brcm47xx: remove support for old kernel versions

SVN-Revision: 24168
2010-11-28 14:08:04 +00:00 · 2010-11-28 14:08:04 +00:00 · af2349b4bc
commit af2349b4bc
parent 6f58cc20fc
68 changed files with 0 additions and 7629 deletions
--- a/target/linux/brcm47xx/config-2.6.32
+++ b/target/linux/brcm47xx/config-2.6.32
@ -1,183 +0,0 @@
 CONFIG_32BIT=y
 # CONFIG_64BIT is not set
 # CONFIG_ALCHEMY_GPIO_INDIRECT is not set
 # CONFIG_AR7 is not set
 # CONFIG_ARCH_HAS_ILOG2_U32 is not set
 # CONFIG_ARCH_HAS_ILOG2_U64 is not set
 CONFIG_ARCH_HIBERNATION_POSSIBLE=y
 CONFIG_ARCH_POPULATES_NODE_MAP=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
 CONFIG_ARCH_SUPPORTS_OPROFILE=y
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
 # CONFIG_ARPD is not set
 CONFIG_B44_PCI_AUTOSELECT=y
 CONFIG_B44_PCICORE_AUTOSELECT=y
 CONFIG_B44_PCI=y
 CONFIG_B44=y
 CONFIG_BCM47XX_WDT=y
 CONFIG_BCM47XX=y
 # CONFIG_BCM63XX is not set
 # CONFIG_BINARY_PRINTF is not set
 CONFIG_BITREVERSE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_CAVIUM_OCTEON_REFERENCE_BOARD is not set
 # CONFIG_CAVIUM_OCTEON_SIMULATOR is not set
 CONFIG_CEVT_R4K_LIB=y
 CONFIG_CEVT_R4K=y
 CONFIG_CFE=y
 CONFIG_CMDLINE="root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200"
 # CONFIG_CPU_BIG_ENDIAN is not set
 # CONFIG_CPU_CAVIUM_OCTEON is not set
 CONFIG_CPU_HAS_LLSC=y
 CONFIG_CPU_HAS_PREFETCH=y
 CONFIG_CPU_HAS_SYNC=y
 CONFIG_CPU_LITTLE_ENDIAN=y
 # CONFIG_CPU_LOONGSON2E is not set
 # CONFIG_CPU_LOONGSON2 is not set
 CONFIG_CPU_MIPS32_R1=y
 # CONFIG_CPU_MIPS32_R2 is not set
 CONFIG_CPU_MIPS32=y
 # CONFIG_CPU_MIPS64_R1 is not set
 # CONFIG_CPU_MIPS64_R2 is not set
 CONFIG_CPU_MIPSR1=y
 # CONFIG_CPU_NEVADA is not set
 # CONFIG_CPU_R10000 is not set
 # CONFIG_CPU_R3000 is not set
 # CONFIG_CPU_R4300 is not set
 # CONFIG_CPU_R4X00 is not set
 # CONFIG_CPU_R5000 is not set
 # CONFIG_CPU_R5432 is not set
 # CONFIG_CPU_R5500 is not set
 # CONFIG_CPU_R6000 is not set
 # CONFIG_CPU_R8000 is not set
 # CONFIG_CPU_RM7000 is not set
 # CONFIG_CPU_RM9000 is not set
 # CONFIG_CPU_SB1 is not set
 CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
 CONFIG_CPU_SUPPORTS_HIGHMEM=y
 # CONFIG_CPU_TX39XX is not set
 # CONFIG_CPU_TX49XX is not set
 # CONFIG_CPU_VR41XX is not set
 CONFIG_CRYPTO_AEAD2=y
 CONFIG_CRYPTO_BLKCIPHER2=y
 CONFIG_CRYPTO_HASH2=y
 CONFIG_CRYPTO_MANAGER2=y
 CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_WORKQUEUE=y
 CONFIG_CSRC_R4K_LIB=y
 CONFIG_CSRC_R4K=y
 CONFIG_DECOMPRESS_LZMA=y
 CONFIG_DEVPORT=y
 CONFIG_DM_LOG_USERSPACE=n
 # CONFIG_DM9000 is not set
 CONFIG_DMA_NEED_PCI_MAP_STATE=y
 CONFIG_DMA_NONCOHERENT=y
 # CONFIG_FSNOTIFY is not set
 CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
 CONFIG_GENERIC_FIND_LAST_BIT=y
 CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_GENERIC_GPIO=y
 CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
 CONFIG_HARDWARE_WATCHPOINTS=y
 CONFIG_HAS_DMA=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
 CONFIG_HAVE_ARCH_KGDB=y
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_HAVE_GENERIC_DMA_COHERENT=y
 CONFIG_HAVE_IDE=y
 CONFIG_HAVE_MLOCK=y
 CONFIG_HAVE_OPROFILE=y
 CONFIG_HW_HAS_PCI=y
 CONFIG_HW_RANDOM=y
 # CONFIG_HZ_100 is not set
 CONFIG_HZ=250
 CONFIG_HZ_250=y
 CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_IP_ROUTE_VERBOSE is not set
 CONFIG_IRQ_CPU=y
 CONFIG_KALLSYMS=y
 CONFIG_LEDS_GPIO=y
 # CONFIG_LEMOTE_FULONG is not set
 # CONFIG_MACH_ALCHEMY is not set
 # CONFIG_MACH_DECSTATION is not set
 # CONFIG_MACH_JAZZ is not set
 # CONFIG_MACH_LOONGSON is not set
 # CONFIG_MACH_TX39XX is not set
 # CONFIG_MACH_TX49XX is not set
 # CONFIG_MACH_VR41XX is not set
 # CONFIG_MIKROTIK_RB532 is not set
 # CONFIG_MIPS_COBALT is not set
 CONFIG_MIPS_L1_CACHE_SHIFT=5
 # CONFIG_MIPS_MACHINE is not set
 # CONFIG_MIPS_MALTA is not set
 CONFIG_MIPS_MT_DISABLED=y
 # CONFIG_MIPS_MT_SMP is not set
 # CONFIG_MIPS_MT_SMTC is not set
 # CONFIG_MIPS_SIM is not set
 CONFIG_MIPS=y
 CONFIG_MTD_BCM47XX=y
 # CONFIG_NO_IOPORT is not set
 # CONFIG_NXP_STB220 is not set
 # CONFIG_NXP_STB225 is not set
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_PCI=y
 CONFIG_PCI_DOMAINS=y
 CONFIG_PHYLIB=y
 # CONFIG_PMC_MSP is not set
 # CONFIG_PMC_YOSEMITE is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_PROBE_INITRD_HEADER is not set
 # CONFIG_PROC_KCORE is not set
 CONFIG_SCHED_OMIT_FRAME_POINTER=y
 # CONFIG_SCSI_DMA is not set
 # CONFIG_SERIAL_8250_DETECT_IRQ is not set
 CONFIG_SERIAL_8250_EXTENDED=y
 # CONFIG_SERIAL_8250_MANY_PORTS is not set
 # CONFIG_SERIAL_8250_RSA is not set
 CONFIG_SERIAL_8250_SHARE_IRQ=y
 # CONFIG_SGI_IP22 is not set
 # CONFIG_SGI_IP27 is not set
 # CONFIG_SGI_IP28 is not set
 # CONFIG_SGI_IP32 is not set
 # CONFIG_SIBYTE_BIGSUR is not set
 # CONFIG_SIBYTE_CARMEL is not set
 # CONFIG_SIBYTE_CRHINE is not set
 # CONFIG_SIBYTE_CRHONE is not set
 # CONFIG_SIBYTE_LITTLESUR is not set
 # CONFIG_SIBYTE_RHONE is not set
 # CONFIG_SIBYTE_SENTOSA is not set
 # CONFIG_SIBYTE_SWARM is not set
 # CONFIG_SLOW_WORK is not set
 CONFIG_SSB_B43_PCI_BRIDGE=y
 CONFIG_SSB_DEBUG=y
 CONFIG_SSB_DRIVER_EXTIF=y
 CONFIG_SSB_DRIVER_GIGE=y
 CONFIG_SSB_DRIVER_MIPS=y
 CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y
 CONFIG_SSB_DRIVER_PCICORE=y
 CONFIG_SSB_EMBEDDED=y
 CONFIG_SSB_PCICORE_HOSTMODE=y
 CONFIG_SSB_PCIHOST_POSSIBLE=y
 CONFIG_SSB_PCIHOST=y
 CONFIG_SSB_SERIAL=y
 CONFIG_SSB_SPROM=y
 CONFIG_SSB=y
 CONFIG_SYS_HAS_CPU_MIPS32_R1=y
 CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
 CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
 CONFIG_SYS_SUPPORTS_LITTLE_ENDIAN=y
 # CONFIG_TC35815 is not set
 CONFIG_TRACING_SUPPORT=y
 CONFIG_TRAD_SIGNALS=y
 # CONFIG_TREE_PREEMPT_RCU is not set
 CONFIG_TREE_RCU=y
 CONFIG_USB_EHCI_HCD_SSB=y
 CONFIG_USB_OHCI_HCD_SSB=y
 CONFIG_USB_SUPPORT=y
 CONFIG_WATCHDOG_NOWAYOUT=y
 CONFIG_ZONE_DMA_FLAG=0
--- a/target/linux/brcm47xx/config-2.6.35
+++ b/target/linux/brcm47xx/config-2.6.35
@ -1,180 +0,0 @@
 CONFIG_32BIT=y
 # CONFIG_64BIT is not set
 # CONFIG_ALCHEMY_GPIO_INDIRECT is not set
 # CONFIG_AR7 is not set
 # CONFIG_ARCH_HAS_ILOG2_U32 is not set
 # CONFIG_ARCH_HAS_ILOG2_U64 is not set
 CONFIG_ARCH_HIBERNATION_POSSIBLE=y
 # CONFIG_ARCH_PHYS_ADDR_T_64BIT is not set
 CONFIG_ARCH_POPULATES_NODE_MAP=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
 CONFIG_ARCH_SUPPORTS_OPROFILE=y
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
 # CONFIG_ARPD is not set
 CONFIG_B44=y
 CONFIG_B44_PCI=y
 CONFIG_B44_PCICORE_AUTOSELECT=y
 CONFIG_B44_PCI_AUTOSELECT=y
 CONFIG_BCM47XX=y
 CONFIG_BCM47XX_WDT=y
 # CONFIG_BCM63XX is not set
 CONFIG_BITREVERSE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_BUG is not set
 # CONFIG_CAVIUM_OCTEON_REFERENCE_BOARD is not set
 # CONFIG_CAVIUM_OCTEON_SIMULATOR is not set
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_CEVT_R4K=y
 CONFIG_CEVT_R4K_LIB=y
 CONFIG_CFE=y
 CONFIG_CMDLINE="root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200"
 CONFIG_CMDLINE_BOOL=y
 # CONFIG_CMDLINE_OVERRIDE is not set
 # CONFIG_CPU_BIG_ENDIAN is not set
 # CONFIG_CPU_CAVIUM_OCTEON is not set
 CONFIG_CPU_HAS_PREFETCH=y
 CONFIG_CPU_HAS_SYNC=y
 CONFIG_CPU_LITTLE_ENDIAN=y
 # CONFIG_CPU_LOONGSON2E is not set
 # CONFIG_CPU_LOONGSON2F is not set
 CONFIG_CPU_MIPS32=y
 CONFIG_CPU_MIPS32_R1=y
 # CONFIG_CPU_MIPS32_R2 is not set
 # CONFIG_CPU_MIPS64_R1 is not set
 # CONFIG_CPU_MIPS64_R2 is not set
 CONFIG_CPU_MIPSR1=y
 # CONFIG_CPU_NEVADA is not set
 # CONFIG_CPU_R10000 is not set
 # CONFIG_CPU_R3000 is not set
 # CONFIG_CPU_R4300 is not set
 # CONFIG_CPU_R4X00 is not set
 # CONFIG_CPU_R5000 is not set
 # CONFIG_CPU_R5432 is not set
 # CONFIG_CPU_R5500 is not set
 # CONFIG_CPU_R6000 is not set
 # CONFIG_CPU_R8000 is not set
 # CONFIG_CPU_RM7000 is not set
 # CONFIG_CPU_RM9000 is not set
 # CONFIG_CPU_SB1 is not set
 CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
 CONFIG_CPU_SUPPORTS_HIGHMEM=y
 # CONFIG_CPU_TX39XX is not set
 # CONFIG_CPU_TX49XX is not set
 # CONFIG_CPU_VR41XX is not set
 CONFIG_CSRC_R4K=y
 CONFIG_CSRC_R4K_LIB=y
 CONFIG_DECOMPRESS_LZMA=y
 CONFIG_DEVPORT=y
 # CONFIG_DM9000 is not set
 CONFIG_DMA_NONCOHERENT=y
 # CONFIG_FSNOTIFY is not set
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
 CONFIG_GENERIC_CMOS_UPDATE=y
 CONFIG_GENERIC_FIND_LAST_BIT=y
 CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_GENERIC_GPIO=y
 CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
 CONFIG_HARDWARE_WATCHPOINTS=y
 CONFIG_HAS_DMA=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
 CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_HAVE_DYNAMIC_FTRACE=y
 CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
 CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
 CONFIG_HAVE_FUNCTION_TRACER=y
 CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y
 CONFIG_HAVE_GENERIC_DMA_COHERENT=y
 CONFIG_HAVE_IDE=y
 CONFIG_HAVE_OPROFILE=y
 CONFIG_HW_HAS_PCI=y
 CONFIG_HW_RANDOM=y
 CONFIG_HZ=250
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
 CONFIG_IMAGE_CMDLINE_HACK=y
 CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_IP_ROUTE_VERBOSE is not set
 CONFIG_IRQ_CPU=y
 CONFIG_KALLSYMS=y
 CONFIG_LEDS_GPIO=y
 # CONFIG_LOONGSON_MC146818 is not set
 CONFIG_LOONGSON_UART_BASE=y
 # CONFIG_MACH_ALCHEMY is not set
 # CONFIG_MACH_DECSTATION is not set
 # CONFIG_MACH_JAZZ is not set
 # CONFIG_MACH_LOONGSON is not set
 # CONFIG_MACH_TX39XX is not set
 # CONFIG_MACH_TX49XX is not set
 # CONFIG_MACH_VR41XX is not set
 # CONFIG_MIKROTIK_RB532 is not set
 CONFIG_MIPS=y
 # CONFIG_MIPS_COBALT is not set
 CONFIG_MIPS_L1_CACHE_SHIFT=5
 # CONFIG_MIPS_MACHINE is not set
 # CONFIG_MIPS_MALTA is not set
 CONFIG_MIPS_MT_DISABLED=y
 # CONFIG_MIPS_MT_SMP is not set
 # CONFIG_MIPS_MT_SMTC is not set
 # CONFIG_MIPS_SIM is not set
 CONFIG_MTD_BCM47XX=y
 CONFIG_NEED_DMA_MAP_STATE=y
 CONFIG_NO_HZ=y
 # CONFIG_NO_IOPORT is not set
 # CONFIG_NXP_STB220 is not set
 # CONFIG_NXP_STB225 is not set
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_PCI=y
 CONFIG_PCI_DISABLE_COMMON_QUIRKS=y
 CONFIG_PCI_DOMAINS=y
 CONFIG_PHYLIB=y
 # CONFIG_PMC_MSP is not set
 # CONFIG_PMC_YOSEMITE is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_POWERTV is not set
 # CONFIG_PROC_KCORE is not set
 CONFIG_SCHED_OMIT_FRAME_POINTER=y
 # CONFIG_SCSI_DMA is not set
 CONFIG_SCSI_MOD=y
 # CONFIG_SERIAL_8250_DETECT_IRQ is not set
 CONFIG_SERIAL_8250_EXTENDED=y
 # CONFIG_SERIAL_8250_MANY_PORTS is not set
 # CONFIG_SERIAL_8250_RSA is not set
 CONFIG_SERIAL_8250_SHARE_IRQ=y
 # CONFIG_SGI_IP22 is not set
 # CONFIG_SGI_IP27 is not set
 # CONFIG_SGI_IP28 is not set
 # CONFIG_SGI_IP32 is not set
 # CONFIG_SIBYTE_BIGSUR is not set
 # CONFIG_SIBYTE_CARMEL is not set
 # CONFIG_SIBYTE_CRHINE is not set
 # CONFIG_SIBYTE_CRHONE is not set
 # CONFIG_SIBYTE_LITTLESUR is not set
 # CONFIG_SIBYTE_RHONE is not set
 # CONFIG_SIBYTE_SENTOSA is not set
 # CONFIG_SIBYTE_SWARM is not set
 CONFIG_SSB=y
 CONFIG_SSB_B43_PCI_BRIDGE=y
 CONFIG_SSB_BLOCKIO=y
 CONFIG_SSB_DRIVER_EXTIF=y
 CONFIG_SSB_DRIVER_GIGE=y
 CONFIG_SSB_DRIVER_MIPS=y
 CONFIG_SSB_DRIVER_PCICORE=y
 CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y
 CONFIG_SSB_EMBEDDED=y
 CONFIG_SSB_PCICORE_HOSTMODE=y
 CONFIG_SSB_PCIHOST=y
 CONFIG_SSB_PCIHOST_POSSIBLE=y
 CONFIG_SSB_SERIAL=y
 CONFIG_SSB_SPROM=y
 CONFIG_SYS_HAS_CPU_MIPS32_R1=y
 CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
 CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
 CONFIG_SYS_SUPPORTS_LITTLE_ENDIAN=y
 # CONFIG_TC35815 is not set
 CONFIG_TRAD_SIGNALS=y
 CONFIG_USB_SUPPORT=y
 CONFIG_WATCHDOG_NOWAYOUT=y
 CONFIG_ZONE_DMA_FLAG=0
--- a/target/linux/brcm47xx/files-2.6.32/arch/mips/bcm47xx/cfe_env.c
+++ b/target/linux/brcm47xx/files-2.6.32/arch/mips/bcm47xx/cfe_env.c
@ -1,229 +0,0 @@
 /*
 * CFE environment variable access
 *
 * Copyright 2001-2003, Broadcom Corporation
 * Copyright 2006, Felix Fietkau <nbd@openwrt.org>
 * 
 * This program is free software; you can redistribute  it and/or modify it
 * under  the terms of  the GNU General  Public License as published by the
 * Free Software Foundation;  either version 2 of the  License, or (at your
 * option) any later version.
 */
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
 #define NVRAM_SIZE       (0x1ff0)
 static char _nvdata[NVRAM_SIZE];
 static char _valuestr[256];
 /*
 * TLV types.  These codes are used in the "type-length-value"
 * encoding of the items stored in the NVRAM device (flash or EEPROM)
 *
 * The layout of the flash/nvram is as follows:
 *
 * <type> <length> <data ...> <type> <length> <data ...> <type_end>
 *
 * The type code of "ENV_TLV_TYPE_END" marks the end of the list.
 * The "length" field marks the length of the data section, not
 * including the type and length fields.
 *
 * Environment variables are stored as follows:
 *
 * <type_env> <length> <flags> <name> = <value>
 *
 * If bit 0 (low bit) is set, the length is an 8-bit value.
 * If bit 0 (low bit) is clear, the length is a 16-bit value
 * 
 * Bit 7 set indicates "user" TLVs.  In this case, bit 0 still
 * indicates the size of the length field.  
 *
 * Flags are from the constants below:
 *
 */
 #define ENV_LENGTH_16BITS	0x00	/* for low bit */
 #define ENV_LENGTH_8BITS	0x01
 #define ENV_TYPE_USER		0x80
 #define ENV_CODE_SYS(n,l) (((n)<<1)|(l))
 #define ENV_CODE_USER(n,l) ((((n)<<1)|(l)) | ENV_TYPE_USER)
 /*
 * The actual TLV types we support
 */
 #define ENV_TLV_TYPE_END	0x00	
 #define ENV_TLV_TYPE_ENV	ENV_CODE_SYS(0,ENV_LENGTH_8BITS)
 /*
 * Environment variable flags 
 */
 #define ENV_FLG_NORMAL		0x00	/* normal read/write */
 #define ENV_FLG_BUILTIN		0x01	/* builtin - not stored in flash */
 #define ENV_FLG_READONLY	0x02	/* read-only - cannot be changed */
 #define ENV_FLG_MASK		0xFF	/* mask of attributes we keep */
 #define ENV_FLG_ADMIN		0x100	/* lets us internally override permissions */
 /*  *********************************************************************
    *  _nvram_read(buffer,offset,length)
    *  
    *  Read data from the NVRAM device
    *  
    *  Input parameters: 
    *  	   buffer - destination buffer
    *  	   offset - offset of data to read
    *  	   length - number of bytes to read
    *  	   
    *  Return value:
    *  	   number of bytes read, or <0 if error occured
    ********************************************************************* */
 static int
 _nvram_read(unsigned char *nv_buf, unsigned char *buffer, int offset, int length)
 {
    int i;
    if (offset > NVRAM_SIZE)
 	return -1; 
    for ( i = 0; i < length; i++) {
 	buffer[i] = ((volatile unsigned char*)nv_buf)[offset + i];
    }
    return length;
 }
 static char*
 _strnchr(const char *dest,int c,size_t cnt)
 {
 	while (*dest && (cnt > 0)) {
 	if (*dest == c) return (char *) dest;
 	dest++;
 	cnt--;
 	}
 	return NULL;
 }
 /*
 * Core support API: Externally visible.
 */
 /*
 * Get the value of an NVRAM variable
 * @param	name	name of variable to get
 * @return	value of variable or NULL if undefined
 */
 char* 
 cfe_env_get(unsigned char *nv_buf, char* name)
 {
    int size;
    unsigned char *buffer;
    unsigned char *ptr;
    unsigned char *envval;
    unsigned int reclen;
    unsigned int rectype;
    int offset;
    int flg;
 	if (!strcmp(name, "nvram_type"))
 		return "cfe";
    size = NVRAM_SIZE;
    buffer = &_nvdata[0];
    ptr = buffer;
    offset = 0;
    /* Read the record type and length */
    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
 	goto error;
    }
    while ((*ptr != ENV_TLV_TYPE_END)  && (size > 1)) {
 	/* Adjust pointer for TLV type */
 	rectype = *(ptr);
 	offset++;
 	size--;
 	/* 
 	 * Read the length.  It can be either 1 or 2 bytes
 	 * depending on the code 
 	 */
 	if (rectype & ENV_LENGTH_8BITS) {
 	    /* Read the record type and length - 8 bits */
 	    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
 		goto error;
 	    }
 	    reclen = *(ptr);
 	    size--;
 	    offset++;
 	}
 	else {
 	    /* Read the record type and length - 16 bits, MSB first */
 	    if (_nvram_read(nv_buf, ptr,offset,2) != 2) {
 		goto error;
 	    }
 	    reclen = (((unsigned int) *(ptr)) << 8) + (unsigned int) *(ptr+1);
 	    size -= 2;
 	    offset += 2;
 	}
 	if (reclen > size)
 	    break;	/* should not happen, bad NVRAM */
 	switch (rectype) {
 	    case ENV_TLV_TYPE_ENV:
 		/* Read the TLV data */
 		if (_nvram_read(nv_buf, ptr,offset,reclen) != reclen)
 		    goto error;
 		flg = *ptr++;
 		envval = (unsigned char *) _strnchr(ptr,'=',(reclen-1));
 		if (envval) {
 		    *envval++ = '\0';
 		    memcpy(_valuestr,envval,(reclen-1)-(envval-ptr));
 		    _valuestr[(reclen-1)-(envval-ptr)] = '\0';
 #if 0			
 		    printk(KERN_INFO "NVRAM:%s=%s\n", ptr, _valuestr);
 #endif
 		    if(!strcmp(ptr, name)){
 			return _valuestr;
 		    }
 		    if((strlen(ptr) > 1) && !strcmp(&ptr[1], name))
 			return _valuestr;
 		}
 		break;
 	    default: 
 		/* Unknown TLV type, skip it. */
 		break;
 	    }
 	/*
 	 * Advance to next TLV 
 	 */
 	size -= (int)reclen;
 	offset += reclen;
 	/* Read the next record type */
 	ptr = buffer;
 	if (_nvram_read(nv_buf, ptr,offset,1) != 1)
 	    goto error;
 	}
 error:
    return NULL;
 }
--- a/target/linux/brcm47xx/files-2.6.32/arch/mips/bcm47xx/include/nvram.h
+++ b/target/linux/brcm47xx/files-2.6.32/arch/mips/bcm47xx/include/nvram.h
@ -1,37 +0,0 @@
 /*
 *  Copyright (C) 2006 Felix Fietkau <nbd@openwrt.org>
 *
 *  This program is free software; you can redistribute  it and/or modify it
 *  under  the terms of  the GNU General  Public License as published by the
 *  Free Software Foundation;  either version 2 of the  License, or (at your
 *  option) any later version.
 */
 #ifndef __NVRAM_H
 #define __NVRAM_H
 struct nvram_header {
 	u32 magic;
 	u32 len;
 	u32 crc_ver_init;	/* 0:7 crc, 8:15 ver, 16:31 sdram_init */
 	u32 config_refresh;	/* 0:15 sdram_config, 16:31 sdram_refresh */
 	u32 config_ncdl;	/* ncdl values for memc */
 };
 struct nvram_tuple {
 	char *name;
 	char *value;
 	struct nvram_tuple *next;
 };
 #define NVRAM_HEADER		0x48534C46	/* 'FLSH' */
 #define NVRAM_VERSION		1
 #define NVRAM_HEADER_SIZE	20
 #define NVRAM_SPACE		0x8000
 #define NVRAM_MAX_VALUE_LEN 255
 #define NVRAM_MAX_PARAM_LEN 64
 char *nvram_get(const char *name);
 #endif
--- a/target/linux/brcm47xx/files-2.6.32/arch/mips/bcm47xx/nvram.c
+++ b/target/linux/brcm47xx/files-2.6.32/arch/mips/bcm47xx/nvram.c
@ -1,125 +0,0 @@
 /*
 * BCM947xx nvram variable access
 *
 * Copyright 2005, Broadcom Corporation
 * Copyright 2006, Felix Fietkau <nbd@openwrt.org>
 * 
 * This program is free software; you can redistribute  it and/or modify it
 * under  the terms of  the GNU General  Public License as published by the
 * Free Software Foundation;  either version 2 of the  License, or (at your
 * option) any later version.
 */
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/ssb/ssb.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/interrupt.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
 #include <asm/byteorder.h>
 #include <asm/bootinfo.h>
 #include <asm/addrspace.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
 #include <nvram.h>
 #define MB * 1048576
 extern struct ssb_bus ssb;
 static char nvram_buf[NVRAM_SPACE];
 static int cfe_env;
 extern char *cfe_env_get(char *nv_buf, const char *name);
 /* Probe for NVRAM header */
 static void __init early_nvram_init(void)
 {
 	struct ssb_mipscore *mcore = &ssb.mipscore;
 	struct nvram_header *header;
 	int i;
 	u32 base, lim, off;
 	u32 *src, *dst;
 	base = mcore->flash_window;
 	lim = mcore->flash_window_size;
 	cfe_env = 0;
 	/* XXX: hack for supporting the CFE environment stuff on WGT634U */
 	if (lim >= 8 MB) {
 		src = (u32 *) KSEG1ADDR(base + 8 MB - 0x2000);
 		dst = (u32 *) nvram_buf;
 		if ((*src & 0xff00ff) == 0x000001) {
 			printk("early_nvram_init: WGT634U NVRAM found.\n");
 			for (i = 0; i < 0x1ff0; i++) {
 				if (*src == 0xFFFFFFFF)
 					break;
 				*dst++ = *src++;
 			}
 			cfe_env = 1;
 			return;
 		}
 	}
 	off = 0x20000;
 	while (off <= lim) {
 		/* Windowed flash access */
 		header = (struct nvram_header *) KSEG1ADDR(base + off - NVRAM_SPACE);
 		if (header->magic == NVRAM_HEADER)
 			goto found;
 		off <<= 1;
 	}
 	/* Try embedded NVRAM at 4 KB and 1 KB as last resorts */
 	header = (struct nvram_header *) KSEG1ADDR(base + 4096);
 	if (header->magic == NVRAM_HEADER)
 		goto found;
 	header = (struct nvram_header *) KSEG1ADDR(base + 1024);
 	if (header->magic == NVRAM_HEADER)
 		goto found;
 	return;
 found:
 	src = (u32 *) header;
 	dst = (u32 *) nvram_buf;
 	for (i = 0; i < sizeof(struct nvram_header); i += 4)
 		*dst++ = *src++;
 	for (; i < header->len && i < NVRAM_SPACE; i += 4)
 		*dst++ = le32_to_cpu(*src++);
 }
 char *nvram_get(const char *name)
 {
 	char *var, *value, *end, *eq;
 	if (!name)
 		return NULL;
 	if (!nvram_buf[0])
 		early_nvram_init();
 	if (cfe_env)
 		return cfe_env_get(nvram_buf, name);
 	/* Look for name=value and return value */
 	var = &nvram_buf[sizeof(struct nvram_header)];
 	end = nvram_buf + sizeof(nvram_buf) - 2;
 	end[0] = end[1] = '\0';
 	for (; *var; var = value + strlen(value) + 1) {
 		if (!(eq = strchr(var, '=')))
 			break;
 		value = eq + 1;
 		if ((eq - var) == strlen(name) && strncmp(var, name, (eq - var)) == 0)
 			return value;
 	}
 	return NULL;
 }
 EXPORT_SYMBOL(nvram_get);
--- a/target/linux/brcm47xx/files-2.6.32/arch/mips/include/asm/mach-bcm47xx/kernel-entry-init.h
+++ b/target/linux/brcm47xx/files-2.6.32/arch/mips/include/asm/mach-bcm47xx/kernel-entry-init.h
@ -1,26 +0,0 @@
 /*
 * This file is subject to the terms and conditions of the GNU General Public
 * License.  See the file "COPYING" in the main directory of this archive
 * for more details.
 *
 * Copyright (C) 2005 Embedded Alley Solutions, Inc
 * Copyright (C) 2005 Ralf Baechle (ralf@linux-mips.org)
 * Copyright (C) 2006 Michael Buesch
 */
 #ifndef __ASM_MACH_GENERIC_KERNEL_ENTRY_H
 #define __ASM_MACH_GENERIC_KERNEL_ENTRY_H
 /* Intentionally empty macro, used in head.S. Override in
 * arch/mips/mach-xxx/kernel-entry-init.h when necessary.
 */
 	.macro	kernel_entry_setup
 	.endm
 /*
 * Do SMP slave processor setup necessary before we can savely execute C code.
 */
 	.macro	smp_slave_setup
 	.endm
 #endif /* __ASM_MACH_GENERIC_KERNEL_ENTRY_H */
--- a/target/linux/brcm47xx/files-2.6.32/drivers/mtd/maps/bcm47xx-flash.c
+++ b/target/linux/brcm47xx/files-2.6.32/drivers/mtd/maps/bcm47xx-flash.c
@ -1,474 +0,0 @@
 /*
 *  Copyright (C) 2006 Felix Fietkau <nbd@openwrt.org>
 *  Copyright (C) 2005 Waldemar Brodkorb <wbx@openwrt.org>
 *  Copyright (C) 2004 Florian Schirmer (jolt@tuxbox.org)
 *
 *  original functions for finding root filesystem from Mike Baker 
 *
 *  This program is free software; you can redistribute  it and/or modify it
 *  under  the terms of  the GNU General  Public License as published by the
 *  Free Software Foundation;  either version 2 of the  License, or (at your
 *  option) any later version.
 *
 *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
 *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
 *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
 *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
 *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
 *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
 *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 *  You should have received a copy of the  GNU General Public License along
 *  with this program; if not, write  to the Free Software Foundation, Inc.,
 *  675 Mass Ave, Cambridge, MA 02139, USA.
 * 
 *  Copyright 2001-2003, Broadcom Corporation
 *  All Rights Reserved.
 * 
 *  THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
 *  KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
 *  SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
 *  FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
 *
 *  Flash mapping for BCM947XX boards
 */
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/map.h>
 #ifdef CONFIG_MTD_PARTITIONS
 #include <linux/mtd/partitions.h>
 #endif
 #include <linux/crc32.h>
 #ifdef CONFIG_SSB
 #include <linux/ssb/ssb.h>
 #endif
 #include <asm/io.h>
 #define TRX_MAGIC	0x30524448	/* "HDR0" */
 #define TRX_VERSION	1
 #define TRX_MAX_LEN	0x3A0000
 #define TRX_NO_HEADER	1		/* Do not write TRX header */	
 #define TRX_GZ_FILES	0x2     /* Contains up to TRX_MAX_OFFSET individual gzip files */
 #define TRX_MAX_OFFSET	3
 struct trx_header {
 	u32 magic;		/* "HDR0" */
 	u32 len;		/* Length of file including header */
 	u32 crc32;		/* 32-bit CRC from flag_version to end of file */
 	u32 flag_version;	/* 0:15 flags, 16:31 version */
 	u32 offsets[TRX_MAX_OFFSET];	/* Offsets of partitions from start of header */
 };
 #define ROUNDUP(x, y) ((((x)+((y)-1))/(y))*(y))
 #define NVRAM_SPACE 0x8000
 #define WINDOW_ADDR 0x1fc00000
 #define WINDOW_SIZE 0x400000
 #define BUSWIDTH 2
 #ifdef CONFIG_SSB
 extern struct ssb_bus ssb_bcm47xx;
 #endif
 static struct mtd_info *bcm47xx_mtd;
 static void bcm47xx_map_copy_from(struct map_info *map, void *to, unsigned long from, ssize_t len)
 {
 	if (len==1) {
 		memcpy_fromio(to, map->virt + from, len);
 	} else {
 		int i;
 		u16 *dest = (u16 *) to;
 		u16 *src  = (u16 *) (map->virt + from);
 		for (i = 0; i < (len / 2); i++) {
 			dest[i] = src[i];
 		}
 		if (len & 1)
 			*((u8 *)dest+len-1) = src[i] & 0xff;
 	}
 }
 static struct map_info bcm47xx_map = {
 	name: "Physically mapped flash",
 	size: WINDOW_SIZE,
 	bankwidth: BUSWIDTH,
 	phys: WINDOW_ADDR,
 };
 #ifdef CONFIG_MTD_PARTITIONS
 static struct mtd_partition bcm47xx_parts[] = {
 	{ name: "cfe",	offset: 0, size: 0, mask_flags: MTD_WRITEABLE, },
 	{ name: "linux", offset: 0, size: 0, },
 	{ name: "rootfs", offset: 0, size: 0, },
 	{ name: "nvram", offset: 0, size: 0, },
 	{ name: NULL, },
 };
 static int __init
 find_cfe_size(struct mtd_info *mtd, size_t size)
 {
 	struct trx_header *trx;
 	unsigned char buf[512];
 	int off;
 	size_t len;
 	int blocksize;
 	trx = (struct trx_header *) buf;
 	blocksize = mtd->erasesize;
 	if (blocksize < 0x10000)
 		blocksize = 0x10000;
 	for (off = (128*1024); off < size; off += blocksize) {
 		memset(buf, 0xe5, sizeof(buf));
 		/*
 		 * Read into buffer 
 		 */
 		if (mtd->read(mtd, off, sizeof(buf), &len, buf) ||
 		    len != sizeof(buf))
 			continue;
 		/* found a TRX header */
 		if (le32_to_cpu(trx->magic) == TRX_MAGIC) {
 			goto found;
 		}
 	}
 	printk(KERN_NOTICE
 	       "%s: Couldn't find bootloader size\n",
 	       mtd->name);
 	return -1;
 found:
 	printk(KERN_NOTICE "bootloader size: %d\n", off);
 	return off;
 }
 /*
 * Copied from mtdblock.c
 *
 * Cache stuff...
 * 
 * Since typical flash erasable sectors are much larger than what Linux's
 * buffer cache can handle, we must implement read-modify-write on flash
 * sectors for each block write requests.  To avoid over-erasing flash sectors
 * and to speed things up, we locally cache a whole flash sector while it is
 * being written to until a different sector is required.
 */
 static void erase_callback(struct erase_info *done)
 {
 	wait_queue_head_t *wait_q = (wait_queue_head_t *)done->priv;
 	wake_up(wait_q);
 }
 static int erase_write (struct mtd_info *mtd, unsigned long pos, 
 			int len, const char *buf)
 {
 	struct erase_info erase;
 	DECLARE_WAITQUEUE(wait, current);
 	wait_queue_head_t wait_q;
 	size_t retlen;
 	int ret;
 	/*
 	 * First, let's erase the flash block.
 	 */
 	init_waitqueue_head(&wait_q);
 	erase.mtd = mtd;
 	erase.callback = erase_callback;
 	erase.addr = pos;
 	erase.len = len;
 	erase.priv = (u_long)&wait_q;
 	set_current_state(TASK_INTERRUPTIBLE);
 	add_wait_queue(&wait_q, &wait);
 	ret = mtd->erase(mtd, &erase);
 	if (ret) {
 		set_current_state(TASK_RUNNING);
 		remove_wait_queue(&wait_q, &wait);
 		printk (KERN_WARNING "erase of region [0x%lx, 0x%x] "
 				     "on \"%s\" failed\n",
 			pos, len, mtd->name);
 		return ret;
 	}
 	schedule();  /* Wait for erase to finish. */
 	remove_wait_queue(&wait_q, &wait);
 	/*
 	 * Next, writhe data to flash.
