++
++	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
++	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
++	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
++	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
++
++	SPEX(country_code, SSB_SPROM8_CCODE, ~0, 0);
++
++	/* Extract cores power info info */
++	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
++		o = pwr_info_offset[i];
++		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_MAXP, 0);
++
++		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
++
++		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GH_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
++
++		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
++	}
++
++	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++
++	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++}
++
++/*
++ * Indicates the presence of external SPROM.
++ */
++static bool bcma_sprom_ext_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 srom_control;
++	u32 present_mask;
++
++	if (bus->drv_cc.core->id.rev >= 31) {
++		if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
++			return false;
++
++		srom_control = bcma_read32(bus->drv_cc.core,
++					   BCMA_CC_SROM_CONTROL);
++		return srom_control & BCMA_CC_SROM_CONTROL_PRESENT;
++	}
++
++	/* older chipcommon revisions use chip status register */
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present_mask = BCMA_CC_CHIPST_4313_SPROM_PRESENT;
++		break;
++
++	case 0x4331:
++		present_mask = BCMA_CC_CHIPST_4331_SPROM_PRESENT;
++		break;
++
++	default:
++		return true;
++	}
++
++	return chip_status & present_mask;
++}
++
++/*
++ * Indicates that on-chip OTP memory is present and enabled.
++ */
++static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 otpsize = 0;
++	bool present;
++
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present = chip_status & BCMA_CC_CHIPST_4313_OTP_PRESENT;
++		break;
++
++	case 0x4331:
++		present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
++		break;
++
++	case 43224:
++	case 43225:
++		/* for these chips OTP is always available */
++		present = true;
++		break;
++
++	default:
++		present = false;
++		break;
++	}
++
++	if (present) {
++		otpsize = bus->drv_cc.capabilities & BCMA_CC_CAP_OTPS;
++		otpsize >>= BCMA_CC_CAP_OTPS_SHIFT;
++	}
++
++	return otpsize != 0;
++}
++
++/*
++ * Verify OTP is filled and determine the byte
++ * offset where SPROM data is located.
++ *
++ * On error, returns 0; byte offset otherwise.
++ */
++static int bcma_sprom_onchip_offset(struct bcma_bus *bus)
++{
++	struct bcma_device *cc = bus->drv_cc.core;
++	u32 offset;
++
++	/* verify OTP status */
++	if ((bcma_read32(cc, BCMA_CC_OTPS) & BCMA_CC_OTPS_GU_PROG_HW) == 0)
++		return 0;
++
++	/* obtain bit offset from otplayout register */
++	offset = (bcma_read32(cc, BCMA_CC_OTPL) & BCMA_CC_OTPL_GURGN_OFFSET);
++	return BCMA_CC_SPROM + (offset >> 3);
 +}
 +
 +int bcma_sprom_get(struct bcma_bus *bus)
 +{
-+	u16 offset;
++	u16 offset = BCMA_CC_SPROM;
 +	u16 *sprom;
 +	int err = 0;
 +
 +	if (!bus->drv_cc.core)
 +		return -EOPNOTSUPP;
 +
-+	if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
-+		return -ENOENT;
++	if (!bcma_sprom_ext_available(bus)) {
++		/*
++		 * External SPROM takes precedence so check
++		 * on-chip OTP only when no external SPROM
++		 * is present.
++		 */
++		if (bcma_sprom_onchip_available(bus)) {
++			/* determine offset */
++			offset = bcma_sprom_onchip_offset(bus);
++		}
++		if (!offset) {
++			/*
++			 * Maybe there is no SPROM on the device?
++			 * Now we ask the arch code if there is some sprom
++			 * available for this device in some other storage.
++			 */
++			err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
++			return err;
++		}
++	}
 +
 +	sprom = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
 +			GFP_KERNEL);
@@ -2122,11 +3186,7 @@
 +	if (bus->chipinfo.id == 0x4331)
 +		bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
 +
-+	/* Most cards have SPROM moved by additional offset 0x30 (48 dwords).
-+	 * According to brcm80211 this applies to cards with PCIe rev >= 6
-+	 * TODO: understand this condition and use it */
-+	offset = (bus->chipinfo.id == 0x4331) ? BCMA_CC_SPROM :
-+		BCMA_CC_SPROM_PCIE6;
++	pr_debug("SPROM offset 0x%x\n", offset);
 +	bcma_sprom_read(bus, offset, sprom);
 +
 +	if (bus->chipinfo.id == 0x4331)
@@ -2189,7 +3249,7 @@
  	/* Agent ops */
  	u32 (*aread32)(struct bcma_device *core, u16 offset);
  	void (*awrite32)(struct bcma_device *core, u16 offset, u32 value);
-@@ -117,6 +130,9 @@ struct bcma_device {
+@@ -117,13 +130,20 @@ struct bcma_device {
  	struct bcma_device_id id;
  
  	struct device dev;
@@ -2199,7 +3259,8 @@
  	bool dev_registered;
  
  	u8 core_index;
-@@ -124,6 +140,9 @@ struct bcma_device {
++	u8 core_unit;
+ 
  	u32 addr;
  	u32 wrap;
  
@@ -2209,7 +3270,16 @@
  	void *drvdata;
  	struct list_head list;
  };
-@@ -151,10 +170,9 @@ struct bcma_driver {
+@@ -143,7 +163,7 @@ struct bcma_driver {
+ 
+ 	int (*probe)(struct bcma_device *dev);
+ 	void (*remove)(struct bcma_device *dev);
+-	int (*suspend)(struct bcma_device *dev, pm_message_t state);
++	int (*suspend)(struct bcma_device *dev);
+ 	int (*resume)(struct bcma_device *dev);
+ 	void (*shutdown)(struct bcma_device *dev);
+ 
+@@ -151,12 +171,17 @@ struct bcma_driver {
  };
  extern
  int __bcma_driver_register(struct bcma_driver *drv, struct module *owner);
@@ -2222,12 +3292,21 @@
 +
  extern void bcma_driver_unregister(struct bcma_driver *drv);
  
++/* Set a fallback SPROM.
++ * See kdoc at the function definition for complete documentation. */
++extern int bcma_arch_register_fallback_sprom(
++		int (*sprom_callback)(struct bcma_bus *bus,
++		struct ssb_sprom *out));
++
  struct bcma_bus {
-@@ -176,49 +194,105 @@ struct bcma_bus {
+ 	/* The MMIO area. */
+ 	void __iomem *mmio;
+@@ -176,49 +201,107 @@ struct bcma_bus {
  	struct bcma_device *mapped_core;
  	struct list_head cores;
  	u8 nr_cores;
 +	u8 init_done:1;
++	u8 num;
  
  	struct bcma_drv_cc drv_cc;
  	struct bcma_drv_pci drv_pci;
@@ -2323,6 +3402,7 @@
 +	bcma_write16(cc, offset, (bcma_read16(cc, offset) & mask) | set);
 +}
 +
++extern struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid);
  extern bool bcma_core_is_enabled(struct bcma_device *core);
 +extern void bcma_core_disable(struct bcma_device *core, u32 flags);
  extern int bcma_core_enable(struct bcma_device *core, u32 flags);
@@ -2347,7 +3427,37 @@
  #define	  BCMA_CC_FLASHT_PARA		0x00000700	/* Parallel flash */
  #define  BCMA_CC_CAP_PLLT		0x00038000	/* PLL Type */
  #define   BCMA_PLLTYPE_NONE		0x00000000
-@@ -178,16 +179,9 @@
+@@ -55,6 +56,9 @@
+ #define	 BCMA_CC_OTPS_HW_PROTECT	0x00000001
+ #define	 BCMA_CC_OTPS_SW_PROTECT	0x00000002
+ #define	 BCMA_CC_OTPS_CID_PROTECT	0x00000004
++#define  BCMA_CC_OTPS_GU_PROG_IND	0x00000F00	/* General Use programmed indication */
++#define  BCMA_CC_OTPS_GU_PROG_IND_SHIFT	8
++#define  BCMA_CC_OTPS_GU_PROG_HW	0x00000100	/* HW region programmed */
+ #define BCMA_CC_OTPC			0x0014		/* OTP control */
+ #define	 BCMA_CC_OTPC_RECWAIT		0xFF000000
+ #define	 BCMA_CC_OTPC_PROGWAIT		0x00FFFF00
+@@ -71,6 +75,8 @@
+ #define	 BCMA_CC_OTPP_READ		0x40000000
+ #define	 BCMA_CC_OTPP_START		0x80000000
+ #define	 BCMA_CC_OTPP_BUSY		0x80000000
++#define BCMA_CC_OTPL			0x001C		/* OTP layout */
++#define  BCMA_CC_OTPL_GURGN_OFFSET	0x00000FFF	/* offset of general use region */
+ #define BCMA_CC_IRQSTAT			0x0020
+ #define BCMA_CC_IRQMASK			0x0024
+ #define	 BCMA_CC_IRQ_GPIO		0x00000001	/* gpio intr */
+@@ -78,6 +84,10 @@
+ #define	 BCMA_CC_IRQ_WDRESET		0x80000000	/* watchdog reset occurred */
+ #define BCMA_CC_CHIPCTL			0x0028		/* Rev >= 11 only */
+ #define BCMA_CC_CHIPSTAT		0x002C		/* Rev >= 11 only */
++#define  BCMA_CC_CHIPST_4313_SPROM_PRESENT	1
++#define  BCMA_CC_CHIPST_4313_OTP_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_SPROM_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_OTP_PRESENT	4
+ #define BCMA_CC_JCMD			0x0030		/* Rev >= 10 only */
+ #define  BCMA_CC_JCMD_START		0x80000000
+ #define  BCMA_CC_JCMD_BUSY		0x80000000
+@@ -178,16 +188,25 @@
  #define BCMA_CC_PROG_CFG		0x0120
  #define BCMA_CC_PROG_WAITCNT		0x0124
  #define BCMA_CC_FLASH_CFG		0x0128
@@ -2362,11 +3472,27 @@
 -#define  BCMA_CC_CLKCTLST_HWCROFF	0x00000020 /* Force HW clock request off */
 -#define  BCMA_CC_CLKCTLST_HAVEHT	0x00010000 /* HT available */
 -#define  BCMA_CC_CLKCTLST_HAVEALP	0x00020000 /* APL available */
++#define BCMA_CC_SROM_CONTROL		0x0190
++#define  BCMA_CC_SROM_CONTROL_START	0x80000000
++#define  BCMA_CC_SROM_CONTROL_BUSY	0x80000000
++#define  BCMA_CC_SROM_CONTROL_OPCODE	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OP_READ	0x00000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRITE	0x20000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRDIS	0x40000000
++#define  BCMA_CC_SROM_CONTROL_OP_WREN	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OTPSEL	0x00000010
++#define  BCMA_CC_SROM_CONTROL_LOCK	0x00000008
++#define  BCMA_CC_SROM_CONTROL_SIZE_MASK	0x00000006
++#define  BCMA_CC_SROM_CONTROL_SIZE_1K	0x00000000
++#define  BCMA_CC_SROM_CONTROL_SIZE_4K	0x00000002
++#define  BCMA_CC_SROM_CONTROL_SIZE_16K	0x00000004
++#define  BCMA_CC_SROM_CONTROL_SIZE_SHIFT	1
++#define  BCMA_CC_SROM_CONTROL_PRESENT	0x00000001
 +/* 0x1E0 is defined as shared BCMA_CLKCTLST */
  #define BCMA_CC_HW_WORKAROUND		0x01E4 /* Hardware workaround (rev >= 20) */
  #define BCMA_CC_UART0_DATA		0x0300
  #define BCMA_CC_UART0_IMR		0x0304
-@@ -209,6 +203,7 @@
+@@ -209,6 +228,7 @@
  #define BCMA_CC_PMU_CTL			0x0600 /* PMU control */
  #define  BCMA_CC_PMU_CTL_ILP_DIV	0xFFFF0000 /* ILP div mask */
  #define  BCMA_CC_PMU_CTL_ILP_DIV_SHIFT	16
@@ -2374,12 +3500,11 @@
  #define  BCMA_CC_PMU_CTL_NOILPONW	0x00000200 /* No ILP on wait */
  #define  BCMA_CC_PMU_CTL_HTREQEN	0x00000100 /* HT req enable */
  #define  BCMA_CC_PMU_CTL_ALPREQEN	0x00000080 /* ALP req enable */
-@@ -244,6 +239,66 @@
+@@ -244,6 +264,65 @@
  #define BCMA_CC_REGCTL_DATA		0x065C
  #define BCMA_CC_PLLCTL_ADDR		0x0660
  #define BCMA_CC_PLLCTL_DATA		0x0664
 +#define BCMA_CC_SPROM			0x0800 /* SPROM beginning */
-+#define BCMA_CC_SPROM_PCIE6		0x0830 /* SPROM beginning on PCIe rev >= 6 */
 +
 +/* Divider allocation in 4716/47162/5356 */
 +#define BCMA_CC_PMU5_MAINPLL_CPU	1
@@ -2441,7 +3566,7 @@
  
  /* Data for the PMU, if available.
   * Check availability with ((struct bcma_chipcommon)->capabilities & BCMA_CC_CAP_PMU)
-@@ -253,14 +308,37 @@ struct bcma_chipcommon_pmu {
+@@ -253,14 +332,37 @@ struct bcma_chipcommon_pmu {
  	u32 crystalfreq;	/* The active crystal frequency (in kHz) */
  };
  
@@ -2479,7 +3604,7 @@
  };
  
  /* Register access */
-@@ -281,6 +359,8 @@ extern void bcma_core_chipcommon_init(st
+@@ -281,6 +383,8 @@ extern void bcma_core_chipcommon_init(st
  extern void bcma_chipco_suspend(struct bcma_drv_cc *cc);
  extern void bcma_chipco_resume(struct bcma_drv_cc *cc);
  
@@ -2488,7 +3613,7 @@
  extern void bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc,
  					  u32 ticks);
  
-@@ -299,4 +379,13 @@ u32 bcma_chipco_gpio_polarity(struct bcm
+@@ -299,4 +403,13 @@ u32 bcma_chipco_gpio_polarity(struct bcm
  /* PMU support */
  extern void bcma_pmu_init(struct bcma_drv_cc *cc);
  
@@ -2558,12 +3683,156 @@
 +#endif /* LINUX_BCMA_DRIVER_MIPS_H_ */
 --- a/include/linux/bcma/bcma_driver_pci.h
 +++ b/include/linux/bcma/bcma_driver_pci.h
-@@ -85,5 +85,7 @@ struct bcma_drv_pci {
+@@ -53,6 +53,35 @@ struct pci_dev;
+ #define  BCMA_CORE_PCI_SBTOPCI1_MASK		0xFC000000
+ #define BCMA_CORE_PCI_SBTOPCI2			0x0108	/* Backplane to PCI translation 2 (sbtopci2) */
+ #define  BCMA_CORE_PCI_SBTOPCI2_MASK		0xC0000000
++#define BCMA_CORE_PCI_CONFIG_ADDR		0x0120	/* pcie config space access */
++#define BCMA_CORE_PCI_CONFIG_DATA		0x0124	/* pcie config space access */
++#define BCMA_CORE_PCI_MDIO_CONTROL		0x0128	/* controls the mdio access */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_MASK	0x7f	/* clock to be used on MDIO */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL	0x2
++#define  BCMA_CORE_PCI_MDIOCTL_PREAM_EN		0x80	/* Enable preamble sequnce */
++#define  BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE	0x100	/* Tranaction complete */
++#define BCMA_CORE_PCI_MDIO_DATA			0x012c	/* Data to the mdio access */
++#define  BCMA_CORE_PCI_MDIODATA_MASK		0x0000ffff /* data 2 bytes */
++#define  BCMA_CORE_PCI_MDIODATA_TA		0x00020000 /* Turnaround */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD	18	/* Regaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK_OLD	0x003c0000 /* Regaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD	22	/* Physmedia devaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK_OLD	0x0fc00000 /* Physmedia devaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF	18	/* Regaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK	0x007c0000 /* Regaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF	23	/* Physmedia devaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK	0x0f800000 /* Physmedia devaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_WRITE		0x10000000 /* write Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_READ		0x20000000 /* Read Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_START		0x40000000 /* start of Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_ADDR	0x0	/* dev address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_BLK_ADDR	0x1F	/* blk address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_PLL		0x1d	/* SERDES PLL Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_TX		0x1e	/* SERDES TX Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_RX		0x1f	/* SERDES RX Dev */
++#define BCMA_CORE_PCI_PCIEIND_ADDR		0x0130	/* indirect access to the internal register */
++#define BCMA_CORE_PCI_PCIEIND_DATA		0x0134	/* Data to/from the internal regsiter */
++#define BCMA_CORE_PCI_CLKREQENCTRL		0x0138	/*  >= rev 6, Clkreq rdma control */
+ #define BCMA_CORE_PCI_PCICFG0			0x0400	/* PCI config space 0 (rev >= 8) */
+ #define BCMA_CORE_PCI_PCICFG1			0x0500	/* PCI config space 1 (rev >= 8) */
+ #define BCMA_CORE_PCI_PCICFG2			0x0600	/* PCI config space 2 (rev >= 8) */
+@@ -72,18 +101,114 @@ struct pci_dev;
+ #define  BCMA_CORE_PCI_SBTOPCI_RC_READL		0x00000010 /* Memory read line */
+ #define  BCMA_CORE_PCI_SBTOPCI_RC_READM		0x00000020 /* Memory read multiple */
+ 
++/* PCIE protocol PHY diagnostic registers */
++#define BCMA_CORE_PCI_PLP_MODEREG		0x200	/* Mode */
++#define BCMA_CORE_PCI_PLP_STATUSREG		0x204	/* Status */
++#define  BCMA_CORE_PCI_PLP_POLARITYINV_STAT	0x10	/* Status reg PCIE_PLP_STATUSREG */
++#define BCMA_CORE_PCI_PLP_LTSSMCTRLREG		0x208	/* LTSSM control */
++#define BCMA_CORE_PCI_PLP_LTLINKNUMREG		0x20c	/* Link Training Link number */
++#define BCMA_CORE_PCI_PLP_LTLANENUMREG		0x210	/* Link Training Lane number */
++#define BCMA_CORE_PCI_PLP_LTNFTSREG		0x214	/* Link Training N_FTS */
++#define BCMA_CORE_PCI_PLP_ATTNREG		0x218	/* Attention */
++#define BCMA_CORE_PCI_PLP_ATTNMASKREG		0x21C	/* Attention Mask */
++#define BCMA_CORE_PCI_PLP_RXERRCTR		0x220	/* Rx Error */
++#define BCMA_CORE_PCI_PLP_RXFRMERRCTR		0x224	/* Rx Framing Error */
++#define BCMA_CORE_PCI_PLP_RXERRTHRESHREG	0x228	/* Rx Error threshold */
++#define BCMA_CORE_PCI_PLP_TESTCTRLREG		0x22C	/* Test Control reg */
++#define BCMA_CORE_PCI_PLP_SERDESCTRLOVRDREG	0x230	/* SERDES Control Override */
++#define BCMA_CORE_PCI_PLP_TIMINGOVRDREG		0x234	/* Timing param override */
++#define BCMA_CORE_PCI_PLP_RXTXSMDIAGREG		0x238	/* RXTX State Machine Diag */
++#define BCMA_CORE_PCI_PLP_LTSSMDIAGREG		0x23C	/* LTSSM State Machine Diag */
++
++/* PCIE protocol DLLP diagnostic registers */
++#define BCMA_CORE_PCI_DLLP_LCREG		0x100	/* Link Control */
++#define BCMA_CORE_PCI_DLLP_LSREG		0x104	/* Link Status */
++#define BCMA_CORE_PCI_DLLP_LAREG		0x108	/* Link Attention */
++#define  BCMA_CORE_PCI_DLLP_LSREG_LINKUP	(1 << 16)
++#define BCMA_CORE_PCI_DLLP_LAMASKREG		0x10C	/* Link Attention Mask */
++#define BCMA_CORE_PCI_DLLP_NEXTTXSEQNUMREG	0x110	/* Next Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_ACKEDTXSEQNUMREG	0x114	/* Acked Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_PURGEDTXSEQNUMREG	0x118	/* Purged Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_RXSEQNUMREG		0x11C	/* Rx Sequence Number */
++#define BCMA_CORE_PCI_DLLP_LRREG		0x120	/* Link Replay */
++#define BCMA_CORE_PCI_DLLP_LACKTOREG		0x124	/* Link Ack Timeout */
++#define BCMA_CORE_PCI_DLLP_PMTHRESHREG		0x128	/* Power Management Threshold */
++#define BCMA_CORE_PCI_DLLP_RTRYWPREG		0x12C	/* Retry buffer write ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYRPREG		0x130	/* Retry buffer Read ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYPPREG		0x134	/* Retry buffer Purged ptr */
++#define BCMA_CORE_PCI_DLLP_RTRRWREG		0x138	/* Retry buffer Read/Write */
++#define BCMA_CORE_PCI_DLLP_ECTHRESHREG		0x13C	/* Error Count Threshold */
++#define BCMA_CORE_PCI_DLLP_TLPERRCTRREG		0x140	/* TLP Error Counter */
++#define BCMA_CORE_PCI_DLLP_ERRCTRREG		0x144	/* Error Counter */
++#define BCMA_CORE_PCI_DLLP_NAKRXCTRREG		0x148	/* NAK Received Counter */
++#define BCMA_CORE_PCI_DLLP_TESTREG		0x14C	/* Test */
++#define BCMA_CORE_PCI_DLLP_PKTBIST		0x150	/* Packet BIST */
++#define BCMA_CORE_PCI_DLLP_PCIE11		0x154	/* DLLP PCIE 1.1 reg */
++
++/* SERDES RX registers */
++#define BCMA_CORE_PCI_SERDES_RX_CTRL		1	/* Rx cntrl */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE	0x80	/* rxpolarity_force */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY	0x40	/* rxpolarity_value */
++#define BCMA_CORE_PCI_SERDES_RX_TIMER1		2	/* Rx Timer1 */
++#define BCMA_CORE_PCI_SERDES_RX_CDR		6	/* CDR */
++#define BCMA_CORE_PCI_SERDES_RX_CDRBW		7	/* CDR BW */
++
++/* SERDES PLL registers */
++#define BCMA_CORE_PCI_SERDES_PLL_CTRL		1	/* PLL control reg */
++#define BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN	0x4000	/* bit 14 is FREQDET on */
++
+ /* PCIcore specific boardflags */
+ #define BCMA_CORE_PCI_BFL_NOPCI			0x00000400 /* Board leaves PCI floating */
+ 
++/* PCIE Config space accessing MACROS */
++#define BCMA_CORE_PCI_CFG_BUS_SHIFT		24	/* Bus shift */
++#define BCMA_CORE_PCI_CFG_SLOT_SHIFT		19	/* Slot/Device shift */
++#define BCMA_CORE_PCI_CFG_FUN_SHIFT		16	/* Function shift */
++#define BCMA_CORE_PCI_CFG_OFF_SHIFT		0	/* Register shift */
++
++#define BCMA_CORE_PCI_CFG_BUS_MASK		0xff	/* Bus mask */
++#define BCMA_CORE_PCI_CFG_SLOT_MASK		0x1f	/* Slot/Device mask */
++#define BCMA_CORE_PCI_CFG_FUN_MASK		7	/* Function mask */
++#define BCMA_CORE_PCI_CFG_OFF_MASK		0xfff	/* Register mask */
++
++/* PCIE Root Capability Register bits (Host mode only) */
++#define BCMA_CORE_PCI_RC_CRS_VISIBILITY		0x0001
++
++struct bcma_drv_pci;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++struct bcma_drv_pci_host {
++	struct bcma_drv_pci *pdev;
++
++	u32 host_cfg_addr;
++	spinlock_t cfgspace_lock;
++
++	struct pci_controller pci_controller;
++	struct pci_ops pci_ops;
++	struct resource mem_resource;
++	struct resource io_resource;
++};
++#endif
++
+ struct bcma_drv_pci {
+ 	struct bcma_device *core;
+ 	u8 setup_done:1;
++	u8 hostmode:1;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	struct bcma_drv_pci_host *host_controller;
++#endif
+ };
+ 
+ /* Register access */
+ #define pcicore_read32(pc, offset)		bcma_read32((pc)->core, offset)
  #define pcicore_write32(pc, offset, val)	bcma_write32((pc)->core, offset, val)
  
- extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
+-extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
++extern void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc);
 +extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
 +				 struct bcma_device *core, bool enable);
++
++extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
++extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
  
  #endif /* LINUX_BCMA_DRIVER_PCI_H_ */
 --- a/include/linux/bcma/bcma_regs.h
@@ -2608,6 +3877,38 @@
  #define BCMA_RESET_CTL			0x0800
  #define  BCMA_RESET_CTL_RESET		0x0001
  
+@@ -31,4 +56,31 @@
+ #define  BCMA_PCI_GPIO_XTAL		0x40	/* PCI config space GPIO 14 for Xtal powerup */
+ #define  BCMA_PCI_GPIO_PLL		0x80	/* PCI config space GPIO 15 for PLL powerdown */
+ 
++/* SiliconBackplane Address Map.
++ * All regions may not exist on all chips.
++ */
++#define BCMA_SOC_SDRAM_BASE		0x00000000U	/* Physical SDRAM */
++#define BCMA_SOC_PCI_MEM		0x08000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI_MEM_SZ		(64 * 1024 * 1024)
++#define BCMA_SOC_PCI_CFG		0x0c000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_SDRAM_SWAPPED		0x10000000U	/* Byteswapped Physical SDRAM */
++#define BCMA_SOC_SDRAM_R2		0x80000000U	/* Region 2 for sdram (512 MB) */
++
++
++#define BCMA_SOC_PCI_DMA		0x40000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA2		0x80000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA_SZ		0x40000000U	/* Client Mode sb2pcitranslation2 size in bytes */
++#define BCMA_SOC_PCIE_DMA_L32		0x00000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), low 32 bits
++							 */
++#define BCMA_SOC_PCIE_DMA_H32		0x80000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
++#define BCMA_SOC_PCI1_MEM		0x40000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI1_CFG		0x44000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_PCIE1_DMA_H32		0xc0000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
+ #endif /* LINUX_BCMA_REGS_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_soc.h
 @@ -0,0 +1,16 @@
diff --git a/target/linux/generic/patches-3.1/020-ssb_update.patch b/target/linux/generic/patches-3.1/020-ssb_update.patch
index 843f970447..76759273a7 100644
--- a/target/linux/generic/patches-3.1/020-ssb_update.patch
+++ b/target/linux/generic/patches-3.1/020-ssb_update.patch
@@ -1,3 +1,14 @@
+--- a/drivers/ssb/driver_pcicore.c
++++ b/drivers/ssb/driver_pcicore.c
+@@ -74,7 +74,7 @@ static u32 get_cfgspace_addr(struct ssb_
+ 	u32 tmp;
+ 
+ 	/* We do only have one cardbus device behind the bridge. */
+-	if (pc->cardbusmode && (dev >= 1))
++	if (pc->cardbusmode && (dev > 1))
+ 		goto out;
+ 
+ 	if (bus == 0) {
 --- a/drivers/ssb/b43_pci_bridge.c
 +++ b/drivers/ssb/b43_pci_bridge.c
 @@ -11,6 +11,7 @@
@@ -8,6 +19,101 @@
  #include <linux/ssb/ssb.h>
  
  #include "ssb_private.h"
+--- a/drivers/ssb/driver_chipcommon_pmu.c
++++ b/drivers/ssb/driver_chipcommon_pmu.c
+@@ -12,6 +12,9 @@
+ #include <linux/ssb/ssb_regs.h>
+ #include <linux/ssb/ssb_driver_chipcommon.h>
+ #include <linux/delay.h>
++#ifdef CONFIG_BCM47XX
++#include <asm/mach-bcm47xx/nvram.h>
++#endif
+ 
+ #include "ssb_private.h"
+ 
+@@ -91,10 +94,6 @@ static void ssb_pmu0_pllinit_r0(struct s
+ 	u32 pmuctl, tmp, pllctl;
+ 	unsigned int i;
+ 
+-	if ((bus->chip_id == 0x5354) && !crystalfreq) {
+-		/* The 5354 crystal freq is 25MHz */
+-		crystalfreq = 25000;
+-	}
+ 	if (crystalfreq)
+ 		e = pmu0_plltab_find_entry(crystalfreq);
+ 	if (!e)
+@@ -320,7 +319,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 	u32 crystalfreq = 0; /* in kHz. 0 = keep default freq. */
+ 
+ 	if (bus->bustype == SSB_BUSTYPE_SSB) {
+-		/* TODO: The user may override the crystal frequency. */
++#ifdef CONFIG_BCM47XX
++		char buf[20];
++		if (nvram_getenv("xtalfreq", buf, sizeof(buf)) >= 0)
++			crystalfreq = simple_strtoul(buf, NULL, 0);
++#endif
+ 	}
+ 
+ 	switch (bus->chip_id) {
+@@ -329,7 +332,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 		ssb_pmu1_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4328:
++		ssb_pmu0_pllinit_r0(cc, crystalfreq);
++		break;
+ 	case 0x5354:
++		if (crystalfreq == 0)
++			crystalfreq = 25000;
+ 		ssb_pmu0_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4322:
+@@ -606,3 +613,34 @@ void ssb_pmu_set_ldo_paref(struct ssb_ch
+ 
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_voltage);
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_paref);
++
++u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		/* 5354 chip uses a non programmable PLL of frequency 240MHz */
++		return 240000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU cpu clock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
++
++u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		return 120000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU controlclock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
+--- a/drivers/ssb/driver_mipscore.c
++++ b/drivers/ssb/driver_mipscore.c
+@@ -208,6 +208,9 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 	u32 pll_type, n, m, rate = 0;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_cpu_clock(&bus->chipco);
++
+ 	if (bus->extif.dev) {
+ 		ssb_extif_get_clockcontrol(&bus->extif, &pll_type, &n, &m);
+ 	} else if (bus->chipco.dev) {
 --- a/drivers/ssb/main.c
 +++ b/drivers/ssb/main.c
 @@ -12,6 +12,7 @@
@@ -18,7 +124,59 @@
  #include <linux/ssb/ssb.h>
  #include <linux/ssb/ssb_regs.h>
  #include <linux/ssb/ssb_driver_gige.h>
-@@ -1260,16 +1261,34 @@ void ssb_device_disable(struct ssb_devic
+@@ -139,19 +140,6 @@ static void ssb_device_put(struct ssb_de
+ 		put_device(dev->dev);
+ }
+ 
+-static inline struct ssb_driver *ssb_driver_get(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		get_driver(&drv->drv);
+-	return drv;
+-}
+-
+-static inline void ssb_driver_put(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		put_driver(&drv->drv);
+-}
+-
+ static int ssb_device_resume(struct device *dev)
+ {
+ 	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
+@@ -249,11 +237,9 @@ int ssb_devices_freeze(struct ssb_bus *b
+ 			ssb_device_put(sdev);
+ 			continue;
+ 		}
+-		sdrv = ssb_driver_get(drv_to_ssb_drv(sdev->dev->driver));
+-		if (!sdrv || SSB_WARN_ON(!sdrv->remove)) {
+-			ssb_device_put(sdev);
++		sdrv = drv_to_ssb_drv(sdev->dev->driver);
++		if (SSB_WARN_ON(!sdrv->remove))
+ 			continue;
+-		}
+ 		sdrv->remove(sdev);
+ 		ctx->device_frozen[i] = 1;
+ 	}
+@@ -292,7 +278,6 @@ int ssb_devices_thaw(struct ssb_freeze_c
+ 				   dev_name(sdev->dev));
+ 			result = err;
+ 		}
+-		ssb_driver_put(sdrv);
+ 		ssb_device_put(sdev);
+ 	}
+ 
+@@ -1093,6 +1078,9 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
+ 	u32 plltype;
+ 	u32 clkctl_n, clkctl_m;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_controlclock(&bus->chipco);
++
+ 	if (ssb_extif_available(&bus->extif))
+ 		ssb_extif_get_clockcontrol(&bus->extif, &plltype,
+ 					   &clkctl_n, &clkctl_m);
+@@ -1260,16 +1248,34 @@ void ssb_device_disable(struct ssb_devic
  }
  EXPORT_SYMBOL(ssb_device_disable);
  
@@ -58,7 +216,63 @@
  	}
 --- a/drivers/ssb/pci.c
 +++ b/drivers/ssb/pci.c
-@@ -523,7 +523,13 @@ static void sprom_extract_r45(struct ssb
+@@ -331,7 +331,6 @@ static void sprom_extract_r123(struct ss
+ {
+ 	int i;
+ 	u16 v;
+-	s8 gain;
+ 	u16 loc[3];
+ 
+ 	if (out->revision == 3)			/* rev 3 moved MAC */
+@@ -390,20 +389,12 @@ static void sprom_extract_r123(struct ss
+ 		SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_BG,
+-				    SSB_SPROM1_AGAIN_BG_SHIFT);
+-	out->antenna_gain.ghz24.a0 = gain;
+-	out->antenna_gain.ghz24.a1 = gain;
+-	out->antenna_gain.ghz24.a2 = gain;
+-	out->antenna_gain.ghz24.a3 = gain;
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_A,
+-				    SSB_SPROM1_AGAIN_A_SHIFT);
+-	out->antenna_gain.ghz5.a0 = gain;
+-	out->antenna_gain.ghz5.a1 = gain;
+-	out->antenna_gain.ghz5.a2 = gain;
+-	out->antenna_gain.ghz5.a3 = gain;
++	out->antenna_gain.a0 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_BG,
++						    SSB_SPROM1_AGAIN_BG_SHIFT);
++	out->antenna_gain.a1 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_A,
++						    SSB_SPROM1_AGAIN_A_SHIFT);
+ }
+ 
+ /* Revs 4 5 and 8 have partially shared layout */
+@@ -504,16 +495,14 @@ static void sprom_extract_r45(struct ssb
+ 	}
+ 
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN0, SSB_SPROM4_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN1, SSB_SPROM4_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN2, SSB_SPROM4_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN3, SSB_SPROM4_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
+ 
+ 	sprom_extract_r458(out, in);
+ 
+@@ -523,7 +512,13 @@ static void sprom_extract_r45(struct ssb
  static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
  {
  	int i;
@@ -73,10 +287,25 @@
  
  	/* extract the MAC address */
  	for (i = 0; i < 3; i++) {
-@@ -607,6 +613,61 @@ static void sprom_extract_r8(struct ssb_
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
+@@ -596,16 +591,69 @@ static void sprom_extract_r8(struct ssb_
+ 	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
  
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
++
 +	/* Extract cores power info info */
 +	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
 +		o = pwr_info_offset[i];
@@ -131,10 +360,74 @@
 +		SSB_SROM8_FEM_TR_ISO, SSB_SROM8_FEM_TR_ISO_SHIFT);
 +	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G,
 +		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
-+
+ 
  	sprom_extract_r458(out, in);
  
