Finally fix the annoying BCM4704 segfault issues (#2035) - tested with WL-500gP

Thanks to jhansen and Wolfram Joost for the fixes and to ryd for the test hardware.
Seems like the user space segfaults actually came from this patch: http://lkml.org/lkml/2006/12/12/158


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@9285 3c298f89-4303-0410-b956-a3cf2f4a3e73

6 files changed, 168 insertions, 632 deletions

diff --git a/target/linux/brcm47xx/Makefile b/target/linux/brcm47xx/Makefile
index b00d5d7401..5e0fe3d339 100644
--- a/target/linux/brcm47xx/Makefile
+++ b/target/linux/brcm47xx/Makefile
@@ -11,7 +11,7 @@ BOARD:=brcm47xx
 BOARDNAME:=Broadcom BCM947xx/953xx
 FEATURES:=squashfs usb
 
-LINUX_VERSION:=2.6.22.4
+LINUX_VERSION:=2.6.23
 
 include $(INCLUDE_DIR)/target.mk
 DEFAULT_PACKAGES += kmod-switch kmod-diag
diff --git a/target/linux/brcm47xx/patches-2.6.23/120-b44_ssb_support.patch b/target/linux/brcm47xx/patches-2.6.23/120-b44_ssb_support.patch
index e8114c6bbe..06865cff3c 100644
--- a/target/linux/brcm47xx/patches-2.6.23/120-b44_ssb_support.patch
+++ b/target/linux/brcm47xx/patches-2.6.23/120-b44_ssb_support.patch
@@ -1,7 +1,7 @@
 Index: linux-2.6.23/drivers/net/b44.c
 ===================================================================
---- linux-2.6.23.orig/drivers/net/b44.c	2007-10-09 22:31:38.000000000 +0200
-+++ linux-2.6.23/drivers/net/b44.c	2007-10-13 02:46:38.946989430 +0200
+--- linux-2.6.23.orig/drivers/net/b44.c	2007-10-13 10:58:27.872607266 +0200
++++ linux-2.6.23/drivers/net/b44.c	2007-10-13 11:00:46.916530927 +0200
 @@ -1,7 +1,9 @@
 -/* b44.c: Broadcom 4400 device driver.
 +/* b44.c: Broadcom 4400/47xx device driver.
@@ -107,7 +107,7 @@ Index: linux-2.6.23/drivers/net/b44.c
 +	                                       unsigned long offset,
 +	                                       enum dma_data_direction dir)
 +{
-+	dma_sync_single_range_for_device(&sdev->dev, dma_base,
++	dma_sync_single_range_for_device(sdev->dev, dma_base,
 +		                        offset & dma_desc_align_mask,
 +		                        dma_desc_sync_size, dir);
 +}
@@ -117,7 +117,7 @@ Index: linux-2.6.23/drivers/net/b44.c
 +	                                    unsigned long offset,
 +	                                    enum dma_data_direction dir)
 +{
-+	dma_sync_single_range_for_cpu(&sdev->dev, dma_base,
++	dma_sync_single_range_for_cpu(sdev->dev, dma_base,
 +		                     offset & dma_desc_align_mask,
 +		                     dma_desc_sync_size, dir);
  }
@@ -370,7 +370,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  		BUG_ON(skb == NULL);
  
 -		pci_unmap_single(bp->pdev,
-+		dma_unmap_single(&bp->sdev->dev,
++		dma_unmap_single(bp->sdev->dev,
  				 pci_unmap_addr(rp, mapping),
  				 skb->len,
 -				 PCI_DMA_TODEVICE);
@@ -383,7 +383,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  		return -ENOMEM;
  
 -	mapping = pci_map_single(bp->pdev, skb->data,
-+	mapping = dma_map_single(&bp->sdev->dev, skb->data,
++	mapping = dma_map_single(bp->sdev->dev, skb->data,
  				 RX_PKT_BUF_SZ,
 -				 PCI_DMA_FROMDEVICE);
 +				 DMA_FROM_DEVICE);
@@ -395,13 +395,13 @@ Index: linux-2.6.23/drivers/net/b44.c
  		/* Sigh... */
  		if (!dma_mapping_error(mapping))
 -			pci_unmap_single(bp->pdev, mapping, RX_PKT_BUF_SZ,PCI_DMA_FROMDEVICE);
-+			dma_unmap_single(&bp->sdev->dev, mapping, RX_PKT_BUF_SZ,DMA_FROM_DEVICE);
++			dma_unmap_single(bp->sdev->dev, mapping, RX_PKT_BUF_SZ,DMA_FROM_DEVICE);
  		dev_kfree_skb_any(skb);
  		skb = __netdev_alloc_skb(bp->dev, RX_PKT_BUF_SZ, GFP_ATOMIC|GFP_DMA);
  		if (skb == NULL)
  			return -ENOMEM;
 -		mapping = pci_map_single(bp->pdev, skb->data,
-+		mapping = dma_map_single(&bp->sdev->dev, skb->data,
++		mapping = dma_map_single(bp->sdev->dev, skb->data,
  					 RX_PKT_BUF_SZ,
 -					 PCI_DMA_FROMDEVICE);
 +					 DMA_FROM_DEVICE);
@@ -409,7 +409,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  			mapping + RX_PKT_BUF_SZ > DMA_30BIT_MASK) {
  			if (!dma_mapping_error(mapping))
 -				pci_unmap_single(bp->pdev, mapping, RX_PKT_BUF_SZ,PCI_DMA_FROMDEVICE);
-+				dma_unmap_single(&bp->sdev->dev, mapping, RX_PKT_BUF_SZ,DMA_FROM_DEVICE);
++				dma_unmap_single(bp->sdev->dev, mapping, RX_PKT_BUF_SZ,DMA_FROM_DEVICE);
  			dev_kfree_skb_any(skb);
  			return -ENOMEM;
  		}
@@ -451,7 +451,7 @@ Index: linux-2.6.23/drivers/net/b44.c
 +			                    DMA_BIDIRECTIONAL);
  
 -	pci_dma_sync_single_for_device(bp->pdev, le32_to_cpu(src_desc->addr),
-+	dma_sync_single_for_device(&bp->sdev->dev, le32_to_cpu(src_desc->addr),
++	dma_sync_single_for_device(bp->sdev->dev, le32_to_cpu(src_desc->addr),
  				       RX_PKT_BUF_SZ,
 -				       PCI_DMA_FROMDEVICE);
 +				       DMA_FROM_DEVICE);
@@ -463,7 +463,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  		u16 len;
  
 -		pci_dma_sync_single_for_cpu(bp->pdev, map,
-+		dma_sync_single_for_cpu(&bp->sdev->dev, map,
++		dma_sync_single_for_cpu(bp->sdev->dev, map,
  					    RX_PKT_BUF_SZ,
 -					    PCI_DMA_FROMDEVICE);
 +					    DMA_FROM_DEVICE);
@@ -476,7 +476,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  				goto drop_it;
 -			pci_unmap_single(bp->pdev, map,
 -					 skb_size, PCI_DMA_FROMDEVICE);
-+			dma_unmap_single(&bp->sdev->dev, map,
++			dma_unmap_single(bp->sdev->dev, map,
 +					 skb_size, DMA_FROM_DEVICE);
  			/* Leave out rx_header */
                  	skb_put(skb, len + RX_PKT_OFFSET);
@@ -486,14 +486,14 @@ Index: linux-2.6.23/drivers/net/b44.c
  	}
  
