path: root/target/linux/linux-2.6/patches/brcm/001-bcm947xx.patch

diff -Nur linux-2.6.12.5/arch/mips/Kconfig linux-2.6.12.5-brcm/arch/mips/Kconfig
--- linux-2.6.12.5/arch/mips/Kconfig	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/arch/mips/Kconfig	2005-08-28 16:21:04.700803432 +0200
@@ -40,6 +40,15 @@
 	 Members include the Acer PICA, MIPS Magnum 4000, MIPS Millenium and
 	 Olivetti M700-10 workstations.
 
+config BCM947XX
+	bool "Support for BCM947xx based boards"
+	select DMA_NONCOHERENT
+	select HW_HAS_PCI
+	select IRQ_CPU
+	select CPU_LITTLE_ENDIAN
+	help
+	 Support for BCM947xx based boards
+	 
 config ACER_PICA_61
 	bool "Support for Acer PICA 1 chipset (EXPERIMENTAL)"
 	depends on MACH_JAZZ && EXPERIMENTAL
@@ -974,7 +983,7 @@
 
 config CPU_LITTLE_ENDIAN
 	bool "Generate little endian code"
-	default y if ACER_PICA_61 || CASIO_E55 || DDB5074 || DDB5476 || DDB5477 || MACH_DECSTATION || IBM_WORKPAD || LASAT || MIPS_COBALT || MIPS_ITE8172 || MIPS_IVR || SOC_AU1X00 || NEC_OSPREY || OLIVETTI_M700 || SNI_RM200_PCI || VICTOR_MPC30X || ZAO_CAPCELLA
+	default y if ACER_PICA_61 || CASIO_E55 || DDB5074 || DDB5476 || DDB5477 || MACH_DECSTATION || IBM_WORKPAD || LASAT || MIPS_COBALT || MIPS_ITE8172 || MIPS_IVR || SOC_AU1X00 || NEC_OSPREY || OLIVETTI_M700 || SNI_RM200_PCI || VICTOR_MPC30X || ZAO_CAPCELLA || BCM47XX
 	default n if MIPS_EV64120 || MIPS_EV96100 || MOMENCO_OCELOT || MOMENCO_OCELOT_G || SGI_IP22 || SGI_IP27 || SGI_IP32 || TOSHIBA_JMR3927
 	help
 	  Some MIPS machines can be configured for either little or big endian
diff -Nur linux-2.6.12.5/arch/mips/Makefile linux-2.6.12.5-brcm/arch/mips/Makefile
--- linux-2.6.12.5/arch/mips/Makefile	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/arch/mips/Makefile	2005-08-28 16:39:59.077334424 +0200
@@ -79,7 +79,7 @@
 cflags-y			+= -I $(TOPDIR)/include/asm/gcc
 cflags-y			+= -G 0 -mno-abicalls -fno-pic -pipe
 cflags-y			+= $(call cc-option, -finline-limit=100000)
-LDFLAGS_vmlinux			+= -G 0 -static -n
+LDFLAGS_vmlinux			+= -G 0 -static -n -nostdlib
 MODFLAGS			+= -mlong-calls
 
 cflags-$(CONFIG_SB1XXX_CORELIS)	+= -mno-sched-prolog -fno-omit-frame-pointer
@@ -167,9 +167,10 @@
 			$(call set_gccflags,r4600,mips3,r4600,mips3,mips2)  \
 			-Wa,--trap
 
-cflags-$(CONFIG_CPU_MIPS32)	+= \
-			$(call set_gccflags,mips32,mips32,r4600,mips3,mips2) \
-			-Wa,--trap
+#cflags-$(CONFIG_CPU_MIPS32)	+= \
+#			$(call set_gccflags,mips32,mips32,r4600,mips3,mips2) \
+#			-Wa,--trap
+cflags-$(CONFIG_CPU_MIPS32)	+= -mips2 -Wa,--trap
 
 cflags-$(CONFIG_CPU_MIPS64)	+= \
 			$(call set_gccflags,mips64,mips64,r4600,mips3,mips2) \
@@ -618,6 +619,14 @@
 load-$(CONFIG_SIBYTE_SWARM)	:= 0xffffffff80100000
 
 #
+# Broadcom BCM47XX boards
+#
+core-$(CONFIG_BCM947XX)		+= arch/mips/bcm947xx/ arch/mips/bcm947xx/broadcom/
+cflags-$(CONFIG_BCM947XX)	+= -Iarch/mips/bcm947xx/include
+load-$(CONFIG_BCM947XX)		:= 0xffffffff80001000
+
+
+#
 # SNI RM200 PCI
 #
 core-$(CONFIG_SNI_RM200_PCI)	+= arch/mips/sni/
@@ -729,6 +738,7 @@
 archclean:
 	@$(MAKE) $(clean)=arch/mips/boot
 	@$(MAKE) $(clean)=arch/mips/lasat
+	@$(MAKE) -C arch/mips/bcm47xx/compressed clean
 
 # Generate <asm/offset.h 
 #
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/Makefile linux-2.6.12.5-brcm/arch/mips/bcm947xx/Makefile
--- linux-2.6.12.5/arch/mips/bcm947xx/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/Makefile	2005-08-28 11:12:20.406862800 +0200
@@ -0,0 +1,6 @@
+#
+# Makefile for the BCM47xx specific kernel interface routines
+# under Linux.
+#
+
+obj-y := irq.o int-handler.o prom.o setup.o time.o
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/broadcom/Makefile linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/Makefile
--- linux-2.6.12.5/arch/mips/bcm947xx/broadcom/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/Makefile	2005-08-28 11:12:20.407862648 +0200
@@ -0,0 +1,6 @@
+#
+# Makefile for the BCM47xx specific kernel interface routines
+# under Linux.
+#
+
+obj-y   := sbutils.o linux_osl.o bcmsrom.o bcmutils.o sbmips.o sbpci.o hnddma.o
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/broadcom/bcmsrom.c linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/bcmsrom.c
--- linux-2.6.12.5/arch/mips/bcm947xx/broadcom/bcmsrom.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/bcmsrom.c	2005-08-28 11:12:20.408862496 +0200
@@ -0,0 +1,685 @@
+/*
+ *  Misc useful routines to access NIC SROM
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <bcmsrom.h>
+#include <bcmdevs.h>
+#include <bcmendian.h>
+#include <sbpcmcia.h>
+#include <pcicfg.h>
+
+#include <proto/ethernet.h>	/* for sprom content groking */
+
+#define	VARS_MAX	4096	/* should be reduced */
+
+static int initvars_srom_pci(void *curmap, char **vars, int *count);
+static int initvars_cis_pcmcia(void *osh, char **vars, int *count);
+static int sprom_cmd_pcmcia(void *osh, uint8 cmd);
+static int sprom_read_pcmcia(void *osh, uint16 addr, uint16 *data);
+static int sprom_write_pcmcia(void *osh, uint16 addr, uint16 data);
+static int sprom_read_pci(uint16 *sprom, uint byteoff, uint16 *buf, uint nbytes, bool check_crc);
+
+/*
+ * Initialize the vars from the right source for this platform.
+ * Return 0 on success, nonzero on error.