- 	/* TODO - get remaining rev 8 stuff needed */
+--- a/drivers/ssb/pcmcia.c
++++ b/drivers/ssb/pcmcia.c
+@@ -676,14 +676,10 @@ static int ssb_pcmcia_do_get_invariants(
+ 	case SSB_PCMCIA_CIS_ANTGAIN:
+ 		GOTO_ERROR_ON(tuple->TupleDataLen != 2,
+ 			"antg tpl size");
+-		sprom->antenna_gain.ghz24.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a3 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a3 = tuple->TupleData[1];
++		sprom->antenna_gain.a0 = tuple->TupleData[1];
++		sprom->antenna_gain.a1 = tuple->TupleData[1];
++		sprom->antenna_gain.a2 = tuple->TupleData[1];
++		sprom->antenna_gain.a3 = tuple->TupleData[1];
+ 		break;
+ 	case SSB_PCMCIA_CIS_BFLAGS:
+ 		GOTO_ERROR_ON((tuple->TupleDataLen != 3) &&
+--- a/drivers/ssb/scan.c
++++ b/drivers/ssb/scan.c
+@@ -318,6 +318,9 @@ int ssb_bus_scan(struct ssb_bus *bus,
+ 			bus->chip_package = 0;
+ 		}
+ 	}
++	ssb_printk(KERN_INFO PFX "Found chip with id 0x%04X, rev 0x%02X and "
++		   "package 0x%02X\n", bus->chip_id, bus->chip_rev,
++		   bus->chip_package);
+ 	if (!bus->nr_devices)
+ 		bus->nr_devices = chipid_to_nrcores(bus->chip_id);
+ 	if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
+--- a/drivers/ssb/sdio.c
++++ b/drivers/ssb/sdio.c
+@@ -551,14 +551,10 @@ int ssb_sdio_get_invariants(struct ssb_b
+ 			case SSB_SDIO_CIS_ANTGAIN:
+ 				GOTO_ERROR_ON(tuple->size != 2,
+ 					      "antg tpl size");
+-				sprom->antenna_gain.ghz24.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a3 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a3 = tuple->data[1];
++				sprom->antenna_gain.a0 = tuple->data[1];
++				sprom->antenna_gain.a1 = tuple->data[1];
++				sprom->antenna_gain.a2 = tuple->data[1];
++				sprom->antenna_gain.a3 = tuple->data[1];
+ 				break;
+ 			case SSB_SDIO_CIS_BFLAGS:
+ 				GOTO_ERROR_ON((tuple->size != 3) &&
+--- a/drivers/ssb/ssb_private.h
++++ b/drivers/ssb/ssb_private.h
+@@ -207,4 +207,8 @@ static inline void b43_pci_ssb_bridge_ex
+ }
+ #endif /* CONFIG_SSB_B43_PCI_BRIDGE */
+ 
++/* driver_chipcommon_pmu.c */
++extern u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc);
++extern u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc);
++
+ #endif /* LINUX_SSB_PRIVATE_H_ */
 --- a/include/linux/ssb/ssb.h
 +++ b/include/linux/ssb/ssb.h
 @@ -16,6 +16,12 @@ struct pcmcia_device;
@@ -144,22 +437,56 @@
 +struct ssb_sprom_core_pwr_info {
 +	u8 itssi_2g, itssi_5g;
 +	u8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh;
-+	u16 pa_2g[3], pa_5gl[3], pa_5g[3], pa_5gh[3];
++	u16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4];
 +};
 +
  struct ssb_sprom {
  	u8 revision;
  	u8 il0mac[6];		/* MAC address for 802.11b/g */
-@@ -25,7 +31,7 @@ struct ssb_sprom {
+@@ -25,10 +31,13 @@ struct ssb_sprom {
  	u8 et1phyaddr;		/* MII address for enet1 */
  	u8 et0mdcport;		/* MDIO for enet0 */
  	u8 et1mdcport;		/* MDIO for enet1 */
 -	u8 board_rev;		/* Board revision number from SPROM. */
 +	u16 board_rev;		/* Board revision number from SPROM. */
++	u16 board_num;		/* Board number from SPROM. */
++	u16 board_type;		/* Board type from SPROM. */
  	u8 country_code;	/* Country Code */
- 	u16 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
- 	u16 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
-@@ -82,6 +88,8 @@ struct ssb_sprom {
+-	u16 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
+-	u16 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
++	char alpha2[2];		/* Country Code as two chars like EU or US */
++	u8 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
++	u8 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
+ 	u8 ant_available_a;	/* 2GHz antenna available bits (up to 4) */
+ 	u8 ant_available_bg;	/* 5GHz antenna available bits (up to 4) */
+ 	u16 pa0b0;
+@@ -47,10 +56,10 @@ struct ssb_sprom {
+ 	u8 gpio1;		/* GPIO pin 1 */
+ 	u8 gpio2;		/* GPIO pin 2 */
+ 	u8 gpio3;		/* GPIO pin 3 */
+-	u16 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
+ 	u8 itssi_a;		/* Idle TSSI Target for A-PHY */
+ 	u8 itssi_bg;		/* Idle TSSI Target for B/G-PHY */
+ 	u8 tri2g;		/* 2.4GHz TX isolation */
+@@ -61,8 +70,8 @@ struct ssb_sprom {
+ 	u8 txpid5gl[4];		/* 4.9 - 5.1GHz TX power index */
+ 	u8 txpid5g[4];		/* 5.1 - 5.5GHz TX power index */
+ 	u8 txpid5gh[4];		/* 5.5 - ...GHz TX power index */
+-	u8 rxpo2g;		/* 2GHz RX power offset */
+-	u8 rxpo5g;		/* 5GHz RX power offset */
++	s8 rxpo2g;		/* 2GHz RX power offset */
++	s8 rxpo5g;		/* 5GHz RX power offset */
+ 	u8 rssisav2g;		/* 2GHz RSSI params */
+ 	u8 rssismc2g;
+ 	u8 rssismf2g;
+@@ -82,19 +91,97 @@ struct ssb_sprom {
  	u16 boardflags2_hi;	/* Board flags (bits 48-63) */
  	/* TODO store board flags in a single u64 */
  
@@ -168,10 +495,17 @@
  	/* Antenna gain values for up to 4 antennas
  	 * on each band. Values in dBm/4 (Q5.2). Negative gain means the
  	 * loss in the connectors is bigger than the gain. */
-@@ -94,6 +102,15 @@ struct ssb_sprom {
- 		} ghz5;		/* 5GHz band */
+ 	struct {
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz24;	/* 2.4GHz band */
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz5;		/* 5GHz band */
++		s8 a0, a1, a2, a3;
  	} antenna_gain;
  
+-	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
 +	struct {
 +		struct {
 +			u8 tssipos, extpa_gain, pdet_range, tr_iso, antswlut;
@@ -181,10 +515,83 @@
 +		} ghz5;
 +	} fem;
 +
- 	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
++	u16 mcs2gpo[8];
++	u16 mcs5gpo[8];
++	u16 mcs5glpo[8];
++	u16 mcs5ghpo[8];
++	u8 opo;
++
++	u8 rxgainerr2ga[3];
++	u8 rxgainerr5gla[3];
++	u8 rxgainerr5gma[3];
++	u8 rxgainerr5gha[3];
++	u8 rxgainerr5gua[3];
++
++	u8 noiselvl2ga[3];
++	u8 noiselvl5gla[3];
++	u8 noiselvl5gma[3];
++	u8 noiselvl5gha[3];
++	u8 noiselvl5gua[3];
++
++	u8 regrev;
++	u8 txchain;
++	u8 rxchain;
++	u8 antswitch;
++	u16 cddpo;
++	u16 stbcpo;
++	u16 bw40po;
++	u16 bwduppo;
++
++	u8 tempthresh;
++	u8 tempoffset;
++	u16 rawtempsense;
++	u8 measpower;
++	u8 tempsense_slope;
++	u8 tempcorrx;
++	u8 tempsense_option;
++	u8 freqoffset_corr;
++	u8 iqcal_swp_dis;
++	u8 hw_iqcal_en;
++	u8 elna2g;
++	u8 elna5g;
++	u8 phycal_tempdelta;
++	u8 temps_period;
++	u8 temps_hysteresis;
++	u8 measpower1;
++	u8 measpower2;
++	u8 pcieingress_war;
++
++	/* power per rate from sromrev 9 */
++	u16 cckbw202gpo;
++	u16 cckbw20ul2gpo;
++	u32 legofdmbw202gpo;
++	u32 legofdmbw20ul2gpo;
++	u32 legofdmbw205glpo;
++	u32 legofdmbw20ul5glpo;
++	u32 legofdmbw205gmpo;
++	u32 legofdmbw20ul5gmpo;
++	u32 legofdmbw205ghpo;
++	u32 legofdmbw20ul5ghpo;
++	u32 mcsbw202gpo;
++	u32 mcsbw20ul2gpo;
++	u32 mcsbw402gpo;
++	u32 mcsbw205glpo;
++	u32 mcsbw20ul5glpo;
++	u32 mcsbw405glpo;
++	u32 mcsbw205gmpo;
++	u32 mcsbw20ul5gmpo;
++	u32 mcsbw405gmpo;
++	u32 mcsbw205ghpo;
++	u32 mcsbw20ul5ghpo;
++	u32 mcsbw405ghpo;
++	u16 mcs32po;
++	u16 legofdm40duppo;
++	u8 sar2g;
++	u8 sar5g;
  };
  
-@@ -231,10 +248,9 @@ struct ssb_driver {
+ /* Information about the PCB the circuitry is soldered on. */
+@@ -231,10 +318,9 @@ struct ssb_driver {
  #define drv_to_ssb_drv(_drv) container_of(_drv, struct ssb_driver, drv)
  
  extern int __ssb_driver_register(struct ssb_driver *drv, struct module *owner);
@@ -198,6 +605,16 @@
  extern void ssb_driver_unregister(struct ssb_driver *drv);
  
  
+--- a/include/linux/ssb/ssb_driver_gige.h
++++ b/include/linux/ssb/ssb_driver_gige.h
+@@ -2,6 +2,7 @@
+ #define LINUX_SSB_DRIVER_GIGE_H_
+ 
+ #include <linux/ssb/ssb.h>
++#include <linux/bug.h>
+ #include <linux/pci.h>
+ #include <linux/spinlock.h>
+ 
 --- a/include/linux/ssb/ssb_regs.h
 +++ b/include/linux/ssb/ssb_regs.h
 @@ -432,6 +432,56 @@
diff --git a/target/linux/generic/patches-3.1/025-bcma_backport.patch b/target/linux/generic/patches-3.1/025-bcma_backport.patch
index 671c6ce24b..1f0b9b5126 100644
--- a/target/linux/generic/patches-3.1/025-bcma_backport.patch
+++ b/target/linux/generic/patches-3.1/025-bcma_backport.patch
@@ -1,6 +1,11 @@
 --- a/drivers/bcma/Kconfig
 +++ b/drivers/bcma/Kconfig
-@@ -33,6 +33,19 @@ config BCMA_DRIVER_PCI_HOSTMODE
+@@ -29,10 +29,23 @@ config BCMA_HOST_PCI
+ 
+ config BCMA_DRIVER_PCI_HOSTMODE
+ 	bool "Driver for PCI core working in hostmode"
+-	depends on BCMA && MIPS
++	depends on BCMA && MIPS && BCMA_HOST_PCI
  	help
  	  PCI core hostmode operation (external PCI bus).
  
@@ -34,14 +39,18 @@
  ccflags-$(CONFIG_BCMA_DEBUG)		:= -DDEBUG
 --- a/drivers/bcma/bcma_private.h
 +++ b/drivers/bcma/bcma_private.h
-@@ -15,13 +15,32 @@ struct bcma_bus;
+@@ -13,23 +13,47 @@
+ struct bcma_bus;
+ 
  /* main.c */
- int bcma_bus_register(struct bcma_bus *bus);
+-int bcma_bus_register(struct bcma_bus *bus);
++int __devinit bcma_bus_register(struct bcma_bus *bus);
  void bcma_bus_unregister(struct bcma_bus *bus);
 +int __init bcma_bus_early_register(struct bcma_bus *bus,
 +				   struct bcma_device *core_cc,
 +				   struct bcma_device *core_mips);
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus);
 +int bcma_bus_resume(struct bcma_bus *bus);
 +#endif
  
@@ -67,6 +76,19 @@
  #ifdef CONFIG_BCMA_HOST_PCI
  /* host_pci.c */
  extern int __init bcma_host_pci_init(void);
+ extern void __exit bcma_host_pci_exit(void);
+ #endif /* CONFIG_BCMA_HOST_PCI */
+ 
++/* driver_pci.c */
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address);
++
+ #ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
+-void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc);
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
+ #endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
+ 
+ #endif
 --- a/drivers/bcma/core.c
 +++ b/drivers/bcma/core.c
 @@ -110,6 +110,8 @@ EXPORT_SYMBOL_GPL(bcma_core_pll_ctl);
@@ -210,7 +232,15 @@
  
  static void bcma_pmu_pll_init(struct bcma_drv_cc *cc)
  {
-@@ -83,6 +110,24 @@ void bcma_pmu_swreg_init(struct bcma_drv
+@@ -52,6 +79,7 @@ static void bcma_pmu_resources_init(stru
+ 		min_msk = 0x200D;
+ 		max_msk = 0xFFFF;
+ 		break;
++	case 0x4331:
+ 	case 43224:
+ 	case 43225:
+ 		break;
+@@ -83,6 +111,24 @@ void bcma_pmu_swreg_init(struct bcma_drv
  	}
  }
  
@@ -235,7 +265,7 @@
  void bcma_pmu_workarounds(struct bcma_drv_cc *cc)
  {
  	struct bcma_bus *bus = cc->core->bus;
-@@ -92,7 +137,7 @@ void bcma_pmu_workarounds(struct bcma_dr
+@@ -92,7 +138,7 @@ void bcma_pmu_workarounds(struct bcma_dr
  		bcma_chipco_chipctl_maskset(cc, 0, ~0, 0x7);
  		break;
  	case 0x4331:
@@ -244,7 +274,7 @@
  		break;
  	case 43224:
  		if (bus->chipinfo.rev == 0) {
-@@ -136,3 +181,129 @@ void bcma_pmu_init(struct bcma_drv_cc *c
+@@ -136,3 +182,129 @@ void bcma_pmu_init(struct bcma_drv_cc *c
  	bcma_pmu_swreg_init(cc);
  	bcma_pmu_workarounds(cc);
  }
@@ -635,35 +665,285 @@
 +}
 --- a/drivers/bcma/driver_pci.c
 +++ b/drivers/bcma/driver_pci.c
-@@ -173,7 +173,7 @@ static bool bcma_core_pci_is_in_hostmode
- 		return false;
+@@ -2,8 +2,9 @@
+  * Broadcom specific AMBA
+  * PCI Core
+  *
+- * Copyright 2005, Broadcom Corporation
++ * Copyright 2005, 2011, Broadcom Corporation
+  * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
+  *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+@@ -15,40 +16,41 @@
+  * R/W ops.
+  **************************************************/
  
- #ifdef CONFIG_SSB_DRIVER_PCICORE
--	if (bus->sprom.boardflags_lo & SSB_PCICORE_BFL_NOPCI)
-+	if (bus->sprom.boardflags_lo & SSB_BFL_NOPCI)
- 		return false;
- #endif /* CONFIG_SSB_DRIVER_PCICORE */
+-static u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
+ {
+-	pcicore_write32(pc, 0x130, address);
+-	pcicore_read32(pc, 0x130);
+-	return pcicore_read32(pc, 0x134);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_DATA);
+ }
+ 
+ #if 0
+ static void bcma_pcie_write(struct bcma_drv_pci *pc, u32 address, u32 data)
+ {
+-	pcicore_write32(pc, 0x130, address);
+-	pcicore_read32(pc, 0x130);
+-	pcicore_write32(pc, 0x134, data);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_DATA, data);
+ }
+ #endif
+ 
+ static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u8 phy)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	u32 v;
+ 	int i;
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 28); /* Write Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	v |= (0x1F << 18);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++	v |= (BCMA_CORE_PCI_MDIODATA_BLK_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 	v |= (phy << 4);
+-	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 
+ 	udelay(10);
+ 	for (i = 0; i < 200; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
+ 			break;
+ 		msleep(1);
+ 	}
+@@ -56,79 +58,84 @@ static void bcma_pcie_mdio_set_phy(struc
+ 
+ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u8 device, u8 address)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	int max_retries = 10;
+ 	u16 ret = 0;
+ 	u32 v;
+ 	int i;
+ 
+-	v = 0x80; /* Enable Preamble Sequence */
+-	v |= 0x2; /* MDIO Clock Divisor */
+-	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
+ 
+ 	if (pc->core->id.rev >= 10) {
+ 		max_retries = 200;
+ 		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 29); /* Read Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	if (pc->core->id.rev < 10)
+-		v |= (u32)device << 22;
+-	v |= (u32)address << 18;
+-	pcicore_write32(pc, mdio_data, v);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_READ;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
++
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 	/* Wait for the device to complete the transaction */
+ 	udelay(10);
+ 	for (i = 0; i < max_retries; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */) {
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE) {
+ 			udelay(10);
+-			ret = pcicore_read32(pc, mdio_data);
++			ret = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_DATA);
+ 			break;
+ 		}
+ 		msleep(1);
+ 	}
+-	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
+ 	return ret;
+ }
  
-@@ -189,6 +189,9 @@ static bool bcma_core_pci_is_in_hostmode
+ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u8 device,
+ 				u8 address, u16 data)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	int max_retries = 10;
+ 	u32 v;
+ 	int i;
+ 
+-	v = 0x80; /* Enable Preamble Sequence */
+-	v |= 0x2; /* MDIO Clock Divisor */
+-	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
+ 
+ 	if (pc->core->id.rev >= 10) {
+ 		max_retries = 200;
+ 		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 28); /* Write Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	if (pc->core->id.rev < 10)
+-		v |= (u32)device << 22;
+-	v |= (u32)address << 18;
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 	v |= data;
+-	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 	/* Wait for the device to complete the transaction */
+ 	udelay(10);
+ 	for (i = 0; i < max_retries; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
+ 			break;
+ 		msleep(1);
+ 	}
+-	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
+ }
+ 
+ /**************************************************
+@@ -137,67 +144,53 @@ static void bcma_pcie_mdio_write(struct
+ 
+ static u8 bcma_pcicore_polarity_workaround(struct bcma_drv_pci *pc)
+ {
+-	return (bcma_pcie_read(pc, 0x204) & 0x10) ? 0xC0 : 0x80;
++	u32 tmp;
++
++	tmp = bcma_pcie_read(pc, BCMA_CORE_PCI_PLP_STATUSREG);
++	if (tmp & BCMA_CORE_PCI_PLP_POLARITYINV_STAT)
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE |
++		       BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY;
++	else
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE;
+ }
+ 
+ static void bcma_pcicore_serdes_workaround(struct bcma_drv_pci *pc)
+ {
+-	const u8 serdes_pll_device = 0x1D;
+-	const u8 serdes_rx_device = 0x1F;
+ 	u16 tmp;
+ 
+-	bcma_pcie_mdio_write(pc, serdes_rx_device, 1 /* Control */,
+-			      bcma_pcicore_polarity_workaround(pc));
+-	tmp = bcma_pcie_mdio_read(pc, serdes_pll_device, 1 /* Control */);
+-	if (tmp & 0x4000)
+-		bcma_pcie_mdio_write(pc, serdes_pll_device, 1, tmp & ~0x4000);
++	bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_RX,
++	                     BCMA_CORE_PCI_SERDES_RX_CTRL,
++			     bcma_pcicore_polarity_workaround(pc));
++	tmp = bcma_pcie_mdio_read(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++	                          BCMA_CORE_PCI_SERDES_PLL_CTRL);
++	if (tmp & BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN)
++		bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++		                     BCMA_CORE_PCI_SERDES_PLL_CTRL,
++		                     tmp & ~BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN);
+ }
+ 
+ /**************************************************
+  * Init.
+  **************************************************/
+ 
+-static void bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
++static void __devinit bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
+ {
+ 	bcma_pcicore_serdes_workaround(pc);
+ }
  
- void bcma_core_pci_init(struct bcma_drv_pci *pc)
+-static bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
++void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
  {
+-	struct bcma_bus *bus = pc->core->bus;
+-	u16 chipid_top;
+-
+-	chipid_top = (bus->chipinfo.id & 0xFF00);
+-	if (chipid_top != 0x4700 &&
+-	    chipid_top != 0x5300)
+-		return false;
+-
+-#ifdef CONFIG_SSB_DRIVER_PCICORE
+-	if (bus->sprom.boardflags_lo & SSB_PCICORE_BFL_NOPCI)
+-		return false;
+-#endif /* CONFIG_SSB_DRIVER_PCICORE */
+-
+-#if 0
+-	/* TODO: on BCMA we use address from EROM instead of magic formula */
+-	u32 tmp;
+-	return !mips_busprobe32(tmp, (bus->mmio +
+-		(pc->core->core_index * BCMA_CORE_SIZE)));
+-#endif
+-
+-	return true;
+-}
 +	if (pc->setup_done)
 +		return;
-+
- 	if (bcma_core_pci_is_in_hostmode(pc)) {
+ 
+-void bcma_core_pci_init(struct bcma_drv_pci *pc)
+-{
+-	if (bcma_core_pci_is_in_hostmode(pc)) {
  #ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	pc->hostmode = bcma_core_pci_is_in_hostmode(pc);
++	if (pc->hostmode)
  		bcma_core_pci_hostmode_init(pc);
-@@ -198,6 +201,8 @@ void bcma_core_pci_init(struct bcma_drv_
- 	} else {
- 		bcma_core_pci_clientmode_init(pc);
- 	}
+-#else
+-		pr_err("Driver compiled without support for hostmode PCI\n");
+ #endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
+-	} else {
 +
-+	pc->setup_done = true;
++	if (!pc->hostmode)
+ 		bcma_core_pci_clientmode_init(pc);
+-	}
  }
  
  int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
-@@ -205,7 +210,14 @@ int bcma_core_pci_irq_ctl(struct bcma_dr
+@@ -205,7 +198,14 @@ int bcma_core_pci_irq_ctl(struct bcma_dr
  {
  	struct pci_dev *pdev = pc->core->bus->host_pci;
  	u32 coremask, tmp;
@@ -679,6 +959,598 @@
  
  	err = pci_read_config_dword(pdev, BCMA_PCI_IRQMASK, &tmp);
  	if (err)
+--- a/drivers/bcma/driver_pci_host.c
++++ b/drivers/bcma/driver_pci_host.c
+@@ -2,13 +2,587 @@
+  * Broadcom specific AMBA
+  * PCI Core in hostmode
+  *
++ * Copyright 2005 - 2011, Broadcom Corporation
++ * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+ 
+ #include "bcma_private.h"
++#include <linux/pci.h>
+ #include <linux/bcma/bcma.h>
++#include <asm/paccess.h>
++
++/* Probe a 32bit value on the bus and catch bus exceptions.
++ * Returns nonzero on a bus exception.
++ * This is MIPS specific */
++#define mips_busprobe32(val, addr)	get_dbe((val), ((u32 *)(addr)))
++
++/* Assume one-hot slot wiring */
++#define BCMA_PCI_SLOT_MAX	16
++#define	PCI_CONFIG_SPACE_SIZE	256
++
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	u16 chipid_top;
++	u32 tmp;
++
++	chipid_top = (bus->chipinfo.id & 0xFF00);
++	if (chipid_top != 0x4700 &&
++	    chipid_top != 0x5300)
++		return false;
++
++	if (bus->sprom.boardflags_lo & BCMA_CORE_PCI_BFL_NOPCI) {
++		pr_info("This PCI core is disabled and not working\n");
++		return false;
++	}
++
++	bcma_core_enable(pc->core, 0);
++
++	return !mips_busprobe32(tmp, pc->core->io_addr);
++}
++
++static u32 bcma_pcie_read_config(struct bcma_drv_pci *pc, u32 address)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_DATA);
++}
++
++static void bcma_pcie_write_config(struct bcma_drv_pci *pc, u32 address,
++				   u32 data)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_DATA, data);
++}
++
++static u32 bcma_get_cfgspace_addr(struct bcma_drv_pci *pc, unsigned int dev,
++			     unsigned int func, unsigned int off)
++{
++	u32 addr = 0;
++
++	/* Issue config commands only when the data link is up (atleast
++	 * one external pcie device is present).
++	 */
++	if (dev >= 2 || !(bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_LSREG)
++			  & BCMA_CORE_PCI_DLLP_LSREG_LINKUP))
++		goto out;
++
++	/* Type 0 transaction */
++	/* Slide the PCI window to the appropriate slot */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++	/* Calculate the address */
++	addr = pc->host_controller->host_cfg_addr;
++	addr |= (dev << BCMA_CORE_PCI_CFG_SLOT_SHIFT);
++	addr |= (func << BCMA_CORE_PCI_CFG_FUN_SHIFT);
++	addr |= (off & ~3);
++
++out:
++	return addr;
++}
+ 
+-void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++static int bcma_extpci_read_config(struct bcma_drv_pci *pc, unsigned int dev,
++				  unsigned int func, unsigned int off,
++				  void *buf, int len)
+ {
+-	pr_err("No support for PCI core in hostmode yet\n");
++	int err = -EINVAL;
++	u32 addr, val;
++	void __iomem *mmio = 0;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* we support only two functions on device 0 */
++		if (func > 1)
++			return -EINVAL;
++
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off >= PCI_CONFIG_SPACE_SIZE) {
++			addr = (func << 12);
++			addr |= (off & 0x0FFF);
++			val = bcma_pcie_read_config(pc, addr);
++		} else {
++			addr = BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			val = pcicore_read32(pc, addr);
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++
++		val = readl(mmio);
++	}
++	val >>= (8 * (off & 3));
++
++	switch (len) {
++	case 1:
++		*((u8 *)buf) = (u8)val;
++		break;
++	case 2:
++		*((u16 *)buf) = (u16)val;
++		break;
++	case 4:
++		*((u32 *)buf) = (u32)val;
++		break;
++	}
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
++				   unsigned int func, unsigned int off,
++				   const void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr = 0, val = 0;
++	void __iomem *mmio = 0;
++	u16 chipid = pc->core->bus->chipinfo.id;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off < PCI_CONFIG_SPACE_SIZE) {
++			addr = pc->core->addr + BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			mmio = ioremap_nocache(addr, len);
++			if (!mmio)
++				goto out;
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++	}
++
++	switch (len) {
++	case 1:
++		val = readl(mmio);
++		val &= ~(0xFF << (8 * (off & 3)));
++		val |= *((const u8 *)buf) << (8 * (off & 3));
++		break;
++	case 2:
++		val = readl(mmio);
++		val &= ~(0xFFFF << (8 * (off & 3)));
++		val |= *((const u16 *)buf) << (8 * (off & 3));
++		break;
++	case 4:
++		val = *((const u32 *)buf);
++		break;
++	}
++	if (dev == 0 && !addr) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		addr = (func << 12);
++		addr |= (off & 0x0FFF);
++		bcma_pcie_write_config(pc, addr, val);
++	} else {
++		writel(val, mmio);
++
++		if (chipid == 0x4716 || chipid == 0x4748)
++			readl(mmio);
++	}
++
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_core_pci_hostmode_read_config(struct pci_bus *bus,
++					      unsigned int devfn,
++					      int reg, int size, u32 *val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_read_config(pc, PCI_SLOT(devfn),
++				     PCI_FUNC(devfn), reg, val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++static int bcma_core_pci_hostmode_write_config(struct pci_bus *bus,
++					       unsigned int devfn,
++					       int reg, int size, u32 val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_write_config(pc, PCI_SLOT(devfn),
++				      PCI_FUNC(devfn), reg, &val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++/* return cap_offset if requested capability exists in the PCI config space */
++static u8 __devinit bcma_find_pci_capability(struct bcma_drv_pci *pc,
++					     unsigned int dev,
++					     unsigned int func, u8 req_cap_id,
++					     unsigned char *buf, u32 *buflen)
++{
++	u8 cap_id;
++	u8 cap_ptr = 0;
++	u32 bufsize;
++	u8 byte_val;
++
++	/* check for Header type 0 */
++	bcma_extpci_read_config(pc, dev, func, PCI_HEADER_TYPE, &byte_val,
++				sizeof(u8));
++	if ((byte_val & 0x7f) != PCI_HEADER_TYPE_NORMAL)
++		return cap_ptr;
++
++	/* check if the capability pointer field exists */
++	bcma_extpci_read_config(pc, dev, func, PCI_STATUS, &byte_val,
++				sizeof(u8));
++	if (!(byte_val & PCI_STATUS_CAP_LIST))
++		return cap_ptr;
++
++	/* check if the capability pointer is 0x00 */
++	bcma_extpci_read_config(pc, dev, func, PCI_CAPABILITY_LIST, &cap_ptr,
++				sizeof(u8));
++	if (cap_ptr == 0x00)
++		return cap_ptr;
++
++	/* loop thr'u the capability list and see if the requested capabilty
++	 * exists */
++	bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id, sizeof(u8));
++	while (cap_id != req_cap_id) {
++		bcma_extpci_read_config(pc, dev, func, cap_ptr + 1, &cap_ptr,
++					sizeof(u8));
++		if (cap_ptr == 0x00)
++			return cap_ptr;
++		bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id,
++					sizeof(u8));
++	}
++
++	/* found the caller requested capability */
++	if ((buf != NULL) && (buflen != NULL)) {
++		u8 cap_data;
++
++		bufsize = *buflen;
++		if (!bufsize)
++			return cap_ptr;
++
++		*buflen = 0;
++
++		/* copy the cpability data excluding cap ID and next ptr */
++		cap_data = cap_ptr + 2;
++		if ((bufsize + cap_data)  > PCI_CONFIG_SPACE_SIZE)
++			bufsize = PCI_CONFIG_SPACE_SIZE - cap_data;
++		*buflen = bufsize;
++		while (bufsize--) {
++			bcma_extpci_read_config(pc, dev, func, cap_data, buf,
++						sizeof(u8));
++			cap_data++;
++			buf++;
++		}
++	}
++
++	return cap_ptr;
++}
++
++/* If the root port is capable of returning Config Request
++ * Retry Status (CRS) Completion Status to software then
++ * enable the feature.
++ */
++static void __devinit bcma_core_pci_enable_crs(struct bcma_drv_pci *pc)
++{
++	u8 cap_ptr, root_ctrl, root_cap, dev;
++	u16 val16;
++	int i;
++
++	cap_ptr = bcma_find_pci_capability(pc, 0, 0, PCI_CAP_ID_EXP, NULL,
++					   NULL);
++	root_cap = cap_ptr + PCI_EXP_RTCAP;
++	bcma_extpci_read_config(pc, 0, 0, root_cap, &val16, sizeof(u16));
++	if (val16 & BCMA_CORE_PCI_RC_CRS_VISIBILITY) {
++		/* Enable CRS software visibility */
++		root_ctrl = cap_ptr + PCI_EXP_RTCTL;
++		val16 = PCI_EXP_RTCTL_CRSSVE;
++		bcma_extpci_read_config(pc, 0, 0, root_ctrl, &val16,
++					sizeof(u16));
++
++		/* Initiate a configuration request to read the vendor id
++		 * field of the device function's config space header after
++		 * 100 ms wait time from the end of Reset. If the device is
++		 * not done with its internal initialization, it must at
++		 * least return a completion TLP, with a completion status
++		 * of "Configuration Request Retry Status (CRS)". The root
++		 * complex must complete the request to the host by returning
++		 * a read-data value of 0001h for the Vendor ID field and
++		 * all 1s for any additional bytes included in the request.
++		 * Poll using the config reads for max wait time of 1 sec or
++		 * until we receive the successful completion status. Repeat
++		 * the procedure for all the devices.
++		 */
++		for (dev = 1; dev < BCMA_PCI_SLOT_MAX; dev++) {
++			for (i = 0; i < 100000; i++) {
++				bcma_extpci_read_config(pc, dev, 0,
++							PCI_VENDOR_ID, &val16,
++							sizeof(val16));
++				if (val16 != 0x1)
++					break;
++				udelay(10);
++			}
++			if (val16 == 0x1)
++				pr_err("PCI: Broken device in slot %d\n", dev);
++		}
++	}
++}
++
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	struct bcma_drv_pci_host *pc_host;
++	u32 tmp;
++	u32 pci_membase_1G;
++	unsigned long io_map_base;
++
++	pr_info("PCIEcore in host mode found\n");
++
++	pc_host = kzalloc(sizeof(*pc_host), GFP_KERNEL);
++	if (!pc_host)  {
++		pr_err("can not allocate memory");
++		return;
++	}
++
++	pc->host_controller = pc_host;
++	pc_host->pci_controller.io_resource = &pc_host->io_resource;
++	pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
++	pc_host->pci_controller.pci_ops = &pc_host->pci_ops;
++	pc_host->pdev = pc;
++
++	pci_membase_1G = BCMA_SOC_PCI_DMA;
++	pc_host->host_cfg_addr = BCMA_SOC_PCI_CFG;
++
++	pc_host->pci_ops.read = bcma_core_pci_hostmode_read_config;
++	pc_host->pci_ops.write = bcma_core_pci_hostmode_write_config;
++
++	pc_host->mem_resource.name = "BCMA PCIcore external memory",
++	pc_host->mem_resource.start = BCMA_SOC_PCI_DMA;
++	pc_host->mem_resource.end = BCMA_SOC_PCI_DMA + BCMA_SOC_PCI_DMA_SZ - 1;
++	pc_host->mem_resource.flags = IORESOURCE_MEM | IORESOURCE_PCI_FIXED;
++
++	pc_host->io_resource.name = "BCMA PCIcore external I/O",
++	pc_host->io_resource.start = 0x100;
++	pc_host->io_resource.end = 0x7FF;
++	pc_host->io_resource.flags = IORESOURCE_IO | IORESOURCE_PCI_FIXED;
++
++	/* Reset RC */
++	udelay(3000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST_OE);
++	udelay(1000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST |
++			BCMA_CORE_PCI_CTL_RST_OE);
++
++	/* 64 MB I/O access window. On 4716, use
++	 * sbtopcie0 to access the device registers. We
++	 * can't use address match 2 (1 GB window) region
++	 * as mips can't generate 64-bit address on the
++	 * backplane.
++	 */
++	if (bus->chipinfo.id == 0x4716 || bus->chipinfo.id == 0x4748) {
++		pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++		pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++					    BCMA_SOC_PCI_MEM_SZ - 1;
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_MEM | BCMA_SOC_PCI_MEM);
++	} else if (bus->chipinfo.id == 0x5300) {
++		tmp = BCMA_CORE_PCI_SBTOPCI_MEM;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_PREF;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_BURST;
++		if (pc->core->core_unit == 0) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE_DMA_H32;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI_MEM);
++		} else if (pc->core->core_unit == 1) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI1_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI1_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE1_DMA_H32;
++			pc_host->host_cfg_addr = BCMA_SOC_PCI1_CFG;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI1_MEM);
++		}
++	} else
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_IO);
++
++	/* 64 MB configuration access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++
++	/* 1 GB memory access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI2,
++			BCMA_CORE_PCI_SBTOPCI_MEM | pci_membase_1G);
++
++
++	/* As per PCI Express Base Spec 1.1 we need to wait for
++	 * at least 100 ms from the end of a reset (cold/warm/hot)
++	 * before issuing configuration requests to PCI Express
++	 * devices.
++	 */
++	udelay(100000);
++
++	bcma_core_pci_enable_crs(pc);
++
++	/* Enable PCI bridge BAR0 memory & master access */
++	tmp = PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
++	bcma_extpci_write_config(pc, 0, 0, PCI_COMMAND, &tmp, sizeof(tmp));
++
++	/* Enable PCI interrupts */
++	pcicore_write32(pc, BCMA_CORE_PCI_IMASK, BCMA_CORE_PCI_IMASK_INTA);
++
++	/* Ok, ready to run, register it to the system.
++	 * The following needs change, if we want to port hostmode
++	 * to non-MIPS platform. */
++	io_map_base = (unsigned long)ioremap_nocache(BCMA_SOC_PCI_MEM,
++						     0x04000000);
++	pc_host->pci_controller.io_map_base = io_map_base;
++	set_io_port_base(pc_host->pci_controller.io_map_base);
++	/* Give some time to the PCI controller to configure itself with the new
++	 * values. Not waiting at this point causes crashes of the machine. */
++	mdelay(10);
++	register_pci_controller(&pc_host->pci_controller);
++	return;
++}
++
++/* Early PCI fixup for a device on the PCI-core bridge. */
++static void bcma_core_pci_fixup_pcibridge(struct pci_dev *dev)
++{
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) != 0)
++		return;
++
++	pr_info("PCI: Fixing up bridge %s\n", pci_name(dev));
++
++	/* Enable PCI bridge bus mastering and memory space */
++	pci_set_master(dev);
++	if (pcibios_enable_device(dev, ~0) < 0) {
++		pr_err("PCI: BCMA bridge enable failed\n");
++		return;
++	}
++
++	/* Enable PCI bridge BAR1 prefetch and burst */
++	pci_write_config_dword(dev, BCMA_PCI_BAR1_CONTROL, 3);
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_pcibridge);
++
++/* Early PCI fixup for all PCI-cores to set the correct memory address. */
++static void bcma_core_pci_fixup_addresses(struct pci_dev *dev)
++{
++	struct resource *res;
++	int pos;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) == 0)
++		return;
++
++	pr_info("PCI: Fixing up addresses %s\n", pci_name(dev));
++
++	for (pos = 0; pos < 6; pos++) {
++		res = &dev->resource[pos];
++		if (res->flags & (IORESOURCE_IO | IORESOURCE_MEM))
++			pci_assign_resource(dev, pos);
++	}
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_addresses);
++
++/* This function is called when doing a pci_enable_device().
++ * We must first check if the device is a device on the PCI-core bridge. */
++int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++
++	pr_info("PCI: Fixing up device %s\n", pci_name(dev));
++
++	/* Fix up interrupt lines */
++	dev->irq = bcma_core_mips_irq(pc_host->pdev->core) + 2;
++	pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
++
++	return 0;
++}
++EXPORT_SYMBOL(bcma_core_pci_plat_dev_init);
++
++/* PCI device IRQ mapping. */
++int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++	return bcma_core_mips_irq(pc_host->pdev->core) + 2;
+ }
++EXPORT_SYMBOL(bcma_core_pci_pcibios_map_irq);
 --- a/drivers/bcma/host_pci.c
 +++ b/drivers/bcma/host_pci.c
 @@ -9,6 +9,7 @@
@@ -760,54 +1632,58 @@
  	iowrite32(value, core->bus->mmio + offset);
  }
  