 -	mapping = pci_map_single(bp->pdev, skb->data, len, PCI_DMA_TODEVICE);
-+	mapping = dma_map_single(&bp->sdev->dev, skb->data, len, DMA_TO_DEVICE);
++	mapping = dma_map_single(bp->sdev->dev, skb->data, len, DMA_TO_DEVICE);
  	if (dma_mapping_error(mapping) || mapping + len > DMA_30BIT_MASK) {
  		struct sk_buff *bounce_skb;
  
  		/* Chip can't handle DMA to/from >1GB, use bounce buffer */
  		if (!dma_mapping_error(mapping))
 -			pci_unmap_single(bp->pdev, mapping, len, PCI_DMA_TODEVICE);
-+			dma_unmap_single(&bp->sdev->dev, mapping, len, DMA_TO_DEVICE);
++			dma_unmap_single(bp->sdev->dev, mapping, len, DMA_TO_DEVICE);
  
  		bounce_skb = __dev_alloc_skb(len, GFP_ATOMIC | GFP_DMA);
  		if (!bounce_skb)
@@ -501,13 +501,13 @@ Index: linux-2.6.23/drivers/net/b44.c
  
 -		mapping = pci_map_single(bp->pdev, bounce_skb->data,
 -					 len, PCI_DMA_TODEVICE);
-+		mapping = dma_map_single(&bp->sdev->dev, bounce_skb->data,
++		mapping = dma_map_single(bp->sdev->dev, bounce_skb->data,
 +					 len, DMA_TO_DEVICE);
  		if (dma_mapping_error(mapping) || mapping + len > DMA_30BIT_MASK) {
  			if (!dma_mapping_error(mapping))
 -				pci_unmap_single(bp->pdev, mapping,
 -						 len, PCI_DMA_TODEVICE);
-+				dma_unmap_single(&bp->sdev->dev, mapping,
++				dma_unmap_single(bp->sdev->dev, mapping,
 +						 len, DMA_TO_DEVICE);
  			dev_kfree_skb_any(bounce_skb);
  			goto err_out;
@@ -530,7 +530,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  		if (rp->skb == NULL)
  			continue;
 -		pci_unmap_single(bp->pdev,
-+		dma_unmap_single(&bp->sdev->dev,
++		dma_unmap_single(bp->sdev->dev,
  				 pci_unmap_addr(rp, mapping),
  				 RX_PKT_BUF_SZ,
 -				 PCI_DMA_FROMDEVICE);
@@ -543,7 +543,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  		if (rp->skb == NULL)
  			continue;
 -		pci_unmap_single(bp->pdev,
-+		dma_unmap_single(&bp->sdev->dev,
++		dma_unmap_single(bp->sdev->dev,
  				 pci_unmap_addr(rp, mapping),
  				 rp->skb->len,
 -				 PCI_DMA_TODEVICE);
@@ -558,7 +558,7 @@ Index: linux-2.6.23/drivers/net/b44.c
 -		dma_sync_single_for_device(&bp->pdev->dev, bp->rx_ring_dma,
 -		                           DMA_TABLE_BYTES,
 -		                           PCI_DMA_BIDIRECTIONAL);
-+		dma_sync_single_for_device(&bp->sdev->dev, bp->rx_ring_dma,
++		dma_sync_single_for_device(bp->sdev->dev, bp->rx_ring_dma,
 +			                  DMA_TABLE_BYTES,
 +			                  DMA_BIDIRECTIONAL);
  
@@ -566,7 +566,7 @@ Index: linux-2.6.23/drivers/net/b44.c
 -		dma_sync_single_for_device(&bp->pdev->dev, bp->tx_ring_dma,
 -		                           DMA_TABLE_BYTES,
 -		                           PCI_DMA_TODEVICE);
-+		dma_sync_single_for_device(&bp->sdev->dev, bp->tx_ring_dma,
++		dma_sync_single_for_device(bp->sdev->dev, bp->tx_ring_dma,
 +			                  DMA_TABLE_BYTES,
 +			                  DMA_TO_DEVICE);
  
@@ -579,13 +579,13 @@ Index: linux-2.6.23/drivers/net/b44.c
 -			dma_unmap_single(&bp->pdev->dev, bp->rx_ring_dma,
 -				         DMA_TABLE_BYTES,
 -				         DMA_BIDIRECTIONAL);
-+			dma_unmap_single(&bp->sdev->dev, bp->rx_ring_dma,
++			dma_unmap_single(bp->sdev->dev, bp->rx_ring_dma,
 +					DMA_TABLE_BYTES,
 +					DMA_BIDIRECTIONAL);
  			kfree(bp->rx_ring);
  		} else
 -			pci_free_consistent(bp->pdev, DMA_TABLE_BYTES,
-+			dma_free_coherent(&bp->sdev->dev, DMA_TABLE_BYTES,
++			dma_free_coherent(bp->sdev->dev, DMA_TABLE_BYTES,
  					    bp->rx_ring, bp->rx_ring_dma);
  		bp->rx_ring = NULL;
  		bp->flags &= ~B44_FLAG_RX_RING_HACK;
@@ -595,13 +595,13 @@ Index: linux-2.6.23/drivers/net/b44.c
 -			dma_unmap_single(&bp->pdev->dev, bp->tx_ring_dma,
 -				         DMA_TABLE_BYTES,
 -				         DMA_TO_DEVICE);
-+			dma_unmap_single(&bp->sdev->dev, bp->tx_ring_dma,
++			dma_unmap_single(bp->sdev->dev, bp->tx_ring_dma,
 +					DMA_TABLE_BYTES,
 +					DMA_TO_DEVICE);
  			kfree(bp->tx_ring);
  		} else
 -			pci_free_consistent(bp->pdev, DMA_TABLE_BYTES,
-+			dma_free_coherent(&bp->sdev->dev, DMA_TABLE_BYTES,
++			dma_free_coherent(bp->sdev->dev, DMA_TABLE_BYTES,
  					    bp->tx_ring, bp->tx_ring_dma);
  		bp->tx_ring = NULL;
  		bp->flags &= ~B44_FLAG_TX_RING_HACK;
@@ -610,7 +610,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  	size = DMA_TABLE_BYTES;
 -	bp->rx_ring = pci_alloc_consistent(bp->pdev, size, &bp->rx_ring_dma);
-+	bp->rx_ring = dma_alloc_coherent(&bp->sdev->dev, size, &bp->rx_ring_dma, GFP_ATOMIC);
++	bp->rx_ring = dma_alloc_coherent(bp->sdev->dev, size, &bp->rx_ring_dma, GFP_ATOMIC);
  	if (!bp->rx_ring) {
  		/* Allocation may have failed due to pci_alloc_consistent
  		   insisting on use of GFP_DMA, which is more restrictive
@@ -621,7 +621,7 @@ Index: linux-2.6.23/drivers/net/b44.c
 -		rx_ring_dma = dma_map_single(&bp->pdev->dev, rx_ring,
 -		                             DMA_TABLE_BYTES,
 -		                             DMA_BIDIRECTIONAL);
-+		rx_ring_dma = dma_map_single(&bp->sdev->dev, rx_ring,
++		rx_ring_dma = dma_map_single(bp->sdev->dev, rx_ring,
 +			                    DMA_TABLE_BYTES,
 +			                    DMA_BIDIRECTIONAL);
  