 	 */
 	ret = mtd->write (mtd, pos, len, &retlen, buf);
 	if (ret)
 		return ret;
 	if (retlen != len)
 		return -EIO;
 	return 0;
 }
 static int __init
 find_dual_image_off (struct mtd_info *mtd, size_t size)
 {
 	struct trx_header trx;
 	int off, blocksize;
 	size_t len;
 	blocksize = mtd->erasesize;
 	if (blocksize < 0x10000)
 		blocksize = 0x10000;
 	for (off = (128*1024); off < size; off += blocksize) {
 		memset(&trx, 0xe5, sizeof(trx));
 		/*
 		* Read into buffer 
 		*/
 		if (mtd->read(mtd, off, sizeof(trx), &len, (char *) &trx) ||
 		    len != sizeof(trx))
 			continue;
 		/* found last TRX header */
 		if (le32_to_cpu(trx.magic) == TRX_MAGIC){ 
 			if (le32_to_cpu(trx.flag_version >> 16)==2){
 				printk("dual image TRX header found\n");
 				return size/2;
 			} else {
 				return 0;
 			}
 		}
 	}
 	return 0;
 }
 static int __init
 find_root(struct mtd_info *mtd, size_t size, struct mtd_partition *part)
 {
 	struct trx_header trx, *trx2;
 	unsigned char buf[512], *block;
 	int off, blocksize;
 	u32 i, crc = ~0;
 	size_t len;
 	blocksize = mtd->erasesize;
 	if (blocksize < 0x10000)
 		blocksize = 0x10000;
 	for (off = (128*1024); off < size; off += blocksize) {
 		memset(&trx, 0xe5, sizeof(trx));
 		/*
 		 * Read into buffer 
 		 */
 		if (mtd->read(mtd, off, sizeof(trx), &len, (char *) &trx) ||
 		    len != sizeof(trx))
 			continue;
 		/* found a TRX header */
 		if (le32_to_cpu(trx.magic) == TRX_MAGIC) {
 			part->offset = le32_to_cpu(trx.offsets[2]) ? : 
 				le32_to_cpu(trx.offsets[1]);
 			part->size = le32_to_cpu(trx.len); 
 			part->size -= part->offset;
 			part->offset += off;
 			goto found;
 		}
 	}
 	printk(KERN_NOTICE
 	       "%s: Couldn't find root filesystem\n",
 	       mtd->name);
 	return -1;
 found:
 	if (part->size == 0)
 		return 0;
 	if (mtd->read(mtd, part->offset, sizeof(buf), &len, buf) || len != sizeof(buf))
 		return 0;
 	/* Move the fs outside of the trx */
 	part->size = 0;
 	if (trx.len != part->offset + part->size - off) {
 		/* Update the trx offsets and length */
 		trx.len = part->offset + part->size - off;
 		/* Update the trx crc32 */
 		for (i = (u32) &(((struct trx_header *)NULL)->flag_version); i <= trx.len; i += sizeof(buf)) {
 			if (mtd->read(mtd, off + i, sizeof(buf), &len, buf) || len != sizeof(buf))
 				return 0;
 			crc = crc32_le(crc, buf, min(sizeof(buf), trx.len - i));
 		}
 		trx.crc32 = crc;
 		/* read first eraseblock from the trx */
 		block = kmalloc(mtd->erasesize, GFP_KERNEL);
 		trx2 = (struct trx_header *) block;
 		if (mtd->read(mtd, off, mtd->erasesize, &len, block) || len != mtd->erasesize) {
 			printk("Error accessing the first trx eraseblock\n");
 			return 0;
 		}
 		printk("Updating TRX offsets and length:\n");
 		printk("old trx = [0x%08x, 0x%08x, 0x%08x], len=0x%08x crc32=0x%08x\n", trx2->offsets[0], trx2->offsets[1], trx2->offsets[2], trx2->len, trx2->crc32);
 		printk("new trx = [0x%08x, 0x%08x, 0x%08x], len=0x%08x crc32=0x%08x\n",   trx.offsets[0],   trx.offsets[1],   trx.offsets[2],   trx.len, trx.crc32);
 		/* Write updated trx header to the flash */
 		memcpy(block, &trx, sizeof(trx));
 		if (mtd->unlock)
 			mtd->unlock(mtd, off, mtd->erasesize);
 		erase_write(mtd, off, mtd->erasesize, block);
 		if (mtd->sync)
 			mtd->sync(mtd);
 		kfree(block);
 		printk("Done\n");
 	}
 	return part->size;
 }
 struct mtd_partition * __init
 init_mtd_partitions(struct mtd_info *mtd, size_t size)
 {
 	int cfe_size;
 	int dual_image_offset = 0;
 	if ((cfe_size = find_cfe_size(mtd,size)) < 0)
 		return NULL;
 	/* boot loader */
 	bcm47xx_parts[0].offset = 0;
 	bcm47xx_parts[0].size   = cfe_size;
 	/* nvram */
 	if (cfe_size != 384 * 1024) {
 		bcm47xx_parts[3].offset = size - ROUNDUP(NVRAM_SPACE, mtd->erasesize);
 		bcm47xx_parts[3].size   = ROUNDUP(NVRAM_SPACE, mtd->erasesize);
 	} else {
 		/* nvram (old 128kb config partition on netgear wgt634u) */
 		bcm47xx_parts[3].offset = bcm47xx_parts[0].size;
 		bcm47xx_parts[3].size   = ROUNDUP(NVRAM_SPACE, mtd->erasesize);
 	}
 	/* dual image offset*/
 	printk("Looking for dual image\n");
 	dual_image_offset=find_dual_image_off(mtd,size);
 	/* linux (kernel and rootfs) */
 	if (cfe_size != 384 * 1024) {
 		bcm47xx_parts[1].offset = bcm47xx_parts[0].size;
 		bcm47xx_parts[1].size   = bcm47xx_parts[3].offset - dual_image_offset -
 			bcm47xx_parts[1].offset;
 	} else {
 		/* do not count the elf loader, which is on one block */
 		bcm47xx_parts[1].offset = bcm47xx_parts[0].size + 
 			bcm47xx_parts[3].size + mtd->erasesize;
 		bcm47xx_parts[1].size   = size - 
 			bcm47xx_parts[0].size - 
 			(2*bcm47xx_parts[3].size) - 
 			mtd->erasesize;
 	}
 	/* find and size rootfs */
 	find_root(mtd,size,&bcm47xx_parts[2]);
 	bcm47xx_parts[2].size = size - dual_image_offset - bcm47xx_parts[2].offset - bcm47xx_parts[3].size;
 	return bcm47xx_parts;
 }
 #endif
 int __init init_bcm47xx_map(void)
 {
 #ifdef CONFIG_SSB
 	struct ssb_mipscore *mcore = &ssb_bcm47xx.mipscore;
 #endif
 	size_t size;
 	int ret = 0;
 #ifdef CONFIG_MTD_PARTITIONS
 	struct mtd_partition *parts;
 	int i;
 #endif
 #ifdef CONFIG_SSB
 	u32 window = mcore->flash_window;
 	u32 window_size = mcore->flash_window_size;
 	printk("flash init: 0x%08x 0x%08x\n", window, window_size);
 	bcm47xx_map.phys = window;
 	bcm47xx_map.size = window_size;
 	bcm47xx_map.bankwidth = mcore->flash_buswidth;
 	bcm47xx_map.virt = ioremap_nocache(window, window_size);
 #else
 	printk("flash init: 0x%08x 0x%08x\n", WINDOW_ADDR, WINDOW_SIZE);
 	bcm47xx_map.virt = ioremap_nocache(WINDOW_ADDR, WINDOW_SIZE);
 #endif
 	if (!bcm47xx_map.virt) {
 		printk("Failed to ioremap\n");
 		return -EIO;
 	}
 	simple_map_init(&bcm47xx_map);
 	if (!(bcm47xx_mtd = do_map_probe("cfi_probe", &bcm47xx_map))) {
 		printk("Failed to do_map_probe\n");
 		iounmap((void *)bcm47xx_map.virt);
 		return -ENXIO;
 	}
 	/* override copy_from routine */
 	bcm47xx_map.copy_from = bcm47xx_map_copy_from;
 	bcm47xx_mtd->owner = THIS_MODULE;
 	size = bcm47xx_mtd->size;
 	printk(KERN_NOTICE "Flash device: 0x%x at 0x%x\n", size, WINDOW_ADDR);
 #ifdef CONFIG_MTD_PARTITIONS
 	parts = init_mtd_partitions(bcm47xx_mtd, size);
 	for (i = 0; parts[i].name; i++);
 	ret = add_mtd_partitions(bcm47xx_mtd, parts, i);
 	if (ret) {
 		printk(KERN_ERR "Flash: add_mtd_partitions failed\n");
 		goto fail;
 	}
 #endif
 	return 0;
 fail:
 	if (bcm47xx_mtd)
 		map_destroy(bcm47xx_mtd);
 	if (bcm47xx_map.virt)
 		iounmap((void *)bcm47xx_map.virt);
 	bcm47xx_map.virt = 0;
 	return ret;
 }
 void __exit cleanup_bcm47xx_map(void)
 {
 #ifdef CONFIG_MTD_PARTITIONS
 	del_mtd_partitions(bcm47xx_mtd);
 #endif
 	map_destroy(bcm47xx_mtd);
 	iounmap((void *)bcm47xx_map.virt);
 }
 module_init(init_bcm47xx_map);
 module_exit(cleanup_bcm47xx_map);
--- a/target/linux/brcm47xx/files-2.6.35/drivers/mtd/maps/bcm47xx-flash.c
+++ b/target/linux/brcm47xx/files-2.6.35/drivers/mtd/maps/bcm47xx-flash.c
@ -1,559 +0,0 @@
 /*
 *  Copyright (C) 2006 Felix Fietkau <nbd@openwrt.org>
 *  Copyright (C) 2005 Waldemar Brodkorb <wbx@openwrt.org>
 *  Copyright (C) 2004 Florian Schirmer (jolt@tuxbox.org)
 *
 *  original functions for finding root filesystem from Mike Baker 
 *
 *  This program is free software; you can redistribute  it and/or modify it
 *  under  the terms of  the GNU General  Public License as published by the
 *  Free Software Foundation;  either version 2 of the  License, or (at your
 *  option) any later version.
 *
 *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
 *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
 *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
 *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
 *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
 *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
 *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 *  You should have received a copy of the  GNU General Public License along
 *  with this program; if not, write  to the Free Software Foundation, Inc.,
 *  675 Mass Ave, Cambridge, MA 02139, USA.
 * 
 *  Copyright 2001-2003, Broadcom Corporation
 *  All Rights Reserved.
 * 
 *  THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
 *  KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
 *  SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
 *  FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
 *
 *  Flash mapping for BCM947XX boards
 */
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/map.h>
 #ifdef CONFIG_MTD_PARTITIONS
 #include <linux/mtd/partitions.h>
 #endif
 #include <linux/crc32.h>
 #ifdef CONFIG_SSB
 #include <linux/ssb/ssb.h>
 #endif
 #include <asm/io.h>
 #include <asm/mach-bcm47xx/nvram.h>
 #include <asm/fw/cfe/cfe_api.h>
 #define TRX_MAGIC	0x30524448	/* "HDR0" */
 #define TRX_VERSION	1
 #define TRX_MAX_LEN	0x3A0000
 #define TRX_NO_HEADER	1		/* Do not write TRX header */	
 #define TRX_GZ_FILES	0x2     /* Contains up to TRX_MAX_OFFSET individual gzip files */
 #define TRX_MAX_OFFSET	3
 struct trx_header {
 	u32 magic;		/* "HDR0" */
 	u32 len;		/* Length of file including header */
 	u32 crc32;		/* 32-bit CRC from flag_version to end of file */
 	u32 flag_version;	/* 0:15 flags, 16:31 version */
 	u32 offsets[TRX_MAX_OFFSET];	/* Offsets of partitions from start of header */
 };
 #define ROUNDUP(x, y) ((((x)+((y)-1))/(y))*(y))
 #define NVRAM_SPACE 0x8000
 #define WINDOW_ADDR 0x1fc00000
 #define WINDOW_SIZE 0x400000
 #define BUSWIDTH 2
 #define ROUTER_NETGEAR_WGR614L         1
 #define ROUTER_NETGEAR_WNR834B         2
 #define ROUTER_NETGEAR_WNDR3300        3
 #define ROUTER_NETGEAR_WNR3500L        4
 #ifdef CONFIG_SSB
 extern struct ssb_bus ssb_bcm47xx;
 #endif
 static struct mtd_info *bcm47xx_mtd;
 static void bcm47xx_map_copy_from(struct map_info *map, void *to, unsigned long from, ssize_t len)
 {
 	if (len==1) {
 		memcpy_fromio(to, map->virt + from, len);
 	} else {
 		int i;
 		u16 *dest = (u16 *) to;
 		u16 *src  = (u16 *) (map->virt + from);
 		for (i = 0; i < (len / 2); i++) {
 			dest[i] = src[i];
 		}
 		if (len & 1)
 			*((u8 *)dest+len-1) = src[i] & 0xff;
 	}
 }
 static struct map_info bcm47xx_map = {
 	name: "Physically mapped flash",
 	size: WINDOW_SIZE,
 	bankwidth: BUSWIDTH,
 	phys: WINDOW_ADDR,
 };
 #ifdef CONFIG_MTD_PARTITIONS
 static struct mtd_partition bcm47xx_parts[] = {
 	{ name: "cfe",	offset: 0, size: 0, mask_flags: MTD_WRITEABLE, },
 	{ name: "linux", offset: 0, size: 0, },
 	{ name: "rootfs", offset: 0, size: 0, },
 	{ name: "nvram", offset: 0, size: 0, },
 	{ name: NULL, },
 };
 static int __init
 find_cfe_size(struct mtd_info *mtd, size_t size)
 {
 	struct trx_header *trx;
 	unsigned char buf[512];
 	int off;
 	size_t len;
 	int blocksize;
 	trx = (struct trx_header *) buf;
 	blocksize = mtd->erasesize;
 	if (blocksize < 0x10000)
 		blocksize = 0x10000;
 	for (off = (128*1024); off < size; off += blocksize) {
 		memset(buf, 0xe5, sizeof(buf));
 		/*
 		 * Read into buffer 
 		 */
 		if (mtd->read(mtd, off, sizeof(buf), &len, buf) ||
 		    len != sizeof(buf))
 			continue;
 		/* found a TRX header */
 		if (le32_to_cpu(trx->magic) == TRX_MAGIC) {
 			goto found;
 		}
 	}
 	printk(KERN_NOTICE
 	       "%s: Couldn't find bootloader size\n",
 	       mtd->name);
 	return -1;
 found:
 	printk(KERN_NOTICE "bootloader size: %d\n", off);
 	return off;
 }
 /*
 * Copied from mtdblock.c
 *
 * Cache stuff...
 * 
 * Since typical flash erasable sectors are much larger than what Linux's
 * buffer cache can handle, we must implement read-modify-write on flash
 * sectors for each block write requests.  To avoid over-erasing flash sectors
 * and to speed things up, we locally cache a whole flash sector while it is
 * being written to until a different sector is required.
 */
 static void erase_callback(struct erase_info *done)
 {
 	wait_queue_head_t *wait_q = (wait_queue_head_t *)done->priv;
 	wake_up(wait_q);
 }
 static int erase_write (struct mtd_info *mtd, unsigned long pos, 
 			int len, const char *buf)
 {
 	struct erase_info erase;
 	DECLARE_WAITQUEUE(wait, current);
 	wait_queue_head_t wait_q;
 	size_t retlen;
 	int ret;
 	/*
 	 * First, let's erase the flash block.
 	 */
 	init_waitqueue_head(&wait_q);
 	erase.mtd = mtd;
 	erase.callback = erase_callback;
 	erase.addr = pos;
 	erase.len = len;
 	erase.priv = (u_long)&wait_q;
 	set_current_state(TASK_INTERRUPTIBLE);
 	add_wait_queue(&wait_q, &wait);
 	ret = mtd->erase(mtd, &erase);
 	if (ret) {
 		set_current_state(TASK_RUNNING);
 		remove_wait_queue(&wait_q, &wait);
 		printk (KERN_WARNING "erase of region [0x%lx, 0x%x] "
 				     "on \"%s\" failed\n",
 			pos, len, mtd->name);
 		return ret;
 	}
 	schedule();  /* Wait for erase to finish. */
 	remove_wait_queue(&wait_q, &wait);
 	/*
 	 * Next, writhe data to flash.
 	 */
 	ret = mtd->write (mtd, pos, len, &retlen, buf);
 	if (ret)
 		return ret;
 	if (retlen != len)
 		return -EIO;
 	return 0;
 }
 static int __init
 find_dual_image_off (struct mtd_info *mtd, size_t size)
 {
 	struct trx_header trx;
 	int off, blocksize;
 	size_t len;
 	blocksize = mtd->erasesize;
 	if (blocksize < 0x10000)
 		blocksize = 0x10000;
 	for (off = (128*1024); off < size; off += blocksize) {
 		memset(&trx, 0xe5, sizeof(trx));
 		/*
 		* Read into buffer 
 		*/
 		if (mtd->read(mtd, off, sizeof(trx), &len, (char *) &trx) ||
 		    len != sizeof(trx))
 			continue;
 		/* found last TRX header */
 		if (le32_to_cpu(trx.magic) == TRX_MAGIC){ 
 			if (le32_to_cpu(trx.flag_version >> 16)==2){
 				printk("dual image TRX header found\n");
 				return size/2;
 			} else {
 				return 0;
 			}
 		}
 	}
 	return 0;
 }
 static int __init
 find_root(struct mtd_info *mtd, size_t size, struct mtd_partition *part)
 {
 	struct trx_header trx, *trx2;
 	unsigned char buf[512], *block;
 	int off, blocksize;
 	u32 i, crc = ~0;
 	size_t len;
 	blocksize = mtd->erasesize;
 	if (blocksize < 0x10000)
 		blocksize = 0x10000;
 	for (off = (128*1024); off < size; off += blocksize) {
 		memset(&trx, 0xe5, sizeof(trx));
 		/*
 		 * Read into buffer 
 		 */
 		if (mtd->read(mtd, off, sizeof(trx), &len, (char *) &trx) ||
 		    len != sizeof(trx))
 			continue;
 		/* found a TRX header */
 		if (le32_to_cpu(trx.magic) == TRX_MAGIC) {
 			part->offset = le32_to_cpu(trx.offsets[2]) ? : 
 				le32_to_cpu(trx.offsets[1]);
 			part->size = le32_to_cpu(trx.len); 
 			part->size -= part->offset;
 			part->offset += off;
 			goto found;
 		}
 	}
 	printk(KERN_NOTICE
 	       "%s: Couldn't find root filesystem\n",
 	       mtd->name);
 	return -1;
 found:
 	if (part->size == 0)
 		return 0;
 	if (mtd->read(mtd, part->offset, sizeof(buf), &len, buf) || len != sizeof(buf))
 		return 0;
 	/* Move the fs outside of the trx */
 	part->size = 0;
 	if (trx.len != part->offset + part->size - off) {
 		/* Update the trx offsets and length */
 		trx.len = part->offset + part->size - off;
 		/* Update the trx crc32 */
 		for (i = (u32) &(((struct trx_header *)NULL)->flag_version); i <= trx.len; i += sizeof(buf)) {
 			if (mtd->read(mtd, off + i, sizeof(buf), &len, buf) || len != sizeof(buf))
 				return 0;
 			crc = crc32_le(crc, buf, min(sizeof(buf), trx.len - i));
 		}
 		trx.crc32 = crc;
 		/* read first eraseblock from the trx */
 		block = kmalloc(mtd->erasesize, GFP_KERNEL);
 		trx2 = (struct trx_header *) block;
 		if (mtd->read(mtd, off, mtd->erasesize, &len, block) || len != mtd->erasesize) {
 			printk("Error accessing the first trx eraseblock\n");
 			return 0;
 		}
 		printk("Updating TRX offsets and length:\n");
 		printk("old trx = [0x%08x, 0x%08x, 0x%08x], len=0x%08x crc32=0x%08x\n", trx2->offsets[0], trx2->offsets[1], trx2->offsets[2], trx2->len, trx2->crc32);
 		printk("new trx = [0x%08x, 0x%08x, 0x%08x], len=0x%08x crc32=0x%08x\n",   trx.offsets[0],   trx.offsets[1],   trx.offsets[2],   trx.len, trx.crc32);
 		/* Write updated trx header to the flash */
 		memcpy(block, &trx, sizeof(trx));
 		if (mtd->unlock)
 			mtd->unlock(mtd, off, mtd->erasesize);
 		erase_write(mtd, off, mtd->erasesize, block);
 		if (mtd->sync)
 			mtd->sync(mtd);
 		kfree(block);
 		printk("Done\n");
 	}
 	return part->size;
 }
 static int get_router(void)
 {
 	char buf[20];
 	u32 boardnum = 0;
 	u16 boardtype = 0;
 	u16 boardrev = 0;
 	u32 boardflags = 0;
 	u16 sdram_init = 0;
 	u16 cardbus = 0;
 	if (nvram_getenv("boardnum", buf, sizeof(buf)) >= 0 ||
 	    cfe_getenv("boardnum", buf, sizeof(buf)) >= 0)
 		boardnum = simple_strtoul(buf, NULL, 0);
 	if (nvram_getenv("boardtype", buf, sizeof(buf)) >= 0 ||
 	    cfe_getenv("boardtype", buf, sizeof(buf)) >= 0)
 		boardtype = simple_strtoul(buf, NULL, 0);
 	if (nvram_getenv("boardrev", buf, sizeof(buf)) >= 0 ||
 	    cfe_getenv("boardrev", buf, sizeof(buf)) >= 0)
 		boardrev = simple_strtoul(buf, NULL, 0);
 	if (nvram_getenv("boardflags", buf, sizeof(buf)) >= 0 ||
 	    cfe_getenv("boardflags", buf, sizeof(buf)) >= 0)
 		boardflags = simple_strtoul(buf, NULL, 0);
 	if (nvram_getenv("sdram_init", buf, sizeof(buf)) >= 0 ||
 	    cfe_getenv("sdram_init", buf, sizeof(buf)) >= 0)
 		sdram_init = simple_strtoul(buf, NULL, 0);
 	if (nvram_getenv("cardbus", buf, sizeof(buf)) >= 0 ||
 	    cfe_getenv("cardbus", buf, sizeof(buf)) >= 0)
 		cardbus = simple_strtoul(buf, NULL, 0);
 	if ((boardnum == 8 || boardnum == 01)
 	  && boardtype == 0x0472 && cardbus == 1) {
 		/* Netgear WNR834B, Netgear WNR834Bv2 */
 		return ROUTER_NETGEAR_WNR834B;
 	}
 	if (boardnum == 01 && boardtype == 0x0472 && boardrev == 0x23) {
 		/* Netgear WNDR-3300 */
 		return ROUTER_NETGEAR_WNDR3300;
 	}
 	if ((boardnum == 83258 || boardnum == 01)
 	  && boardtype == 0x048e
 	  && (boardrev == 0x11 || boardrev == 0x10)
 	  && boardflags == 0x750
 	  && sdram_init == 0x000A) {
 		/* Netgear WGR614v8/L/WW 16MB ram, cfe v1.3 or v1.5 */
 		return ROUTER_NETGEAR_WGR614L;
 	}
 	if ((boardnum == 1 || boardnum == 3500)
 	  && boardtype == 0x04CF
 	  && (boardrev == 0x1213 || boardrev == 02)) {
 		/* Netgear WNR3500v2/U/L */
 		return ROUTER_NETGEAR_WNR3500L;
 	}
 	return 0;
 }
 struct mtd_partition * __init
 init_mtd_partitions(struct mtd_info *mtd, size_t size)
 {
 	int cfe_size;
 	int dual_image_offset = 0;
 	/* e.g Netgear 0x003e0000-0x003f0000 : "board_data", we exclude this
 	 * part from our mapping to prevent overwriting len/checksum on e.g.
 	 * Netgear WGR614v8/L/WW
 	 */
 	int board_data_size = 0;
 	switch (get_router()) {
 	case ROUTER_NETGEAR_WGR614L:
 	case ROUTER_NETGEAR_WNR834B:
 	case ROUTER_NETGEAR_WNDR3300:
 	case ROUTER_NETGEAR_WNR3500L:
 		/* Netgear: checksum is @ 0x003AFFF8 for 4M flash or checksum
 		 * is @ 0x007AFFF8 for 8M flash
 		 */
 		board_data_size = 4 * mtd->erasesize;
 		break;
 	}
 	if ((cfe_size = find_cfe_size(mtd,size)) < 0)
 		return NULL;
 	/* boot loader */
 	bcm47xx_parts[0].offset = 0;
 	bcm47xx_parts[0].size   = cfe_size;
 	/* nvram */
 	if (cfe_size != 384 * 1024) {
 		bcm47xx_parts[3].offset = size - ROUNDUP(NVRAM_SPACE, mtd->erasesize);
 		bcm47xx_parts[3].size   = ROUNDUP(NVRAM_SPACE, mtd->erasesize);
 	} else {
 		/* nvram (old 128kb config partition on netgear wgt634u) */
 		bcm47xx_parts[3].offset = bcm47xx_parts[0].size;
 		bcm47xx_parts[3].size   = ROUNDUP(NVRAM_SPACE, mtd->erasesize);
 	}
 	/* dual image offset*/
 	printk("Looking for dual image\n");
 	dual_image_offset=find_dual_image_off(mtd,size);
 	/* linux (kernel and rootfs) */
 	if (cfe_size != 384 * 1024) {
 		bcm47xx_parts[1].offset = bcm47xx_parts[0].size;
 		bcm47xx_parts[1].size   = bcm47xx_parts[3].offset - dual_image_offset -
 			bcm47xx_parts[1].offset - board_data_size;
 	} else {
 		/* do not count the elf loader, which is on one block */
 		bcm47xx_parts[1].offset = bcm47xx_parts[0].size + 
 			bcm47xx_parts[3].size + mtd->erasesize;
 		bcm47xx_parts[1].size   = size - 
 			bcm47xx_parts[0].size - 
 			(2*bcm47xx_parts[3].size) - 
 			mtd->erasesize - board_data_size;
 	}
 	/* find and size rootfs */
 	find_root(mtd,size,&bcm47xx_parts[2]);
 	bcm47xx_parts[2].size = size - dual_image_offset -
 				bcm47xx_parts[2].offset -
 				bcm47xx_parts[3].size - board_data_size;
 	return bcm47xx_parts;
 }
 #endif
 int __init init_bcm47xx_map(void)
 {
 #ifdef CONFIG_SSB
 	struct ssb_mipscore *mcore = &ssb_bcm47xx.mipscore;
 #endif
 	size_t size;
 	int ret = 0;
 #ifdef CONFIG_MTD_PARTITIONS
 	struct mtd_partition *parts;
 	int i;
 #endif
 #ifdef CONFIG_SSB
 	u32 window = mcore->flash_window;
 	u32 window_size = mcore->flash_window_size;
 	printk("flash init: 0x%08x 0x%08x\n", window, window_size);
 	bcm47xx_map.phys = window;
 	bcm47xx_map.size = window_size;
 	bcm47xx_map.bankwidth = mcore->flash_buswidth;
 	bcm47xx_map.virt = ioremap_nocache(window, window_size);
 #else
 	printk("flash init: 0x%08x 0x%08x\n", WINDOW_ADDR, WINDOW_SIZE);
 	bcm47xx_map.virt = ioremap_nocache(WINDOW_ADDR, WINDOW_SIZE);
 #endif
 	if (!bcm47xx_map.virt) {
 		printk("Failed to ioremap\n");
 		return -EIO;
 	}
 	simple_map_init(&bcm47xx_map);
 	if (!(bcm47xx_mtd = do_map_probe("cfi_probe", &bcm47xx_map))) {
 		printk("Failed to do_map_probe\n");
 		iounmap((void *)bcm47xx_map.virt);
 		return -ENXIO;
 	}
 	/* override copy_from routine */
 	bcm47xx_map.copy_from = bcm47xx_map_copy_from;
 	bcm47xx_mtd->owner = THIS_MODULE;
 	size = bcm47xx_mtd->size;
 	printk(KERN_NOTICE "Flash device: 0x%x at 0x%x\n", size, WINDOW_ADDR);
 #ifdef CONFIG_MTD_PARTITIONS
 	parts = init_mtd_partitions(bcm47xx_mtd, size);
 	for (i = 0; parts[i].name; i++);
 	ret = add_mtd_partitions(bcm47xx_mtd, parts, i);
 	if (ret) {
 		printk(KERN_ERR "Flash: add_mtd_partitions failed\n");
 		goto fail;
 	}
 #endif
 	return 0;
 fail:
 	if (bcm47xx_mtd)
 		map_destroy(bcm47xx_mtd);
 	if (bcm47xx_map.virt)
 		iounmap((void *)bcm47xx_map.virt);
 	bcm47xx_map.virt = 0;
 	return ret;
 }
 void __exit cleanup_bcm47xx_map(void)
 {
 #ifdef CONFIG_MTD_PARTITIONS
 	del_mtd_partitions(bcm47xx_mtd);
 #endif
 	map_destroy(bcm47xx_mtd);
 	iounmap((void *)bcm47xx_map.virt);
 }
 module_init(init_bcm47xx_map);
 module_exit(cleanup_bcm47xx_map);
--- a/target/linux/brcm47xx/patches-2.6.32/110-flash_map.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/110-flash_map.patch
@ -1,25 +0,0 @@
 --- a/drivers/mtd/maps/Kconfig
 +++ b/drivers/mtd/maps/Kconfig
@@ -327,6 +327,12 @@ config MTD_CFI_FLAGADM
 	  Mapping for the Flaga digital module. If you don't have one, ignore
 	  this setting.
 +config MTD_BCM47XX
 +	tristate "BCM47xx flash device"
 +	depends on MIPS && MTD_CFI && BCM47XX
 +	help
 +	  Support for the flash chips on the BCM947xx board.
 +
 config MTD_REDWOOD
 	tristate "CFI Flash devices mapped on IBM Redwood"
 	depends on MTD_CFI && ( REDWOOD_4 || REDWOOD_5 || REDWOOD_6 )
 --- a/drivers/mtd/maps/Makefile
 +++ b/drivers/mtd/maps/Makefile
@@ -28,6 +28,7 @@ obj-$(CONFIG_MTD_PMC_MSP_EVM)   += pmcms
 obj-$(CONFIG_MTD_PCMCIA)	+= pcmciamtd.o
 obj-$(CONFIG_MTD_RPXLITE)	+= rpxlite.o
 obj-$(CONFIG_MTD_TQM8XXL)	+= tqm8xxl.o
 +obj-$(CONFIG_MTD_BCM47XX)	+= bcm47xx-flash.o
 obj-$(CONFIG_MTD_SA1100)	+= sa1100-flash.o
 obj-$(CONFIG_MTD_IPAQ)		+= ipaq-flash.o
 obj-$(CONFIG_MTD_SBC_GXX)	+= sbc_gxx.o
--- a/target/linux/brcm47xx/patches-2.6.32/130-remove_scache.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/130-remove_scache.patch
@ -1,89 +0,0 @@
 --- a/arch/mips/Kconfig
 +++ b/arch/mips/Kconfig
@@ -216,7 +216,6 @@ config MIPS_MALTA
 	select I8259
 	select MIPS_BOARDS_GEN
 	select MIPS_BONITO64
 -	select MIPS_CPU_SCACHE
 	select PCI_GT64XXX_PCI0
 	select MIPS_MSC
 	select SWAP_IO_SPACE
@@ -1523,13 +1522,6 @@ config IP22_CPU_SCACHE
 	bool
 	select BOARD_SCACHE
 -#
 -# Support for a MIPS32 / MIPS64 style S-caches
 -#
 -config MIPS_CPU_SCACHE
 -	bool
 -	select BOARD_SCACHE
 -
 config R5000_CPU_SCACHE
 	bool
 	select BOARD_SCACHE
 --- a/arch/mips/kernel/cpu-probe.c
 +++ b/arch/mips/kernel/cpu-probe.c
@@ -748,6 +748,8 @@ static inline void cpu_probe_mips(struct
 	case PRID_IMP_25KF:
 		c->cputype = CPU_25KF;
 		__cpu_name[cpu] = "MIPS 25Kc";
 +		/* Probe for L2 cache */
 +		c->scache.flags &= ~MIPS_CACHE_NOT_PRESENT;
 		break;
 	case PRID_IMP_34K:
 		c->cputype = CPU_34K;
 --- a/arch/mips/mm/Makefile
 +++ b/arch/mips/mm/Makefile
@@ -33,6 +33,5 @@ obj-$(CONFIG_CPU_CAVIUM_OCTEON)	+= c-oct
 obj-$(CONFIG_IP22_CPU_SCACHE)	+= sc-ip22.o
 obj-$(CONFIG_R5000_CPU_SCACHE)  += sc-r5k.o
 obj-$(CONFIG_RM7000_CPU_SCACHE)	+= sc-rm7k.o
 -obj-$(CONFIG_MIPS_CPU_SCACHE)	+= sc-mips.o
 EXTRA_CFLAGS += -Werror
 --- a/arch/mips/mm/c-r4k.c
 +++ b/arch/mips/mm/c-r4k.c
@@ -1148,7 +1148,6 @@ static void __init loongson2_sc_init(voi
 extern int r5k_sc_init(void);
 extern int rm7k_sc_init(void);
 -extern int mips_sc_init(void);
 static void __cpuinit setup_scache(void)
 {
@@ -1202,29 +1201,17 @@ static void __cpuinit setup_scache(void)
 #endif
 	default:
 -		if (c->isa_level == MIPS_CPU_ISA_M32R1 ||
 -		    c->isa_level == MIPS_CPU_ISA_M32R2 ||
 -		    c->isa_level == MIPS_CPU_ISA_M64R1 ||
 -		    c->isa_level == MIPS_CPU_ISA_M64R2) {
 -#ifdef CONFIG_MIPS_CPU_SCACHE
 -			if (mips_sc_init ()) {
 -				scache_size = c->scache.ways * c->scache.sets * c->scache.linesz;
 -				printk("MIPS secondary cache %ldkB, %s, linesize %d bytes.\n",
 -				       scache_size >> 10,
 -				       way_string[c->scache.ways], c->scache.linesz);
 -			}
 -#else
 -			if (!(c->scache.flags & MIPS_CACHE_NOT_PRESENT))
 -				panic("Dunno how to handle MIPS32 / MIPS64 second level cache");
 -#endif
 -			return;
 -		}
 		sc_present = 0;
 	}
 	if (!sc_present)
 		return;
 +	if ((c->isa_level == MIPS_CPU_ISA_M32R1 ||
 +	     c->isa_level == MIPS_CPU_ISA_M64R1) &&
 +	    !(c->scache.flags & MIPS_CACHE_NOT_PRESENT))
 +		panic("Dunno how to handle MIPS32 / MIPS64 second level cache");
 +
 	/* compute a couple of other cache variables */
 	c->scache.waysize = scache_size / c->scache.ways;
--- a/target/linux/brcm47xx/patches-2.6.32/150-cpu_fixes.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/150-cpu_fixes.patch
@ -1,367 +0,0 @@
 --- a/arch/mips/include/asm/r4kcache.h
 +++ b/arch/mips/include/asm/r4kcache.h
@@ -17,6 +17,20 @@
 #include <asm/cpu-features.h>
 #include <asm/mipsmtregs.h>
 +#ifdef CONFIG_BCM47XX
 +#include <asm/paccess.h>
 +#include <linux/ssb/ssb.h>
 +#define BCM4710_DUMMY_RREG() ((void) *((u8 *) KSEG1ADDR(SSB_ENUM_BASE)))
 +
 +#define BCM4710_FILL_TLB(addr) (*(volatile unsigned long *)(addr))
 +#define BCM4710_PROTECTED_FILL_TLB(addr) ({ unsigned long x; get_dbe(x, (volatile unsigned long *)(addr)); })
 +#else
 +#define BCM4710_DUMMY_RREG()
 +
 +#define BCM4710_FILL_TLB(addr)
 +#define BCM4710_PROTECTED_FILL_TLB(addr)
 +#endif
 +
 /*
  * This macro return a properly sign-extended address suitable as base address
  * for indexed cache operations.  Two issues here:
@@ -150,6 +164,7 @@ static inline void flush_icache_line_ind
 static inline void flush_dcache_line_indexed(unsigned long addr)
 {
 	__dflush_prologue
 +	BCM4710_DUMMY_RREG();
 	cache_op(Index_Writeback_Inv_D, addr);
 	__dflush_epilogue
 }
@@ -169,6 +184,7 @@ static inline void flush_icache_line(uns
 static inline void flush_dcache_line(unsigned long addr)
 {
 	__dflush_prologue
 +	BCM4710_DUMMY_RREG();
 	cache_op(Hit_Writeback_Inv_D, addr);
 	__dflush_epilogue
 }
@@ -176,6 +192,7 @@ static inline void flush_dcache_line(uns
 static inline void invalidate_dcache_line(unsigned long addr)
 {
 	__dflush_prologue
 +	BCM4710_DUMMY_RREG();
 	cache_op(Hit_Invalidate_D, addr);
 	__dflush_epilogue
 }
@@ -208,6 +225,7 @@ static inline void flush_scache_line(uns
  */
 static inline void protected_flush_icache_line(unsigned long addr)
 {
 +	BCM4710_DUMMY_RREG();
 	protected_cache_op(Hit_Invalidate_I, addr);
 }
@@ -219,6 +237,7 @@ static inline void protected_flush_icach
  */
 static inline void protected_writeback_dcache_line(unsigned long addr)
 {
 +	BCM4710_DUMMY_RREG();
 	protected_cache_op(Hit_Writeback_Inv_D, addr);
 }
@@ -339,8 +358,52 @@ static inline void invalidate_tcache_pag
 		: "r" (base),						\
 		  "i" (op));
 +static inline void blast_dcache(void)
 +{
 +	unsigned long start = KSEG0;
 +	unsigned long dcache_size = current_cpu_data.dcache.waysize * current_cpu_data.dcache.ways;
 +	unsigned long end = (start + dcache_size);
 +
 +	do {
 +		BCM4710_DUMMY_RREG();
 +		cache_op(Index_Writeback_Inv_D, start);
 +		start += current_cpu_data.dcache.linesz;
 +	} while(start < end);
 +}
 +
 +static inline void blast_dcache_page(unsigned long page)
 +{
 +	unsigned long start = page;
 +	unsigned long end = start + PAGE_SIZE;
 +
 +	BCM4710_FILL_TLB(start);
 +	do {
 +		BCM4710_DUMMY_RREG();
 +		cache_op(Hit_Writeback_Inv_D, start);
 +		start += current_cpu_data.dcache.linesz;
 +	} while(start < end);
 +}
 +
 +static inline void blast_dcache_page_indexed(unsigned long page)
 +{
 +	unsigned long start = page;
 +	unsigned long end = start + PAGE_SIZE;
 +	unsigned long ws_inc = 1UL << current_cpu_data.dcache.waybit;
 +	unsigned long ws_end = current_cpu_data.dcache.ways <<
 +	                       current_cpu_data.dcache.waybit;
 +	unsigned long ws, addr;
 +	for (ws = 0; ws < ws_end; ws += ws_inc) {
 +		start = page + ws;
 +		for (addr = start; addr < end; addr += current_cpu_data.dcache.linesz) {
 +			BCM4710_DUMMY_RREG();
 +			cache_op(Index_Writeback_Inv_D, addr);
 +		}
 +	}
 +}
 +
 +
 /* build blast_xxx, blast_xxx_page, blast_xxx_page_indexed */
 -#define __BUILD_BLAST_CACHE(pfx, desc, indexop, hitop, lsize) \
 +#define __BUILD_BLAST_CACHE(pfx, desc, indexop, hitop, lsize, war) \
 static inline void blast_##pfx##cache##lsize(void)			\
 {									\
 	unsigned long start = INDEX_BASE;				\
@@ -352,6 +415,7 @@ static inline void blast_##pfx##cache##l
 									\
 	__##pfx##flush_prologue						\
 									\
 +	war								\
 	for (ws = 0; ws < ws_end; ws += ws_inc)				\
 		for (addr = start; addr < end; addr += lsize * 32)	\
 			cache##lsize##_unroll32(addr|ws, indexop);	\
@@ -366,6 +430,7 @@ static inline void blast_##pfx##cache##l
 									\
 	__##pfx##flush_prologue						\
 									\
 +	war								\
 	do {								\
 		cache##lsize##_unroll32(start, hitop);			\
 		start += lsize * 32;					\
@@ -384,6 +449,8 @@ static inline void blast_##pfx##cache##l
 	                       current_cpu_data.desc.waybit;		\
 	unsigned long ws, addr;						\
 									\
 +	war								\
 +									\
 	__##pfx##flush_prologue						\
 									\
 	for (ws = 0; ws < ws_end; ws += ws_inc)				\
@@ -393,36 +460,38 @@ static inline void blast_##pfx##cache##l
 	__##pfx##flush_epilogue						\
 }
 -__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 16)
 -__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 16)
 -__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 16)
 -__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 32)
 -__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 32)
 -__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 32)
 -__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 64)
 -__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64)
 -__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 64)
 -__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 128)
 -
 -__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 16)
 -__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 32)
 -__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 16)
 -__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 32)
 -__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 64)
 -__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 128)
 +__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 16, )
 +__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 16, BCM4710_FILL_TLB(start);)
 +__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 16, )
 +__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 32, )
 +__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 32, BCM4710_FILL_TLB(start);)
 +__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 32, )
 +__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 64, )
 +__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64, BCM4710_FILL_TLB(start);)
 +__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 64, )
 +__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 128, )
 +
 +__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 16, )
 +__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 32, )
 +__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 16, )
 +__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 32, )
 +__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 64, )
 +__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 128, )
 /* build blast_xxx_range, protected_blast_xxx_range */
 -#define __BUILD_BLAST_CACHE_RANGE(pfx, desc, hitop, prot) \
 +#define __BUILD_BLAST_CACHE_RANGE(pfx, desc, hitop, prot, war, war2) \
 static inline void prot##blast_##pfx##cache##_range(unsigned long start, \
 						    unsigned long end)	\
 {									\
 	unsigned long lsize = cpu_##desc##_line_size();			\
 	unsigned long addr = start & ~(lsize - 1);			\
 	unsigned long aend = (end - 1) & ~(lsize - 1);			\
 +	war								\
 									\
 	__##pfx##flush_prologue						\
 									\
 	while (1) {							\
 +		war2						\
 		prot##cache_op(hitop, addr);				\
 		if (addr == aend)					\
 			break;						\
@@ -432,13 +501,13 @@ static inline void prot##blast_##pfx##ca
 	__##pfx##flush_epilogue						\
 }
 -__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, protected_)
 -__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, protected_)
 -__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, protected_)
 -__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, )
 -__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, )
 +__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, protected_, BCM4710_PROTECTED_FILL_TLB(addr); BCM4710_PROTECTED_FILL_TLB(aend);, BCM4710_DUMMY_RREG();)
 +__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, protected_,, )
 +__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, protected_,, )
 +__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D,, BCM4710_FILL_TLB(addr); BCM4710_FILL_TLB(aend);, BCM4710_DUMMY_RREG();)
 +__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD,,, )
 /* blast_inv_dcache_range */
 -__BUILD_BLAST_CACHE_RANGE(inv_d, dcache, Hit_Invalidate_D, )
 -__BUILD_BLAST_CACHE_RANGE(inv_s, scache, Hit_Invalidate_SD, )
 +__BUILD_BLAST_CACHE_RANGE(inv_d, dcache, Hit_Invalidate_D,,,BCM4710_DUMMY_RREG();)
 +__BUILD_BLAST_CACHE_RANGE(inv_s, scache, Hit_Invalidate_SD,,, )
 #endif /* _ASM_R4KCACHE_H */
 --- a/arch/mips/include/asm/stackframe.h
 +++ b/arch/mips/include/asm/stackframe.h
@@ -426,6 +426,10 @@
 		.macro	RESTORE_SP_AND_RET
 		LONG_L	sp, PT_R29(sp)
 		.set	mips3
 +#ifdef CONFIG_BCM47XX
 +		nop
 +		nop
 +#endif
 		eret
 		.set	mips0
 		.endm
 --- a/arch/mips/kernel/genex.S
 +++ b/arch/mips/kernel/genex.S
@@ -52,6 +52,10 @@ NESTED(except_vec1_generic, 0, sp)
 NESTED(except_vec3_generic, 0, sp)
 	.set	push
 	.set	noat
 +#ifdef CONFIG_BCM47XX
 +	nop
 +	nop
 +#endif
 #if R5432_CP0_INTERRUPT_WAR
 	mfc0	k0, CP0_INDEX
 #endif
 --- a/arch/mips/mm/c-r4k.c
 +++ b/arch/mips/mm/c-r4k.c
@@ -35,6 +35,9 @@
 #include <asm/cacheflush.h> /* for run_uncached() */
 +/* For enabling BCM4710 cache workarounds */
 +int bcm4710 = 0;
 +
 /*
  * Special Variant of smp_call_function for use by cache functions:
  *
@@ -111,6 +114,9 @@ static void __cpuinit r4k_blast_dcache_p
 {
 	unsigned long  dc_lsize = cpu_dcache_line_size();
 +	if (bcm4710)
 +		r4k_blast_dcache_page = blast_dcache_page;
 +	else
 	if (dc_lsize == 0)
 		r4k_blast_dcache_page = (void *)cache_noop;
 	else if (dc_lsize == 16)
@@ -127,6 +133,9 @@ static void __cpuinit r4k_blast_dcache_p
 {
 	unsigned long dc_lsize = cpu_dcache_line_size();
 +	if (bcm4710)
 +		r4k_blast_dcache_page_indexed = blast_dcache_page_indexed;
 +	else
 	if (dc_lsize == 0)
 		r4k_blast_dcache_page_indexed = (void *)cache_noop;
 	else if (dc_lsize == 16)
@@ -143,6 +152,9 @@ static void __cpuinit r4k_blast_dcache_s
 {
 	unsigned long dc_lsize = cpu_dcache_line_size();
 +	if (bcm4710)
 +		r4k_blast_dcache = blast_dcache;
 +	else
 	if (dc_lsize == 0)
 		r4k_blast_dcache = (void *)cache_noop;
 	else if (dc_lsize == 16)
@@ -680,6 +692,8 @@ static void local_r4k_flush_cache_sigtra
 	unsigned long addr = (unsigned long) arg;
 	R4600_HIT_CACHEOP_WAR_IMPL;
 +	BCM4710_PROTECTED_FILL_TLB(addr);
 +	BCM4710_PROTECTED_FILL_TLB(addr + 4);
 	if (dc_lsize)
 		protected_writeback_dcache_line(addr & ~(dc_lsize - 1));
 	if (!cpu_icache_snoops_remote_store && scache_size)
@@ -1298,6 +1312,17 @@ static void __cpuinit coherency_setup(vo
 	 * silly idea of putting something else there ...