-@@ -223,6 +234,41 @@ static void bcma_host_pci_remove(struct
+@@ -143,8 +154,8 @@ const struct bcma_host_ops bcma_host_pci
+ 	.awrite32	= bcma_host_pci_awrite32,
+ };
+ 
+-static int bcma_host_pci_probe(struct pci_dev *dev,
+-			     const struct pci_device_id *id)
++static int __devinit bcma_host_pci_probe(struct pci_dev *dev,
++					 const struct pci_device_id *id)
+ {
+ 	struct bcma_bus *bus;
+ 	int err = -ENOMEM;
+@@ -223,6 +234,35 @@ static void bcma_host_pci_remove(struct
  	pci_set_drvdata(dev, NULL);
  }
  
 +#ifdef CONFIG_PM
-+static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
++static int bcma_host_pci_suspend(struct device *dev)
 +{
-+	/* Host specific */
-+	pci_save_state(dev);
-+	pci_disable_device(dev);
-+	pci_set_power_state(dev, pci_choose_state(dev, state));
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	return 0;
++	bus->mapped_core = NULL;
++
++	return bcma_bus_suspend(bus);
 +}
 +
-+static int bcma_host_pci_resume(struct pci_dev *dev)
++static int bcma_host_pci_resume(struct device *dev)
 +{
-+	struct bcma_bus *bus = pci_get_drvdata(dev);
-+	int err;
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
 +
-+	/* Host specific */
-+	pci_set_power_state(dev, 0);
-+	err = pci_enable_device(dev);
-+	if (err)
-+		return err;
-+	pci_restore_state(dev);
++	return bcma_bus_resume(bus);
++}
 +
-+	/* Bus specific */
-+	err = bcma_bus_resume(bus);
-+	if (err)
-+		return err;
++static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
++			 bcma_host_pci_resume);
++#define BCMA_PM_OPS	(&bcma_pm_ops)
 +
-+	return 0;
-+}
 +#else /* CONFIG_PM */
-+# define bcma_host_pci_suspend	NULL
-+# define bcma_host_pci_resume	NULL
++
++#define BCMA_PM_OPS     NULL
++
 +#endif /* CONFIG_PM */
 +
  static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
  	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) },
  	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
-@@ -238,6 +284,8 @@ static struct pci_driver bcma_pci_bridge
+@@ -238,6 +278,7 @@ static struct pci_driver bcma_pci_bridge
  	.id_table = bcma_pci_bridge_tbl,
  	.probe = bcma_host_pci_probe,
  	.remove = bcma_host_pci_remove,
-+	.suspend = bcma_host_pci_suspend,
-+	.resume = bcma_host_pci_resume,
++	.driver.pm = BCMA_PM_OPS,
  };
  
  int __init bcma_host_pci_init(void)
@@ -999,7 +1875,7 @@
 +}
 --- a/drivers/bcma/main.c
 +++ b/drivers/bcma/main.c
-@@ -6,6 +6,7 @@
+@@ -6,12 +6,19 @@
   */
  
  #include "bcma_private.h"
@@ -1007,7 +1883,33 @@
  #include <linux/bcma/bcma.h>
  #include <linux/slab.h>
  
-@@ -68,6 +69,10 @@ static struct bcma_device *bcma_find_cor
+ MODULE_DESCRIPTION("Broadcom's specific AMBA driver");
+ MODULE_LICENSE("GPL");
+ 
++/* contains the number the next bus should get. */
++static unsigned int bcma_bus_next_num = 0;
++
++/* bcma_buses_mutex locks the bcma_bus_next_num */
++static DEFINE_MUTEX(bcma_buses_mutex);
++
+ static int bcma_bus_match(struct device *dev, struct device_driver *drv);
+ static int bcma_device_probe(struct device *dev);
+ static int bcma_device_remove(struct device *dev);
+@@ -54,7 +61,7 @@ static struct bus_type bcma_bus_type = {
+ 	.dev_attrs	= bcma_device_attrs,
+ };
+ 
+-static struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
++struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
+ {
+ 	struct bcma_device *core;
+ 
+@@ -64,10 +71,15 @@ static struct bcma_device *bcma_find_cor
+ 	}
+ 	return NULL;
+ }
++EXPORT_SYMBOL_GPL(bcma_find_core);
+ 
  static void bcma_release_core_dev(struct device *dev)
  {
  	struct bcma_device *core = container_of(dev, struct bcma_device, dev);
@@ -1018,7 +1920,7 @@
  	kfree(core);
  }
  
-@@ -82,6 +87,7 @@ static int bcma_register_cores(struct bc
+@@ -82,12 +94,13 @@ static int bcma_register_cores(struct bc
  		case BCMA_CORE_CHIPCOMMON:
  		case BCMA_CORE_PCI:
  		case BCMA_CORE_PCIE:
@@ -1026,7 +1928,14 @@
  			continue;
  		}
  
-@@ -95,7 +101,10 @@ static int bcma_register_cores(struct bc
+ 		core->dev.release = bcma_release_core_dev;
+ 		core->dev.bus = &bcma_bus_type;
+-		dev_set_name(&core->dev, "bcma%d:%d", 0/*bus->num*/, dev_id);
++		dev_set_name(&core->dev, "bcma%d:%d", bus->num, dev_id);
+ 
+ 		switch (bus->hosttype) {
+ 		case BCMA_HOSTTYPE_PCI:
+@@ -95,7 +108,10 @@ static int bcma_register_cores(struct bc
  			core->dma_dev = &bus->host_pci->dev;
  			core->irq = bus->host_pci->irq;
  			break;
@@ -1038,7 +1947,24 @@
  		case BCMA_HOSTTYPE_SDIO:
  			break;
  		}
-@@ -142,6 +151,13 @@ int bcma_bus_register(struct bcma_bus *b
+@@ -123,11 +139,15 @@ static void bcma_unregister_cores(struct
+ 	}
+ }
+ 
+-int bcma_bus_register(struct bcma_bus *bus)
++int __devinit bcma_bus_register(struct bcma_bus *bus)
+ {
+ 	int err;
+ 	struct bcma_device *core;
+ 
++	mutex_lock(&bcma_buses_mutex);
++	bus->num = bcma_bus_next_num++;
++	mutex_unlock(&bcma_buses_mutex);
++
+ 	/* Scan for devices (cores) */
+ 	err = bcma_bus_scan(bus);
+ 	if (err) {
+@@ -142,6 +162,13 @@ int bcma_bus_register(struct bcma_bus *b
  		bcma_core_chipcommon_init(&bus->drv_cc);
  	}
  
@@ -1052,7 +1978,19 @@
  	/* Init PCIE core */
  	core = bcma_find_core(bus, BCMA_CORE_PCIE);
  	if (core) {
-@@ -171,6 +187,75 @@ void bcma_bus_unregister(struct bcma_bus
+@@ -153,10 +180,8 @@ int bcma_bus_register(struct bcma_bus *b
+ 	err = bcma_sprom_get(bus);
+ 	if (err == -ENOENT) {
+ 		pr_err("No SPROM available\n");
+-	} else if (err) {
++	} else if (err)
+ 		pr_err("Failed to get SPROM: %d\n", err);
+-		return -ENOENT;
+-	}
+ 
+ 	/* Register found cores */
+ 	bcma_register_cores(bus);
+@@ -171,6 +196,99 @@ void bcma_bus_unregister(struct bcma_bus
  	bcma_unregister_cores(bus);
  }
  
@@ -1110,6 +2048,21 @@
 +}
 +
 +#ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->suspend)
++				adrv->suspend(core);
++		}
++	}
++	return 0;
++}
++
 +int bcma_bus_resume(struct bcma_bus *bus)
 +{
 +	struct bcma_device *core;
@@ -1121,6 +2074,15 @@
 +		bcma_core_chipcommon_init(&bus->drv_cc);
 +	}
 +
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->resume)
++				adrv->resume(core);
++		}
++	}
++
 +	return 0;
 +}
 +#endif
@@ -1130,7 +2092,7 @@
  	drv->drv.name = drv->name;
 --- a/drivers/bcma/scan.c
 +++ b/drivers/bcma/scan.c
-@@ -200,18 +200,162 @@ static s32 bcma_erom_get_addr_desc(struc
+@@ -200,18 +200,174 @@ static s32 bcma_erom_get_addr_desc(struc
  	return addrl;
  }
  
@@ -1141,7 +2103,7 @@
 -	u32 erombase;
 -	u32 __iomem *eromptr, *eromend;
 +	struct bcma_device *core;
- 
++
 +	list_for_each_entry(core, &bus->cores, list) {
 +		if (core->core_index == index)
 +			return core;
@@ -1149,6 +2111,17 @@
 +	return NULL;
 +}
 +
++static struct bcma_device *bcma_find_core_reverse(struct bcma_bus *bus, u16 coreid)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry_reverse(core, &bus->cores, list) {
++		if (core->id.id == coreid)
++			return core;
++	}
++	return NULL;
++}
+ 
 +static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
 +			      struct bcma_device_id *match, int core_num,
 +			      struct bcma_device *core)
@@ -1291,6 +2264,7 @@
 +{
  	s32 tmp;
 -	u8 i, j;
++	struct bcma_chipinfo *chipinfo = &(bus->chipinfo);
  
 -	int err;
 +	if (bus->init_done)
@@ -1298,10 +2272,19 @@
  
  	INIT_LIST_HEAD(&bus->cores);
  	bus->nr_cores = 0;
-@@ -222,9 +366,27 @@ int bcma_bus_scan(struct bcma_bus *bus)
- 	bus->chipinfo.id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
- 	bus->chipinfo.rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
- 	bus->chipinfo.pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
+@@ -219,142 +375,133 @@ int bcma_bus_scan(struct bcma_bus *bus)
+ 	bcma_scan_switch_core(bus, BCMA_ADDR_BASE);
+ 
+ 	tmp = bcma_scan_read32(bus, 0, BCMA_CC_ID);
+-	bus->chipinfo.id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
+-	bus->chipinfo.rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
+-	bus->chipinfo.pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	chipinfo->id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
++	chipinfo->rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
++	chipinfo->pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	pr_info("Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
++		chipinfo->id, chipinfo->rev, chipinfo->pkg);
++
 +	bus->init_done = true;
 +}
 +
@@ -1327,7 +2310,12 @@
  	eromend = eromptr + BCMA_CORE_SIZE / sizeof(u32);
  
  	bcma_scan_switch_core(bus, erombase);
-@@ -236,125 +398,89 @@ int bcma_bus_scan(struct bcma_bus *bus)
+ 
+ 	while (eromptr < eromend) {
++		struct bcma_device *other_core;
+ 		struct bcma_device *core = kzalloc(sizeof(*core), GFP_KERNEL);
+ 		if (!core)
+ 			return -ENOMEM;
  		INIT_LIST_HEAD(&core->list);
  		core->bus = bus;
  
@@ -1336,7 +2324,16 @@
 -		if (cia < 0) {
 -			bcma_erom_push_ent(&eromptr);
 -			if (bcma_erom_is_end(bus, &eromptr))
--				break;
++		err = bcma_get_next_core(bus, &eromptr, NULL, core_num, core);
++		if (err < 0) {
++			kfree(core);
++			if (err == -ENODEV) {
++				core_num++;
++				continue;
++			} else if (err == -ENXIO) {
++				continue;
++			} else if (err == -ESPIPE) {
+ 				break;
 -			err= -EILSEQ;
 -			goto out;
 -		}
@@ -1344,8 +2341,10 @@
 -		if (cib < 0) {
 -			err= -EILSEQ;
 -			goto out;
--		}
--
++			}
++			return err;
+ 		}
+ 
 -		/* parse CIs */
 -		core->id.class = (cia & SCAN_CIA_CLASS) >> SCAN_CIA_CLASS_SHIFT;
 -		core->id.id = (cia & SCAN_CIA_ID) >> SCAN_CIA_ID_SHIFT;
@@ -1360,32 +2359,33 @@
 -		     (core->id.id == 0xFFF)) ||
 -		    (ports[1] == 0)) {
 -			bcma_erom_skip_component(bus, &eromptr);
-+		err = bcma_get_next_core(bus, &eromptr, NULL, core_num, core);
-+		if (err == -ENODEV) {
-+			core_num++;
- 			continue;
+-			continue;
 -		}
--
++		core->core_index = core_num++;
++		bus->nr_cores++;
++		other_core = bcma_find_core_reverse(bus, core->id.id);
++		core->core_unit = (other_core == NULL) ? 0 : other_core->core_unit + 1;
+ 
 -		/* check if component is a core at all */
 -		if (wrappers[0] + wrappers[1] == 0) {
 -			/* we could save addrl of the router
 -			if (cid == BCMA_CORE_OOB_ROUTER)
 -			 */
 -			bcma_erom_skip_component(bus, &eromptr);
-+		} else if (err == -ENXIO)
- 			continue;
+-			continue;
 -		}
-+		else if (err == -ESPIPE)
-+			break;
-+		else if (err < 0)
-+			return err;
++		pr_info("Core %d found: %s "
++			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
++			core->core_index, bcma_device_name(&core->id),
++			core->id.manuf, core->id.id, core->id.rev,
++			core->id.class);
  
 -		if (bcma_erom_is_bridge(bus, &eromptr)) {
 -			bcma_erom_skip_component(bus, &eromptr);
 -			continue;
 -		}
-+		core->core_index = core_num++;
-+		bus->nr_cores++;
++		list_add(&core->list, &bus->cores);
++	}
  
 -		/* get & parse master ports */
 -		for (i = 0; i < ports[0]; i++) {
@@ -1395,11 +2395,8 @@
 -				goto out;
 -			}
 -		}
-+		pr_info("Core %d found: %s "
-+			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
-+			core->core_index, bcma_device_name(&core->id),
-+			core->id.manuf, core->id.id, core->id.rev,
-+			core->id.class);
++	if (bus->hosttype == BCMA_HOSTTYPE_SOC)
++		iounmap(eromptr);
  
 -		/* get & parse slave ports */
 -		for (i = 0; i < ports[1]; i++) {
@@ -1417,8 +2414,8 @@
 -				}
 -			}
 -		}
-+		list_add(&core->list, &bus->cores);
-+	}
++	return 0;
++}
  
 -		/* get & parse master wrappers */
 -		for (i = 0; i < wrappers[0]; i++) {
@@ -1436,8 +2433,12 @@
 -				}
 -			}
 -		}
-+	if (bus->hosttype == BCMA_HOSTTYPE_SOC)
-+		iounmap(eromptr);
++int __init bcma_bus_scan_early(struct bcma_bus *bus,
++			       struct bcma_device_id *match,
++			       struct bcma_device *core)
++{
++	u32 erombase;
++	u32 __iomem *eromptr, *eromend;
  
 -		/* get & parse slave wrappers */
 -		for (i = 0; i < wrappers[1]; i++) {
@@ -1456,16 +2457,6 @@
 -				}
 -			}
 -		}
-+	return 0;
-+}
-+
-+int __init bcma_bus_scan_early(struct bcma_bus *bus,
-+			       struct bcma_device_id *match,
-+			       struct bcma_device *core)
-+{
-+	u32 erombase;
-+	u32 __iomem *eromptr, *eromend;
- 
 +	int err = -ENODEV;
 +	int core_num = 0;
 +
@@ -1477,7 +2468,7 @@
 +	} else {
 +		eromptr = bus->mmio;
 +	}
-+
+ 
 +	eromend = eromptr + BCMA_CORE_SIZE / sizeof(u32);
 +
 +	bcma_scan_switch_core(bus, erombase);
@@ -1524,99 +2515,344 @@
  }
 --- a/drivers/bcma/sprom.c
 +++ b/drivers/bcma/sprom.c
-@@ -129,10 +129,80 @@ static void bcma_sprom_extract_r8(struct
- 	u16 v;
- 	int i;
+@@ -2,6 +2,8 @@
+  * Broadcom specific AMBA
+  * SPROM reading
+  *
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+ 
+@@ -14,7 +16,57 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/slab.h>
  
+-#define SPOFF(offset)	((offset) / sizeof(u16))
++static int(*get_fallback_sprom)(struct bcma_bus *dev, struct ssb_sprom *out);
++
++/**
++ * bcma_arch_register_fallback_sprom - Registers a method providing a
++ * fallback SPROM if no SPROM is found.
++ *
++ * @sprom_callback: The callback function.
++ *
++ * With this function the architecture implementation may register a
++ * callback handler which fills the SPROM data structure. The fallback is
++ * used for PCI based BCMA devices, where no valid SPROM can be found
++ * in the shadow registers and to provide the SPROM for SoCs where BCMA is
++ * to controll the system bus.
++ *
++ * This function is useful for weird architectures that have a half-assed
++ * BCMA device hardwired to their PCI bus.
++ *
++ * This function is available for architecture code, only. So it is not
++ * exported.
++ */
++int bcma_arch_register_fallback_sprom(int (*sprom_callback)(struct bcma_bus *bus,
++				     struct ssb_sprom *out))
++{
++	if (get_fallback_sprom)
++		return -EEXIST;
++	get_fallback_sprom = sprom_callback;
++
++	return 0;
++}
++
++static int bcma_fill_sprom_with_fallback(struct bcma_bus *bus,
++					 struct ssb_sprom *out)
++{
++	int err;
++
++	if (!get_fallback_sprom) {
++		err = -ENOENT;
++		goto fail;
++	}
++
++	err = get_fallback_sprom(bus, out);
++	if (err)
++		goto fail;
++
++	pr_debug("Using SPROM revision %d provided by"
++		 " platform.\n", bus->sprom.revision);
++	return 0;
++fail:
++	pr_warn("Using fallback SPROM failed (err %d)\n", err);
++	return err;
++}
+ 
+ /**************************************************
+  * R/W ops.
+@@ -124,41 +176,268 @@ static int bcma_sprom_valid(const u16 *s
+  * SPROM extraction.
+  **************************************************/
+ 
++#define SPOFF(offset)	((offset) / sizeof(u16))
++
++#define SPEX(_field, _offset, _mask, _shift)	\
++	bus->sprom._field = ((sprom[SPOFF(_offset)] & (_mask)) >> (_shift))
++
+ static void bcma_sprom_extract_r8(struct bcma_bus *bus, const u16 *sprom)
+ {
+-	u16 v;
++	u16 v, o;
+ 	int i;
++	u16 pwr_info_offset[] = {
++		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
++		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
++	};
++	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
++			ARRAY_SIZE(bus->sprom.core_pwr_info));
++
 +	bus->sprom.revision = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] &
 +		SSB_SPROM_REVISION_REV;
-+
+ 
  	for (i = 0; i < 3; i++) {
  		v = sprom[SPOFF(SSB_SPROM8_IL0MAC) + i];
  		*(((__be16 *)bus->sprom.il0mac) + i) = cpu_to_be16(v);
  	}
 +
-+	bus->sprom.board_rev = sprom[SPOFF(SSB_SPROM8_BOARDREV)];
-+
-+	bus->sprom.txpid2g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G0) >> SSB_SPROM4_TXPID2G0_SHIFT;
-+	bus->sprom.txpid2g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G1) >> SSB_SPROM4_TXPID2G1_SHIFT;
-+	bus->sprom.txpid2g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G2) >> SSB_SPROM4_TXPID2G2_SHIFT;
-+	bus->sprom.txpid2g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G3) >> SSB_SPROM4_TXPID2G3_SHIFT;
-+
-+	bus->sprom.txpid5gl[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL0) >> SSB_SPROM4_TXPID5GL0_SHIFT;
-+	bus->sprom.txpid5gl[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL1) >> SSB_SPROM4_TXPID5GL1_SHIFT;
-+	bus->sprom.txpid5gl[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL2) >> SSB_SPROM4_TXPID5GL2_SHIFT;
-+	bus->sprom.txpid5gl[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL3) >> SSB_SPROM4_TXPID5GL3_SHIFT;
-+
-+	bus->sprom.txpid5g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G0) >> SSB_SPROM4_TXPID5G0_SHIFT;
-+	bus->sprom.txpid5g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G1) >> SSB_SPROM4_TXPID5G1_SHIFT;
-+	bus->sprom.txpid5g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G2) >> SSB_SPROM4_TXPID5G2_SHIFT;
-+	bus->sprom.txpid5g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G3) >> SSB_SPROM4_TXPID5G3_SHIFT;
-+
-+	bus->sprom.txpid5gh[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH0) >> SSB_SPROM4_TXPID5GH0_SHIFT;
-+	bus->sprom.txpid5gh[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH1) >> SSB_SPROM4_TXPID5GH1_SHIFT;
-+	bus->sprom.txpid5gh[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH2) >> SSB_SPROM4_TXPID5GH2_SHIFT;
-+	bus->sprom.txpid5gh[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH3) >> SSB_SPROM4_TXPID5GH3_SHIFT;
-+
-+	bus->sprom.boardflags_lo = sprom[SPOFF(SSB_SPROM8_BFLLO)];
-+	bus->sprom.boardflags_hi = sprom[SPOFF(SSB_SPROM8_BFLHI)];
-+	bus->sprom.boardflags2_lo = sprom[SPOFF(SSB_SPROM8_BFL2LO)];
-+	bus->sprom.boardflags2_hi = sprom[SPOFF(SSB_SPROM8_BFL2HI)];
-+
-+	bus->sprom.country_code = sprom[SPOFF(SSB_SPROM8_CCODE)];
-+
-+	bus->sprom.fem.ghz2.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz2.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz2.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz2.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz2.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
-+
-+	bus->sprom.fem.ghz5.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz5.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz5.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz5.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz5.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
++	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
++
++	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
++	     SSB_SPROM4_TXPID2G0_SHIFT);
++	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
++	     SSB_SPROM4_TXPID2G1_SHIFT);
++	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
++	     SSB_SPROM4_TXPID2G2_SHIFT);
++	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
++	     SSB_SPROM4_TXPID2G3_SHIFT);
++
++	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
++	     SSB_SPROM4_TXPID5GL0_SHIFT);
++	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
++	     SSB_SPROM4_TXPID5GL1_SHIFT);
++	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
++	     SSB_SPROM4_TXPID5GL2_SHIFT);
++	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
++	     SSB_SPROM4_TXPID5GL3_SHIFT);
++
++	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
++	     SSB_SPROM4_TXPID5G0_SHIFT);
++	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
++	     SSB_SPROM4_TXPID5G1_SHIFT);
++	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
++	     SSB_SPROM4_TXPID5G2_SHIFT);
++	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
++	     SSB_SPROM4_TXPID5G3_SHIFT);
++
++	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
++	     SSB_SPROM4_TXPID5GH0_SHIFT);
++	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
++	     SSB_SPROM4_TXPID5GH1_SHIFT);
++	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
++	     SSB_SPROM4_TXPID5GH2_SHIFT);
++	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
++	     SSB_SPROM4_TXPID5GH3_SHIFT);
++
++	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
++	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
++	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
++	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
++
++	SPEX(country_code, SSB_SPROM8_CCODE, ~0, 0);
++
++	/* Extract cores power info info */
++	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
++		o = pwr_info_offset[i];
++		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_MAXP, 0);
++
++		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
++
++		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GH_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
++
++		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
++	}
++
++	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++
++	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++}
++
++/*
++ * Indicates the presence of external SPROM.
++ */
++static bool bcma_sprom_ext_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 srom_control;
++	u32 present_mask;
++
++	if (bus->drv_cc.core->id.rev >= 31) {
++		if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
++			return false;
++
++		srom_control = bcma_read32(bus->drv_cc.core,
++					   BCMA_CC_SROM_CONTROL);
++		return srom_control & BCMA_CC_SROM_CONTROL_PRESENT;
++	}
++
++	/* older chipcommon revisions use chip status register */
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present_mask = BCMA_CC_CHIPST_4313_SPROM_PRESENT;
++		break;
++
++	case 0x4331:
++		present_mask = BCMA_CC_CHIPST_4331_SPROM_PRESENT;
++		break;
++
++	default:
++		return true;
++	}
++
++	return chip_status & present_mask;
++}
++
++/*
++ * Indicates that on-chip OTP memory is present and enabled.
++ */
++static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 otpsize = 0;
++	bool present;
++
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present = chip_status & BCMA_CC_CHIPST_4313_OTP_PRESENT;
++		break;
++
++	case 0x4331:
++		present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
++		break;
++
++	case 43224:
++	case 43225:
++		/* for these chips OTP is always available */
++		present = true;
++		break;
++
++	default:
++		present = false;
++		break;
++	}
++
++	if (present) {
++		otpsize = bus->drv_cc.capabilities & BCMA_CC_CAP_OTPS;
++		otpsize >>= BCMA_CC_CAP_OTPS_SHIFT;
++	}
++
++	return otpsize != 0;
++}
++
++/*
++ * Verify OTP is filled and determine the byte
++ * offset where SPROM data is located.
++ *
++ * On error, returns 0; byte offset otherwise.
++ */
++static int bcma_sprom_onchip_offset(struct bcma_bus *bus)
++{
++	struct bcma_device *cc = bus->drv_cc.core;
++	u32 offset;
++
++	/* verify OTP status */
++	if ((bcma_read32(cc, BCMA_CC_OTPS) & BCMA_CC_OTPS_GU_PROG_HW) == 0)
++		return 0;
++
++	/* obtain bit offset from otplayout register */
++	offset = (bcma_read32(cc, BCMA_CC_OTPL) & BCMA_CC_OTPL_GURGN_OFFSET);
++	return BCMA_CC_SPROM + (offset >> 3);
  }
  
  int bcma_sprom_get(struct bcma_bus *bus)
-@@ -152,6 +222,9 @@ int bcma_sprom_get(struct bcma_bus *bus)
+ {
+-	u16 offset;
++	u16 offset = BCMA_CC_SPROM;
+ 	u16 *sprom;
+ 	int err = 0;
+ 
+ 	if (!bus->drv_cc.core)
+ 		return -EOPNOTSUPP;
+ 
+-	if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
+-		return -ENOENT;
++	if (!bcma_sprom_ext_available(bus)) {
++		/*
++		 * External SPROM takes precedence so check
++		 * on-chip OTP only when no external SPROM
++		 * is present.
++		 */
++		if (bcma_sprom_onchip_available(bus)) {
++			/* determine offset */
++			offset = bcma_sprom_onchip_offset(bus);
++		}
++		if (!offset) {
++			/*
++			 * Maybe there is no SPROM on the device?
++			 * Now we ask the arch code if there is some sprom
++			 * available for this device in some other storage.
++			 */
++			err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
++			return err;
++		}
++	}
+ 
+ 	sprom = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
+ 			GFP_KERNEL);
  	if (!sprom)
  		return -ENOMEM;
  
+-	/* Most cards have SPROM moved by additional offset 0x30 (48 dwords).
+-	 * According to brcm80211 this applies to cards with PCIe rev >= 6
+-	 * TODO: understand this condition and use it */
+-	offset = (bus->chipinfo.id == 0x4331) ? BCMA_CC_SPROM :
+-		BCMA_CC_SPROM_PCIE6;
 +	if (bus->chipinfo.id == 0x4331)
 +		bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
 +
- 	/* Most cards have SPROM moved by additional offset 0x30 (48 dwords).
- 	 * According to brcm80211 this applies to cards with PCIe rev >= 6
- 	 * TODO: understand this condition and use it */
-@@ -159,6 +232,9 @@ int bcma_sprom_get(struct bcma_bus *bus)
- 		BCMA_CC_SPROM_PCIE6;
++	pr_debug("SPROM offset 0x%x\n", offset);
  	bcma_sprom_read(bus, offset, sprom);
  
 +	if (bus->chipinfo.id == 0x4331)
@@ -1646,7 +2882,7 @@
  };
  
  struct bcma_chipinfo {
-@@ -130,6 +131,7 @@ struct bcma_device {
+@@ -130,14 +131,19 @@ struct bcma_device {
  
  	struct device dev;
  	struct device *dma_dev;
@@ -1654,7 +2890,9 @@
  	unsigned int irq;
  	bool dev_registered;
  
-@@ -138,6 +140,9 @@ struct bcma_device {
+ 	u8 core_index;
++	u8 core_unit;
+ 
  	u32 addr;
  	u32 wrap;
  
@@ -1664,7 +2902,16 @@
  	void *drvdata;
  	struct list_head list;
  };
-@@ -165,10 +170,9 @@ struct bcma_driver {
+@@ -157,7 +163,7 @@ struct bcma_driver {
+ 
+ 	int (*probe)(struct bcma_device *dev);
+ 	void (*remove)(struct bcma_device *dev);
+-	int (*suspend)(struct bcma_device *dev, pm_message_t state);
++	int (*suspend)(struct bcma_device *dev);
+ 	int (*resume)(struct bcma_device *dev);
+ 	void (*shutdown)(struct bcma_device *dev);
+ 
+@@ -165,12 +171,17 @@ struct bcma_driver {
  };
  extern
  int __bcma_driver_register(struct bcma_driver *drv, struct module *owner);
@@ -1677,12 +2924,21 @@
 +
  extern void bcma_driver_unregister(struct bcma_driver *drv);
  
++/* Set a fallback SPROM.
++ * See kdoc at the function definition for complete documentation. */
++extern int bcma_arch_register_fallback_sprom(
++		int (*sprom_callback)(struct bcma_bus *bus,
++		struct ssb_sprom *out));
++
  struct bcma_bus {
-@@ -190,70 +194,93 @@ struct bcma_bus {
+ 	/* The MMIO area. */
+ 	void __iomem *mmio;
+@@ -190,71 +201,96 @@ struct bcma_bus {
  	struct bcma_device *mapped_core;
  	struct list_head cores;
  	u8 nr_cores;
 +	u8 init_done:1;
++	u8 num;
  
  	struct bcma_drv_cc drv_cc;
  	struct bcma_drv_pci drv_pci;
@@ -1787,8 +3043,10 @@
 +	bcma_write16(cc, offset, (bcma_read16(cc, offset) & mask) | set);
 +}
  
++extern struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid);
  extern bool bcma_core_is_enabled(struct bcma_device *core);
  extern void bcma_core_disable(struct bcma_device *core, u32 flags);
+ extern int bcma_core_enable(struct bcma_device *core, u32 flags);
 --- a/include/linux/bcma/bcma_driver_chipcommon.h
 +++ b/include/linux/bcma/bcma_driver_chipcommon.h
 @@ -24,6 +24,7 @@
@@ -1799,15 +3057,62 @@
  #define	  BCMA_CC_FLASHT_PARA		0x00000700	/* Parallel flash */
  #define  BCMA_CC_CAP_PLLT		0x00038000	/* PLL Type */
  #define   BCMA_PLLTYPE_NONE		0x00000000
-@@ -178,6 +179,7 @@
+@@ -55,6 +56,9 @@
+ #define	 BCMA_CC_OTPS_HW_PROTECT	0x00000001
+ #define	 BCMA_CC_OTPS_SW_PROTECT	0x00000002
+ #define	 BCMA_CC_OTPS_CID_PROTECT	0x00000004
++#define  BCMA_CC_OTPS_GU_PROG_IND	0x00000F00	/* General Use programmed indication */
++#define  BCMA_CC_OTPS_GU_PROG_IND_SHIFT	8
++#define  BCMA_CC_OTPS_GU_PROG_HW	0x00000100	/* HW region programmed */
+ #define BCMA_CC_OTPC			0x0014		/* OTP control */
+ #define	 BCMA_CC_OTPC_RECWAIT		0xFF000000
+ #define	 BCMA_CC_OTPC_PROGWAIT		0x00FFFF00
+@@ -71,6 +75,8 @@
+ #define	 BCMA_CC_OTPP_READ		0x40000000
+ #define	 BCMA_CC_OTPP_START		0x80000000
+ #define	 BCMA_CC_OTPP_BUSY		0x80000000
++#define BCMA_CC_OTPL			0x001C		/* OTP layout */
++#define  BCMA_CC_OTPL_GURGN_OFFSET	0x00000FFF	/* offset of general use region */
+ #define BCMA_CC_IRQSTAT			0x0020
+ #define BCMA_CC_IRQMASK			0x0024
+ #define	 BCMA_CC_IRQ_GPIO		0x00000001	/* gpio intr */
+@@ -78,6 +84,10 @@
+ #define	 BCMA_CC_IRQ_WDRESET		0x80000000	/* watchdog reset occurred */
+ #define BCMA_CC_CHIPCTL			0x0028		/* Rev >= 11 only */
+ #define BCMA_CC_CHIPSTAT		0x002C		/* Rev >= 11 only */
++#define  BCMA_CC_CHIPST_4313_SPROM_PRESENT	1
++#define  BCMA_CC_CHIPST_4313_OTP_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_SPROM_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_OTP_PRESENT	4
+ #define BCMA_CC_JCMD			0x0030		/* Rev >= 10 only */
+ #define  BCMA_CC_JCMD_START		0x80000000
+ #define  BCMA_CC_JCMD_BUSY		0x80000000
+@@ -178,7 +188,24 @@
  #define BCMA_CC_PROG_CFG		0x0120
  #define BCMA_CC_PROG_WAITCNT		0x0124
  #define BCMA_CC_FLASH_CFG		0x0128
 +#define  BCMA_CC_FLASH_CFG_DS		0x0010	/* Data size, 0=8bit, 1=16bit */
  #define BCMA_CC_FLASH_WAITCNT		0x012C
++#define BCMA_CC_SROM_CONTROL		0x0190
++#define  BCMA_CC_SROM_CONTROL_START	0x80000000
++#define  BCMA_CC_SROM_CONTROL_BUSY	0x80000000
++#define  BCMA_CC_SROM_CONTROL_OPCODE	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OP_READ	0x00000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRITE	0x20000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRDIS	0x40000000
++#define  BCMA_CC_SROM_CONTROL_OP_WREN	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OTPSEL	0x00000010
++#define  BCMA_CC_SROM_CONTROL_LOCK	0x00000008
++#define  BCMA_CC_SROM_CONTROL_SIZE_MASK	0x00000006
++#define  BCMA_CC_SROM_CONTROL_SIZE_1K	0x00000000
++#define  BCMA_CC_SROM_CONTROL_SIZE_4K	0x00000002
++#define  BCMA_CC_SROM_CONTROL_SIZE_16K	0x00000004
++#define  BCMA_CC_SROM_CONTROL_SIZE_SHIFT	1
++#define  BCMA_CC_SROM_CONTROL_PRESENT	0x00000001
  /* 0x1E0 is defined as shared BCMA_CLKCTLST */
  #define BCMA_CC_HW_WORKAROUND		0x01E4 /* Hardware workaround (rev >= 20) */
-@@ -201,6 +203,7 @@
+ #define BCMA_CC_UART0_DATA		0x0300
+@@ -201,6 +228,7 @@
  #define BCMA_CC_PMU_CTL			0x0600 /* PMU control */
  #define  BCMA_CC_PMU_CTL_ILP_DIV	0xFFFF0000 /* ILP div mask */
  #define  BCMA_CC_PMU_CTL_ILP_DIV_SHIFT	16
@@ -1815,10 +3120,12 @@
  #define  BCMA_CC_PMU_CTL_NOILPONW	0x00000200 /* No ILP on wait */
  #define  BCMA_CC_PMU_CTL_HTREQEN	0x00000100 /* HT req enable */
  #define  BCMA_CC_PMU_CTL_ALPREQEN	0x00000080 /* ALP req enable */
-@@ -239,6 +242,64 @@
+@@ -237,7 +265,64 @@
+ #define BCMA_CC_PLLCTL_ADDR		0x0660
+ #define BCMA_CC_PLLCTL_DATA		0x0664
  #define BCMA_CC_SPROM			0x0800 /* SPROM beginning */
- #define BCMA_CC_SPROM_PCIE6		0x0830 /* SPROM beginning on PCIe rev >= 6 */
- 
+-#define BCMA_CC_SPROM_PCIE6		0x0830 /* SPROM beginning on PCIe rev >= 6 */
++
 +/* Divider allocation in 4716/47162/5356 */
 +#define BCMA_CC_PMU5_MAINPLL_CPU	1
 +#define BCMA_CC_PMU5_MAINPLL_MEM	2
@@ -1876,11 +3183,10 @@
 +#define BCMA_CHIPCTL_4331_PCIE_PIPE_PLLDOWN	BIT(11)	/* pcie_pipe_pllpowerdown */
 +#define BCMA_CHIPCTL_4331_BT_SHD0_ON_GPIO4	BIT(16)	/* enable bt_shd0 at gpio4 */
 +#define BCMA_CHIPCTL_4331_BT_SHD1_ON_GPIO5	BIT(17)	/* enable bt_shd1 at gpio5 */
-+
+ 
  /* Data for the PMU, if available.
   * Check availability with ((struct bcma_chipcommon)->capabilities & BCMA_CC_CAP_PMU)
-  */
-@@ -247,14 +308,37 @@ struct bcma_chipcommon_pmu {
+@@ -247,14 +332,37 @@ struct bcma_chipcommon_pmu {
  	u32 crystalfreq;	/* The active crystal frequency (in kHz) */
  };
  