@@ -632,7 +632,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  	}
  
 -	bp->tx_ring = pci_alloc_consistent(bp->pdev, size, &bp->tx_ring_dma);
-+	bp->tx_ring = dma_alloc_coherent(&bp->sdev->dev, size, &bp->tx_ring_dma, GFP_ATOMIC);
++	bp->tx_ring = dma_alloc_coherent(bp->sdev->dev, size, &bp->tx_ring_dma, GFP_ATOMIC);
  	if (!bp->tx_ring) {
 -		/* Allocation may have failed due to pci_alloc_consistent
 +		/* Allocation may have failed due to dma_alloc_coherent
@@ -646,7 +646,7 @@ Index: linux-2.6.23/drivers/net/b44.c
 -		tx_ring_dma = dma_map_single(&bp->pdev->dev, tx_ring,
 -		                             DMA_TABLE_BYTES,
 -		                             DMA_TO_DEVICE);
-+		tx_ring_dma = dma_map_single(&bp->sdev->dev, tx_ring,
++		tx_ring_dma = dma_map_single(bp->sdev->dev, tx_ring,
 +			                    DMA_TABLE_BYTES,
 +			                    DMA_TO_DEVICE);
  
@@ -1115,7 +1115,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  	if (!is_valid_ether_addr(&bp->dev->dev_addr[0])){
  		printk(KERN_ERR PFX "Invalid MAC address found in EEPROM\n");
-@@ -2086,26 +2282,20 @@
+@@ -2086,103 +2282,52 @@
  
  	memcpy(bp->dev->perm_addr, bp->dev->dev_addr, bp->dev->addr_len);
  
@@ -1131,7 +1131,7 @@ Index: linux-2.6.23/drivers/net/b44.c
           */
  
 - 	if (ssb_get_core_rev(bp) >= 7)
-+	if (bp->sdev->dev->id.revision >= 7)
++	if (bp->sdev->id.revision >= 7)
   		bp->flags |= B44_FLAG_B0_ANDLATER;
  
 -out:
@@ -1144,8 +1144,8 @@ Index: linux-2.6.23/drivers/net/b44.c
 +				  const struct ssb_device_id *ent)
  {
  	static int b44_version_printed = 0;
- 	unsigned long b44reg_base, b44reg_len;
-@@ -2113,76 +2303,32 @@
+-	unsigned long b44reg_base, b44reg_len;
+ 	struct net_device *dev;
  	struct b44 *bp;
  	int err, i;
  
@@ -1195,7 +1195,8 @@ Index: linux-2.6.23/drivers/net/b44.c
 -
  	dev = alloc_etherdev(sizeof(*bp));
  	if (!dev) {
- 		dev_err(&pdev->dev, "Etherdev alloc failed, aborting.\n");
+-		dev_err(&pdev->dev, "Etherdev alloc failed, aborting.\n");
++		dev_err(sdev->dev, "Etherdev alloc failed, aborting.\n");
  		err = -ENOMEM;
 -		goto err_out_free_res;
 +		goto out;
@@ -1203,7 +1204,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  	SET_MODULE_OWNER(dev);
 -	SET_NETDEV_DEV(dev,&pdev->dev);
-+	SET_NETDEV_DEV(dev,&sdev->dev);
++	SET_NETDEV_DEV(dev,sdev->dev);
  
  	/* No interesting netdevice features in this card... */
  	dev->features |= 0;
@@ -1227,7 +1228,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  	bp->rx_pending = B44_DEF_RX_RING_PENDING;
  	bp->tx_pending = B44_DEF_TX_RING_PENDING;
  
-@@ -2201,16 +2347,16 @@
+@@ -2201,16 +2346,16 @@
  	dev->poll_controller = b44_poll_controller;
  #endif
  	dev->change_mtu = b44_change_mtu;
@@ -1240,20 +1241,20 @@ Index: linux-2.6.23/drivers/net/b44.c
  	err = b44_get_invariants(bp);
  	if (err) {
 -		dev_err(&pdev->dev,
-+		dev_err(&sdev->dev,
++		dev_err(sdev->dev,
  			"Problem fetching invariants of chip, aborting.\n");
 -		goto err_out_iounmap;
 +		goto err_out_free_dev;
  	}
  
  	bp->mii_if.dev = dev;
-@@ -2229,61 +2375,52 @@
+@@ -2229,61 +2374,52 @@
  
  	err = register_netdev(dev);
  	if (err) {
 -		dev_err(&pdev->dev, "Cannot register net device, aborting.\n");
 -		goto err_out_iounmap;
-+		dev_err(&sdev->dev, "Cannot register net device, aborting.\n");
++		dev_err(sdev->dev, "Cannot register net device, aborting.\n");
 +		goto out;
  	}
  
@@ -1325,7 +1326,7 @@ Index: linux-2.6.23/drivers/net/b44.c
  
  	del_timer_sync(&bp->timer);
  
-@@ -2301,26 +2438,16 @@
+@@ -2301,33 +2437,22 @@
  		b44_init_hw(bp, B44_PARTIAL_RESET);
  		b44_setup_wol(bp);
  	}
@@ -1355,7 +1356,14 @@ Index: linux-2.6.23/drivers/net/b44.c
  	if (!netif_running(dev))
  		return 0;
  
-@@ -2346,29 +2473,31 @@
+ 	rc = request_irq(dev->irq, b44_interrupt, IRQF_SHARED, dev->name, dev);
+ 	if (rc) {
+ 		printk(KERN_ERR PFX "%s: request_irq failed\n", dev->name);
+-		pci_disable_device(pdev);
+ 		return rc;
+ 	}
+ 
+@@ -2346,29 +2471,31 @@
  	return 0;
  }
  
@@ -1395,8 +1403,8 @@ Index: linux-2.6.23/drivers/net/b44.c
  module_init(b44_init);
 Index: linux-2.6.23/drivers/net/b44.h
 ===================================================================
---- linux-2.6.23.orig/drivers/net/b44.h	2007-10-09 22:31:38.000000000 +0200
-+++ linux-2.6.23/drivers/net/b44.h	2007-10-13 02:28:25.848697310 +0200
+--- linux-2.6.23.orig/drivers/net/b44.h	2007-10-13 10:58:27.880607722 +0200
++++ linux-2.6.23/drivers/net/b44.h	2007-10-13 11:00:46.904530245 +0200
 @@ -129,6 +129,7 @@
  #define  RXCONFIG_FLOW		0x00000020 /* Flow Control Enable */
  #define  RXCONFIG_FLOW_ACCEPT	0x00000040 /* Accept Unicast Flow Control Frame */
@@ -1522,8 +1530,8 @@ Index: linux-2.6.23/drivers/net/b44.h
  	dma_addr_t		rx_ring_dma, tx_ring_dma;
 Index: linux-2.6.23/drivers/net/Kconfig
 ===================================================================
---- linux-2.6.23.orig/drivers/net/Kconfig	2007-10-13 02:19:47.919182188 +0200
-+++ linux-2.6.23/drivers/net/Kconfig	2007-10-13 02:28:25.860697993 +0200
+--- linux-2.6.23.orig/drivers/net/Kconfig	2007-10-13 10:58:27.888608180 +0200
++++ linux-2.6.23/drivers/net/Kconfig	2007-10-13 11:00:46.912530699 +0200
 @@ -1577,7 +1577,7 @@
  