 	 */
 	switch (current_cpu_type()) {
 +	case CPU_BCM3302:
 +		{
 +			u32 cm;
 +			cm = read_c0_diag();
 +			/* Enable icache */
 +			cm |= (1 << 31);
 +			/* Enable dcache */
 +			cm |= (1 << 30);
 +			write_c0_diag(cm);
 +		}
 +		break;
 	case CPU_R4000PC:
 	case CPU_R4000SC:
 	case CPU_R4000MC:
@@ -1354,6 +1379,15 @@ void __cpuinit r4k_cache_init(void)
 		break;
 	}
 +	/* Check if special workarounds are required */
 +#ifdef CONFIG_BCM47XX
 +	if (current_cpu_data.cputype == CPU_BCM4710 && (current_cpu_data.processor_id & 0xff) == 0) {
 +		printk("Enabling BCM4710A0 cache workarounds.\n");
 +		bcm4710 = 1;
 +	} else
 +#endif
 +		bcm4710 = 0;
 +
 	probe_pcache();
 	setup_scache();
@@ -1412,5 +1446,13 @@ void __cpuinit r4k_cache_init(void)
 #if !defined(CONFIG_MIPS_CMP)
 	local_r4k___flush_cache_all(NULL);
 #endif
 +#ifdef CONFIG_BCM47XX
 +	{
 +		static void (*_coherency_setup)(void);
 +		_coherency_setup = (void (*)(void)) KSEG1ADDR(coherency_setup);
 +		_coherency_setup();
 +	}
 +#else
 	coherency_setup();
 +#endif
 }
 --- a/arch/mips/mm/tlbex.c
 +++ b/arch/mips/mm/tlbex.c
@@ -733,6 +733,9 @@ static void __cpuinit build_r4000_tlb_re
 		/* No need for uasm_i_nop */
 	}
 +#ifdef CONFIG_BCM47XX
 +	uasm_i_nop(&p);
 +#endif
 #ifdef CONFIG_64BIT
 	build_get_pmde64(&p, &l, &r, K0, K1); /* get pmd in K1 */
 #else
@@ -1185,6 +1188,9 @@ build_r4000_tlbchange_handler_head(u32 *
 				   struct uasm_reloc **r, unsigned int pte,
 				   unsigned int ptr)
 {
 +#ifdef CONFIG_BCM47XX
 +	uasm_i_nop(p);
 +#endif
 #ifdef CONFIG_64BIT
 	build_get_pmde64(p, l, r, pte, ptr); /* get pmd in ptr */
 #else
--- a/target/linux/brcm47xx/patches-2.6.32/160-kmap_coherent.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/160-kmap_coherent.patch
@ -1,77 +0,0 @@
 --- a/arch/mips/include/asm/cpu-features.h
 +++ b/arch/mips/include/asm/cpu-features.h
@@ -107,6 +107,9 @@
 #ifndef cpu_has_pindexed_dcache
 #define cpu_has_pindexed_dcache	(cpu_data[0].dcache.flags & MIPS_CACHE_PINDEX)
 #endif
 +#ifndef cpu_use_kmap_coherent
 +#define cpu_use_kmap_coherent 1
 +#endif
 /*
  * I-Cache snoops remote store.  This only matters on SMP.  Some multiprocessors
 --- /dev/null
 +++ b/arch/mips/include/asm/mach-bcm47xx/cpu-feature-overrides.h
@@ -0,0 +1,13 @@
 +/*
 + * This file is subject to the terms and conditions of the GNU General Public
 + * License.  See the file "COPYING" in the main directory of this archive
 + * for more details.
 + *
 + * Copyright (C) 2005 Ralf Baechle (ralf@linux-mips.org)
 + */
 +#ifndef __ASM_MACH_BCM47XX_CPU_FEATURE_OVERRIDES_H
 +#define __ASM_MACH_BCM47XX_CPU_FEATURE_OVERRIDES_H
 +
 +#define cpu_use_kmap_coherent	0
 +
 +#endif /* __ASM_MACH_BCM47XX_CPU_FEATURE_OVERRIDES_H */
 --- a/arch/mips/mm/c-r4k.c
 +++ b/arch/mips/mm/c-r4k.c
@@ -507,7 +507,7 @@ static inline void local_r4k_flush_cache
 		 */
 		map_coherent = (cpu_has_dc_aliases &&
 				page_mapped(page) && !Page_dcache_dirty(page));
 -		if (map_coherent)
 +		if (map_coherent && cpu_use_kmap_coherent)
 			vaddr = kmap_coherent(page, addr);
 		else
 			vaddr = kmap_atomic(page, KM_USER0);
@@ -530,7 +530,7 @@ static inline void local_r4k_flush_cache
 	}
 	if (vaddr) {
 -		if (map_coherent)
 +		if (map_coherent && cpu_use_kmap_coherent)
 			kunmap_coherent();
 		else
 			kunmap_atomic(vaddr, KM_USER0);
 --- a/arch/mips/mm/init.c
 +++ b/arch/mips/mm/init.c
@@ -209,7 +209,7 @@ void copy_user_highpage(struct page *to,
 	void *vfrom, *vto;
 	vto = kmap_atomic(to, KM_USER1);
 -	if (cpu_has_dc_aliases &&
 +	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
 	    page_mapped(from) && !Page_dcache_dirty(from)) {
 		vfrom = kmap_coherent(from, vaddr);
 		copy_page(vto, vfrom);
@@ -231,7 +231,7 @@ void copy_to_user_page(struct vm_area_st
 	struct page *page, unsigned long vaddr, void *dst, const void *src,
 	unsigned long len)
 {
 -	if (cpu_has_dc_aliases &&
 +	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
 	    page_mapped(page) && !Page_dcache_dirty(page)) {
 		void *vto = kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
 		memcpy(vto, src, len);
@@ -249,7 +249,7 @@ void copy_from_user_page(struct vm_area_
 	struct page *page, unsigned long vaddr, void *dst, const void *src,
 	unsigned long len)
 {
 -	if (cpu_has_dc_aliases &&
 +	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
 	    page_mapped(page) && !Page_dcache_dirty(page)) {
 		void *vfrom = kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
 		memcpy(dst, vfrom, len);
--- a/target/linux/brcm47xx/patches-2.6.32/170-128MB_ram_bugfix.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/170-128MB_ram_bugfix.patch
@ -1,32 +0,0 @@
 --- a/arch/mips/bcm47xx/prom.c
 +++ b/arch/mips/bcm47xx/prom.c
@@ -126,6 +126,7 @@ static __init void prom_init_cmdline(voi
 static __init void prom_init_mem(void)
 {
 	unsigned long mem;
 +	unsigned long max;
 	/* Figure out memory size by finding aliases.
 	 *
@@ -134,8 +135,21 @@ static __init void prom_init_mem(void)
 	 * want to reuse the memory used by CFE (around 4MB). That means cfe_*
 	 * functions stop to work at some point during the boot, we should only
 	 * call them at the beginning of the boot.
 +	 * 
 +	 * BCM47XX uses 128MB for addressing the ram, if the system contains
 +	 * less that that amount of ram it remaps the ram more often into the
 +	 * available space.
 +	 * Accessing memory after 128MB will cause an exception.
 +	 * max contains the biggest possible address supported by the platform.
 +	 * If the method wants to try something above we assume 128MB ram.
 	 */
 +	max = ((unsigned long)(prom_init) | ((128 << 20) - 1));
 	for (mem = (1 << 20); mem < (128 << 20); mem += (1 << 20)) {
 +		if (((unsigned long)(prom_init) + mem) > max) {
 +			mem = (128 << 20);
 +			printk("assume 128MB RAM\n");
 +			break;
 +		}
 		if (*(unsigned long *)((unsigned long)(prom_init) + mem) ==
 		    *(unsigned long *)(prom_init))
 			break;
--- a/target/linux/brcm47xx/patches-2.6.32/210-b44_phy_fix.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/210-b44_phy_fix.patch
@ -1,86 +0,0 @@
 --- a/drivers/net/b44.c
 +++ b/drivers/net/b44.c
@@ -339,7 +339,7 @@ static int b44_phy_reset(struct b44 *bp)
 		}
 	}
 -	return 0;
 +	return err;
 }
 static void __b44_set_flow_ctrl(struct b44 *bp, u32 pause_flags)
@@ -384,7 +384,7 @@ static void b44_set_flow_ctrl(struct b44
 	__b44_set_flow_ctrl(bp, pause_enab);
 }
 -#ifdef SSB_DRIVER_MIPS
 +#ifdef CONFIG_SSB_DRIVER_MIPS
 extern char *nvram_get(char *name);
 static void b44_wap54g10_workaround(struct b44 *bp)
 {
@@ -421,12 +421,45 @@ static inline void b44_wap54g10_workarou
 }
 #endif
 +#ifdef CONFIG_SSB_DRIVER_MIPS
 +static inline int startswith (const char *source, const char *cmp) 
 +{ 
 +       return !strncmp(source,cmp,strlen(cmp)); 
 +}
 +
 +#define getvar(str) (nvram_get(str) ? : "")
 +
 +static inline void b44_bcm47xx_workarounds(struct b44 *bp)
 +{
 +	/* Toshiba WRC-1000, Siemens SE505 v1, Askey RT-210W, RT-220W */
 +	if (simple_strtoul(getvar("boardnum"), NULL, 0) == 100) {
 +		bp->phy_addr = B44_PHY_ADDR_NO_PHY;
 +	} else {
 +		/* WL-HDD */
 +		struct ssb_device *sdev = bp->sdev;
 +		if (startswith(getvar("hardware_version"), "WL300-")) 
 +		{
 +			if (sdev->bus->sprom.et0phyaddr == 0 &&
 +			    sdev->bus->sprom.et1phyaddr == 1)
 +				bp->phy_addr = B44_PHY_ADDR_NO_PHY;
 +		}
 +	}
 +	return;
 +}
 +
 +#else
 +static inline void b44_bcm47xx_workarounds(struct b44 *bp) 
 +{ 
 +}
 +#endif
 +
 static int b44_setup_phy(struct b44 *bp)
 {
 	u32 val;
 	int err;
 	b44_wap54g10_workaround(bp);
 +	b44_bcm47xx_workarounds(bp);
 	if (bp->phy_addr == B44_PHY_ADDR_NO_PHY)
 		return 0;
@@ -2094,6 +2127,8 @@ static int __devinit b44_get_invariants(
 	 * valid PHY address. */
 	bp->phy_addr &= 0x1F;
 +	b44_bcm47xx_workarounds(bp);
 +
 	memcpy(bp->dev->dev_addr, addr, 6);
 	if (!is_valid_ether_addr(&bp->dev->dev_addr[0])){
@@ -2223,6 +2258,10 @@ static int __devinit b44_init_one(struct
 	 */
 	b44_chip_reset(bp, B44_CHIP_RESET_FULL);
 +	/* do a phy reset to test if there is an active phy */
 +	if (b44_phy_reset(bp) < 0)
 +		bp->phy_addr = B44_PHY_ADDR_NO_PHY;
 +
 	printk(KERN_INFO "%s: Broadcom 44xx/47xx 10/100BaseT Ethernet %pM\n",
 	       dev->name, dev->dev_addr);
--- a/target/linux/brcm47xx/patches-2.6.32/211-b44_timeout_spam.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/211-b44_timeout_spam.patch
@ -1,17 +0,0 @@
 --- a/drivers/net/b44.c
 +++ b/drivers/net/b44.c
@@ -189,11 +189,13 @@ static int b44_wait_bit(struct b44 *bp, 
 		udelay(10);
 	}
 	if (i == timeout) {
 -		printk(KERN_ERR PFX "%s: BUG!  Timeout waiting for bit %08x of register "
 +#if 0
 +		printk(KERN_DEBUG PFX "%s: BUG!  Timeout waiting for bit %08x of register "
 		       "%lx to %s.\n",
 		       bp->dev->name,
 		       bit, reg,
 		       (clear ? "clear" : "set"));
 +#endif
 		return -ENODEV;
 	}
 	return 0;
--- a/target/linux/brcm47xx/patches-2.6.32/220-bcm5354.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/220-bcm5354.patch
@ -1,42 +0,0 @@
 --- a/drivers/ssb/driver_chipcommon.c
 +++ b/drivers/ssb/driver_chipcommon.c
@@ -260,6 +260,8 @@ void ssb_chipco_resume(struct ssb_chipco
 void ssb_chipco_get_clockcpu(struct ssb_chipcommon *cc,
                              u32 *plltype, u32 *n, u32 *m)
 {
 +	if ((chipco_read32(cc, SSB_CHIPCO_CHIPID) & SSB_CHIPCO_IDMASK) == 0x5354)
 +		return;
 	*n = chipco_read32(cc, SSB_CHIPCO_CLOCK_N);
 	*plltype = (cc->capabilities & SSB_CHIPCO_CAP_PLLT);
 	switch (*plltype) {
@@ -283,6 +285,8 @@ void ssb_chipco_get_clockcpu(struct ssb_
 void ssb_chipco_get_clockcontrol(struct ssb_chipcommon *cc,
 				 u32 *plltype, u32 *n, u32 *m)
 {
 +	if ((chipco_read32(cc, SSB_CHIPCO_CHIPID) & SSB_CHIPCO_IDMASK) == 0x5354)
 +		return;
 	*n = chipco_read32(cc, SSB_CHIPCO_CLOCK_N);
 	*plltype = (cc->capabilities & SSB_CHIPCO_CAP_PLLT);
 	switch (*plltype) {
 --- a/drivers/ssb/driver_mipscore.c
 +++ b/drivers/ssb/driver_mipscore.c
@@ -217,6 +217,8 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
 	if ((pll_type == SSB_PLLTYPE_5) || (bus->chip_id == 0x5365)) {
 		rate = 200000000;
 +	} else if (bus->chip_id == 0x5354) {
 +		rate = 240000000;
 	} else {
 		rate = ssb_calc_clock_rate(pll_type, n, m);
 	}
 --- a/drivers/ssb/main.c
 +++ b/drivers/ssb/main.c
@@ -1073,6 +1073,8 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
 	if (bus->chip_id == 0x5365) {
 		rate = 100000000;
 +	} else if (bus->chip_id == 0x5354) {
 +		rate = 120000000;
 	} else {
 		rate = ssb_calc_clock_rate(plltype, clkctl_n, clkctl_m);
 		if (plltype == SSB_PLLTYPE_3) /* 25Mhz, 2 dividers */
--- a/target/linux/brcm47xx/patches-2.6.32/250-ohci-ssb-usb2.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/250-ohci-ssb-usb2.patch
@ -1,60 +0,0 @@
 ---
 drivers/usb/host/ohci-ssb.c |   39 ++++++++++++++++++++++++++++++++++++---
 1 file changed, 36 insertions(+), 3 deletions(-)
 --- a/drivers/usb/host/ohci-ssb.c
 +++ b/drivers/usb/host/ohci-ssb.c
@@ -106,10 +106,42 @@ static int ssb_ohci_attach(struct ssb_de
 	int err = -ENOMEM;
 	u32 tmp, flags = 0;
 -	if (dev->id.coreid == SSB_DEV_USB11_HOSTDEV)
 +	if (dev->id.coreid == SSB_DEV_USB11_HOSTDEV) {
 +		/* Put the device into host-mode. */
 		flags |= SSB_OHCI_TMSLOW_HOSTMODE;
 -
 -	ssb_device_enable(dev, flags);
 +		ssb_device_enable(dev, flags);
 +	} else if (dev->id.coreid == SSB_DEV_USB20_HOST) {
 +		/*
 +		 * USB 2.0 special considerations:
 +		 *
 +		 * 1. Since the core supports both OHCI and EHCI functions, it must
 +		 *    only be reset once.
 +		 *
 +		 * 2. In addition to the standard SSB reset sequence, the Host Control
 +		 *    Register must be programmed to bring the USB core and various
 +		 *    phy components out of reset.
 +		 */
 +		ssb_device_enable(dev, 0);
 +		ssb_write32(dev, 0x200, 0x7ff);
 +		udelay(1);
 +		if (dev->id.revision == 1) { // bug in rev 1
 +
 +			/* Change Flush control reg */
 +			tmp = ssb_read32(dev, 0x400);
 +			tmp &= ~8;
 +			ssb_write32(dev, 0x400, tmp);
 +			tmp = ssb_read32(dev, 0x400);
 +			printk("USB20H fcr: 0x%0x\n", tmp);
 +
 +			/* Change Shim control reg */
 +			tmp = ssb_read32(dev, 0x304);
 +			tmp &= ~0x100;
 +			ssb_write32(dev, 0x304, tmp);
 +			tmp = ssb_read32(dev, 0x304);
 +			printk("USB20H shim: 0x%0x\n", tmp);
 +		}
 +	} else
 +		ssb_device_enable(dev, 0);
 	hcd = usb_create_hcd(&ssb_ohci_hc_driver, dev->dev,
 			dev_name(dev->dev));
@@ -200,6 +232,7 @@ static int ssb_ohci_resume(struct ssb_de
 static const struct ssb_device_id ssb_ohci_table[] = {
 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB11_HOSTDEV, SSB_ANY_REV),
 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB11_HOST, SSB_ANY_REV),
 +	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB20_HOST, SSB_ANY_REV),
 	SSB_DEVTABLE_END
 };
 MODULE_DEVICE_TABLE(ssb, ssb_ohci_table);
--- a/target/linux/brcm47xx/patches-2.6.32/260-ohci-set-dma-mask.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/260-ohci-set-dma-mask.patch
@ -1,16 +0,0 @@
 ---
 drivers/usb/host/ohci-ssb.c |    3 +++
 1 file changed, 3 insertions(+)
 --- a/drivers/usb/host/ohci-ssb.c
 +++ b/drivers/usb/host/ohci-ssb.c
@@ -106,6 +106,9 @@ static int ssb_ohci_attach(struct ssb_de
 	int err = -ENOMEM;
 	u32 tmp, flags = 0;
 +	if (ssb_dma_set_mask(dev, DMA_BIT_MASK(32)))
 +		return -EOPNOTSUPP;
 +
 	if (dev->id.coreid == SSB_DEV_USB11_HOSTDEV) {
 		/* Put the device into host-mode. */
 		flags |= SSB_OHCI_TMSLOW_HOSTMODE;
--- a/target/linux/brcm47xx/patches-2.6.32/270-ehci-ssb.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/270-ehci-ssb.patch
@ -1,271 +0,0 @@
 ---
 drivers/usb/host/Kconfig    |   13 ++
 drivers/usb/host/ehci-hcd.c |   12 ++
 drivers/usb/host/ehci-ssb.c |  201 ++++++++++++++++++++++++++++++++++++++++++++
 drivers/usb/host/ohci-ssb.c |   23 +++++
 4 files changed, 247 insertions(+), 2 deletions(-)
 --- a/drivers/usb/host/Kconfig
 +++ b/drivers/usb/host/Kconfig
@@ -132,6 +132,19 @@ config USB_OXU210HP_HCD
 	  To compile this driver as a module, choose M here: the
 	  module will be called oxu210hp-hcd.
 +config USB_EHCI_HCD_SSB
 +	bool "EHCI support for Broadcom SSB EHCI core"
 +	depends on USB_EHCI_HCD && SSB && EXPERIMENTAL
 +	default n
 +	---help---
 +	  Support for the Sonics Silicon Backplane (SSB) attached
 +	  Broadcom USB EHCI core.
 +
 +	  This device is present in some embedded devices with
 +	  Broadcom based SSB bus.
 +
 +	  If unsure, say N.
 +
 config USB_ISP116X_HCD
 	tristate "ISP116X HCD support"
 	depends on USB
 --- a/drivers/usb/host/ehci-hcd.c
 +++ b/drivers/usb/host/ehci-hcd.c
@@ -1142,8 +1142,16 @@ MODULE_LICENSE ("GPL");
 #define	PLATFORM_DRIVER		ehci_atmel_driver
 #endif
 -#if !defined(PCI_DRIVER) && !defined(PLATFORM_DRIVER) && \
 -    !defined(PS3_SYSTEM_BUS_DRIVER) && !defined(OF_PLATFORM_DRIVER)
 +#ifdef CONFIG_USB_EHCI_HCD_SSB
 +#include "ehci-ssb.c"
 +#define SSB_EHCI_DRIVER         ssb_ehci_driver
 +#endif
 +
 +#if !defined(PCI_DRIVER) && \
 +    !defined(PLATFORM_DRIVER) && \
 +    !defined(PS3_SYSTEM_BUS_DRIVER) && \
 +    !defined(OF_PLATFORM_DRIVER) && \
 +    !defined(SSB_EHCI_DRIVER)
 #error "missing bus glue for ehci-hcd"
 #endif
 --- /dev/null
 +++ b/drivers/usb/host/ehci-ssb.c
@@ -0,0 +1,158 @@
 +/*
 + * Sonics Silicon Backplane
 + * Broadcom USB-core EHCI driver (SSB bus glue)
 + *
 + * Copyright 2007 Steven Brown <sbrown@cortland.com>
 + *
 + * Derived from the OHCI-SSB driver
 + * Copyright 2007 Michael Buesch <mb@bu3sch.de>
 + *
 + * Derived from the EHCI-PCI driver
 + * Copyright (c) 2000-2004 by David Brownell
 + *
 + * Derived from the OHCI-PCI driver
 + * Copyright 1999 Roman Weissgaerber
 + * Copyright 2000-2002 David Brownell
 + * Copyright 1999 Linus Torvalds
 + * Copyright 1999 Gregory P. Smith
 + *
 + * Derived from the USBcore related parts of Broadcom-SB
 + * Copyright 2005 Broadcom Corporation
 + *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +#include <linux/ssb/ssb.h>
 +
 +#define SSB_OHCI_TMSLOW_HOSTMODE	(1 << 29)
 +
 +struct ssb_ehci_device {
 +	struct ehci_hcd ehci; /* _must_ be at the beginning. */
 +
 +	u32 enable_flags;
 +};
 +
 +static inline
 +struct ssb_ehci_device *hcd_to_ssb_ehci(struct usb_hcd *hcd)
 +{
 +	return (struct ssb_ehci_device *)(hcd->hcd_priv);
 +}
 +
 +static int ssb_ehci_reset(struct usb_hcd *hcd)
 +{
 +	struct ehci_hcd *ehci = hcd_to_ehci(hcd);
 +	int err;
 +
 +	ehci->caps = hcd->regs;
 +	ehci->regs = hcd->regs +
 +		HC_LENGTH(ehci_readl(ehci, &ehci->caps->hc_capbase));
 +
 +	dbg_hcs_params(ehci, "reset");
 +	dbg_hcc_params(ehci, "reset");
 +
 +	ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
 +
 +	err = ehci_halt(ehci);
 +
 +	if (err)
 +		return err;
 +
 +	err = ehci_init(hcd);
 +
 +	if (err)
 +		return err;
 +
 +	ehci_reset(ehci);
 +
 +	return err;
 +}
 +
 +static const struct hc_driver ssb_ehci_hc_driver = {
 +	.description		= "ssb-usb-ehci",
 +	.product_desc		= "SSB EHCI Controller",
 +	.hcd_priv_size		= sizeof(struct ssb_ehci_device),
 +
 +	.irq			= ehci_irq,
 +	.flags			= HCD_MEMORY | HCD_USB2,
 +
 +	.reset			= ssb_ehci_reset,
 +	.start			= ehci_run,
 +	.stop			= ehci_stop,
 +	.shutdown		= ehci_shutdown,
 +
 +	.urb_enqueue		= ehci_urb_enqueue,
 +	.urb_dequeue		= ehci_urb_dequeue,
 +	.endpoint_disable	= ehci_endpoint_disable,
 +	.endpoint_reset		= ehci_endpoint_reset,
 +
 +	.get_frame_number	= ehci_get_frame,
 +
 +	.hub_status_data	= ehci_hub_status_data,
 +	.hub_control		= ehci_hub_control,
 +	.bus_suspend		= ehci_bus_suspend,
 +	.bus_resume		= ehci_bus_resume,
 +	.relinquish_port	= ehci_relinquish_port,
 +	.port_handed_over	= ehci_port_handed_over,
 +
 +	.clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
 +};
 +
 +static void ssb_ehci_detach(struct ssb_device *dev, struct usb_hcd *hcd)
 +{
 +	if (hcd->driver->shutdown)
 +		hcd->driver->shutdown(hcd);
 +
 +	usb_remove_hcd(hcd);
 +
 +	iounmap(hcd->regs);
 +	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
 +
 +	usb_put_hcd(hcd);
 +}
 +EXPORT_SYMBOL_GPL(ssb_ehci_detach);
 +
 +static int ssb_ehci_attach(struct ssb_device *dev, struct usb_hcd **ehci_hcd)
 +{
 +	struct ssb_ehci_device *ehcidev;
 +	struct usb_hcd *hcd;
 +	int err = -ENOMEM;
 +	u32 tmp, flags = 0;
 +
 +	hcd = usb_create_hcd(&ssb_ehci_hc_driver, dev->dev,
 +			     dev_name(dev->dev));
 +	if (!hcd)
 +		goto err_dev_disable;
 +
 +	ehcidev = hcd_to_ssb_ehci(hcd);
 +	ehcidev->enable_flags = flags;
 +	tmp = ssb_read32(dev, SSB_ADMATCH0);
 +	hcd->rsrc_start = ssb_admatch_base(tmp) + 0x800; /* ehci core offset */
 +	hcd->rsrc_len = 0x100; /* ehci reg block size */
 +	/*
 +	 * start & size modified per sbutils.c
 +	 */
 +	hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
 +	if (!hcd->regs)
 +		goto err_put_hcd;
 +	err = usb_add_hcd(hcd, dev->irq, IRQF_SHARED | IRQF_DISABLED);
 +	if (err)
 +		goto err_iounmap;
 +
 +	*ehci_hcd = hcd;
 +
 +	return err;
 +
 +err_iounmap:
 +	iounmap(hcd->regs);
 +err_put_hcd:
 +	usb_put_hcd(hcd);
 +err_dev_disable:
 +	ssb_device_disable(dev, flags);
 +	return err;
 +}
 +EXPORT_SYMBOL_GPL(ssb_ehci_attach);
 +
 +static const struct ssb_device_id ssb_ehci_table[] = {
 +	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB20_HOST, SSB_ANY_REV),
 +	SSB_DEVTABLE_END
 +};
 +MODULE_DEVICE_TABLE(ssb, ssb_ehci_table);
 --- a/drivers/usb/host/ohci-ssb.c
 +++ b/drivers/usb/host/ohci-ssb.c
@@ -17,6 +17,8 @@
  */
 #include <linux/ssb/ssb.h>
 +extern int ssb_ehci_attach(struct ssb_device *dev, struct usb_hcd **hcd);
 +extern void ssb_ehci_detach(struct ssb_device *dev, struct usb_hcd *hcd);
 #define SSB_OHCI_TMSLOW_HOSTMODE	(1 << 29)
@@ -24,6 +26,7 @@ struct ssb_ohci_device {
 	struct ohci_hcd ohci; /* _must_ be at the beginning. */
 	u32 enable_flags;
 +	struct usb_hcd *ehci_hcd;
 };
 static inline
@@ -92,13 +95,25 @@ static const struct hc_driver ssb_ohci_h
 static void ssb_ohci_detach(struct ssb_device *dev)
 {
 	struct usb_hcd *hcd = ssb_get_drvdata(dev);
 +#ifdef CONFIG_USB_EHCI_HCD_SSB
 +	struct ssb_ohci_device *ohcidev = hcd_to_ssb_ohci(hcd);
 +#endif
 	usb_remove_hcd(hcd);
 	iounmap(hcd->regs);
 	usb_put_hcd(hcd);
 +
 +#ifdef CONFIG_USB_EHCI_HCD_SSB
 +	/*
 +	 * Also detach ehci function
 +	 */
 +	if (dev->id.coreid == SSB_DEV_USB20_HOST)
 +		ssb_ehci_detach(dev, ohcidev->ehci_hcd);
 +#endif
 	ssb_device_disable(dev, 0);
 }
 +
 static int ssb_ohci_attach(struct ssb_device *dev)
 {
 	struct ssb_ohci_device *ohcidev;
@@ -165,6 +180,14 @@ static int ssb_ohci_attach(struct ssb_de
 	ssb_set_drvdata(dev, hcd);
 +#ifdef CONFIG_USB_EHCI_HCD_SSB
 +	/*
 +	 * attach ehci function in this core
 +	 */
 +	if (dev->id.coreid == SSB_DEV_USB20_HOST)
 +		err = ssb_ehci_attach(dev, &(ohcidev->ehci_hcd));
 +#endif
 +
 	return err;
 err_iounmap:
--- a/target/linux/brcm47xx/patches-2.6.32/275-usb2-bcm5354-init.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/275-usb2-bcm5354-init.patch
@ -1,63 +0,0 @@
 This patch significantly improves the reliability of high speed 
 usb writes on the bcm5354. It implements a work around for version 2
 of the usb20 core that was cribbed from the GPL sources for the 
 Asus wl500gpv2 and verified against the wl520gu sources.
 Reference:
 GPL/WL-520gu-NewUI/src/linux/linux/arch/mips/brcm-boards/bcm947xx/pcibios.c
 GPL/WL-500gPV2-NewUI/src/linux/linux/arch/mips/brcm-boards/bcm947xx/pcibios.c
 Signed-off-by: Steve Brown <sbrown@cortland.com>
 ---
 drivers/usb/host/ohci-ssb.c |   37 +++++++++++++++++++++++--------------
 1 file changed, 23 insertions(+), 14 deletions(-)
 --- a/drivers/usb/host/ohci-ssb.c
 +++ b/drivers/usb/host/ohci-ssb.c
@@ -141,22 +141,31 @@ static int ssb_ohci_attach(struct ssb_de
 		 */
 		ssb_device_enable(dev, 0);
 		ssb_write32(dev, 0x200, 0x7ff);
 +
 +		/* Change Flush control reg */
 +		tmp = ssb_read32(dev, 0x400);
 +		tmp &= ~8;
 +		ssb_write32(dev, 0x400, tmp);
 +		tmp = ssb_read32(dev, 0x400);
 +
 +		/* Change Shim control reg */
 +		tmp = ssb_read32(dev, 0x304);
 +		tmp &= ~0x100;
 +		ssb_write32(dev, 0x304, tmp);
 +		tmp = ssb_read32(dev, 0x304);
 +
 		udelay(1);
 -		if (dev->id.revision == 1) { // bug in rev 1
 -			/* Change Flush control reg */
 -			tmp = ssb_read32(dev, 0x400);
 -			tmp &= ~8;
 -			ssb_write32(dev, 0x400, tmp);
 -			tmp = ssb_read32(dev, 0x400);
 -			printk("USB20H fcr: 0x%0x\n", tmp);
 -
 -			/* Change Shim control reg */
 -			tmp = ssb_read32(dev, 0x304);
 -			tmp &= ~0x100;
 -			ssb_write32(dev, 0x304, tmp);
 -			tmp = ssb_read32(dev, 0x304);
 -			printk("USB20H shim: 0x%0x\n", tmp);
 +		/* Work around for 5354 failures */
 +		if ((dev->id.revision == 2) && (dev->bus->chip_id == 0x5354)) {
 +			/* Change syn01 reg */
 +			tmp = 0x00fe00fe;
 +			ssb_write32(dev, 0x894, tmp);
 +
 +			/* Change syn03 reg */
 +			tmp = ssb_read32(dev, 0x89c);
 +			tmp |= 0x1;
 +			ssb_write32(dev, 0x89c, tmp);
 		}
 	} else
 		ssb_device_enable(dev, 0);
--- a/target/linux/brcm47xx/patches-2.6.32/280-activate_ssb_support_in_usb.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/280-activate_ssb_support_in_usb.patch
@ -1,16 +0,0 @@
 This prevents the options from being delete with make kernel_oldconfig.
 ---
 drivers/ssb/Kconfig |    2 ++
 1 file changed, 2 insertions(+)
 --- a/drivers/ssb/Kconfig
 +++ b/drivers/ssb/Kconfig
@@ -141,6 +141,8 @@ config SSB_DRIVER_MIPS
 config SSB_EMBEDDED
 	bool
 	depends on SSB_DRIVER_MIPS
 +	select USB_EHCI_HCD_SSB if USB_EHCI_HCD
 +	select USB_OHCI_HCD_SSB if USB_OHCI_HCD
 	default y
 config SSB_DRIVER_EXTIF
--- a/target/linux/brcm47xx/patches-2.6.32/300-fork_cacheflush.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/300-fork_cacheflush.patch
@ -1,11 +0,0 @@
 --- a/arch/mips/include/asm/cacheflush.h
 +++ b/arch/mips/include/asm/cacheflush.h
@@ -32,7 +32,7 @@
 extern void (*flush_cache_all)(void);
 extern void (*__flush_cache_all)(void);
 extern void (*flush_cache_mm)(struct mm_struct *mm);
 -#define flush_cache_dup_mm(mm)	do { (void) (mm); } while (0)
 +#define flush_cache_dup_mm(mm) flush_cache_mm(mm)
 extern void (*flush_cache_range)(struct vm_area_struct *vma,
 	unsigned long start, unsigned long end);
 extern void (*flush_cache_page)(struct vm_area_struct *vma, unsigned long page, unsigned long pfn);
--- a/target/linux/brcm47xx/patches-2.6.32/301-kmod-fuse-dcache-bug-r4k.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/301-kmod-fuse-dcache-bug-r4k.patch
@ -1,31 +0,0 @@
 --- a/arch/mips/mm/c-r4k.c
 +++ b/arch/mips/mm/c-r4k.c
@@ -373,7 +373,7 @@ static inline void local_r4k___flush_cac
 	}
 }
 -static void r4k___flush_cache_all(void)
 +void r4k___flush_cache_all(void)
 {
 	r4k_on_each_cpu(local_r4k___flush_cache_all, NULL, 1);
 }
@@ -537,7 +537,7 @@ static inline void local_r4k_flush_cache
 	}
 }
 -static void r4k_flush_cache_page(struct vm_area_struct *vma,
 +void r4k_flush_cache_page(struct vm_area_struct *vma,
 	unsigned long addr, unsigned long pfn)
 {
 	struct flush_cache_page_args args;
@@ -1456,3 +1456,10 @@ void __cpuinit r4k_cache_init(void)
 	coherency_setup();
 #endif
 }
 +
 +// fuse package DCACHE BUG patch exports
 +void (*fuse_flush_cache_all)(void) = r4k___flush_cache_all;
 +void (*fuse_flush_cache_page)(struct vm_area_struct *vma, unsigned long page,
 +        unsigned long pfn) = r4k_flush_cache_page;
 +EXPORT_SYMBOL(fuse_flush_cache_page);
 +EXPORT_SYMBOL(fuse_flush_cache_all);
--- a/target/linux/brcm47xx/patches-2.6.32/302-kmod-fuse-dcache-bug-fuse.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/302-kmod-fuse-dcache-bug-fuse.patch
@ -1,82 +0,0 @@
 --- a/fs/fuse/dev.c
 +++ b/fs/fuse/dev.c
@@ -533,6 +533,11 @@ static void fuse_copy_finish(struct fuse
 	}
 }
 +#ifdef DCACHE_BUG
 +extern void (*fuse_flush_cache_all)(void);
 +extern void (*fuse_flush_cache_page)(struct vm_area_struct *vma, unsigned long page, unsigned long pfn);
 +#endif
 +
 /*
  * Get another pagefull of userspace buffer, and map it to kernel
  * address space, and lock request
@@ -541,6 +546,9 @@ static int fuse_copy_fill(struct fuse_co
 {
 	unsigned long offset;
 	int err;
 +#ifdef DCACHE_BUG
 +	struct vm_area_struct *vma;
 +#endif
 	unlock_request(cs->fc, cs->req);
 	fuse_copy_finish(cs);
@@ -552,14 +560,22 @@ static int fuse_copy_fill(struct fuse_co
 		cs->nr_segs--;
 	}
 	down_read(&current->mm->mmap_sem);
 +#ifndef DCACHE_BUG
 	err = get_user_pages(current, current->mm, cs->addr, 1, cs->write, 0,
 			     &cs->pg, NULL);
 +#else
 +	err = get_user_pages(current, current->mm, cs->addr, 1, cs->write, 0,
 +			     &cs->pg, &vma);
 +#endif
 	up_read(&current->mm->mmap_sem);
 	if (err < 0)
 		return err;
 	BUG_ON(err != 1);
 	offset = cs->addr % PAGE_SIZE;
 	cs->mapaddr = kmap_atomic(cs->pg, KM_USER0);
 +#ifdef DCACHE_BUG
 +	fuse_flush_cache_page(vma, cs->addr, page_to_pfn(cs->pg));
 +#endif
 	cs->buf = cs->mapaddr + offset;
 	cs->len = min(PAGE_SIZE - offset, cs->seglen);
 	cs->seglen -= cs->len;
@@ -573,6 +589,11 @@ static int fuse_copy_do(struct fuse_copy
 {
 	unsigned ncpy = min(*size, cs->len);
 	if (val) {
 +#ifdef DCACHE_BUG
 +		// patch from mailing list, it is very important, otherwise,
 +		// can't mount, or ls mount point will hang
 +		fuse_flush_cache_all();
 +#endif
 		if (cs->write)
 			memcpy(cs->buf, *val, ncpy);
 		else
 --- a/fs/fuse/fuse_i.h
 +++ b/fs/fuse/fuse_i.h
@@ -8,6 +8,7 @@
 #ifndef _FS_FUSE_I_H
 #define _FS_FUSE_I_H
 +#define DCACHE_BUG
 #include <linux/fuse.h>
 #include <linux/fs.h>
 --- a/fs/fuse/inode.c
 +++ b/fs/fuse/inode.c
@@ -1201,6 +1201,10 @@ static int __init fuse_init(void)
 	printk(KERN_INFO "fuse init (API version %i.%i)\n",
 	       FUSE_KERNEL_VERSION, FUSE_KERNEL_MINOR_VERSION);
 +#ifdef DCACHE_BUG
 +printk("fuse init: DCACHE_BUG enabled\n");
 +#endif
 +
 	INIT_LIST_HEAD(&fuse_conn_list);
 	res = fuse_fs_init();
 	if (res)
--- a/target/linux/brcm47xx/patches-2.6.32/310-no_highpage.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/310-no_highpage.patch
@ -1,66 +0,0 @@
 --- a/arch/mips/include/asm/page.h
 +++ b/arch/mips/include/asm/page.h
@@ -43,6 +43,7 @@
 #ifndef __ASSEMBLY__
 #include <linux/pfn.h>
 +#include <asm/cpu-features.h>
 #include <asm/io.h>
 extern void build_clear_page(void);
@@ -78,13 +79,16 @@ static inline void clear_user_page(void 
 		flush_data_cache_page((unsigned long)addr);
 }
 -extern void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
 -	struct page *to);
 -struct vm_area_struct;
 -extern void copy_user_highpage(struct page *to, struct page *from,
 -	unsigned long vaddr, struct vm_area_struct *vma);
 +static inline void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
 +	struct page *to)
 +{
 +	extern void (*flush_data_cache_page)(unsigned long addr);
 -#define __HAVE_ARCH_COPY_USER_HIGHPAGE
 +	copy_page(vto, vfrom);
 +	if (!cpu_has_ic_fills_f_dc ||
 +	    pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK))
 +		flush_data_cache_page((unsigned long)vto);
 +}
 /*
  * These are used to make use of C type-checking..