@@ -1918,7 +3224,7 @@
  };
  
  /* Register access */
-@@ -275,6 +359,8 @@ extern void bcma_core_chipcommon_init(st
+@@ -275,6 +383,8 @@ extern void bcma_core_chipcommon_init(st
  extern void bcma_chipco_suspend(struct bcma_drv_cc *cc);
  extern void bcma_chipco_resume(struct bcma_drv_cc *cc);
  
@@ -1927,7 +3233,7 @@
  extern void bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc,
  					  u32 ticks);
  
-@@ -293,4 +379,13 @@ u32 bcma_chipco_gpio_polarity(struct bcm
+@@ -293,4 +403,13 @@ u32 bcma_chipco_gpio_polarity(struct bcm
  /* PMU support */
  extern void bcma_pmu_init(struct bcma_drv_cc *cc);
  
@@ -1995,6 +3301,194 @@
 +extern unsigned int bcma_core_mips_irq(struct bcma_device *dev);
 +
 +#endif /* LINUX_BCMA_DRIVER_MIPS_H_ */
+--- a/include/linux/bcma/bcma_driver_pci.h
++++ b/include/linux/bcma/bcma_driver_pci.h
+@@ -53,6 +53,35 @@ struct pci_dev;
+ #define  BCMA_CORE_PCI_SBTOPCI1_MASK		0xFC000000
+ #define BCMA_CORE_PCI_SBTOPCI2			0x0108	/* Backplane to PCI translation 2 (sbtopci2) */
+ #define  BCMA_CORE_PCI_SBTOPCI2_MASK		0xC0000000
++#define BCMA_CORE_PCI_CONFIG_ADDR		0x0120	/* pcie config space access */
++#define BCMA_CORE_PCI_CONFIG_DATA		0x0124	/* pcie config space access */
++#define BCMA_CORE_PCI_MDIO_CONTROL		0x0128	/* controls the mdio access */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_MASK	0x7f	/* clock to be used on MDIO */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL	0x2
++#define  BCMA_CORE_PCI_MDIOCTL_PREAM_EN		0x80	/* Enable preamble sequnce */
++#define  BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE	0x100	/* Tranaction complete */
++#define BCMA_CORE_PCI_MDIO_DATA			0x012c	/* Data to the mdio access */
++#define  BCMA_CORE_PCI_MDIODATA_MASK		0x0000ffff /* data 2 bytes */
++#define  BCMA_CORE_PCI_MDIODATA_TA		0x00020000 /* Turnaround */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD	18	/* Regaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK_OLD	0x003c0000 /* Regaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD	22	/* Physmedia devaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK_OLD	0x0fc00000 /* Physmedia devaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF	18	/* Regaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK	0x007c0000 /* Regaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF	23	/* Physmedia devaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK	0x0f800000 /* Physmedia devaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_WRITE		0x10000000 /* write Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_READ		0x20000000 /* Read Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_START		0x40000000 /* start of Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_ADDR	0x0	/* dev address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_BLK_ADDR	0x1F	/* blk address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_PLL		0x1d	/* SERDES PLL Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_TX		0x1e	/* SERDES TX Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_RX		0x1f	/* SERDES RX Dev */
++#define BCMA_CORE_PCI_PCIEIND_ADDR		0x0130	/* indirect access to the internal register */
++#define BCMA_CORE_PCI_PCIEIND_DATA		0x0134	/* Data to/from the internal regsiter */
++#define BCMA_CORE_PCI_CLKREQENCTRL		0x0138	/*  >= rev 6, Clkreq rdma control */
+ #define BCMA_CORE_PCI_PCICFG0			0x0400	/* PCI config space 0 (rev >= 8) */
+ #define BCMA_CORE_PCI_PCICFG1			0x0500	/* PCI config space 1 (rev >= 8) */
+ #define BCMA_CORE_PCI_PCICFG2			0x0600	/* PCI config space 2 (rev >= 8) */
+@@ -72,20 +101,114 @@ struct pci_dev;
+ #define  BCMA_CORE_PCI_SBTOPCI_RC_READL		0x00000010 /* Memory read line */
+ #define  BCMA_CORE_PCI_SBTOPCI_RC_READM		0x00000020 /* Memory read multiple */
+ 
++/* PCIE protocol PHY diagnostic registers */
++#define BCMA_CORE_PCI_PLP_MODEREG		0x200	/* Mode */
++#define BCMA_CORE_PCI_PLP_STATUSREG		0x204	/* Status */
++#define  BCMA_CORE_PCI_PLP_POLARITYINV_STAT	0x10	/* Status reg PCIE_PLP_STATUSREG */
++#define BCMA_CORE_PCI_PLP_LTSSMCTRLREG		0x208	/* LTSSM control */
++#define BCMA_CORE_PCI_PLP_LTLINKNUMREG		0x20c	/* Link Training Link number */
++#define BCMA_CORE_PCI_PLP_LTLANENUMREG		0x210	/* Link Training Lane number */
++#define BCMA_CORE_PCI_PLP_LTNFTSREG		0x214	/* Link Training N_FTS */
++#define BCMA_CORE_PCI_PLP_ATTNREG		0x218	/* Attention */
++#define BCMA_CORE_PCI_PLP_ATTNMASKREG		0x21C	/* Attention Mask */
++#define BCMA_CORE_PCI_PLP_RXERRCTR		0x220	/* Rx Error */
++#define BCMA_CORE_PCI_PLP_RXFRMERRCTR		0x224	/* Rx Framing Error */
++#define BCMA_CORE_PCI_PLP_RXERRTHRESHREG	0x228	/* Rx Error threshold */
++#define BCMA_CORE_PCI_PLP_TESTCTRLREG		0x22C	/* Test Control reg */
++#define BCMA_CORE_PCI_PLP_SERDESCTRLOVRDREG	0x230	/* SERDES Control Override */
++#define BCMA_CORE_PCI_PLP_TIMINGOVRDREG		0x234	/* Timing param override */
++#define BCMA_CORE_PCI_PLP_RXTXSMDIAGREG		0x238	/* RXTX State Machine Diag */
++#define BCMA_CORE_PCI_PLP_LTSSMDIAGREG		0x23C	/* LTSSM State Machine Diag */
++
++/* PCIE protocol DLLP diagnostic registers */
++#define BCMA_CORE_PCI_DLLP_LCREG		0x100	/* Link Control */
++#define BCMA_CORE_PCI_DLLP_LSREG		0x104	/* Link Status */
++#define BCMA_CORE_PCI_DLLP_LAREG		0x108	/* Link Attention */
++#define  BCMA_CORE_PCI_DLLP_LSREG_LINKUP	(1 << 16)
++#define BCMA_CORE_PCI_DLLP_LAMASKREG		0x10C	/* Link Attention Mask */
++#define BCMA_CORE_PCI_DLLP_NEXTTXSEQNUMREG	0x110	/* Next Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_ACKEDTXSEQNUMREG	0x114	/* Acked Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_PURGEDTXSEQNUMREG	0x118	/* Purged Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_RXSEQNUMREG		0x11C	/* Rx Sequence Number */
++#define BCMA_CORE_PCI_DLLP_LRREG		0x120	/* Link Replay */
++#define BCMA_CORE_PCI_DLLP_LACKTOREG		0x124	/* Link Ack Timeout */
++#define BCMA_CORE_PCI_DLLP_PMTHRESHREG		0x128	/* Power Management Threshold */
++#define BCMA_CORE_PCI_DLLP_RTRYWPREG		0x12C	/* Retry buffer write ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYRPREG		0x130	/* Retry buffer Read ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYPPREG		0x134	/* Retry buffer Purged ptr */
++#define BCMA_CORE_PCI_DLLP_RTRRWREG		0x138	/* Retry buffer Read/Write */
++#define BCMA_CORE_PCI_DLLP_ECTHRESHREG		0x13C	/* Error Count Threshold */
++#define BCMA_CORE_PCI_DLLP_TLPERRCTRREG		0x140	/* TLP Error Counter */
++#define BCMA_CORE_PCI_DLLP_ERRCTRREG		0x144	/* Error Counter */
++#define BCMA_CORE_PCI_DLLP_NAKRXCTRREG		0x148	/* NAK Received Counter */
++#define BCMA_CORE_PCI_DLLP_TESTREG		0x14C	/* Test */
++#define BCMA_CORE_PCI_DLLP_PKTBIST		0x150	/* Packet BIST */
++#define BCMA_CORE_PCI_DLLP_PCIE11		0x154	/* DLLP PCIE 1.1 reg */
++
++/* SERDES RX registers */
++#define BCMA_CORE_PCI_SERDES_RX_CTRL		1	/* Rx cntrl */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE	0x80	/* rxpolarity_force */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY	0x40	/* rxpolarity_value */
++#define BCMA_CORE_PCI_SERDES_RX_TIMER1		2	/* Rx Timer1 */
++#define BCMA_CORE_PCI_SERDES_RX_CDR		6	/* CDR */
++#define BCMA_CORE_PCI_SERDES_RX_CDRBW		7	/* CDR BW */
++
++/* SERDES PLL registers */
++#define BCMA_CORE_PCI_SERDES_PLL_CTRL		1	/* PLL control reg */
++#define BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN	0x4000	/* bit 14 is FREQDET on */
++
+ /* PCIcore specific boardflags */
+ #define BCMA_CORE_PCI_BFL_NOPCI			0x00000400 /* Board leaves PCI floating */
+ 
++/* PCIE Config space accessing MACROS */
++#define BCMA_CORE_PCI_CFG_BUS_SHIFT		24	/* Bus shift */
++#define BCMA_CORE_PCI_CFG_SLOT_SHIFT		19	/* Slot/Device shift */
++#define BCMA_CORE_PCI_CFG_FUN_SHIFT		16	/* Function shift */
++#define BCMA_CORE_PCI_CFG_OFF_SHIFT		0	/* Register shift */
++
++#define BCMA_CORE_PCI_CFG_BUS_MASK		0xff	/* Bus mask */
++#define BCMA_CORE_PCI_CFG_SLOT_MASK		0x1f	/* Slot/Device mask */
++#define BCMA_CORE_PCI_CFG_FUN_MASK		7	/* Function mask */
++#define BCMA_CORE_PCI_CFG_OFF_MASK		0xfff	/* Register mask */
++
++/* PCIE Root Capability Register bits (Host mode only) */
++#define BCMA_CORE_PCI_RC_CRS_VISIBILITY		0x0001
++
++struct bcma_drv_pci;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++struct bcma_drv_pci_host {
++	struct bcma_drv_pci *pdev;
++
++	u32 host_cfg_addr;
++	spinlock_t cfgspace_lock;
++
++	struct pci_controller pci_controller;
++	struct pci_ops pci_ops;
++	struct resource mem_resource;
++	struct resource io_resource;
++};
++#endif
++
+ struct bcma_drv_pci {
+ 	struct bcma_device *core;
+ 	u8 setup_done:1;
++	u8 hostmode:1;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	struct bcma_drv_pci_host *host_controller;
++#endif
+ };
+ 
+ /* Register access */
+ #define pcicore_read32(pc, offset)		bcma_read32((pc)->core, offset)
+ #define pcicore_write32(pc, offset, val)	bcma_write32((pc)->core, offset, val)
+ 
+-extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
++extern void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc);
+ extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
+ 				 struct bcma_device *core, bool enable);
+ 
++extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
++extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
++
+ #endif /* LINUX_BCMA_DRIVER_PCI_H_ */
+--- a/include/linux/bcma/bcma_regs.h
++++ b/include/linux/bcma/bcma_regs.h
+@@ -56,4 +56,31 @@
+ #define  BCMA_PCI_GPIO_XTAL		0x40	/* PCI config space GPIO 14 for Xtal powerup */
+ #define  BCMA_PCI_GPIO_PLL		0x80	/* PCI config space GPIO 15 for PLL powerdown */
+ 
++/* SiliconBackplane Address Map.
++ * All regions may not exist on all chips.
++ */
++#define BCMA_SOC_SDRAM_BASE		0x00000000U	/* Physical SDRAM */
++#define BCMA_SOC_PCI_MEM		0x08000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI_MEM_SZ		(64 * 1024 * 1024)
++#define BCMA_SOC_PCI_CFG		0x0c000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_SDRAM_SWAPPED		0x10000000U	/* Byteswapped Physical SDRAM */
++#define BCMA_SOC_SDRAM_R2		0x80000000U	/* Region 2 for sdram (512 MB) */
++
++
++#define BCMA_SOC_PCI_DMA		0x40000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA2		0x80000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA_SZ		0x40000000U	/* Client Mode sb2pcitranslation2 size in bytes */
++#define BCMA_SOC_PCIE_DMA_L32		0x00000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), low 32 bits
++							 */
++#define BCMA_SOC_PCIE_DMA_H32		0x80000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
++#define BCMA_SOC_PCI1_MEM		0x40000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI1_CFG		0x44000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_PCIE1_DMA_H32		0xc0000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
+ #endif /* LINUX_BCMA_REGS_H_ */
 --- /dev/null
 +++ b/include/linux/bcma/bcma_soc.h
 @@ -0,0 +1,16 @@
diff --git a/target/linux/generic/patches-3.2/020-ssb_update.patch b/target/linux/generic/patches-3.2/020-ssb_update.patch
index 1fe1768f1a..1b38e380d4 100644
--- a/target/linux/generic/patches-3.2/020-ssb_update.patch
+++ b/target/linux/generic/patches-3.2/020-ssb_update.patch
@@ -1,6 +1,222 @@
+--- a/drivers/ssb/driver_chipcommon_pmu.c
++++ b/drivers/ssb/driver_chipcommon_pmu.c
+@@ -13,6 +13,9 @@
+ #include <linux/ssb/ssb_driver_chipcommon.h>
+ #include <linux/delay.h>
+ #include <linux/export.h>
++#ifdef CONFIG_BCM47XX
++#include <asm/mach-bcm47xx/nvram.h>
++#endif
+ 
+ #include "ssb_private.h"
+ 
+@@ -92,10 +95,6 @@ static void ssb_pmu0_pllinit_r0(struct s
+ 	u32 pmuctl, tmp, pllctl;
+ 	unsigned int i;
+ 
+-	if ((bus->chip_id == 0x5354) && !crystalfreq) {
+-		/* The 5354 crystal freq is 25MHz */
+-		crystalfreq = 25000;
+-	}
+ 	if (crystalfreq)
+ 		e = pmu0_plltab_find_entry(crystalfreq);
+ 	if (!e)
+@@ -321,7 +320,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 	u32 crystalfreq = 0; /* in kHz. 0 = keep default freq. */
+ 
+ 	if (bus->bustype == SSB_BUSTYPE_SSB) {
+-		/* TODO: The user may override the crystal frequency. */
++#ifdef CONFIG_BCM47XX
++		char buf[20];
++		if (nvram_getenv("xtalfreq", buf, sizeof(buf)) >= 0)
++			crystalfreq = simple_strtoul(buf, NULL, 0);
++#endif
+ 	}
+ 
+ 	switch (bus->chip_id) {
+@@ -330,7 +333,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 		ssb_pmu1_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4328:
++		ssb_pmu0_pllinit_r0(cc, crystalfreq);
++		break;
+ 	case 0x5354:
++		if (crystalfreq == 0)
++			crystalfreq = 25000;
+ 		ssb_pmu0_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4322:
+@@ -607,3 +614,34 @@ void ssb_pmu_set_ldo_paref(struct ssb_ch
+ 
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_voltage);
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_paref);
++
++u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		/* 5354 chip uses a non programmable PLL of frequency 240MHz */
++		return 240000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU cpu clock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
++
++u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		return 120000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU controlclock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
+--- a/drivers/ssb/driver_mipscore.c
++++ b/drivers/ssb/driver_mipscore.c
+@@ -208,6 +208,9 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 	u32 pll_type, n, m, rate = 0;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_cpu_clock(&bus->chipco);
++
+ 	if (bus->extif.dev) {
+ 		ssb_extif_get_clockcontrol(&bus->extif, &pll_type, &n, &m);
+ 	} else if (bus->chipco.dev) {
+--- a/drivers/ssb/driver_pcicore.c
++++ b/drivers/ssb/driver_pcicore.c
+@@ -75,7 +75,7 @@ static u32 get_cfgspace_addr(struct ssb_
+ 	u32 tmp;
+ 
+ 	/* We do only have one cardbus device behind the bridge. */
+-	if (pc->cardbusmode && (dev >= 1))
++	if (pc->cardbusmode && (dev > 1))
+ 		goto out;
+ 
+ 	if (bus == 0) {
+--- a/drivers/ssb/main.c
++++ b/drivers/ssb/main.c
+@@ -140,19 +140,6 @@ static void ssb_device_put(struct ssb_de
+ 		put_device(dev->dev);
+ }
+ 
+-static inline struct ssb_driver *ssb_driver_get(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		get_driver(&drv->drv);
+-	return drv;
+-}
+-
+-static inline void ssb_driver_put(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		put_driver(&drv->drv);
+-}
+-
+ static int ssb_device_resume(struct device *dev)
+ {
+ 	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
+@@ -250,11 +237,9 @@ int ssb_devices_freeze(struct ssb_bus *b
+ 			ssb_device_put(sdev);
+ 			continue;
+ 		}
+-		sdrv = ssb_driver_get(drv_to_ssb_drv(sdev->dev->driver));
+-		if (!sdrv || SSB_WARN_ON(!sdrv->remove)) {
+-			ssb_device_put(sdev);
++		sdrv = drv_to_ssb_drv(sdev->dev->driver);
++		if (SSB_WARN_ON(!sdrv->remove))
+ 			continue;
+-		}
+ 		sdrv->remove(sdev);
+ 		ctx->device_frozen[i] = 1;
+ 	}
+@@ -293,7 +278,6 @@ int ssb_devices_thaw(struct ssb_freeze_c
+ 				   dev_name(sdev->dev));
+ 			result = err;
+ 		}
+-		ssb_driver_put(sdrv);
+ 		ssb_device_put(sdev);
+ 	}
+ 
+@@ -1094,6 +1078,9 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
+ 	u32 plltype;
+ 	u32 clkctl_n, clkctl_m;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_controlclock(&bus->chipco);
++
+ 	if (ssb_extif_available(&bus->extif))
+ 		ssb_extif_get_clockcontrol(&bus->extif, &plltype,
+ 					   &clkctl_n, &clkctl_m);
 --- a/drivers/ssb/pci.c
 +++ b/drivers/ssb/pci.c
-@@ -523,7 +523,13 @@ static void sprom_extract_r45(struct ssb
+@@ -331,7 +331,6 @@ static void sprom_extract_r123(struct ss
+ {
+ 	int i;
+ 	u16 v;
+-	s8 gain;
+ 	u16 loc[3];
+ 
+ 	if (out->revision == 3)			/* rev 3 moved MAC */
+@@ -390,20 +389,12 @@ static void sprom_extract_r123(struct ss
+ 		SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_BG,
+-				    SSB_SPROM1_AGAIN_BG_SHIFT);
+-	out->antenna_gain.ghz24.a0 = gain;
+-	out->antenna_gain.ghz24.a1 = gain;
+-	out->antenna_gain.ghz24.a2 = gain;
+-	out->antenna_gain.ghz24.a3 = gain;
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_A,
+-				    SSB_SPROM1_AGAIN_A_SHIFT);
+-	out->antenna_gain.ghz5.a0 = gain;
+-	out->antenna_gain.ghz5.a1 = gain;
+-	out->antenna_gain.ghz5.a2 = gain;
+-	out->antenna_gain.ghz5.a3 = gain;
++	out->antenna_gain.a0 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_BG,
++						    SSB_SPROM1_AGAIN_BG_SHIFT);
++	out->antenna_gain.a1 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_A,
++						    SSB_SPROM1_AGAIN_A_SHIFT);
+ }
+ 
+ /* Revs 4 5 and 8 have partially shared layout */
+@@ -504,16 +495,14 @@ static void sprom_extract_r45(struct ssb
+ 	}
+ 
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN0, SSB_SPROM4_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN1, SSB_SPROM4_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN2, SSB_SPROM4_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN3, SSB_SPROM4_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
+ 
+ 	sprom_extract_r458(out, in);
+ 
+@@ -523,7 +512,13 @@ static void sprom_extract_r45(struct ssb
  static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
  {
  	int i;
@@ -15,10 +231,25 @@
  
  	/* extract the MAC address */
  	for (i = 0; i < 3; i++) {
-@@ -607,6 +613,61 @@ static void sprom_extract_r8(struct ssb_
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
+@@ -596,16 +591,69 @@ static void sprom_extract_r8(struct ssb_
+ 	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
  
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
++
 +	/* Extract cores power info info */
 +	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
 +		o = pwr_info_offset[i];
@@ -73,10 +304,74 @@
 +		SSB_SROM8_FEM_TR_ISO, SSB_SROM8_FEM_TR_ISO_SHIFT);
 +	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G,
 +		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
-+
+ 
  	sprom_extract_r458(out, in);
  
- 	/* TODO - get remaining rev 8 stuff needed */
+--- a/drivers/ssb/pcmcia.c
++++ b/drivers/ssb/pcmcia.c
+@@ -676,14 +676,10 @@ static int ssb_pcmcia_do_get_invariants(
+ 	case SSB_PCMCIA_CIS_ANTGAIN:
+ 		GOTO_ERROR_ON(tuple->TupleDataLen != 2,
+ 			"antg tpl size");
+-		sprom->antenna_gain.ghz24.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a3 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a3 = tuple->TupleData[1];
++		sprom->antenna_gain.a0 = tuple->TupleData[1];
++		sprom->antenna_gain.a1 = tuple->TupleData[1];
++		sprom->antenna_gain.a2 = tuple->TupleData[1];
++		sprom->antenna_gain.a3 = tuple->TupleData[1];
+ 		break;
+ 	case SSB_PCMCIA_CIS_BFLAGS:
+ 		GOTO_ERROR_ON((tuple->TupleDataLen != 3) &&
+--- a/drivers/ssb/scan.c
++++ b/drivers/ssb/scan.c
+@@ -318,6 +318,9 @@ int ssb_bus_scan(struct ssb_bus *bus,
+ 			bus->chip_package = 0;
+ 		}
+ 	}
++	ssb_printk(KERN_INFO PFX "Found chip with id 0x%04X, rev 0x%02X and "
++		   "package 0x%02X\n", bus->chip_id, bus->chip_rev,
++		   bus->chip_package);
+ 	if (!bus->nr_devices)
+ 		bus->nr_devices = chipid_to_nrcores(bus->chip_id);
+ 	if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
+--- a/drivers/ssb/sdio.c
++++ b/drivers/ssb/sdio.c
+@@ -551,14 +551,10 @@ int ssb_sdio_get_invariants(struct ssb_b
+ 			case SSB_SDIO_CIS_ANTGAIN:
+ 				GOTO_ERROR_ON(tuple->size != 2,
+ 					      "antg tpl size");
+-				sprom->antenna_gain.ghz24.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a3 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a3 = tuple->data[1];
++				sprom->antenna_gain.a0 = tuple->data[1];
++				sprom->antenna_gain.a1 = tuple->data[1];
++				sprom->antenna_gain.a2 = tuple->data[1];
++				sprom->antenna_gain.a3 = tuple->data[1];
+ 				break;
+ 			case SSB_SDIO_CIS_BFLAGS:
+ 				GOTO_ERROR_ON((tuple->size != 3) &&
+--- a/drivers/ssb/ssb_private.h
++++ b/drivers/ssb/ssb_private.h
+@@ -207,4 +207,8 @@ static inline void b43_pci_ssb_bridge_ex
+ }
+ #endif /* CONFIG_SSB_B43_PCI_BRIDGE */
+ 
++/* driver_chipcommon_pmu.c */
++extern u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc);
++extern u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc);
++
+ #endif /* LINUX_SSB_PRIVATE_H_ */
 --- a/include/linux/ssb/ssb.h
 +++ b/include/linux/ssb/ssb.h
 @@ -16,6 +16,12 @@ struct pcmcia_device;
@@ -86,13 +381,54 @@
 +struct ssb_sprom_core_pwr_info {
 +	u8 itssi_2g, itssi_5g;
 +	u8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh;
-+	u16 pa_2g[3], pa_5gl[3], pa_5g[3], pa_5gh[3];
++	u16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4];
 +};
 +
  struct ssb_sprom {
  	u8 revision;
  	u8 il0mac[6];		/* MAC address for 802.11b/g */
-@@ -82,6 +88,8 @@ struct ssb_sprom {
+@@ -26,9 +32,12 @@ struct ssb_sprom {
+ 	u8 et0mdcport;		/* MDIO for enet0 */
+ 	u8 et1mdcport;		/* MDIO for enet1 */
+ 	u16 board_rev;		/* Board revision number from SPROM. */
++	u16 board_num;		/* Board number from SPROM. */
++	u16 board_type;		/* Board type from SPROM. */
+ 	u8 country_code;	/* Country Code */
+-	u16 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
+-	u16 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
++	char alpha2[2];		/* Country Code as two chars like EU or US */
++	u8 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
++	u8 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
+ 	u8 ant_available_a;	/* 2GHz antenna available bits (up to 4) */
+ 	u8 ant_available_bg;	/* 5GHz antenna available bits (up to 4) */
+ 	u16 pa0b0;
+@@ -47,10 +56,10 @@ struct ssb_sprom {
+ 	u8 gpio1;		/* GPIO pin 1 */
+ 	u8 gpio2;		/* GPIO pin 2 */
+ 	u8 gpio3;		/* GPIO pin 3 */
+-	u16 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
+ 	u8 itssi_a;		/* Idle TSSI Target for A-PHY */
+ 	u8 itssi_bg;		/* Idle TSSI Target for B/G-PHY */
+ 	u8 tri2g;		/* 2.4GHz TX isolation */
+@@ -61,8 +70,8 @@ struct ssb_sprom {
+ 	u8 txpid5gl[4];		/* 4.9 - 5.1GHz TX power index */
+ 	u8 txpid5g[4];		/* 5.1 - 5.5GHz TX power index */
+ 	u8 txpid5gh[4];		/* 5.5 - ...GHz TX power index */
+-	u8 rxpo2g;		/* 2GHz RX power offset */
+-	u8 rxpo5g;		/* 5GHz RX power offset */
++	s8 rxpo2g;		/* 2GHz RX power offset */
++	s8 rxpo5g;		/* 5GHz RX power offset */
+ 	u8 rssisav2g;		/* 2GHz RSSI params */
+ 	u8 rssismc2g;
+ 	u8 rssismf2g;
+@@ -82,19 +91,97 @@ struct ssb_sprom {
  	u16 boardflags2_hi;	/* Board flags (bits 48-63) */
  	/* TODO store board flags in a single u64 */
  
@@ -101,22 +437,111 @@
  	/* Antenna gain values for up to 4 antennas
  	 * on each band. Values in dBm/4 (Q5.2). Negative gain means the
  	 * loss in the connectors is bigger than the gain. */
-@@ -94,6 +102,15 @@ struct ssb_sprom {
- 		} ghz5;		/* 5GHz band */
- 	} antenna_gain;
- 
+ 	struct {
++		s8 a0, a1, a2, a3;
++	} antenna_gain;
++
 +	struct {
-+		struct {
+ 		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz24;	/* 2.4GHz band */
 +			u8 tssipos, extpa_gain, pdet_range, tr_iso, antswlut;
 +		} ghz2;
-+		struct {
+ 		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz5;		/* 5GHz band */
+-	} antenna_gain;
 +			u8 tssipos, extpa_gain, pdet_range, tr_iso, antswlut;
 +		} ghz5;
 +	} fem;
 +
- 	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
++	u16 mcs2gpo[8];
++	u16 mcs5gpo[8];
++	u16 mcs5glpo[8];
++	u16 mcs5ghpo[8];
++	u8 opo;
++
++	u8 rxgainerr2ga[3];
++	u8 rxgainerr5gla[3];
++	u8 rxgainerr5gma[3];
++	u8 rxgainerr5gha[3];
++	u8 rxgainerr5gua[3];
++
++	u8 noiselvl2ga[3];
++	u8 noiselvl5gla[3];
++	u8 noiselvl5gma[3];
++	u8 noiselvl5gha[3];
++	u8 noiselvl5gua[3];
++
++	u8 regrev;
++	u8 txchain;
++	u8 rxchain;
++	u8 antswitch;
++	u16 cddpo;
++	u16 stbcpo;
++	u16 bw40po;
++	u16 bwduppo;
++
++	u8 tempthresh;
++	u8 tempoffset;
++	u16 rawtempsense;
++	u8 measpower;
++	u8 tempsense_slope;
++	u8 tempcorrx;
++	u8 tempsense_option;
++	u8 freqoffset_corr;
++	u8 iqcal_swp_dis;
++	u8 hw_iqcal_en;
++	u8 elna2g;
++	u8 elna5g;
++	u8 phycal_tempdelta;
++	u8 temps_period;
++	u8 temps_hysteresis;
++	u8 measpower1;
++	u8 measpower2;
++	u8 pcieingress_war;
+ 
+-	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
++	/* power per rate from sromrev 9 */
++	u16 cckbw202gpo;
++	u16 cckbw20ul2gpo;
++	u32 legofdmbw202gpo;
++	u32 legofdmbw20ul2gpo;
++	u32 legofdmbw205glpo;
++	u32 legofdmbw20ul5glpo;
++	u32 legofdmbw205gmpo;
++	u32 legofdmbw20ul5gmpo;
++	u32 legofdmbw205ghpo;
++	u32 legofdmbw20ul5ghpo;
++	u32 mcsbw202gpo;
++	u32 mcsbw20ul2gpo;
++	u32 mcsbw402gpo;
++	u32 mcsbw205glpo;
++	u32 mcsbw20ul5glpo;
++	u32 mcsbw405glpo;
++	u32 mcsbw205gmpo;
++	u32 mcsbw20ul5gmpo;
++	u32 mcsbw405gmpo;
++	u32 mcsbw205ghpo;
++	u32 mcsbw20ul5ghpo;
++	u32 mcsbw405ghpo;
++	u16 mcs32po;
++	u16 legofdm40duppo;
++	u8 sar2g;
++	u8 sar5g;
  };
  
+ /* Information about the PCB the circuitry is soldered on. */
+--- a/include/linux/ssb/ssb_driver_gige.h
++++ b/include/linux/ssb/ssb_driver_gige.h
+@@ -2,6 +2,7 @@
+ #define LINUX_SSB_DRIVER_GIGE_H_
+ 
+ #include <linux/ssb/ssb.h>
++#include <linux/bug.h>
+ #include <linux/pci.h>
+ #include <linux/spinlock.h>
+ 
 --- a/include/linux/ssb/ssb_regs.h
 +++ b/include/linux/ssb/ssb_regs.h
 @@ -432,6 +432,56 @@
@@ -184,50 +609,3 @@
  #define SSB_SPROM8_CCK2GPO		0x0140	/* CCK power offset */
  #define SSB_SPROM8_OFDM2GPO		0x0142	/* 2.4GHz OFDM power offset */
  #define SSB_SPROM8_OFDM5GPO		0x0146	/* 5.3GHz OFDM power offset */
-@@ -464,6 +515,46 @@
- 
- /* Values for boardflags_lo read from SPROM */
- #define SSB_BFL_BTCOEXIST		0x0001	/* implements Bluetooth coexistance */
-+#define SSB_BFL_PACTRL			0x0002	/* GPIO 9 controlling the PA */
-+#define SSB_BFL_AIRLINEMODE		0x0004	/* implements GPIO 13 radio disable indication */
-+#define SSB_BFL_RSSI			0x0008	/* software calculates nrssi slope. */
-+#define SSB_BFL_ENETSPI			0x0010	/* has ephy roboswitch spi */
-+#define SSB_BFL_XTAL_NOSLOW		0x0020	/* no slow clock available */
-+#define SSB_BFL_CCKHIPWR		0x0040	/* can do high power CCK transmission */
-+#define SSB_BFL_ENETADM			0x0080	/* has ADMtek switch */
-+#define SSB_BFL_ENETVLAN		0x0100	/* can do vlan */
-+#define SSB_BFL_AFTERBURNER		0x0200	/* supports Afterburner mode */
-+#define SSB_BFL_NOPCI			0x0400	/* board leaves PCI floating */
-+#define SSB_BFL_FEM			0x0800	/* supports the Front End Module */
-+#define SSB_BFL_EXTLNA			0x1000	/* has an external LNA */
-+#define SSB_BFL_HGPA			0x2000	/* had high gain PA */
-+#define SSB_BFL_BTCMOD			0x4000	/* BFL_BTCOEXIST is given in alternate GPIOs */
-+#define SSB_BFL_ALTIQ			0x8000	/* alternate I/Q settings */
-+
-+/* Values for boardflags_hi read from SPROM */
-+#define SSB_BFH_NOPA			0x0001	/* has no PA */
-+#define SSB_BFH_RSSIINV			0x0002	/* RSSI uses positive slope (not TSSI) */
-+#define SSB_BFH_PAREF			0x0004	/* uses the PARef LDO */
-+#define SSB_BFH_3TSWITCH		0x0008	/* uses a triple throw switch shared with bluetooth */
-+#define SSB_BFH_PHASESHIFT		0x0010	/* can support phase shifter */
-+#define SSB_BFH_BUCKBOOST		0x0020	/* has buck/booster */
-+#define SSB_BFH_FEM_BT			0x0040	/* has FEM and switch to share antenna with bluetooth */
-+
-+/* Values for boardflags2_lo read from SPROM */
-+#define SSB_BFL2_RXBB_INT_REG_DIS	0x0001	/* external RX BB regulator present */
-+#define SSB_BFL2_APLL_WAR		0x0002	/* alternative A-band PLL settings implemented */
-+#define SSB_BFL2_TXPWRCTRL_EN 		0x0004	/* permits enabling TX Power Control */
-+#define SSB_BFL2_2X4_DIV		0x0008	/* 2x4 diversity switch */
-+#define SSB_BFL2_5G_PWRGAIN		0x0010	/* supports 5G band power gain */
-+#define SSB_BFL2_PCIEWAR_OVR		0x0020	/* overrides ASPM and Clkreq settings */
-+#define SSB_BFL2_CAESERS_BRD		0x0040	/* is Caesers board (unused) */
-+#define SSB_BFL2_BTC3WIRE		0x0080	/* used 3-wire bluetooth coexist */
-+#define SSB_BFL2_SKWRKFEM_BRD		0x0100	/* 4321mcm93 uses Skyworks FEM */
-+#define SSB_BFL2_SPUR_WAR		0x0200	/* has a workaround for clock-harmonic spurs */
-+#define SSB_BFL2_GPLL_WAR		0x0400	/* altenative G-band PLL settings implemented */
-+
-+/* Values for boardflags_lo read from SPROM */
-+#define SSB_BFL_BTCOEXIST		0x0001	/* implements Bluetooth coexistance */
- #define SSB_BFL_PACTRL			0x0002	/* GPIO 9 controlling the PA */
- #define SSB_BFL_AIRLINEMODE		0x0004	/* implements GPIO 13 radio disable indication */
- #define SSB_BFL_RSSI			0x0008	/* software calculates nrssi slope. */
diff --git a/target/linux/generic/patches-3.2/025-bcma_backport.patch b/target/linux/generic/patches-3.2/025-bcma_backport.patch
index bc3f05573f..fdb1b8dd2b 100644
--- a/target/linux/generic/patches-3.2/025-bcma_backport.patch
+++ b/target/linux/generic/patches-3.2/025-bcma_backport.patch
@@ -1,3 +1,34 @@
+--- a/drivers/bcma/bcma_private.h
++++ b/drivers/bcma/bcma_private.h
+@@ -13,12 +13,13 @@
+ struct bcma_bus;
+ 
+ /* main.c */
+-int bcma_bus_register(struct bcma_bus *bus);
++int __devinit bcma_bus_register(struct bcma_bus *bus);
+ void bcma_bus_unregister(struct bcma_bus *bus);
+ int __init bcma_bus_early_register(struct bcma_bus *bus,
+ 				   struct bcma_device *core_cc,
+ 				   struct bcma_device *core_mips);
+ #ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus);
+ int bcma_bus_resume(struct bcma_bus *bus);
+ #endif
+ 
+@@ -47,8 +48,12 @@ extern int __init bcma_host_pci_init(voi
+ extern void __exit bcma_host_pci_exit(void);
+ #endif /* CONFIG_BCMA_HOST_PCI */
+ 
++/* driver_pci.c */
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address);
++
+ #ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
+-void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc);
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
+ #endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
+ 
+ #endif
 --- a/drivers/bcma/host_pci.c
 +++ b/drivers/bcma/host_pci.c
 @@ -21,48 +21,58 @@ static void bcma_host_pci_switch_core(st
@@ -5,10 +36,11 @@
  }
  