  config B44
diff --git a/target/linux/brcm47xx/patches-2.6.23/150-cpu_fixes.patch b/target/linux/brcm47xx/patches-2.6.23/150-cpu_fixes.patch
index fe759dc62b..d19ba81fad 100644
--- a/target/linux/brcm47xx/patches-2.6.23/150-cpu_fixes.patch
+++ b/target/linux/brcm47xx/patches-2.6.23/150-cpu_fixes.patch
@@ -1,7 +1,7 @@
 Index: linux-2.6.23/arch/mips/kernel/genex.S
 ===================================================================
---- linux-2.6.23.orig/arch/mips/kernel/genex.S	2007-10-09 22:31:38.000000000 +0200
-+++ linux-2.6.23/arch/mips/kernel/genex.S	2007-10-13 02:47:32.546043867 +0200
+--- linux-2.6.23.orig/arch/mips/kernel/genex.S	2007-10-13 11:29:46.219648163 +0200
++++ linux-2.6.23/arch/mips/kernel/genex.S	2007-10-13 11:29:49.619841933 +0200
 @@ -51,6 +51,10 @@
  NESTED(except_vec3_generic, 0, sp)
  	.set	push
@@ -15,8 +15,8 @@ Index: linux-2.6.23/arch/mips/kernel/genex.S
  #endif
 Index: linux-2.6.23/arch/mips/mm/c-r4k.c
 ===================================================================
---- linux-2.6.23.orig/arch/mips/mm/c-r4k.c	2007-10-13 02:47:02.792348301 +0200
-+++ linux-2.6.23/arch/mips/mm/c-r4k.c	2007-10-13 02:55:35.877587360 +0200
+--- linux-2.6.23.orig/arch/mips/mm/c-r4k.c	2007-10-13 11:29:46.227648623 +0200
++++ linux-2.6.23/arch/mips/mm/c-r4k.c	2007-10-13 11:29:49.619841933 +0200
 @@ -30,6 +30,9 @@
  #include <asm/cacheflush.h> /* for run_uncached() */
  
@@ -27,19 +27,7 @@ Index: linux-2.6.23/arch/mips/mm/c-r4k.c
  /*
   * Special Variant of smp_call_function for use by cache functions:
   *
-@@ -86,14 +89,21 @@
- 
- static inline void r4k_blast_dcache_page_dc32(unsigned long addr)
- {
-+	unsigned long flags;
-+
-+	local_irq_save(flags);
- 	R4600_HIT_CACHEOP_WAR_IMPL;
- 	blast_dcache32_page(addr);
-+	local_irq_restore(flags);
- }
- 
- static void __init r4k_blast_dcache_page_setup(void)
+@@ -94,6 +97,9 @@
  {
  	unsigned long  dc_lsize = cpu_dcache_line_size();
  
@@ -49,7 +37,7 @@ Index: linux-2.6.23/arch/mips/mm/c-r4k.c
  	if (dc_lsize == 0)
  		r4k_blast_dcache_page = (void *)cache_noop;
  	else if (dc_lsize == 16)
-@@ -108,6 +118,9 @@
+@@ -108,6 +114,9 @@
  {
  	unsigned long dc_lsize = cpu_dcache_line_size();
  
@@ -59,7 +47,7 @@ Index: linux-2.6.23/arch/mips/mm/c-r4k.c
  	if (dc_lsize == 0)
  		r4k_blast_dcache_page_indexed = (void *)cache_noop;
  	else if (dc_lsize == 16)
-@@ -122,6 +135,9 @@
+@@ -122,6 +131,9 @@
  {
  	unsigned long dc_lsize = cpu_dcache_line_size();
  