 --- a/arch/mips/mm/init.c
 +++ b/arch/mips/mm/init.c
@@ -203,30 +203,6 @@ void kunmap_coherent(void)
 	preempt_check_resched();
 }
 -void copy_user_highpage(struct page *to, struct page *from,
 -	unsigned long vaddr, struct vm_area_struct *vma)
 -{
 -	void *vfrom, *vto;
 -
 -	vto = kmap_atomic(to, KM_USER1);
 -	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
 -	    page_mapped(from) && !Page_dcache_dirty(from)) {
 -		vfrom = kmap_coherent(from, vaddr);
 -		copy_page(vto, vfrom);
 -		kunmap_coherent();
 -	} else {
 -		vfrom = kmap_atomic(from, KM_USER0);
 -		copy_page(vto, vfrom);
 -		kunmap_atomic(vfrom, KM_USER0);
 -	}
 -	if ((!cpu_has_ic_fills_f_dc) ||
 -	    pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK))
 -		flush_data_cache_page((unsigned long)vto);
 -	kunmap_atomic(vto, KM_USER1);
 -	/* Make sure this page is cleared on other CPU's too before using it */
 -	smp_wmb();
 -}
 -
 void copy_to_user_page(struct vm_area_struct *vma,
 	struct page *page, unsigned long vaddr, void *dst, const void *src,
 	unsigned long len)
--- a/target/linux/brcm47xx/patches-2.6.32/400-arch-bcm47xx.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/400-arch-bcm47xx.patch
@ -1,319 +0,0 @@
 --- a/arch/mips/Kconfig
 +++ b/arch/mips/Kconfig
@@ -74,6 +74,7 @@ config BCM47XX
 	select SSB_DRIVER_MIPS
 	select SSB_DRIVER_EXTIF
 	select SSB_EMBEDDED
 +	select SSB_B43_PCI_BRIDGE if PCI
 	select SSB_PCICORE_HOSTMODE if PCI
 	select GENERIC_GPIO
 	select SYS_HAS_EARLY_PRINTK
 --- a/arch/mips/bcm47xx/Makefile
 +++ b/arch/mips/bcm47xx/Makefile
@@ -3,4 +3,4 @@
 # under Linux.
 #
 -obj-y := gpio.o irq.o prom.o serial.o setup.o time.o wgt634u.o
 +obj-y := cfe_env.o gpio.o irq.o nvram.o prom.o serial.o setup.o time.o wgt634u.o
 --- a/arch/mips/bcm47xx/irq.c
 +++ b/arch/mips/bcm47xx/irq.c
@@ -1,5 +1,6 @@
 /*
  *  Copyright (C) 2004 Florian Schirmer <jolt@tuxbox.org>
 + *  Copyright (C) 2008 Michael Buesch <mb@bu3sch.de>
  *
  *  This program is free software; you can redistribute  it and/or modify it
  *  under  the terms of  the GNU General  Public License as published by the
@@ -23,10 +24,19 @@
  */
 #include <linux/types.h>
 +#include <linux/errno.h>
 +#include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
 +#include <linux/pci.h>
 +#include <linux/ssb/ssb.h>
 +
 #include <asm/irq_cpu.h>
 +
 +extern struct ssb_bus ssb_bcm47xx;
 +
 +
 void plat_irq_dispatch(void)
 {
 	u32 cause;
 --- a/arch/mips/bcm47xx/nvram.c
 +++ b/arch/mips/bcm47xx/nvram.c
@@ -24,10 +24,10 @@
 #include <asm/io.h>
 #include <asm/uaccess.h>
 -#include <nvram.h>
 +#include "include/nvram.h"
 #define MB * 1048576
 -extern struct ssb_bus ssb;
 +extern struct ssb_bus ssb_bcm47xx;
 static char nvram_buf[NVRAM_SPACE];
 static int cfe_env;
@@ -36,7 +36,7 @@ extern char *cfe_env_get(char *nv_buf, c
 /* Probe for NVRAM header */
 static void __init early_nvram_init(void)
 {
 -	struct ssb_mipscore *mcore = &ssb.mipscore;
 +	struct ssb_mipscore *mcore = &ssb_bcm47xx.mipscore;
 	struct nvram_header *header;
 	int i;
 	u32 base, lim, off;
 --- a/arch/mips/bcm47xx/setup.c
 +++ b/arch/mips/bcm47xx/setup.c
@@ -2,7 +2,7 @@
  *  Copyright (C) 2004 Florian Schirmer <jolt@tuxbox.org>
  *  Copyright (C) 2005 Waldemar Brodkorb <wbx@openwrt.org>
  *  Copyright (C) 2006 Felix Fietkau <nbd@openwrt.org>
 - *  Copyright (C) 2006 Michael Buesch <mb@bu3sch.de>
 + *  Copyright (C) 2006-2008 Michael Buesch <mb@bu3sch.de>
  *
  *  This program is free software; you can redistribute  it and/or modify it
  *  under  the terms of  the GNU General  Public License as published by the
@@ -25,18 +25,28 @@
  *  675 Mass Ave, Cambridge, MA 02139, USA.
  */
 +#include <linux/init.h>
 #include <linux/types.h>
 #include <linux/ssb/ssb.h>
 #include <linux/ssb/ssb_embedded.h>
 +#include <linux/tty.h>
 +#include <linux/serial.h>
 +#include <linux/serial_core.h>
 +#include <linux/serial_reg.h>
 +#include <linux/serial_8250.h>
 #include <asm/bootinfo.h>
 #include <asm/reboot.h>
 #include <asm/time.h>
 -#include <bcm47xx.h>
 #include <asm/fw/cfe/cfe_api.h>
 +#include <linux/pm.h>
 +
 +#include "include/nvram.h"
 struct ssb_bus ssb_bcm47xx;
 EXPORT_SYMBOL(ssb_bcm47xx);
 +extern void bcm47xx_pci_init(void);
 +
 static void bcm47xx_machine_restart(char *command)
 {
 	printk(KERN_ALERT "Please stand by while rebooting the system...\n");
@@ -56,7 +66,7 @@ static void bcm47xx_machine_halt(void)
 		cpu_relax();
 }
 -static void str2eaddr(char *str, char *dest)
 +static void e_aton(char *str, char *dest)
 {
 	int i = 0;
@@ -73,52 +83,142 @@ static void str2eaddr(char *str, char *d
 	}
 }
 -static int bcm47xx_get_invariants(struct ssb_bus *bus,
 -				   struct ssb_init_invariants *iv)
 +static void bcm47xx_fill_sprom(struct ssb_sprom *sprom)
 {
 -	char buf[100];
 +	char *s;
 -	/* Fill boardinfo structure */
 -	memset(&(iv->boardinfo), 0 , sizeof(struct ssb_boardinfo));
 +	memset(sprom, 0xFF, sizeof(struct ssb_sprom));
 -	if (cfe_getenv("boardvendor", buf, sizeof(buf)) >= 0)
 -		iv->boardinfo.type = (u16)simple_strtoul(buf, NULL, 0);
 -	if (cfe_getenv("boardtype", buf, sizeof(buf)) >= 0)
 -		iv->boardinfo.type = (u16)simple_strtoul(buf, NULL, 0);
 -	if (cfe_getenv("boardrev", buf, sizeof(buf)) >= 0)
 -		iv->boardinfo.rev = (u16)simple_strtoul(buf, NULL, 0);
 -
 -	/* Fill sprom structure */
 -	memset(&(iv->sprom), 0, sizeof(struct ssb_sprom));
 -	iv->sprom.revision = 3;
 -
 -	if (cfe_getenv("et0macaddr", buf, sizeof(buf)) >= 0)
 -		str2eaddr(buf, iv->sprom.et0mac);
 -	if (cfe_getenv("et1macaddr", buf, sizeof(buf)) >= 0)
 -		str2eaddr(buf, iv->sprom.et1mac);
 -	if (cfe_getenv("et0phyaddr", buf, sizeof(buf)) >= 0)
 -		iv->sprom.et0phyaddr = simple_strtoul(buf, NULL, 10);
 -	if (cfe_getenv("et1phyaddr", buf, sizeof(buf)) >= 0)
 -		iv->sprom.et1phyaddr = simple_strtoul(buf, NULL, 10);
 -	if (cfe_getenv("et0mdcport", buf, sizeof(buf)) >= 0)
 -		iv->sprom.et0mdcport = simple_strtoul(buf, NULL, 10);
 -	if (cfe_getenv("et1mdcport", buf, sizeof(buf)) >= 0)
 -		iv->sprom.et1mdcport = simple_strtoul(buf, NULL, 10);
 +	sprom->revision = 1;
 +	if ((s = nvram_get("il0macaddr")))
 +		e_aton(s, sprom->il0mac);
 +	if ((s = nvram_get("et0macaddr")))
 +		e_aton(s, sprom->et0mac);
 +	if ((s = nvram_get("et1macaddr")))
 +		e_aton(s, sprom->et1mac);
 +	if ((s = nvram_get("et0phyaddr")))
 +		sprom->et0phyaddr = simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("et1phyaddr")))
 +		sprom->et1phyaddr = simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("et0mdcport")))
 +		sprom->et0mdcport = !!simple_strtoul(s, NULL, 10);
 +	if ((s = nvram_get("et1mdcport")))
 +		sprom->et1mdcport = !!simple_strtoul(s, NULL, 10);
 +	if ((s = nvram_get("pa0b0")))
 +		sprom->pa0b0 = simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("pa0b1")))
 +		sprom->pa0b1 = simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("pa0b2")))
 +		sprom->pa0b2 = simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("pa1b0")))
 +		sprom->pa1b0 = simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("pa1b1")))
 +		sprom->pa1b1 = simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("pa1b2")))
 +		sprom->pa1b2 = simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("wl0gpio0")))
 +		sprom->gpio0 = simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("wl0gpio1")))
 +		sprom->gpio1 = simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("wl0gpio2")))
 +		sprom->gpio2 = simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("wl0gpio3")))
 +		sprom->gpio3 = simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("pa0maxpwr")))
 +		sprom->maxpwr_bg = simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("pa1maxpwr")))
 +		sprom->maxpwr_a = simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("pa0itssit")))
 +		sprom->itssi_bg = simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("pa1itssit")))
 +		sprom->itssi_a = simple_strtoul(s, NULL, 0);
 +	sprom->boardflags_lo = 0;
 +	if ((s = nvram_get("boardflags")))
 +		sprom->boardflags_lo = simple_strtoul(s, NULL, 0);
 +	sprom->boardflags_hi = 0;
 +	if ((s = nvram_get("boardflags2")))
 +		sprom->boardflags_hi = simple_strtoul(s, NULL, 0);
 +}
 +
 +static int bcm47xx_get_invariants(struct ssb_bus *bus, struct ssb_init_invariants *iv)
 +{
 +	char *s;
 +
 +	iv->boardinfo.vendor = SSB_BOARDVENDOR_BCM;
 +	if ((s = nvram_get("boardtype")))
 +		iv->boardinfo.type = (u16)simple_strtoul(s, NULL, 0);
 +	if ((s = nvram_get("boardrev")))
 +		iv->boardinfo.rev = (u16)simple_strtoul(s, NULL, 0);
 +
 +	bcm47xx_fill_sprom(&iv->sprom);
 +
 +	if ((s = nvram_get("cardbus")))
 +		iv->has_cardbus_slot = !!simple_strtoul(s, NULL, 10);
 	return 0;
 }
 void __init plat_mem_setup(void)
 {
 -	int err;
 +	int i, err;
 +	char *s;
 +	struct ssb_mipscore *mcore;
 +
 +	err = ssb_bus_ssbbus_register(&ssb_bcm47xx, SSB_ENUM_BASE, bcm47xx_get_invariants);
 +	if (err) {
 +		const char *msg = "Failed to initialize SSB bus (err %d)\n";
 +		printk(msg, err); /* Make sure the message gets out of the box. */
 +		panic(msg, err);
 +	}
 +	mcore = &ssb_bcm47xx.mipscore;
 -	err = ssb_bus_ssbbus_register(&ssb_bcm47xx, SSB_ENUM_BASE,
 -				      bcm47xx_get_invariants);
 -	if (err)
 -		panic("Failed to initialize SSB bus (err %d)\n", err);
 +	s = nvram_get("kernel_args");
 +	if (s && !strncmp(s, "console=ttyS1", 13)) {
 +		struct ssb_serial_port port;
 +
 +		printk("Swapping serial ports!\n");
 +		/* swap serial ports */
 +		memcpy(&port, &mcore->serial_ports[0], sizeof(port));
 +		memcpy(&mcore->serial_ports[0], &mcore->serial_ports[1], sizeof(port));
 +		memcpy(&mcore->serial_ports[1], &port, sizeof(port));
 +	}
 +
 +	for (i = 0; i < mcore->nr_serial_ports; i++) {
 +		struct ssb_serial_port *port = &(mcore->serial_ports[i]);
 +		struct uart_port s;
 +
 +		memset(&s, 0, sizeof(s));
 +		s.line = i;
 +		s.mapbase = (unsigned int) port->regs;
 +		s.membase = port->regs;
 +		s.irq = port->irq + 2;
 +		s.uartclk = port->baud_base;
 +		s.flags = UPF_BOOT_AUTOCONF | UPF_SHARE_IRQ;
 +		s.iotype = SERIAL_IO_MEM;
 +		s.regshift = port->reg_shift;
 +
 +		early_serial_setup(&s);
 +	}
 +	printk("Serial init done.\n");
 	_machine_restart = bcm47xx_machine_restart;
 	_machine_halt = bcm47xx_machine_halt;
 	pm_power_off = bcm47xx_machine_halt;
 }
 +static int __init bcm47xx_register_gpiodev(void)
 +{
 +	static struct resource res = {
 +		.start = 0xFFFFFFFF,
 +	};
 +	struct platform_device *pdev;
 +
 +	pdev = platform_device_register_simple("GPIODEV", 0, &res, 1);
 +	if (!pdev) {
 +		printk(KERN_ERR "bcm47xx: GPIODEV init failed\n");
 +		return -ENODEV;
 +	}
 +
 +	return 0;
 +}
 +device_initcall(bcm47xx_register_gpiodev);
 --- a/arch/mips/bcm47xx/time.c
 +++ b/arch/mips/bcm47xx/time.c
@@ -22,11 +22,17 @@
  *  675 Mass Ave, Cambridge, MA 02139, USA.
  */
 -
 #include <linux/init.h>
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/serial_reg.h>
 +#include <linux/interrupt.h>
 #include <linux/ssb/ssb.h>
 +#include <asm/addrspace.h>
 +#include <asm/io.h>
 #include <asm/time.h>
 -#include <bcm47xx.h>
 +
 +extern struct ssb_bus ssb_bcm47xx;
 void __init plat_time_init(void)
 {
--- a/target/linux/brcm47xx/patches-2.6.32/601-mips-remove-pci-collision-check.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/601-mips-remove-pci-collision-check.patch
@ -1,18 +0,0 @@
 --- a/arch/mips/pci/pci.c
 +++ b/arch/mips/pci/pci.c
@@ -185,12 +185,10 @@ static int pcibios_enable_resources(stru
 		if ((idx == PCI_ROM_RESOURCE) &&
 				(!(r->flags & IORESOURCE_ROM_ENABLE)))
 			continue;
 -		if (!r->start && r->end) {
 -			printk(KERN_ERR "PCI: Device %s not available "
 -			       "because of resource collisions\n",
 +		if (!r->start && r->end)
 +			printk(KERN_WARNING "PCI: Device %s resource"
 +			       "collisions detected. Ignoring...\n",
 			       pci_name(dev));
 -			return -EINVAL;
 -		}
 		if (r->flags & IORESOURCE_IO)
 			cmd |= PCI_COMMAND_IO;
 		if (r->flags & IORESOURCE_MEM)
--- a/target/linux/brcm47xx/patches-2.6.32/610-pci_ide_fix.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/610-pci_ide_fix.patch
@ -1,14 +0,0 @@
 --- a/include/linux/ide.h
 +++ b/include/linux/ide.h
@@ -195,7 +195,11 @@ static inline void ide_std_init_ports(st
 	hw->io_ports.ctl_addr = ctl_addr;
 }
 +#if defined CONFIG_BCM47XX
 +# define MAX_HWIFS	2
 +#else
 #define MAX_HWIFS	10
 +#endif
 /*
  * Now for the data we need to maintain per-drive:  ide_drive_t
--- a/target/linux/brcm47xx/patches-2.6.32/700-ssb-gigabit-ethernet-driver.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/700-ssb-gigabit-ethernet-driver.patch
@ -1,310 +0,0 @@
 --- a/drivers/net/tg3.c
 +++ b/drivers/net/tg3.c
@@ -41,6 +41,7 @@
 #include <linux/prefetch.h>
 #include <linux/dma-mapping.h>
 #include <linux/firmware.h>
 +#include <linux/ssb/ssb_driver_gige.h>
 #include <net/checksum.h>
 #include <net/ip.h>
@@ -457,8 +458,9 @@ static void _tw32_flush(struct tg3 *tp, 
 static inline void tw32_mailbox_flush(struct tg3 *tp, u32 off, u32 val)
 {
 	tp->write32_mbox(tp, off, val);
 -	if (!(tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER) &&
 -	    !(tp->tg3_flags2 & TG3_FLG2_ICH_WORKAROUND))
 +	if ((tp->tg3_flags3 & TG3_FLG3_FLUSH_POSTED_WRITES) ||
 +	    (!(tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER) &&
 +	     !(tp->tg3_flags2 & TG3_FLG2_ICH_WORKAROUND)))
 		tp->read32_mbox(tp, off);
 }
@@ -468,7 +470,7 @@ static void tg3_write32_tx_mbox(struct t
 	writel(val, mbox);
 	if (tp->tg3_flags & TG3_FLAG_TXD_MBOX_HWBUG)
 		writel(val, mbox);
 -	if (tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER)
 +	if ((tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER) || (tp->tg3_flags3 & TG3_FLG3_FLUSH_POSTED_WRITES))
 		readl(mbox);
 }
@@ -768,7 +770,7 @@ static void tg3_switch_clocks(struct tg3
 #define PHY_BUSY_LOOPS	5000
 -static int tg3_readphy(struct tg3 *tp, int reg, u32 *val)
 +static int __tg3_readphy(struct tg3 *tp, unsigned int phy_addr, int reg, u32 *val)
 {
 	u32 frame_val;
 	unsigned int loops;
@@ -817,7 +819,12 @@ static int tg3_readphy(struct tg3 *tp, i
 	return ret;
 }
 -static int tg3_writephy(struct tg3 *tp, int reg, u32 val)
 +static int tg3_readphy(struct tg3 *tp, int reg, u32 *val)
 +{
 +	return __tg3_readphy(tp, PHY_ADDR, reg, val);
 +}
 +
 +static int __tg3_writephy(struct tg3 *tp, unsigned int phy_addr, int reg, u32 val)
 {
 	u32 frame_val;
 	unsigned int loops;
@@ -866,6 +873,11 @@ static int tg3_writephy(struct tg3 *tp, 
 	return ret;
 }
 +static int tg3_writephy(struct tg3 *tp, int reg, u32 val)
 +{
 +	return __tg3_writephy(tp, PHY_ADDR, reg, val);
 +}
 +
 static int tg3_bmcr_reset(struct tg3 *tp)
 {
 	u32 phy_control;
@@ -2337,6 +2349,9 @@ static int tg3_nvram_read(struct tg3 *tp
 {
 	int ret;
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE)
 +		return -ENODEV;
 +
 	if (!(tp->tg3_flags & TG3_FLAG_NVRAM))
 		return tg3_nvram_read_using_eeprom(tp, offset, val);
@@ -2668,8 +2683,10 @@ static int tg3_set_power_state(struct tg
 	tg3_frob_aux_power(tp);
 	/* Workaround for unstable PLL clock */
 -	if ((GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5750_AX) ||
 -	    (GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5750_BX)) {
 +	if ((tp->phy_id & PHY_ID_MASK) != PHY_ID_BCM5750_2 &&
 +				/* !!! FIXME !!! */
 +	    ((GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5750_AX) ||
 +	    (GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5750_BX))) {
 		u32 val = tr32(0x7d00);
 		val &= ~((1 << 16) | (1 << 4) | (1 << 2) | (1 << 1) | 1);
@@ -3161,6 +3178,14 @@ relink:
 		tg3_phy_copper_begin(tp);
 +		if (tp->tg3_flags3 & TG3_FLG3_ROBOSWITCH) {
 +			current_link_up = 1;
 +			current_speed = SPEED_1000; //FIXME
 +			current_duplex = DUPLEX_FULL;
 +			tp->link_config.active_speed = current_speed;
 +			tp->link_config.active_duplex = current_duplex;
 +		}
 +
 		tg3_readphy(tp, MII_BMSR, &tmp);
 		if (!tg3_readphy(tp, MII_BMSR, &tmp) &&
 		    (tmp & BMSR_LSTATUS))
@@ -6273,6 +6298,11 @@ static int tg3_poll_fw(struct tg3 *tp)
 	int i;
 	u32 val;
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE) {
 +		/* We don't use firmware. */
 +		return 0;
 +	}
 +
 	if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
 		/* Wait up to 20ms for init done. */
 		for (i = 0; i < 200; i++) {
@@ -6550,6 +6580,14 @@ static int tg3_chip_reset(struct tg3 *tp
 		tw32(0x5000, 0x400);
 	}
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE) {
 +		/* BCM4785: In order to avoid repercussions from using potentially
 +		 * defective internal ROM, stop the Rx RISC CPU, which is not
 +		 * required. */
 +		tg3_stop_fw(tp);
 +		tg3_halt_cpu(tp, RX_CPU_BASE);
 +	}
 +
 	tw32(GRC_MODE, tp->grc_mode);
 	if (tp->pci_chip_rev_id == CHIPREV_ID_5705_A0) {
@@ -6704,9 +6742,12 @@ static int tg3_halt_cpu(struct tg3 *tp, 
 		return -ENODEV;
 	}
 -	/* Clear firmware's nvram arbitration. */
 -	if (tp->tg3_flags & TG3_FLAG_NVRAM)
 -		tw32(NVRAM_SWARB, SWARB_REQ_CLR0);
 +	if (!(tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE)) {
 +		/* Clear firmware's nvram arbitration. */
 +		if (tp->tg3_flags & TG3_FLAG_NVRAM)
 +			tw32(NVRAM_SWARB, SWARB_REQ_CLR0);
 +	}
 +
 	return 0;
 }
@@ -6769,6 +6810,11 @@ static int tg3_load_5701_a0_firmware_fix
 	const __be32 *fw_data;
 	int err, i;
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE) {
 +		/* We don't use firmware. */
 +		return 0;
 +	}
 +
 	fw_data = (void *)tp->fw->data;
 	/* Firmware blob starts with version numbers, followed by
@@ -6828,6 +6874,11 @@ static int tg3_load_tso_firmware(struct 
 	unsigned long cpu_base, cpu_scratch_base, cpu_scratch_size;
 	int err, i;
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE) {
 +		/* We don't use firmware. */
 +		return 0;
 +	}
 +
 	if (tp->tg3_flags2 & TG3_FLG2_HW_TSO)
 		return 0;
@@ -7915,6 +7966,11 @@ static void tg3_timer(unsigned long __op
 	spin_lock(&tp->lock);
 +	if (tp->tg3_flags3 & TG3_FLG3_FLUSH_POSTED_WRITES) {
 +		/* BCM4785: Flush posted writes from GbE to host memory. */
 +		tr32(HOSTCC_MODE);
 +	}
 +
 	if (!(tp->tg3_flags & TG3_FLAG_TAGGED_STATUS)) {
 		/* All of this garbage is because when using non-tagged
 		 * IRQ status the mailbox/status_block protocol the chip
@@ -9801,6 +9857,11 @@ static int tg3_test_nvram(struct tg3 *tp
 	if (tp->tg3_flags3 & TG3_FLG3_NO_NVRAM)
 		return 0;
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE) {
 +		/* We don't have NVRAM. */
 +		return 0;
 +	}
 +
 	if (tg3_nvram_read(tp, 0, &magic) != 0)
 		return -EIO;
@@ -10595,7 +10656,7 @@ static int tg3_ioctl(struct net_device *
 			return -EAGAIN;
 		spin_lock_bh(&tp->lock);
 -		err = tg3_readphy(tp, data->reg_num & 0x1f, &mii_regval);
 +		err = __tg3_readphy(tp, data->phy_id & 0x1f, data->reg_num & 0x1f, &mii_regval);
 		spin_unlock_bh(&tp->lock);
 		data->val_out = mii_regval;
@@ -10611,7 +10672,7 @@ static int tg3_ioctl(struct net_device *
 			return -EAGAIN;
 		spin_lock_bh(&tp->lock);
 -		err = tg3_writephy(tp, data->reg_num & 0x1f, data->val_in);
 +		err = __tg3_writephy(tp, data->phy_id & 0x1f, data->reg_num & 0x1f, data->val_in);
 		spin_unlock_bh(&tp->lock);
 		return err;
@@ -11256,6 +11317,12 @@ static void __devinit tg3_get_5717_nvram
 /* Chips other than 5700/5701 use the NVRAM for fetching info. */
 static void __devinit tg3_nvram_init(struct tg3 *tp)
 {
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE) {
 +		/* No NVRAM and EEPROM on the SSB Broadcom GigE core. */
 +		tp->tg3_flags &= ~(TG3_FLAG_NVRAM | TG3_FLAG_NVRAM_BUFFERED);
 +		return;
 +	}
 +
 	tw32_f(GRC_EEPROM_ADDR,
 	     (EEPROM_ADDR_FSM_RESET |
 	      (EEPROM_DEFAULT_CLOCK_PERIOD <<
@@ -11516,6 +11583,9 @@ static int tg3_nvram_write_block(struct 
 {
 	int ret;
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE)
 +		return -ENODEV;
 +
 	if (tp->tg3_flags & TG3_FLAG_EEPROM_WRITE_PROT) {
 		tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl &
 		       ~GRC_LCLCTRL_GPIO_OUTPUT1);
@@ -12801,6 +12871,11 @@ static int __devinit tg3_get_invariants(
 	      GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)))
 		tp->tg3_flags |= TG3_FLAG_SRAM_USE_CONFIG;
 +	if (tp->tg3_flags3 & TG3_FLG3_FLUSH_POSTED_WRITES) {
 +		tp->write32_tx_mbox = tg3_write_flush_reg32;
 +		tp->write32_rx_mbox = tg3_write_flush_reg32;
 +	}
 +
 	/* Get eeprom hw config before calling tg3_set_power_state().
 	 * In particular, the TG3_FLG2_IS_NIC flag must be
 	 * determined before calling tg3_set_power_state() so that
@@ -13190,6 +13265,10 @@ static int __devinit tg3_get_device_addr
 	}
 	if (!is_valid_ether_addr(&dev->dev_addr[0])) {
 +		if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE)
 +			ssb_gige_get_macaddr(tp->pdev, &dev->dev_addr[0]);
 +	}
 +	if (!is_valid_ether_addr(&dev->dev_addr[0])) {
 #ifdef CONFIG_SPARC
 		if (!tg3_get_default_macaddr_sparc(tp))
 			return 0;
@@ -13682,6 +13761,7 @@ static char * __devinit tg3_phy_string(s
 	case PHY_ID_BCM5704:	return "5704";
 	case PHY_ID_BCM5705:	return "5705";
 	case PHY_ID_BCM5750:	return "5750";
 +	case PHY_ID_BCM5750_2:	return "5750-2";
 	case PHY_ID_BCM5752:	return "5752";
 	case PHY_ID_BCM5714:	return "5714";
 	case PHY_ID_BCM5780:	return "5780";
@@ -13893,6 +13973,13 @@ static int __devinit tg3_init_one(struct
 		tp->msg_enable = tg3_debug;
 	else
 		tp->msg_enable = TG3_DEF_MSG_ENABLE;
 +	if (pdev_is_ssb_gige_core(pdev)) {
 +		tp->tg3_flags3 |= TG3_FLG3_IS_SSB_CORE;
 +		if (ssb_gige_must_flush_posted_writes(pdev))
 +			tp->tg3_flags3 |= TG3_FLG3_FLUSH_POSTED_WRITES;
 +		if (ssb_gige_have_roboswitch(pdev))
 +			tp->tg3_flags3 |= TG3_FLG3_ROBOSWITCH;
 +	}
 	/* The word/byte swap controls here control register access byte
 	 * swapping.  DMA data byte swapping is controlled in the GRC_MODE
 --- a/drivers/net/tg3.h
 +++ b/drivers/net/tg3.h
@@ -1939,6 +1939,9 @@
 #define  NIC_SRAM_RGMII_STD_IBND_DISABLE 0x00000004
 #define  NIC_SRAM_RGMII_EXT_IBND_RX_EN	 0x00000008
 #define  NIC_SRAM_RGMII_EXT_IBND_TX_EN	 0x00000010
 +#define TG3_FLG3_IS_SSB_CORE		0x00000800
 +#define TG3_FLG3_FLUSH_POSTED_WRITES	0x00001000
 +#define TG3_FLG3_ROBOSWITCH		0x00002000
 #define NIC_SRAM_RX_MINI_BUFFER_DESC	0x00001000
@@ -2824,6 +2827,7 @@ struct tg3 {
 #define PHY_ID_BCM5714			0x60008340
 #define PHY_ID_BCM5780			0x60008350
 #define PHY_ID_BCM5755			0xbc050cc0
 +#define PHY_ID_BCM5750_2		0xbc050cd0
 #define PHY_ID_BCM5787			0xbc050ce0
 #define PHY_ID_BCM5756			0xbc050ed0
 #define PHY_ID_BCM5784			0xbc050fa0
@@ -2868,7 +2872,7 @@ struct tg3 {
 	 (X) == PHY_ID_BCM5780 || (X) == PHY_ID_BCM5787 || \
 	 (X) == PHY_ID_BCM5755 || (X) == PHY_ID_BCM5756 || \
 	 (X) == PHY_ID_BCM5906 || (X) == PHY_ID_BCM5761 || \
 -	 (X) == PHY_ID_BCM8002)
 +	 (X) == PHY_ID_BCM8002 || (X) == PHY_ID_BCM5750_2)
 	struct tg3_hw_stats		*hw_stats;
 	dma_addr_t			stats_mapping;
--- a/target/linux/brcm47xx/patches-2.6.32/800-fix_cfe_detection.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/800-fix_cfe_detection.patch
@ -1,108 +0,0 @@
 --- a/arch/mips/bcm47xx/prom.c
 +++ b/arch/mips/bcm47xx/prom.c
@@ -32,6 +32,7 @@
 #include <asm/fw/cfe/cfe_error.h>
 static int cfe_cons_handle;
 +static void (* __prom_putchar)(char c);
 const char *get_system_type(void)
 {
@@ -40,65 +41,40 @@ const char *get_system_type(void)
 void prom_putchar(char c)
 {
 +	if (__prom_putchar)
 +		__prom_putchar(c);
 +}
 +
 +void prom_putchar_cfe(char c)
 +{
 	while (cfe_write(cfe_cons_handle, &c, 1) == 0)
 		;
 }
 -static __init void prom_init_cfe(void)
 +static __init int prom_init_cfe(void)
 {
 	uint32_t cfe_ept;
 	uint32_t cfe_handle;
 	uint32_t cfe_eptseal;
 -	int argc = fw_arg0;
 -	char **envp = (char **) fw_arg2;
 -	int *prom_vec = (int *) fw_arg3;
 -
 -	/*
 -	 * Check if a loader was used; if NOT, the 4 arguments are
 -	 * what CFE gives us (handle, 0, EPT and EPTSEAL)
 -	 */
 -	if (argc < 0) {
 -		cfe_handle = (uint32_t)argc;
 -		cfe_ept = (uint32_t)envp;
 -		cfe_eptseal = (uint32_t)prom_vec;
 -	} else {
 -		if ((int)prom_vec < 0) {
 -			/*
 -			 * Old loader; all it gives us is the handle,
 -			 * so use the "known" entrypoint and assume
 -			 * the seal.
 -			 */
 -			cfe_handle = (uint32_t)prom_vec;
 -			cfe_ept = 0xBFC00500;
 -			cfe_eptseal = CFE_EPTSEAL;
 -		} else {
 -			/*
 -			 * Newer loaders bundle the handle/ept/eptseal
 -			 * Note: prom_vec is in the loader's useg
 -			 * which is still alive in the TLB.
 -			 */
 -			cfe_handle = prom_vec[0];
 -			cfe_ept = prom_vec[2];
 -			cfe_eptseal = prom_vec[3];
 -		}
 -	}
 -	if (cfe_eptseal != CFE_EPTSEAL) {
 -		/* too early for panic to do any good */
 -		printk(KERN_ERR "CFE's entrypoint seal doesn't match.");
 -		while (1) ;
 -	}
 +	cfe_eptseal = (uint32_t) fw_arg3;
 +	cfe_handle = (uint32_t) fw_arg0;
 +	cfe_ept = (uint32_t) fw_arg2;
 +
 +	if (cfe_eptseal != CFE_EPTSEAL)
 +		return -1;
 	cfe_init(cfe_handle, cfe_ept);
 +	return 0;
 }
 -static __init void prom_init_console(void)
 +static __init void prom_init_console_cfe(void)
 {
 	/* Initialize CFE console */
 	cfe_cons_handle = cfe_getstdhandle(CFE_STDHANDLE_CONSOLE);
 }
 -static __init void prom_init_cmdline(void)
 +static __init void prom_init_cmdline_cfe(void)
 {
 	static char buf[CL_SIZE] __initdata;
@@ -160,9 +136,12 @@ static __init void prom_init_mem(void)
 void __init prom_init(void)
 {
 -	prom_init_cfe();
 -	prom_init_console();
 -	prom_init_cmdline();
 +	if (prom_init_cfe() == 0) {
 +		//prom_init_console_cfe();
 +		//prom_init_cmdline_cfe();
 +		__prom_putchar = prom_putchar_cfe;
 +	}
 +
 	prom_init_mem();
 }
--- a/target/linux/brcm47xx/patches-2.6.32/812-disable_wgt634u_crap.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/812-disable_wgt634u_crap.patch
@ -1,178 +0,0 @@
 --- a/arch/mips/bcm47xx/Makefile
 +++ b/arch/mips/bcm47xx/Makefile
@@ -3,4 +3,4 @@
 # under Linux.
 #
 -obj-y := cfe_env.o gpio.o irq.o nvram.o prom.o serial.o setup.o time.o wgt634u.o
 +obj-y := cfe_env.o gpio.o irq.o nvram.o prom.o serial.o setup.o time.o
 --- a/arch/mips/bcm47xx/wgt634u.c
 +++ /dev/null
@@ -1,167 +0,0 @@
 -/*
 - * This file is subject to the terms and conditions of the GNU General Public
 - * License.  See the file "COPYING" in the main directory of this archive
 - * for more details.