+ */
+int
+srom_var_init(uint bus, void *curmap, void *osh, char **vars, int *count)
+{
+	if (vars == NULL)
+		return (0);
+
+	switch (bus) {
+	case SB_BUS:
+		/* These two could be asserts ... */
+		*vars = NULL;
+		*count = 0;
+		return(0);
+
+	case PCI_BUS:
+		ASSERT(curmap);	/* can not be NULL */
+		return(initvars_srom_pci(curmap, vars, count));
+
+	case PCMCIA_BUS:
+		return(initvars_cis_pcmcia(osh, vars, count));
+
+
+	default:
+		ASSERT(0);
+	}
+	return (-1);
+}
+
+
+/* support only 16-bit word read from srom */
+int
+srom_read(uint bus, void *curmap, void *osh, uint byteoff, uint nbytes, uint16 *buf)
+{
+	void *srom;
+	uint i, off, nw;
+
+	/* check input - 16-bit access only */
+	if (byteoff & 1 || nbytes & 1 || (byteoff + nbytes) > (SPROM_SIZE * 2))
+		return 1;
+
+	if (bus == PCI_BUS) {
+		if (!curmap)
+			return 1;
+		srom = (void *)((uint)curmap + PCI_BAR0_SPROM_OFFSET);
+		if (sprom_read_pci(srom, byteoff, buf, nbytes, FALSE))
+			return 1;
+	} else if (bus == PCMCIA_BUS) {
+		off = byteoff / 2;
+		nw = nbytes / 2;
+		for (i = 0; i < nw; i++) {
+			if (sprom_read_pcmcia(osh, (uint16)(off + i), (uint16*)(buf + i)))
+				return 1;
+		}
+	} else {
+		return 1;
+	}
+
+	return 0;
+}
+
+/* support only 16-bit word write into srom */
+int
+srom_write(uint bus, void *curmap, void *osh, uint byteoff, uint nbytes, uint16 *buf)
+{
+	uint16 *srom;
+	uint i, off, nw, crc_range;
+	uint16 image[SPROM_SIZE], *p;
+	uint8 crc;
+	volatile uint32 val32;
+
+	/* check input - 16-bit access only */
+	if (byteoff & 1 || nbytes & 1 || (byteoff + nbytes) > (SPROM_SIZE * 2))
+		return 1;
+
+	crc_range = ((bus == PCMCIA_BUS) ? SPROM_SIZE : SPROM_CRC_RANGE) * 2;
+
+	/* if changes made inside crc cover range */
+	if (byteoff < crc_range) {
+		nw = (((byteoff + nbytes) > crc_range) ? byteoff + nbytes : crc_range) / 2;
+		/* read data including entire first 64 words from srom */
+		if (srom_read(bus, curmap, osh, 0, nw * 2, image))
+			return 1;
+		/* make changes */
+		bcopy((void*)buf, (void*)&image[byteoff / 2], nbytes);
+		/* calculate crc */
+		htol16_buf(image, crc_range);
+		crc = ~crc8((uint8 *)image, crc_range - 1, CRC8_INIT_VALUE);
+		ltoh16_buf(image, crc_range);
+		image[(crc_range / 2) - 1] = (crc << 8) | (image[(crc_range / 2) - 1] & 0xff);
+		p = image;
+		off = 0;
+	} else {
+		p = buf;
+		off = byteoff / 2;
+		nw = nbytes / 2;
+	}
+
+	if (bus == PCI_BUS) {
+		srom = (uint16*)((uint)curmap + PCI_BAR0_SPROM_OFFSET);
+		/* enable writes to the SPROM */
+		val32 = OSL_PCI_READ_CONFIG(osh, PCI_SPROM_CONTROL, sizeof(uint32));
+		val32 |= SPROM_WRITEEN;
+		OSL_PCI_WRITE_CONFIG(osh, PCI_SPROM_CONTROL, sizeof(uint32), val32);
+		bcm_mdelay(500);
+		/* write srom */
+		for (i = 0; i < nw; i++) {
+			W_REG(&srom[off + i], p[i]);
+			bcm_mdelay(20);
+		}
+		/* disable writes to the SPROM */
+		OSL_PCI_WRITE_CONFIG(osh, PCI_SPROM_CONTROL, sizeof(uint32), val32 & ~SPROM_WRITEEN);
+	} else if (bus == PCMCIA_BUS) {
+		/* enable writes to the SPROM */
+		if (sprom_cmd_pcmcia(osh, SROM_WEN))
+			return 1;
+		bcm_mdelay(500);
+		/* write srom */
+		for (i = 0; i < nw; i++) {
+			sprom_write_pcmcia(osh, (uint16)(off + i), p[i]);
+			bcm_mdelay(20);
+		}
+		/* disable writes to the SPROM */
+		if (sprom_cmd_pcmcia(osh, SROM_WDS))
+			return 1;
+	} else {
+		return 1;
+	}
+
+	bcm_mdelay(500);
+	return 0;
+}
+
+
+int
+srom_parsecis(uint8 *cis, char **vars, int *count)
+{
+	char eabuf[32];
+	char *vp, *base;
+	uint8 tup, tlen, sromrev = 1;
+	int i, j;
+	uint varsize;
+	bool ag_init = FALSE;
+	uint16 w;
+
+	ASSERT(vars);
+	ASSERT(count);
+
+	base = vp = MALLOC(VARS_MAX);
+	ASSERT(vp);
+
+	i = 0;
+	do {
+		tup = cis[i++];
+		tlen = cis[i++];
+
+		switch (tup) {
+		case CISTPL_MANFID:
+			vp += sprintf(vp, "manfid=%d", (cis[i + 1] << 8) + cis[i]);
+			vp++;
+			vp += sprintf(vp, "prodid=%d", (cis[i + 3] << 8) + cis[i + 2]);
+			vp++;
+			break;
+
+		case CISTPL_FUNCE:
+			if (cis[i] == LAN_NID) {
+				ASSERT(cis[i + 1] == ETHER_ADDR_LEN);
+				bcm_ether_ntoa((uchar*)&cis[i + 2], eabuf);
+				vp += sprintf(vp, "il0macaddr=%s", eabuf);
+				vp++;
+			}
+			break;
+
+		case CISTPL_CFTABLE:
+			vp += sprintf(vp, "regwindowsz=%d", (cis[i + 7] << 8) | cis[i + 6]);
+			vp++;
+			break;
+
+		case CISTPL_BRCM_HNBU:
+			switch (cis[i]) {
+			case HNBU_CHIPID:
+				vp += sprintf(vp, "vendid=%d", (cis[i + 2] << 8) + cis[i + 1]);
+				vp++;
+				vp += sprintf(vp, "devid=%d", (cis[i + 4] << 8) + cis[i + 3]);
+				vp++;
+				if (tlen == 7) {
+					vp += sprintf(vp, "chiprev=%d", (cis[i + 6] << 8) + cis[i + 5]);
+					vp++;
+				}
+				break;
+
+			case HNBU_BOARDREV:
+				vp += sprintf(vp, "boardrev=%d", cis[i + 1]);
+				vp++;
+				break;
+
+			case HNBU_AA:
+				vp += sprintf(vp, "aa0=%d", cis[i + 1]);
+				vp++;
+				break;
+
+			case HNBU_AG:
+				vp += sprintf(vp, "ag0=%d", cis[i + 1]);
+				vp++;
+				ag_init = TRUE;
+				break;
+
+			case HNBU_CC:
+				vp += sprintf(vp, "cc=%d", cis[i + 1]);
+				vp++;
+				break;
+
+			case HNBU_PAPARMS:
+				vp += sprintf(vp, "pa0maxpwr=%d", cis[i + tlen - 1]);
+				vp++;
+				if (tlen == 9) {
+					/* New version */
+					for (j = 0; j < 3; j++) {
+						vp += sprintf(vp, "pa0b%d=%d", j,
+							      (cis[i + (j * 2) + 2] << 8) + cis[i + (j * 2) + 1]);
+						vp++;
+					}
+					vp += sprintf(vp, "pa0itssit=%d", cis[i + 7]);
+					vp++;
+				}
+				break;
+
+			case HNBU_OEM:
+				vp += sprintf(vp, "oem=%02x%02x%02x%02x%02x%02x%02x%02x",
+					cis[i + 1], cis[i + 2], cis[i + 3], cis[i + 4],
+					cis[i + 5], cis[i + 6], cis[i + 7], cis[i + 8]);
+				vp++;
+				break;
+			case HNBU_BOARDFLAGS:
+				w = (cis[i + 2] << 8) + cis[i + 1];
+				if (w == 0xffff) w = 0;
+				vp += sprintf(vp, "boardflags=%d", w);
+				vp++;
+				break;
+			case HNBU_LED:
+				if (cis[i + 1] != 0xff) {
+					vp += sprintf(vp, "wl0gpio0=%d", cis[i + 1]);
+					vp++;
+				}
+				if (cis[i + 2] != 0xff) {
+					vp += sprintf(vp, "wl0gpio1=%d", cis[i + 2]);
+					vp++;
+				}
+				if (cis[i + 3] != 0xff) {
+					vp += sprintf(vp, "wl0gpio2=%d", cis[i + 3]);
+					vp++;
+				}
+				if (cis[i + 4] != 0xff) {
+					vp += sprintf(vp, "wl0gpio3=%d", cis[i + 4]);
+					vp++;
+				}
+				break;
+			}
+			break;
+
+		}
+		i += tlen;
+	} while (tup != 0xff);
+
+	/* Set the srom version */
+	vp += sprintf(vp, "sromrev=%d", sromrev);
+	vp++;
+
+	/* For now just set boardflags2 to zero */
+	vp += sprintf(vp, "boardflags2=0");
+	vp++;
+
+	/* if there is no antenna gain field, set default */
+	if (ag_init == FALSE) {