 -static u8 bcma_host_pci_read8(struct bcma_device *core, u16 offset)
+-{
 +/* Provides access to the requested core. Returns base offset that has to be
 + * used. It makes use of fixed windows when possible. */
 +static u16 bcma_host_pci_provide_access_to_core(struct bcma_device *core)
- {
++{
 +	switch (core->id.id) {
 +	case BCMA_CORE_CHIPCOMMON:
 +		return 3 * BCMA_CORE_SIZE;
@@ -70,102 +102,1562 @@
  	iowrite32(value, core->bus->mmio + offset);
  }
  
+@@ -144,8 +154,8 @@ const struct bcma_host_ops bcma_host_pci
+ 	.awrite32	= bcma_host_pci_awrite32,
+ };
+ 
+-static int bcma_host_pci_probe(struct pci_dev *dev,
+-			     const struct pci_device_id *id)
++static int __devinit bcma_host_pci_probe(struct pci_dev *dev,
++					 const struct pci_device_id *id)
+ {
+ 	struct bcma_bus *bus;
+ 	int err = -ENOMEM;
+@@ -225,41 +235,32 @@ static void bcma_host_pci_remove(struct
+ }
+ 
+ #ifdef CONFIG_PM
+-static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
++static int bcma_host_pci_suspend(struct device *dev)
+ {
+-	struct bcma_bus *bus = pci_get_drvdata(dev);
+-
+-	/* Host specific */
+-	pci_save_state(dev);
+-	pci_disable_device(dev);
+-	pci_set_power_state(dev, pci_choose_state(dev, state));
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
+ 
+ 	bus->mapped_core = NULL;
+-	return 0;
++
++	return bcma_bus_suspend(bus);
+ }
+ 
+-static int bcma_host_pci_resume(struct pci_dev *dev)
++static int bcma_host_pci_resume(struct device *dev)
+ {
+-	struct bcma_bus *bus = pci_get_drvdata(dev);
+-	int err;
++	struct pci_dev *pdev = to_pci_dev(dev);
++	struct bcma_bus *bus = pci_get_drvdata(pdev);
+ 
+-	/* Host specific */
+-	pci_set_power_state(dev, 0);
+-	err = pci_enable_device(dev);
+-	if (err)
+-		return err;
+-	pci_restore_state(dev);
++	return bcma_bus_resume(bus);
++}
+ 
+-	/* Bus specific */
+-	err = bcma_bus_resume(bus);
+-	if (err)
+-		return err;
++static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
++			 bcma_host_pci_resume);
++#define BCMA_PM_OPS	(&bcma_pm_ops)
+ 
+-	return 0;
+-}
+ #else /* CONFIG_PM */
+-# define bcma_host_pci_suspend	NULL
+-# define bcma_host_pci_resume	NULL
++
++#define BCMA_PM_OPS     NULL
++
+ #endif /* CONFIG_PM */
+ 
+ static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
+@@ -277,8 +278,7 @@ static struct pci_driver bcma_pci_bridge
+ 	.id_table = bcma_pci_bridge_tbl,
+ 	.probe = bcma_host_pci_probe,
+ 	.remove = bcma_host_pci_remove,
+-	.suspend = bcma_host_pci_suspend,
+-	.resume = bcma_host_pci_resume,
++	.driver.pm = BCMA_PM_OPS,
+ };
+ 
+ int __init bcma_host_pci_init(void)
+--- a/drivers/bcma/main.c
++++ b/drivers/bcma/main.c
+@@ -13,6 +13,12 @@
+ MODULE_DESCRIPTION("Broadcom's specific AMBA driver");
+ MODULE_LICENSE("GPL");
+ 
++/* contains the number the next bus should get. */
++static unsigned int bcma_bus_next_num = 0;
++
++/* bcma_buses_mutex locks the bcma_bus_next_num */
++static DEFINE_MUTEX(bcma_buses_mutex);
++
+ static int bcma_bus_match(struct device *dev, struct device_driver *drv);
+ static int bcma_device_probe(struct device *dev);
+ static int bcma_device_remove(struct device *dev);
+@@ -55,7 +61,7 @@ static struct bus_type bcma_bus_type = {
+ 	.dev_attrs	= bcma_device_attrs,
+ };
+ 
+-static struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
++struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
+ {
+ 	struct bcma_device *core;
+ 
+@@ -65,6 +71,7 @@ static struct bcma_device *bcma_find_cor
+ 	}
+ 	return NULL;
+ }
++EXPORT_SYMBOL_GPL(bcma_find_core);
+ 
+ static void bcma_release_core_dev(struct device *dev)
+ {
+@@ -93,7 +100,7 @@ static int bcma_register_cores(struct bc
+ 
+ 		core->dev.release = bcma_release_core_dev;
+ 		core->dev.bus = &bcma_bus_type;
+-		dev_set_name(&core->dev, "bcma%d:%d", 0/*bus->num*/, dev_id);
++		dev_set_name(&core->dev, "bcma%d:%d", bus->num, dev_id);
+ 
+ 		switch (bus->hosttype) {
+ 		case BCMA_HOSTTYPE_PCI:
+@@ -132,11 +139,15 @@ static void bcma_unregister_cores(struct
+ 	}
+ }
+ 
+-int bcma_bus_register(struct bcma_bus *bus)
++int __devinit bcma_bus_register(struct bcma_bus *bus)
+ {
+ 	int err;
+ 	struct bcma_device *core;
+ 
++	mutex_lock(&bcma_buses_mutex);
++	bus->num = bcma_bus_next_num++;
++	mutex_unlock(&bcma_buses_mutex);
++
+ 	/* Scan for devices (cores) */
+ 	err = bcma_bus_scan(bus);
+ 	if (err) {
+@@ -169,10 +180,8 @@ int bcma_bus_register(struct bcma_bus *b
+ 	err = bcma_sprom_get(bus);
+ 	if (err == -ENOENT) {
+ 		pr_err("No SPROM available\n");
+-	} else if (err) {
++	} else if (err)
+ 		pr_err("Failed to get SPROM: %d\n", err);
+-		return -ENOENT;
+-	}
+ 
+ 	/* Register found cores */
+ 	bcma_register_cores(bus);
+@@ -241,6 +250,21 @@ int __init bcma_bus_early_register(struc
+ }
+ 
+ #ifdef CONFIG_PM
++int bcma_bus_suspend(struct bcma_bus *bus)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->suspend)
++				adrv->suspend(core);
++		}
++	}
++	return 0;
++}
++
+ int bcma_bus_resume(struct bcma_bus *bus)
+ {
+ 	struct bcma_device *core;
+@@ -252,6 +276,15 @@ int bcma_bus_resume(struct bcma_bus *bus
+ 		bcma_core_chipcommon_init(&bus->drv_cc);
+ 	}
+ 
++	list_for_each_entry(core, &bus->cores, list) {
++		struct device_driver *drv = core->dev.driver;
++		if (drv) {
++			struct bcma_driver *adrv = container_of(drv, struct bcma_driver, drv);
++			if (adrv->resume)
++				adrv->resume(core);
++		}
++	}
++
+ 	return 0;
+ }
+ #endif
+--- a/drivers/bcma/Kconfig
++++ b/drivers/bcma/Kconfig
+@@ -29,7 +29,7 @@ config BCMA_HOST_PCI
+ 
+ config BCMA_DRIVER_PCI_HOSTMODE
+ 	bool "Driver for PCI core working in hostmode"
+-	depends on BCMA && MIPS
++	depends on BCMA && MIPS && BCMA_HOST_PCI
+ 	help
+ 	  PCI core hostmode operation (external PCI bus).
+ 
+--- a/drivers/bcma/driver_chipcommon_pmu.c
++++ b/drivers/bcma/driver_chipcommon_pmu.c
+@@ -80,6 +80,7 @@ static void bcma_pmu_resources_init(stru
+ 		min_msk = 0x200D;
+ 		max_msk = 0xFFFF;
+ 		break;
++	case 0x4331:
+ 	case 43224:
+ 	case 43225:
+ 		break;
+--- a/drivers/bcma/driver_pci.c
++++ b/drivers/bcma/driver_pci.c
+@@ -2,8 +2,9 @@
+  * Broadcom specific AMBA
+  * PCI Core
+  *
+- * Copyright 2005, Broadcom Corporation
++ * Copyright 2005, 2011, Broadcom Corporation
+  * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
+  *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+@@ -16,40 +17,41 @@
+  * R/W ops.
+  **************************************************/
+ 
+-static u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
+ {
+-	pcicore_write32(pc, 0x130, address);
+-	pcicore_read32(pc, 0x130);
+-	return pcicore_read32(pc, 0x134);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_DATA);
+ }
+ 
+ #if 0
+ static void bcma_pcie_write(struct bcma_drv_pci *pc, u32 address, u32 data)
+ {
+-	pcicore_write32(pc, 0x130, address);
+-	pcicore_read32(pc, 0x130);
+-	pcicore_write32(pc, 0x134, data);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_DATA, data);
+ }
+ #endif
+ 
+ static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u8 phy)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	u32 v;
+ 	int i;
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 28); /* Write Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	v |= (0x1F << 18);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++	v |= (BCMA_CORE_PCI_MDIODATA_BLK_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 	v |= (phy << 4);
+-	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 
+ 	udelay(10);
+ 	for (i = 0; i < 200; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
+ 			break;
+ 		msleep(1);
+ 	}
+@@ -57,79 +59,84 @@ static void bcma_pcie_mdio_set_phy(struc
+ 
+ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u8 device, u8 address)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	int max_retries = 10;
+ 	u16 ret = 0;
+ 	u32 v;
+ 	int i;
+ 
+-	v = 0x80; /* Enable Preamble Sequence */
+-	v |= 0x2; /* MDIO Clock Divisor */
+-	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
+ 
+ 	if (pc->core->id.rev >= 10) {
+ 		max_retries = 200;
+ 		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 29); /* Read Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	if (pc->core->id.rev < 10)
+-		v |= (u32)device << 22;
+-	v |= (u32)address << 18;
+-	pcicore_write32(pc, mdio_data, v);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_READ;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
++
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 	/* Wait for the device to complete the transaction */
+ 	udelay(10);
+ 	for (i = 0; i < max_retries; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */) {
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE) {
+ 			udelay(10);
+-			ret = pcicore_read32(pc, mdio_data);
++			ret = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_DATA);
+ 			break;
+ 		}
+ 		msleep(1);
+ 	}
+-	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
+ 	return ret;
+ }
+ 
+ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u8 device,
+ 				u8 address, u16 data)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	int max_retries = 10;
+ 	u32 v;
+ 	int i;
+ 
+-	v = 0x80; /* Enable Preamble Sequence */
+-	v |= 0x2; /* MDIO Clock Divisor */
+-	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
+ 
+ 	if (pc->core->id.rev >= 10) {
+ 		max_retries = 200;
+ 		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 28); /* Write Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	if (pc->core->id.rev < 10)
+-		v |= (u32)device << 22;
+-	v |= (u32)address << 18;
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 	v |= data;
+-	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 	/* Wait for the device to complete the transaction */
+ 	udelay(10);
+ 	for (i = 0; i < max_retries; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
+ 			break;
+ 		msleep(1);
+ 	}
+-	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
+ }
+ 
+ /**************************************************
+@@ -138,72 +145,53 @@ static void bcma_pcie_mdio_write(struct
+ 
+ static u8 bcma_pcicore_polarity_workaround(struct bcma_drv_pci *pc)
+ {
+-	return (bcma_pcie_read(pc, 0x204) & 0x10) ? 0xC0 : 0x80;
++	u32 tmp;
++
++	tmp = bcma_pcie_read(pc, BCMA_CORE_PCI_PLP_STATUSREG);
++	if (tmp & BCMA_CORE_PCI_PLP_POLARITYINV_STAT)
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE |
++		       BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY;
++	else
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE;
+ }
+ 
+ static void bcma_pcicore_serdes_workaround(struct bcma_drv_pci *pc)
+ {
+-	const u8 serdes_pll_device = 0x1D;
+-	const u8 serdes_rx_device = 0x1F;
+ 	u16 tmp;
+ 
+-	bcma_pcie_mdio_write(pc, serdes_rx_device, 1 /* Control */,
+-			      bcma_pcicore_polarity_workaround(pc));
+-	tmp = bcma_pcie_mdio_read(pc, serdes_pll_device, 1 /* Control */);
+-	if (tmp & 0x4000)
+-		bcma_pcie_mdio_write(pc, serdes_pll_device, 1, tmp & ~0x4000);
++	bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_RX,
++	                     BCMA_CORE_PCI_SERDES_RX_CTRL,
++			     bcma_pcicore_polarity_workaround(pc));
++	tmp = bcma_pcie_mdio_read(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++	                          BCMA_CORE_PCI_SERDES_PLL_CTRL);
++	if (tmp & BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN)
++		bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++		                     BCMA_CORE_PCI_SERDES_PLL_CTRL,
++		                     tmp & ~BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN);
+ }
+ 
+ /**************************************************
+  * Init.
+  **************************************************/
+ 
+-static void bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
++static void __devinit bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
+ {
+ 	bcma_pcicore_serdes_workaround(pc);
+ }
+ 
+-static bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
+-{
+-	struct bcma_bus *bus = pc->core->bus;
+-	u16 chipid_top;
+-
+-	chipid_top = (bus->chipinfo.id & 0xFF00);
+-	if (chipid_top != 0x4700 &&
+-	    chipid_top != 0x5300)
+-		return false;
+-
+-#ifdef CONFIG_SSB_DRIVER_PCICORE
+-	if (bus->sprom.boardflags_lo & SSB_BFL_NOPCI)
+-		return false;
+-#endif /* CONFIG_SSB_DRIVER_PCICORE */
+-
+-#if 0
+-	/* TODO: on BCMA we use address from EROM instead of magic formula */
+-	u32 tmp;
+-	return !mips_busprobe32(tmp, (bus->mmio +
+-		(pc->core->core_index * BCMA_CORE_SIZE)));
+-#endif
+-
+-	return true;
+-}
+-
+-void bcma_core_pci_init(struct bcma_drv_pci *pc)
++void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
+ {
+ 	if (pc->setup_done)
+ 		return;
+ 
+-	if (bcma_core_pci_is_in_hostmode(pc)) {
+ #ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	pc->hostmode = bcma_core_pci_is_in_hostmode(pc);
++	if (pc->hostmode)
+ 		bcma_core_pci_hostmode_init(pc);
+-#else
+-		pr_err("Driver compiled without support for hostmode PCI\n");
+ #endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
+-	} else {
+-		bcma_core_pci_clientmode_init(pc);
+-	}
+ 
+-	pc->setup_done = true;
++	if (!pc->hostmode)
++		bcma_core_pci_clientmode_init(pc);
+ }
+ 
+ int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
+--- a/drivers/bcma/driver_pci_host.c
++++ b/drivers/bcma/driver_pci_host.c
+@@ -2,13 +2,588 @@
+  * Broadcom specific AMBA
+  * PCI Core in hostmode
+  *
++ * Copyright 2005 - 2011, Broadcom Corporation
++ * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+ 
+ #include "bcma_private.h"
++#include <linux/pci.h>
++#include <linux/export.h>
+ #include <linux/bcma/bcma.h>
++#include <asm/paccess.h>
++
++/* Probe a 32bit value on the bus and catch bus exceptions.
++ * Returns nonzero on a bus exception.
++ * This is MIPS specific */
++#define mips_busprobe32(val, addr)	get_dbe((val), ((u32 *)(addr)))
++
++/* Assume one-hot slot wiring */
++#define BCMA_PCI_SLOT_MAX	16
++#define	PCI_CONFIG_SPACE_SIZE	256
++
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	u16 chipid_top;
++	u32 tmp;
++
++	chipid_top = (bus->chipinfo.id & 0xFF00);
++	if (chipid_top != 0x4700 &&
++	    chipid_top != 0x5300)
++		return false;
++
++	if (bus->sprom.boardflags_lo & BCMA_CORE_PCI_BFL_NOPCI) {
++		pr_info("This PCI core is disabled and not working\n");
++		return false;
++	}
++
++	bcma_core_enable(pc->core, 0);
++
++	return !mips_busprobe32(tmp, pc->core->io_addr);
++}
++
++static u32 bcma_pcie_read_config(struct bcma_drv_pci *pc, u32 address)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_DATA);
++}
++
++static void bcma_pcie_write_config(struct bcma_drv_pci *pc, u32 address,
++				   u32 data)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_DATA, data);
++}
++
++static u32 bcma_get_cfgspace_addr(struct bcma_drv_pci *pc, unsigned int dev,
++			     unsigned int func, unsigned int off)
++{
++	u32 addr = 0;
++
++	/* Issue config commands only when the data link is up (atleast
++	 * one external pcie device is present).
++	 */
++	if (dev >= 2 || !(bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_LSREG)
++			  & BCMA_CORE_PCI_DLLP_LSREG_LINKUP))
++		goto out;
++
++	/* Type 0 transaction */
++	/* Slide the PCI window to the appropriate slot */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++	/* Calculate the address */
++	addr = pc->host_controller->host_cfg_addr;
++	addr |= (dev << BCMA_CORE_PCI_CFG_SLOT_SHIFT);
++	addr |= (func << BCMA_CORE_PCI_CFG_FUN_SHIFT);
++	addr |= (off & ~3);
++
++out:
++	return addr;
++}
+ 
+-void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++static int bcma_extpci_read_config(struct bcma_drv_pci *pc, unsigned int dev,
++				  unsigned int func, unsigned int off,
++				  void *buf, int len)
+ {
+-	pr_err("No support for PCI core in hostmode yet\n");
++	int err = -EINVAL;
++	u32 addr, val;
++	void __iomem *mmio = 0;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* we support only two functions on device 0 */
++		if (func > 1)
++			return -EINVAL;
++
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off >= PCI_CONFIG_SPACE_SIZE) {
++			addr = (func << 12);
++			addr |= (off & 0x0FFF);
++			val = bcma_pcie_read_config(pc, addr);
++		} else {
++			addr = BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			val = pcicore_read32(pc, addr);
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++
++		val = readl(mmio);
++	}
++	val >>= (8 * (off & 3));
++
++	switch (len) {
++	case 1:
++		*((u8 *)buf) = (u8)val;
++		break;
++	case 2:
++		*((u16 *)buf) = (u16)val;
++		break;
++	case 4:
++		*((u32 *)buf) = (u32)val;
++		break;
++	}
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
++				   unsigned int func, unsigned int off,
++				   const void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr = 0, val = 0;
++	void __iomem *mmio = 0;
++	u16 chipid = pc->core->bus->chipinfo.id;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off < PCI_CONFIG_SPACE_SIZE) {
++			addr = pc->core->addr + BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			mmio = ioremap_nocache(addr, len);
++			if (!mmio)
++				goto out;
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++	}
++
++	switch (len) {
++	case 1:
++		val = readl(mmio);
++		val &= ~(0xFF << (8 * (off & 3)));
++		val |= *((const u8 *)buf) << (8 * (off & 3));
++		break;
++	case 2:
++		val = readl(mmio);
++		val &= ~(0xFFFF << (8 * (off & 3)));
++		val |= *((const u16 *)buf) << (8 * (off & 3));
++		break;
++	case 4:
++		val = *((const u32 *)buf);
++		break;
++	}
++	if (dev == 0 && !addr) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		addr = (func << 12);
++		addr |= (off & 0x0FFF);
++		bcma_pcie_write_config(pc, addr, val);
++	} else {
++		writel(val, mmio);
++
++		if (chipid == 0x4716 || chipid == 0x4748)
++			readl(mmio);
++	}
++
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_core_pci_hostmode_read_config(struct pci_bus *bus,
++					      unsigned int devfn,
++					      int reg, int size, u32 *val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_read_config(pc, PCI_SLOT(devfn),
++				     PCI_FUNC(devfn), reg, val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++static int bcma_core_pci_hostmode_write_config(struct pci_bus *bus,
++					       unsigned int devfn,
++					       int reg, int size, u32 val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_write_config(pc, PCI_SLOT(devfn),
++				      PCI_FUNC(devfn), reg, &val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++/* return cap_offset if requested capability exists in the PCI config space */
++static u8 __devinit bcma_find_pci_capability(struct bcma_drv_pci *pc,
++					     unsigned int dev,
++					     unsigned int func, u8 req_cap_id,
++					     unsigned char *buf, u32 *buflen)
++{
++	u8 cap_id;
++	u8 cap_ptr = 0;
++	u32 bufsize;
++	u8 byte_val;
++
++	/* check for Header type 0 */
++	bcma_extpci_read_config(pc, dev, func, PCI_HEADER_TYPE, &byte_val,
++				sizeof(u8));
++	if ((byte_val & 0x7f) != PCI_HEADER_TYPE_NORMAL)
++		return cap_ptr;
++
++	/* check if the capability pointer field exists */
++	bcma_extpci_read_config(pc, dev, func, PCI_STATUS, &byte_val,
++				sizeof(u8));
++	if (!(byte_val & PCI_STATUS_CAP_LIST))
++		return cap_ptr;
++
++	/* check if the capability pointer is 0x00 */
++	bcma_extpci_read_config(pc, dev, func, PCI_CAPABILITY_LIST, &cap_ptr,
++				sizeof(u8));
++	if (cap_ptr == 0x00)
++		return cap_ptr;
++
++	/* loop thr'u the capability list and see if the requested capabilty
++	 * exists */
++	bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id, sizeof(u8));
++	while (cap_id != req_cap_id) {
++		bcma_extpci_read_config(pc, dev, func, cap_ptr + 1, &cap_ptr,
++					sizeof(u8));
++		if (cap_ptr == 0x00)
++			return cap_ptr;
++		bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id,
++					sizeof(u8));
++	}
++
++	/* found the caller requested capability */
++	if ((buf != NULL) && (buflen != NULL)) {
++		u8 cap_data;
++
++		bufsize = *buflen;
++		if (!bufsize)
++			return cap_ptr;
++
++		*buflen = 0;
++
++		/* copy the cpability data excluding cap ID and next ptr */
++		cap_data = cap_ptr + 2;
++		if ((bufsize + cap_data)  > PCI_CONFIG_SPACE_SIZE)
++			bufsize = PCI_CONFIG_SPACE_SIZE - cap_data;
++		*buflen = bufsize;
++		while (bufsize--) {
++			bcma_extpci_read_config(pc, dev, func, cap_data, buf,
++						sizeof(u8));
++			cap_data++;
++			buf++;
++		}
++	}
++
++	return cap_ptr;
++}
++
++/* If the root port is capable of returning Config Request
++ * Retry Status (CRS) Completion Status to software then
++ * enable the feature.
++ */
++static void __devinit bcma_core_pci_enable_crs(struct bcma_drv_pci *pc)
++{
++	u8 cap_ptr, root_ctrl, root_cap, dev;
++	u16 val16;
++	int i;
++
++	cap_ptr = bcma_find_pci_capability(pc, 0, 0, PCI_CAP_ID_EXP, NULL,
++					   NULL);
++	root_cap = cap_ptr + PCI_EXP_RTCAP;
++	bcma_extpci_read_config(pc, 0, 0, root_cap, &val16, sizeof(u16));
++	if (val16 & BCMA_CORE_PCI_RC_CRS_VISIBILITY) {
++		/* Enable CRS software visibility */
++		root_ctrl = cap_ptr + PCI_EXP_RTCTL;
++		val16 = PCI_EXP_RTCTL_CRSSVE;
++		bcma_extpci_read_config(pc, 0, 0, root_ctrl, &val16,
++					sizeof(u16));
++
++		/* Initiate a configuration request to read the vendor id
++		 * field of the device function's config space header after
++		 * 100 ms wait time from the end of Reset. If the device is
++		 * not done with its internal initialization, it must at
++		 * least return a completion TLP, with a completion status
++		 * of "Configuration Request Retry Status (CRS)". The root
++		 * complex must complete the request to the host by returning
++		 * a read-data value of 0001h for the Vendor ID field and
++		 * all 1s for any additional bytes included in the request.
++		 * Poll using the config reads for max wait time of 1 sec or
++		 * until we receive the successful completion status. Repeat
++		 * the procedure for all the devices.
++		 */
++		for (dev = 1; dev < BCMA_PCI_SLOT_MAX; dev++) {
++			for (i = 0; i < 100000; i++) {
++				bcma_extpci_read_config(pc, dev, 0,
++							PCI_VENDOR_ID, &val16,
++							sizeof(val16));
++				if (val16 != 0x1)
++					break;
++				udelay(10);
++			}
++			if (val16 == 0x1)
++				pr_err("PCI: Broken device in slot %d\n", dev);
++		}
++	}
++}
++
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	struct bcma_drv_pci_host *pc_host;
++	u32 tmp;
++	u32 pci_membase_1G;
++	unsigned long io_map_base;
++
++	pr_info("PCIEcore in host mode found\n");
++
++	pc_host = kzalloc(sizeof(*pc_host), GFP_KERNEL);
++	if (!pc_host)  {
++		pr_err("can not allocate memory");
++		return;
++	}
++
++	pc->host_controller = pc_host;
++	pc_host->pci_controller.io_resource = &pc_host->io_resource;
++	pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
++	pc_host->pci_controller.pci_ops = &pc_host->pci_ops;
++	pc_host->pdev = pc;
++
++	pci_membase_1G = BCMA_SOC_PCI_DMA;
++	pc_host->host_cfg_addr = BCMA_SOC_PCI_CFG;
++
++	pc_host->pci_ops.read = bcma_core_pci_hostmode_read_config;
++	pc_host->pci_ops.write = bcma_core_pci_hostmode_write_config;
++
++	pc_host->mem_resource.name = "BCMA PCIcore external memory",
++	pc_host->mem_resource.start = BCMA_SOC_PCI_DMA;
++	pc_host->mem_resource.end = BCMA_SOC_PCI_DMA + BCMA_SOC_PCI_DMA_SZ - 1;
++	pc_host->mem_resource.flags = IORESOURCE_MEM | IORESOURCE_PCI_FIXED;
++
++	pc_host->io_resource.name = "BCMA PCIcore external I/O",
++	pc_host->io_resource.start = 0x100;
++	pc_host->io_resource.end = 0x7FF;
++	pc_host->io_resource.flags = IORESOURCE_IO | IORESOURCE_PCI_FIXED;
++
++	/* Reset RC */
++	udelay(3000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST_OE);
++	udelay(1000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST |
++			BCMA_CORE_PCI_CTL_RST_OE);
++
++	/* 64 MB I/O access window. On 4716, use
++	 * sbtopcie0 to access the device registers. We
++	 * can't use address match 2 (1 GB window) region
++	 * as mips can't generate 64-bit address on the
++	 * backplane.
++	 */
++	if (bus->chipinfo.id == 0x4716 || bus->chipinfo.id == 0x4748) {
++		pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++		pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++					    BCMA_SOC_PCI_MEM_SZ - 1;
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_MEM | BCMA_SOC_PCI_MEM);
++	} else if (bus->chipinfo.id == 0x5300) {
++		tmp = BCMA_CORE_PCI_SBTOPCI_MEM;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_PREF;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_BURST;
++		if (pc->core->core_unit == 0) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE_DMA_H32;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI_MEM);
++		} else if (pc->core->core_unit == 1) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI1_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI1_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE1_DMA_H32;
++			pc_host->host_cfg_addr = BCMA_SOC_PCI1_CFG;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI1_MEM);
++		}
++	} else
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_IO);
++
++	/* 64 MB configuration access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++
++	/* 1 GB memory access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI2,
++			BCMA_CORE_PCI_SBTOPCI_MEM | pci_membase_1G);
++
++
++	/* As per PCI Express Base Spec 1.1 we need to wait for
++	 * at least 100 ms from the end of a reset (cold/warm/hot)
++	 * before issuing configuration requests to PCI Express
++	 * devices.
++	 */
++	udelay(100000);
++
++	bcma_core_pci_enable_crs(pc);
++
++	/* Enable PCI bridge BAR0 memory & master access */
++	tmp = PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
++	bcma_extpci_write_config(pc, 0, 0, PCI_COMMAND, &tmp, sizeof(tmp));
++
++	/* Enable PCI interrupts */
++	pcicore_write32(pc, BCMA_CORE_PCI_IMASK, BCMA_CORE_PCI_IMASK_INTA);
++
++	/* Ok, ready to run, register it to the system.
++	 * The following needs change, if we want to port hostmode
++	 * to non-MIPS platform. */
++	io_map_base = (unsigned long)ioremap_nocache(BCMA_SOC_PCI_MEM,
++						     0x04000000);
++	pc_host->pci_controller.io_map_base = io_map_base;
++	set_io_port_base(pc_host->pci_controller.io_map_base);
++	/* Give some time to the PCI controller to configure itself with the new
++	 * values. Not waiting at this point causes crashes of the machine. */
++	mdelay(10);
++	register_pci_controller(&pc_host->pci_controller);
++	return;
++}
++
++/* Early PCI fixup for a device on the PCI-core bridge. */
++static void bcma_core_pci_fixup_pcibridge(struct pci_dev *dev)
++{
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) != 0)
++		return;
++
++	pr_info("PCI: Fixing up bridge %s\n", pci_name(dev));
++
++	/* Enable PCI bridge bus mastering and memory space */
++	pci_set_master(dev);
++	if (pcibios_enable_device(dev, ~0) < 0) {
++		pr_err("PCI: BCMA bridge enable failed\n");
++		return;
++	}
++
++	/* Enable PCI bridge BAR1 prefetch and burst */
++	pci_write_config_dword(dev, BCMA_PCI_BAR1_CONTROL, 3);
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_pcibridge);
++
++/* Early PCI fixup for all PCI-cores to set the correct memory address. */
++static void bcma_core_pci_fixup_addresses(struct pci_dev *dev)
++{
++	struct resource *res;
++	int pos;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) == 0)
++		return;
++
++	pr_info("PCI: Fixing up addresses %s\n", pci_name(dev));
++
++	for (pos = 0; pos < 6; pos++) {
++		res = &dev->resource[pos];
++		if (res->flags & (IORESOURCE_IO | IORESOURCE_MEM))
++			pci_assign_resource(dev, pos);
++	}
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_addresses);
++
++/* This function is called when doing a pci_enable_device().
++ * We must first check if the device is a device on the PCI-core bridge. */
++int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++
++	pr_info("PCI: Fixing up device %s\n", pci_name(dev));
++
++	/* Fix up interrupt lines */
++	dev->irq = bcma_core_mips_irq(pc_host->pdev->core) + 2;
++	pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
++
++	return 0;
++}
++EXPORT_SYMBOL(bcma_core_pci_plat_dev_init);
++
++/* PCI device IRQ mapping. */
++int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++	return bcma_core_mips_irq(pc_host->pdev->core) + 2;
+ }
++EXPORT_SYMBOL(bcma_core_pci_pcibios_map_irq);
+--- a/drivers/bcma/scan.c
++++ b/drivers/bcma/scan.c
+@@ -212,6 +212,17 @@ static struct bcma_device *bcma_find_cor
+ 	return NULL;
+ }
+ 
++static struct bcma_device *bcma_find_core_reverse(struct bcma_bus *bus, u16 coreid)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry_reverse(core, &bus->cores, list) {
++		if (core->id.id == coreid)
++			return core;
++	}
++	return NULL;
++}
++
+ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
+ 			      struct bcma_device_id *match, int core_num,
+ 			      struct bcma_device *core)
+@@ -353,6 +364,7 @@ static int bcma_get_next_core(struct bcm
+ void bcma_init_bus(struct bcma_bus *bus)
+ {
+ 	s32 tmp;
++	struct bcma_chipinfo *chipinfo = &(bus->chipinfo);
+ 
+ 	if (bus->init_done)
+ 		return;
+@@ -363,9 +375,12 @@ void bcma_init_bus(struct bcma_bus *bus)
+ 	bcma_scan_switch_core(bus, BCMA_ADDR_BASE);
+ 
+ 	tmp = bcma_scan_read32(bus, 0, BCMA_CC_ID);
+-	bus->chipinfo.id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
+-	bus->chipinfo.rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
+-	bus->chipinfo.pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	chipinfo->id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
++	chipinfo->rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
++	chipinfo->pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	pr_info("Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
++		chipinfo->id, chipinfo->rev, chipinfo->pkg);
++
+ 	bus->init_done = true;
+ }
+ 
+@@ -392,6 +407,7 @@ int bcma_bus_scan(struct bcma_bus *bus)
+ 	bcma_scan_switch_core(bus, erombase);
+ 
+ 	while (eromptr < eromend) {
++		struct bcma_device *other_core;
+ 		struct bcma_device *core = kzalloc(sizeof(*core), GFP_KERNEL);
+ 		if (!core)
+ 			return -ENOMEM;
+@@ -399,18 +415,23 @@ int bcma_bus_scan(struct bcma_bus *bus)
+ 		core->bus = bus;
+ 
+ 		err = bcma_get_next_core(bus, &eromptr, NULL, core_num, core);
+-		if (err == -ENODEV) {
+-			core_num++;
+-			continue;
+-		} else if (err == -ENXIO)
+-			continue;
+-		else if (err == -ESPIPE)
+-			break;
+-		else if (err < 0)
++		if (err < 0) {
++			kfree(core);
++			if (err == -ENODEV) {
++				core_num++;
++				continue;
++			} else if (err == -ENXIO) {
++				continue;
++			} else if (err == -ESPIPE) {
++				break;
++			}
+ 			return err;
++		}
+ 
+ 		core->core_index = core_num++;
+ 		bus->nr_cores++;
++		other_core = bcma_find_core_reverse(bus, core->id.id);
++		core->core_unit = (other_core == NULL) ? 0 : other_core->core_unit + 1;
+ 
+ 		pr_info("Core %d found: %s "
+ 			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
 --- a/drivers/bcma/sprom.c
 +++ b/drivers/bcma/sprom.c
-@@ -129,6 +129,9 @@ static void bcma_sprom_extract_r8(struct
- 	u16 v;
- 	int i;
+@@ -2,6 +2,8 @@
+  * Broadcom specific AMBA
+  * SPROM reading
+  *
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+ 
+@@ -14,7 +16,57 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/slab.h>
  