 - *
 - * Copyright (C) 2007 Aurelien Jarno <aurelien@aurel32.net>
 - */
 -
 -#include <linux/platform_device.h>
 -#include <linux/module.h>
 -#include <linux/leds.h>
 -#include <linux/mtd/physmap.h>
 -#include <linux/ssb/ssb.h>
 -#include <linux/interrupt.h>
 -#include <linux/reboot.h>
 -#include <linux/gpio.h>
 -#include <asm/mach-bcm47xx/bcm47xx.h>
 -
 -/* GPIO definitions for the WGT634U */
 -#define WGT634U_GPIO_LED	3
 -#define WGT634U_GPIO_RESET	2
 -#define WGT634U_GPIO_TP1	7
 -#define WGT634U_GPIO_TP2	6
 -#define WGT634U_GPIO_TP3	5
 -#define WGT634U_GPIO_TP4	4
 -#define WGT634U_GPIO_TP5	1
 -
 -static struct gpio_led wgt634u_leds[] = {
 -	{
 -		.name = "power",
 -		.gpio = WGT634U_GPIO_LED,
 -		.active_low = 1,
 -		.default_trigger = "heartbeat",
 -	},
 -};
 -
 -static struct gpio_led_platform_data wgt634u_led_data = {
 -	.num_leds =     ARRAY_SIZE(wgt634u_leds),
 -	.leds =         wgt634u_leds,
 -};
 -
 -static struct platform_device wgt634u_gpio_leds = {
 -	.name =         "leds-gpio",
 -	.id =           -1,
 -	.dev = {
 -		.platform_data = &wgt634u_led_data,
 -	}
 -};
 -
 -
 -/* 8MiB flash. The struct mtd_partition matches original Netgear WGT634U
 -   firmware. */
 -static struct mtd_partition wgt634u_partitions[] = {
 -	{
 -		.name       = "cfe",
 -		.offset     = 0,
 -		.size       = 0x60000,		/* 384k */
 -		.mask_flags = MTD_WRITEABLE 	/* force read-only */
 -	},
 -	{
 -		.name   = "config",
 -		.offset = 0x60000,
 -		.size   = 0x20000		/* 128k */
 -	},
 -	{
 -		.name   = "linux",
 -		.offset = 0x80000,
 -		.size   = 0x140000 		/* 1280k */
 -	},
 -	{
 -		.name   = "jffs",
 -		.offset = 0x1c0000,
 -		.size   = 0x620000 		/* 6272k */
 -	},
 -	{
 -		.name   = "nvram",
 -		.offset = 0x7e0000,
 -		.size   = 0x20000		/* 128k */
 -	},
 -};
 -
 -static struct physmap_flash_data wgt634u_flash_data = {
 -	.parts    = wgt634u_partitions,
 -	.nr_parts = ARRAY_SIZE(wgt634u_partitions)
 -};
 -
 -static struct resource wgt634u_flash_resource = {
 -	.flags = IORESOURCE_MEM,
 -};
 -
 -static struct platform_device wgt634u_flash = {
 -	.name          = "physmap-flash",
 -	.id            = 0,
 -	.dev           = { .platform_data = &wgt634u_flash_data, },
 -	.resource      = &wgt634u_flash_resource,
 -	.num_resources = 1,
 -};
 -
 -/* Platform devices */
 -static struct platform_device *wgt634u_devices[] __initdata = {
 -	&wgt634u_flash,
 -	&wgt634u_gpio_leds,
 -};
 -
 -static irqreturn_t gpio_interrupt(int irq, void *ignored)
 -{
 -	int state;
 -
 -	/* Interrupts are shared, check if the current one is
 -	   a GPIO interrupt. */
 -	if (!ssb_chipco_irq_status(&ssb_bcm47xx.chipco,
 -				   SSB_CHIPCO_IRQ_GPIO))
 -		return IRQ_NONE;
 -
 -	state = gpio_get_value(WGT634U_GPIO_RESET);
 -
 -	/* Interrupt are level triggered, revert the interrupt polarity
 -	   to clear the interrupt. */
 -	gpio_polarity(WGT634U_GPIO_RESET, state);
 -
 -	if (!state) {
 -		printk(KERN_INFO "Reset button pressed");
 -		ctrl_alt_del();
 -	}
 -
 -	return IRQ_HANDLED;
 -}
 -
 -static int __init wgt634u_init(void)
 -{
 -	/* There is no easy way to detect that we are running on a WGT634U
 -	 * machine. Use the MAC address as an heuristic. Netgear Inc. has
 -	 * been allocated ranges 00:09:5b:xx:xx:xx and 00:0f:b5:xx:xx:xx.
 -	 */
 -
 -	u8 *et0mac = ssb_bcm47xx.sprom.et0mac;
 -
 -	if (et0mac[0] == 0x00 &&
 -	    ((et0mac[1] == 0x09 && et0mac[2] == 0x5b) ||
 -	     (et0mac[1] == 0x0f && et0mac[2] == 0xb5))) {
 -		struct ssb_mipscore *mcore = &ssb_bcm47xx.mipscore;
 -
 -		printk(KERN_INFO "WGT634U machine detected.\n");
 -
 -		if (!request_irq(gpio_to_irq(WGT634U_GPIO_RESET),
 -				 gpio_interrupt, IRQF_SHARED,
 -				 "WGT634U GPIO", &ssb_bcm47xx.chipco)) {
 -			gpio_direction_input(WGT634U_GPIO_RESET);
 -			gpio_intmask(WGT634U_GPIO_RESET, 1);
 -			ssb_chipco_irq_mask(&ssb_bcm47xx.chipco,
 -					    SSB_CHIPCO_IRQ_GPIO,
 -					    SSB_CHIPCO_IRQ_GPIO);
 -		}
 -
 -		wgt634u_flash_data.width = mcore->flash_buswidth;
 -		wgt634u_flash_resource.start = mcore->flash_window;
 -		wgt634u_flash_resource.end = mcore->flash_window
 -					   + mcore->flash_window_size
 -					   - 1;
 -		return platform_add_devices(wgt634u_devices,
 -					    ARRAY_SIZE(wgt634u_devices));
 -	} else
 -		return -ENODEV;
 -}
 -
 -module_init(wgt634u_init);
 -
--- a/target/linux/brcm47xx/patches-2.6.32/813-use_netdev_alloc_skb.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/813-use_netdev_alloc_skb.patch
@ -1,11 +0,0 @@
 --- a/drivers/net/b44.c
 +++ b/drivers/net/b44.c
@@ -850,7 +850,7 @@ static int b44_rx(struct b44 *bp, int bu
 			struct sk_buff *copy_skb;
 			b44_recycle_rx(bp, cons, bp->rx_prod);
 -			copy_skb = dev_alloc_skb(len + 2);
 +			copy_skb = netdev_alloc_skb(bp->dev, len + 2);
 			if (copy_skb == NULL)
 				goto drop_it_no_recycle;
--- a/target/linux/brcm47xx/patches-2.6.32/900-disable_early_printk.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/900-disable_early_printk.patch
@ -1,10 +0,0 @@
 --- a/arch/mips/Kconfig
 +++ b/arch/mips/Kconfig
@@ -77,7 +77,6 @@ config BCM47XX
 	select SSB_B43_PCI_BRIDGE if PCI
 	select SSB_PCICORE_HOSTMODE if PCI
 	select GENERIC_GPIO
 -	select SYS_HAS_EARLY_PRINTK
 	select CFE
 	help
 	 Support for BCM47XX based boards
--- a/target/linux/brcm47xx/patches-2.6.32/920-cache-wround.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/920-cache-wround.patch
@ -1,135 +0,0 @@
 --- a/arch/mips/include/asm/r4kcache.h
 +++ b/arch/mips/include/asm/r4kcache.h
@@ -20,10 +20,25 @@
 #ifdef CONFIG_BCM47XX
 #include <asm/paccess.h>
 #include <linux/ssb/ssb.h>
 -#define BCM4710_DUMMY_RREG() ((void) *((u8 *) KSEG1ADDR(SSB_ENUM_BASE)))
 +#define BCM4710_DUMMY_RREG() bcm4710_dummy_rreg()
 +
 +static inline unsigned long bcm4710_dummy_rreg(void) {
 +      return (*(volatile unsigned long *)(KSEG1ADDR(SSB_ENUM_BASE)));
 +}
 +
 +#define BCM4710_FILL_TLB(addr) bcm4710_fill_tlb((void*)(addr))
 +
 +static inline unsigned long bcm4710_fill_tlb(void *addr) {
 +      return (*(unsigned long *)addr);
 +}
 +
 +#define BCM4710_PROTECTED_FILL_TLB(addr) bcm4710_protected_fill_tlb((void*)(addr))
 +
 +static inline void bcm4710_protected_fill_tlb(void *addr) {
 +      unsigned long x;
 +      get_dbe(x, (unsigned long *)addr);;
 +}
 -#define BCM4710_FILL_TLB(addr) (*(volatile unsigned long *)(addr))
 -#define BCM4710_PROTECTED_FILL_TLB(addr) ({ unsigned long x; get_dbe(x, (volatile unsigned long *)(addr)); })
 #else
 #define BCM4710_DUMMY_RREG()
 --- a/arch/mips/mm/tlbex.c
 +++ b/arch/mips/mm/tlbex.c
@@ -595,6 +595,9 @@ build_get_pgde32(u32 **p, unsigned int t
 #endif
 	uasm_i_addu(p, ptr, tmp, ptr);
 #else
 +#ifdef CONFIG_BCM47XX
 +	uasm_i_nop(p);
 +#endif
 	UASM_i_LA_mostly(p, ptr, pgdc);
 #endif
 	uasm_i_mfc0(p, tmp, C0_BADVADDR); /* get faulting address */
@@ -733,12 +736,12 @@ static void __cpuinit build_r4000_tlb_re
 		/* No need for uasm_i_nop */
 	}
 -#ifdef CONFIG_BCM47XX
 -	uasm_i_nop(&p);
 -#endif
 #ifdef CONFIG_64BIT
 	build_get_pmde64(&p, &l, &r, K0, K1); /* get pmd in K1 */
 #else
 +# ifdef CONFIG_BCM47XX
 +	uasm_i_nop(&p);
 +# endif
 	build_get_pgde32(&p, K0, K1); /* get pgd in K1 */
 #endif
@@ -750,6 +753,9 @@ static void __cpuinit build_r4000_tlb_re
 	build_update_entries(&p, K0, K1);
 	build_tlb_write_entry(&p, &l, &r, tlb_random);
 	uasm_l_leave(&l, p);
 +#ifdef CONFIG_BCM47XX
 +	uasm_i_nop(&p);
 +#endif
 	uasm_i_eret(&p); /* return from trap */
 #ifdef CONFIG_HUGETLB_PAGE
@@ -1188,12 +1194,12 @@ build_r4000_tlbchange_handler_head(u32 *
 				   struct uasm_reloc **r, unsigned int pte,
 				   unsigned int ptr)
 {
 -#ifdef CONFIG_BCM47XX
 -	uasm_i_nop(p);
 -#endif
 #ifdef CONFIG_64BIT
 	build_get_pmde64(p, l, r, pte, ptr); /* get pmd in ptr */
 #else
 +# ifdef CONFIG_BCM47XX
 +	uasm_i_nop(p);
 +# endif
 	build_get_pgde32(p, pte, ptr); /* get pgd in ptr */
 #endif
@@ -1230,6 +1236,9 @@ build_r4000_tlbchange_handler_tail(u32 *
 	build_update_entries(p, tmp, ptr);
 	build_tlb_write_entry(p, l, r, tlb_indexed);
 	uasm_l_leave(l, *p);
 +#ifdef CONFIG_BCM47XX
 +	uasm_i_nop(p);
 +#endif
 	uasm_i_eret(p); /* return from trap */
 #ifdef CONFIG_64BIT
 --- a/arch/mips/kernel/genex.S
 +++ b/arch/mips/kernel/genex.S
@@ -22,6 +22,19 @@
 #include <asm/page.h>
 #include <asm/thread_info.h>
 +#ifdef CONFIG_BCM47XX
 +# ifdef eret
 +#  undef eret
 +# endif
 +# define eret 					\
 +	.set push;				\
 +	.set noreorder;				\
 +	 nop; 					\
 +	 nop;					\
 +	 eret;					\
 +	.set pop;
 +#endif
 +
 #define PANIC_PIC(msg)					\
 		.set push;				\
 		.set	reorder;			\
@@ -54,7 +67,6 @@ NESTED(except_vec3_generic, 0, sp)
 	.set	noat
 #ifdef CONFIG_BCM47XX
 	nop
 -	nop
 #endif
 #if R5432_CP0_INTERRUPT_WAR
 	mfc0	k0, CP0_INDEX
@@ -79,6 +91,9 @@ NESTED(except_vec3_r4000, 0, sp)
 	.set	push
 	.set	mips3
 	.set	noat
 +#ifdef CONFIG_BCM47XX
 +	nop
 +#endif
 	mfc0	k1, CP0_CAUSE
 	li	k0, 31<<2
 	andi	k1, k1, 0x7c
--- a/target/linux/brcm47xx/patches-2.6.32/940-bcm47xx-yenta.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/940-bcm47xx-yenta.patch
@ -1,46 +0,0 @@
 --- a/drivers/pcmcia/yenta_socket.c
 +++ b/drivers/pcmcia/yenta_socket.c
@@ -866,6 +866,8 @@ static unsigned int yenta_probe_irq(stru
 	 * Probe for usable interrupts using the force
 	 * register to generate bogus card status events.
 	 */
 +#ifndef CONFIG_BCM47XX
 +	/* WRT54G3G does not like this */
 	cb_writel(socket, CB_SOCKET_EVENT, -1);
 	cb_writel(socket, CB_SOCKET_MASK, CB_CSTSMASK);
 	exca_writeb(socket, I365_CSCINT, 0);
@@ -880,6 +882,7 @@ static unsigned int yenta_probe_irq(stru
 	}
 	cb_writel(socket, CB_SOCKET_MASK, 0);
 	exca_writeb(socket, I365_CSCINT, 0);
 +#endif
 	mask = probe_irq_mask(val) & 0xffff;
@@ -960,6 +963,10 @@ static void yenta_get_socket_capabilitie
 	else
 		socket->socket.irq_mask = 0;
 +	/* irq mask probing is broken for the WRT54G3G */
 +	if (socket->socket.irq_mask == 0)
 +		socket->socket.irq_mask = 0x6f8;
 +
 	dev_printk(KERN_INFO, &socket->dev->dev,
 		   "ISA IRQ mask 0x%04x, PCI irq %d\n",
 		   socket->socket.irq_mask, socket->cb_irq);
@@ -1198,6 +1205,15 @@ static int __devinit yenta_probe (struct
 	dev_printk(KERN_INFO, &dev->dev,
 		   "Socket status: %08x\n", cb_readl(socket, CB_SOCKET_STATE));
 +	/* Generate an interrupt on card insert/remove */
 +	config_writew(socket, CB_SOCKET_MASK, CB_CSTSMASK | CB_CDMASK);
 +
 +	/* Set up Multifunction Routing Status Register */
 +	config_writew(socket, 0x8C, 0x1000 /* MFUNC3 to GPIO3 */ | 0x2 /* MFUNC0 to INTA */);
 +
 +	/* Switch interrupts to parallelized */
 +	config_writeb(socket, 0x92, 0x64);
 +
 	yenta_fixup_parent_bridge(dev->subordinate);
 	/* Register it with the pcmcia layer.. */
--- a/target/linux/brcm47xx/patches-2.6.32/950-sbb-sysfs-files.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/950-sbb-sysfs-files.patch
@ -1,45 +0,0 @@
 --- a/drivers/ssb/main.c
 +++ b/drivers/ssb/main.c
@@ -385,6 +385,34 @@ static int ssb_device_uevent(struct devi
 			     ssb_dev->id.revision);
 }
 +#define ssb_config_attr(attrib, field, format_string)					\
 +static ssize_t													\
 +attrib##_show(struct device *dev, struct device_attribute *attr, char *buf) \
 +{																\
 +	return sprintf (buf, format_string, dev_to_ssb_dev(dev)->field);		\
 +}
 +
 +ssb_config_attr(core_num, core_index, "%u\n")
 +ssb_config_attr(coreid, id.coreid, "0x%04x\n")
 +ssb_config_attr(vendor, id.vendor, "0x%04x\n")
 +ssb_config_attr(revision, id.revision, "%u\n")
 +ssb_config_attr(irq, irq, "%u\n")
 +static ssize_t
 +name_show(struct device *dev, struct device_attribute *attr, char *buf)
 +{
 +	return sprintf (buf, "%s\n", ssb_core_name(dev_to_ssb_dev(dev)->id.coreid));
 +}
 +
 +static struct device_attribute ssb_device_attrs[] = {
 +	__ATTR_RO(name),
 +	__ATTR_RO(core_num),
 +	__ATTR_RO(coreid),
 +	__ATTR_RO(vendor),
 +	__ATTR_RO(revision),
 +	__ATTR_RO(irq),
 +	__ATTR_NULL,
 +};
 +
 static struct bus_type ssb_bustype = {
 	.name		= "ssb",
 	.match		= ssb_bus_match,
@@ -394,6 +422,7 @@ static struct bus_type ssb_bustype = {
 	.suspend	= ssb_device_suspend,
 	.resume		= ssb_device_resume,
 	.uevent		= ssb_device_uevent,
 +	.dev_attrs	= ssb_device_attrs,
 };
 static void ssb_buses_lock(void)
--- a/target/linux/brcm47xx/patches-2.6.32/951-brcm4716-defines.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/951-brcm4716-defines.patch
@ -1,104 +0,0 @@
 --- a/drivers/ssb/scan.c
 +++ b/drivers/ssb/scan.c
@@ -92,6 +92,14 @@ const char *ssb_core_name(u16 coreid)
 		return "ARM 1176";
 	case SSB_DEV_ARM_7TDMI:
 		return "ARM 7TDMI";
 +	case SSB_DEV_ETHERNET_GBIT2:
 +		return "Gigabit MAC";
 +	case SSB_DEV_MIPS_74K:
 +		return "MIPS 74k";
 +	case SSB_DEV_DDR_CTRLR:
 +		return "DDR1/2 memory controller";
 +	case SSB_DEV_I2S:
 +		return "I2S";
 	}
 	return "UNKNOWN";
 }
@@ -150,6 +158,7 @@ static u8 chipid_to_nrcores(u16 chipid)
 	case 0x4710:
 	case 0x4610:
 	case 0x4704:
 +	case 0x4716:
 		return 9;
 	default:
 		ssb_printk(KERN_ERR PFX
 --- a/include/linux/ssb/ssb.h
 +++ b/include/linux/ssb/ssb.h
@@ -151,9 +151,16 @@ struct ssb_bus_ops {
 #define SSB_DEV_MINI_MACPHY	0x823
 #define SSB_DEV_ARM_1176	0x824
 #define SSB_DEV_ARM_7TDMI	0x825
 +#define SSB_DEV_ETHERNET_GBIT2	0x82d
 +#define SSB_DEV_MIPS_74K	0x82c
 +#define SSB_DEV_DDR_CTRLR	0x82e
 +#define SSB_DEV_I2S			0x834
 +#define SSB_DEV_DEFAULT		0xfff
 /* Vendor-ID values */
 #define SSB_VENDOR_BROADCOM	0x4243
 +#define SSB_VENDOR_BROADCOM2 0x04BF
 +#define SSB_VENDOR_ARM		0x43b
 /* Some kernel subsystems poke with dev->drvdata, so we must use the
  * following ugly workaround to get from struct device to struct ssb_device */
 --- a/include/linux/ssb/ssb_regs.h
 +++ b/include/linux/ssb/ssb_regs.h
@@ -11,6 +11,7 @@
 #define	SSB_SDRAM_SWAPPED	0x10000000U	/* Byteswapped Physical SDRAM */
 #define SSB_ENUM_BASE    	0x18000000U	/* Enumeration space base */
 #define	SSB_ENUM_LIMIT		0x18010000U	/* Enumeration space limit */
 +#define SSB_AI_BASE		0x18100000		/* base for AI registers */
 #define	SSB_FLASH2		0x1c000000U	/* Flash Region 2 (region 1 shadowed here) */
 #define	SSB_FLASH2_SZ		0x02000000U	/* Size of Flash Region 2 */
@@ -26,6 +27,7 @@
 #define	SSB_EUART		(SSB_EXTIF_BASE + 0x00800000)
 #define	SSB_LED			(SSB_EXTIF_BASE + 0x00900000)
 +#define SSB_EROM_ASD_SZ_BASE 0x00001000
 /* Enumeration space constants */
 #define SSB_CORE_SIZE		0x1000	/* Size of a core MMIO area */
@@ -453,5 +455,41 @@ enum {
 #define SSB_ADM_BASE2			0xFFFF0000	/* Type2 base address for the core */
 #define SSB_ADM_BASE2_SHIFT		16
 +/***** EROM defines for AI type busses *****/
 +#define SSB_EROM_VALID			1
 +#define SSB_EROM_END			0xe
 +#define SSB_EROM_TAG			0xe
 +/* Adress Space Descriptor */
 +#define SSB_EROM_ASD			0x4
 +#define SSB_EROM_ASD_SP_MASK	0x00000f00
 +#define SSB_EROM_ASD_SP_SHIFT	8
 +#define SSB_EROM_ASD_ST_MASK	0x000000c0
 +#define SSB_EROM_ASD_ST_SLAVE	0x00000000
 +#define SSB_EROM_ASD_ST_BRIDGE	0x00000040
 +#define SSB_EROM_ASD_ST_MWRAP	0x000000c0
 +#define SSB_EROM_ASD_ST_SWRAP	0x00000080
 +#define SSB_EROM_ASD_ADDR_MASK	0xfffff000
 +#define SSB_EROM_ASD_AG32		0x00000008
 +#define SSB_EROM_ASD_SZ_MASK	0x00000030
 +#define SSB_EROM_ASD_SZ_SZD		0x00000030
 +#define SSB_EROM_ASD_SZ_SHIFT	4
 +#define SSB_EROM_CI				0
 +#define SSB_EROM_CIA_CID_MASK	0x000fff00
 +#define SSB_EROM_CIA_CID_SHIFT	8
 +#define SSB_EROM_CIA_MFG_MASK	0xfff00000
 +#define SSB_EROM_CIA_MFG_SHIFT	20
 +#define SSB_EROM_CIB_REV_MASK	0xff000000
 +#define SSB_EROM_CIB_REV_SHIFT	24
 +#define SSB_EROM_CIB_NMW_MASK	0x0007c000
 +#define SSB_EROM_CIB_NSW_MASK	0x00f80000
 +#define SSB_EROM_CIB_NSP_MASK	0x00003e00
 +
 +/***** Registers of AI config space *****/
 +#define SSB_AI_RESETCTRL		0x800 /* maybe 0x804 for big endian */
 +#define  SSB_AI_RESETCTRL_RESET	1
 +#define SSB_AI_IOCTRL			0x408 /* maybe 0x40c for big endian */
 +#define SSB_CF_FGC				0x0002
 +#define SSB_CF_CLOCK_EN			0x001
 +#define SSB_AI_oobselouta30		0x100
 #endif /* LINUX_SSB_REGS_H_ */
--- a/target/linux/brcm47xx/patches-2.6.32/999-wl_exports.patch
+++ b/target/linux/brcm47xx/patches-2.6.32/999-wl_exports.patch
@ -1,23 +0,0 @@
 --- a/arch/mips/bcm47xx/nvram.c
 +++ b/arch/mips/bcm47xx/nvram.c
@@ -29,7 +29,9 @@
 #define MB * 1048576
 extern struct ssb_bus ssb_bcm47xx;
 -static char nvram_buf[NVRAM_SPACE];
 +char nvram_buf[NVRAM_SPACE];
 +EXPORT_SYMBOL(nvram_buf);
 +
 static int cfe_env;
 extern char *cfe_env_get(char *nv_buf, const char *name);
 --- a/arch/mips/mm/cache.c
 +++ b/arch/mips/mm/cache.c
@@ -52,6 +52,7 @@ void (*_dma_cache_wback)(unsigned long s
 void (*_dma_cache_inv)(unsigned long start, unsigned long size);
 EXPORT_SYMBOL(_dma_cache_wback_inv);
 +EXPORT_SYMBOL(_dma_cache_inv);
 #endif /* CONFIG_DMA_NONCOHERENT */
--- a/target/linux/brcm47xx/patches-2.6.35/011-MIPS-BCM47xx-Really-fix-128MB-RAM-problem.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/011-MIPS-BCM47xx-Really-fix-128MB-RAM-problem.patch
@ -1,66 +0,0 @@
 From f65eb52ea6c0ec939fd44e74b6b873e0b549e3c9 Mon Sep 17 00:00:00 2001
 From: Hauke Mehrtens <hauke@hauke-m.de>
 Date: Sun, 18 Jul 2010 12:49:41 +0200
 Subject: [PATCH 1/6] MIPS: BCM47xx: Really fix 128MB RAM problem
 The previews patch 84a6fcb368a080620d12fc4d79e07902dbee7335 was wrong,
 I got wrong success reports.
 The bcm47xx architecture maps the ram into a 128MB address space. It
 will be paced there as often as goes into the 128MB. The detection
 tries to find the position where the same memory is found. When reading
 over 128MB the processor will throw an exception. If 128MB ram is
 installed, it will not find the same memory because it tries to read
 over the 128MB boarder. Now it just assumes 128MB installed ram if it
 can not find that the ram is repeating.
 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 ---
 arch/mips/bcm47xx/prom.c |   22 ++++++++++++++--------
 1 files changed, 14 insertions(+), 8 deletions(-)
 --- a/arch/mips/bcm47xx/prom.c
 +++ b/arch/mips/bcm47xx/prom.c
@@ -126,6 +126,7 @@ static __init void prom_init_cmdline(voi
 static __init void prom_init_mem(void)
 {
 	unsigned long mem;
 +	unsigned long max;
 	/* Figure out memory size by finding aliases.
 	 *
@@ -134,21 +135,26 @@ static __init void prom_init_mem(void)
 	 * want to reuse the memory used by CFE (around 4MB). That means cfe_*
 	 * functions stop to work at some point during the boot, we should only
 	 * call them at the beginning of the boot.
 +	 *
 +	 * BCM47XX uses 128MB for addressing the ram, if the system contains
 +	 * less that that amount of ram it remaps the ram more often into the
 +	 * available space.
 +	 * Accessing memory after 128MB will cause an exception.
 +	 * max contains the biggest possible address supported by the platform.
 +	 * If the method wants to try something above we assume 128MB ram.
 	 */
 +	max = ((unsigned long)(prom_init) | ((128 << 20) - 1));
 	for (mem = (1 << 20); mem < (128 << 20); mem += (1 << 20)) {
 +		if (((unsigned long)(prom_init) + mem) > max) {
 +			mem = (128 << 20);
 +			printk(KERN_DEBUG "assume 128MB RAM\n");
 +			break;
 +		}
 		if (*(unsigned long *)((unsigned long)(prom_init) + mem) ==
 		    *(unsigned long *)(prom_init))
 			break;
 	}
 -	/* Ignoring the last page when ddr size is 128M. Cached
 -	 * accesses to last page is causing the processor to prefetch
 -	 * using address above 128M stepping out of the ddr address
 -	 * space.
 -	 */
 -	if (mem == 0x8000000)
 -		mem -= 0x1000;
 -
 	add_memory_region(0, mem, BOOT_MEM_RAM);
 }
--- a/target/linux/brcm47xx/patches-2.6.35/012-MIPS-BCM47xx-Fill-values-for-b43-into-ssb-sprom.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/012-MIPS-BCM47xx-Fill-values-for-b43-into-ssb-sprom.patch
@ -1,170 +0,0 @@
 From e5c5828063a55a752e2392d820383dd7a5da3737 Mon Sep 17 00:00:00 2001
 From: Hauke Mehrtens <hauke@hauke-m.de>
 Date: Sun, 18 Jul 2010 13:34:32 +0200
 Subject: [PATCH 2/6] MIPS: BCM47xx: Fill values for b43 into ssb sprom
 Most of the values are stored in the nvram and not in the CFE. At first
 the nvram should be read and if there is no value it should look into
 the CFE. Now more values are read out because the b43 and b43legacy
 drivers needs them.
 Some parts of this patch have been in OpenWRT for a long time and were
 made by Michael Buesch.
 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 ---
 arch/mips/bcm47xx/setup.c |  131 +++++++++++++++++++++++++++++++++-----------
 1 files changed, 98 insertions(+), 33 deletions(-)
 --- a/arch/mips/bcm47xx/setup.c
 +++ b/arch/mips/bcm47xx/setup.c
@@ -74,6 +74,95 @@ static void str2eaddr(char *str, char *d
 	}
 }
 +#define READ_FROM_NVRAM(_outvar, name, buf) \
 +	if (nvram_getenv(name, buf, sizeof(buf)) >= 0 || \
 +	    cfe_getenv(name, buf, sizeof(buf)) >= 0) \
 +		sprom->_outvar = simple_strtoul(buf, NULL, 0);
 +
 +static void bcm47xx_fill_sprom(struct ssb_sprom *sprom)
 +{
 +	char buf[100];
 +	u32 boardflags;
 +
 +	memset(sprom, 0, sizeof(struct ssb_sprom));
 +
 +	sprom->revision = 1; /* Fallback: Old hardware does not define this. */
 +	READ_FROM_NVRAM(revision, "sromrev", buf);
 +	if (nvram_getenv("il0macaddr", buf, sizeof(buf)) >= 0 ||
 +	    cfe_getenv("il0macaddr", buf, sizeof(buf)) >= 0)
 +		str2eaddr(buf, sprom->il0mac);
 +	if (nvram_getenv("et0macaddr", buf, sizeof(buf)) >= 0 ||
 +	    cfe_getenv("et0macaddr", buf, sizeof(buf)) >= 0)
 +		str2eaddr(buf, sprom->et0mac);
 +	if (nvram_getenv("et1macaddr", buf, sizeof(buf)) >= 0 ||
 +	    cfe_getenv("et1macaddr", buf, sizeof(buf)) >= 0)
 +		str2eaddr(buf, sprom->et1mac);
 +	READ_FROM_NVRAM(et0phyaddr, "et0phyaddr", buf);
 +	READ_FROM_NVRAM(et1phyaddr, "et1phyaddr", buf);
 +	READ_FROM_NVRAM(et0mdcport, "et0mdcport", buf);
 +	READ_FROM_NVRAM(et1mdcport, "et1mdcport", buf);
 +	READ_FROM_NVRAM(board_rev, "boardrev", buf);
 +	READ_FROM_NVRAM(country_code, "ccode", buf);
 +	READ_FROM_NVRAM(ant_available_a, "aa5g", buf);
 +	READ_FROM_NVRAM(ant_available_bg, "aa2g", buf);
 +	READ_FROM_NVRAM(pa0b0, "pa0b0", buf);
 +	READ_FROM_NVRAM(pa0b1, "pa0b1", buf);
 +	READ_FROM_NVRAM(pa0b2, "pa0b2", buf);
 +	READ_FROM_NVRAM(pa1b0, "pa1b0", buf);
 +	READ_FROM_NVRAM(pa1b1, "pa1b1", buf);
 +	READ_FROM_NVRAM(pa1b2, "pa1b2", buf);
 +	READ_FROM_NVRAM(pa1lob0, "pa1lob0", buf);
 +	READ_FROM_NVRAM(pa1lob2, "pa1lob1", buf);
 +	READ_FROM_NVRAM(pa1lob1, "pa1lob2", buf);
 +	READ_FROM_NVRAM(pa1hib0, "pa1hib0", buf);
 +	READ_FROM_NVRAM(pa1hib2, "pa1hib1", buf);
 +	READ_FROM_NVRAM(pa1hib1, "pa1hib2", buf);
 +	READ_FROM_NVRAM(gpio0, "wl0gpio0", buf);
 +	READ_FROM_NVRAM(gpio1, "wl0gpio1", buf);
 +	READ_FROM_NVRAM(gpio2, "wl0gpio2", buf);
 +	READ_FROM_NVRAM(gpio3, "wl0gpio3", buf);
 +	READ_FROM_NVRAM(maxpwr_bg, "pa0maxpwr", buf);
 +	READ_FROM_NVRAM(maxpwr_al, "pa1lomaxpwr", buf);
 +	READ_FROM_NVRAM(maxpwr_a, "pa1maxpwr", buf);
 +	READ_FROM_NVRAM(maxpwr_ah, "pa1himaxpwr", buf);
 +	READ_FROM_NVRAM(itssi_a, "pa1itssit", buf);
 +	READ_FROM_NVRAM(itssi_bg, "pa0itssit", buf);
 +	READ_FROM_NVRAM(tri2g, "tri2g", buf);
 +	READ_FROM_NVRAM(tri5gl, "tri5gl", buf);
 +	READ_FROM_NVRAM(tri5g, "tri5g", buf);
 +	READ_FROM_NVRAM(tri5gh, "tri5gh", buf);
 +	READ_FROM_NVRAM(rxpo2g, "rxpo2g", buf);
 +	READ_FROM_NVRAM(rxpo5g, "rxpo5g", buf);
 +	READ_FROM_NVRAM(rssisav2g, "rssisav2g", buf);
 +	READ_FROM_NVRAM(rssismc2g, "rssismc2g", buf);
 +	READ_FROM_NVRAM(rssismf2g, "rssismf2g", buf);
 +	READ_FROM_NVRAM(bxa2g, "bxa2g", buf);
 +	READ_FROM_NVRAM(rssisav5g, "rssisav5g", buf);
 +	READ_FROM_NVRAM(rssismc5g, "rssismc5g", buf);
 +	READ_FROM_NVRAM(rssismf5g, "rssismf5g", buf);
 +	READ_FROM_NVRAM(bxa5g, "bxa5g", buf);
 +	READ_FROM_NVRAM(cck2gpo, "cck2gpo", buf);
 +	READ_FROM_NVRAM(ofdm2gpo, "ofdm2gpo", buf);
 +	READ_FROM_NVRAM(ofdm5glpo, "ofdm5glpo", buf);
 +	READ_FROM_NVRAM(ofdm5gpo, "ofdm5gpo", buf);
 +	READ_FROM_NVRAM(ofdm5ghpo, "ofdm5ghpo", buf);
 +
 +	if (nvram_getenv("boardflags", buf, sizeof(buf)) >= 0 ||
 +	    cfe_getenv("boardflags", buf, sizeof(buf)) >= 0)
 +		boardflags = simple_strtoul(buf, NULL, 0);
 +	if (boardflags) {
 +		sprom->boardflags_lo = (boardflags & 0x0000FFFFU);
 +		sprom->boardflags_hi = (boardflags & 0xFFFF0000U) >> 16;
 +	}
 +	if (nvram_getenv("boardflags2", buf, sizeof(buf)) >= 0 ||
 +	    cfe_getenv("boardflags2", buf, sizeof(buf)) >= 0)
 +		boardflags = simple_strtoul(buf, NULL, 0);
 +	if (boardflags) {
 +		sprom->boardflags2_lo = (boardflags & 0x0000FFFFU);
 +		sprom->boardflags2_hi = (boardflags & 0xFFFF0000U) >> 16;
 +	}
 +}
 +
 static int bcm47xx_get_invariants(struct ssb_bus *bus,
 				   struct ssb_init_invariants *iv)
 {
@@ -82,43 +171,19 @@ static int bcm47xx_get_invariants(struct
 	/* Fill boardinfo structure */
 	memset(&(iv->boardinfo), 0 , sizeof(struct ssb_boardinfo));
 -	if (cfe_getenv("boardvendor", buf, sizeof(buf)) >= 0 ||
 -	    nvram_getenv("boardvendor", buf, sizeof(buf)) >= 0)
 +	iv->boardinfo.vendor = SSB_BOARDVENDOR_BCM;
 +	if (nvram_getenv("boardtype", buf, sizeof(buf)) >= 0 ||
 +	    cfe_getenv("boardtype", buf, sizeof(buf)) >= 0)
 		iv->boardinfo.type = (u16)simple_strtoul(buf, NULL, 0);
 -	if (cfe_getenv("boardtype", buf, sizeof(buf)) >= 0 ||
 -	    nvram_getenv("boardtype", buf, sizeof(buf)) >= 0)
 -		iv->boardinfo.type = (u16)simple_strtoul(buf, NULL, 0);
 -	if (cfe_getenv("boardrev", buf, sizeof(buf)) >= 0 ||
 -	    nvram_getenv("boardrev", buf, sizeof(buf)) >= 0)
 +	if (nvram_getenv("boardrev", buf, sizeof(buf)) >= 0 ||
 +	    cfe_getenv("boardrev", buf, sizeof(buf)) >= 0)
 		iv->boardinfo.rev = (u16)simple_strtoul(buf, NULL, 0);
 -	/* Fill sprom structure */
 -	memset(&(iv->sprom), 0, sizeof(struct ssb_sprom));
 -	iv->sprom.revision = 3;
 -
 -	if (cfe_getenv("et0macaddr", buf, sizeof(buf)) >= 0 ||
 -	    nvram_getenv("et0macaddr", buf, sizeof(buf)) >= 0)
 -		str2eaddr(buf, iv->sprom.et0mac);
 -
 -	if (cfe_getenv("et1macaddr", buf, sizeof(buf)) >= 0 ||
 -	    nvram_getenv("et1macaddr", buf, sizeof(buf)) >= 0)
 -		str2eaddr(buf, iv->sprom.et1mac);
 -
 -	if (cfe_getenv("et0phyaddr", buf, sizeof(buf)) >= 0 ||
 -	    nvram_getenv("et0phyaddr", buf, sizeof(buf)) >= 0)
 -		iv->sprom.et0phyaddr = simple_strtoul(buf, NULL, 0);
 -
 -	if (cfe_getenv("et1phyaddr", buf, sizeof(buf)) >= 0 ||
 -	    nvram_getenv("et1phyaddr", buf, sizeof(buf)) >= 0)
 -		iv->sprom.et1phyaddr = simple_strtoul(buf, NULL, 0);
 -
 -	if (cfe_getenv("et0mdcport", buf, sizeof(buf)) >= 0 ||
 -	    nvram_getenv("et0mdcport", buf, sizeof(buf)) >= 0)
 -		iv->sprom.et0mdcport = simple_strtoul(buf, NULL, 10);
 -
 -	if (cfe_getenv("et1mdcport", buf, sizeof(buf)) >= 0 ||
 -	    nvram_getenv("et1mdcport", buf, sizeof(buf)) >= 0)
 -		iv->sprom.et1mdcport = simple_strtoul(buf, NULL, 10);
 +	bcm47xx_fill_sprom(&iv->sprom);
 +
 +	if (nvram_getenv("cardbus", buf, sizeof(buf)) >= 0 ||
 +	    cfe_getenv("cardbus", buf, sizeof(buf)) >= 0)
 +		iv->has_cardbus_slot = !!simple_strtoul(buf, NULL, 10);
 	return 0;
 }
--- a/target/linux/brcm47xx/patches-2.6.35/013-MIPS-BCM47xx-Activate-SSB_B43_PCI_BRIDGE-by-default.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/013-MIPS-BCM47xx-Activate-SSB_B43_PCI_BRIDGE-by-default.patch
@ -1,23 +0,0 @@
 From e0039e622e53a22b14fce4d2f0cb3febc75cd58b Mon Sep 17 00:00:00 2001
 From: Hauke Mehrtens <hauke@hauke-m.de>
 Date: Sun, 18 Jul 2010 13:58:09 +0200
 Subject: [PATCH 3/6] MIPS: BCM47xx: Activate SSB_B43_PCI_BRIDGE by default
 The b43_pci_bridge is needed to use the b43 driver with brcm47xx.
 Activate it by default if pci is available.
 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 ---
 arch/mips/Kconfig |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
 --- a/arch/mips/Kconfig
 +++ b/arch/mips/Kconfig
@@ -62,6 +62,7 @@ config BCM47XX
 	select SSB_DRIVER_MIPS
 	select SSB_DRIVER_EXTIF
 	select SSB_EMBEDDED
 +	select SSB_B43_PCI_BRIDGE if PCI
 	select SSB_PCICORE_HOSTMODE if PCI
 	select GENERIC_GPIO
 	select SYS_HAS_EARLY_PRINTK
--- a/target/linux/brcm47xx/patches-2.6.35/014-MIPS-BCM47xx-Setup-and-register-serial-early.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/014-MIPS-BCM47xx-Setup-and-register-serial-early.patch
@ -1,75 +0,0 @@
 From 9be402f069cc259ad5795b77567d66c4e7f6bef6 Mon Sep 17 00:00:00 2001
 From: Hauke Mehrtens <hauke@hauke-m.de>
 Date: Sun, 18 Jul 2010 14:59:24 +0200
 Subject: [PATCH 4/6] MIPS: BCM47xx: Setup and register serial early
 Swap the first and second serial if console=ttyS1 was set.
 Set it up and register it for early serial support.
 This patch has been in OpenWRT for a long time.