+		vp += sprintf(vp, "ag0=%d", 0xff);
+		vp++;
+	}
+
+	/* final nullbyte terminator */
+	*vp++ = '\0';
+	varsize = (uint)vp - (uint)base;
+
+	ASSERT(varsize < VARS_MAX);
+
+	if (varsize == VARS_MAX) {
+		*vars = base;
+	} else {
+		vp = MALLOC(varsize);
+		ASSERT(vp);
+		bcopy(base, vp, varsize);
+		MFREE(base, VARS_MAX);
+		*vars = vp;
+	}
+	*count = varsize;
+
+	return (0);
+}
+
+
+/* set PCMCIA sprom command register */
+static int
+sprom_cmd_pcmcia(void *osh, uint8 cmd)
+{
+	uint8 status;
+	uint wait_cnt = 1000;
+
+	/* write sprom command register */
+	OSL_PCMCIA_WRITE_ATTR(osh, SROM_CS, &cmd, 1);
+
+	/* wait status */
+	while (wait_cnt--) {
+		OSL_PCMCIA_READ_ATTR(osh, SROM_CS, &status, 1);
+		if (status & SROM_DONE)
+			return 0;
+	}
+	return 1;
+}
+
+/* read a word from the PCMCIA srom */
+static int
+sprom_read_pcmcia(void *osh, uint16 addr, uint16 *data)
+{
+	uint8 addr_l, addr_h, data_l, data_h;
+
+	addr_l = (uint8)((addr * 2) & 0xff);
+	addr_h = (uint8)(((addr * 2) >> 8) & 0xff);
+
+	/* set address */
+	OSL_PCMCIA_WRITE_ATTR(osh, SROM_ADDRH, &addr_h, 1);
+	OSL_PCMCIA_WRITE_ATTR(osh, SROM_ADDRL, &addr_l, 1);
+
+	/* do read */
+	if (sprom_cmd_pcmcia(osh, SROM_READ))
+		return 1;
+
+	/* read data */
+	OSL_PCMCIA_READ_ATTR(osh, SROM_DATAH, &data_h, 1);
+	OSL_PCMCIA_READ_ATTR(osh, SROM_DATAL, &data_l, 1);
+
+	*data = (data_h << 8) | data_l;
+	return 0;
+}
+
+/* write a word to the PCMCIA srom */
+static int
+sprom_write_pcmcia(void *osh, uint16 addr, uint16 data)
+{
+	uint8 addr_l, addr_h, data_l, data_h;
+
+	addr_l = (uint8)((addr * 2) & 0xff);
+	addr_h = (uint8)(((addr * 2) >> 8) & 0xff);
+	data_l = (uint8)(data & 0xff);
+	data_h = (uint8)((data >> 8) & 0xff);
+
+	/* set address */
+	OSL_PCMCIA_WRITE_ATTR(osh, SROM_ADDRH, &addr_h, 1);
+	OSL_PCMCIA_WRITE_ATTR(osh, SROM_ADDRL, &addr_l, 1);
+
+	/* write data */
+	OSL_PCMCIA_WRITE_ATTR(osh, SROM_DATAH, &data_h, 1);
+	OSL_PCMCIA_WRITE_ATTR(osh, SROM_DATAL, &data_l, 1);
+
+	/* do write */
+	return sprom_cmd_pcmcia(osh, SROM_WRITE);
+}
+
+/*
+ * Read in and validate sprom.
+ * Return 0 on success, nonzero on error.
+ */
+static int
+sprom_read_pci(uint16 *sprom, uint byteoff, uint16 *buf, uint nbytes, bool check_crc)
+{
+	int off, nw;
+	uint8 chk8;
+	int i;
+
+	off = byteoff / 2;
+	nw = ROUNDUP(nbytes, 2) / 2;
+
+	/* read the sprom */
+	for (i = 0; i < nw; i++)
+		buf[i] = R_REG(&sprom[off + i]);
+
+	if (check_crc) {
+		/* fixup the endianness so crc8 will pass */
+		htol16_buf(buf, nw * 2);
+		if ((chk8 = crc8((uchar*)buf, nbytes, CRC8_INIT_VALUE)) != CRC8_GOOD_VALUE)
+			return (1);
+		/* now correct the endianness of the byte array */
+		ltoh16_buf(buf, nw * 2);
+	}
+
+	return (0);
+}
+
+/*
+ * Initialize nonvolatile variable table from sprom.
+ * Return 0 on success, nonzero on error.
+ */
+
+static int
+initvars_srom_pci(void *curmap, char **vars, int *count)
+{
+	uint16 w, b[64];
+	uint8 sromrev;
+	struct ether_addr ea;
+	char eabuf[32];		     
+	int c, woff, i;
+	char *vp, *base;
+
+	if (sprom_read_pci((void *)((uint)curmap + PCI_BAR0_SPROM_OFFSET), 0, b, sizeof (b), TRUE))
+		return (-1);
+
+	/* top word of sprom contains version and crc8 */
+	sromrev = b[63] & 0xff;
+	if ((sromrev != 1) && (sromrev != 2)) {
+		return (-2);
+	}
+
+	ASSERT(vars);
+	ASSERT(count);
+
+	base = vp = MALLOC(VARS_MAX);
+	ASSERT(vp);
+
+	vp += sprintf(vp, "sromrev=%d", sromrev);
+	vp++;
+
+	if (sromrev >= 2) {
+		/* New section takes over the 4th hardware function space */
+
+		/* Word 28 is boardflags2 */
+		vp += sprintf(vp, "boardflags2=%d", b[28]);
+		vp++;
+
+		/* Word 29 is max power 11a high/low */
+		w = b[29];
+		vp += sprintf(vp, "pa1himaxpwr=%d", w & 0xff);
+		vp++;
+		vp += sprintf(vp, "pa1lomaxpwr=%d", (w >> 8) & 0xff);
+		vp++;
+
+		/* Words 30-32 set the 11alow pa settings,
+		 * 33-35 are the 11ahigh ones.
+		 */
+		for (i = 0; i < 3; i++) {
+			vp += sprintf(vp, "pa1lob%d=%d", i, b[30 + i]);
+			vp++;
+			vp += sprintf(vp, "pa1hib%d=%d", i, b[33 + i]);
+			vp++;
+		}
+		w = b[59];
+		if (w == 0)
+			vp += sprintf(vp, "ccode=");
+		else
+			vp += sprintf(vp, "ccode=%c%c", (w >> 8), (w & 0xff));
+		vp++;
+
+	}
+
+	/* parameter section of sprom starts at byte offset 72 */
+	woff = 72/2;
+
+	/* first 6 bytes are il0macaddr */
+	ea.octet[0] = (b[woff] >> 8) & 0xff;
+	ea.octet[1] = b[woff] & 0xff;
+	ea.octet[2] = (b[woff+1] >> 8) & 0xff;
+	ea.octet[3] = b[woff+1] & 0xff;
+	ea.octet[4] = (b[woff+2] >> 8) & 0xff;
+	ea.octet[5] = b[woff+2] & 0xff;
+	woff += ETHER_ADDR_LEN/2 ;
+	bcm_ether_ntoa((uchar*)&ea, eabuf);
+	vp += sprintf(vp, "il0macaddr=%s", eabuf);
+	vp++;
+
+	/* next 6 bytes are et0macaddr */
+	ea.octet[0] = (b[woff] >> 8) & 0xff;
+	ea.octet[1] = b[woff] & 0xff;
+	ea.octet[2] = (b[woff+1] >> 8) & 0xff;
+	ea.octet[3] = b[woff+1] & 0xff;
+	ea.octet[4] = (b[woff+2] >> 8) & 0xff;
+	ea.octet[5] = b[woff+2] & 0xff;
+	woff += ETHER_ADDR_LEN/2 ;
+	bcm_ether_ntoa((uchar*)&ea, eabuf);
+	vp += sprintf(vp, "et0macaddr=%s", eabuf);
+	vp++;
+
+	/* next 6 bytes are et1macaddr */
+	ea.octet[0] = (b[woff] >> 8) & 0xff;
+	ea.octet[1] = b[woff] & 0xff;
+	ea.octet[2] = (b[woff+1] >> 8) & 0xff;
+	ea.octet[3] = b[woff+1] & 0xff;
+	ea.octet[4] = (b[woff+2] >> 8) & 0xff;
+	ea.octet[5] = b[woff+2] & 0xff;
+	woff += ETHER_ADDR_LEN/2 ;
+	bcm_ether_ntoa((uchar*)&ea, eabuf);
+	vp += sprintf(vp, "et1macaddr=%s", eabuf);
+	vp++;
+
+	/*
+	 * Enet phy settings one or two singles or a dual
+	 * Bits 4-0 : MII address for enet0 (0x1f for not there)
+	 * Bits 9-5 : MII address for enet1 (0x1f for not there)
+	 * Bit 14   : Mdio for enet0
+	 * Bit 15   : Mdio for enet1
+	 */
+	w = b[woff];
+	vp += sprintf(vp, "et0phyaddr=%d", (w & 0x1f));
+	vp++;
+	vp += sprintf(vp, "et1phyaddr=%d", ((w >> 5) & 0x1f));
+	vp++;
+	vp += sprintf(vp, "et0mdcport=%d", ((w >> 14) & 0x1));
+	vp++;
+	vp += sprintf(vp, "et1mdcport=%d", ((w >> 15) & 0x1));
+	vp++;
+
+	/* Word 46 has board rev, antennas 0/1 & Country code/control */
+	w = b[46];
+	vp += sprintf(vp, "boardrev=%d", w & 0xff);
+	vp++;
+
+	if (sromrev > 1)
+		vp += sprintf(vp, "cctl=%d", (w >> 8) & 0xf);
+	else
+		vp += sprintf(vp, "cc=%d", (w >> 8) & 0xf);
+	vp++;
+
+	vp += sprintf(vp, "aa0=%d", (w >> 12) & 0x3);
+	vp++;
+
+	vp += sprintf(vp, "aa1=%d", (w >> 14) & 0x3);
+	vp++;
+
+	/* Words 47-49 set the (wl) pa settings */
+	woff = 47;
+
+	for (i = 0; i < 3; i++) {
+		vp += sprintf(vp, "pa0b%d=%d", i, b[woff+i]);
+		vp++;
+		vp += sprintf(vp, "pa1b%d=%d", i, b[woff+i+6]);
+		vp++;
+	}
+
+	/*
+	 * Words 50-51 set the customer-configured wl led behavior.