@@ -69,274 +57,16 @@ Index: linux-2.6.23/arch/mips/mm/c-r4k.c
  	if (dc_lsize == 0)
  		r4k_blast_dcache = (void *)cache_noop;
  	else if (dc_lsize == 16)
-@@ -203,8 +219,12 @@
- 
- static void (* r4k_blast_icache_page)(unsigned long addr);
- 
-+static void r4k_flush_cache_all(void);
- static void __init r4k_blast_icache_page_setup(void)
- {
-+#ifdef CONFIG_BCM947XX
-+	r4k_blast_icache_page = (void *)r4k_flush_cache_all;
-+#else
- 	unsigned long ic_lsize = cpu_icache_line_size();
- 
- 	if (ic_lsize == 0)
-@@ -215,6 +235,7 @@
- 		r4k_blast_icache_page = blast_icache32_page;
- 	else if (ic_lsize == 64)
- 		r4k_blast_icache_page = blast_icache64_page;
-+#endif
- }
- 
- 
-@@ -222,6 +243,9 @@
- 
- static void __init r4k_blast_icache_page_indexed_setup(void)
- {
-+#ifdef CONFIG_BCM947XX
-+	r4k_blast_icache_page_indexed = (void *)r4k_flush_cache_all;
-+#else
- 	unsigned long ic_lsize = cpu_icache_line_size();
- 
- 	if (ic_lsize == 0)
-@@ -240,6 +264,7 @@
- 				blast_icache32_page_indexed;
- 	} else if (ic_lsize == 64)
- 		r4k_blast_icache_page_indexed = blast_icache64_page_indexed;
-+#endif
- }
- 
- static void (* r4k_blast_icache)(void);
-@@ -323,12 +348,17 @@
-  */
- static inline void local_r4k_flush_cache_all(void * args)
- {
-+	unsigned long flags;
-+
-+	local_irq_save(flags);
- 	r4k_blast_dcache();
-+	r4k_blast_icache();
-+	local_irq_restore(flags);
- }
- 
- static void r4k_flush_cache_all(void)
- {
--	if (!cpu_has_dc_aliases)
-+	if (!cpu_has_dc_aliases && cpu_use_kmap_coherent)
- 		return;
- 
- 	r4k_on_each_cpu(local_r4k_flush_cache_all, NULL, 1, 1);
-@@ -336,6 +366,9 @@
- 
- static inline void local_r4k___flush_cache_all(void * args)
- {
-+	unsigned long flags;
-+
-+	local_irq_save(flags);
- #if defined(CONFIG_CPU_LOONGSON2)
- 	r4k_blast_scache();
- 	return;
-@@ -353,6 +386,7 @@
- 	case CPU_R14000:
- 		r4k_blast_scache();
- 	}
-+	local_irq_restore(flags);
- }
- 
- static void r4k___flush_cache_all(void)
-@@ -363,17 +397,21 @@
- static inline void local_r4k_flush_cache_range(void * args)
- {
- 	struct vm_area_struct *vma = args;
-+	unsigned long flags;
- 
- 	if (!(cpu_context(smp_processor_id(), vma->vm_mm)))
- 		return;
- 
-+	local_irq_save(flags);
- 	r4k_blast_dcache();
-+	r4k_blast_icache();
-+	local_irq_restore(flags);
- }
- 
- static void r4k_flush_cache_range(struct vm_area_struct *vma,
- 	unsigned long start, unsigned long end)
- {
--	if (!cpu_has_dc_aliases)
-+	if (!cpu_has_dc_aliases && cpu_use_kmap_coherent)
- 		return;
- 
- 	r4k_on_each_cpu(local_r4k_flush_cache_range, vma, 1, 1);
-@@ -382,6 +420,7 @@
- static inline void local_r4k_flush_cache_mm(void * args)
- {
- 	struct mm_struct *mm = args;
-+	unsigned long flags;
- 
- 	if (!cpu_context(smp_processor_id(), mm))
- 		return;
-@@ -400,12 +439,15 @@
- 		return;
- 	}
- 
-+	local_irq_save(flags);
- 	r4k_blast_dcache();
-+	r4k_blast_icache();
-+	local_irq_restore(flags);
- }
- 
- static void r4k_flush_cache_mm(struct mm_struct *mm)
- {
--	if (!cpu_has_dc_aliases)
-+	if (!cpu_has_dc_aliases && cpu_use_kmap_coherent)
- 		return;
- 
- 	r4k_on_each_cpu(local_r4k_flush_cache_mm, mm, 1, 1);
-@@ -425,6 +467,7 @@
- 	unsigned long paddr = fcp_args->pfn << PAGE_SHIFT;
- 	int exec = vma->vm_flags & VM_EXEC;
- 	struct mm_struct *mm = vma->vm_mm;
-+	unsigned long flags;
- 	pgd_t *pgdp;
- 	pud_t *pudp;
- 	pmd_t *pmdp;
-@@ -456,8 +499,9 @@
- 	 * for every cache flush operation.  So we do indexed flushes
- 	 * in that case, which doesn't overly flush the cache too much.
- 	 */
-+	local_irq_save(flags);
- 	if ((mm == current->active_mm) && (pte_val(*ptep) & _PAGE_VALID)) {
--		if (cpu_has_dc_aliases || (exec && !cpu_has_ic_fills_f_dc)) {
-+		if (!cpu_use_kmap_coherent || cpu_has_dc_aliases || (exec && !cpu_has_ic_fills_f_dc)) {
- 			r4k_blast_dcache_page(addr);
- 			if (exec && !cpu_icache_snoops_remote_store)
- 				r4k_blast_scache_page(addr);
-@@ -465,14 +509,14 @@
- 		if (exec)
- 			r4k_blast_icache_page(addr);
- 
--		return;
-+		goto done;
- 	}
- 
- 	/*
- 	 * Do indexed flush, too much work to get the (possible) TLB refills
- 	 * to work correctly.
- 	 */
--	if (cpu_has_dc_aliases || (exec && !cpu_has_ic_fills_f_dc)) {
-+	if (!cpu_use_kmap_coherent || cpu_has_dc_aliases || (exec && !cpu_has_ic_fills_f_dc)) {
- 		r4k_blast_dcache_page_indexed(cpu_has_pindexed_dcache ?
- 					      paddr : addr);
- 		if (exec && !cpu_icache_snoops_remote_store) {
-@@ -488,6 +532,8 @@
- 		} else
- 			r4k_blast_icache_page_indexed(addr);
- 	}
-+done:
-+	local_irq_restore(flags);
- }
- 
- static void r4k_flush_cache_page(struct vm_area_struct *vma,
-@@ -504,7 +550,11 @@
- 
- static inline void local_r4k_flush_data_cache_page(void * addr)
- {
-+	unsigned long flags;
-+
-+	local_irq_save(flags);
- 	r4k_blast_dcache_page((unsigned long) addr);
-+	local_irq_restore(flags);
- }
- 
- static void r4k_flush_data_cache_page(unsigned long addr)
-@@ -547,6 +597,9 @@
- 
- static void r4k_flush_icache_range(unsigned long start, unsigned long end)
- {
-+#ifdef CONFIG_BCM947XX
-+	r4k_flush_cache_all();
-+#else
- 	struct flush_icache_range_args args;
- 
- 	args.start = start;
-@@ -554,12 +607,15 @@
- 
- 	r4k_on_each_cpu(local_r4k_flush_icache_range, &args, 1, 1);
- 	instruction_hazard();
-+#endif
- }
- 
- #ifdef CONFIG_DMA_NONCOHERENT
- 
- static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
- {
-+	unsigned long flags;
-+
- 	/* Catch bad driver code */
- 	BUG_ON(size == 0);
- 
-@@ -576,18 +632,21 @@
- 	 * subset property so we have to flush the primary caches
- 	 * explicitly
- 	 */
-+	local_irq_save(flags);
- 	if (size >= dcache_size) {
- 		r4k_blast_dcache();
- 	} else {
- 		R4600_HIT_CACHEOP_WAR_IMPL;
- 		blast_dcache_range(addr, addr + size);
- 	}
--
- 	bc_wback_inv(addr, size);
-+	local_irq_restore(flags);
- }
- 
- static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
- {
-+	unsigned long flags;
-+
- 	/* Catch bad driver code */
- 	BUG_ON(size == 0);
- 
-@@ -599,6 +658,7 @@
- 		return;
- 	}
- 
-+	local_irq_save(flags);
- 	if (size >= dcache_size) {
- 		r4k_blast_dcache();
- 	} else {
-@@ -607,6 +667,7 @@
- 	}
- 
- 	bc_inv(addr, size);
-+	local_irq_restore(flags);
- }
- #endif /* CONFIG_DMA_NONCOHERENT */
- 
-@@ -621,8 +682,12 @@
- 	unsigned long dc_lsize = cpu_dcache_line_size();
- 	unsigned long sc_lsize = cpu_scache_line_size();
+@@ -623,6 +635,8 @@
  	unsigned long addr = (unsigned long) arg;
-+	unsigned long flags;
  
-+	local_irq_save(flags);
  	R4600_HIT_CACHEOP_WAR_IMPL;
 +	BCM4710_PROTECTED_FILL_TLB(addr);
 +	BCM4710_PROTECTED_FILL_TLB(addr + 4);
  	if (dc_lsize)
  		protected_writeback_dcache_line(addr & ~(dc_lsize - 1));
  	if (!cpu_icache_snoops_remote_store && scache_size)
-@@ -649,6 +714,7 @@
- 	}
- 	if (MIPS_CACHE_SYNC_WAR)
- 		__asm__ __volatile__ ("sync");
-+	local_irq_restore(flags);
- }
- 
- static void r4k_flush_cache_sigtramp(unsigned long addr)
-@@ -1198,6 +1264,17 @@
+@@ -1198,6 +1212,17 @@
  	 * silly idea of putting something else there ...
  	 */
  	switch (current_cpu_data.cputype) {
@@ -354,7 +84,7 @@ Index: linux-2.6.23/arch/mips/mm/c-r4k.c
  	case CPU_R4000PC:
  	case CPU_R4000SC:
  	case CPU_R4000MC:
-@@ -1228,6 +1305,15 @@
+@@ -1228,6 +1253,15 @@
  	/* Default cache error handler for R4000 and R5000 family */
  	set_uncached_handler (0x100, &except_vec2_generic, 0x80);
  
@@ -370,7 +100,7 @@ Index: linux-2.6.23/arch/mips/mm/c-r4k.c
  	probe_pcache();
  	setup_scache();
  
-@@ -1273,5 +1359,13 @@
+@@ -1273,5 +1307,13 @@
  	build_clear_page();
  	build_copy_page();
  	local_r4k___flush_cache_all(NULL);
@@ -386,44 +116,32 @@ Index: linux-2.6.23/arch/mips/mm/c-r4k.c
  }
 Index: linux-2.6.23/arch/mips/mm/tlbex.c
 ===================================================================
---- linux-2.6.23.orig/arch/mips/mm/tlbex.c	2007-10-13 02:26:00.272401391 +0200
-+++ linux-2.6.23/arch/mips/mm/tlbex.c	2007-10-13 02:47:32.550044103 +0200
-@@ -1247,6 +1247,10 @@
- #endif
- }
- 
-+#ifdef CONFIG_BCM947XX
-+extern int bcm4710;
-+#endif
-+
- static void __init build_r4000_tlb_refill_handler(void)
- {
- 	u32 *p = tlb_handler;
-@@ -1261,6 +1265,10 @@
- 	memset(relocs, 0, sizeof(relocs));
- 	memset(final_handler, 0, sizeof(final_handler));
+--- linux-2.6.23.orig/arch/mips/mm/tlbex.c	2007-10-13 11:29:46.235649074 +0200
++++ linux-2.6.23/arch/mips/mm/tlbex.c	2007-10-13 11:35:46.076155216 +0200
+@@ -1273,6 +1273,9 @@
+ 		/* No need for i_nop */
+ 	}
  