 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 ---
 arch/mips/bcm47xx/setup.c |   39 ++++++++++++++++++++++++++++++++++++++-
 1 files changed, 38 insertions(+), 1 deletions(-)
 --- a/arch/mips/bcm47xx/setup.c
 +++ b/arch/mips/bcm47xx/setup.c
@@ -28,6 +28,8 @@
 #include <linux/types.h>
 #include <linux/ssb/ssb.h>
 #include <linux/ssb/ssb_embedded.h>
 +#include <linux/serial.h>
 +#include <linux/serial_8250.h>
 #include <asm/bootinfo.h>
 #include <asm/reboot.h>
 #include <asm/time.h>
@@ -190,12 +192,47 @@ static int bcm47xx_get_invariants(struct
 void __init plat_mem_setup(void)
 {
 -	int err;
 +	int i, err;
 +	char buf[100];
 +	struct ssb_mipscore *mcore;
 	err = ssb_bus_ssbbus_register(&ssb_bcm47xx, SSB_ENUM_BASE,
 				      bcm47xx_get_invariants);
 	if (err)
 		panic("Failed to initialize SSB bus (err %d)\n", err);
 +	mcore = &ssb_bcm47xx.mipscore;
 +
 +	if (nvram_getenv("kernel_args", buf, sizeof(buf)) >= 0 ||
 +	    cfe_getenv("kernel_args", buf, sizeof(buf)) >= 0) {
 +		if (strstr(buf, "console=ttyS1")) {
 +			struct ssb_serial_port port;
 +
 +			printk(KERN_DEBUG "Swapping serial ports!\n");
 +			/* swap serial ports */
 +			memcpy(&port, &mcore->serial_ports[0], sizeof(port));
 +			memcpy(&mcore->serial_ports[0], &mcore->serial_ports[1],
 +			       sizeof(port));
 +			memcpy(&mcore->serial_ports[1], &port, sizeof(port));
 +		}
 +	}
 +
 +	for (i = 0; i < mcore->nr_serial_ports; i++) {
 +		struct ssb_serial_port *port = &(mcore->serial_ports[i]);
 +		struct uart_port s;
 +
 +		memset(&s, 0, sizeof(s));
 +		s.line = i;
 +		s.mapbase = (unsigned int) port->regs;
 +		s.membase = port->regs;
 +		s.irq = port->irq + 2;
 +		s.uartclk = port->baud_base;
 +		s.flags = UPF_BOOT_AUTOCONF | UPF_SHARE_IRQ;
 +		s.iotype = SERIAL_IO_MEM;
 +		s.regshift = port->reg_shift;
 +
 +		early_serial_setup(&s);
 +	}
 +	printk(KERN_DEBUG "Serial init done.\n");
 	_machine_restart = bcm47xx_machine_restart;
 	_machine_halt = bcm47xx_machine_halt;
--- a/target/linux/brcm47xx/patches-2.6.35/015-MIPS-BCM47xx-nvram_getenv-fix-return-value.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/015-MIPS-BCM47xx-nvram_getenv-fix-return-value.patch
@ -1,47 +0,0 @@
 From ff7295cc37b1e4b31aed9f071374f43aa128329b Mon Sep 17 00:00:00 2001
 From: Hauke Mehrtens <hauke@hauke-m.de>
 Date: Fri, 30 Jul 2010 17:45:20 +0200
 Subject: [PATCH 5/6] MIPS: BCM47xx: nvram_getenv fix return value.
 nvram_getenv should behave like cfe_getenv. For now it is used like
 cfe_getenv. cfe_getenv returns 0 on success and -1 in case of an error.
 Change nvram_getenv to do the same.
 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 ---
 arch/mips/bcm47xx/nvram.c                  |    4 ++--
 arch/mips/include/asm/mach-bcm47xx/nvram.h |    3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)
 --- a/arch/mips/bcm47xx/nvram.c
 +++ b/arch/mips/bcm47xx/nvram.c
@@ -69,7 +69,7 @@ int nvram_getenv(char *name, char *val,
 	char *var, *value, *end, *eq;
 	if (!name)
 -		return 1;
 +		return NVRAM_ERR_INV_PARAM;
 	if (!nvram_buf[0])
 		early_nvram_init();
@@ -89,6 +89,6 @@ int nvram_getenv(char *name, char *val,
 			return 0;
 		}
 	}
 -	return 1;
 +	return NVRAM_ERR_ENVNOTFOUND;
 }
 EXPORT_SYMBOL(nvram_getenv);
 --- a/arch/mips/include/asm/mach-bcm47xx/nvram.h
 +++ b/arch/mips/include/asm/mach-bcm47xx/nvram.h
@@ -31,6 +31,10 @@ struct nvram_header {
 #define NVRAM_MAX_VALUE_LEN 255
 #define NVRAM_MAX_PARAM_LEN 64
 +// TODO: replace by old values. This chaueses that the system will not try to look into the cfe.
 +#define NVRAM_ERR_INV_PARAM	1 // -8
 +#define NVRAM_ERR_ENVNOTFOUND	1 // -9
 +
 extern int nvram_getenv(char *name, char *val, size_t val_len);
 #endif
--- a/target/linux/brcm47xx/patches-2.6.35/016-MIPS-BCM47xx-Remove-CFE-console.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/016-MIPS-BCM47xx-Remove-CFE-console.patch
@ -1,141 +0,0 @@
 From 5219981646071abb6731634bf47781a53e248764 Mon Sep 17 00:00:00 2001
 From: Hauke Mehrtens <hauke@hauke-m.de>
 Date: Sun, 18 Jul 2010 15:11:26 +0200
 Subject: [PATCH 6/6] MIPS: BCM47xx: Remove CFE console
 Do not use the CFE console. It causes hangs on some devices like the
 Buffalo WHR-HP-G54.
 This was reported in https://dev.openwrt.org/ticket/4061 and
 https://forum.openwrt.org/viewtopic.php?id=17063
 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 ---
 arch/mips/Kconfig        |    1 -
 arch/mips/bcm47xx/prom.c |   82 +++------------------------------------------
 2 files changed, 6 insertions(+), 77 deletions(-)
 --- a/arch/mips/Kconfig
 +++ b/arch/mips/Kconfig
@@ -65,7 +65,6 @@ config BCM47XX
 	select SSB_B43_PCI_BRIDGE if PCI
 	select SSB_PCICORE_HOSTMODE if PCI
 	select GENERIC_GPIO
 -	select SYS_HAS_EARLY_PRINTK
 	select CFE
 	help
 	 Support for BCM47XX based boards
 --- a/arch/mips/bcm47xx/prom.c
 +++ b/arch/mips/bcm47xx/prom.c
@@ -31,96 +31,28 @@
 #include <asm/fw/cfe/cfe_api.h>
 #include <asm/fw/cfe/cfe_error.h>
 -static int cfe_cons_handle;
 -
 const char *get_system_type(void)
 {
 	return "Broadcom BCM47XX";
 }
 -void prom_putchar(char c)
 -{
 -	while (cfe_write(cfe_cons_handle, &c, 1) == 0)
 -		;
 -}
 -
 -static __init void prom_init_cfe(void)
 +static __init int prom_init_cfe(void)
 {
 	uint32_t cfe_ept;
 	uint32_t cfe_handle;
 	uint32_t cfe_eptseal;
 -	int argc = fw_arg0;
 -	char **envp = (char **) fw_arg2;
 -	int *prom_vec = (int *) fw_arg3;
 -
 -	/*
 -	 * Check if a loader was used; if NOT, the 4 arguments are
 -	 * what CFE gives us (handle, 0, EPT and EPTSEAL)
 -	 */
 -	if (argc < 0) {
 -		cfe_handle = (uint32_t)argc;
 -		cfe_ept = (uint32_t)envp;
 -		cfe_eptseal = (uint32_t)prom_vec;
 -	} else {
 -		if ((int)prom_vec < 0) {
 -			/*
 -			 * Old loader; all it gives us is the handle,
 -			 * so use the "known" entrypoint and assume
 -			 * the seal.
 -			 */
 -			cfe_handle = (uint32_t)prom_vec;
 -			cfe_ept = 0xBFC00500;
 -			cfe_eptseal = CFE_EPTSEAL;
 -		} else {
 -			/*
 -			 * Newer loaders bundle the handle/ept/eptseal
 -			 * Note: prom_vec is in the loader's useg
 -			 * which is still alive in the TLB.
 -			 */
 -			cfe_handle = prom_vec[0];
 -			cfe_ept = prom_vec[2];
 -			cfe_eptseal = prom_vec[3];
 -		}
 -	}
 +
 +	cfe_eptseal = (uint32_t) fw_arg3;
 +	cfe_handle = (uint32_t) fw_arg0;
 +	cfe_ept = (uint32_t) fw_arg2;
 	if (cfe_eptseal != CFE_EPTSEAL) {
 -		/* too early for panic to do any good */
 		printk(KERN_ERR "CFE's entrypoint seal doesn't match.");
 -		while (1) ;
 +		return -1;
 	}
 	cfe_init(cfe_handle, cfe_ept);
 -}
 -
 -static __init void prom_init_console(void)
 -{
 -	/* Initialize CFE console */
 -	cfe_cons_handle = cfe_getstdhandle(CFE_STDHANDLE_CONSOLE);
 -}
 -
 -static __init void prom_init_cmdline(void)
 -{
 -	static char buf[COMMAND_LINE_SIZE] __initdata;
 -
 -	/* Get the kernel command line from CFE */
 -	if (cfe_getenv("LINUX_CMDLINE", buf, COMMAND_LINE_SIZE) >= 0) {
 -		buf[COMMAND_LINE_SIZE - 1] = 0;
 -		strcpy(arcs_cmdline, buf);
 -	}
 -
 -	/* Force a console handover by adding a console= argument if needed,
 -	 * as CFE is not available anymore later in the boot process. */
 -	if ((strstr(arcs_cmdline, "console=")) == NULL) {
 -		/* Try to read the default serial port used by CFE */
 -		if ((cfe_getenv("BOOT_CONSOLE", buf, COMMAND_LINE_SIZE) < 0)
 -		    || (strncmp("uart", buf, 4)))
 -			/* Default to uart0 */
 -			strcpy(buf, "uart0");
 -
 -		/* Compute the new command line */
 -		snprintf(arcs_cmdline, COMMAND_LINE_SIZE, "%s console=ttyS%c,115200",
 -			 arcs_cmdline, buf[4]);
 -	}
 +	return 0;
 }
 static __init void prom_init_mem(void)
@@ -161,8 +93,6 @@ static __init void prom_init_mem(void)
 void __init prom_init(void)
 {
 	prom_init_cfe();
 -	prom_init_console();
 -	prom_init_cmdline();
 	prom_init_mem();
 }
--- a/target/linux/brcm47xx/patches-2.6.35/021-USB-Add-USB-2.0-to-ssb-ohci-driver.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/021-USB-Add-USB-2.0-to-ssb-ohci-driver.patch
@ -1,92 +0,0 @@
 From ca00adabb88dd1194891624836d7574aab2d7c05 Mon Sep 17 00:00:00 2001
 From: Hauke Mehrtens <hauke@hauke-m.de>
 Date: Sun, 18 Jul 2010 21:25:03 +0200
 Subject: [PATCH 1/2] USB: Add USB 2.0 to ssb ohci driver
 This adds USB 2.0 support to ssb ohci driver.
 This patch was used in OpenWRT for a long time now.
 CC: Steve Brown <sbrown@cortland.com>
 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 ---
 drivers/usb/host/ohci-ssb.c |   52 ++++++++++++++++++++++++++++++++++++++++--
 1 files changed, 49 insertions(+), 3 deletions(-)
 --- a/drivers/usb/host/ohci-ssb.c
 +++ b/drivers/usb/host/ohci-ssb.c
@@ -93,8 +93,11 @@ static void ssb_ohci_detach(struct ssb_d
 {
 	struct usb_hcd *hcd = ssb_get_drvdata(dev);
 +	if (hcd->driver->shutdown)
 +		hcd->driver->shutdown(hcd);
 	usb_remove_hcd(hcd);
 	iounmap(hcd->regs);
 +	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
 	usb_put_hcd(hcd);
 	ssb_device_disable(dev, 0);
 }
@@ -106,10 +109,52 @@ static int ssb_ohci_attach(struct ssb_de
 	int err = -ENOMEM;
 	u32 tmp, flags = 0;
 -	if (dev->id.coreid == SSB_DEV_USB11_HOSTDEV)
 -		flags |= SSB_OHCI_TMSLOW_HOSTMODE;
 +	if (dma_set_mask(dev->dma_dev, DMA_BIT_MASK(32)) ||
 +	    dma_set_coherent_mask(dev->dma_dev, DMA_BIT_MASK(32)))
 +		return -EOPNOTSUPP;
 -	ssb_device_enable(dev, flags);
 +	if (dev->id.coreid == SSB_DEV_USB11_HOSTDEV) {
 +		/* Put the device into host-mode. */
 +		flags |= SSB_OHCI_TMSLOW_HOSTMODE;
 +		ssb_device_enable(dev, flags);
 +	} else if (dev->id.coreid == SSB_DEV_USB20_HOST) {
 +		/*
 +		 * USB 2.0 special considerations:
 +		 *
 +		 * In addition to the standard SSB reset sequence, the Host
 +		 * Control Register must be programmed to bring the USB core
 +		 * and various phy components out of reset.
 +		 */
 +		ssb_device_enable(dev, 0);
 +		ssb_write32(dev, 0x200, 0x7ff);
 +
 +		/* Change Flush control reg */
 +		tmp = ssb_read32(dev, 0x400);
 +		tmp &= ~8;
 +		ssb_write32(dev, 0x400, tmp);
 +		tmp = ssb_read32(dev, 0x400);
 +
 +		/* Change Shim control reg */
 +		tmp = ssb_read32(dev, 0x304);
 +		tmp &= ~0x100;
 +		ssb_write32(dev, 0x304, tmp);
 +		tmp = ssb_read32(dev, 0x304);
 +
 +		udelay(1);
 +
 +		/* Work around for 5354 failures */
 +		if (dev->id.revision == 2 && dev->bus->chip_id == 0x5354) {
 +			/* Change syn01 reg */
 +			tmp = 0x00fe00fe;
 +			ssb_write32(dev, 0x894, tmp);
 +
 +			/* Change syn03 reg */
 +			tmp = ssb_read32(dev, 0x89c);
 +			tmp |= 0x1;
 +			ssb_write32(dev, 0x89c, tmp);
 +		}
 +	} else
 +		ssb_device_enable(dev, 0);
 	hcd = usb_create_hcd(&ssb_ohci_hc_driver, dev->dev,
 			dev_name(dev->dev));
@@ -200,6 +245,7 @@ static int ssb_ohci_resume(struct ssb_de
 static const struct ssb_device_id ssb_ohci_table[] = {
 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB11_HOSTDEV, SSB_ANY_REV),
 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB11_HOST, SSB_ANY_REV),
 +	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB20_HOST, SSB_ANY_REV),
 	SSB_DEVTABLE_END
 };
 MODULE_DEVICE_TABLE(ssb, ssb_ohci_table);
--- a/target/linux/brcm47xx/patches-2.6.35/022-USB-Add-ehci-ssb-driver.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/022-USB-Add-ehci-ssb-driver.patch
@ -1,345 +0,0 @@
 From ad224c0d5fa0fc05f8aaef3c19fc9b4eb275a5d2 Mon Sep 17 00:00:00 2001
 From: Hauke Mehrtens <hauke@hauke-m.de>
 Date: Sun, 18 Jul 2010 21:29:40 +0200
 Subject: [PATCH 2/2] USB: Add ehci ssb driver
 Support for the Sonics Silicon Backplane (SSB) attached Broadcom USB EHCI core.
 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 ---
 drivers/usb/host/Kconfig    |   13 ++
 drivers/usb/host/ehci-hcd.c |   22 ++++-
 drivers/usb/host/ehci-ssb.c |  255 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 288 insertions(+), 2 deletions(-)
 create mode 100644 drivers/usb/host/ehci-ssb.c
 --- a/drivers/usb/host/Kconfig
 +++ b/drivers/usb/host/Kconfig
@@ -150,6 +150,19 @@ config USB_OXU210HP_HCD
 	  To compile this driver as a module, choose M here: the
 	  module will be called oxu210hp-hcd.
 +config USB_EHCI_HCD_SSB
 +	bool "EHCI support for Broadcom SSB EHCI core"
 +	depends on USB_EHCI_HCD && (SSB = y || SSB = USB_EHCI_HCD) && EXPERIMENTAL
 +	default n
 +	---help---
 +	  Support for the Sonics Silicon Backplane (SSB) attached
 +	  Broadcom USB EHCI core.
 +
 +	  This device is present in some embedded devices with
 +	  Broadcom based SSB bus.
 +
 +	  If unsure, say N.
 +
 config USB_ISP116X_HCD
 	tristate "ISP116X HCD support"
 	depends on USB
 --- a/drivers/usb/host/ehci-hcd.c
 +++ b/drivers/usb/host/ehci-hcd.c
@@ -1158,9 +1158,14 @@ MODULE_LICENSE ("GPL");
 #define	PLATFORM_DRIVER		ehci_atmel_driver
 #endif
 +#ifdef CONFIG_USB_EHCI_HCD_SSB
 +#include "ehci-ssb.c"
 +#define SSB_EHCI_DRIVER		ssb_ehci_driver
 +#endif
 +
 #if !defined(PCI_DRIVER) && !defined(PLATFORM_DRIVER) && \
     !defined(PS3_SYSTEM_BUS_DRIVER) && !defined(OF_PLATFORM_DRIVER) && \
 -    !defined(XILINX_OF_PLATFORM_DRIVER)
 +    !defined(XILINX_OF_PLATFORM_DRIVER) && !defined(SSB_EHCI_DRIVER)
 #error "missing bus glue for ehci-hcd"
 #endif
@@ -1220,10 +1225,20 @@ static int __init ehci_hcd_init(void)
 	if (retval < 0)
 		goto clean4;
 #endif
 +
 +#ifdef SSB_EHCI_DRIVER
 +	retval = ssb_driver_register(&SSB_EHCI_DRIVER);
 +	if (retval < 0)
 +		goto clean5;
 +#endif
 	return retval;
 +#ifdef SSB_EHCI_DRIVER
 +	/* ssb_driver_unregister(&SSB_EHCI_DRIVER); */
 +clean5:
 +#endif
 #ifdef XILINX_OF_PLATFORM_DRIVER
 -	/* of_unregister_platform_driver(&XILINX_OF_PLATFORM_DRIVER); */
 +	of_unregister_platform_driver(&XILINX_OF_PLATFORM_DRIVER);
 clean4:
 #endif
 #ifdef OF_PLATFORM_DRIVER
@@ -1254,6 +1269,9 @@ module_init(ehci_hcd_init);
 static void __exit ehci_hcd_cleanup(void)
 {
 +#ifdef SSB_EHCI_DRIVER
 +	ssb_driver_unregister(&SSB_EHCI_DRIVER);
 +#endif
 #ifdef XILINX_OF_PLATFORM_DRIVER
 	of_unregister_platform_driver(&XILINX_OF_PLATFORM_DRIVER);
 #endif
 --- /dev/null
 +++ b/drivers/usb/host/ehci-ssb.c
@@ -0,0 +1,255 @@
 +/*
 + * Sonics Silicon Backplane
 + * Broadcom USB-core EHCI driver (SSB bus glue)
 + *
 + * Copyright 2007 Steven Brown <sbrown@cortland.com>
 + * Copyright 2010 Hauke Mehrtens <hauke@hauke-m.de>
 + *
 + * Derived from the OHCI-SSB driver
 + * Copyright 2007 Michael Buesch <mb@bu3sch.de>
 + *
 + * Derived from the EHCI-PCI driver
 + * Copyright (c) 2000-2004 by David Brownell
 + *
 + * Derived from the OHCI-PCI driver
 + * Copyright 1999 Roman Weissgaerber
 + * Copyright 2000-2002 David Brownell
 + * Copyright 1999 Linus Torvalds
 + * Copyright 1999 Gregory P. Smith
 + *
 + * Derived from the USBcore related parts of Broadcom-SB
 + * Copyright 2005 Broadcom Corporation
 + *
 + * Licensed under the GNU/GPL. See COPYING for details.
 + */
 +#include <linux/ssb/ssb.h>
 +
 +
 +struct ssb_ehci_device {
 +	struct ehci_hcd ehci; /* _must_ be at the beginning. */
 +};
 +
 +static inline
 +struct ssb_ehci_device *hcd_to_ssb_ehci(struct usb_hcd *hcd)
 +{
 +	return (struct ssb_ehci_device *)(hcd->hcd_priv);
 +}
 +
 +static int ssb_ehci_reset(struct usb_hcd *hcd)
 +{
 +	struct ehci_hcd *ehci = hcd_to_ehci(hcd);
 +	int err;
 +
 +	ehci->caps = hcd->regs;
 +	ehci->regs = hcd->regs +
 +		HC_LENGTH(ehci_readl(ehci, &ehci->caps->hc_capbase));
 +
 +	dbg_hcs_params(ehci, "reset");
 +	dbg_hcc_params(ehci, "reset");
 +
 +	ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
 +
 +	err = ehci_halt(ehci);
 +
 +	if (err)
 +		return err;
 +
 +	err = ehci_init(hcd);
 +
 +	if (err)
 +		return err;
 +
 +	ehci_reset(ehci);
 +
 +	return err;
 +}
 +
 +static const struct hc_driver ssb_ehci_hc_driver = {
 +	.description		= "ssb-usb-ehci",
 +	.product_desc		= "SSB EHCI Controller",
 +	.hcd_priv_size		= sizeof(struct ssb_ehci_device),
 +
 +	.irq			= ehci_irq,
 +	.flags			= HCD_MEMORY | HCD_USB2,
 +
 +	.reset			= ssb_ehci_reset,
 +	.start			= ehci_run,
 +	.stop			= ehci_stop,
 +	.shutdown		= ehci_shutdown,
 +
 +	.urb_enqueue		= ehci_urb_enqueue,
 +	.urb_dequeue		= ehci_urb_dequeue,
 +	.endpoint_disable	= ehci_endpoint_disable,
 +	.endpoint_reset		= ehci_endpoint_reset,
 +
 +	.get_frame_number	= ehci_get_frame,
 +
 +	.hub_status_data	= ehci_hub_status_data,
 +	.hub_control		= ehci_hub_control,
 +#if defined(CONFIG_PM)
 +	.bus_suspend		= ehci_bus_suspend,
 +	.bus_resume		= ehci_bus_resume,
 +#endif
 +	.relinquish_port	= ehci_relinquish_port,
 +	.port_handed_over	= ehci_port_handed_over,
 +
 +	.clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
 +};
 +
 +static void ssb_ehci_detach(struct ssb_device *dev)
 +{
 +	struct usb_hcd *hcd = ssb_get_drvdata(dev);
 +
 +	if (hcd->driver->shutdown)
 +		hcd->driver->shutdown(hcd);
 +	usb_remove_hcd(hcd);
 +	iounmap(hcd->regs);
 +	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
 +	usb_put_hcd(hcd);
 +	ssb_device_disable(dev, 0);
 +}
 +
 +static int ssb_ehci_attach(struct ssb_device *dev)
 +{
 +	struct ssb_ehci_device *ehcidev;
 +	struct usb_hcd *hcd;
 +	int err = -ENOMEM;
 +	u32 tmp;
 +
 +	if (dma_set_mask(dev->dma_dev, DMA_BIT_MASK(32)) ||
 +	    dma_set_coherent_mask(dev->dma_dev, DMA_BIT_MASK(32)))
 +		return -EOPNOTSUPP;
 +
 +	/*
 +	 * USB 2.0 special considerations:
 +	 *
 +	 * In addition to the standard SSB reset sequence, the Host Control
 +	 * Register must be programmed to bring the USB core and various phy
 +	 * components out of reset.
 +	 */
 +	ssb_device_enable(dev, 0);
 +	ssb_write32(dev, 0x200, 0x7ff);
 +
 +	/* Change Flush control reg */
 +	tmp = ssb_read32(dev, 0x400);
 +	tmp &= ~8;
 +	ssb_write32(dev, 0x400, tmp);
 +	tmp = ssb_read32(dev, 0x400);
 +
 +	/* Change Shim control reg */
 +	tmp = ssb_read32(dev, 0x304);
 +	tmp &= ~0x100;
 +	ssb_write32(dev, 0x304, tmp);
 +	tmp = ssb_read32(dev, 0x304);
 +
 +	udelay(1);
 +
 +	/* Work around for 5354 failures */
 +	if (dev->id.revision == 2 && dev->bus->chip_id == 0x5354) {
 +		/* Change syn01 reg */
 +		tmp = 0x00fe00fe;
 +		ssb_write32(dev, 0x894, tmp);
 +
 +		/* Change syn03 reg */
 +		tmp = ssb_read32(dev, 0x89c);
 +		tmp |= 0x1;
 +		ssb_write32(dev, 0x89c, tmp);
 +	}
 +
 +	hcd = usb_create_hcd(&ssb_ehci_hc_driver, dev->dev,
 +			     dev_name(dev->dev));
 +	if (!hcd)
 +		goto err_dev_disable;
 +
 +	ehcidev = hcd_to_ssb_ehci(hcd);
 +	tmp = ssb_read32(dev, SSB_ADMATCH0);
 +	hcd->rsrc_start = ssb_admatch_base(tmp) + 0x800; /* ehci core offset */
 +	hcd->rsrc_len = 0x100; /* ehci reg block size */
 +	/*
 +	 * start & size modified per sbutils.c
 +	 */
 +	hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
 +	if (!hcd->regs)
 +		goto err_put_hcd;
 +	err = usb_add_hcd(hcd, dev->irq, IRQF_DISABLED | IRQF_SHARED);
 +	if (err)
 +		goto err_iounmap;
 +
 +	ssb_set_drvdata(dev, hcd);
 +
 +	return err;
 +
 +err_iounmap:
 +	iounmap(hcd->regs);
 +err_put_hcd:
 +	usb_put_hcd(hcd);
 +err_dev_disable:
 +	ssb_device_disable(dev, 0);
 +	return err;
 +}
 +
 +static int ssb_ehci_probe(struct ssb_device *dev,
 +		const struct ssb_device_id *id)
 +{
 +	int err;
 +	u16 chipid_top;
 +
 +	/* USBcores are only connected on embedded devices. */
 +	chipid_top = (dev->bus->chip_id & 0xFF00);
 +	if (chipid_top != 0x4700 && chipid_top != 0x5300)
 +		return -ENODEV;
 +
 +	/* TODO: Probably need checks here; is the core connected? */
 +
 +	if (usb_disabled())
 +		return -ENODEV;
 +
 +	err = ssb_ehci_attach(dev);
 +
 +	return err;
 +}
 +
 +static void ssb_ehci_remove(struct ssb_device *dev)
 +{
 +	ssb_ehci_detach(dev);
 +}
 +
 +#ifdef CONFIG_PM
 +
 +static int ssb_ehci_suspend(struct ssb_device *dev, pm_message_t state)
 +{
 +	ssb_device_disable(dev, 0);
 +
 +	return 0;
 +}
 +
 +static int ssb_ehci_resume(struct ssb_device *dev)
 +{
 +	struct usb_hcd *hcd = ssb_get_drvdata(dev);
 +	struct ssb_ehci_device *ehcidev = hcd_to_ssb_ehci(hcd);
 +
 +	ssb_device_enable(dev, 0);
 +
 +	ehci_finish_controller_resume(hcd);
 +	return 0;
 +}
 +
 +#else /* !CONFIG_PM */
 +#define ssb_ehci_suspend	NULL
 +#define ssb_ehci_resume	NULL
 +#endif /* CONFIG_PM */
 +
 +static const struct ssb_device_id ssb_ehci_table[] = {
 +	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB20_HOST, SSB_ANY_REV),
 +	SSB_DEVTABLE_END
 +};
 +MODULE_DEVICE_TABLE(ssb, ssb_ehci_table);
 +
 +static struct ssb_driver ssb_ehci_driver = {
 +	.name		= KBUILD_MODNAME,
 +	.id_table	= ssb_ehci_table,
 +	.probe		= ssb_ehci_probe,
 +	.remove		= ssb_ehci_remove,
 +	.suspend	= ssb_ehci_suspend,
 +	.resume		= ssb_ehci_resume,
 +};
--- a/target/linux/brcm47xx/patches-2.6.35/023-usb_ehci_ohci.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/023-usb_ehci_ohci.patch
@ -1,188 +0,0 @@
 --- a/drivers/usb/host/ohci-ssb.c
 +++ b/drivers/usb/host/ohci-ssb.c
@@ -17,6 +17,8 @@
  */
 #include <linux/ssb/ssb.h>
 +extern int ssb_ehci_attach(struct ssb_device *dev, struct usb_hcd **hcd);
 +extern void ssb_ehci_detach(struct ssb_device *dev, struct usb_hcd *hcd);
 #define SSB_OHCI_TMSLOW_HOSTMODE	(1 << 29)
@@ -24,6 +26,9 @@ struct ssb_ohci_device {
 	struct ohci_hcd ohci; /* _must_ be at the beginning. */
 	u32 enable_flags;
 +#ifdef CONFIG_USB_EHCI_HCD_SSB
 +	struct usb_hcd *ehci_hcd;
 +#endif
 };
 static inline
@@ -92,6 +97,9 @@ static const struct hc_driver ssb_ohci_h
 static void ssb_ohci_detach(struct ssb_device *dev)
 {
 	struct usb_hcd *hcd = ssb_get_drvdata(dev);
 +#ifdef CONFIG_USB_EHCI_HCD_SSB
 +	struct ssb_ohci_device *ohcidev = hcd_to_ssb_ohci(hcd);
 +#endif
 	if (hcd->driver->shutdown)
 		hcd->driver->shutdown(hcd);
@@ -99,6 +107,14 @@ static void ssb_ohci_detach(struct ssb_d
 	iounmap(hcd->regs);
 	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
 	usb_put_hcd(hcd);
 +
 +#ifdef CONFIG_USB_EHCI_HCD_SSB
 +	/*
 + 	 * Also detach ehci function
 +	 */
 +	if (dev->id.coreid == SSB_DEV_USB20_HOST)
 +		ssb_ehci_detach(dev, ohcidev->ehci_hcd);
 +#endif
 	ssb_device_disable(dev, 0);
 }
@@ -121,6 +137,9 @@ static int ssb_ohci_attach(struct ssb_de
 		/*
 		 * USB 2.0 special considerations:
 		 *
 +		 * Since the core supports both OHCI and EHCI functions, 
 +		 * it must only be reset once.
 +		 *
 		 * In addition to the standard SSB reset sequence, the Host
 		 * Control Register must be programmed to bring the USB core
 		 * and various phy components out of reset.
@@ -175,6 +194,14 @@ static int ssb_ohci_attach(struct ssb_de
 	ssb_set_drvdata(dev, hcd);
 +#ifdef CONFIG_USB_EHCI_HCD_SSB
 +	/*
 +	 *  attach ehci function in this core
 +	 */
 +	if (dev->id.coreid == SSB_DEV_USB20_HOST)
 +		err = ssb_ehci_attach(dev, &(ohcidev->ehci_hcd));
 +#endif
 +
 	return err;
 err_iounmap:
 --- a/drivers/usb/host/ehci-ssb.c
 +++ b/drivers/usb/host/ehci-ssb.c
@@ -106,10 +106,18 @@ static void ssb_ehci_detach(struct ssb_d
 	iounmap(hcd->regs);
 	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
 	usb_put_hcd(hcd);
 +#ifndef CONFIG_USB_OHCI_HCD_SSB
 +	ssb_device_disable(dev, 0);
 +#endif
 	ssb_device_disable(dev, 0);
 }
 +EXPORT_SYMBOL_GPL(ssb_ehci_detach);
 +#ifndef CONFIG_USB_OHCI_HCD_SSB
 static int ssb_ehci_attach(struct ssb_device *dev)
 +#else
 +static int ssb_ehci_attach(struct ssb_device *dev, struct usb_hcd **ehci_hcd)
 +#endif
 {
 	struct ssb_ehci_device *ehcidev;
 	struct usb_hcd *hcd;
@@ -120,6 +128,7 @@ static int ssb_ehci_attach(struct ssb_de
 	    dma_set_coherent_mask(dev->dma_dev, DMA_BIT_MASK(32)))
 		return -EOPNOTSUPP;
 +#ifndef CONFIG_USB_OHCI_HCD_SSB
 	/*
 	 * USB 2.0 special considerations:
 	 *
@@ -155,6 +164,7 @@ static int ssb_ehci_attach(struct ssb_de
 		tmp |= 0x1;
 		ssb_write32(dev, 0x89c, tmp);
 	}
 +#endif
 	hcd = usb_create_hcd(&ssb_ehci_hc_driver, dev->dev,
 			     dev_name(dev->dev));
@@ -175,7 +185,11 @@ static int ssb_ehci_attach(struct ssb_de
 	if (err)
 		goto err_iounmap;
 +#ifndef CONFIG_USB_OHCI_HCD_SSB
 	ssb_set_drvdata(dev, hcd);
 +#else
 +	*ehci_hcd = hcd;
 +#endif
 	return err;
@@ -187,7 +201,9 @@ err_dev_disable:
 	ssb_device_disable(dev, 0);
 	return err;
 }
 +EXPORT_SYMBOL_GPL(ssb_ehci_attach);
 +#ifndef CONFIG_USB_OHCI_HCD_SSB
 static int ssb_ehci_probe(struct ssb_device *dev,
 		const struct ssb_device_id *id)
 {
@@ -238,6 +254,7 @@ static int ssb_ehci_resume(struct ssb_de
 #define ssb_ehci_suspend	NULL
 #define ssb_ehci_resume	NULL
 #endif /* CONFIG_PM */
 +#endif /* !CONFIG_USB_OHCI_HCD_SSB */
 static const struct ssb_device_id ssb_ehci_table[] = {
 	SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB20_HOST, SSB_ANY_REV),
@@ -245,6 +262,8 @@ static const struct ssb_device_id ssb_eh
 };
 MODULE_DEVICE_TABLE(ssb, ssb_ehci_table);
 +
 +#ifndef CONFIG_USB_OHCI_HCD_SSB
 static struct ssb_driver ssb_ehci_driver = {
 	.name		= KBUILD_MODNAME,
 	.id_table	= ssb_ehci_table,
@@ -253,3 +272,4 @@ static struct ssb_driver ssb_ehci_driver
 	.suspend	= ssb_ehci_suspend,
 	.resume		= ssb_ehci_resume,
 };
 +#endif
 --- a/drivers/usb/host/ehci-hcd.c
 +++ b/drivers/usb/host/ehci-hcd.c
@@ -1226,17 +1226,21 @@ static int __init ehci_hcd_init(void)
 		goto clean4;
 #endif
 +#ifndef CONFIG_USB_OHCI_HCD_SSB
 #ifdef SSB_EHCI_DRIVER
 	retval = ssb_driver_register(&SSB_EHCI_DRIVER);
 	if (retval < 0)
 		goto clean5;
 #endif
 +#endif /* !CONFIG_USB_OHCI_HCD_SSB */
 	return retval;
 +#ifndef CONFIG_USB_OHCI_HCD_SSB
 #ifdef SSB_EHCI_DRIVER
 	/* ssb_driver_unregister(&SSB_EHCI_DRIVER); */
 clean5:
 #endif
 +#endif /* !CONFIG_USB_OHCI_HCD_SSB */
 #ifdef XILINX_OF_PLATFORM_DRIVER
 	of_unregister_platform_driver(&XILINX_OF_PLATFORM_DRIVER);
 clean4:
@@ -1269,9 +1273,11 @@ module_init(ehci_hcd_init);
 static void __exit ehci_hcd_cleanup(void)
 {
 +#ifndef CONFIG_USB_OHCI_HCD_SSB
 #ifdef SSB_EHCI_DRIVER
 	ssb_driver_unregister(&SSB_EHCI_DRIVER);
 #endif
 +#endif /* !CONFIG_USB_OHCI_HCD_SSB */
 #ifdef XILINX_OF_PLATFORM_DRIVER
 	of_unregister_platform_driver(&XILINX_OF_PLATFORM_DRIVER);
 #endif
--- a/target/linux/brcm47xx/patches-2.6.35/110-flash_map.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/110-flash_map.patch
@ -1,25 +0,0 @@
 --- a/drivers/mtd/maps/Kconfig
 +++ b/drivers/mtd/maps/Kconfig
@@ -319,6 +319,12 @@ config MTD_CFI_FLAGADM
 	  Mapping for the Flaga digital module. If you don't have one, ignore
 	  this setting.
 +config MTD_BCM47XX
 +	tristate "BCM47xx flash device"
 +	depends on MIPS && MTD_CFI && BCM47XX
 +	help
 +	  Support for the flash chips on the BCM947xx board.