+	 * 8 bits/gpio pin.  High bit:  activehi=0, activelo=1;
+	 * LED behavior values defined in wlioctl.h .
+	 */
+	w = b[50];
+	if ((w != 0) && (w != 0xffff)) {
+		/* gpio0 */
+		vp += sprintf(vp, "wl0gpio0=%d", (w & 0xff));
+		vp++;
+
+		/* gpio1 */
+		vp += sprintf(vp, "wl0gpio1=%d", (w >> 8) & 0xff);
+		vp++;
+	}
+	w = b[51];
+	if ((w != 0) && (w != 0xffff)) {
+		/* gpio2 */
+		vp += sprintf(vp, "wl0gpio2=%d", w & 0xff);
+		vp++;
+
+		/* gpio3 */
+		vp += sprintf(vp, "wl0gpio3=%d", (w >> 8) & 0xff);
+		vp++;
+	}
+	
+	/* Word 52 is max power 0/1 */
+	w = b[52];
+	vp += sprintf(vp, "pa0maxpwr=%d", w & 0xff);
+	vp++;
+	vp += sprintf(vp, "pa1maxpwr=%d", (w >> 8) & 0xff);
+	vp++;
+
+	/* Word 56 is idle tssi target 0/1 */
+	w = b[56];
+	vp += sprintf(vp, "pa0itssit=%d", w & 0xff);
+	vp++;
+	vp += sprintf(vp, "pa1itssit=%d", (w >> 8) & 0xff);
+	vp++;
+
+	/* Word 57 is boardflags, if not programmed make it zero */
+	w = b[57];
+	if (w == 0xffff) w = 0;
+	vp += sprintf(vp, "boardflags=%d", w);
+	vp++;
+
+	/* Word 58 is antenna gain 0/1 */
+	w = b[58];
+	vp += sprintf(vp, "ag0=%d", w & 0xff);
+	vp++;
+
+	vp += sprintf(vp, "ag1=%d", (w >> 8) & 0xff);
+	vp++;
+
+	if (sromrev == 1) {
+		/* set the oem string */
+		vp += sprintf(vp, "oem=%02x%02x%02x%02x%02x%02x%02x%02x",
+			      ((b[59] >> 8) & 0xff), (b[59] & 0xff),
+			      ((b[60] >> 8) & 0xff), (b[60] & 0xff),
+			      ((b[61] >> 8) & 0xff), (b[61] & 0xff),
+			      ((b[62] >> 8) & 0xff), (b[62] & 0xff));
+		vp++;
+	}
+
+	/* final nullbyte terminator */
+	*vp++ = '\0';
+
+	c = vp - base;
+	ASSERT(c <= VARS_MAX);
+
+	if (c == VARS_MAX) {
+		*vars = base;
+	} else {
+		vp = MALLOC(c);
+		ASSERT(vp);
+		bcopy(base, vp, c);
+		MFREE(base, VARS_MAX);
+		*vars = vp;
+	}
+	*count = c;
+
+	return (0);
+}
+
+/*
+ * Read the cis and call parsecis to initialize the vars.
+ * Return 0 on success, nonzero on error.
+ */
+static int
+initvars_cis_pcmcia(void *osh, char **vars, int *count)
+{
+	uint8 *cis = NULL;
+	int rc;
+
+	if ((cis = MALLOC(CIS_SIZE)) == NULL)
+		return (-1);
+
+	OSL_PCMCIA_READ_ATTR(osh, 0, cis, CIS_SIZE);
+
+	rc = srom_parsecis(cis, vars, count);
+
+	MFREE(cis, CIS_SIZE);
+
+	return (rc);
+}
+
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/broadcom/bcmutils.c linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/bcmutils.c
--- linux-2.6.12.5/arch/mips/bcm947xx/broadcom/bcmutils.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/bcmutils.c	2005-08-28 11:12:20.428859456 +0200
@@ -0,0 +1,691 @@
+/*
+ * Misc useful OS-independent routines.
+ *
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmnvram.h>
+
+unsigned char bcm_ctype[] = {
+	_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,			/* 0-7 */
+	_BCM_C,_BCM_C|_BCM_S,_BCM_C|_BCM_S,_BCM_C|_BCM_S,_BCM_C|_BCM_S,_BCM_C|_BCM_S,_BCM_C,_BCM_C,		/* 8-15 */
+	_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,			/* 16-23 */
+	_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,			/* 24-31 */
+	_BCM_S|_BCM_SP,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,			/* 32-39 */
+	_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,			/* 40-47 */
+	_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,			/* 48-55 */
+	_BCM_D,_BCM_D,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,			/* 56-63 */
+	_BCM_P,_BCM_U|_BCM_X,_BCM_U|_BCM_X,_BCM_U|_BCM_X,_BCM_U|_BCM_X,_BCM_U|_BCM_X,_BCM_U|_BCM_X,_BCM_U,	/* 64-71 */
+	_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,			/* 72-79 */
+	_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,			/* 80-87 */
+	_BCM_U,_BCM_U,_BCM_U,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,			/* 88-95 */
+	_BCM_P,_BCM_L|_BCM_X,_BCM_L|_BCM_X,_BCM_L|_BCM_X,_BCM_L|_BCM_X,_BCM_L|_BCM_X,_BCM_L|_BCM_X,_BCM_L,	/* 96-103 */
+	_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,			/* 104-111 */
+	_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,			/* 112-119 */
+	_BCM_L,_BCM_L,_BCM_L,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_C,			/* 120-127 */
+	0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,		/* 128-143 */
+	0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,		/* 144-159 */
+	_BCM_S|_BCM_SP,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,   /* 160-175 */
+	_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,       /* 176-191 */
+	_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,       /* 192-207 */
+	_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_P,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_L,       /* 208-223 */
+	_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,       /* 224-239 */
+	_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_P,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L        /* 240-255 */
+};
+
+uchar
+bcm_toupper(uchar c)
+{
+	if (bcm_islower(c))
+		c -= 'a'-'A';
+	return (c);
+}
+
+ulong
+bcm_strtoul(char *cp, char **endp, uint base)
+{
+	ulong result, value;
+	bool minus;
+	
+	minus = FALSE;
+
+	while (bcm_isspace(*cp))
+		cp++;
+	
+	if (cp[0] == '+')
+		cp++;
+	else if (cp[0] == '-') {
+		minus = TRUE;
+		cp++;
+	}
+	
+	if (base == 0) {
+		if (cp[0] == '0') {
+			if ((cp[1] == 'x') || (cp[1] == 'X')) {
+				base = 16;
+				cp = &cp[2];
+			} else {
+				base = 8;
+				cp = &cp[1];
+			}
+		} else
+			base = 10;
+	} else if (base == 16 && (cp[0] == '0') && ((cp[1] == 'x') || (cp[1] == 'X'))) {
+		cp = &cp[2];
+	}
+		   
+	result = 0;