 +#ifdef CONFIG_BCM947XX
 +	i_nop(&p);
 +#endif
-+
- 	/*
- 	 * create the plain linear handler
- 	 */
-@@ -1756,6 +1764,9 @@
- 	memset(labels, 0, sizeof(labels));
- 	memset(relocs, 0, sizeof(relocs));
- 
+ #ifdef CONFIG_64BIT
+ 	build_get_pmde64(&p, &l, &r, K0, K1); /* get pmd in K1 */
+ #else
+@@ -1708,6 +1711,9 @@
+ 				   struct reloc **r, unsigned int pte,
+ 				   unsigned int ptr)
+ {
 +#ifdef CONFIG_BCM947XX
-+	i_nop(&p);
++	i_nop(p);
 +#endif
- 	if (bcm1250_m3_war()) {
- 		i_MFC0(&p, K0, C0_BADVADDR);
- 		i_MFC0(&p, K1, C0_ENTRYHI);
+ #ifdef CONFIG_64BIT
+ 	build_get_pmde64(p, l, r, pte, ptr); /* get pmd in ptr */
+ #else
 Index: linux-2.6.23/include/asm-mips/r4kcache.h
 ===================================================================
---- linux-2.6.23.orig/include/asm-mips/r4kcache.h	2007-10-09 22:31:38.000000000 +0200
-+++ linux-2.6.23/include/asm-mips/r4kcache.h	2007-10-13 02:47:32.554044332 +0200
+--- linux-2.6.23.orig/include/asm-mips/r4kcache.h	2007-10-13 11:29:46.255650214 +0200
++++ linux-2.6.23/include/asm-mips/r4kcache.h	2007-10-13 11:29:49.631842613 +0200
 @@ -17,6 +17,20 @@
  #include <asm/cpu-features.h>
  #include <asm/mipsmtregs.h>
@@ -628,8 +346,8 @@ Index: linux-2.6.23/include/asm-mips/r4kcache.h
  #endif /* _ASM_R4KCACHE_H */
 Index: linux-2.6.23/include/asm-mips/stackframe.h
 ===================================================================
---- linux-2.6.23.orig/include/asm-mips/stackframe.h	2007-10-09 22:31:38.000000000 +0200
-+++ linux-2.6.23/include/asm-mips/stackframe.h	2007-10-13 02:47:32.554044332 +0200
+--- linux-2.6.23.orig/include/asm-mips/stackframe.h	2007-10-13 11:29:46.263650671 +0200
++++ linux-2.6.23/include/asm-mips/stackframe.h	2007-10-13 11:33:38.504885346 +0200
 @@ -350,6 +350,10 @@
  		.macro	RESTORE_SP_AND_RET
  		LONG_L	sp, PT_R29(sp)
diff --git a/target/linux/brcm47xx/patches-2.6.23/200-b44_ssb_fixup.patch b/target/linux/brcm47xx/patches-2.6.23/200-b44_ssb_fixup.patch
deleted file mode 100644
index e0456c6d8a..0000000000
--- a/target/linux/brcm47xx/patches-2.6.23/200-b44_ssb_fixup.patch
+++ /dev/null
@@ -1,274 +0,0 @@
-Index: linux-2.6.23/drivers/net/b44.c
-===================================================================
---- linux-2.6.23.orig/drivers/net/b44.c	2007-10-13 02:46:38.946989430 +0200
-+++ linux-2.6.23/drivers/net/b44.c	2007-10-13 03:15:34.889915180 +0200
-@@ -129,7 +129,7 @@
- 	                                       unsigned long offset,
- 	                                       enum dma_data_direction dir)
- {
--	dma_sync_single_range_for_device(&sdev->dev, dma_base,
-+	dma_sync_single_range_for_device(sdev->dev, dma_base,
- 		                        offset & dma_desc_align_mask,
- 		                        dma_desc_sync_size, dir);
- }
-@@ -139,7 +139,7 @@
- 	                                    unsigned long offset,
- 	                                    enum dma_data_direction dir)
- {
--	dma_sync_single_range_for_cpu(&sdev->dev, dma_base,
-+	dma_sync_single_range_for_cpu(sdev->dev, dma_base,
- 		                     offset & dma_desc_align_mask,
- 		                     dma_desc_sync_size, dir);
- }
-@@ -563,7 +563,7 @@
- 
- 		BUG_ON(skb == NULL);
- 
--		dma_unmap_single(&bp->sdev->dev,
-+		dma_unmap_single(bp->sdev->dev,
- 				 pci_unmap_addr(rp, mapping),
- 				 skb->len,
- 				 DMA_TO_DEVICE);
-@@ -603,7 +603,7 @@
- 	if (skb == NULL)
- 		return -ENOMEM;
- 
--	mapping = dma_map_single(&bp->sdev->dev, skb->data,
-+	mapping = dma_map_single(bp->sdev->dev, skb->data,
- 				 RX_PKT_BUF_SZ,
- 				 DMA_FROM_DEVICE);
- 
-@@ -613,18 +613,18 @@
- 		mapping + RX_PKT_BUF_SZ > DMA_30BIT_MASK) {
- 		/* Sigh... */
- 		if (!dma_mapping_error(mapping))
--			dma_unmap_single(&bp->sdev->dev, mapping, RX_PKT_BUF_SZ,DMA_FROM_DEVICE);
-+			dma_unmap_single(bp->sdev->dev, mapping, RX_PKT_BUF_SZ,DMA_FROM_DEVICE);
- 		dev_kfree_skb_any(skb);
- 		skb = __netdev_alloc_skb(bp->dev, RX_PKT_BUF_SZ, GFP_ATOMIC|GFP_DMA);
- 		if (skb == NULL)
- 			return -ENOMEM;
--		mapping = dma_map_single(&bp->sdev->dev, skb->data,
-+		mapping = dma_map_single(bp->sdev->dev, skb->data,
- 					 RX_PKT_BUF_SZ,
- 					 DMA_FROM_DEVICE);
- 		if (dma_mapping_error(mapping) ||
- 			mapping + RX_PKT_BUF_SZ > DMA_30BIT_MASK) {
- 			if (!dma_mapping_error(mapping))
--				dma_unmap_single(&bp->sdev->dev, mapping, RX_PKT_BUF_SZ,DMA_FROM_DEVICE);
-+				dma_unmap_single(bp->sdev->dev, mapping, RX_PKT_BUF_SZ,DMA_FROM_DEVICE);
- 			dev_kfree_skb_any(skb);
- 			return -ENOMEM;
- 		}
-@@ -700,7 +700,7 @@
- 			                    dest_idx * sizeof(dest_desc),
- 			                    DMA_BIDIRECTIONAL);
- 
--	dma_sync_single_for_device(&bp->sdev->dev, le32_to_cpu(src_desc->addr),
-+	dma_sync_single_for_device(bp->sdev->dev, le32_to_cpu(src_desc->addr),
- 				       RX_PKT_BUF_SZ,
- 				       DMA_FROM_DEVICE);
- }
-@@ -722,7 +722,7 @@
- 		struct rx_header *rh;
- 		u16 len;
- 
--		dma_sync_single_for_cpu(&bp->sdev->dev, map,
-+		dma_sync_single_for_cpu(bp->sdev->dev, map,
- 					    RX_PKT_BUF_SZ,
- 					    DMA_FROM_DEVICE);