 +
 config MTD_REDWOOD
 	tristate "CFI Flash devices mapped on IBM Redwood"
 	depends on MTD_CFI && ( REDWOOD_4 || REDWOOD_5 || REDWOOD_6 )
 --- a/drivers/mtd/maps/Makefile
 +++ b/drivers/mtd/maps/Makefile
@@ -29,6 +29,7 @@ obj-$(CONFIG_MTD_PMC_MSP_EVM)   += pmcms
 obj-$(CONFIG_MTD_PCMCIA)	+= pcmciamtd.o
 obj-$(CONFIG_MTD_RPXLITE)	+= rpxlite.o
 obj-$(CONFIG_MTD_TQM8XXL)	+= tqm8xxl.o
 +obj-$(CONFIG_MTD_BCM47XX)	+= bcm47xx-flash.o
 obj-$(CONFIG_MTD_SA1100)	+= sa1100-flash.o
 obj-$(CONFIG_MTD_SBC_GXX)	+= sbc_gxx.o
 obj-$(CONFIG_MTD_SC520CDP)	+= sc520cdp.o
--- a/target/linux/brcm47xx/patches-2.6.35/150-cpu_fixes.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/150-cpu_fixes.patch
@ -1,367 +0,0 @@
 --- a/arch/mips/include/asm/r4kcache.h
 +++ b/arch/mips/include/asm/r4kcache.h
@@ -17,6 +17,20 @@
 #include <asm/cpu-features.h>
 #include <asm/mipsmtregs.h>
 +#ifdef CONFIG_BCM47XX
 +#include <asm/paccess.h>
 +#include <linux/ssb/ssb.h>
 +#define BCM4710_DUMMY_RREG() ((void) *((u8 *) KSEG1ADDR(SSB_ENUM_BASE)))
 +
 +#define BCM4710_FILL_TLB(addr) (*(volatile unsigned long *)(addr))
 +#define BCM4710_PROTECTED_FILL_TLB(addr) ({ unsigned long x; get_dbe(x, (volatile unsigned long *)(addr)); })
 +#else
 +#define BCM4710_DUMMY_RREG()
 +
 +#define BCM4710_FILL_TLB(addr)
 +#define BCM4710_PROTECTED_FILL_TLB(addr)
 +#endif
 +
 /*
  * This macro return a properly sign-extended address suitable as base address
  * for indexed cache operations.  Two issues here:
@@ -150,6 +164,7 @@ static inline void flush_icache_line_ind
 static inline void flush_dcache_line_indexed(unsigned long addr)
 {
 	__dflush_prologue
 +	BCM4710_DUMMY_RREG();
 	cache_op(Index_Writeback_Inv_D, addr);
 	__dflush_epilogue
 }
@@ -169,6 +184,7 @@ static inline void flush_icache_line(uns
 static inline void flush_dcache_line(unsigned long addr)
 {
 	__dflush_prologue
 +	BCM4710_DUMMY_RREG();
 	cache_op(Hit_Writeback_Inv_D, addr);
 	__dflush_epilogue
 }
@@ -176,6 +192,7 @@ static inline void flush_dcache_line(uns
 static inline void invalidate_dcache_line(unsigned long addr)
 {
 	__dflush_prologue
 +	BCM4710_DUMMY_RREG();
 	cache_op(Hit_Invalidate_D, addr);
 	__dflush_epilogue
 }
@@ -208,6 +225,7 @@ static inline void flush_scache_line(uns
  */
 static inline void protected_flush_icache_line(unsigned long addr)
 {
 +	BCM4710_DUMMY_RREG();
 	protected_cache_op(Hit_Invalidate_I, addr);
 }
@@ -219,6 +237,7 @@ static inline void protected_flush_icach
  */
 static inline void protected_writeback_dcache_line(unsigned long addr)
 {
 +	BCM4710_DUMMY_RREG();
 	protected_cache_op(Hit_Writeback_Inv_D, addr);
 }
@@ -339,8 +358,52 @@ static inline void invalidate_tcache_pag
 		: "r" (base),						\
 		  "i" (op));
 +static inline void blast_dcache(void)
 +{
 +	unsigned long start = KSEG0;
 +	unsigned long dcache_size = current_cpu_data.dcache.waysize * current_cpu_data.dcache.ways;
 +	unsigned long end = (start + dcache_size);
 +
 +	do {
 +		BCM4710_DUMMY_RREG();
 +		cache_op(Index_Writeback_Inv_D, start);
 +		start += current_cpu_data.dcache.linesz;
 +	} while(start < end);
 +}
 +
 +static inline void blast_dcache_page(unsigned long page)
 +{
 +	unsigned long start = page;
 +	unsigned long end = start + PAGE_SIZE;
 +
 +	BCM4710_FILL_TLB(start);
 +	do {
 +		BCM4710_DUMMY_RREG();
 +		cache_op(Hit_Writeback_Inv_D, start);
 +		start += current_cpu_data.dcache.linesz;
 +	} while(start < end);
 +}
 +
 +static inline void blast_dcache_page_indexed(unsigned long page)
 +{
 +	unsigned long start = page;
 +	unsigned long end = start + PAGE_SIZE;
 +	unsigned long ws_inc = 1UL << current_cpu_data.dcache.waybit;
 +	unsigned long ws_end = current_cpu_data.dcache.ways <<
 +	                       current_cpu_data.dcache.waybit;
 +	unsigned long ws, addr;
 +	for (ws = 0; ws < ws_end; ws += ws_inc) {
 +		start = page + ws;
 +		for (addr = start; addr < end; addr += current_cpu_data.dcache.linesz) {
 +			BCM4710_DUMMY_RREG();
 +			cache_op(Index_Writeback_Inv_D, addr);
 +		}
 +	}
 +}
 +
 +
 /* build blast_xxx, blast_xxx_page, blast_xxx_page_indexed */
 -#define __BUILD_BLAST_CACHE(pfx, desc, indexop, hitop, lsize) \
 +#define __BUILD_BLAST_CACHE(pfx, desc, indexop, hitop, lsize, war) \
 static inline void blast_##pfx##cache##lsize(void)			\
 {									\
 	unsigned long start = INDEX_BASE;				\
@@ -352,6 +415,7 @@ static inline void blast_##pfx##cache##l
 									\
 	__##pfx##flush_prologue						\
 									\
 +	war								\
 	for (ws = 0; ws < ws_end; ws += ws_inc)				\
 		for (addr = start; addr < end; addr += lsize * 32)	\
 			cache##lsize##_unroll32(addr|ws, indexop);	\
@@ -366,6 +430,7 @@ static inline void blast_##pfx##cache##l
 									\
 	__##pfx##flush_prologue						\
 									\
 +	war								\
 	do {								\
 		cache##lsize##_unroll32(start, hitop);			\
 		start += lsize * 32;					\
@@ -384,6 +449,8 @@ static inline void blast_##pfx##cache##l
 	                       current_cpu_data.desc.waybit;		\
 	unsigned long ws, addr;						\
 									\
 +	war								\
 +									\
 	__##pfx##flush_prologue						\
 									\
 	for (ws = 0; ws < ws_end; ws += ws_inc)				\
@@ -393,36 +460,38 @@ static inline void blast_##pfx##cache##l
 	__##pfx##flush_epilogue						\
 }
 -__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 16)
 -__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 16)
 -__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 16)
 -__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 32)
 -__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 32)
 -__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 32)
 -__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 64)
 -__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64)
 -__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 64)
 -__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 128)
 -
 -__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 16)
 -__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 32)
 -__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 16)
 -__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 32)
 -__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 64)
 -__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 128)
 +__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 16, )
 +__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 16, BCM4710_FILL_TLB(start);)
 +__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 16, )
 +__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 32, )
 +__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 32, BCM4710_FILL_TLB(start);)
 +__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 32, )
 +__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 64, )
 +__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64, BCM4710_FILL_TLB(start);)
 +__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 64, )
 +__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 128, )
 +
 +__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 16, )
 +__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 32, )
 +__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 16, )
 +__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 32, )
 +__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 64, )
 +__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 128, )
 /* build blast_xxx_range, protected_blast_xxx_range */
 -#define __BUILD_BLAST_CACHE_RANGE(pfx, desc, hitop, prot) \
 +#define __BUILD_BLAST_CACHE_RANGE(pfx, desc, hitop, prot, war, war2) \
 static inline void prot##blast_##pfx##cache##_range(unsigned long start, \
 						    unsigned long end)	\
 {									\
 	unsigned long lsize = cpu_##desc##_line_size();			\
 	unsigned long addr = start & ~(lsize - 1);			\
 	unsigned long aend = (end - 1) & ~(lsize - 1);			\
 +	war								\
 									\
 	__##pfx##flush_prologue						\
 									\
 	while (1) {							\
 +		war2						\
 		prot##cache_op(hitop, addr);				\
 		if (addr == aend)					\
 			break;						\
@@ -432,13 +501,13 @@ static inline void prot##blast_##pfx##ca
 	__##pfx##flush_epilogue						\
 }
 -__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, protected_)
 -__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, protected_)
 -__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, protected_)
 -__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, )
 -__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, )
 +__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, protected_, BCM4710_PROTECTED_FILL_TLB(addr); BCM4710_PROTECTED_FILL_TLB(aend);, BCM4710_DUMMY_RREG();)
 +__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, protected_,, )
 +__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, protected_,, )
 +__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D,, BCM4710_FILL_TLB(addr); BCM4710_FILL_TLB(aend);, BCM4710_DUMMY_RREG();)
 +__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD,,, )
 /* blast_inv_dcache_range */
 -__BUILD_BLAST_CACHE_RANGE(inv_d, dcache, Hit_Invalidate_D, )
 -__BUILD_BLAST_CACHE_RANGE(inv_s, scache, Hit_Invalidate_SD, )
 +__BUILD_BLAST_CACHE_RANGE(inv_d, dcache, Hit_Invalidate_D,,,BCM4710_DUMMY_RREG();)
 +__BUILD_BLAST_CACHE_RANGE(inv_s, scache, Hit_Invalidate_SD,,, )
 #endif /* _ASM_R4KCACHE_H */
 --- a/arch/mips/include/asm/stackframe.h
 +++ b/arch/mips/include/asm/stackframe.h
@@ -449,6 +449,10 @@
 		.macro	RESTORE_SP_AND_RET
 		LONG_L	sp, PT_R29(sp)
 		.set	mips3
 +#ifdef CONFIG_BCM47XX
 +		nop
 +		nop
 +#endif
 		eret
 		.set	mips0
 		.endm
 --- a/arch/mips/kernel/genex.S
 +++ b/arch/mips/kernel/genex.S
@@ -52,6 +52,10 @@ NESTED(except_vec1_generic, 0, sp)
 NESTED(except_vec3_generic, 0, sp)
 	.set	push
 	.set	noat
 +#ifdef CONFIG_BCM47XX
 +	nop
 +	nop
 +#endif
 #if R5432_CP0_INTERRUPT_WAR
 	mfc0	k0, CP0_INDEX
 #endif
 --- a/arch/mips/mm/c-r4k.c
 +++ b/arch/mips/mm/c-r4k.c
@@ -35,6 +35,9 @@
 #include <asm/cacheflush.h> /* for run_uncached() */
 +/* For enabling BCM4710 cache workarounds */
 +int bcm4710 = 0;
 +
 /*
  * Special Variant of smp_call_function for use by cache functions:
  *
@@ -111,6 +114,9 @@ static void __cpuinit r4k_blast_dcache_p
 {
 	unsigned long  dc_lsize = cpu_dcache_line_size();
 +	if (bcm4710)
 +		r4k_blast_dcache_page = blast_dcache_page;
 +	else
 	if (dc_lsize == 0)
 		r4k_blast_dcache_page = (void *)cache_noop;
 	else if (dc_lsize == 16)
@@ -127,6 +133,9 @@ static void __cpuinit r4k_blast_dcache_p
 {
 	unsigned long dc_lsize = cpu_dcache_line_size();
 +	if (bcm4710)
 +		r4k_blast_dcache_page_indexed = blast_dcache_page_indexed;
 +	else
 	if (dc_lsize == 0)
 		r4k_blast_dcache_page_indexed = (void *)cache_noop;
 	else if (dc_lsize == 16)
@@ -143,6 +152,9 @@ static void __cpuinit r4k_blast_dcache_s
 {
 	unsigned long dc_lsize = cpu_dcache_line_size();
 +	if (bcm4710)
 +		r4k_blast_dcache = blast_dcache;
 +	else
 	if (dc_lsize == 0)
 		r4k_blast_dcache = (void *)cache_noop;
 	else if (dc_lsize == 16)
@@ -680,6 +692,8 @@ static void local_r4k_flush_cache_sigtra
 	unsigned long addr = (unsigned long) arg;
 	R4600_HIT_CACHEOP_WAR_IMPL;
 +	BCM4710_PROTECTED_FILL_TLB(addr);
 +	BCM4710_PROTECTED_FILL_TLB(addr + 4);
 	if (dc_lsize)
 		protected_writeback_dcache_line(addr & ~(dc_lsize - 1));
 	if (!cpu_icache_snoops_remote_store && scache_size)
@@ -1311,6 +1325,17 @@ static void __cpuinit coherency_setup(vo
 	 * silly idea of putting something else there ...
 	 */
 	switch (current_cpu_type()) {
 +	case CPU_BCM3302:
 +		{
 +			u32 cm;
 +			cm = read_c0_diag();
 +			/* Enable icache */
 +			cm |= (1 << 31);
 +			/* Enable dcache */
 +			cm |= (1 << 30);
 +			write_c0_diag(cm);
 +		}
 +		break;
 	case CPU_R4000PC:
 	case CPU_R4000SC:
 	case CPU_R4000MC:
@@ -1367,6 +1392,15 @@ void __cpuinit r4k_cache_init(void)
 		break;
 	}
 +	/* Check if special workarounds are required */
 +#ifdef CONFIG_BCM47XX
 +	if (current_cpu_data.cputype == CPU_BCM4710 && (current_cpu_data.processor_id & 0xff) == 0) {
 +		printk("Enabling BCM4710A0 cache workarounds.\n");
 +		bcm4710 = 1;
 +	} else
 +#endif
 +		bcm4710 = 0;
 +
 	probe_pcache();
 	setup_scache();
@@ -1425,5 +1459,13 @@ void __cpuinit r4k_cache_init(void)
 #if !defined(CONFIG_MIPS_CMP)
 	local_r4k___flush_cache_all(NULL);
 #endif
 +#ifdef CONFIG_BCM47XX
 +	{
 +		static void (*_coherency_setup)(void);
 +		_coherency_setup = (void (*)(void)) KSEG1ADDR(coherency_setup);
 +		_coherency_setup();
 +	}
 +#else
 	coherency_setup();
 +#endif
 }
 --- a/arch/mips/mm/tlbex.c
 +++ b/arch/mips/mm/tlbex.c
@@ -868,6 +868,9 @@ static void __cpuinit build_r4000_tlb_re
 		/* No need for uasm_i_nop */
 	}
 +#ifdef CONFIG_BCM47XX
 +	uasm_i_nop(&p);
 +#endif
 #ifdef CONFIG_64BIT
 	build_get_pmde64(&p, &l, &r, K0, K1); /* get pmd in K1 */
 #else
@@ -1318,6 +1321,9 @@ build_r4000_tlbchange_handler_head(u32 *
 				   struct uasm_reloc **r, unsigned int pte,
 				   unsigned int ptr)
 {
 +#ifdef CONFIG_BCM47XX
 +	uasm_i_nop(p);
 +#endif
 #ifdef CONFIG_64BIT
 	build_get_pmde64(p, l, r, pte, ptr); /* get pmd in ptr */
 #else
--- a/target/linux/brcm47xx/patches-2.6.35/160-kmap_coherent.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/160-kmap_coherent.patch
@ -1,77 +0,0 @@
 --- a/arch/mips/include/asm/cpu-features.h
 +++ b/arch/mips/include/asm/cpu-features.h
@@ -110,6 +110,9 @@
 #ifndef cpu_has_pindexed_dcache
 #define cpu_has_pindexed_dcache	(cpu_data[0].dcache.flags & MIPS_CACHE_PINDEX)
 #endif
 +#ifndef cpu_use_kmap_coherent
 +#define cpu_use_kmap_coherent 1
 +#endif
 /*
  * I-Cache snoops remote store.  This only matters on SMP.  Some multiprocessors
 --- /dev/null
 +++ b/arch/mips/include/asm/mach-bcm47xx/cpu-feature-overrides.h
@@ -0,0 +1,13 @@
 +/*
 + * This file is subject to the terms and conditions of the GNU General Public
 + * License.  See the file "COPYING" in the main directory of this archive
 + * for more details.
 + *
 + * Copyright (C) 2005 Ralf Baechle (ralf@linux-mips.org)
 + */
 +#ifndef __ASM_MACH_BCM47XX_CPU_FEATURE_OVERRIDES_H
 +#define __ASM_MACH_BCM47XX_CPU_FEATURE_OVERRIDES_H
 +
 +#define cpu_use_kmap_coherent	0
 +
 +#endif /* __ASM_MACH_BCM47XX_CPU_FEATURE_OVERRIDES_H */
 --- a/arch/mips/mm/c-r4k.c
 +++ b/arch/mips/mm/c-r4k.c
@@ -507,7 +507,7 @@ static inline void local_r4k_flush_cache
 		 */
 		map_coherent = (cpu_has_dc_aliases &&
 				page_mapped(page) && !Page_dcache_dirty(page));
 -		if (map_coherent)
 +		if (map_coherent && cpu_use_kmap_coherent)
 			vaddr = kmap_coherent(page, addr);
 		else
 			vaddr = kmap_atomic(page, KM_USER0);
@@ -530,7 +530,7 @@ static inline void local_r4k_flush_cache
 	}
 	if (vaddr) {
 -		if (map_coherent)
 +		if (map_coherent && cpu_use_kmap_coherent)
 			kunmap_coherent();
 		else
 			kunmap_atomic(vaddr, KM_USER0);
 --- a/arch/mips/mm/init.c
 +++ b/arch/mips/mm/init.c
@@ -210,7 +210,7 @@ void copy_user_highpage(struct page *to,
 	void *vfrom, *vto;
 	vto = kmap_atomic(to, KM_USER1);
 -	if (cpu_has_dc_aliases &&
 +	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
 	    page_mapped(from) && !Page_dcache_dirty(from)) {
 		vfrom = kmap_coherent(from, vaddr);
 		copy_page(vto, vfrom);
@@ -232,7 +232,7 @@ void copy_to_user_page(struct vm_area_st
 	struct page *page, unsigned long vaddr, void *dst, const void *src,
 	unsigned long len)
 {
 -	if (cpu_has_dc_aliases &&
 +	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
 	    page_mapped(page) && !Page_dcache_dirty(page)) {
 		void *vto = kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
 		memcpy(vto, src, len);
@@ -250,7 +250,7 @@ void copy_from_user_page(struct vm_area_
 	struct page *page, unsigned long vaddr, void *dst, const void *src,
 	unsigned long len)
 {
 -	if (cpu_has_dc_aliases &&
 +	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
 	    page_mapped(page) && !Page_dcache_dirty(page)) {
 		void *vfrom = kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
 		memcpy(dst, vfrom, len);
--- a/target/linux/brcm47xx/patches-2.6.35/210-b44_phy_fix.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/210-b44_phy_fix.patch
@ -1,92 +0,0 @@
 --- a/drivers/net/b44.c
 +++ b/drivers/net/b44.c
@@ -381,11 +381,12 @@ static void b44_set_flow_ctrl(struct b44
 	__b44_set_flow_ctrl(bp, pause_enab);
 }
 -#ifdef SSB_DRIVER_MIPS
 -extern char *nvram_get(char *name);
 +#ifdef CONFIG_BCM47XX
 +
 +#include <asm/mach-bcm47xx/nvram.h>
 static void b44_wap54g10_workaround(struct b44 *bp)
 {
 -	const char *str;
 +	char buf[20];
 	u32 val;
 	int err;
@@ -394,10 +395,9 @@ static void b44_wap54g10_workaround(stru
 	 * see https://dev.openwrt.org/ticket/146
 	 * check and reset bit "isolate"
 	 */
 -	str = nvram_get("boardnum");
 -	if (!str)
 +	if (nvram_getenv("boardnum", buf, sizeof(buf)) > 0)
 		return;
 -	if (simple_strtoul(str, NULL, 0) == 2) {
 +	if (simple_strtoul(buf, NULL, 0) == 2) {
 		err = __b44_readphy(bp, 0, MII_BMCR, &val);
 		if (err)
 			goto error;
@@ -412,10 +412,43 @@ static void b44_wap54g10_workaround(stru
 error:
 	pr_warning("PHY: cannot reset MII transceiver isolate bit\n");
 }
 +
 +static inline int startswith (const char *source, const char *cmp) 
 +{ 
 +       return !strncmp(source,cmp,strlen(cmp)); 
 +}
 +
 +static inline void b44_bcm47xx_workarounds(struct b44 *bp)
 +{
 +	char buf[20];
 +	/* Toshiba WRC-1000, Siemens SE505 v1, Askey RT-210W, RT-220W */
 +	if (nvram_getenv("boardnum", buf, sizeof(buf)) > 0)
 +		return;
 +	if (simple_strtoul(buf, NULL, 0) == 100) {
 +		bp->phy_addr = B44_PHY_ADDR_NO_PHY;
 +	} else {
 +		/* WL-HDD */
 +		struct ssb_device *sdev = bp->sdev;
 +		if (nvram_getenv("hardware_version", buf, sizeof(buf)) > 0)
 +			return;
 +		if (startswith(buf, "WL300-")) {
 +			if (sdev->bus->sprom.et0phyaddr == 0 &&
 +			    sdev->bus->sprom.et1phyaddr == 1)
 +				bp->phy_addr = B44_PHY_ADDR_NO_PHY;
 +		}
 +	}
 +	return;
 +}
 +
 #else
 +
 static inline void b44_wap54g10_workaround(struct b44 *bp)
 {
 }
 +
 +static inline void b44_bcm47xx_workarounds(struct b44 *bp)
 +{
 +}
 #endif
 static int b44_setup_phy(struct b44 *bp)
@@ -424,6 +457,7 @@ static int b44_setup_phy(struct b44 *bp)
 	int err;
 	b44_wap54g10_workaround(bp);
 +	b44_bcm47xx_workarounds(bp);
 	if (bp->phy_addr == B44_PHY_ADDR_NO_PHY)
 		return 0;
@@ -2080,6 +2114,8 @@ static int __devinit b44_get_invariants(
 	 * valid PHY address. */
 	bp->phy_addr &= 0x1F;
 +	b44_bcm47xx_workarounds(bp);
 +
 	memcpy(bp->dev->dev_addr, addr, 6);
 	if (!is_valid_ether_addr(&bp->dev->dev_addr[0])){
--- a/target/linux/brcm47xx/patches-2.6.35/211-b44_timeout_spam.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/211-b44_timeout_spam.patch
@ -1,15 +0,0 @@
 --- a/drivers/net/b44.c
 +++ b/drivers/net/b44.c
@@ -188,10 +188,11 @@ static int b44_wait_bit(struct b44 *bp,
 		udelay(10);
 	}
 	if (i == timeout) {
 +#if 0
 		if (net_ratelimit())
 			netdev_err(bp->dev, "BUG!  Timeout waiting for bit %08x of register %lx to %s\n",
 				   bit, reg, clear ? "clear" : "set");
 -
 +#endif
 		return -ENODEV;
 	}
 	return 0;
--- a/target/linux/brcm47xx/patches-2.6.35/220-bcm5354.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/220-bcm5354.patch
@ -1,42 +0,0 @@
 --- a/drivers/ssb/driver_chipcommon.c
 +++ b/drivers/ssb/driver_chipcommon.c
@@ -285,6 +285,8 @@ void ssb_chipco_resume(struct ssb_chipco
 void ssb_chipco_get_clockcpu(struct ssb_chipcommon *cc,
                              u32 *plltype, u32 *n, u32 *m)
 {
 +	if ((chipco_read32(cc, SSB_CHIPCO_CHIPID) & SSB_CHIPCO_IDMASK) == 0x5354)
 +		return;
 	*n = chipco_read32(cc, SSB_CHIPCO_CLOCK_N);
 	*plltype = (cc->capabilities & SSB_CHIPCO_CAP_PLLT);
 	switch (*plltype) {
@@ -308,6 +310,8 @@ void ssb_chipco_get_clockcpu(struct ssb_
 void ssb_chipco_get_clockcontrol(struct ssb_chipcommon *cc,
 				 u32 *plltype, u32 *n, u32 *m)
 {
 +	if ((chipco_read32(cc, SSB_CHIPCO_CHIPID) & SSB_CHIPCO_IDMASK) == 0x5354)
 +		return;
 	*n = chipco_read32(cc, SSB_CHIPCO_CLOCK_N);
 	*plltype = (cc->capabilities & SSB_CHIPCO_CAP_PLLT);
 	switch (*plltype) {
 --- a/drivers/ssb/driver_mipscore.c
 +++ b/drivers/ssb/driver_mipscore.c
@@ -217,6 +217,8 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
 	if ((pll_type == SSB_PLLTYPE_5) || (bus->chip_id == 0x5365)) {
 		rate = 200000000;
 +	} else if (bus->chip_id == 0x5354) {
 +		rate = 240000000;
 	} else {
 		rate = ssb_calc_clock_rate(pll_type, n, m);
 	}
 --- a/drivers/ssb/main.c
 +++ b/drivers/ssb/main.c
@@ -1075,6 +1075,8 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
 	if (bus->chip_id == 0x5365) {
 		rate = 100000000;
 +	} else if (bus->chip_id == 0x5354) {
 +		rate = 120000000;
 	} else {
 		rate = ssb_calc_clock_rate(plltype, clkctl_n, clkctl_m);
 		if (plltype == SSB_PLLTYPE_3) /* 25Mhz, 2 dividers */
--- a/target/linux/brcm47xx/patches-2.6.35/280-activate_ssb_support_in_usb.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/280-activate_ssb_support_in_usb.patch
@ -1,16 +0,0 @@
 This prevents the options from being delete with make kernel_oldconfig.
 ---
 drivers/ssb/Kconfig |    2 ++
 1 file changed, 2 insertions(+)
 --- a/drivers/ssb/Kconfig
 +++ b/drivers/ssb/Kconfig
@@ -141,6 +141,8 @@ config SSB_DRIVER_MIPS
 config SSB_EMBEDDED
 	bool
 	depends on SSB_DRIVER_MIPS
 +	select USB_EHCI_HCD_SSB if USB_EHCI_HCD
 +	select USB_OHCI_HCD_SSB if USB_OHCI_HCD
 	default y
 config SSB_DRIVER_EXTIF
--- a/target/linux/brcm47xx/patches-2.6.35/300-fork_cacheflush.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/300-fork_cacheflush.patch
@ -1,11 +0,0 @@
 --- a/arch/mips/include/asm/cacheflush.h
 +++ b/arch/mips/include/asm/cacheflush.h
@@ -32,7 +32,7 @@
 extern void (*flush_cache_all)(void);
 extern void (*__flush_cache_all)(void);
 extern void (*flush_cache_mm)(struct mm_struct *mm);
 -#define flush_cache_dup_mm(mm)	do { (void) (mm); } while (0)
 +#define flush_cache_dup_mm(mm) flush_cache_mm(mm)
 extern void (*flush_cache_range)(struct vm_area_struct *vma,
 	unsigned long start, unsigned long end);
 extern void (*flush_cache_page)(struct vm_area_struct *vma, unsigned long page, unsigned long pfn);
--- a/target/linux/brcm47xx/patches-2.6.35/301-kmod-fuse-dcache-bug-r4k.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/301-kmod-fuse-dcache-bug-r4k.patch
@ -1,32 +0,0 @@
 --- a/arch/mips/mm/c-r4k.c
 +++ b/arch/mips/mm/c-r4k.c
@@ -373,7 +373,7 @@ static inline void local_r4k___flush_cac
 	}
 }
 -static void r4k___flush_cache_all(void)
 +void r4k___flush_cache_all(void)
 {
 	r4k_on_each_cpu(local_r4k___flush_cache_all, NULL, 1);
 }
@@ -537,7 +537,7 @@ static inline void local_r4k_flush_cache
 	}
 }
 -static void r4k_flush_cache_page(struct vm_area_struct *vma,
 +void r4k_flush_cache_page(struct vm_area_struct *vma,
 	unsigned long addr, unsigned long pfn)
 {
 	struct flush_cache_page_args args;
@@ -1469,3 +1469,11 @@ void __cpuinit r4k_cache_init(void)
 	coherency_setup();
 #endif
 }
 +
 +/* fuse package DCACHE BUG patch exports */
 +void (*fuse_flush_cache_all)(void) = r4k___flush_cache_all;
 +EXPORT_SYMBOL(fuse_flush_cache_all);
 +
 +void (*fuse_flush_cache_page)(struct vm_area_struct *vma, unsigned long page,
 +	unsigned long pfn) = r4k_flush_cache_page;
 +EXPORT_SYMBOL(fuse_flush_cache_page);
--- a/target/linux/brcm47xx/patches-2.6.35/310-no_highpage.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/310-no_highpage.patch
@ -1,66 +0,0 @@
 --- a/arch/mips/include/asm/page.h
 +++ b/arch/mips/include/asm/page.h
@@ -43,6 +43,7 @@
 #ifndef __ASSEMBLY__
 #include <linux/pfn.h>
 +#include <asm/cpu-features.h>
 #include <asm/io.h>
 extern void build_clear_page(void);
@@ -78,13 +79,16 @@ static inline void clear_user_page(void
 		flush_data_cache_page((unsigned long)addr);
 }
 -extern void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
 -	struct page *to);
 -struct vm_area_struct;
 -extern void copy_user_highpage(struct page *to, struct page *from,
 -	unsigned long vaddr, struct vm_area_struct *vma);
 +static inline void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
 +	struct page *to)
 +{
 +	extern void (*flush_data_cache_page)(unsigned long addr);
 -#define __HAVE_ARCH_COPY_USER_HIGHPAGE
 +	copy_page(vto, vfrom);
 +	if (!cpu_has_ic_fills_f_dc ||
 +	    pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK))
 +		flush_data_cache_page((unsigned long)vto);
 +}
 /*
  * These are used to make use of C type-checking..
 --- a/arch/mips/mm/init.c
 +++ b/arch/mips/mm/init.c
@@ -204,30 +204,6 @@ void kunmap_coherent(void)
 	preempt_check_resched();
 }
 -void copy_user_highpage(struct page *to, struct page *from,
 -	unsigned long vaddr, struct vm_area_struct *vma)
 -{
 -	void *vfrom, *vto;
 -
 -	vto = kmap_atomic(to, KM_USER1);
 -	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
 -	    page_mapped(from) && !Page_dcache_dirty(from)) {
 -		vfrom = kmap_coherent(from, vaddr);
 -		copy_page(vto, vfrom);
 -		kunmap_coherent();
 -	} else {
 -		vfrom = kmap_atomic(from, KM_USER0);
 -		copy_page(vto, vfrom);
 -		kunmap_atomic(vfrom, KM_USER0);
 -	}
 -	if ((!cpu_has_ic_fills_f_dc) ||
 -	    pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK))
 -		flush_data_cache_page((unsigned long)vto);
 -	kunmap_atomic(vto, KM_USER1);
 -	/* Make sure this page is cleared on other CPU's too before using it */
 -	smp_wmb();
 -}
 -
 void copy_to_user_page(struct vm_area_struct *vma,
 	struct page *page, unsigned long vaddr, void *dst, const void *src,
 	unsigned long len)
--- a/target/linux/brcm47xx/patches-2.6.35/400-arch-bcm47xx.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/400-arch-bcm47xx.patch
@ -1,56 +0,0 @@
 --- a/arch/mips/bcm47xx/nvram.c
 +++ b/arch/mips/bcm47xx/nvram.c
@@ -92,3 +92,30 @@ int nvram_getenv(char *name, char *val,
 	return NVRAM_ERR_ENVNOTFOUND;
 }
 EXPORT_SYMBOL(nvram_getenv);
 +
 +char *nvram_get(const char *name)
 +{
 +	char *var, *value, *end, *eq;
 +
 +	if (!name)
 +		return NULL;
 +
 +	if (!nvram_buf[0])
 +		early_nvram_init();
 +
 +	/* Look for name=value and return value */
 +	var = &nvram_buf[sizeof(struct nvram_header)];
 +	end = nvram_buf + sizeof(nvram_buf) - 2;
 +	end[0] = end[1] = '\0';
 +	for (; *var; var = value + strlen(value) + 1) {
 +		eq = strchr(var, '=');
 +		if (!eq)
 +			break;
 +		value = eq + 1;
 +		if ((eq - var) == strlen(name) && strncmp(var, name, (eq - var)) == 0)
 +			return value;
 +	}
 +
 +	return NULL;
 +}
 +EXPORT_SYMBOL(nvram_get);
 --- a/arch/mips/bcm47xx/setup.c
 +++ b/arch/mips/bcm47xx/setup.c
@@ -238,3 +238,20 @@ void __init plat_mem_setup(void)
 	_machine_halt = bcm47xx_machine_halt;
 	pm_power_off = bcm47xx_machine_halt;
 }
 +
 +static int __init bcm47xx_register_gpiodev(void)
 +{
 +	static struct resource res = {
 +		.start = 0xFFFFFFFF,
 +	};
 +	struct platform_device *pdev;
 +
 +	pdev = platform_device_register_simple("GPIODEV", 0, &res, 1);
 +	if (!pdev) {
 +		printk(KERN_ERR "bcm47xx: GPIODEV init failed\n");
 +		return -ENODEV;
 +	}
 +
 +	return 0;
 +}
 +device_initcall(bcm47xx_register_gpiodev);
--- a/target/linux/brcm47xx/patches-2.6.35/601-mips-remove-pci-collision-check.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/601-mips-remove-pci-collision-check.patch
@ -1,18 +0,0 @@
 --- a/arch/mips/pci/pci.c
 +++ b/arch/mips/pci/pci.c
@@ -185,12 +185,10 @@ static int pcibios_enable_resources(stru
 		if ((idx == PCI_ROM_RESOURCE) &&
 				(!(r->flags & IORESOURCE_ROM_ENABLE)))
 			continue;
 -		if (!r->start && r->end) {
 -			printk(KERN_ERR "PCI: Device %s not available "
 -			       "because of resource collisions\n",
 +		if (!r->start && r->end)
 +			printk(KERN_WARNING "PCI: Device %s resource"
 +			       "collisions detected. Ignoring...\n",
 			       pci_name(dev));
 -			return -EINVAL;
 -		}
 		if (r->flags & IORESOURCE_IO)
 			cmd |= PCI_COMMAND_IO;
 		if (r->flags & IORESOURCE_MEM)
--- a/target/linux/brcm47xx/patches-2.6.35/610-pci_ide_fix.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/610-pci_ide_fix.patch
@ -1,14 +0,0 @@
 --- a/include/linux/ide.h
 +++ b/include/linux/ide.h
@@ -195,7 +195,11 @@ static inline void ide_std_init_ports(st
 	hw->io_ports.ctl_addr = ctl_addr;
 }
 +#if defined CONFIG_BCM47XX
 +# define MAX_HWIFS	2
 +#else
 #define MAX_HWIFS	10
 +#endif
 /*
  * Now for the data we need to maintain per-drive:  ide_drive_t
--- a/target/linux/brcm47xx/patches-2.6.35/700-ssb-gigabit-ethernet-driver.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/700-ssb-gigabit-ethernet-driver.patch
@ -1,329 +0,0 @@
 --- a/drivers/net/tg3.c
 +++ b/drivers/net/tg3.c
@@ -41,6 +41,7 @@
 #include <linux/prefetch.h>
 #include <linux/dma-mapping.h>
 #include <linux/firmware.h>
 +#include <linux/ssb/ssb_driver_gige.h>
 #include <net/checksum.h>
 #include <net/ip.h>
@@ -494,8 +495,9 @@ static void _tw32_flush(struct tg3 *tp,
 static inline void tw32_mailbox_flush(struct tg3 *tp, u32 off, u32 val)
 {
 	tp->write32_mbox(tp, off, val);
 -	if (!(tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER) &&
 -	    !(tp->tg3_flags2 & TG3_FLG2_ICH_WORKAROUND))
 +	if ((tp->tg3_flags3 & TG3_FLG3_FLUSH_POSTED_WRITES) ||
 +	    (!(tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER) &&
 +	     !(tp->tg3_flags2 & TG3_FLG2_ICH_WORKAROUND)))
 		tp->read32_mbox(tp, off);
 }
@@ -505,7 +507,7 @@ static void tg3_write32_tx_mbox(struct t
 	writel(val, mbox);
 	if (tp->tg3_flags & TG3_FLAG_TXD_MBOX_HWBUG)
 		writel(val, mbox);
 -	if (tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER)
 +	if ((tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER) || (tp->tg3_flags3 & TG3_FLG3_FLUSH_POSTED_WRITES))
 		readl(mbox);
 }
@@ -807,7 +809,7 @@ static void tg3_switch_clocks(struct tg3
 #define PHY_BUSY_LOOPS	5000
 -static int tg3_readphy(struct tg3 *tp, int reg, u32 *val)
 +static int __tg3_readphy(struct tg3 *tp, unsigned int phy_addr, int reg, u32 *val)
 {
 	u32 frame_val;
 	unsigned int loops;
@@ -821,7 +823,7 @@ static int tg3_readphy(struct tg3 *tp, i
 	*val = 0x0;
 -	frame_val  = ((tp->phy_addr << MI_COM_PHY_ADDR_SHIFT) &
 +	frame_val  = ((phy_addr << MI_COM_PHY_ADDR_SHIFT) &
 		      MI_COM_PHY_ADDR_MASK);
 	frame_val |= ((reg << MI_COM_REG_ADDR_SHIFT) &
 		      MI_COM_REG_ADDR_MASK);
@@ -856,7 +858,12 @@ static int tg3_readphy(struct tg3 *tp, i
 	return ret;
 }
 -static int tg3_writephy(struct tg3 *tp, int reg, u32 val)
 +static int tg3_readphy(struct tg3 *tp, int reg, u32 *val)
 +{
 +	return __tg3_readphy(tp, tp->phy_addr, reg, val);
 +}
 +
 +static int __tg3_writephy(struct tg3 *tp, unsigned int phy_addr, int reg, u32 val)
 {
 	u32 frame_val;
 	unsigned int loops;
@@ -872,7 +879,7 @@ static int tg3_writephy(struct tg3 *tp,
 		udelay(80);
 	}
 -	frame_val  = ((tp->phy_addr << MI_COM_PHY_ADDR_SHIFT) &
 +	frame_val  = ((phy_addr << MI_COM_PHY_ADDR_SHIFT) &
 		      MI_COM_PHY_ADDR_MASK);
 	frame_val |= ((reg << MI_COM_REG_ADDR_SHIFT) &
 		      MI_COM_REG_ADDR_MASK);
@@ -905,6 +912,11 @@ static int tg3_writephy(struct tg3 *tp,
 	return ret;
 }
 +static int tg3_writephy(struct tg3 *tp, int reg, u32 val)
 +{
 +	return __tg3_writephy(tp, tp->phy_addr, reg, val);
 +}
 +
 static int tg3_bmcr_reset(struct tg3 *tp)
 {
 	u32 phy_control;
@@ -2411,6 +2423,9 @@ static int tg3_nvram_read(struct tg3 *tp
 {
 	int ret;
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE)
 +		return -ENODEV;
 +
 	if (!(tp->tg3_flags & TG3_FLAG_NVRAM))
 		return tg3_nvram_read_using_eeprom(tp, offset, val);
@@ -2742,8 +2757,10 @@ static int tg3_set_power_state(struct tg
 	tg3_frob_aux_power(tp);
 	/* Workaround for unstable PLL clock */
 -	if ((GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5750_AX) ||
 -	    (GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5750_BX)) {
 +	if ((tp->phy_id & TG3_PHY_ID_MASK) != TG3_PHY_ID_BCM5750_2 &&
 +				/* !!! FIXME !!! */
 +	    ((GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5750_AX) ||
 +	    (GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5750_BX))) {
 		u32 val = tr32(0x7d00);
 		val &= ~((1 << 16) | (1 << 4) | (1 << 2) | (1 << 1) | 1);
@@ -3236,6 +3253,14 @@ relink:
 		tg3_phy_copper_begin(tp);
 +		if (tp->tg3_flags3 & TG3_FLG3_ROBOSWITCH) {
 +			current_link_up = 1;
 +			current_speed = SPEED_1000; /* FIXME */
 +			current_duplex = DUPLEX_FULL;
 +			tp->link_config.active_speed = current_speed;
 +			tp->link_config.active_duplex = current_duplex;
 +		}
 +
 		tg3_readphy(tp, MII_BMSR, &tmp);
 		if (!tg3_readphy(tp, MII_BMSR, &tmp) &&
 		    (tmp & BMSR_LSTATUS))
@@ -6719,6 +6744,11 @@ static int tg3_poll_fw(struct tg3 *tp)
 	int i;
 	u32 val;
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE) {
 +		/* We don't use firmware. */
 +		return 0;
 +	}
 +
 	if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
 		/* Wait up to 20ms for init done. */
 		for (i = 0; i < 200; i++) {
@@ -7002,6 +7032,14 @@ static int tg3_chip_reset(struct tg3 *tp
 		tw32(0x5000, 0x400);
 	}
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE) {
 +		/* BCM4785: In order to avoid repercussions from using potentially
 +		 * defective internal ROM, stop the Rx RISC CPU, which is not
 +		 * required. */
 +		tg3_stop_fw(tp);
 +		tg3_halt_cpu(tp, RX_CPU_BASE);
 +	}
 +
 	tw32(GRC_MODE, tp->grc_mode);
 	if (tp->pci_chip_rev_id == CHIPREV_ID_5705_A0) {
@@ -7179,9 +7217,12 @@ static int tg3_halt_cpu(struct tg3 *tp,
 		return -ENODEV;
 	}
 -	/* Clear firmware's nvram arbitration. */
 -	if (tp->tg3_flags & TG3_FLAG_NVRAM)
 -		tw32(NVRAM_SWARB, SWARB_REQ_CLR0);
 +	if (!(tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE)) {
 +		/* Clear firmware's nvram arbitration. */
 +		if (tp->tg3_flags & TG3_FLAG_NVRAM)
 +			tw32(NVRAM_SWARB, SWARB_REQ_CLR0);
 +	}
 +
 	return 0;
 }
@@ -7244,6 +7285,11 @@ static int tg3_load_5701_a0_firmware_fix
 	const __be32 *fw_data;
 	int err, i;
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE) {
 +		/* We don't use firmware. */
 +		return 0;
 +	}
 +
 	fw_data = (void *)tp->fw->data;
 	/* Firmware blob starts with version numbers, followed by
@@ -7302,6 +7348,11 @@ static int tg3_load_tso_firmware(struct
 	unsigned long cpu_base, cpu_scratch_base, cpu_scratch_size;
 	int err, i;
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE) {
 +		/* We don't use firmware. */
 +		return 0;
 +	}
 +
 	if (tp->tg3_flags2 & TG3_FLG2_HW_TSO)
 		return 0;
@@ -8446,6 +8497,11 @@ static void tg3_timer(unsigned long __op
 	spin_lock(&tp->lock);
 +	if (tp->tg3_flags3 & TG3_FLG3_FLUSH_POSTED_WRITES) {
 +		/* BCM4785: Flush posted writes from GbE to host memory. */
 +		tr32(HOSTCC_MODE);
 +	}
 +
 	if (!(tp->tg3_flags & TG3_FLAG_TAGGED_STATUS)) {
 		/* All of this garbage is because when using non-tagged
 		 * IRQ status the mailbox/status_block protocol the chip
@@ -10113,6 +10169,11 @@ static int tg3_test_nvram(struct tg3 *tp
 	if (tp->tg3_flags3 & TG3_FLG3_NO_NVRAM)
 		return 0;
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE) {
 +		/* We don't have NVRAM. */
 +		return 0;
 +	}
 +
 	if (tg3_nvram_read(tp, 0, &magic) != 0)
 		return -EIO;
@@ -10932,7 +10993,7 @@ static int tg3_ioctl(struct net_device *
 			return -EAGAIN;
 		spin_lock_bh(&tp->lock);
 -		err = tg3_readphy(tp, data->reg_num & 0x1f, &mii_regval);
 +		err = __tg3_readphy(tp, data->phy_id & 0x1f, data->reg_num & 0x1f, &mii_regval);
 		spin_unlock_bh(&tp->lock);
 		data->val_out = mii_regval;
@@ -10948,7 +11009,7 @@ static int tg3_ioctl(struct net_device *
 			return -EAGAIN;
 		spin_lock_bh(&tp->lock);
 -		err = tg3_writephy(tp, data->reg_num & 0x1f, data->val_in);
 +		err = __tg3_writephy(tp, data->phy_id & 0x1f, data->reg_num & 0x1f, data->val_in);
 		spin_unlock_bh(&tp->lock);
 		return err;
@@ -11593,6 +11654,12 @@ static void __devinit tg3_get_5717_nvram
 /* Chips other than 5700/5701 use the NVRAM for fetching info. */
 static void __devinit tg3_nvram_init(struct tg3 *tp)
 {
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE) {
 +		/* No NVRAM and EEPROM on the SSB Broadcom GigE core. */
 +		tp->tg3_flags &= ~(TG3_FLAG_NVRAM | TG3_FLAG_NVRAM_BUFFERED);
 +		return;
 +	}
 +
 	tw32_f(GRC_EEPROM_ADDR,
 	     (EEPROM_ADDR_FSM_RESET |
 	      (EEPROM_DEFAULT_CLOCK_PERIOD <<
@@ -11855,6 +11922,9 @@ static int tg3_nvram_write_block(struct
 {
 	int ret;
 +	if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE)
 +		return -ENODEV;
 +
 	if (tp->tg3_flags & TG3_FLAG_EEPROM_WRITE_PROT) {
 		tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl &
 		       ~GRC_LCLCTRL_GPIO_OUTPUT1);
@@ -13227,6 +13297,11 @@ static int __devinit tg3_get_invariants(
 	      GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)))
 		tp->tg3_flags |= TG3_FLAG_SRAM_USE_CONFIG;
 +	if (tp->tg3_flags3 & TG3_FLG3_FLUSH_POSTED_WRITES) {
 +		tp->write32_tx_mbox = tg3_write_flush_reg32;
 +		tp->write32_rx_mbox = tg3_write_flush_reg32;
 +	}
 +
 	/* Get eeprom hw config before calling tg3_set_power_state().