+
+	while (bcm_isxdigit(*cp) &&
+	       (value = bcm_isdigit(*cp) ? *cp-'0' : bcm_toupper(*cp)-'A'+10) < base) {
+		result = result*base + value;
+		cp++;
+	}
+
+	if (minus)
+		result = (ulong)(result * -1);
+
+	if (endp)
+		*endp = (char *)cp;
+
+	return (result);
+}
+
+uint
+bcm_atoi(char *s)
+{
+	uint n;
+
+	n = 0;
+
+	while (bcm_isdigit(*s))
+		n = (n * 10) + *s++ - '0';
+	return (n);
+}
+
+void
+deadbeef(char *p, uint len)
+{
+	static uchar meat[] = { 0xde, 0xad, 0xbe, 0xef };
+
+	while (len-- > 0) {
+		*p = meat[((uint)p) & 3];
+		p++;
+	}
+}
+
+/* pretty hex print a contiguous buffer */
+void
+prhex(char *msg, uchar *buf, uint nbytes)
+{
+	char line[256];
+	char* p;
+	uint i;
+
+	if (msg && (msg[0] != '\0'))
+		printf("%s: ", msg);
+
+	p = line;
+	for (i = 0; i < nbytes; i++) {
+		if (i % 16 == 0) {
+			p += sprintf(p, "%04d: ", i);	/* line prefix */
+		}
+		p += sprintf(p, "%02x ", buf[i]);
+		if (i % 16 == 15) {
+			printf("%s\n", line);		/* flush line */
+			p = line;
+		}
+	}
+
+	/* flush last partial line */
+	if (p != line)
+		printf("%s\n", line);
+}
+
+/* pretty hex print a pkt buffer chain */
+void
+prpkt(char *msg, void *drv, void *p0)
+{
+	void *p;
+
+	if (msg && (msg[0] != '\0'))
+		printf("%s: ", msg);
+
+	for (p = p0; p; p = PKTNEXT(drv, p))
+		prhex(NULL, PKTDATA(drv, p), PKTLEN(drv, p));
+}
+
+/* copy a pkt buffer chain into a buffer */
+uint
+pktcopy(void *drv, void *p, uint offset, int len, uchar *buf)
+{
+	uint n, ret = 0;
+
+	if (len < 0)
+		len = 4096;	/* "infinite" */
+
+	/* skip 'offset' bytes */
+	for (; p && offset; p = PKTNEXT(drv, p)) {
+		if (offset < (uint)PKTLEN(drv, p))
+			break;
+		offset -= PKTLEN(drv, p);
+	}
+
+	if (!p)
+		return 0;
+
+	/* copy the data */
+	for (; p && len; p = PKTNEXT(drv, p)) {
+		n = MIN((uint)PKTLEN(drv, p) - offset, (uint)len);
+		bcopy(PKTDATA(drv, p) + offset, buf, n);
+		buf += n;
+		len -= n;
+		ret += n;
+		offset = 0;
+	}
+
+	return ret;
+}
+
+/* return total length of buffer chain */
+uint
+pkttotlen(void *drv, void *p)
+{
+	uint total;
+
+	total = 0;
+	for (; p; p = PKTNEXT(drv, p))
+		total += PKTLEN(drv, p);
+	return (total);
+}
+
+
+uchar*
+bcm_ether_ntoa(char *ea, char *buf)
+{
+	sprintf(buf,"%02x:%02x:%02x:%02x:%02x:%02x",
+		(uchar)ea[0]&0xff, (uchar)ea[1]&0xff, (uchar)ea[2]&0xff,
+		(uchar)ea[3]&0xff, (uchar)ea[4]&0xff, (uchar)ea[5]&0xff);
+	return (buf);
+}
+
+/* parse a xx:xx:xx:xx:xx:xx format ethernet address */
+int
+bcm_ether_atoe(char *p, char *ea)
+{
+	int i = 0;
+
+	for (;;) {
+		ea[i++] = (char) bcm_strtoul(p, &p, 16);
+		if (!*p++ || i == 6)
+			break;
+	}
+
+	return (i == 6);
+}
+
+/* 
+ * Traverse a string of 1-byte tag/1-byte length/variable-length value 
+ * triples, returning a pointer to the substring whose first element 
+ * matches tag.  Stop parsing when we see an element whose ID is greater
+ * than the target key. 
+ */
+bcm_tlv_t *
+bcm_parse_ordered_tlvs(void *buf, int buflen, uint key)
+{
+	bcm_tlv_t *elt;
+	int totlen;
+
+	elt = (bcm_tlv_t*)buf;
+	totlen = buflen;
+
+	/* find tagged parameter */
+	while (totlen >= 2) {
+		uint id = elt->id;
+		int len = elt->len;
+		
+		/* Punt if we start seeing IDs > than target key */
+		if (id > key)
+			return(NULL);
+
+		/* validate remaining totlen */
+		if ((id == key) && (totlen >= (len + 2)))
+			return (elt);
+
+		elt = (bcm_tlv_t*)((uint8*)elt + (len + 2));
+		totlen -= (len + 2);
+	}
+	return NULL;
+}
+
+
+/* 
+ * Traverse a string of 1-byte tag/1-byte length/variable-length value 
+ * triples, returning a pointer to the substring whose first element 
+ * matches tag
+ */
+bcm_tlv_t *
+bcm_parse_tlvs(void *buf, int buflen, uint key)
+{
+	bcm_tlv_t *elt;
+	int totlen;
+
+	elt = (bcm_tlv_t*)buf;
+	totlen = buflen;
+
+	/* find tagged parameter */
+	while (totlen >= 2) {
+		int len = elt->len;
+
+		/* validate remaining totlen */
+		if ((elt->id == key) && (totlen >= (len + 2)))
+			return (elt);
+
+		elt = (bcm_tlv_t*)((uint8*)elt + (len + 2));
+		totlen -= (len + 2);
+	}
+	
+	return NULL;
+}
+
+void
+pktqinit(struct pktq *q, int maxlen)
+{
+	q->head = q->tail = NULL;
+	q->maxlen = maxlen;
+	q->len = 0;
+}
+
+void
+pktenq(struct pktq *q, void *p, bool lifo)
+{
+	ASSERT(PKTLINK(p) == NULL);
+
+	PKTSETLINK(p, NULL);
+
+	if (q->tail == NULL) {
+		ASSERT(q->head == NULL);
+		q->head = q->tail = p;
+	}
+	else {
+		ASSERT(q->head);
+		ASSERT(PKTLINK(q->tail) == NULL);
+		if (lifo) {
+			PKTSETLINK(p, q->head);
+			q->head = p;
+		} else {
+			PKTSETLINK(q->tail, p);
+			q->tail = p;
+		}
+	}
+	q->len++;
+}
+
+void*
+pktdeq(struct pktq *q)
+{
+	void *p;
+
+	if ((p = q->head)) {
+		ASSERT(q->tail);
+		q->head = PKTLINK(p);
+		PKTSETLINK(p, NULL);
+		q->len--;
+		if (q->head == NULL)
+			q->tail = NULL;
+	}
+	else {
+		ASSERT(q->tail == NULL);
+	}
+
+	return (p);
+}
+
+/*******************************************************************************
+ * crc8
+ *
+ * Computes a crc8 over the input data using the polynomial:
+ *
+ *       x^8 + x^7 +x^6 + x^4 + x^2 + 1
+ *
+ * The caller provides the initial value (either CRC8_INIT_VALUE
+ * or the previous returned value) to allow for processing of 
+ * discontiguous blocks of data.  When generating the CRC the
+ * caller is responsible for complementing the final return value
+ * and inserting it into the byte stream.  When checking, a final
+ * return value of CRC8_GOOD_VALUE indicates a valid CRC.