- 		rh = (struct rx_header *) skb->data;
-@@ -756,7 +756,7 @@
- 			skb_size = b44_alloc_rx_skb(bp, cons, bp->rx_prod);
- 			if (skb_size < 0)
- 				goto drop_it;
--			dma_unmap_single(&bp->sdev->dev, map,
-+			dma_unmap_single(bp->sdev->dev, map,
- 					 skb_size, DMA_FROM_DEVICE);
- 			/* Leave out rx_header */
-                 	skb_put(skb, len + RX_PKT_OFFSET);
-@@ -928,23 +928,23 @@
- 		goto err_out;
- 	}
- 
--	mapping = dma_map_single(&bp->sdev->dev, skb->data, len, DMA_TO_DEVICE);
-+	mapping = dma_map_single(bp->sdev->dev, skb->data, len, DMA_TO_DEVICE);
- 	if (dma_mapping_error(mapping) || mapping + len > DMA_30BIT_MASK) {
- 		struct sk_buff *bounce_skb;
- 
- 		/* Chip can't handle DMA to/from >1GB, use bounce buffer */
- 		if (!dma_mapping_error(mapping))
--			dma_unmap_single(&bp->sdev->dev, mapping, len, DMA_TO_DEVICE);
-+			dma_unmap_single(bp->sdev->dev, mapping, len, DMA_TO_DEVICE);
- 
- 		bounce_skb = __dev_alloc_skb(len, GFP_ATOMIC | GFP_DMA);
- 		if (!bounce_skb)
- 			goto err_out;
- 
--		mapping = dma_map_single(&bp->sdev->dev, bounce_skb->data,
-+		mapping = dma_map_single(bp->sdev->dev, bounce_skb->data,
- 					 len, DMA_TO_DEVICE);
- 		if (dma_mapping_error(mapping) || mapping + len > DMA_30BIT_MASK) {
- 			if (!dma_mapping_error(mapping))
--				dma_unmap_single(&bp->sdev->dev, mapping,
-+				dma_unmap_single(bp->sdev->dev, mapping,
- 						 len, DMA_TO_DEVICE);
- 			dev_kfree_skb_any(bounce_skb);
- 			goto err_out;
-@@ -1043,7 +1043,7 @@
- 
- 		if (rp->skb == NULL)
- 			continue;
--		dma_unmap_single(&bp->sdev->dev,
-+		dma_unmap_single(bp->sdev->dev,
- 				 pci_unmap_addr(rp, mapping),
- 				 RX_PKT_BUF_SZ,
- 				 DMA_FROM_DEVICE);
-@@ -1057,7 +1057,7 @@
- 
- 		if (rp->skb == NULL)
- 			continue;
--		dma_unmap_single(&bp->sdev->dev,
-+		dma_unmap_single(bp->sdev->dev,
- 				 pci_unmap_addr(rp, mapping),
- 				 rp->skb->len,
- 				 DMA_TO_DEVICE);
-@@ -1082,12 +1082,12 @@
- 	memset(bp->tx_ring, 0, B44_TX_RING_BYTES);
- 
- 	if (bp->flags & B44_FLAG_RX_RING_HACK)
--		dma_sync_single_for_device(&bp->sdev->dev, bp->rx_ring_dma,
-+		dma_sync_single_for_device(bp->sdev->dev, bp->rx_ring_dma,
- 			                  DMA_TABLE_BYTES,
- 			                  DMA_BIDIRECTIONAL);
- 
- 	if (bp->flags & B44_FLAG_TX_RING_HACK)
--		dma_sync_single_for_device(&bp->sdev->dev, bp->tx_ring_dma,
-+		dma_sync_single_for_device(bp->sdev->dev, bp->tx_ring_dma,
- 			                  DMA_TABLE_BYTES,
- 			                  DMA_TO_DEVICE);
- 
-@@ -1109,24 +1109,24 @@
- 	bp->tx_buffers = NULL;
- 	if (bp->rx_ring) {
- 		if (bp->flags & B44_FLAG_RX_RING_HACK) {
--			dma_unmap_single(&bp->sdev->dev, bp->rx_ring_dma,
-+			dma_unmap_single(bp->sdev->dev, bp->rx_ring_dma,
- 					DMA_TABLE_BYTES,
- 					DMA_BIDIRECTIONAL);
- 			kfree(bp->rx_ring);
- 		} else
--			dma_free_coherent(&bp->sdev->dev, DMA_TABLE_BYTES,
-+			dma_free_coherent(bp->sdev->dev, DMA_TABLE_BYTES,
- 					    bp->rx_ring, bp->rx_ring_dma);
- 		bp->rx_ring = NULL;
- 		bp->flags &= ~B44_FLAG_RX_RING_HACK;
- 	}
- 	if (bp->tx_ring) {
- 		if (bp->flags & B44_FLAG_TX_RING_HACK) {
--			dma_unmap_single(&bp->sdev->dev, bp->tx_ring_dma,
-+			dma_unmap_single(bp->sdev->dev, bp->tx_ring_dma,
- 					DMA_TABLE_BYTES,
- 					DMA_TO_DEVICE);
- 			kfree(bp->tx_ring);
- 		} else
--			dma_free_coherent(&bp->sdev->dev, DMA_TABLE_BYTES,
-+			dma_free_coherent(bp->sdev->dev, DMA_TABLE_BYTES,
- 					    bp->tx_ring, bp->tx_ring_dma);
- 		bp->tx_ring = NULL;
- 		bp->flags &= ~B44_FLAG_TX_RING_HACK;
-@@ -1152,7 +1152,7 @@
- 		goto out_err;
- 
- 	size = DMA_TABLE_BYTES;
--	bp->rx_ring = dma_alloc_coherent(&bp->sdev->dev, size, &bp->rx_ring_dma, GFP_ATOMIC);
-+	bp->rx_ring = dma_alloc_coherent(bp->sdev->dev, size, &bp->rx_ring_dma, GFP_ATOMIC);
- 	if (!bp->rx_ring) {
- 		/* Allocation may have failed due to pci_alloc_consistent
- 		   insisting on use of GFP_DMA, which is more restrictive
-@@ -1164,7 +1164,7 @@
- 		if (!rx_ring)
- 			goto out_err;
- 
--		rx_ring_dma = dma_map_single(&bp->sdev->dev, rx_ring,
-+		rx_ring_dma = dma_map_single(bp->sdev->dev, rx_ring,
- 			                    DMA_TABLE_BYTES,
- 			                    DMA_BIDIRECTIONAL);
- 
-@@ -1179,7 +1179,7 @@
- 		bp->flags |= B44_FLAG_RX_RING_HACK;
- 	}
- 
--	bp->tx_ring = dma_alloc_coherent(&bp->sdev->dev, size, &bp->tx_ring_dma, GFP_ATOMIC);
-+	bp->tx_ring = dma_alloc_coherent(bp->sdev->dev, size, &bp->tx_ring_dma, GFP_ATOMIC);
- 	if (!bp->tx_ring) {
- 		/* Allocation may have failed due to dma_alloc_coherent
- 		   insisting on use of GFP_DMA, which is more restrictive
-@@ -1191,7 +1191,7 @@
- 		if (!tx_ring)
- 			goto out_err;
- 
--		tx_ring_dma = dma_map_single(&bp->sdev->dev, tx_ring,
-+		tx_ring_dma = dma_map_single(bp->sdev->dev, tx_ring,
- 			                    DMA_TABLE_BYTES,
- 			                    DMA_TO_DEVICE);
- 
-@@ -2288,7 +2288,7 @@
- 	   bp->flags |= B44_FLAG_BUGGY_TXPTR;
-          */
- 
--	if (bp->sdev->dev->id.revision >= 7)
-+	if (bp->sdev->id.revision >= 7)
-  		bp->flags |= B44_FLAG_B0_ANDLATER;
- 
- 	return err;
-@@ -2298,7 +2298,6 @@