+-#define SPOFF(offset)	((offset) / sizeof(u16))
++static int(*get_fallback_sprom)(struct bcma_bus *dev, struct ssb_sprom *out);
++
++/**
++ * bcma_arch_register_fallback_sprom - Registers a method providing a
++ * fallback SPROM if no SPROM is found.
++ *
++ * @sprom_callback: The callback function.
++ *
++ * With this function the architecture implementation may register a
++ * callback handler which fills the SPROM data structure. The fallback is
++ * used for PCI based BCMA devices, where no valid SPROM can be found
++ * in the shadow registers and to provide the SPROM for SoCs where BCMA is
++ * to controll the system bus.
++ *
++ * This function is useful for weird architectures that have a half-assed
++ * BCMA device hardwired to their PCI bus.
++ *
++ * This function is available for architecture code, only. So it is not
++ * exported.
++ */
++int bcma_arch_register_fallback_sprom(int (*sprom_callback)(struct bcma_bus *bus,
++				     struct ssb_sprom *out))
++{
++	if (get_fallback_sprom)
++		return -EEXIST;
++	get_fallback_sprom = sprom_callback;
++
++	return 0;
++}
++
++static int bcma_fill_sprom_with_fallback(struct bcma_bus *bus,
++					 struct ssb_sprom *out)
++{
++	int err;
++
++	if (!get_fallback_sprom) {
++		err = -ENOENT;
++		goto fail;
++	}
++
++	err = get_fallback_sprom(bus, out);
++	if (err)
++		goto fail;
++
++	pr_debug("Using SPROM revision %d provided by"
++		 " platform.\n", bus->sprom.revision);
++	return 0;
++fail:
++	pr_warn("Using fallback SPROM failed (err %d)\n", err);
++	return err;
++}
+ 
+ /**************************************************
+  * R/W ops.
+@@ -124,37 +176,253 @@ static int bcma_sprom_valid(const u16 *s
+  * SPROM extraction.
+  **************************************************/
+ 
++#define SPOFF(offset)	((offset) / sizeof(u16))
++
++#define SPEX(_field, _offset, _mask, _shift)	\
++	bus->sprom._field = ((sprom[SPOFF(_offset)] & (_mask)) >> (_shift))
++
+ static void bcma_sprom_extract_r8(struct bcma_bus *bus, const u16 *sprom)
+ {
+-	u16 v;
++	u16 v, o;
+ 	int i;
++	u16 pwr_info_offset[] = {
++		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
++		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
++	};
++	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
++			ARRAY_SIZE(bus->sprom.core_pwr_info));
++
 +	bus->sprom.revision = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] &
 +		SSB_SPROM_REVISION_REV;
-+
+ 
  	for (i = 0; i < 3; i++) {
  		v = sprom[SPOFF(SSB_SPROM8_IL0MAC) + i];
  		*(((__be16 *)bus->sprom.il0mac) + i) = cpu_to_be16(v);
-@@ -136,12 +139,70 @@ static void bcma_sprom_extract_r8(struct
- 
- 	bus->sprom.board_rev = sprom[SPOFF(SSB_SPROM8_BOARDREV)];
- 
-+	bus->sprom.txpid2g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G0) >> SSB_SPROM4_TXPID2G0_SHIFT;
-+	bus->sprom.txpid2g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
-+	     SSB_SPROM4_TXPID2G1) >> SSB_SPROM4_TXPID2G1_SHIFT;
-+	bus->sprom.txpid2g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G2) >> SSB_SPROM4_TXPID2G2_SHIFT;
-+	bus->sprom.txpid2g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
-+	     SSB_SPROM4_TXPID2G3) >> SSB_SPROM4_TXPID2G3_SHIFT;
-+
-+	bus->sprom.txpid5gl[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL0) >> SSB_SPROM4_TXPID5GL0_SHIFT;
-+	bus->sprom.txpid5gl[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
-+	     SSB_SPROM4_TXPID5GL1) >> SSB_SPROM4_TXPID5GL1_SHIFT;
-+	bus->sprom.txpid5gl[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL2) >> SSB_SPROM4_TXPID5GL2_SHIFT;
-+	bus->sprom.txpid5gl[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
-+	     SSB_SPROM4_TXPID5GL3) >> SSB_SPROM4_TXPID5GL3_SHIFT;
-+
-+	bus->sprom.txpid5g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G0) >> SSB_SPROM4_TXPID5G0_SHIFT;
-+	bus->sprom.txpid5g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
-+	     SSB_SPROM4_TXPID5G1) >> SSB_SPROM4_TXPID5G1_SHIFT;
-+	bus->sprom.txpid5g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G2) >> SSB_SPROM4_TXPID5G2_SHIFT;
-+	bus->sprom.txpid5g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
-+	     SSB_SPROM4_TXPID5G3) >> SSB_SPROM4_TXPID5G3_SHIFT;
-+
-+	bus->sprom.txpid5gh[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH0) >> SSB_SPROM4_TXPID5GH0_SHIFT;
-+	bus->sprom.txpid5gh[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
-+	     SSB_SPROM4_TXPID5GH1) >> SSB_SPROM4_TXPID5GH1_SHIFT;
-+	bus->sprom.txpid5gh[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH2) >> SSB_SPROM4_TXPID5GH2_SHIFT;
-+	bus->sprom.txpid5gh[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
-+	     SSB_SPROM4_TXPID5GH3) >> SSB_SPROM4_TXPID5GH3_SHIFT;
-+
- 	bus->sprom.boardflags_lo = sprom[SPOFF(SSB_SPROM8_BFLLO)];
- 	bus->sprom.boardflags_hi = sprom[SPOFF(SSB_SPROM8_BFLHI)];
- 	bus->sprom.boardflags2_lo = sprom[SPOFF(SSB_SPROM8_BFL2LO)];
- 	bus->sprom.boardflags2_hi = sprom[SPOFF(SSB_SPROM8_BFL2HI)];
- 
- 	bus->sprom.country_code = sprom[SPOFF(SSB_SPROM8_CCODE)];
-+
-+	bus->sprom.fem.ghz2.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz2.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz2.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz2.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz2.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
-+
-+	bus->sprom.fem.ghz5.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
-+	bus->sprom.fem.ghz5.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
-+	bus->sprom.fem.ghz5.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
-+	bus->sprom.fem.ghz5.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
-+	bus->sprom.fem.ghz5.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
-+		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
+ 	}
+ 
+-	bus->sprom.board_rev = sprom[SPOFF(SSB_SPROM8_BOARDREV)];
++	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
+ 
+-	bus->sprom.boardflags_lo = sprom[SPOFF(SSB_SPROM8_BFLLO)];
+-	bus->sprom.boardflags_hi = sprom[SPOFF(SSB_SPROM8_BFLHI)];
+-	bus->sprom.boardflags2_lo = sprom[SPOFF(SSB_SPROM8_BFL2LO)];
+-	bus->sprom.boardflags2_hi = sprom[SPOFF(SSB_SPROM8_BFL2HI)];
++	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
++	     SSB_SPROM4_TXPID2G0_SHIFT);
++	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
++	     SSB_SPROM4_TXPID2G1_SHIFT);
++	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
++	     SSB_SPROM4_TXPID2G2_SHIFT);
++	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
++	     SSB_SPROM4_TXPID2G3_SHIFT);
++
++	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
++	     SSB_SPROM4_TXPID5GL0_SHIFT);
++	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
++	     SSB_SPROM4_TXPID5GL1_SHIFT);
++	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
++	     SSB_SPROM4_TXPID5GL2_SHIFT);
++	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
++	     SSB_SPROM4_TXPID5GL3_SHIFT);
++
++	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
++	     SSB_SPROM4_TXPID5G0_SHIFT);
++	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
++	     SSB_SPROM4_TXPID5G1_SHIFT);
++	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
++	     SSB_SPROM4_TXPID5G2_SHIFT);
++	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
++	     SSB_SPROM4_TXPID5G3_SHIFT);
++
++	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
++	     SSB_SPROM4_TXPID5GH0_SHIFT);
++	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
++	     SSB_SPROM4_TXPID5GH1_SHIFT);
++	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
++	     SSB_SPROM4_TXPID5GH2_SHIFT);
++	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
++	     SSB_SPROM4_TXPID5GH3_SHIFT);
++
++	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
++	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
++	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
++	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
++
++	SPEX(country_code, SSB_SPROM8_CCODE, ~0, 0);
++
++	/* Extract cores power info info */
++	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
++		o = pwr_info_offset[i];
++		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_MAXP, 0);
++
++		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
++
++		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GH_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
++
++		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
++	}
++
++	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++
++	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++}
++
++/*
++ * Indicates the presence of external SPROM.
++ */
++static bool bcma_sprom_ext_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 srom_control;
++	u32 present_mask;
++
++	if (bus->drv_cc.core->id.rev >= 31) {
++		if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
++			return false;
++
++		srom_control = bcma_read32(bus->drv_cc.core,
++					   BCMA_CC_SROM_CONTROL);
++		return srom_control & BCMA_CC_SROM_CONTROL_PRESENT;
++	}
++
++	/* older chipcommon revisions use chip status register */
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present_mask = BCMA_CC_CHIPST_4313_SPROM_PRESENT;
++		break;
++
++	case 0x4331:
++		present_mask = BCMA_CC_CHIPST_4331_SPROM_PRESENT;
++		break;
++
++	default:
++		return true;
++	}
++
++	return chip_status & present_mask;
++}
++
++/*
++ * Indicates that on-chip OTP memory is present and enabled.
++ */
++static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 otpsize = 0;
++	bool present;
++
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present = chip_status & BCMA_CC_CHIPST_4313_OTP_PRESENT;
++		break;
++
++	case 0x4331:
++		present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
++		break;
++
++	case 43224:
++	case 43225:
++		/* for these chips OTP is always available */
++		present = true;
++		break;
++
++	default:
++		present = false;
++		break;
++	}
+ 
+-	bus->sprom.country_code = sprom[SPOFF(SSB_SPROM8_CCODE)];
++	if (present) {
++		otpsize = bus->drv_cc.capabilities & BCMA_CC_CAP_OTPS;
++		otpsize >>= BCMA_CC_CAP_OTPS_SHIFT;
++	}
++
++	return otpsize != 0;
++}
++
++/*
++ * Verify OTP is filled and determine the byte
++ * offset where SPROM data is located.
++ *
++ * On error, returns 0; byte offset otherwise.
++ */
++static int bcma_sprom_onchip_offset(struct bcma_bus *bus)
++{
++	struct bcma_device *cc = bus->drv_cc.core;
++	u32 offset;
++
++	/* verify OTP status */
++	if ((bcma_read32(cc, BCMA_CC_OTPS) & BCMA_CC_OTPS_GU_PROG_HW) == 0)
++		return 0;
++
++	/* obtain bit offset from otplayout register */
++	offset = (bcma_read32(cc, BCMA_CC_OTPL) & BCMA_CC_OTPL_GURGN_OFFSET);
++	return BCMA_CC_SPROM + (offset >> 3);
  }
  
  int bcma_sprom_get(struct bcma_bus *bus)
---- a/include/linux/bcma/bcma_driver_chipcommon.h
-+++ b/include/linux/bcma/bcma_driver_chipcommon.h
-@@ -203,6 +203,7 @@
- #define BCMA_CC_PMU_CTL			0x0600 /* PMU control */
- #define  BCMA_CC_PMU_CTL_ILP_DIV	0xFFFF0000 /* ILP div mask */
- #define  BCMA_CC_PMU_CTL_ILP_DIV_SHIFT	16
-+#define  BCMA_CC_PMU_CTL_PLL_UPD	0x00000400
- #define  BCMA_CC_PMU_CTL_NOILPONW	0x00000200 /* No ILP on wait */
- #define  BCMA_CC_PMU_CTL_HTREQEN	0x00000100 /* HT req enable */
- #define  BCMA_CC_PMU_CTL_ALPREQEN	0x00000080 /* ALP req enable */
+ {
+-	u16 offset;
++	u16 offset = BCMA_CC_SPROM;
+ 	u16 *sprom;
+ 	int err = 0;
+ 
+ 	if (!bus->drv_cc.core)
+ 		return -EOPNOTSUPP;
+ 
+-	if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
+-		return -ENOENT;
++	if (!bcma_sprom_ext_available(bus)) {
++		/*
++		 * External SPROM takes precedence so check
++		 * on-chip OTP only when no external SPROM
++		 * is present.
++		 */
++		if (bcma_sprom_onchip_available(bus)) {
++			/* determine offset */
++			offset = bcma_sprom_onchip_offset(bus);
++		}
++		if (!offset) {
++			/*
++			 * Maybe there is no SPROM on the device?
++			 * Now we ask the arch code if there is some sprom
++			 * available for this device in some other storage.
++			 */
++			err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
++			return err;
++		}
++	}
+ 
+ 	sprom = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
+ 			GFP_KERNEL);
+@@ -164,11 +432,7 @@ int bcma_sprom_get(struct bcma_bus *bus)
+ 	if (bus->chipinfo.id == 0x4331)
+ 		bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
+ 
+-	/* Most cards have SPROM moved by additional offset 0x30 (48 dwords).
+-	 * According to brcm80211 this applies to cards with PCIe rev >= 6
+-	 * TODO: understand this condition and use it */
+-	offset = (bus->chipinfo.id == 0x4331) ? BCMA_CC_SPROM :
+-		BCMA_CC_SPROM_PCIE6;
++	pr_debug("SPROM offset 0x%x\n", offset);
+ 	bcma_sprom_read(bus, offset, sprom);
+ 
+ 	if (bus->chipinfo.id == 0x4331)
 --- a/include/linux/bcma/bcma.h
 +++ b/include/linux/bcma/bcma.h
-@@ -205,61 +205,82 @@ struct bcma_bus {
+@@ -136,6 +136,7 @@ struct bcma_device {
+ 	bool dev_registered;
+ 
+ 	u8 core_index;
++	u8 core_unit;
+ 
+ 	u32 addr;
+ 	u32 wrap;
+@@ -162,7 +163,7 @@ struct bcma_driver {
+ 
+ 	int (*probe)(struct bcma_device *dev);
+ 	void (*remove)(struct bcma_device *dev);
+-	int (*suspend)(struct bcma_device *dev, pm_message_t state);
++	int (*suspend)(struct bcma_device *dev);
+ 	int (*resume)(struct bcma_device *dev);
+ 	void (*shutdown)(struct bcma_device *dev);
+ 
+@@ -175,6 +176,12 @@ int __bcma_driver_register(struct bcma_d
+ 
+ extern void bcma_driver_unregister(struct bcma_driver *drv);
+ 
++/* Set a fallback SPROM.
++ * See kdoc at the function definition for complete documentation. */
++extern int bcma_arch_register_fallback_sprom(
++		int (*sprom_callback)(struct bcma_bus *bus,
++		struct ssb_sprom *out));
++
+ struct bcma_bus {
+ 	/* The MMIO area. */
+ 	void __iomem *mmio;
+@@ -195,6 +202,7 @@ struct bcma_bus {
+ 	struct list_head cores;
+ 	u8 nr_cores;
+ 	u8 init_done:1;
++	u8 num;
+ 
+ 	struct bcma_drv_cc drv_cc;
+ 	struct bcma_drv_pci drv_pci;
+@@ -205,62 +213,84 @@ struct bcma_bus {
  	struct ssb_sprom sprom;
  };
  
@@ -263,5 +1755,266 @@
 +	bcma_write16(cc, offset, (bcma_read16(cc, offset) & mask) | set);
 +}
  
++extern struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid);
  extern bool bcma_core_is_enabled(struct bcma_device *core);
  extern void bcma_core_disable(struct bcma_device *core, u32 flags);
+ extern int bcma_core_enable(struct bcma_device *core, u32 flags);
+--- a/include/linux/bcma/bcma_driver_chipcommon.h
++++ b/include/linux/bcma/bcma_driver_chipcommon.h
+@@ -56,6 +56,9 @@
+ #define	 BCMA_CC_OTPS_HW_PROTECT	0x00000001
+ #define	 BCMA_CC_OTPS_SW_PROTECT	0x00000002
+ #define	 BCMA_CC_OTPS_CID_PROTECT	0x00000004
++#define  BCMA_CC_OTPS_GU_PROG_IND	0x00000F00	/* General Use programmed indication */
++#define  BCMA_CC_OTPS_GU_PROG_IND_SHIFT	8
++#define  BCMA_CC_OTPS_GU_PROG_HW	0x00000100	/* HW region programmed */
+ #define BCMA_CC_OTPC			0x0014		/* OTP control */
+ #define	 BCMA_CC_OTPC_RECWAIT		0xFF000000
+ #define	 BCMA_CC_OTPC_PROGWAIT		0x00FFFF00
+@@ -72,6 +75,8 @@
+ #define	 BCMA_CC_OTPP_READ		0x40000000
+ #define	 BCMA_CC_OTPP_START		0x80000000
+ #define	 BCMA_CC_OTPP_BUSY		0x80000000
++#define BCMA_CC_OTPL			0x001C		/* OTP layout */
++#define  BCMA_CC_OTPL_GURGN_OFFSET	0x00000FFF	/* offset of general use region */
+ #define BCMA_CC_IRQSTAT			0x0020
+ #define BCMA_CC_IRQMASK			0x0024
+ #define	 BCMA_CC_IRQ_GPIO		0x00000001	/* gpio intr */
+@@ -79,6 +84,10 @@
+ #define	 BCMA_CC_IRQ_WDRESET		0x80000000	/* watchdog reset occurred */
+ #define BCMA_CC_CHIPCTL			0x0028		/* Rev >= 11 only */
+ #define BCMA_CC_CHIPSTAT		0x002C		/* Rev >= 11 only */
++#define  BCMA_CC_CHIPST_4313_SPROM_PRESENT	1
++#define  BCMA_CC_CHIPST_4313_OTP_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_SPROM_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_OTP_PRESENT	4
+ #define BCMA_CC_JCMD			0x0030		/* Rev >= 10 only */
+ #define  BCMA_CC_JCMD_START		0x80000000
+ #define  BCMA_CC_JCMD_BUSY		0x80000000
+@@ -181,6 +190,22 @@
+ #define BCMA_CC_FLASH_CFG		0x0128
+ #define  BCMA_CC_FLASH_CFG_DS		0x0010	/* Data size, 0=8bit, 1=16bit */
+ #define BCMA_CC_FLASH_WAITCNT		0x012C
++#define BCMA_CC_SROM_CONTROL		0x0190
++#define  BCMA_CC_SROM_CONTROL_START	0x80000000
++#define  BCMA_CC_SROM_CONTROL_BUSY	0x80000000
++#define  BCMA_CC_SROM_CONTROL_OPCODE	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OP_READ	0x00000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRITE	0x20000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRDIS	0x40000000
++#define  BCMA_CC_SROM_CONTROL_OP_WREN	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OTPSEL	0x00000010
++#define  BCMA_CC_SROM_CONTROL_LOCK	0x00000008
++#define  BCMA_CC_SROM_CONTROL_SIZE_MASK	0x00000006
++#define  BCMA_CC_SROM_CONTROL_SIZE_1K	0x00000000
++#define  BCMA_CC_SROM_CONTROL_SIZE_4K	0x00000002
++#define  BCMA_CC_SROM_CONTROL_SIZE_16K	0x00000004
++#define  BCMA_CC_SROM_CONTROL_SIZE_SHIFT	1
++#define  BCMA_CC_SROM_CONTROL_PRESENT	0x00000001
+ /* 0x1E0 is defined as shared BCMA_CLKCTLST */
+ #define BCMA_CC_HW_WORKAROUND		0x01E4 /* Hardware workaround (rev >= 20) */
+ #define BCMA_CC_UART0_DATA		0x0300
+@@ -203,6 +228,7 @@
+ #define BCMA_CC_PMU_CTL			0x0600 /* PMU control */
+ #define  BCMA_CC_PMU_CTL_ILP_DIV	0xFFFF0000 /* ILP div mask */
+ #define  BCMA_CC_PMU_CTL_ILP_DIV_SHIFT	16
++#define  BCMA_CC_PMU_CTL_PLL_UPD	0x00000400
+ #define  BCMA_CC_PMU_CTL_NOILPONW	0x00000200 /* No ILP on wait */
+ #define  BCMA_CC_PMU_CTL_HTREQEN	0x00000100 /* HT req enable */
+ #define  BCMA_CC_PMU_CTL_ALPREQEN	0x00000080 /* ALP req enable */
+@@ -239,7 +265,6 @@
+ #define BCMA_CC_PLLCTL_ADDR		0x0660
+ #define BCMA_CC_PLLCTL_DATA		0x0664
+ #define BCMA_CC_SPROM			0x0800 /* SPROM beginning */
+-#define BCMA_CC_SPROM_PCIE6		0x0830 /* SPROM beginning on PCIe rev >= 6 */
+ 
+ /* Divider allocation in 4716/47162/5356 */
+ #define BCMA_CC_PMU5_MAINPLL_CPU	1
+--- a/include/linux/bcma/bcma_driver_pci.h
++++ b/include/linux/bcma/bcma_driver_pci.h
+@@ -53,6 +53,35 @@ struct pci_dev;
+ #define  BCMA_CORE_PCI_SBTOPCI1_MASK		0xFC000000
+ #define BCMA_CORE_PCI_SBTOPCI2			0x0108	/* Backplane to PCI translation 2 (sbtopci2) */
+ #define  BCMA_CORE_PCI_SBTOPCI2_MASK		0xC0000000
++#define BCMA_CORE_PCI_CONFIG_ADDR		0x0120	/* pcie config space access */
++#define BCMA_CORE_PCI_CONFIG_DATA		0x0124	/* pcie config space access */
++#define BCMA_CORE_PCI_MDIO_CONTROL		0x0128	/* controls the mdio access */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_MASK	0x7f	/* clock to be used on MDIO */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL	0x2
++#define  BCMA_CORE_PCI_MDIOCTL_PREAM_EN		0x80	/* Enable preamble sequnce */
++#define  BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE	0x100	/* Tranaction complete */
++#define BCMA_CORE_PCI_MDIO_DATA			0x012c	/* Data to the mdio access */
++#define  BCMA_CORE_PCI_MDIODATA_MASK		0x0000ffff /* data 2 bytes */
++#define  BCMA_CORE_PCI_MDIODATA_TA		0x00020000 /* Turnaround */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD	18	/* Regaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK_OLD	0x003c0000 /* Regaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD	22	/* Physmedia devaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK_OLD	0x0fc00000 /* Physmedia devaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF	18	/* Regaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK	0x007c0000 /* Regaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF	23	/* Physmedia devaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK	0x0f800000 /* Physmedia devaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_WRITE		0x10000000 /* write Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_READ		0x20000000 /* Read Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_START		0x40000000 /* start of Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_ADDR	0x0	/* dev address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_BLK_ADDR	0x1F	/* blk address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_PLL		0x1d	/* SERDES PLL Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_TX		0x1e	/* SERDES TX Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_RX		0x1f	/* SERDES RX Dev */
++#define BCMA_CORE_PCI_PCIEIND_ADDR		0x0130	/* indirect access to the internal register */
++#define BCMA_CORE_PCI_PCIEIND_DATA		0x0134	/* Data to/from the internal regsiter */
++#define BCMA_CORE_PCI_CLKREQENCTRL		0x0138	/*  >= rev 6, Clkreq rdma control */
+ #define BCMA_CORE_PCI_PCICFG0			0x0400	/* PCI config space 0 (rev >= 8) */
+ #define BCMA_CORE_PCI_PCICFG1			0x0500	/* PCI config space 1 (rev >= 8) */
+ #define BCMA_CORE_PCI_PCICFG2			0x0600	/* PCI config space 2 (rev >= 8) */
+@@ -72,20 +101,114 @@ struct pci_dev;
+ #define  BCMA_CORE_PCI_SBTOPCI_RC_READL		0x00000010 /* Memory read line */
+ #define  BCMA_CORE_PCI_SBTOPCI_RC_READM		0x00000020 /* Memory read multiple */
+ 
++/* PCIE protocol PHY diagnostic registers */
++#define BCMA_CORE_PCI_PLP_MODEREG		0x200	/* Mode */
++#define BCMA_CORE_PCI_PLP_STATUSREG		0x204	/* Status */
++#define  BCMA_CORE_PCI_PLP_POLARITYINV_STAT	0x10	/* Status reg PCIE_PLP_STATUSREG */
++#define BCMA_CORE_PCI_PLP_LTSSMCTRLREG		0x208	/* LTSSM control */
++#define BCMA_CORE_PCI_PLP_LTLINKNUMREG		0x20c	/* Link Training Link number */
++#define BCMA_CORE_PCI_PLP_LTLANENUMREG		0x210	/* Link Training Lane number */
++#define BCMA_CORE_PCI_PLP_LTNFTSREG		0x214	/* Link Training N_FTS */
++#define BCMA_CORE_PCI_PLP_ATTNREG		0x218	/* Attention */
++#define BCMA_CORE_PCI_PLP_ATTNMASKREG		0x21C	/* Attention Mask */
++#define BCMA_CORE_PCI_PLP_RXERRCTR		0x220	/* Rx Error */
++#define BCMA_CORE_PCI_PLP_RXFRMERRCTR		0x224	/* Rx Framing Error */
++#define BCMA_CORE_PCI_PLP_RXERRTHRESHREG	0x228	/* Rx Error threshold */
++#define BCMA_CORE_PCI_PLP_TESTCTRLREG		0x22C	/* Test Control reg */
++#define BCMA_CORE_PCI_PLP_SERDESCTRLOVRDREG	0x230	/* SERDES Control Override */
++#define BCMA_CORE_PCI_PLP_TIMINGOVRDREG		0x234	/* Timing param override */
++#define BCMA_CORE_PCI_PLP_RXTXSMDIAGREG		0x238	/* RXTX State Machine Diag */
++#define BCMA_CORE_PCI_PLP_LTSSMDIAGREG		0x23C	/* LTSSM State Machine Diag */
++
++/* PCIE protocol DLLP diagnostic registers */
++#define BCMA_CORE_PCI_DLLP_LCREG		0x100	/* Link Control */
++#define BCMA_CORE_PCI_DLLP_LSREG		0x104	/* Link Status */
++#define BCMA_CORE_PCI_DLLP_LAREG		0x108	/* Link Attention */
++#define  BCMA_CORE_PCI_DLLP_LSREG_LINKUP	(1 << 16)
++#define BCMA_CORE_PCI_DLLP_LAMASKREG		0x10C	/* Link Attention Mask */
++#define BCMA_CORE_PCI_DLLP_NEXTTXSEQNUMREG	0x110	/* Next Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_ACKEDTXSEQNUMREG	0x114	/* Acked Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_PURGEDTXSEQNUMREG	0x118	/* Purged Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_RXSEQNUMREG		0x11C	/* Rx Sequence Number */
++#define BCMA_CORE_PCI_DLLP_LRREG		0x120	/* Link Replay */
++#define BCMA_CORE_PCI_DLLP_LACKTOREG		0x124	/* Link Ack Timeout */
++#define BCMA_CORE_PCI_DLLP_PMTHRESHREG		0x128	/* Power Management Threshold */
++#define BCMA_CORE_PCI_DLLP_RTRYWPREG		0x12C	/* Retry buffer write ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYRPREG		0x130	/* Retry buffer Read ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYPPREG		0x134	/* Retry buffer Purged ptr */
++#define BCMA_CORE_PCI_DLLP_RTRRWREG		0x138	/* Retry buffer Read/Write */
++#define BCMA_CORE_PCI_DLLP_ECTHRESHREG		0x13C	/* Error Count Threshold */
++#define BCMA_CORE_PCI_DLLP_TLPERRCTRREG		0x140	/* TLP Error Counter */
++#define BCMA_CORE_PCI_DLLP_ERRCTRREG		0x144	/* Error Counter */
++#define BCMA_CORE_PCI_DLLP_NAKRXCTRREG		0x148	/* NAK Received Counter */
++#define BCMA_CORE_PCI_DLLP_TESTREG		0x14C	/* Test */
++#define BCMA_CORE_PCI_DLLP_PKTBIST		0x150	/* Packet BIST */
++#define BCMA_CORE_PCI_DLLP_PCIE11		0x154	/* DLLP PCIE 1.1 reg */
++
++/* SERDES RX registers */
++#define BCMA_CORE_PCI_SERDES_RX_CTRL		1	/* Rx cntrl */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE	0x80	/* rxpolarity_force */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY	0x40	/* rxpolarity_value */
++#define BCMA_CORE_PCI_SERDES_RX_TIMER1		2	/* Rx Timer1 */
++#define BCMA_CORE_PCI_SERDES_RX_CDR		6	/* CDR */
++#define BCMA_CORE_PCI_SERDES_RX_CDRBW		7	/* CDR BW */
++
++/* SERDES PLL registers */
++#define BCMA_CORE_PCI_SERDES_PLL_CTRL		1	/* PLL control reg */
++#define BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN	0x4000	/* bit 14 is FREQDET on */
++
+ /* PCIcore specific boardflags */
+ #define BCMA_CORE_PCI_BFL_NOPCI			0x00000400 /* Board leaves PCI floating */
+ 
++/* PCIE Config space accessing MACROS */
++#define BCMA_CORE_PCI_CFG_BUS_SHIFT		24	/* Bus shift */
++#define BCMA_CORE_PCI_CFG_SLOT_SHIFT		19	/* Slot/Device shift */
++#define BCMA_CORE_PCI_CFG_FUN_SHIFT		16	/* Function shift */
++#define BCMA_CORE_PCI_CFG_OFF_SHIFT		0	/* Register shift */
++
++#define BCMA_CORE_PCI_CFG_BUS_MASK		0xff	/* Bus mask */
++#define BCMA_CORE_PCI_CFG_SLOT_MASK		0x1f	/* Slot/Device mask */
++#define BCMA_CORE_PCI_CFG_FUN_MASK		7	/* Function mask */
++#define BCMA_CORE_PCI_CFG_OFF_MASK		0xfff	/* Register mask */
++
++/* PCIE Root Capability Register bits (Host mode only) */
++#define BCMA_CORE_PCI_RC_CRS_VISIBILITY		0x0001
++
++struct bcma_drv_pci;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++struct bcma_drv_pci_host {
++	struct bcma_drv_pci *pdev;
++
++	u32 host_cfg_addr;
++	spinlock_t cfgspace_lock;
++
++	struct pci_controller pci_controller;
++	struct pci_ops pci_ops;
++	struct resource mem_resource;
++	struct resource io_resource;
++};
++#endif
++
+ struct bcma_drv_pci {
+ 	struct bcma_device *core;
+ 	u8 setup_done:1;
++	u8 hostmode:1;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	struct bcma_drv_pci_host *host_controller;
++#endif
+ };
+ 
+ /* Register access */
+ #define pcicore_read32(pc, offset)		bcma_read32((pc)->core, offset)
+ #define pcicore_write32(pc, offset, val)	bcma_write32((pc)->core, offset, val)
+ 
+-extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
++extern void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc);
+ extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
+ 				 struct bcma_device *core, bool enable);
+ 
++extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
++extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
++
+ #endif /* LINUX_BCMA_DRIVER_PCI_H_ */
+--- a/include/linux/bcma/bcma_regs.h
++++ b/include/linux/bcma/bcma_regs.h
+@@ -56,4 +56,31 @@
+ #define  BCMA_PCI_GPIO_XTAL		0x40	/* PCI config space GPIO 14 for Xtal powerup */
+ #define  BCMA_PCI_GPIO_PLL		0x80	/* PCI config space GPIO 15 for PLL powerdown */
+ 
++/* SiliconBackplane Address Map.
++ * All regions may not exist on all chips.
++ */
++#define BCMA_SOC_SDRAM_BASE		0x00000000U	/* Physical SDRAM */
++#define BCMA_SOC_PCI_MEM		0x08000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI_MEM_SZ		(64 * 1024 * 1024)
++#define BCMA_SOC_PCI_CFG		0x0c000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_SDRAM_SWAPPED		0x10000000U	/* Byteswapped Physical SDRAM */
++#define BCMA_SOC_SDRAM_R2		0x80000000U	/* Region 2 for sdram (512 MB) */
++
++
++#define BCMA_SOC_PCI_DMA		0x40000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA2		0x80000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA_SZ		0x40000000U	/* Client Mode sb2pcitranslation2 size in bytes */
++#define BCMA_SOC_PCIE_DMA_L32		0x00000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), low 32 bits
++							 */
++#define BCMA_SOC_PCIE_DMA_H32		0x80000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
++#define BCMA_SOC_PCI1_MEM		0x40000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI1_CFG		0x44000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_PCIE1_DMA_H32		0xc0000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
+ #endif /* LINUX_BCMA_REGS_H_ */
diff --git a/target/linux/generic/patches-3.3/020-ssb_update.patch b/target/linux/generic/patches-3.3/020-ssb_update.patch
index 4435315d36..708c7ded34 100644
--- a/target/linux/generic/patches-3.3/020-ssb_update.patch
+++ b/target/linux/generic/patches-3.3/020-ssb_update.patch
@@ -1,6 +1,211 @@
+--- a/drivers/ssb/driver_chipcommon_pmu.c
++++ b/drivers/ssb/driver_chipcommon_pmu.c
+@@ -13,6 +13,9 @@
+ #include <linux/ssb/ssb_driver_chipcommon.h>
+ #include <linux/delay.h>
+ #include <linux/export.h>
++#ifdef CONFIG_BCM47XX
++#include <asm/mach-bcm47xx/nvram.h>
++#endif
+ 
+ #include "ssb_private.h"
+ 
+@@ -92,10 +95,6 @@ static void ssb_pmu0_pllinit_r0(struct s
+ 	u32 pmuctl, tmp, pllctl;
+ 	unsigned int i;
+ 
+-	if ((bus->chip_id == 0x5354) && !crystalfreq) {
+-		/* The 5354 crystal freq is 25MHz */
+-		crystalfreq = 25000;
+-	}
+ 	if (crystalfreq)
+ 		e = pmu0_plltab_find_entry(crystalfreq);
+ 	if (!e)
+@@ -321,7 +320,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 	u32 crystalfreq = 0; /* in kHz. 0 = keep default freq. */
+ 
+ 	if (bus->bustype == SSB_BUSTYPE_SSB) {
+-		/* TODO: The user may override the crystal frequency. */
++#ifdef CONFIG_BCM47XX
++		char buf[20];
++		if (nvram_getenv("xtalfreq", buf, sizeof(buf)) >= 0)
++			crystalfreq = simple_strtoul(buf, NULL, 0);
++#endif
+ 	}
+ 
+ 	switch (bus->chip_id) {
+@@ -330,7 +333,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 		ssb_pmu1_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4328:
++		ssb_pmu0_pllinit_r0(cc, crystalfreq);
++		break;
+ 	case 0x5354:
++		if (crystalfreq == 0)
++			crystalfreq = 25000;
+ 		ssb_pmu0_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4322:
+@@ -607,3 +614,34 @@ void ssb_pmu_set_ldo_paref(struct ssb_ch
+ 
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_voltage);
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_paref);
++
++u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		/* 5354 chip uses a non programmable PLL of frequency 240MHz */
++		return 240000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU cpu clock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
++
++u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		return 120000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU controlclock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
+--- a/drivers/ssb/driver_mipscore.c
++++ b/drivers/ssb/driver_mipscore.c
+@@ -208,6 +208,9 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 	u32 pll_type, n, m, rate = 0;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_cpu_clock(&bus->chipco);
++
+ 	if (bus->extif.dev) {
+ 		ssb_extif_get_clockcontrol(&bus->extif, &pll_type, &n, &m);
+ 	} else if (bus->chipco.dev) {
+--- a/drivers/ssb/main.c
++++ b/drivers/ssb/main.c
+@@ -140,19 +140,6 @@ static void ssb_device_put(struct ssb_de
+ 		put_device(dev->dev);
+ }
+ 
+-static inline struct ssb_driver *ssb_driver_get(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		get_driver(&drv->drv);
+-	return drv;
+-}
+-
+-static inline void ssb_driver_put(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		put_driver(&drv->drv);
+-}
+-
+ static int ssb_device_resume(struct device *dev)
+ {
+ 	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
+@@ -250,11 +237,9 @@ int ssb_devices_freeze(struct ssb_bus *b
+ 			ssb_device_put(sdev);
+ 			continue;
+ 		}
+-		sdrv = ssb_driver_get(drv_to_ssb_drv(sdev->dev->driver));
+-		if (!sdrv || SSB_WARN_ON(!sdrv->remove)) {
+-			ssb_device_put(sdev);
++		sdrv = drv_to_ssb_drv(sdev->dev->driver);
++		if (SSB_WARN_ON(!sdrv->remove))
+ 			continue;
+-		}
+ 		sdrv->remove(sdev);
+ 		ctx->device_frozen[i] = 1;
+ 	}
+@@ -293,7 +278,6 @@ int ssb_devices_thaw(struct ssb_freeze_c
+ 				   dev_name(sdev->dev));
+ 			result = err;
+ 		}
+-		ssb_driver_put(sdrv);
+ 		ssb_device_put(sdev);
+ 	}
+ 
+@@ -1094,6 +1078,9 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
+ 	u32 plltype;
+ 	u32 clkctl_n, clkctl_m;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_controlclock(&bus->chipco);
++
+ 	if (ssb_extif_available(&bus->extif))
+ 		ssb_extif_get_clockcontrol(&bus->extif, &plltype,
+ 					   &clkctl_n, &clkctl_m);
 --- a/drivers/ssb/pci.c
 +++ b/drivers/ssb/pci.c
-@@ -523,7 +523,13 @@ static void sprom_extract_r45(struct ssb
+@@ -331,7 +331,6 @@ static void sprom_extract_r123(struct ss
+ {
+ 	int i;
+ 	u16 v;
+-	s8 gain;
+ 	u16 loc[3];
+ 
+ 	if (out->revision == 3)			/* rev 3 moved MAC */
+@@ -390,20 +389,12 @@ static void sprom_extract_r123(struct ss
+ 		SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_BG,
+-				    SSB_SPROM1_AGAIN_BG_SHIFT);
+-	out->antenna_gain.ghz24.a0 = gain;
+-	out->antenna_gain.ghz24.a1 = gain;
+-	out->antenna_gain.ghz24.a2 = gain;
+-	out->antenna_gain.ghz24.a3 = gain;
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_A,
+-				    SSB_SPROM1_AGAIN_A_SHIFT);
+-	out->antenna_gain.ghz5.a0 = gain;
+-	out->antenna_gain.ghz5.a1 = gain;
+-	out->antenna_gain.ghz5.a2 = gain;
+-	out->antenna_gain.ghz5.a3 = gain;
++	out->antenna_gain.a0 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_BG,
++						    SSB_SPROM1_AGAIN_BG_SHIFT);
++	out->antenna_gain.a1 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_A,
++						    SSB_SPROM1_AGAIN_A_SHIFT);
+ }
+ 
+ /* Revs 4 5 and 8 have partially shared layout */
+@@ -504,16 +495,14 @@ static void sprom_extract_r45(struct ssb
+ 	}
+ 
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN0, SSB_SPROM4_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN1, SSB_SPROM4_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN2, SSB_SPROM4_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN3, SSB_SPROM4_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
+ 
+ 	sprom_extract_r458(out, in);
+ 
+@@ -523,7 +512,13 @@ static void sprom_extract_r45(struct ssb
  static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
  {
  	int i;
@@ -15,10 +220,25 @@
  