+ *
+ * Reference: Dallas Semiconductor Application Note 27
+ *   Williams, Ross N., "A Painless Guide to CRC Error Detection Algorithms", 
+ *     ver 3, Aug 1993, ross@guest.adelaide.edu.au, Rocksoft Pty Ltd.,
+ *     ftp://ftp.rocksoft.com/clients/rocksoft/papers/crc_v3.txt
+ *
+ ******************************************************************************/
+
+static uint8 crc8_table[256] = {
+    0x00, 0xF7, 0xB9, 0x4E, 0x25, 0xD2, 0x9C, 0x6B,
+    0x4A, 0xBD, 0xF3, 0x04, 0x6F, 0x98, 0xD6, 0x21,
+    0x94, 0x63, 0x2D, 0xDA, 0xB1, 0x46, 0x08, 0xFF,
+    0xDE, 0x29, 0x67, 0x90, 0xFB, 0x0C, 0x42, 0xB5,
+    0x7F, 0x88, 0xC6, 0x31, 0x5A, 0xAD, 0xE3, 0x14,
+    0x35, 0xC2, 0x8C, 0x7B, 0x10, 0xE7, 0xA9, 0x5E,
+    0xEB, 0x1C, 0x52, 0xA5, 0xCE, 0x39, 0x77, 0x80,
+    0xA1, 0x56, 0x18, 0xEF, 0x84, 0x73, 0x3D, 0xCA,
+    0xFE, 0x09, 0x47, 0xB0, 0xDB, 0x2C, 0x62, 0x95,
+    0xB4, 0x43, 0x0D, 0xFA, 0x91, 0x66, 0x28, 0xDF,
+    0x6A, 0x9D, 0xD3, 0x24, 0x4F, 0xB8, 0xF6, 0x01,
+    0x20, 0xD7, 0x99, 0x6E, 0x05, 0xF2, 0xBC, 0x4B,
+    0x81, 0x76, 0x38, 0xCF, 0xA4, 0x53, 0x1D, 0xEA,
+    0xCB, 0x3C, 0x72, 0x85, 0xEE, 0x19, 0x57, 0xA0,
+    0x15, 0xE2, 0xAC, 0x5B, 0x30, 0xC7, 0x89, 0x7E,
+    0x5F, 0xA8, 0xE6, 0x11, 0x7A, 0x8D, 0xC3, 0x34,
+    0xAB, 0x5C, 0x12, 0xE5, 0x8E, 0x79, 0x37, 0xC0,
+    0xE1, 0x16, 0x58, 0xAF, 0xC4, 0x33, 0x7D, 0x8A,
+    0x3F, 0xC8, 0x86, 0x71, 0x1A, 0xED, 0xA3, 0x54,
+    0x75, 0x82, 0xCC, 0x3B, 0x50, 0xA7, 0xE9, 0x1E,
+    0xD4, 0x23, 0x6D, 0x9A, 0xF1, 0x06, 0x48, 0xBF,
+    0x9E, 0x69, 0x27, 0xD0, 0xBB, 0x4C, 0x02, 0xF5,
+    0x40, 0xB7, 0xF9, 0x0E, 0x65, 0x92, 0xDC, 0x2B,
+    0x0A, 0xFD, 0xB3, 0x44, 0x2F, 0xD8, 0x96, 0x61,
+    0x55, 0xA2, 0xEC, 0x1B, 0x70, 0x87, 0xC9, 0x3E,
+    0x1F, 0xE8, 0xA6, 0x51, 0x3A, 0xCD, 0x83, 0x74,
+    0xC1, 0x36, 0x78, 0x8F, 0xE4, 0x13, 0x5D, 0xAA,
+    0x8B, 0x7C, 0x32, 0xC5, 0xAE, 0x59, 0x17, 0xE0,
+    0x2A, 0xDD, 0x93, 0x64, 0x0F, 0xF8, 0xB6, 0x41,
+    0x60, 0x97, 0xD9, 0x2E, 0x45, 0xB2, 0xFC, 0x0B,
+    0xBE, 0x49, 0x07, 0xF0, 0x9B, 0x6C, 0x22, 0xD5,
+    0xF4, 0x03, 0x4D, 0xBA, 0xD1, 0x26, 0x68, 0x9F
+};
+
+/*
+ * Search the name=value vars for a specific one and return its value.
+ * Returns NULL if not found.
+ */
+char*
+getvar(char *vars, char *name)
+{
+	char *s;
+	int len;
+
+	len = strlen(name);
+
+	/* first look in vars[] */
+	for (s = vars; s && *s; ) {
+		if ((bcmp(s, name, len) == 0) && (s[len] == '='))
+			return (&s[len+1]);
+
+		while (*s++)
+			;
+	}
+
+	/* then query nvram */
+	return (nvram_get(name));
+}
+
+/*
+ * Search the vars for a specific one and return its value as
+ * an integer. Returns 0 if not found.
+ */
+int
+getintvar(char *vars, char *name)
+{
+	char *val;
+
+	if ((val = getvar(vars, name)) == NULL)
+		return (0);
+
+	return (bcm_strtoul(val, NULL, 0));
+}
+
+void
+bcm_mdelay(uint ms)
+{
+	uint i;
+
+	for (i = 0; i < ms; i++) {
+		OSL_DELAY(1000);
+	}
+}
+
+#define CRC_INNER_LOOP(n, c, x) \
+    (c) = ((c) >> 8) ^ crc##n##_table[((c) ^ (x)) & 0xff]
+
+uint8
+crc8(
+	uint8 *pdata,	/* pointer to array of data to process */
+	uint  nbytes,	/* number of input data bytes to process */
+	uint8 crc	/* either CRC8_INIT_VALUE or previous return value */
+)
+{
+	/* hard code the crc loop instead of using CRC_INNER_LOOP macro
+	 * to avoid the undefined and unnecessary (uint8 >> 8) operation. */
+	while (nbytes-- > 0)
+		crc = crc8_table[(crc ^ *pdata++) & 0xff];
+
+	return crc;
+}
+
+/*******************************************************************************
+ * crc16
+ *
+ * Computes a crc16 over the input data using the polynomial:
+ *
+ *       x^16 + x^12 +x^5 + 1
+ *
+ * The caller provides the initial value (either CRC16_INIT_VALUE
+ * or the previous returned value) to allow for processing of 
+ * discontiguous blocks of data.  When generating the CRC the
+ * caller is responsible for complementing the final return value
+ * and inserting it into the byte stream.  When checking, a final
+ * return value of CRC16_GOOD_VALUE indicates a valid CRC.
+ *
+ * Reference: Dallas Semiconductor Application Note 27
+ *   Williams, Ross N., "A Painless Guide to CRC Error Detection Algorithms", 
+ *     ver 3, Aug 1993, ross@guest.adelaide.edu.au, Rocksoft Pty Ltd.,
+ *     ftp://ftp.rocksoft.com/clients/rocksoft/papers/crc_v3.txt
+ *
+ ******************************************************************************/
+
+static uint16 crc16_table[256] = {
+    0x0000, 0x1189, 0x2312, 0x329B, 0x4624, 0x57AD, 0x6536, 0x74BF,
+    0x8C48, 0x9DC1, 0xAF5A, 0xBED3, 0xCA6C, 0xDBE5, 0xE97E, 0xF8F7,
+    0x1081, 0x0108, 0x3393, 0x221A, 0x56A5, 0x472C, 0x75B7, 0x643E,
+    0x9CC9, 0x8D40, 0xBFDB, 0xAE52, 0xDAED, 0xCB64, 0xF9FF, 0xE876,
+    0x2102, 0x308B, 0x0210, 0x1399, 0x6726, 0x76AF, 0x4434, 0x55BD,
+    0xAD4A, 0xBCC3, 0x8E58, 0x9FD1, 0xEB6E, 0xFAE7, 0xC87C, 0xD9F5,
+    0x3183, 0x200A, 0x1291, 0x0318, 0x77A7, 0x662E, 0x54B5, 0x453C,
+    0xBDCB, 0xAC42, 0x9ED9, 0x8F50, 0xFBEF, 0xEA66, 0xD8FD, 0xC974,
+    0x4204, 0x538D, 0x6116, 0x709F, 0x0420, 0x15A9, 0x2732, 0x36BB,
+    0xCE4C, 0xDFC5, 0xED5E, 0xFCD7, 0x8868, 0x99E1, 0xAB7A, 0xBAF3,
+    0x5285, 0x430C, 0x7197, 0x601E, 0x14A1, 0x0528, 0x37B3, 0x263A,
+    0xDECD, 0xCF44, 0xFDDF, 0xEC56, 0x98E9, 0x8960, 0xBBFB, 0xAA72,
+    0x6306, 0x728F, 0x4014, 0x519D, 0x2522, 0x34AB, 0x0630, 0x17B9,
+    0xEF4E, 0xFEC7, 0xCC5C, 0xDDD5, 0xA96A, 0xB8E3, 0x8A78, 0x9BF1,
+    0x7387, 0x620E, 0x5095, 0x411C, 0x35A3, 0x242A, 0x16B1, 0x0738,
+    0xFFCF, 0xEE46, 0xDCDD, 0xCD54, 0xB9EB, 0xA862, 0x9AF9, 0x8B70,
+    0x8408, 0x9581, 0xA71A, 0xB693, 0xC22C, 0xD3A5, 0xE13E, 0xF0B7,