- 				  const struct ssb_device_id *ent)
- {
- 	static int b44_version_printed = 0;
--	unsigned long b44reg_base, b44reg_len;
- 	struct net_device *dev;
- 	struct b44 *bp;
- 	int err, i;
-@@ -2310,13 +2309,13 @@
- 
- 	dev = alloc_etherdev(sizeof(*bp));
- 	if (!dev) {
--		dev_err(&pdev->dev, "Etherdev alloc failed, aborting.\n");
-+		dev_err(sdev->dev, "Etherdev alloc failed, aborting.\n");
- 		err = -ENOMEM;
- 		goto out;
- 	}
- 
- 	SET_MODULE_OWNER(dev);
--	SET_NETDEV_DEV(dev,&sdev->dev);
-+	SET_NETDEV_DEV(dev,sdev->dev);
- 
- 	/* No interesting netdevice features in this card... */
- 	dev->features |= 0;
-@@ -2354,7 +2353,7 @@
- 
- 	err = b44_get_invariants(bp);
- 	if (err) {
--		dev_err(&sdev->dev,
-+		dev_err(sdev->dev,
- 			"Problem fetching invariants of chip, aborting.\n");
- 		goto err_out_free_dev;
- 	}
-@@ -2375,7 +2374,7 @@
- 
- 	err = register_netdev(dev);
- 	if (err) {
--		dev_err(&sdev->dev, "Cannot register net device, aborting.\n");
-+		dev_err(sdev->dev, "Cannot register net device, aborting.\n");
- 		goto out;
- 	}
- 
-@@ -2454,7 +2453,6 @@
- 	rc = request_irq(dev->irq, b44_interrupt, IRQF_SHARED, dev->name, dev);
- 	if (rc) {
- 		printk(KERN_ERR PFX "%s: request_irq failed\n", dev->name);
--		pci_disable_device(pdev);
- 		return rc;
- 	}
- 
diff --git a/target/linux/brcm47xx/patches-2.6.23/300-fork_cacheflush.patch b/target/linux/brcm47xx/patches-2.6.23/300-fork_cacheflush.patch
new file mode 100644
index 0000000000..1620bf48ad
--- /dev/null
+++ b/target/linux/brcm47xx/patches-2.6.23/300-fork_cacheflush.patch
@@ -0,0 +1,13 @@
+Index: linux-2.6.23/include/asm-mips/cacheflush.h
+===================================================================
+--- linux-2.6.23.orig/include/asm-mips/cacheflush.h	2007-10-13 11:01:52.780284289 +0200
++++ linux-2.6.23/include/asm-mips/cacheflush.h	2007-10-13 11:02:16.289624011 +0200
+@@ -32,7 +32,7 @@
+ extern void (*flush_cache_all)(void);
+ extern void (*__flush_cache_all)(void);
+ extern void (*flush_cache_mm)(struct mm_struct *mm);
+-#define flush_cache_dup_mm(mm)	do { (void) (mm); } while (0)
++#define flush_cache_dup_mm(mm) flush_cache_mm(mm)
+ extern void (*flush_cache_range)(struct vm_area_struct *vma,
+ 	unsigned long start, unsigned long end);
+ extern void (*flush_cache_page)(struct vm_area_struct *vma, unsigned long page, unsigned long pfn);
diff --git a/target/linux/brcm47xx/patches-2.6.23/310-no_highpage.patch b/target/linux/brcm47xx/patches-2.6.23/310-no_highpage.patch
new file mode 100644
index 0000000000..16e7e3f36c
--- /dev/null
+++ b/target/linux/brcm47xx/patches-2.6.23/310-no_highpage.patch
@@ -0,0 +1,71 @@
+Index: linux-2.6.23/arch/mips/mm/init.c
+===================================================================
+--- linux-2.6.23.orig/arch/mips/mm/init.c	2007-10-13 11:46:58.762489429 +0200
++++ linux-2.6.23/arch/mips/mm/init.c	2007-10-13 11:47:36.092616749 +0200
+@@ -205,31 +205,6 @@
+ 	preempt_check_resched();
+ }
+ 
+-void copy_user_highpage(struct page *to, struct page *from,
+-	unsigned long vaddr, struct vm_area_struct *vma)
+-{
+-	void *vfrom, *vto;
+-
+-	vto = kmap_atomic(to, KM_USER1);
+-	if (cpu_has_dc_aliases && cpu_use_kmap_coherent && !Page_dcache_dirty(from)) {
+-		vfrom = kmap_coherent(from, vaddr);
+-		copy_page(vto, vfrom);
+-		kunmap_coherent();
+-	} else {
+-		vfrom = kmap_atomic(from, KM_USER0);
+-		copy_page(vto, vfrom);
+-		kunmap_atomic(vfrom, KM_USER0);
+-	}
+-	if (((vma->vm_flags & VM_EXEC) && !cpu_has_ic_fills_f_dc) ||
+-	    pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK))
+-		flush_data_cache_page((unsigned long)vto);
+-	kunmap_atomic(vto, KM_USER1);
+-	/* Make sure this page is cleared on other CPU's too before using it */
+-	smp_wmb();
+-}
+-
+-EXPORT_SYMBOL(copy_user_highpage);
+-
+ void copy_to_user_page(struct vm_area_struct *vma,
+ 	struct page *page, unsigned long vaddr, void *dst, const void *src,
+ 	unsigned long len)
+Index: linux-2.6.23/include/asm-mips/page.h
+===================================================================
+--- linux-2.6.23.orig/include/asm-mips/page.h	2007-10-13 11:45:50.518600430 +0200
++++ linux-2.6.23/include/asm-mips/page.h	2007-10-13 11:47:26.472068504 +0200
+@@ -35,6 +35,7 @@
+ #ifndef __ASSEMBLY__
+ 
+ #include <linux/pfn.h>
++#include <asm/cpu-features.h>
+ #include <asm/io.h>
+ 
+ /*
+@@ -67,13 +68,16 @@
+ 		flush_data_cache_page((unsigned long)addr);
+ }
+ 
+-extern void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
+-	struct page *to);
+-struct vm_area_struct;
+-extern void copy_user_highpage(struct page *to, struct page *from,
+-	unsigned long vaddr, struct vm_area_struct *vma);
++static inline void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
++	struct page *to)
++{
++	extern void (*flush_data_cache_page)(unsigned long addr);
+ 
+-#define __HAVE_ARCH_COPY_USER_HIGHPAGE
++	copy_page(vto, vfrom);
++	if (!cpu_has_ic_fills_f_dc ||
++	    pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK))
++		flush_data_cache_page((unsigned long)vto);
++}
+ 
+ /*
+  * These are used to make use of C type-checking..