 	 * In particular, the TG3_FLG2_IS_NIC flag must be
 	 * determined before calling tg3_set_power_state() so that
@@ -13624,6 +13699,10 @@ static int __devinit tg3_get_device_addr
 	}
 	if (!is_valid_ether_addr(&dev->dev_addr[0])) {
 +		if (tp->tg3_flags3 & TG3_FLG3_IS_SSB_CORE)
 +			ssb_gige_get_macaddr(tp->pdev, &dev->dev_addr[0]);
 +	}
 +	if (!is_valid_ether_addr(&dev->dev_addr[0])) {
 #ifdef CONFIG_SPARC
 		if (!tg3_get_default_macaddr_sparc(tp))
 			return 0;
@@ -14144,6 +14223,7 @@ static char * __devinit tg3_phy_string(s
 	case TG3_PHY_ID_BCM5704:	return "5704";
 	case TG3_PHY_ID_BCM5705:	return "5705";
 	case TG3_PHY_ID_BCM5750:	return "5750";
 +	case TG3_PHY_ID_BCM5750_2:	return "5750-2";
 	case TG3_PHY_ID_BCM5752:	return "5752";
 	case TG3_PHY_ID_BCM5714:	return "5714";
 	case TG3_PHY_ID_BCM5780:	return "5780";
@@ -14354,6 +14434,13 @@ static int __devinit tg3_init_one(struct
 		tp->msg_enable = tg3_debug;
 	else
 		tp->msg_enable = TG3_DEF_MSG_ENABLE;
 +	if (pdev_is_ssb_gige_core(pdev)) {
 +		tp->tg3_flags3 |= TG3_FLG3_IS_SSB_CORE;
 +		if (ssb_gige_must_flush_posted_writes(pdev))
 +			tp->tg3_flags3 |= TG3_FLG3_FLUSH_POSTED_WRITES;
 +		if (ssb_gige_have_roboswitch(pdev))
 +			tp->tg3_flags3 |= TG3_FLG3_ROBOSWITCH;
 +	}
 	/* The word/byte swap controls here control register access byte
 	 * swapping.  DMA data byte swapping is controlled in the GRC_MODE
 --- a/drivers/net/tg3.h
 +++ b/drivers/net/tg3.h
@@ -2014,6 +2014,9 @@
 #define  NIC_SRAM_RGMII_INBAND_DISABLE	 0x00000004
 #define  NIC_SRAM_RGMII_EXT_IBND_RX_EN	 0x00000008
 #define  NIC_SRAM_RGMII_EXT_IBND_TX_EN	 0x00000010
 +#define TG3_FLG3_IS_SSB_CORE		0x00000800
 +#define TG3_FLG3_FLUSH_POSTED_WRITES	0x00001000
 +#define TG3_FLG3_ROBOSWITCH		0x00002000
 #define NIC_SRAM_RX_MINI_BUFFER_DESC	0x00001000
@@ -2931,6 +2934,7 @@ struct tg3 {
 #define TG3_PHY_ID_BCM5704		0x60008190
 #define TG3_PHY_ID_BCM5705		0x600081a0
 #define TG3_PHY_ID_BCM5750		0x60008180
 +#define TG3_PHY_ID_BCM5750_2		0xbc050cd0
 #define TG3_PHY_ID_BCM5752		0x60008100
 #define TG3_PHY_ID_BCM5714		0x60008340
 #define TG3_PHY_ID_BCM5780		0x60008350
@@ -2965,7 +2969,8 @@ struct tg3 {
 	 (X) == TG3_PHY_ID_BCM5755 || (X) == TG3_PHY_ID_BCM5756 || \
 	 (X) == TG3_PHY_ID_BCM5906 || (X) == TG3_PHY_ID_BCM5761 || \
 	 (X) == TG3_PHY_ID_BCM5718C || (X) == TG3_PHY_ID_BCM5718S || \
 -	 (X) == TG3_PHY_ID_BCM57765 || (X) == TG3_PHY_ID_BCM8002)
 +	 (X) == TG3_PHY_ID_BCM57765 || (X) == TG3_PHY_ID_BCM8002 || \
 +	 (X) == TG3_PHY_ID_BCM5750_2)
 	u32				led_ctrl;
 	u32				phy_otp;
--- a/target/linux/brcm47xx/patches-2.6.35/812-disable_wgt634u_crap.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/812-disable_wgt634u_crap.patch
@ -1,177 +0,0 @@
 --- a/arch/mips/bcm47xx/Makefile
 +++ b/arch/mips/bcm47xx/Makefile
@@ -3,4 +3,4 @@
 # under Linux.
 #
 -obj-y := gpio.o irq.o nvram.o prom.o serial.o setup.o time.o wgt634u.o
 +obj-y := gpio.o irq.o nvram.o prom.o serial.o setup.o time.o
 --- a/arch/mips/bcm47xx/wgt634u.c
 +++ /dev/null
@@ -1,166 +0,0 @@
 -/*
 - * This file is subject to the terms and conditions of the GNU General Public
 - * License.  See the file "COPYING" in the main directory of this archive
 - * for more details.
 - *
 - * Copyright (C) 2007 Aurelien Jarno <aurelien@aurel32.net>
 - */
 -
 -#include <linux/platform_device.h>
 -#include <linux/module.h>
 -#include <linux/leds.h>
 -#include <linux/mtd/physmap.h>
 -#include <linux/ssb/ssb.h>
 -#include <linux/interrupt.h>
 -#include <linux/reboot.h>
 -#include <linux/gpio.h>
 -#include <asm/mach-bcm47xx/bcm47xx.h>
 -
 -/* GPIO definitions for the WGT634U */
 -#define WGT634U_GPIO_LED	3
 -#define WGT634U_GPIO_RESET	2
 -#define WGT634U_GPIO_TP1	7
 -#define WGT634U_GPIO_TP2	6
 -#define WGT634U_GPIO_TP3	5
 -#define WGT634U_GPIO_TP4	4
 -#define WGT634U_GPIO_TP5	1
 -
 -static struct gpio_led wgt634u_leds[] = {
 -	{
 -		.name = "power",
 -		.gpio = WGT634U_GPIO_LED,
 -		.active_low = 1,
 -		.default_trigger = "heartbeat",
 -	},
 -};
 -
 -static struct gpio_led_platform_data wgt634u_led_data = {
 -	.num_leds =     ARRAY_SIZE(wgt634u_leds),
 -	.leds =         wgt634u_leds,
 -};
 -
 -static struct platform_device wgt634u_gpio_leds = {
 -	.name =         "leds-gpio",
 -	.id =           -1,
 -	.dev = {
 -		.platform_data = &wgt634u_led_data,
 -	}
 -};
 -
 -
 -/* 8MiB flash. The struct mtd_partition matches original Netgear WGT634U
 -   firmware. */
 -static struct mtd_partition wgt634u_partitions[] = {
 -	{
 -		.name       = "cfe",
 -		.offset     = 0,
 -		.size       = 0x60000,		/* 384k */
 -		.mask_flags = MTD_WRITEABLE 	/* force read-only */
 -	},
 -	{
 -		.name   = "config",
 -		.offset = 0x60000,
 -		.size   = 0x20000		/* 128k */
 -	},
 -	{
 -		.name   = "linux",
 -		.offset = 0x80000,
 -		.size   = 0x140000 		/* 1280k */
 -	},
 -	{
 -		.name   = "jffs",
 -		.offset = 0x1c0000,
 -		.size   = 0x620000 		/* 6272k */
 -	},
 -	{
 -		.name   = "nvram",
 -		.offset = 0x7e0000,
 -		.size   = 0x20000		/* 128k */
 -	},
 -};
 -
 -static struct physmap_flash_data wgt634u_flash_data = {
 -	.parts    = wgt634u_partitions,
 -	.nr_parts = ARRAY_SIZE(wgt634u_partitions)
 -};
 -
 -static struct resource wgt634u_flash_resource = {
 -	.flags = IORESOURCE_MEM,
 -};
 -
 -static struct platform_device wgt634u_flash = {
 -	.name          = "physmap-flash",
 -	.id            = 0,
 -	.dev           = { .platform_data = &wgt634u_flash_data, },
 -	.resource      = &wgt634u_flash_resource,
 -	.num_resources = 1,
 -};
 -
 -/* Platform devices */
 -static struct platform_device *wgt634u_devices[] __initdata = {
 -	&wgt634u_flash,
 -	&wgt634u_gpio_leds,
 -};
 -
 -static irqreturn_t gpio_interrupt(int irq, void *ignored)
 -{
 -	int state;
 -
 -	/* Interrupts are shared, check if the current one is
 -	   a GPIO interrupt. */
 -	if (!ssb_chipco_irq_status(&ssb_bcm47xx.chipco,
 -				   SSB_CHIPCO_IRQ_GPIO))
 -		return IRQ_NONE;
 -
 -	state = gpio_get_value(WGT634U_GPIO_RESET);
 -
 -	/* Interrupt are level triggered, revert the interrupt polarity
 -	   to clear the interrupt. */
 -	gpio_polarity(WGT634U_GPIO_RESET, state);
 -
 -	if (!state) {
 -		printk(KERN_INFO "Reset button pressed");
 -		ctrl_alt_del();
 -	}
 -
 -	return IRQ_HANDLED;
 -}
 -
 -static int __init wgt634u_init(void)
 -{
 -	/* There is no easy way to detect that we are running on a WGT634U
 -	 * machine. Use the MAC address as an heuristic. Netgear Inc. has
 -	 * been allocated ranges 00:09:5b:xx:xx:xx and 00:0f:b5:xx:xx:xx.
 -	 */
 -
 -	u8 *et0mac = ssb_bcm47xx.sprom.et0mac;
 -
 -	if (et0mac[0] == 0x00 &&
 -	    ((et0mac[1] == 0x09 && et0mac[2] == 0x5b) ||
 -	     (et0mac[1] == 0x0f && et0mac[2] == 0xb5))) {
 -		struct ssb_mipscore *mcore = &ssb_bcm47xx.mipscore;
 -
 -		printk(KERN_INFO "WGT634U machine detected.\n");
 -
 -		if (!request_irq(gpio_to_irq(WGT634U_GPIO_RESET),
 -				 gpio_interrupt, IRQF_SHARED,
 -				 "WGT634U GPIO", &ssb_bcm47xx.chipco)) {
 -			gpio_direction_input(WGT634U_GPIO_RESET);
 -			gpio_intmask(WGT634U_GPIO_RESET, 1);
 -			ssb_chipco_irq_mask(&ssb_bcm47xx.chipco,
 -					    SSB_CHIPCO_IRQ_GPIO,
 -					    SSB_CHIPCO_IRQ_GPIO);
 -		}
 -
 -		wgt634u_flash_data.width = mcore->flash_buswidth;
 -		wgt634u_flash_resource.start = mcore->flash_window;
 -		wgt634u_flash_resource.end = mcore->flash_window
 -					   + mcore->flash_window_size
 -					   - 1;
 -		return platform_add_devices(wgt634u_devices,
 -					    ARRAY_SIZE(wgt634u_devices));
 -	} else
 -		return -ENODEV;
 -}
 -
 -module_init(wgt634u_init);
--- a/target/linux/brcm47xx/patches-2.6.35/820-wgt634u-nvram-fix.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/820-wgt634u-nvram-fix.patch
@ -1,305 +0,0 @@
 The Netgear wgt634u uses a different format for storing the 
 configuration. This patch is needed to read out the correct 
 configuration. The cfe_env.c file uses a different method way to read 
 out the configuration than the in kernel cfe config reader.
 --- a/arch/mips/bcm47xx/Makefile
 +++ b/arch/mips/bcm47xx/Makefile
@@ -3,4 +3,4 @@
 # under Linux.
 #
 -obj-y := gpio.o irq.o nvram.o prom.o serial.o setup.o time.o
 +obj-y := gpio.o irq.o nvram.o prom.o serial.o setup.o time.o cfe_env.o
 --- /dev/null
 +++ b/arch/mips/bcm47xx/cfe_env.c
@@ -0,0 +1,229 @@
 +/*
 + * CFE environment variable access
 + *
 + * Copyright 2001-2003, Broadcom Corporation
 + * Copyright 2006, Felix Fietkau <nbd@openwrt.org>
 + * 
 + * This program is free software; you can redistribute  it and/or modify it
 + * under  the terms of  the GNU General  Public License as published by the
 + * Free Software Foundation;  either version 2 of the  License, or (at your
 + * option) any later version.
 + */
 +
 +#include <linux/init.h>
 +#include <linux/module.h>
 +#include <linux/kernel.h>
 +#include <linux/string.h>
 +#include <asm/io.h>
 +#include <asm/uaccess.h>
 +
 +#define NVRAM_SIZE       (0x1ff0)
 +static char _nvdata[NVRAM_SIZE];
 +static char _valuestr[256];
 +
 +/*
 + * TLV types.  These codes are used in the "type-length-value"
 + * encoding of the items stored in the NVRAM device (flash or EEPROM)
 + *
 + * The layout of the flash/nvram is as follows:
 + *
 + * <type> <length> <data ...> <type> <length> <data ...> <type_end>
 + *
 + * The type code of "ENV_TLV_TYPE_END" marks the end of the list.
 + * The "length" field marks the length of the data section, not
 + * including the type and length fields.
 + *
 + * Environment variables are stored as follows:
 + *
 + * <type_env> <length> <flags> <name> = <value>
 + *
 + * If bit 0 (low bit) is set, the length is an 8-bit value.
 + * If bit 0 (low bit) is clear, the length is a 16-bit value
 + * 
 + * Bit 7 set indicates "user" TLVs.  In this case, bit 0 still
 + * indicates the size of the length field.  
 + *
 + * Flags are from the constants below:
 + *
 + */
 +#define ENV_LENGTH_16BITS	0x00	/* for low bit */
 +#define ENV_LENGTH_8BITS	0x01
 +
 +#define ENV_TYPE_USER		0x80
 +
 +#define ENV_CODE_SYS(n,l) (((n)<<1)|(l))
 +#define ENV_CODE_USER(n,l) ((((n)<<1)|(l)) | ENV_TYPE_USER)
 +
 +/*
 + * The actual TLV types we support
 + */
 +
 +#define ENV_TLV_TYPE_END	0x00	
 +#define ENV_TLV_TYPE_ENV	ENV_CODE_SYS(0,ENV_LENGTH_8BITS)
 +
 +/*
 + * Environment variable flags 
 + */
 +
 +#define ENV_FLG_NORMAL		0x00	/* normal read/write */
 +#define ENV_FLG_BUILTIN		0x01	/* builtin - not stored in flash */
 +#define ENV_FLG_READONLY	0x02	/* read-only - cannot be changed */
 +
 +#define ENV_FLG_MASK		0xFF	/* mask of attributes we keep */
 +#define ENV_FLG_ADMIN		0x100	/* lets us internally override permissions */
 +
 +
 +/*  *********************************************************************
 +    *  _nvram_read(buffer,offset,length)
 +    *  
 +    *  Read data from the NVRAM device
 +    *  
 +    *  Input parameters: 
 +    *  	   buffer - destination buffer
 +    *  	   offset - offset of data to read
 +    *  	   length - number of bytes to read
 +    *  	   
 +    *  Return value:
 +    *  	   number of bytes read, or <0 if error occured
 +    ********************************************************************* */
 +static int
 +_nvram_read(unsigned char *nv_buf, unsigned char *buffer, int offset, int length)
 +{
 +    int i;
 +    if (offset > NVRAM_SIZE)
 +	return -1; 
 +
 +    for ( i = 0; i < length; i++) {
 +	buffer[i] = ((volatile unsigned char*)nv_buf)[offset + i];
 +    }
 +    return length;
 +}
 +
 +
 +static char*
 +_strnchr(const char *dest,int c,size_t cnt)
 +{
 +	while (*dest && (cnt > 0)) {
 +	if (*dest == c) return (char *) dest;
 +	dest++;
 +	cnt--;
 +	}
 +	return NULL;
 +}
 +
 +
 +
 +/*
 + * Core support API: Externally visible.
 + */
 +
 +/*
 + * Get the value of an NVRAM variable
 + * @param	name	name of variable to get
 + * @return	value of variable or NULL if undefined
 + */
 +
 +char* 
 +cfe_env_get(unsigned char *nv_buf, char* name)
 +{
 +    int size;
 +    unsigned char *buffer;
 +    unsigned char *ptr;
 +    unsigned char *envval;
 +    unsigned int reclen;
 +    unsigned int rectype;
 +    int offset;
 +    int flg;
 +    
 +	if (!strcmp(name, "nvram_type"))
 +		return "cfe";
 +	
 +    size = NVRAM_SIZE;
 +    buffer = &_nvdata[0];
 +
 +    ptr = buffer;
 +    offset = 0;
 +
 +    /* Read the record type and length */
 +    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
 +	goto error;
 +    }
 +    
 +    while ((*ptr != ENV_TLV_TYPE_END)  && (size > 1)) {
 +
 +	/* Adjust pointer for TLV type */
 +	rectype = *(ptr);
 +	offset++;
 +	size--;
 +
 +	/* 
 +	 * Read the length.  It can be either 1 or 2 bytes
 +	 * depending on the code 
 +	 */
 +	if (rectype & ENV_LENGTH_8BITS) {
 +	    /* Read the record type and length - 8 bits */
 +	    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
 +		goto error;
 +	    }
 +	    reclen = *(ptr);
 +	    size--;
 +	    offset++;
 +	}
 +	else {
 +	    /* Read the record type and length - 16 bits, MSB first */
 +	    if (_nvram_read(nv_buf, ptr,offset,2) != 2) {
 +		goto error;
 +	    }
 +	    reclen = (((unsigned int) *(ptr)) << 8) + (unsigned int) *(ptr+1);
 +	    size -= 2;
 +	    offset += 2;
 +	}
 +
 +	if (reclen > size)
 +	    break;	/* should not happen, bad NVRAM */
 +
 +	switch (rectype) {
 +	    case ENV_TLV_TYPE_ENV:
 +		/* Read the TLV data */
 +		if (_nvram_read(nv_buf, ptr,offset,reclen) != reclen)
 +		    goto error;
 +		flg = *ptr++;
 +		envval = (unsigned char *) _strnchr(ptr,'=',(reclen-1));
 +		if (envval) {
 +		    *envval++ = '\0';
 +		    memcpy(_valuestr,envval,(reclen-1)-(envval-ptr));
 +		    _valuestr[(reclen-1)-(envval-ptr)] = '\0';
 +#if 0			
 +		    printk(KERN_INFO "NVRAM:%s=%s\n", ptr, _valuestr);
 +#endif
 +		    if(!strcmp(ptr, name)){
 +			return _valuestr;
 +		    }
 +		    if((strlen(ptr) > 1) && !strcmp(&ptr[1], name))
 +			return _valuestr;
 +		}
 +		break;
 +		
 +	    default: 
 +		/* Unknown TLV type, skip it. */
 +		break;
 +	    }
 +
 +	/*
 +	 * Advance to next TLV 
 +	 */
 +		
 +	size -= (int)reclen;
 +	offset += reclen;
 +
 +	/* Read the next record type */
 +	ptr = buffer;
 +	if (_nvram_read(nv_buf, ptr,offset,1) != 1)
 +	    goto error;
 +	}
 +
 +error:
 +    return NULL;
 +
 +}
 +
 --- a/arch/mips/bcm47xx/nvram.c
 +++ b/arch/mips/bcm47xx/nvram.c
@@ -21,6 +21,8 @@
 #include <asm/mach-bcm47xx/bcm47xx.h>
 static char nvram_buf[NVRAM_SPACE];
 +static int cfe_env;
 +extern char *cfe_env_get(char *nv_buf, const char *name);
 /* Probe for NVRAM header */
 static void __init early_nvram_init(void)
@@ -33,6 +35,25 @@ static void __init early_nvram_init(void
 	base = mcore->flash_window;
 	lim = mcore->flash_window_size;
 +	cfe_env = 0;
 +
 +	/* XXX: hack for supporting the CFE environment stuff on WGT634U */
 +	if (lim >= 8 * 1024 * 1024) {
 +		src = (u32 *) KSEG1ADDR(base + 8 * 1024 * 1024 - 0x2000);
 +		dst = (u32 *) nvram_buf;
 +
 +		if ((*src & 0xff00ff) == 0x000001) {
 +			printk("early_nvram_init: WGT634U NVRAM found.\n");
 +
 +			for (i = 0; i < 0x1ff0; i++) {
 +				if (*src == 0xFFFFFFFF)
 +					break;
 +				*dst++ = *src++;
 +			}
 +			cfe_env = 1;
 +			return;
 +		}
 +	}
 	off = FLASH_MIN;
 	while (off <= lim) {
@@ -74,6 +95,12 @@ int nvram_getenv(char *name, char *val,
 	if (!nvram_buf[0])
 		early_nvram_init();
 +	if (cfe_env) {
 +		value = cfe_env_get(nvram_buf, name);
 +		snprintf(val, val_len, "%s", value);
 +		return 0;
 +	}
 +
 	/* Look for name=value and return value */
 	var = &nvram_buf[sizeof(struct nvram_header)];
 	end = nvram_buf + sizeof(nvram_buf) - 2;
@@ -103,6 +130,9 @@ char *nvram_get(const char *name)
 	if (!nvram_buf[0])
 		early_nvram_init();
 +	if (cfe_env)
 +		return cfe_env_get(nvram_buf, name);
 +
 	/* Look for name=value and return value */
 	var = &nvram_buf[sizeof(struct nvram_header)];
 	end = nvram_buf + sizeof(nvram_buf) - 2;
--- a/target/linux/brcm47xx/patches-2.6.35/920-cache-wround.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/920-cache-wround.patch
@ -1,138 +0,0 @@
 --- a/arch/mips/include/asm/r4kcache.h
 +++ b/arch/mips/include/asm/r4kcache.h
@@ -20,10 +20,28 @@
 #ifdef CONFIG_BCM47XX
 #include <asm/paccess.h>
 #include <linux/ssb/ssb.h>
 -#define BCM4710_DUMMY_RREG() ((void) *((u8 *) KSEG1ADDR(SSB_ENUM_BASE)))
 +#define BCM4710_DUMMY_RREG() bcm4710_dummy_rreg()
 +
 +static inline unsigned long bcm4710_dummy_rreg(void)
 +{
 +      return *(volatile unsigned long *)(KSEG1ADDR(SSB_ENUM_BASE));
 +}
 +
 +#define BCM4710_FILL_TLB(addr) bcm4710_fill_tlb((void *)(addr))
 +
 +static inline unsigned long bcm4710_fill_tlb(void *addr)
 +{
 +      return *(unsigned long *)addr;
 +}
 +
 +#define BCM4710_PROTECTED_FILL_TLB(addr) bcm4710_protected_fill_tlb((void *)(addr))
 +
 +static inline void bcm4710_protected_fill_tlb(void *addr)
 +{
 +      unsigned long x;
 +      get_dbe(x, (unsigned long *)addr);;
 +}
 -#define BCM4710_FILL_TLB(addr) (*(volatile unsigned long *)(addr))
 -#define BCM4710_PROTECTED_FILL_TLB(addr) ({ unsigned long x; get_dbe(x, (volatile unsigned long *)(addr)); })
 #else
 #define BCM4710_DUMMY_RREG()
 --- a/arch/mips/mm/tlbex.c
 +++ b/arch/mips/mm/tlbex.c
@@ -707,6 +707,9 @@ build_get_pgde32(u32 **p, unsigned int t
 #endif
 	uasm_i_addu(p, ptr, tmp, ptr);
 #else
 +#ifdef CONFIG_BCM47XX
 +	uasm_i_nop(p);
 +#endif
 	UASM_i_LA_mostly(p, ptr, pgdc);
 #endif
 	uasm_i_mfc0(p, tmp, C0_BADVADDR); /* get faulting address */
@@ -868,12 +871,12 @@ static void __cpuinit build_r4000_tlb_re
 		/* No need for uasm_i_nop */
 	}
 -#ifdef CONFIG_BCM47XX
 -	uasm_i_nop(&p);
 -#endif
 #ifdef CONFIG_64BIT
 	build_get_pmde64(&p, &l, &r, K0, K1); /* get pmd in K1 */
 #else
 +# ifdef CONFIG_BCM47XX
 +	uasm_i_nop(&p);
 +# endif
 	build_get_pgde32(&p, K0, K1); /* get pgd in K1 */
 #endif
@@ -885,6 +888,9 @@ static void __cpuinit build_r4000_tlb_re
 	build_update_entries(&p, K0, K1);
 	build_tlb_write_entry(&p, &l, &r, tlb_random);
 	uasm_l_leave(&l, p);
 +#ifdef CONFIG_BCM47XX
 +	uasm_i_nop(&p);
 +#endif
 	uasm_i_eret(&p); /* return from trap */
 #ifdef CONFIG_HUGETLB_PAGE
@@ -1321,12 +1327,12 @@ build_r4000_tlbchange_handler_head(u32 *
 				   struct uasm_reloc **r, unsigned int pte,
 				   unsigned int ptr)
 {
 -#ifdef CONFIG_BCM47XX
 -	uasm_i_nop(p);
 -#endif
 #ifdef CONFIG_64BIT
 	build_get_pmde64(p, l, r, pte, ptr); /* get pmd in ptr */
 #else
 +# ifdef CONFIG_BCM47XX
 +	uasm_i_nop(p);
 +# endif
 	build_get_pgde32(p, pte, ptr); /* get pgd in ptr */
 #endif
@@ -1363,6 +1369,9 @@ build_r4000_tlbchange_handler_tail(u32 *
 	build_update_entries(p, tmp, ptr);
 	build_tlb_write_entry(p, l, r, tlb_indexed);
 	uasm_l_leave(l, *p);
 +#ifdef CONFIG_BCM47XX
 +	uasm_i_nop(p);
 +#endif
 	uasm_i_eret(p); /* return from trap */
 #ifdef CONFIG_64BIT
 --- a/arch/mips/kernel/genex.S
 +++ b/arch/mips/kernel/genex.S
@@ -22,6 +22,19 @@
 #include <asm/page.h>
 #include <asm/thread_info.h>
 +#ifdef CONFIG_BCM47XX
 +# ifdef eret
 +#  undef eret
 +# endif
 +# define eret 					\
 +	.set push;				\
 +	.set noreorder;				\
 +	 nop; 					\
 +	 nop;					\
 +	 eret;					\
 +	.set pop;
 +#endif
 +
 #define PANIC_PIC(msg)					\
 		.set push;				\
 		.set	reorder;			\
@@ -54,7 +67,6 @@ NESTED(except_vec3_generic, 0, sp)
 	.set	noat
 #ifdef CONFIG_BCM47XX
 	nop
 -	nop
 #endif
 #if R5432_CP0_INTERRUPT_WAR
 	mfc0	k0, CP0_INDEX
@@ -79,6 +91,9 @@ NESTED(except_vec3_r4000, 0, sp)
 	.set	push
 	.set	mips3
 	.set	noat
 +#ifdef CONFIG_BCM47XX
 +	nop
 +#endif
 	mfc0	k1, CP0_CAUSE
 	li	k0, 31<<2
 	andi	k1, k1, 0x7c
--- a/target/linux/brcm47xx/patches-2.6.35/940-bcm47xx-yenta.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/940-bcm47xx-yenta.patch
@ -1,46 +0,0 @@
 --- a/drivers/pcmcia/yenta_socket.c
 +++ b/drivers/pcmcia/yenta_socket.c
@@ -922,6 +922,8 @@ static unsigned int yenta_probe_irq(stru
 	 * Probe for usable interrupts using the force
 	 * register to generate bogus card status events.
 	 */
 +#ifndef CONFIG_BCM47XX
 +	/* WRT54G3G does not like this */
 	cb_writel(socket, CB_SOCKET_EVENT, -1);
 	cb_writel(socket, CB_SOCKET_MASK, CB_CSTSMASK);
 	reg = exca_readb(socket, I365_CSCINT);
@@ -937,6 +939,7 @@ static unsigned int yenta_probe_irq(stru
 	}
 	cb_writel(socket, CB_SOCKET_MASK, 0);
 	exca_writeb(socket, I365_CSCINT, reg);
 +#endif
 	mask = probe_irq_mask(val) & 0xffff;
@@ -1021,6 +1024,10 @@ static void yenta_get_socket_capabilitie
 	else
 		socket->socket.irq_mask = 0;
 +	/* irq mask probing is broken for the WRT54G3G */
 +	if (socket->socket.irq_mask == 0)
 +		socket->socket.irq_mask = 0x6f8;
 +
 	dev_printk(KERN_INFO, &socket->dev->dev,
 		   "ISA IRQ mask 0x%04x, PCI irq %d\n",
 		   socket->socket.irq_mask, socket->cb_irq);
@@ -1259,6 +1266,15 @@ static int __devinit yenta_probe(struct
 	dev_printk(KERN_INFO, &dev->dev,
 		   "Socket status: %08x\n", cb_readl(socket, CB_SOCKET_STATE));
 +	/* Generate an interrupt on card insert/remove */
 +	config_writew(socket, CB_SOCKET_MASK, CB_CSTSMASK | CB_CDMASK);
 +
 +	/* Set up Multifunction Routing Status Register */
 +	config_writew(socket, 0x8C, 0x1000 /* MFUNC3 to GPIO3 */ | 0x2 /* MFUNC0 to INTA */);
 +
 +	/* Switch interrupts to parallelized */
 +	config_writeb(socket, 0x92, 0x64);
 +
 	yenta_fixup_parent_bridge(dev->subordinate);
 	/* Register it with the pcmcia layer.. */
--- a/target/linux/brcm47xx/patches-2.6.35/950-sbb-sysfs-files.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/950-sbb-sysfs-files.patch
@ -1,45 +0,0 @@
 --- a/drivers/ssb/main.c
 +++ b/drivers/ssb/main.c
@@ -385,6 +385,34 @@ static int ssb_device_uevent(struct devi
 			     ssb_dev->id.revision);
 }
 +#define ssb_config_attr(attrib, field, format_string)					\
 +static ssize_t													\
 +attrib##_show(struct device *dev, struct device_attribute *attr, char *buf) \
 +{																\
 +	return sprintf(buf, format_string, dev_to_ssb_dev(dev)->field);		\
 +}
 +
 +ssb_config_attr(core_num, core_index, "%u\n")
 +ssb_config_attr(coreid, id.coreid, "0x%04x\n")
 +ssb_config_attr(vendor, id.vendor, "0x%04x\n")
 +ssb_config_attr(revision, id.revision, "%u\n")
 +ssb_config_attr(irq, irq, "%u\n")
 +static ssize_t
 +name_show(struct device *dev, struct device_attribute *attr, char *buf)
 +{
 +	return sprintf(buf, "%s\n", ssb_core_name(dev_to_ssb_dev(dev)->id.coreid));
 +}
 +
 +static struct device_attribute ssb_device_attrs[] = {
 +	__ATTR_RO(name),
 +	__ATTR_RO(core_num),
 +	__ATTR_RO(coreid),
 +	__ATTR_RO(vendor),
 +	__ATTR_RO(revision),
 +	__ATTR_RO(irq),
 +	__ATTR_NULL,
 +};
 +
 static struct bus_type ssb_bustype = {
 	.name		= "ssb",
 	.match		= ssb_bus_match,
@@ -394,6 +422,7 @@ static struct bus_type ssb_bustype = {
 	.suspend	= ssb_device_suspend,
 	.resume		= ssb_device_resume,
 	.uevent		= ssb_device_uevent,
 +	.dev_attrs	= ssb_device_attrs,
 };
 static void ssb_buses_lock(void)
--- a/target/linux/brcm47xx/patches-2.6.35/951-brcm4716-defines.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/951-brcm4716-defines.patch
@ -1,104 +0,0 @@
 --- a/drivers/ssb/scan.c
 +++ b/drivers/ssb/scan.c
@@ -92,6 +92,14 @@ const char *ssb_core_name(u16 coreid)
 		return "ARM 1176";
 	case SSB_DEV_ARM_7TDMI:
 		return "ARM 7TDMI";
 +	case SSB_DEV_ETHERNET_GBIT2:
 +		return "Gigabit MAC";
 +	case SSB_DEV_MIPS_74K:
 +		return "MIPS 74k";
 +	case SSB_DEV_DDR_CTRLR:
 +		return "DDR1/2 memory controller";
 +	case SSB_DEV_I2S:
 +		return "I2S";
 	}
 	return "UNKNOWN";
 }
@@ -150,6 +158,7 @@ static u8 chipid_to_nrcores(u16 chipid)
 	case 0x4710:
 	case 0x4610:
 	case 0x4704:
 +	case 0x4716:
 		return 9;
 	default:
 		ssb_printk(KERN_ERR PFX
 --- a/include/linux/ssb/ssb.h
 +++ b/include/linux/ssb/ssb.h
@@ -151,9 +151,16 @@ struct ssb_bus_ops {
 #define SSB_DEV_MINI_MACPHY	0x823
 #define SSB_DEV_ARM_1176	0x824
 #define SSB_DEV_ARM_7TDMI	0x825
 +#define SSB_DEV_ETHERNET_GBIT2	0x82d
 +#define SSB_DEV_MIPS_74K	0x82c
 +#define SSB_DEV_DDR_CTRLR	0x82e
 +#define SSB_DEV_I2S			0x834
 +#define SSB_DEV_DEFAULT		0xfff
 /* Vendor-ID values */
 #define SSB_VENDOR_BROADCOM	0x4243
 +#define SSB_VENDOR_BROADCOM2 0x04BF
 +#define SSB_VENDOR_ARM		0x43b
 /* Some kernel subsystems poke with dev->drvdata, so we must use the
  * following ugly workaround to get from struct device to struct ssb_device */
 --- a/include/linux/ssb/ssb_regs.h
 +++ b/include/linux/ssb/ssb_regs.h
@@ -11,6 +11,7 @@
 #define	SSB_SDRAM_SWAPPED	0x10000000U	/* Byteswapped Physical SDRAM */
 #define SSB_ENUM_BASE    	0x18000000U	/* Enumeration space base */
 #define	SSB_ENUM_LIMIT		0x18010000U	/* Enumeration space limit */
 +#define SSB_AI_BASE		0x18100000		/* base for AI registers */
 #define	SSB_FLASH2		0x1c000000U	/* Flash Region 2 (region 1 shadowed here) */
 #define	SSB_FLASH2_SZ		0x02000000U	/* Size of Flash Region 2 */
@@ -26,6 +27,7 @@
 #define	SSB_EUART		(SSB_EXTIF_BASE + 0x00800000)
 #define	SSB_LED			(SSB_EXTIF_BASE + 0x00900000)
 +#define SSB_EROM_ASD_SZ_BASE 0x00001000
 /* Enumeration space constants */
 #define SSB_CORE_SIZE		0x1000	/* Size of a core MMIO area */
@@ -453,5 +455,41 @@ enum {
 #define SSB_ADM_BASE2			0xFFFF0000	/* Type2 base address for the core */
 #define SSB_ADM_BASE2_SHIFT		16
 +/***** EROM defines for AI type busses *****/
 +#define SSB_EROM_VALID			1
 +#define SSB_EROM_END			0xe
 +#define SSB_EROM_TAG			0xe
 +/* Adress Space Descriptor */
 +#define SSB_EROM_ASD			0x4
 +#define SSB_EROM_ASD_SP_MASK	0x00000f00
 +#define SSB_EROM_ASD_SP_SHIFT	8
 +#define SSB_EROM_ASD_ST_MASK	0x000000c0
 +#define SSB_EROM_ASD_ST_SLAVE	0x00000000
 +#define SSB_EROM_ASD_ST_BRIDGE	0x00000040
 +#define SSB_EROM_ASD_ST_MWRAP	0x000000c0
 +#define SSB_EROM_ASD_ST_SWRAP	0x00000080
 +#define SSB_EROM_ASD_ADDR_MASK	0xfffff000
 +#define SSB_EROM_ASD_AG32		0x00000008
 +#define SSB_EROM_ASD_SZ_MASK	0x00000030
 +#define SSB_EROM_ASD_SZ_SZD		0x00000030
 +#define SSB_EROM_ASD_SZ_SHIFT	4
 +#define SSB_EROM_CI				0
 +#define SSB_EROM_CIA_CID_MASK	0x000fff00
 +#define SSB_EROM_CIA_CID_SHIFT	8
 +#define SSB_EROM_CIA_MFG_MASK	0xfff00000
 +#define SSB_EROM_CIA_MFG_SHIFT	20
 +#define SSB_EROM_CIB_REV_MASK	0xff000000
 +#define SSB_EROM_CIB_REV_SHIFT	24
 +#define SSB_EROM_CIB_NMW_MASK	0x0007c000
 +#define SSB_EROM_CIB_NSW_MASK	0x00f80000
 +#define SSB_EROM_CIB_NSP_MASK	0x00003e00
 +
 +/***** Registers of AI config space *****/
 +#define SSB_AI_RESETCTRL		0x800 /* maybe 0x804 for big endian */
 +#define  SSB_AI_RESETCTRL_RESET	1
 +#define SSB_AI_IOCTRL			0x408 /* maybe 0x40c for big endian */
 +#define SSB_CF_FGC				0x0002
 +#define SSB_CF_CLOCK_EN			0x001
 +#define SSB_AI_oobselouta30		0x100
 #endif /* LINUX_SSB_REGS_H_ */
--- a/target/linux/brcm47xx/patches-2.6.35/999-wl_exports.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/999-wl_exports.patch
@ -1,22 +0,0 @@
 --- a/arch/mips/bcm47xx/nvram.c
 +++ b/arch/mips/bcm47xx/nvram.c
@@ -20,7 +20,8 @@
 #include <asm/mach-bcm47xx/nvram.h>
 #include <asm/mach-bcm47xx/bcm47xx.h>
 -static char nvram_buf[NVRAM_SPACE];
 +char nvram_buf[NVRAM_SPACE];
 +EXPORT_SYMBOL(nvram_buf);
 static int cfe_env;
 extern char *cfe_env_get(char *nv_buf, const char *name);
 --- a/arch/mips/mm/cache.c
 +++ b/arch/mips/mm/cache.c
@@ -52,6 +52,7 @@ void (*_dma_cache_wback)(unsigned long s
 void (*_dma_cache_inv)(unsigned long start, unsigned long size);
 EXPORT_SYMBOL(_dma_cache_wback_inv);
 +EXPORT_SYMBOL(_dma_cache_inv);
 #endif /* CONFIG_DMA_NONCOHERENT */