+    0x0840, 0x19C9, 0x2B52, 0x3ADB, 0x4E64, 0x5FED, 0x6D76, 0x7CFF,
+    0x9489, 0x8500, 0xB79B, 0xA612, 0xD2AD, 0xC324, 0xF1BF, 0xE036,
+    0x18C1, 0x0948, 0x3BD3, 0x2A5A, 0x5EE5, 0x4F6C, 0x7DF7, 0x6C7E,
+    0xA50A, 0xB483, 0x8618, 0x9791, 0xE32E, 0xF2A7, 0xC03C, 0xD1B5,
+    0x2942, 0x38CB, 0x0A50, 0x1BD9, 0x6F66, 0x7EEF, 0x4C74, 0x5DFD,
+    0xB58B, 0xA402, 0x9699, 0x8710, 0xF3AF, 0xE226, 0xD0BD, 0xC134,
+    0x39C3, 0x284A, 0x1AD1, 0x0B58, 0x7FE7, 0x6E6E, 0x5CF5, 0x4D7C,
+    0xC60C, 0xD785, 0xE51E, 0xF497, 0x8028, 0x91A1, 0xA33A, 0xB2B3,
+    0x4A44, 0x5BCD, 0x6956, 0x78DF, 0x0C60, 0x1DE9, 0x2F72, 0x3EFB,
+    0xD68D, 0xC704, 0xF59F, 0xE416, 0x90A9, 0x8120, 0xB3BB, 0xA232,
+    0x5AC5, 0x4B4C, 0x79D7, 0x685E, 0x1CE1, 0x0D68, 0x3FF3, 0x2E7A,
+    0xE70E, 0xF687, 0xC41C, 0xD595, 0xA12A, 0xB0A3, 0x8238, 0x93B1,
+    0x6B46, 0x7ACF, 0x4854, 0x59DD, 0x2D62, 0x3CEB, 0x0E70, 0x1FF9,
+    0xF78F, 0xE606, 0xD49D, 0xC514, 0xB1AB, 0xA022, 0x92B9, 0x8330,
+    0x7BC7, 0x6A4E, 0x58D5, 0x495C, 0x3DE3, 0x2C6A, 0x1EF1, 0x0F78
+};
+
+uint16
+crc16(
+    uint8 *pdata,  /* pointer to array of data to process */
+    uint nbytes, /* number of input data bytes to process */
+    uint16 crc     /* either CRC16_INIT_VALUE or previous return value */
+)
+{
+    while (nbytes-- > 0)
+        CRC_INNER_LOOP(16, crc, *pdata++);
+    return crc;
+}
+
+static uint32 crc32_table[256] = {
+    0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA,
+    0x076DC419, 0x706AF48F, 0xE963A535, 0x9E6495A3,
+    0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988,
+    0x09B64C2B, 0x7EB17CBD, 0xE7B82D07, 0x90BF1D91,
+    0x1DB71064, 0x6AB020F2, 0xF3B97148, 0x84BE41DE,
+    0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7,
+    0x136C9856, 0x646BA8C0, 0xFD62F97A, 0x8A65C9EC,
+    0x14015C4F, 0x63066CD9, 0xFA0F3D63, 0x8D080DF5,
+    0x3B6E20C8, 0x4C69105E, 0xD56041E4, 0xA2677172,
+    0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B,
+    0x35B5A8FA, 0x42B2986C, 0xDBBBC9D6, 0xACBCF940,
+    0x32D86CE3, 0x45DF5C75, 0xDCD60DCF, 0xABD13D59,
+    0x26D930AC, 0x51DE003A, 0xC8D75180, 0xBFD06116,
+    0x21B4F4B5, 0x56B3C423, 0xCFBA9599, 0xB8BDA50F,
+    0x2802B89E, 0x5F058808, 0xC60CD9B2, 0xB10BE924,
+    0x2F6F7C87, 0x58684C11, 0xC1611DAB, 0xB6662D3D,
+    0x76DC4190, 0x01DB7106, 0x98D220BC, 0xEFD5102A,
+    0x71B18589, 0x06B6B51F, 0x9FBFE4A5, 0xE8B8D433,
+    0x7807C9A2, 0x0F00F934, 0x9609A88E, 0xE10E9818,
+    0x7F6A0DBB, 0x086D3D2D, 0x91646C97, 0xE6635C01,
+    0x6B6B51F4, 0x1C6C6162, 0x856530D8, 0xF262004E,
+    0x6C0695ED, 0x1B01A57B, 0x8208F4C1, 0xF50FC457,
+    0x65B0D9C6, 0x12B7E950, 0x8BBEB8EA, 0xFCB9887C,
+    0x62DD1DDF, 0x15DA2D49, 0x8CD37CF3, 0xFBD44C65,
+    0x4DB26158, 0x3AB551CE, 0xA3BC0074, 0xD4BB30E2,
+    0x4ADFA541, 0x3DD895D7, 0xA4D1C46D, 0xD3D6F4FB,
+    0x4369E96A, 0x346ED9FC, 0xAD678846, 0xDA60B8D0,
+    0x44042D73, 0x33031DE5, 0xAA0A4C5F, 0xDD0D7CC9,
+    0x5005713C, 0x270241AA, 0xBE0B1010, 0xC90C2086,
+    0x5768B525, 0x206F85B3, 0xB966D409, 0xCE61E49F,
+    0x5EDEF90E, 0x29D9C998, 0xB0D09822, 0xC7D7A8B4,
+    0x59B33D17, 0x2EB40D81, 0xB7BD5C3B, 0xC0BA6CAD,
+    0xEDB88320, 0x9ABFB3B6, 0x03B6E20C, 0x74B1D29A,
+    0xEAD54739, 0x9DD277AF, 0x04DB2615, 0x73DC1683,
+    0xE3630B12, 0x94643B84, 0x0D6D6A3E, 0x7A6A5AA8,
+    0xE40ECF0B, 0x9309FF9D, 0x0A00AE27, 0x7D079EB1,
+    0xF00F9344, 0x8708A3D2, 0x1E01F268, 0x6906C2FE,
+    0xF762575D, 0x806567CB, 0x196C3671, 0x6E6B06E7,
+    0xFED41B76, 0x89D32BE0, 0x10DA7A5A, 0x67DD4ACC,
+    0xF9B9DF6F, 0x8EBEEFF9, 0x17B7BE43, 0x60B08ED5,
+    0xD6D6A3E8, 0xA1D1937E, 0x38D8C2C4, 0x4FDFF252,
+    0xD1BB67F1, 0xA6BC5767, 0x3FB506DD, 0x48B2364B,
+    0xD80D2BDA, 0xAF0A1B4C, 0x36034AF6, 0x41047A60,
+    0xDF60EFC3, 0xA867DF55, 0x316E8EEF, 0x4669BE79,
+    0xCB61B38C, 0xBC66831A, 0x256FD2A0, 0x5268E236,
+    0xCC0C7795, 0xBB0B4703, 0x220216B9, 0x5505262F,
+    0xC5BA3BBE, 0xB2BD0B28, 0x2BB45A92, 0x5CB36A04,
+    0xC2D7FFA7, 0xB5D0CF31, 0x2CD99E8B, 0x5BDEAE1D,
+    0x9B64C2B0, 0xEC63F226, 0x756AA39C, 0x026D930A,
+    0x9C0906A9, 0xEB0E363F, 0x72076785, 0x05005713,
+    0x95BF4A82, 0xE2B87A14, 0x7BB12BAE, 0x0CB61B38,
+    0x92D28E9B, 0xE5D5BE0D, 0x7CDCEFB7, 0x0BDBDF21,
+    0x86D3D2D4, 0xF1D4E242, 0x68DDB3F8, 0x1FDA836E,
+    0x81BE16CD, 0xF6B9265B, 0x6FB077E1, 0x18B74777,
+    0x88085AE6, 0xFF0F6A70, 0x66063BCA, 0x11010B5C,
+    0x8F659EFF, 0xF862AE69, 0x616BFFD3, 0x166CCF45,
+    0xA00AE278, 0xD70DD2EE, 0x4E048354, 0x3903B3C2,
+    0xA7672661, 0xD06016F7, 0x4969474D, 0x3E6E77DB,
+    0xAED16A4A, 0xD9D65ADC, 0x40DF0B66, 0x37D83BF0,
+    0xA9BCAE53, 0xDEBB9EC5, 0x47B2CF7F, 0x30B5FFE9,
+    0xBDBDF21C, 0xCABAC28A, 0x53B39330, 0x24B4A3A6,
+    0xBAD03605, 0xCDD70693, 0x54DE5729, 0x23D967BF,
+    0xB3667A2E, 0xC4614AB8, 0x5D681B02, 0x2A6F2B94,
+    0xB40BBE37, 0xC30C8EA1, 0x5A05DF1B, 0x2D02EF8D
+};
+
+uint32
+crc32(
+    uint8 *pdata,  /* pointer to array of data to process */
+    uint   nbytes, /* number of input data bytes to process */
+    uint32 crc     /* either CRC32_INIT_VALUE or previous return value */
+)
+{
+    uint8 *pend;
+#ifdef __mips__
+    uint8 tmp[4];
+    ulong *tptr = (ulong *)tmp;
+
+	/* in case the beginning of the buffer isn't aligned */
+	pend = (uint8 *)((uint)(pdata + 3) & 0xfffffffc);
+	nbytes -= (pend - pdata);
+	while (pdata < pend)
+		CRC_INNER_LOOP(32, crc, *pdata++);
+
+    /* handle bulk of data as 32-bit words */
+    pend = pdata + (nbytes & 0xfffffffc);
+    while (pdata < pend) {
+	*tptr = *((ulong *)pdata)++;
+        CRC_INNER_LOOP(32, crc, tmp[0]);
+        CRC_INNER_LOOP(32, crc, tmp[1]);
+        CRC_INNER_LOOP(32, crc, tmp[2]);