  	/* extract the MAC address */
  	for (i = 0; i < 3; i++) {
-@@ -607,6 +613,38 @@ static void sprom_extract_r8(struct ssb_
- 	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
- 	       sizeof(out->antenna_gain.ghz5));
+@@ -596,16 +591,46 @@ static void sprom_extract_r8(struct ssb_
+ 	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
  
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
++
 +	/* Extract cores power info info */
 +	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
 +		o = pwr_info_offset[i];
@@ -50,10 +270,74 @@
 +		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
 +		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
 +	}
-+
+ 
  	/* Extract FEM info */
  	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G,
- 		SSB_SROM8_FEM_TSSIPOS, SSB_SROM8_FEM_TSSIPOS_SHIFT);
+--- a/drivers/ssb/pcmcia.c
++++ b/drivers/ssb/pcmcia.c
+@@ -676,14 +676,10 @@ static int ssb_pcmcia_do_get_invariants(
+ 	case SSB_PCMCIA_CIS_ANTGAIN:
+ 		GOTO_ERROR_ON(tuple->TupleDataLen != 2,
+ 			"antg tpl size");
+-		sprom->antenna_gain.ghz24.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a3 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a3 = tuple->TupleData[1];
++		sprom->antenna_gain.a0 = tuple->TupleData[1];
++		sprom->antenna_gain.a1 = tuple->TupleData[1];
++		sprom->antenna_gain.a2 = tuple->TupleData[1];
++		sprom->antenna_gain.a3 = tuple->TupleData[1];
+ 		break;
+ 	case SSB_PCMCIA_CIS_BFLAGS:
+ 		GOTO_ERROR_ON((tuple->TupleDataLen != 3) &&
+--- a/drivers/ssb/scan.c
++++ b/drivers/ssb/scan.c
+@@ -318,6 +318,9 @@ int ssb_bus_scan(struct ssb_bus *bus,
+ 			bus->chip_package = 0;
+ 		}
+ 	}
++	ssb_printk(KERN_INFO PFX "Found chip with id 0x%04X, rev 0x%02X and "
++		   "package 0x%02X\n", bus->chip_id, bus->chip_rev,
++		   bus->chip_package);
+ 	if (!bus->nr_devices)
+ 		bus->nr_devices = chipid_to_nrcores(bus->chip_id);
+ 	if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
+--- a/drivers/ssb/sdio.c
++++ b/drivers/ssb/sdio.c
+@@ -551,14 +551,10 @@ int ssb_sdio_get_invariants(struct ssb_b
+ 			case SSB_SDIO_CIS_ANTGAIN:
+ 				GOTO_ERROR_ON(tuple->size != 2,
+ 					      "antg tpl size");
+-				sprom->antenna_gain.ghz24.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a3 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a3 = tuple->data[1];
++				sprom->antenna_gain.a0 = tuple->data[1];
++				sprom->antenna_gain.a1 = tuple->data[1];
++				sprom->antenna_gain.a2 = tuple->data[1];
++				sprom->antenna_gain.a3 = tuple->data[1];
+ 				break;
+ 			case SSB_SDIO_CIS_BFLAGS:
+ 				GOTO_ERROR_ON((tuple->size != 3) &&
+--- a/drivers/ssb/ssb_private.h
++++ b/drivers/ssb/ssb_private.h
+@@ -207,4 +207,8 @@ static inline void b43_pci_ssb_bridge_ex
+ }
+ #endif /* CONFIG_SSB_B43_PCI_BRIDGE */
+ 
++/* driver_chipcommon_pmu.c */
++extern u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc);
++extern u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc);
++
+ #endif /* LINUX_SSB_PRIVATE_H_ */
 --- a/include/linux/ssb/ssb.h
 +++ b/include/linux/ssb/ssb.h
 @@ -16,6 +16,12 @@ struct pcmcia_device;
@@ -63,13 +347,54 @@
 +struct ssb_sprom_core_pwr_info {
 +	u8 itssi_2g, itssi_5g;
 +	u8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh;
-+	u16 pa_2g[3], pa_5gl[3], pa_5g[3], pa_5gh[3];
++	u16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4];
 +};
 +
  struct ssb_sprom {
  	u8 revision;
  	u8 il0mac[6];		/* MAC address for 802.11b/g */
-@@ -82,6 +88,8 @@ struct ssb_sprom {
+@@ -26,9 +32,12 @@ struct ssb_sprom {
+ 	u8 et0mdcport;		/* MDIO for enet0 */
+ 	u8 et1mdcport;		/* MDIO for enet1 */
+ 	u16 board_rev;		/* Board revision number from SPROM. */
++	u16 board_num;		/* Board number from SPROM. */
++	u16 board_type;		/* Board type from SPROM. */
+ 	u8 country_code;	/* Country Code */
+-	u16 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
+-	u16 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
++	char alpha2[2];		/* Country Code as two chars like EU or US */
++	u8 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
++	u8 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
+ 	u8 ant_available_a;	/* 2GHz antenna available bits (up to 4) */
+ 	u8 ant_available_bg;	/* 5GHz antenna available bits (up to 4) */
+ 	u16 pa0b0;
+@@ -47,10 +56,10 @@ struct ssb_sprom {
+ 	u8 gpio1;		/* GPIO pin 1 */
+ 	u8 gpio2;		/* GPIO pin 2 */
+ 	u8 gpio3;		/* GPIO pin 3 */
+-	u16 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
+ 	u8 itssi_a;		/* Idle TSSI Target for A-PHY */
+ 	u8 itssi_bg;		/* Idle TSSI Target for B/G-PHY */
+ 	u8 tri2g;		/* 2.4GHz TX isolation */
+@@ -61,8 +70,8 @@ struct ssb_sprom {
+ 	u8 txpid5gl[4];		/* 4.9 - 5.1GHz TX power index */
+ 	u8 txpid5g[4];		/* 5.1 - 5.5GHz TX power index */
+ 	u8 txpid5gh[4];		/* 5.5 - ...GHz TX power index */
+-	u8 rxpo2g;		/* 2GHz RX power offset */
+-	u8 rxpo5g;		/* 5GHz RX power offset */
++	s8 rxpo2g;		/* 2GHz RX power offset */
++	s8 rxpo5g;		/* 5GHz RX power offset */
+ 	u8 rssisav2g;		/* 2GHz RSSI params */
+ 	u8 rssismc2g;
+ 	u8 rssismf2g;
+@@ -82,16 +91,13 @@ struct ssb_sprom {
  	u16 boardflags2_hi;	/* Board flags (bits 48-63) */
  	/* TODO store board flags in a single u64 */
  
@@ -78,6 +403,108 @@
  	/* Antenna gain values for up to 4 antennas
  	 * on each band. Values in dBm/4 (Q5.2). Negative gain means the
  	 * loss in the connectors is bigger than the gain. */
+ 	struct {
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz24;	/* 2.4GHz band */
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz5;		/* 5GHz band */
++		s8 a0, a1, a2, a3;
+ 	} antenna_gain;
+ 
+ 	struct {
+@@ -103,7 +109,79 @@ struct ssb_sprom {
+ 		} ghz5;
+ 	} fem;
+ 
+-	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
++	u16 mcs2gpo[8];
++	u16 mcs5gpo[8];
++	u16 mcs5glpo[8];
++	u16 mcs5ghpo[8];
++	u8 opo;
++
++	u8 rxgainerr2ga[3];
++	u8 rxgainerr5gla[3];
++	u8 rxgainerr5gma[3];
++	u8 rxgainerr5gha[3];
++	u8 rxgainerr5gua[3];
++
++	u8 noiselvl2ga[3];
++	u8 noiselvl5gla[3];
++	u8 noiselvl5gma[3];
++	u8 noiselvl5gha[3];
++	u8 noiselvl5gua[3];
++
++	u8 regrev;
++	u8 txchain;
++	u8 rxchain;
++	u8 antswitch;
++	u16 cddpo;
++	u16 stbcpo;
++	u16 bw40po;
++	u16 bwduppo;
++
++	u8 tempthresh;
++	u8 tempoffset;
++	u16 rawtempsense;
++	u8 measpower;
++	u8 tempsense_slope;
++	u8 tempcorrx;
++	u8 tempsense_option;
++	u8 freqoffset_corr;
++	u8 iqcal_swp_dis;
++	u8 hw_iqcal_en;
++	u8 elna2g;
++	u8 elna5g;
++	u8 phycal_tempdelta;
++	u8 temps_period;
++	u8 temps_hysteresis;
++	u8 measpower1;
++	u8 measpower2;
++	u8 pcieingress_war;
++
++	/* power per rate from sromrev 9 */
++	u16 cckbw202gpo;
++	u16 cckbw20ul2gpo;
++	u32 legofdmbw202gpo;
++	u32 legofdmbw20ul2gpo;
++	u32 legofdmbw205glpo;
++	u32 legofdmbw20ul5glpo;
++	u32 legofdmbw205gmpo;
++	u32 legofdmbw20ul5gmpo;
++	u32 legofdmbw205ghpo;
++	u32 legofdmbw20ul5ghpo;
++	u32 mcsbw202gpo;
++	u32 mcsbw20ul2gpo;
++	u32 mcsbw402gpo;
++	u32 mcsbw205glpo;
++	u32 mcsbw20ul5glpo;
++	u32 mcsbw405glpo;
++	u32 mcsbw205gmpo;
++	u32 mcsbw20ul5gmpo;
++	u32 mcsbw405gmpo;
++	u32 mcsbw205ghpo;
++	u32 mcsbw20ul5ghpo;
++	u32 mcsbw405ghpo;
++	u16 mcs32po;
++	u16 legofdm40duppo;
++	u8 sar2g;
++	u8 sar5g;
+ };
+ 
+ /* Information about the PCB the circuitry is soldered on. */
+--- a/include/linux/ssb/ssb_driver_gige.h
++++ b/include/linux/ssb/ssb_driver_gige.h
+@@ -2,6 +2,7 @@
+ #define LINUX_SSB_DRIVER_GIGE_H_
+ 
+ #include <linux/ssb/ssb.h>
++#include <linux/bug.h>
+ #include <linux/pci.h>
+ #include <linux/spinlock.h>
+ 
 --- a/include/linux/ssb/ssb_regs.h
 +++ b/include/linux/ssb/ssb_regs.h
 @@ -449,6 +449,39 @@
diff --git a/target/linux/generic/patches-3.3/025-bcma_backport.patch b/target/linux/generic/patches-3.3/025-bcma_backport.patch
new file mode 100644
index 0000000000..7117fbaf15
--- /dev/null
+++ b/target/linux/generic/patches-3.3/025-bcma_backport.patch
@@ -0,0 +1,1748 @@
+--- a/drivers/bcma/Kconfig
++++ b/drivers/bcma/Kconfig
+@@ -29,7 +29,7 @@ config BCMA_HOST_PCI
+ 
+ config BCMA_DRIVER_PCI_HOSTMODE
+ 	bool "Driver for PCI core working in hostmode"
+-	depends on BCMA && MIPS
++	depends on BCMA && MIPS && BCMA_HOST_PCI
+ 	help
+ 	  PCI core hostmode operation (external PCI bus).
+ 
+--- a/drivers/bcma/bcma_private.h
++++ b/drivers/bcma/bcma_private.h
+@@ -13,7 +13,7 @@
+ struct bcma_bus;
+ 
+ /* main.c */
+-int bcma_bus_register(struct bcma_bus *bus);
++int __devinit bcma_bus_register(struct bcma_bus *bus);
+ void bcma_bus_unregister(struct bcma_bus *bus);
+ int __init bcma_bus_early_register(struct bcma_bus *bus,
+ 				   struct bcma_device *core_cc,
+@@ -48,8 +48,12 @@ extern int __init bcma_host_pci_init(voi
+ extern void __exit bcma_host_pci_exit(void);
+ #endif /* CONFIG_BCMA_HOST_PCI */
+ 
++/* driver_pci.c */
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address);
++
+ #ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
+-void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc);
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
+ #endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
+ 
+ #endif
+--- a/drivers/bcma/driver_chipcommon_pmu.c
++++ b/drivers/bcma/driver_chipcommon_pmu.c
+@@ -80,6 +80,7 @@ static void bcma_pmu_resources_init(stru
+ 		min_msk = 0x200D;
+ 		max_msk = 0xFFFF;
+ 		break;
++	case 0x4331:
+ 	case 43224:
+ 	case 43225:
+ 		break;
+--- a/drivers/bcma/driver_pci.c
++++ b/drivers/bcma/driver_pci.c
+@@ -2,8 +2,9 @@
+  * Broadcom specific AMBA
+  * PCI Core
+  *
+- * Copyright 2005, Broadcom Corporation
++ * Copyright 2005, 2011, Broadcom Corporation
+  * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
+  *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+@@ -16,40 +17,41 @@
+  * R/W ops.
+  **************************************************/
+ 
+-static u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
+ {
+-	pcicore_write32(pc, 0x130, address);
+-	pcicore_read32(pc, 0x130);
+-	return pcicore_read32(pc, 0x134);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_DATA);
+ }
+ 
+ #if 0
+ static void bcma_pcie_write(struct bcma_drv_pci *pc, u32 address, u32 data)
+ {
+-	pcicore_write32(pc, 0x130, address);
+-	pcicore_read32(pc, 0x130);
+-	pcicore_write32(pc, 0x134, data);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_DATA, data);
+ }
+ #endif
+ 
+ static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u8 phy)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	u32 v;
+ 	int i;
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 28); /* Write Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	v |= (0x1F << 18);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++	v |= (BCMA_CORE_PCI_MDIODATA_BLK_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 	v |= (phy << 4);
+-	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 
+ 	udelay(10);
+ 	for (i = 0; i < 200; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
+ 			break;
+ 		msleep(1);
+ 	}
+@@ -57,79 +59,84 @@ static void bcma_pcie_mdio_set_phy(struc
+ 
+ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u8 device, u8 address)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	int max_retries = 10;
+ 	u16 ret = 0;
+ 	u32 v;
+ 	int i;
+ 
+-	v = 0x80; /* Enable Preamble Sequence */
+-	v |= 0x2; /* MDIO Clock Divisor */
+-	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
+ 
+ 	if (pc->core->id.rev >= 10) {
+ 		max_retries = 200;
+ 		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 29); /* Read Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	if (pc->core->id.rev < 10)
+-		v |= (u32)device << 22;
+-	v |= (u32)address << 18;
+-	pcicore_write32(pc, mdio_data, v);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_READ;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
++
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 	/* Wait for the device to complete the transaction */
+ 	udelay(10);
+ 	for (i = 0; i < max_retries; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */) {
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE) {
+ 			udelay(10);
+-			ret = pcicore_read32(pc, mdio_data);
++			ret = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_DATA);
+ 			break;
+ 		}
+ 		msleep(1);
+ 	}
+-	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
+ 	return ret;
+ }
+ 
+ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u8 device,
+ 				u8 address, u16 data)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	int max_retries = 10;
+ 	u32 v;
+ 	int i;
+ 
+-	v = 0x80; /* Enable Preamble Sequence */
+-	v |= 0x2; /* MDIO Clock Divisor */
+-	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
+ 
+ 	if (pc->core->id.rev >= 10) {
+ 		max_retries = 200;
+ 		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 28); /* Write Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	if (pc->core->id.rev < 10)
+-		v |= (u32)device << 22;
+-	v |= (u32)address << 18;
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 	v |= data;
+-	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 	/* Wait for the device to complete the transaction */
+ 	udelay(10);
+ 	for (i = 0; i < max_retries; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
+ 			break;
+ 		msleep(1);
+ 	}
+-	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
+ }
+ 
+ /**************************************************
+@@ -138,72 +145,53 @@ static void bcma_pcie_mdio_write(struct
+ 
+ static u8 bcma_pcicore_polarity_workaround(struct bcma_drv_pci *pc)
+ {
+-	return (bcma_pcie_read(pc, 0x204) & 0x10) ? 0xC0 : 0x80;
++	u32 tmp;
++
++	tmp = bcma_pcie_read(pc, BCMA_CORE_PCI_PLP_STATUSREG);
++	if (tmp & BCMA_CORE_PCI_PLP_POLARITYINV_STAT)
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE |
++		       BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY;
++	else
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE;
+ }
+ 
+ static void bcma_pcicore_serdes_workaround(struct bcma_drv_pci *pc)
+ {
+-	const u8 serdes_pll_device = 0x1D;
+-	const u8 serdes_rx_device = 0x1F;
+ 	u16 tmp;
+ 
+-	bcma_pcie_mdio_write(pc, serdes_rx_device, 1 /* Control */,
+-			      bcma_pcicore_polarity_workaround(pc));
+-	tmp = bcma_pcie_mdio_read(pc, serdes_pll_device, 1 /* Control */);
+-	if (tmp & 0x4000)
+-		bcma_pcie_mdio_write(pc, serdes_pll_device, 1, tmp & ~0x4000);
++	bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_RX,
++	                     BCMA_CORE_PCI_SERDES_RX_CTRL,
++			     bcma_pcicore_polarity_workaround(pc));
++	tmp = bcma_pcie_mdio_read(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++	                          BCMA_CORE_PCI_SERDES_PLL_CTRL);
++	if (tmp & BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN)
++		bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++		                     BCMA_CORE_PCI_SERDES_PLL_CTRL,
++		                     tmp & ~BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN);
+ }
+ 
+ /**************************************************
+  * Init.
+  **************************************************/
+ 
+-static void bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
++static void __devinit bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
+ {
+ 	bcma_pcicore_serdes_workaround(pc);
+ }
+ 
+-static bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
+-{
+-	struct bcma_bus *bus = pc->core->bus;
+-	u16 chipid_top;
+-
+-	chipid_top = (bus->chipinfo.id & 0xFF00);
+-	if (chipid_top != 0x4700 &&
+-	    chipid_top != 0x5300)
+-		return false;
+-
+-#ifdef CONFIG_SSB_DRIVER_PCICORE
+-	if (bus->sprom.boardflags_lo & SSB_BFL_NOPCI)
+-		return false;
+-#endif /* CONFIG_SSB_DRIVER_PCICORE */
+-
+-#if 0
+-	/* TODO: on BCMA we use address from EROM instead of magic formula */
+-	u32 tmp;
+-	return !mips_busprobe32(tmp, (bus->mmio +
+-		(pc->core->core_index * BCMA_CORE_SIZE)));
+-#endif
+-
+-	return true;
+-}
+-
+-void bcma_core_pci_init(struct bcma_drv_pci *pc)
++void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
+ {
+ 	if (pc->setup_done)
+ 		return;
+ 
+-	if (bcma_core_pci_is_in_hostmode(pc)) {
+ #ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	pc->hostmode = bcma_core_pci_is_in_hostmode(pc);
++	if (pc->hostmode)
+ 		bcma_core_pci_hostmode_init(pc);
+-#else
+-		pr_err("Driver compiled without support for hostmode PCI\n");
+ #endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
+-	} else {
+-		bcma_core_pci_clientmode_init(pc);
+-	}
+ 
+-	pc->setup_done = true;
++	if (!pc->hostmode)
++		bcma_core_pci_clientmode_init(pc);
+ }
+ 
+ int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
+--- a/drivers/bcma/driver_pci_host.c
++++ b/drivers/bcma/driver_pci_host.c
+@@ -2,13 +2,588 @@
+  * Broadcom specific AMBA
+  * PCI Core in hostmode
+  *
++ * Copyright 2005 - 2011, Broadcom Corporation
++ * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+ 
+ #include "bcma_private.h"
++#include <linux/pci.h>
++#include <linux/export.h>
+ #include <linux/bcma/bcma.h>
++#include <asm/paccess.h>
++
++/* Probe a 32bit value on the bus and catch bus exceptions.
++ * Returns nonzero on a bus exception.
++ * This is MIPS specific */
++#define mips_busprobe32(val, addr)	get_dbe((val), ((u32 *)(addr)))
++
++/* Assume one-hot slot wiring */
++#define BCMA_PCI_SLOT_MAX	16
++#define	PCI_CONFIG_SPACE_SIZE	256
++
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	u16 chipid_top;
++	u32 tmp;
++
++	chipid_top = (bus->chipinfo.id & 0xFF00);
++	if (chipid_top != 0x4700 &&
++	    chipid_top != 0x5300)
++		return false;
++
++	if (bus->sprom.boardflags_lo & BCMA_CORE_PCI_BFL_NOPCI) {
++		pr_info("This PCI core is disabled and not working\n");
++		return false;
++	}
++
++	bcma_core_enable(pc->core, 0);
++
++	return !mips_busprobe32(tmp, pc->core->io_addr);
++}
++
++static u32 bcma_pcie_read_config(struct bcma_drv_pci *pc, u32 address)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_DATA);
++}
++
++static void bcma_pcie_write_config(struct bcma_drv_pci *pc, u32 address,
++				   u32 data)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_DATA, data);
++}
++
++static u32 bcma_get_cfgspace_addr(struct bcma_drv_pci *pc, unsigned int dev,
++			     unsigned int func, unsigned int off)
++{
++	u32 addr = 0;
++
++	/* Issue config commands only when the data link is up (atleast
++	 * one external pcie device is present).
++	 */
++	if (dev >= 2 || !(bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_LSREG)
++			  & BCMA_CORE_PCI_DLLP_LSREG_LINKUP))
++		goto out;
++
++	/* Type 0 transaction */
++	/* Slide the PCI window to the appropriate slot */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++	/* Calculate the address */
++	addr = pc->host_controller->host_cfg_addr;
++	addr |= (dev << BCMA_CORE_PCI_CFG_SLOT_SHIFT);
++	addr |= (func << BCMA_CORE_PCI_CFG_FUN_SHIFT);
++	addr |= (off & ~3);
++
++out:
++	return addr;
++}
+ 
+-void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++static int bcma_extpci_read_config(struct bcma_drv_pci *pc, unsigned int dev,
++				  unsigned int func, unsigned int off,
++				  void *buf, int len)
+ {
+-	pr_err("No support for PCI core in hostmode yet\n");
++	int err = -EINVAL;
++	u32 addr, val;
++	void __iomem *mmio = 0;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* we support only two functions on device 0 */
++		if (func > 1)
++			return -EINVAL;
++
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off >= PCI_CONFIG_SPACE_SIZE) {
++			addr = (func << 12);
++			addr |= (off & 0x0FFF);
++			val = bcma_pcie_read_config(pc, addr);
++		} else {
++			addr = BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			val = pcicore_read32(pc, addr);
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++
++		val = readl(mmio);
++	}
++	val >>= (8 * (off & 3));
++
++	switch (len) {
++	case 1:
++		*((u8 *)buf) = (u8)val;
++		break;
++	case 2:
++		*((u16 *)buf) = (u16)val;
++		break;
++	case 4:
++		*((u32 *)buf) = (u32)val;
++		break;
++	}
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
++				   unsigned int func, unsigned int off,
++				   const void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr = 0, val = 0;
++	void __iomem *mmio = 0;
++	u16 chipid = pc->core->bus->chipinfo.id;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off < PCI_CONFIG_SPACE_SIZE) {
++			addr = pc->core->addr + BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			mmio = ioremap_nocache(addr, len);
++			if (!mmio)
++				goto out;
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, len);
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++	}
++
++	switch (len) {
++	case 1:
++		val = readl(mmio);
++		val &= ~(0xFF << (8 * (off & 3)));
++		val |= *((const u8 *)buf) << (8 * (off & 3));
++		break;
++	case 2:
++		val = readl(mmio);
++		val &= ~(0xFFFF << (8 * (off & 3)));
++		val |= *((const u16 *)buf) << (8 * (off & 3));
++		break;
++	case 4:
++		val = *((const u32 *)buf);
++		break;
++	}
++	if (dev == 0 && !addr) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		addr = (func << 12);
++		addr |= (off & 0x0FFF);
++		bcma_pcie_write_config(pc, addr, val);
++	} else {
++		writel(val, mmio);
++
++		if (chipid == 0x4716 || chipid == 0x4748)
++			readl(mmio);
++	}
++
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_core_pci_hostmode_read_config(struct pci_bus *bus,
++					      unsigned int devfn,
++					      int reg, int size, u32 *val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_read_config(pc, PCI_SLOT(devfn),
++				     PCI_FUNC(devfn), reg, val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++static int bcma_core_pci_hostmode_write_config(struct pci_bus *bus,
++					       unsigned int devfn,
++					       int reg, int size, u32 val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_write_config(pc, PCI_SLOT(devfn),
++				      PCI_FUNC(devfn), reg, &val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++/* return cap_offset if requested capability exists in the PCI config space */
++static u8 __devinit bcma_find_pci_capability(struct bcma_drv_pci *pc,
++					     unsigned int dev,
++					     unsigned int func, u8 req_cap_id,
++					     unsigned char *buf, u32 *buflen)
++{
++	u8 cap_id;
++	u8 cap_ptr = 0;
++	u32 bufsize;
++	u8 byte_val;
++
++	/* check for Header type 0 */
++	bcma_extpci_read_config(pc, dev, func, PCI_HEADER_TYPE, &byte_val,
++				sizeof(u8));
++	if ((byte_val & 0x7f) != PCI_HEADER_TYPE_NORMAL)
++		return cap_ptr;
++
++	/* check if the capability pointer field exists */
++	bcma_extpci_read_config(pc, dev, func, PCI_STATUS, &byte_val,
++				sizeof(u8));
++	if (!(byte_val & PCI_STATUS_CAP_LIST))
++		return cap_ptr;
++
++	/* check if the capability pointer is 0x00 */
++	bcma_extpci_read_config(pc, dev, func, PCI_CAPABILITY_LIST, &cap_ptr,
++				sizeof(u8));
++	if (cap_ptr == 0x00)
++		return cap_ptr;
++
++	/* loop thr'u the capability list and see if the requested capabilty
++	 * exists */
++	bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id, sizeof(u8));
++	while (cap_id != req_cap_id) {
++		bcma_extpci_read_config(pc, dev, func, cap_ptr + 1, &cap_ptr,
++					sizeof(u8));
++		if (cap_ptr == 0x00)
++			return cap_ptr;
++		bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id,
++					sizeof(u8));
++	}
++
++	/* found the caller requested capability */
++	if ((buf != NULL) && (buflen != NULL)) {
++		u8 cap_data;
++
++		bufsize = *buflen;
++		if (!bufsize)
++			return cap_ptr;
++
++		*buflen = 0;
++
++		/* copy the cpability data excluding cap ID and next ptr */
++		cap_data = cap_ptr + 2;
++		if ((bufsize + cap_data)  > PCI_CONFIG_SPACE_SIZE)
++			bufsize = PCI_CONFIG_SPACE_SIZE - cap_data;
++		*buflen = bufsize;
++		while (bufsize--) {
++			bcma_extpci_read_config(pc, dev, func, cap_data, buf,
++						sizeof(u8));
++			cap_data++;
++			buf++;
++		}
++	}
++
++	return cap_ptr;
++}
++
++/* If the root port is capable of returning Config Request
++ * Retry Status (CRS) Completion Status to software then
++ * enable the feature.
++ */
++static void __devinit bcma_core_pci_enable_crs(struct bcma_drv_pci *pc)
++{
++	u8 cap_ptr, root_ctrl, root_cap, dev;
++	u16 val16;
++	int i;
++
++	cap_ptr = bcma_find_pci_capability(pc, 0, 0, PCI_CAP_ID_EXP, NULL,
++					   NULL);
++	root_cap = cap_ptr + PCI_EXP_RTCAP;
++	bcma_extpci_read_config(pc, 0, 0, root_cap, &val16, sizeof(u16));
++	if (val16 & BCMA_CORE_PCI_RC_CRS_VISIBILITY) {
++		/* Enable CRS software visibility */
++		root_ctrl = cap_ptr + PCI_EXP_RTCTL;
++		val16 = PCI_EXP_RTCTL_CRSSVE;
++		bcma_extpci_read_config(pc, 0, 0, root_ctrl, &val16,
++					sizeof(u16));
++
++		/* Initiate a configuration request to read the vendor id
++		 * field of the device function's config space header after
++		 * 100 ms wait time from the end of Reset. If the device is
++		 * not done with its internal initialization, it must at
++		 * least return a completion TLP, with a completion status
++		 * of "Configuration Request Retry Status (CRS)". The root
++		 * complex must complete the request to the host by returning
++		 * a read-data value of 0001h for the Vendor ID field and
++		 * all 1s for any additional bytes included in the request.
++		 * Poll using the config reads for max wait time of 1 sec or
++		 * until we receive the successful completion status. Repeat
++		 * the procedure for all the devices.
++		 */
++		for (dev = 1; dev < BCMA_PCI_SLOT_MAX; dev++) {
++			for (i = 0; i < 100000; i++) {
++				bcma_extpci_read_config(pc, dev, 0,
++							PCI_VENDOR_ID, &val16,
++							sizeof(val16));
++				if (val16 != 0x1)
++					break;
++				udelay(10);
++			}
++			if (val16 == 0x1)
++				pr_err("PCI: Broken device in slot %d\n", dev);
++		}
++	}
++}
++
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	struct bcma_drv_pci_host *pc_host;
++	u32 tmp;
++	u32 pci_membase_1G;
++	unsigned long io_map_base;
++
++	pr_info("PCIEcore in host mode found\n");
++
++	pc_host = kzalloc(sizeof(*pc_host), GFP_KERNEL);
++	if (!pc_host)  {
++		pr_err("can not allocate memory");
++		return;
++	}
++
++	pc->host_controller = pc_host;
++	pc_host->pci_controller.io_resource = &pc_host->io_resource;
++	pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
++	pc_host->pci_controller.pci_ops = &pc_host->pci_ops;
++	pc_host->pdev = pc;
++
++	pci_membase_1G = BCMA_SOC_PCI_DMA;
++	pc_host->host_cfg_addr = BCMA_SOC_PCI_CFG;
++
++	pc_host->pci_ops.read = bcma_core_pci_hostmode_read_config;
++	pc_host->pci_ops.write = bcma_core_pci_hostmode_write_config;
++
++	pc_host->mem_resource.name = "BCMA PCIcore external memory",
++	pc_host->mem_resource.start = BCMA_SOC_PCI_DMA;
++	pc_host->mem_resource.end = BCMA_SOC_PCI_DMA + BCMA_SOC_PCI_DMA_SZ - 1;
++	pc_host->mem_resource.flags = IORESOURCE_MEM | IORESOURCE_PCI_FIXED;
++
++	pc_host->io_resource.name = "BCMA PCIcore external I/O",
++	pc_host->io_resource.start = 0x100;
++	pc_host->io_resource.end = 0x7FF;
++	pc_host->io_resource.flags = IORESOURCE_IO | IORESOURCE_PCI_FIXED;
++
++	/* Reset RC */
++	udelay(3000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST_OE);
++	udelay(1000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST |
++			BCMA_CORE_PCI_CTL_RST_OE);
++
++	/* 64 MB I/O access window. On 4716, use
++	 * sbtopcie0 to access the device registers. We
++	 * can't use address match 2 (1 GB window) region
++	 * as mips can't generate 64-bit address on the
++	 * backplane.
++	 */
++	if (bus->chipinfo.id == 0x4716 || bus->chipinfo.id == 0x4748) {
++		pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++		pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++					    BCMA_SOC_PCI_MEM_SZ - 1;
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_MEM | BCMA_SOC_PCI_MEM);
++	} else if (bus->chipinfo.id == 0x5300) {
++		tmp = BCMA_CORE_PCI_SBTOPCI_MEM;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_PREF;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_BURST;
++		if (pc->core->core_unit == 0) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE_DMA_H32;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI_MEM);
++		} else if (pc->core->core_unit == 1) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI1_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI1_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pci_membase_1G = BCMA_SOC_PCIE1_DMA_H32;
++			pc_host->host_cfg_addr = BCMA_SOC_PCI1_CFG;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI1_MEM);
++		}
++	} else
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_IO);
++
++	/* 64 MB configuration access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++
++	/* 1 GB memory access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI2,
++			BCMA_CORE_PCI_SBTOPCI_MEM | pci_membase_1G);
++
++
++	/* As per PCI Express Base Spec 1.1 we need to wait for
++	 * at least 100 ms from the end of a reset (cold/warm/hot)
++	 * before issuing configuration requests to PCI Express
++	 * devices.
++	 */
++	udelay(100000);
++
++	bcma_core_pci_enable_crs(pc);
++
++	/* Enable PCI bridge BAR0 memory & master access */
++	tmp = PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
++	bcma_extpci_write_config(pc, 0, 0, PCI_COMMAND, &tmp, sizeof(tmp));
++
++	/* Enable PCI interrupts */
++	pcicore_write32(pc, BCMA_CORE_PCI_IMASK, BCMA_CORE_PCI_IMASK_INTA);
++
++	/* Ok, ready to run, register it to the system.
++	 * The following needs change, if we want to port hostmode
++	 * to non-MIPS platform. */
++	io_map_base = (unsigned long)ioremap_nocache(BCMA_SOC_PCI_MEM,
++						     0x04000000);
++	pc_host->pci_controller.io_map_base = io_map_base;
++	set_io_port_base(pc_host->pci_controller.io_map_base);
++	/* Give some time to the PCI controller to configure itself with the new
++	 * values. Not waiting at this point causes crashes of the machine. */
++	mdelay(10);
++	register_pci_controller(&pc_host->pci_controller);
++	return;
++}
++
++/* Early PCI fixup for a device on the PCI-core bridge. */
++static void bcma_core_pci_fixup_pcibridge(struct pci_dev *dev)
++{
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) != 0)
++		return;
++
++	pr_info("PCI: Fixing up bridge %s\n", pci_name(dev));
++
++	/* Enable PCI bridge bus mastering and memory space */
++	pci_set_master(dev);
++	if (pcibios_enable_device(dev, ~0) < 0) {
++		pr_err("PCI: BCMA bridge enable failed\n");
++		return;
++	}
++
++	/* Enable PCI bridge BAR1 prefetch and burst */
++	pci_write_config_dword(dev, BCMA_PCI_BAR1_CONTROL, 3);
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_pcibridge);
++
++/* Early PCI fixup for all PCI-cores to set the correct memory address. */
++static void bcma_core_pci_fixup_addresses(struct pci_dev *dev)
++{
++	struct resource *res;
++	int pos;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) == 0)
++		return;
++
++	pr_info("PCI: Fixing up addresses %s\n", pci_name(dev));
++
++	for (pos = 0; pos < 6; pos++) {
++		res = &dev->resource[pos];
++		if (res->flags & (IORESOURCE_IO | IORESOURCE_MEM))
++			pci_assign_resource(dev, pos);
++	}
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_addresses);
++
++/* This function is called when doing a pci_enable_device().
++ * We must first check if the device is a device on the PCI-core bridge. */
++int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++
++	pr_info("PCI: Fixing up device %s\n", pci_name(dev));
++
++	/* Fix up interrupt lines */
++	dev->irq = bcma_core_mips_irq(pc_host->pdev->core) + 2;
++	pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
++
++	return 0;
++}
++EXPORT_SYMBOL(bcma_core_pci_plat_dev_init);
++
++/* PCI device IRQ mapping. */
++int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++	return bcma_core_mips_irq(pc_host->pdev->core) + 2;
+ }
++EXPORT_SYMBOL(bcma_core_pci_pcibios_map_irq);
+--- a/drivers/bcma/host_pci.c
++++ b/drivers/bcma/host_pci.c
+@@ -154,8 +154,8 @@ const struct bcma_host_ops bcma_host_pci
+ 	.awrite32	= bcma_host_pci_awrite32,
+ };
+ 
+-static int bcma_host_pci_probe(struct pci_dev *dev,
+-			     const struct pci_device_id *id)
++static int __devinit bcma_host_pci_probe(struct pci_dev *dev,
++					 const struct pci_device_id *id)
+ {
+ 	struct bcma_bus *bus;
+ 	int err = -ENOMEM;
+--- a/drivers/bcma/main.c
++++ b/drivers/bcma/main.c
+@@ -13,6 +13,12 @@
+ MODULE_DESCRIPTION("Broadcom's specific AMBA driver");
+ MODULE_LICENSE("GPL");
+ 
++/* contains the number the next bus should get. */
++static unsigned int bcma_bus_next_num = 0;
++
++/* bcma_buses_mutex locks the bcma_bus_next_num */
++static DEFINE_MUTEX(bcma_buses_mutex);
++
+ static int bcma_bus_match(struct device *dev, struct device_driver *drv);
+ static int bcma_device_probe(struct device *dev);
+ static int bcma_device_remove(struct device *dev);
+@@ -55,7 +61,7 @@ static struct bus_type bcma_bus_type = {
+ 	.dev_attrs	= bcma_device_attrs,
+ };
+ 
+-static struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
++struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
+ {
+ 	struct bcma_device *core;
+ 
+@@ -65,6 +71,7 @@ static struct bcma_device *bcma_find_cor
+ 	}
+ 	return NULL;
+ }
++EXPORT_SYMBOL_GPL(bcma_find_core);
+ 
+ static void bcma_release_core_dev(struct device *dev)
+ {
+@@ -93,7 +100,7 @@ static int bcma_register_cores(struct bc
+ 
+ 		core->dev.release = bcma_release_core_dev;
+ 		core->dev.bus = &bcma_bus_type;
+-		dev_set_name(&core->dev, "bcma%d:%d", 0/*bus->num*/, dev_id);
++		dev_set_name(&core->dev, "bcma%d:%d", bus->num, dev_id);
+ 
+ 		switch (bus->hosttype) {
+ 		case BCMA_HOSTTYPE_PCI:
+@@ -132,11 +139,15 @@ static void bcma_unregister_cores(struct
+ 	}
+ }
+ 
+-int bcma_bus_register(struct bcma_bus *bus)
++int __devinit bcma_bus_register(struct bcma_bus *bus)
+ {
+ 	int err;
+ 	struct bcma_device *core;
+ 
++	mutex_lock(&bcma_buses_mutex);
++	bus->num = bcma_bus_next_num++;
++	mutex_unlock(&bcma_buses_mutex);
++
+ 	/* Scan for devices (cores) */
+ 	err = bcma_bus_scan(bus);
+ 	if (err) {
+--- a/drivers/bcma/scan.c
++++ b/drivers/bcma/scan.c
+@@ -212,6 +212,17 @@ static struct bcma_device *bcma_find_cor
+ 	return NULL;
+ }
+ 
++static struct bcma_device *bcma_find_core_reverse(struct bcma_bus *bus, u16 coreid)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry_reverse(core, &bus->cores, list) {
++		if (core->id.id == coreid)
++			return core;
++	}
++	return NULL;
++}
++
+ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
+ 			      struct bcma_device_id *match, int core_num,
+ 			      struct bcma_device *core)
+@@ -353,6 +364,7 @@ static int bcma_get_next_core(struct bcm
+ void bcma_init_bus(struct bcma_bus *bus)
+ {
+ 	s32 tmp;
++	struct bcma_chipinfo *chipinfo = &(bus->chipinfo);
+ 
+ 	if (bus->init_done)
+ 		return;
+@@ -363,9 +375,12 @@ void bcma_init_bus(struct bcma_bus *bus)
+ 	bcma_scan_switch_core(bus, BCMA_ADDR_BASE);
+ 
+ 	tmp = bcma_scan_read32(bus, 0, BCMA_CC_ID);
+-	bus->chipinfo.id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
+-	bus->chipinfo.rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
+-	bus->chipinfo.pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	chipinfo->id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
++	chipinfo->rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
++	chipinfo->pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	pr_info("Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
++		chipinfo->id, chipinfo->rev, chipinfo->pkg);
++
+ 	bus->init_done = true;
+ }
+ 
+@@ -392,6 +407,7 @@ int bcma_bus_scan(struct bcma_bus *bus)
+ 	bcma_scan_switch_core(bus, erombase);
+ 
+ 	while (eromptr < eromend) {
++		struct bcma_device *other_core;
+ 		struct bcma_device *core = kzalloc(sizeof(*core), GFP_KERNEL);
+ 		if (!core)
+ 			return -ENOMEM;
+@@ -414,6 +430,8 @@ int bcma_bus_scan(struct bcma_bus *bus)
+ 
+ 		core->core_index = core_num++;
+ 		bus->nr_cores++;
++		other_core = bcma_find_core_reverse(bus, core->id.id);
++		core->core_unit = (other_core == NULL) ? 0 : other_core->core_unit + 1;
+ 
+ 		pr_info("Core %d found: %s "
+ 			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
+--- a/drivers/bcma/sprom.c
++++ b/drivers/bcma/sprom.c
+@@ -2,6 +2,8 @@
+  * Broadcom specific AMBA
+  * SPROM reading
+  *
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+ 
+@@ -14,7 +16,57 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/slab.h>
+ 
+-#define SPOFF(offset)	((offset) / sizeof(u16))
++static int(*get_fallback_sprom)(struct bcma_bus *dev, struct ssb_sprom *out);
++
++/**
++ * bcma_arch_register_fallback_sprom - Registers a method providing a
++ * fallback SPROM if no SPROM is found.
++ *
++ * @sprom_callback: The callback function.
++ *
++ * With this function the architecture implementation may register a
++ * callback handler which fills the SPROM data structure. The fallback is
++ * used for PCI based BCMA devices, where no valid SPROM can be found
++ * in the shadow registers and to provide the SPROM for SoCs where BCMA is
++ * to controll the system bus.
++ *
++ * This function is useful for weird architectures that have a half-assed
++ * BCMA device hardwired to their PCI bus.
++ *
++ * This function is available for architecture code, only. So it is not
++ * exported.
++ */
++int bcma_arch_register_fallback_sprom(int (*sprom_callback)(struct bcma_bus *bus,
++				     struct ssb_sprom *out))
++{
++	if (get_fallback_sprom)
++		return -EEXIST;
++	get_fallback_sprom = sprom_callback;
++
++	return 0;
++}
++
++static int bcma_fill_sprom_with_fallback(struct bcma_bus *bus,
++					 struct ssb_sprom *out)
++{
++	int err;
++
++	if (!get_fallback_sprom) {
++		err = -ENOENT;
++		goto fail;
++	}
++
++	err = get_fallback_sprom(bus, out);
++	if (err)
++		goto fail;
++
++	pr_debug("Using SPROM revision %d provided by"
++		 " platform.\n", bus->sprom.revision);
++	return 0;
++fail:
++	pr_warn("Using fallback SPROM failed (err %d)\n", err);
++	return err;
++}
+ 
+ /**************************************************
+  * R/W ops.
+@@ -124,10 +176,21 @@ static int bcma_sprom_valid(const u16 *s
+  * SPROM extraction.
+  **************************************************/
+ 
++#define SPOFF(offset)	((offset) / sizeof(u16))
++
++#define SPEX(_field, _offset, _mask, _shift)	\
++	bus->sprom._field = ((sprom[SPOFF(_offset)] & (_mask)) >> (_shift))
++
+ static void bcma_sprom_extract_r8(struct bcma_bus *bus, const u16 *sprom)
+ {
+-	u16 v;
++	u16 v, o;
+ 	int i;
++	u16 pwr_info_offset[] = {
++		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
++		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
++	};
++	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
++			ARRAY_SIZE(bus->sprom.core_pwr_info));
+ 
+ 	bus->sprom.revision = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] &
+ 		SSB_SPROM_REVISION_REV;
+@@ -137,85 +200,229 @@ static void bcma_sprom_extract_r8(struct
+ 		*(((__be16 *)bus->sprom.il0mac) + i) = cpu_to_be16(v);
+ 	}
+ 
+-	bus->sprom.board_rev = sprom[SPOFF(SSB_SPROM8_BOARDREV)];
++	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
+ 
+-	bus->sprom.txpid2g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
+-	     SSB_SPROM4_TXPID2G0) >> SSB_SPROM4_TXPID2G0_SHIFT;
+-	bus->sprom.txpid2g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
+-	     SSB_SPROM4_TXPID2G1) >> SSB_SPROM4_TXPID2G1_SHIFT;
+-	bus->sprom.txpid2g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
+-	     SSB_SPROM4_TXPID2G2) >> SSB_SPROM4_TXPID2G2_SHIFT;
+-	bus->sprom.txpid2g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
+-	     SSB_SPROM4_TXPID2G3) >> SSB_SPROM4_TXPID2G3_SHIFT;
+-
+-	bus->sprom.txpid5gl[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
+-	     SSB_SPROM4_TXPID5GL0) >> SSB_SPROM4_TXPID5GL0_SHIFT;
+-	bus->sprom.txpid5gl[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
+-	     SSB_SPROM4_TXPID5GL1) >> SSB_SPROM4_TXPID5GL1_SHIFT;
+-	bus->sprom.txpid5gl[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
+-	     SSB_SPROM4_TXPID5GL2) >> SSB_SPROM4_TXPID5GL2_SHIFT;
+-	bus->sprom.txpid5gl[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
+-	     SSB_SPROM4_TXPID5GL3) >> SSB_SPROM4_TXPID5GL3_SHIFT;
+-
+-	bus->sprom.txpid5g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
+-	     SSB_SPROM4_TXPID5G0) >> SSB_SPROM4_TXPID5G0_SHIFT;
+-	bus->sprom.txpid5g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
+-	     SSB_SPROM4_TXPID5G1) >> SSB_SPROM4_TXPID5G1_SHIFT;
+-	bus->sprom.txpid5g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
+-	     SSB_SPROM4_TXPID5G2) >> SSB_SPROM4_TXPID5G2_SHIFT;
+-	bus->sprom.txpid5g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
+-	     SSB_SPROM4_TXPID5G3) >> SSB_SPROM4_TXPID5G3_SHIFT;
+-
+-	bus->sprom.txpid5gh[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
+-	     SSB_SPROM4_TXPID5GH0) >> SSB_SPROM4_TXPID5GH0_SHIFT;
+-	bus->sprom.txpid5gh[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
+-	     SSB_SPROM4_TXPID5GH1) >> SSB_SPROM4_TXPID5GH1_SHIFT;
+-	bus->sprom.txpid5gh[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
+-	     SSB_SPROM4_TXPID5GH2) >> SSB_SPROM4_TXPID5GH2_SHIFT;
+-	bus->sprom.txpid5gh[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
+-	     SSB_SPROM4_TXPID5GH3) >> SSB_SPROM4_TXPID5GH3_SHIFT;
+-
+-	bus->sprom.boardflags_lo = sprom[SPOFF(SSB_SPROM8_BFLLO)];
+-	bus->sprom.boardflags_hi = sprom[SPOFF(SSB_SPROM8_BFLHI)];
+-	bus->sprom.boardflags2_lo = sprom[SPOFF(SSB_SPROM8_BFL2LO)];
+-	bus->sprom.boardflags2_hi = sprom[SPOFF(SSB_SPROM8_BFL2HI)];
+-
+-	bus->sprom.country_code = sprom[SPOFF(SSB_SPROM8_CCODE)];
+-
+-	bus->sprom.fem.ghz2.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
+-		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
+-	bus->sprom.fem.ghz2.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
+-		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
+-	bus->sprom.fem.ghz2.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
+-		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
+-	bus->sprom.fem.ghz2.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
+-		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
+-	bus->sprom.fem.ghz2.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
+-		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
+-
+-	bus->sprom.fem.ghz5.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
+-		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
+-	bus->sprom.fem.ghz5.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
+-		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
+-	bus->sprom.fem.ghz5.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
+-		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
+-	bus->sprom.fem.ghz5.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
+-		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
+-	bus->sprom.fem.ghz5.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
+-		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
++	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
++	     SSB_SPROM4_TXPID2G0_SHIFT);
++	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
++	     SSB_SPROM4_TXPID2G1_SHIFT);
++	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
++	     SSB_SPROM4_TXPID2G2_SHIFT);
++	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
++	     SSB_SPROM4_TXPID2G3_SHIFT);
++
++	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
++	     SSB_SPROM4_TXPID5GL0_SHIFT);
++	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
++	     SSB_SPROM4_TXPID5GL1_SHIFT);
++	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
++	     SSB_SPROM4_TXPID5GL2_SHIFT);
++	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
++	     SSB_SPROM4_TXPID5GL3_SHIFT);
++
++	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
++	     SSB_SPROM4_TXPID5G0_SHIFT);
++	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
++	     SSB_SPROM4_TXPID5G1_SHIFT);
++	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
++	     SSB_SPROM4_TXPID5G2_SHIFT);
++	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
++	     SSB_SPROM4_TXPID5G3_SHIFT);
++
++	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
++	     SSB_SPROM4_TXPID5GH0_SHIFT);
++	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
++	     SSB_SPROM4_TXPID5GH1_SHIFT);
++	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
++	     SSB_SPROM4_TXPID5GH2_SHIFT);
++	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
++	     SSB_SPROM4_TXPID5GH3_SHIFT);
++
++	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
++	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
++	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
++	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
++
++	SPEX(country_code, SSB_SPROM8_CCODE, ~0, 0);
++
++	/* Extract cores power info info */
++	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
++		o = pwr_info_offset[i];
++		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_MAXP, 0);
++
++		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
++
++		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GH_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
++
++		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
++	}
++
++	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++
++	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++}
++
++/*
++ * Indicates the presence of external SPROM.
++ */
++static bool bcma_sprom_ext_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 srom_control;
++	u32 present_mask;
++
++	if (bus->drv_cc.core->id.rev >= 31) {
++		if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
++			return false;
++
++		srom_control = bcma_read32(bus->drv_cc.core,
++					   BCMA_CC_SROM_CONTROL);
++		return srom_control & BCMA_CC_SROM_CONTROL_PRESENT;
++	}
++
++	/* older chipcommon revisions use chip status register */
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present_mask = BCMA_CC_CHIPST_4313_SPROM_PRESENT;
++		break;
++
++	case 0x4331:
++		present_mask = BCMA_CC_CHIPST_4331_SPROM_PRESENT;
++		break;
++
++	default:
++		return true;
++	}
++
++	return chip_status & present_mask;
++}
++
++/*
++ * Indicates that on-chip OTP memory is present and enabled.
++ */
++static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 otpsize = 0;
++	bool present;
++
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case 0x4313:
++		present = chip_status & BCMA_CC_CHIPST_4313_OTP_PRESENT;
++		break;
++
++	case 0x4331:
++		present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
++		break;
++
++	case 43224:
++	case 43225:
++		/* for these chips OTP is always available */
++		present = true;
++		break;
++
++	default:
++		present = false;
++		break;
++	}
++
++	if (present) {
++		otpsize = bus->drv_cc.capabilities & BCMA_CC_CAP_OTPS;
++		otpsize >>= BCMA_CC_CAP_OTPS_SHIFT;
++	}
++
++	return otpsize != 0;
++}
++
++/*
++ * Verify OTP is filled and determine the byte
++ * offset where SPROM data is located.
++ *
++ * On error, returns 0; byte offset otherwise.
++ */
++static int bcma_sprom_onchip_offset(struct bcma_bus *bus)
++{
++	struct bcma_device *cc = bus->drv_cc.core;
++	u32 offset;
++
++	/* verify OTP status */
++	if ((bcma_read32(cc, BCMA_CC_OTPS) & BCMA_CC_OTPS_GU_PROG_HW) == 0)
++		return 0;
++
++	/* obtain bit offset from otplayout register */
++	offset = (bcma_read32(cc, BCMA_CC_OTPL) & BCMA_CC_OTPL_GURGN_OFFSET);
++	return BCMA_CC_SPROM + (offset >> 3);
+ }
+ 
+ int bcma_sprom_get(struct bcma_bus *bus)
+ {
+-	u16 offset;
++	u16 offset = BCMA_CC_SPROM;
+ 	u16 *sprom;
+ 	int err = 0;
+ 
+ 	if (!bus->drv_cc.core)
+ 		return -EOPNOTSUPP;
+ 
+-	if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
+-		return -ENOENT;
++	if (!bcma_sprom_ext_available(bus)) {
++		/*
++		 * External SPROM takes precedence so check
++		 * on-chip OTP only when no external SPROM
++		 * is present.
++		 */
++		if (bcma_sprom_onchip_available(bus)) {
++			/* determine offset */
++			offset = bcma_sprom_onchip_offset(bus);
++		}
++		if (!offset) {
++			/*
++			 * Maybe there is no SPROM on the device?
++			 * Now we ask the arch code if there is some sprom
++			 * available for this device in some other storage.
++			 */
++			err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
++			return err;
++		}
++	}
+ 
+ 	sprom = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
+ 			GFP_KERNEL);
+@@ -225,11 +432,7 @@ int bcma_sprom_get(struct bcma_bus *bus)
+ 	if (bus->chipinfo.id == 0x4331)
+ 		bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
+ 
+-	/* Most cards have SPROM moved by additional offset 0x30 (48 dwords).
+-	 * According to brcm80211 this applies to cards with PCIe rev >= 6
+-	 * TODO: understand this condition and use it */
+-	offset = (bus->chipinfo.id == 0x4331) ? BCMA_CC_SPROM :
+-		BCMA_CC_SPROM_PCIE6;
++	pr_debug("SPROM offset 0x%x\n", offset);
+ 	bcma_sprom_read(bus, offset, sprom);
+ 
+ 	if (bus->chipinfo.id == 0x4331)
+--- a/include/linux/bcma/bcma.h
++++ b/include/linux/bcma/bcma.h
+@@ -136,6 +136,7 @@ struct bcma_device {
+ 	bool dev_registered;
+ 
+ 	u8 core_index;
++	u8 core_unit;
+ 
+ 	u32 addr;
+ 	u32 wrap;
+@@ -175,6 +176,12 @@ int __bcma_driver_register(struct bcma_d
+ 
+ extern void bcma_driver_unregister(struct bcma_driver *drv);
+ 
++/* Set a fallback SPROM.
++ * See kdoc at the function definition for complete documentation. */
++extern int bcma_arch_register_fallback_sprom(
++		int (*sprom_callback)(struct bcma_bus *bus,
++		struct ssb_sprom *out));
++
+ struct bcma_bus {
+ 	/* The MMIO area. */
+ 	void __iomem *mmio;
+@@ -195,6 +202,7 @@ struct bcma_bus {
+ 	struct list_head cores;
+ 	u8 nr_cores;
+ 	u8 init_done:1;
++	u8 num;
+ 
+ 	struct bcma_drv_cc drv_cc;
+ 	struct bcma_drv_pci drv_pci;
+@@ -282,6 +290,7 @@ static inline void bcma_maskset16(struct
+ 	bcma_write16(cc, offset, (bcma_read16(cc, offset) & mask) | set);
+ }
+ 
++extern struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid);
+ extern bool bcma_core_is_enabled(struct bcma_device *core);
+ extern void bcma_core_disable(struct bcma_device *core, u32 flags);
+ extern int bcma_core_enable(struct bcma_device *core, u32 flags);
+--- a/include/linux/bcma/bcma_driver_chipcommon.h
++++ b/include/linux/bcma/bcma_driver_chipcommon.h
+@@ -56,6 +56,9 @@
+ #define	 BCMA_CC_OTPS_HW_PROTECT	0x00000001
+ #define	 BCMA_CC_OTPS_SW_PROTECT	0x00000002
+ #define	 BCMA_CC_OTPS_CID_PROTECT	0x00000004
++#define  BCMA_CC_OTPS_GU_PROG_IND	0x00000F00	/* General Use programmed indication */
++#define  BCMA_CC_OTPS_GU_PROG_IND_SHIFT	8
++#define  BCMA_CC_OTPS_GU_PROG_HW	0x00000100	/* HW region programmed */
+ #define BCMA_CC_OTPC			0x0014		/* OTP control */
+ #define	 BCMA_CC_OTPC_RECWAIT		0xFF000000
+ #define	 BCMA_CC_OTPC_PROGWAIT		0x00FFFF00
+@@ -72,6 +75,8 @@
+ #define	 BCMA_CC_OTPP_READ		0x40000000
+ #define	 BCMA_CC_OTPP_START		0x80000000
+ #define	 BCMA_CC_OTPP_BUSY		0x80000000
++#define BCMA_CC_OTPL			0x001C		/* OTP layout */
++#define  BCMA_CC_OTPL_GURGN_OFFSET	0x00000FFF	/* offset of general use region */
+ #define BCMA_CC_IRQSTAT			0x0020
+ #define BCMA_CC_IRQMASK			0x0024
+ #define	 BCMA_CC_IRQ_GPIO		0x00000001	/* gpio intr */
+@@ -79,6 +84,10 @@
+ #define	 BCMA_CC_IRQ_WDRESET		0x80000000	/* watchdog reset occurred */
+ #define BCMA_CC_CHIPCTL			0x0028		/* Rev >= 11 only */
+ #define BCMA_CC_CHIPSTAT		0x002C		/* Rev >= 11 only */
++#define  BCMA_CC_CHIPST_4313_SPROM_PRESENT	1
++#define  BCMA_CC_CHIPST_4313_OTP_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_SPROM_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_OTP_PRESENT	4
+ #define BCMA_CC_JCMD			0x0030		/* Rev >= 10 only */
+ #define  BCMA_CC_JCMD_START		0x80000000
+ #define  BCMA_CC_JCMD_BUSY		0x80000000
+@@ -181,6 +190,22 @@
+ #define BCMA_CC_FLASH_CFG		0x0128
+ #define  BCMA_CC_FLASH_CFG_DS		0x0010	/* Data size, 0=8bit, 1=16bit */
+ #define BCMA_CC_FLASH_WAITCNT		0x012C
++#define BCMA_CC_SROM_CONTROL		0x0190
++#define  BCMA_CC_SROM_CONTROL_START	0x80000000
++#define  BCMA_CC_SROM_CONTROL_BUSY	0x80000000
++#define  BCMA_CC_SROM_CONTROL_OPCODE	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OP_READ	0x00000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRITE	0x20000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRDIS	0x40000000
++#define  BCMA_CC_SROM_CONTROL_OP_WREN	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OTPSEL	0x00000010
++#define  BCMA_CC_SROM_CONTROL_LOCK	0x00000008
++#define  BCMA_CC_SROM_CONTROL_SIZE_MASK	0x00000006
++#define  BCMA_CC_SROM_CONTROL_SIZE_1K	0x00000000
++#define  BCMA_CC_SROM_CONTROL_SIZE_4K	0x00000002
++#define  BCMA_CC_SROM_CONTROL_SIZE_16K	0x00000004
++#define  BCMA_CC_SROM_CONTROL_SIZE_SHIFT	1
++#define  BCMA_CC_SROM_CONTROL_PRESENT	0x00000001
+ /* 0x1E0 is defined as shared BCMA_CLKCTLST */
+ #define BCMA_CC_HW_WORKAROUND		0x01E4 /* Hardware workaround (rev >= 20) */
+ #define BCMA_CC_UART0_DATA		0x0300
+@@ -240,7 +265,6 @@
+ #define BCMA_CC_PLLCTL_ADDR		0x0660
+ #define BCMA_CC_PLLCTL_DATA		0x0664
+ #define BCMA_CC_SPROM			0x0800 /* SPROM beginning */
+-#define BCMA_CC_SPROM_PCIE6		0x0830 /* SPROM beginning on PCIe rev >= 6 */
+ 
+ /* Divider allocation in 4716/47162/5356 */
+ #define BCMA_CC_PMU5_MAINPLL_CPU	1
+--- a/include/linux/bcma/bcma_driver_pci.h
++++ b/include/linux/bcma/bcma_driver_pci.h
+@@ -53,6 +53,35 @@ struct pci_dev;
+ #define  BCMA_CORE_PCI_SBTOPCI1_MASK		0xFC000000
+ #define BCMA_CORE_PCI_SBTOPCI2			0x0108	/* Backplane to PCI translation 2 (sbtopci2) */
+ #define  BCMA_CORE_PCI_SBTOPCI2_MASK		0xC0000000
++#define BCMA_CORE_PCI_CONFIG_ADDR		0x0120	/* pcie config space access */
++#define BCMA_CORE_PCI_CONFIG_DATA		0x0124	/* pcie config space access */
++#define BCMA_CORE_PCI_MDIO_CONTROL		0x0128	/* controls the mdio access */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_MASK	0x7f	/* clock to be used on MDIO */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL	0x2
++#define  BCMA_CORE_PCI_MDIOCTL_PREAM_EN		0x80	/* Enable preamble sequnce */
++#define  BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE	0x100	/* Tranaction complete */
++#define BCMA_CORE_PCI_MDIO_DATA			0x012c	/* Data to the mdio access */
++#define  BCMA_CORE_PCI_MDIODATA_MASK		0x0000ffff /* data 2 bytes */
++#define  BCMA_CORE_PCI_MDIODATA_TA		0x00020000 /* Turnaround */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD	18	/* Regaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK_OLD	0x003c0000 /* Regaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD	22	/* Physmedia devaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK_OLD	0x0fc00000 /* Physmedia devaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF	18	/* Regaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK	0x007c0000 /* Regaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF	23	/* Physmedia devaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK	0x0f800000 /* Physmedia devaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_WRITE		0x10000000 /* write Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_READ		0x20000000 /* Read Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_START		0x40000000 /* start of Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_ADDR	0x0	/* dev address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_BLK_ADDR	0x1F	/* blk address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_PLL		0x1d	/* SERDES PLL Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_TX		0x1e	/* SERDES TX Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_RX		0x1f	/* SERDES RX Dev */
++#define BCMA_CORE_PCI_PCIEIND_ADDR		0x0130	/* indirect access to the internal register */
++#define BCMA_CORE_PCI_PCIEIND_DATA		0x0134	/* Data to/from the internal regsiter */
++#define BCMA_CORE_PCI_CLKREQENCTRL		0x0138	/*  >= rev 6, Clkreq rdma control */
+ #define BCMA_CORE_PCI_PCICFG0			0x0400	/* PCI config space 0 (rev >= 8) */
+ #define BCMA_CORE_PCI_PCICFG1			0x0500	/* PCI config space 1 (rev >= 8) */
+ #define BCMA_CORE_PCI_PCICFG2			0x0600	/* PCI config space 2 (rev >= 8) */
+@@ -72,20 +101,114 @@ struct pci_dev;
+ #define  BCMA_CORE_PCI_SBTOPCI_RC_READL		0x00000010 /* Memory read line */
+ #define  BCMA_CORE_PCI_SBTOPCI_RC_READM		0x00000020 /* Memory read multiple */
+ 
++/* PCIE protocol PHY diagnostic registers */
++#define BCMA_CORE_PCI_PLP_MODEREG		0x200	/* Mode */
++#define BCMA_CORE_PCI_PLP_STATUSREG		0x204	/* Status */
++#define  BCMA_CORE_PCI_PLP_POLARITYINV_STAT	0x10	/* Status reg PCIE_PLP_STATUSREG */
++#define BCMA_CORE_PCI_PLP_LTSSMCTRLREG		0x208	/* LTSSM control */
++#define BCMA_CORE_PCI_PLP_LTLINKNUMREG		0x20c	/* Link Training Link number */
++#define BCMA_CORE_PCI_PLP_LTLANENUMREG		0x210	/* Link Training Lane number */
++#define BCMA_CORE_PCI_PLP_LTNFTSREG		0x214	/* Link Training N_FTS */
++#define BCMA_CORE_PCI_PLP_ATTNREG		0x218	/* Attention */
++#define BCMA_CORE_PCI_PLP_ATTNMASKREG		0x21C	/* Attention Mask */
++#define BCMA_CORE_PCI_PLP_RXERRCTR		0x220	/* Rx Error */
++#define BCMA_CORE_PCI_PLP_RXFRMERRCTR		0x224	/* Rx Framing Error */
++#define BCMA_CORE_PCI_PLP_RXERRTHRESHREG	0x228	/* Rx Error threshold */
++#define BCMA_CORE_PCI_PLP_TESTCTRLREG		0x22C	/* Test Control reg */
++#define BCMA_CORE_PCI_PLP_SERDESCTRLOVRDREG	0x230	/* SERDES Control Override */
++#define BCMA_CORE_PCI_PLP_TIMINGOVRDREG		0x234	/* Timing param override */
++#define BCMA_CORE_PCI_PLP_RXTXSMDIAGREG		0x238	/* RXTX State Machine Diag */
++#define BCMA_CORE_PCI_PLP_LTSSMDIAGREG		0x23C	/* LTSSM State Machine Diag */
++
++/* PCIE protocol DLLP diagnostic registers */
++#define BCMA_CORE_PCI_DLLP_LCREG		0x100	/* Link Control */
++#define BCMA_CORE_PCI_DLLP_LSREG		0x104	/* Link Status */
++#define BCMA_CORE_PCI_DLLP_LAREG		0x108	/* Link Attention */
++#define  BCMA_CORE_PCI_DLLP_LSREG_LINKUP	(1 << 16)
++#define BCMA_CORE_PCI_DLLP_LAMASKREG		0x10C	/* Link Attention Mask */
++#define BCMA_CORE_PCI_DLLP_NEXTTXSEQNUMREG	0x110	/* Next Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_ACKEDTXSEQNUMREG	0x114	/* Acked Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_PURGEDTXSEQNUMREG	0x118	/* Purged Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_RXSEQNUMREG		0x11C	/* Rx Sequence Number */
++#define BCMA_CORE_PCI_DLLP_LRREG		0x120	/* Link Replay */
++#define BCMA_CORE_PCI_DLLP_LACKTOREG		0x124	/* Link Ack Timeout */
++#define BCMA_CORE_PCI_DLLP_PMTHRESHREG		0x128	/* Power Management Threshold */
++#define BCMA_CORE_PCI_DLLP_RTRYWPREG		0x12C	/* Retry buffer write ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYRPREG		0x130	/* Retry buffer Read ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYPPREG		0x134	/* Retry buffer Purged ptr */
++#define BCMA_CORE_PCI_DLLP_RTRRWREG		0x138	/* Retry buffer Read/Write */
++#define BCMA_CORE_PCI_DLLP_ECTHRESHREG		0x13C	/* Error Count Threshold */
++#define BCMA_CORE_PCI_DLLP_TLPERRCTRREG		0x140	/* TLP Error Counter */
++#define BCMA_CORE_PCI_DLLP_ERRCTRREG		0x144	/* Error Counter */
++#define BCMA_CORE_PCI_DLLP_NAKRXCTRREG		0x148	/* NAK Received Counter */
++#define BCMA_CORE_PCI_DLLP_TESTREG		0x14C	/* Test */
++#define BCMA_CORE_PCI_DLLP_PKTBIST		0x150	/* Packet BIST */
++#define BCMA_CORE_PCI_DLLP_PCIE11		0x154	/* DLLP PCIE 1.1 reg */
++
++/* SERDES RX registers */
++#define BCMA_CORE_PCI_SERDES_RX_CTRL		1	/* Rx cntrl */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE	0x80	/* rxpolarity_force */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY	0x40	/* rxpolarity_value */
++#define BCMA_CORE_PCI_SERDES_RX_TIMER1		2	/* Rx Timer1 */
++#define BCMA_CORE_PCI_SERDES_RX_CDR		6	/* CDR */
++#define BCMA_CORE_PCI_SERDES_RX_CDRBW		7	/* CDR BW */
++
++/* SERDES PLL registers */
++#define BCMA_CORE_PCI_SERDES_PLL_CTRL		1	/* PLL control reg */
++#define BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN	0x4000	/* bit 14 is FREQDET on */
++
+ /* PCIcore specific boardflags */
+ #define BCMA_CORE_PCI_BFL_NOPCI			0x00000400 /* Board leaves PCI floating */
+ 
++/* PCIE Config space accessing MACROS */
++#define BCMA_CORE_PCI_CFG_BUS_SHIFT		24	/* Bus shift */
++#define BCMA_CORE_PCI_CFG_SLOT_SHIFT		19	/* Slot/Device shift */
++#define BCMA_CORE_PCI_CFG_FUN_SHIFT		16	/* Function shift */
++#define BCMA_CORE_PCI_CFG_OFF_SHIFT		0	/* Register shift */
++
++#define BCMA_CORE_PCI_CFG_BUS_MASK		0xff	/* Bus mask */
++#define BCMA_CORE_PCI_CFG_SLOT_MASK		0x1f	/* Slot/Device mask */
++#define BCMA_CORE_PCI_CFG_FUN_MASK		7	/* Function mask */
++#define BCMA_CORE_PCI_CFG_OFF_MASK		0xfff	/* Register mask */
++
++/* PCIE Root Capability Register bits (Host mode only) */
++#define BCMA_CORE_PCI_RC_CRS_VISIBILITY		0x0001
++
++struct bcma_drv_pci;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++struct bcma_drv_pci_host {
++	struct bcma_drv_pci *pdev;
++
++	u32 host_cfg_addr;
++	spinlock_t cfgspace_lock;
++
++	struct pci_controller pci_controller;
++	struct pci_ops pci_ops;
++	struct resource mem_resource;
++	struct resource io_resource;
++};
++#endif
++
+ struct bcma_drv_pci {
+ 	struct bcma_device *core;
+ 	u8 setup_done:1;
++	u8 hostmode:1;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	struct bcma_drv_pci_host *host_controller;
++#endif
+ };
+ 
+ /* Register access */
+ #define pcicore_read32(pc, offset)		bcma_read32((pc)->core, offset)
+ #define pcicore_write32(pc, offset, val)	bcma_write32((pc)->core, offset, val)
+ 
+-extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
++extern void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc);
+ extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
+ 				 struct bcma_device *core, bool enable);
+ 
++extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
++extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
++
+ #endif /* LINUX_BCMA_DRIVER_PCI_H_ */
+--- a/include/linux/bcma/bcma_regs.h
++++ b/include/linux/bcma/bcma_regs.h
+@@ -56,4 +56,31 @@
+ #define  BCMA_PCI_GPIO_XTAL		0x40	/* PCI config space GPIO 14 for Xtal powerup */
+ #define  BCMA_PCI_GPIO_PLL		0x80	/* PCI config space GPIO 15 for PLL powerdown */
+ 
++/* SiliconBackplane Address Map.
++ * All regions may not exist on all chips.
++ */
++#define BCMA_SOC_SDRAM_BASE		0x00000000U	/* Physical SDRAM */
++#define BCMA_SOC_PCI_MEM		0x08000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI_MEM_SZ		(64 * 1024 * 1024)
++#define BCMA_SOC_PCI_CFG		0x0c000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_SDRAM_SWAPPED		0x10000000U	/* Byteswapped Physical SDRAM */
++#define BCMA_SOC_SDRAM_R2		0x80000000U	/* Region 2 for sdram (512 MB) */
++
++
++#define BCMA_SOC_PCI_DMA		0x40000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA2		0x80000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA_SZ		0x40000000U	/* Client Mode sb2pcitranslation2 size in bytes */
++#define BCMA_SOC_PCIE_DMA_L32		0x00000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), low 32 bits
++							 */
++#define BCMA_SOC_PCIE_DMA_H32		0x80000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
++#define BCMA_SOC_PCI1_MEM		0x40000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI1_CFG		0x44000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_PCIE1_DMA_H32		0xc0000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
+ #endif /* LINUX_BCMA_REGS_H_ */