+        CRC_INNER_LOOP(32, crc, tmp[3]);
+    }
+
+    /* 1-3 bytes at end of buffer */
+    pend = pdata + (nbytes & 0x03);
+    while (pdata < pend)
+        CRC_INNER_LOOP(32, crc, *pdata++);
+#else
+    pend = pdata + nbytes;
+    while (pdata < pend)
+        CRC_INNER_LOOP(32, crc, *pdata++);
+#endif
+       
+    return crc;
+}
+
+#ifdef notdef
+#define CLEN 	1499
+#define CBUFSIZ 	(CLEN+4)
+#define CNBUFS		5
+
+void testcrc32(void)
+{
+	uint j,k,l;
+	uint8 *buf;
+	uint len[CNBUFS];
+	uint32 crcr;
+	uint32 crc32tv[CNBUFS] =
+		{0xd2cb1faa, 0xd385c8fa, 0xf5b4f3f3, 0x55789e20, 0x00343110};
+
+	ASSERT((buf = MALLOC(CBUFSIZ*CNBUFS)) != NULL);
+
+	/* step through all possible alignments */
+	for (l=0;l<=4;l++) {
+		for (j=0; j<CNBUFS; j++) {
+			len[j] = CLEN;
+			for (k=0; k<len[j]; k++)
+				*(buf + j*CBUFSIZ + (k+l)) = (j+k) & 0xff;
+		}
+
+		for (j=0; j<CNBUFS; j++) {
+			crcr = crc32(buf + j*CBUFSIZ + l, len[j], CRC32_INIT_VALUE);
+			ASSERT(crcr == crc32tv[j]);
+		}
+	}
+
+	MFREE(buf, CBUFSIZ*CNBUFS);
+	return;
+}
+#endif
+
+
+
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/broadcom/hnddma.c linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/hnddma.c
--- linux-2.6.12.5/arch/mips/bcm947xx/broadcom/hnddma.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/hnddma.c	2005-08-28 11:12:20.430859152 +0200
@@ -0,0 +1,763 @@
+/*
+ * Generic Broadcom Home Networking Division (HND) DMA module.
+ * This supports the following chips: BCM42xx, 44xx, 47xx .
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmendian.h>
+#include <bcmutils.h>
+
+struct dma_info;	/* forward declaration */
+#define di_t struct dma_info
+#include <hnddma.h>
+
+/* debug/trace */
+#define	DMA_ERROR(args)
+#define	DMA_TRACE(args)
+
+/* default dma message level(if input msg_level pointer is null in dma_attach()) */
+static uint dma_msg_level = 0;
+
+#define	MAXNAMEL	8
+#define	MAXDD		(DMAMAXRINGSZ / sizeof (dmadd_t))
+
+/* dma engine software state */
+typedef struct dma_info {
+	hnddma_t	hnddma;		/* exported structure */
+	uint		*msg_level;	/* message level pointer */
+
+	char		name[MAXNAMEL];	/* callers name for diag msgs */
+	void		*drv;		/* driver handle */
+	void		*dev;		/* device handle */
+	dmaregs_t	*regs;		/* dma engine registers */
+
+	dmadd_t		*txd;		/* pointer to chip-specific tx descriptor ring */
+	uint		txin;		/* index of next descriptor to reclaim */
+	uint		txout;		/* index of next descriptor to post */
+	uint		txavail;	/* # free tx descriptors */
+	void		*txp[MAXDD];	/* parallel array of pointers to packets */
+	ulong		txdpa;		/* physical address of descriptor ring */
+	uint		txdalign;	/* #bytes added to alloc'd mem to align txd */
+
+	dmadd_t		*rxd;		/* pointer to chip-specific rx descriptor ring */
+	uint		rxin;		/* index of next descriptor to reclaim */
+	uint		rxout;		/* index of next descriptor to post */
+	void		*rxp[MAXDD];	/* parallel array of pointers to packets */
+	ulong		rxdpa;		/* physical address of descriptor ring */
+	uint		rxdalign;	/* #bytes added to alloc'd mem to align rxd */
+
+	/* tunables */
+	uint		ntxd;		/* # tx descriptors */
+	uint		nrxd;		/* # rx descriptors */
+	uint		rxbufsize;	/* rx buffer size in bytes */
+	uint		nrxpost;	/* # rx buffers to keep posted */
+	uint		rxoffset;	/* rxcontrol offset */
+	uint		ddoffset;	/* add to get dma address of descriptor ring */
+	uint		dataoffset;	/* add to get dma address of data buffer */
+} dma_info_t;
+
+/* descriptor bumping macros */
+#define	NEXTTXD(i)	((i + 1) & (di->ntxd - 1))
+#define	PREVTXD(i)	((i - 1) & (di->ntxd - 1))
+#define	NEXTRXD(i)	((i + 1) & (di->nrxd - 1))
+#define	NTXDACTIVE(h, t)	((t - h) & (di->ntxd - 1))
+#define	NRXDACTIVE(h, t)	((t - h) & (di->nrxd - 1))
+
+/* macros to convert between byte offsets and indexes */
+#define	B2I(bytes)	((bytes) / sizeof (dmadd_t))
+#define	I2B(index)	((index) * sizeof (dmadd_t))
+
+void*
+dma_attach(void *drv, void *dev, char *name, dmaregs_t *regs, uint ntxd, uint nrxd,
+	uint rxbufsize, uint nrxpost, uint rxoffset, uint ddoffset, uint dataoffset, uint *msg_level)
+{
+	dma_info_t *di;
+	void *va;
+
+	ASSERT(ntxd <= MAXDD);
+	ASSERT(nrxd <= MAXDD);
+
+	/* allocate private info structure */
+	if ((di = MALLOC(sizeof (dma_info_t))) == NULL)
+		return (NULL);
+	bzero((char*)di, sizeof (dma_info_t));
+
+	/* set message level */
+	di->msg_level = msg_level ? msg_level : &dma_msg_level;
+
+	DMA_TRACE(("%s: dma_attach: drv 0x%x dev 0x%x regs 0x%x ntxd %d nrxd %d rxbufsize %d nrxpost %d rxoffset %d ddoffset 0x%x dataoffset 0x%x\n", name, (uint)drv, (uint)dev, (uint)regs, ntxd, nrxd, rxbufsize, nrxpost, rxoffset, ddoffset, dataoffset));
+
+	/* make a private copy of our callers name */
+	strncpy(di->name, name, MAXNAMEL);
+	di->name[MAXNAMEL-1] = '\0';
+
+	di->drv = drv;
+	di->dev = dev;
+	di->regs = regs;
+
+	/* allocate transmit descriptor ring */
+	if (ntxd) {
+		if ((va = DMA_ALLOC_CONSISTENT(dev, (DMAMAXRINGSZ + DMARINGALIGN), &di->txdpa)) == NULL)
+			goto fail;
+		di->txd = (dmadd_t*) ROUNDUP(va, DMARINGALIGN);
+		di->txdalign = ((uint)di->txd - (uint)va);
+		di->txdpa = di->txdpa + di->txdalign;
+		ASSERT(ISALIGNED(di->txd, DMARINGALIGN));
+	}
+
+	/* allocate receive descriptor ring */
+	if (nrxd) {
+		if ((va = DMA_ALLOC_CONSISTENT(dev, (DMAMAXRINGSZ + DMARINGALIGN), &di->rxdpa)) == NULL)
+			goto fail;
+		di->rxd = (dmadd_t*) ROUNDUP(va, DMARINGALIGN);
+		di->rxdalign = ((uint)di->rxd - (uint)va);
+		di->rxdpa = di->rxdpa + di->rxdalign;
+		ASSERT(ISALIGNED(di->rxd, DMARINGALIGN));
+	}
+
+	/* save tunables */
+	di->ntxd = ntxd;
+	di->nrxd = nrxd;
+	di->rxbufsize = rxbufsize;
+	di->nrxpost = nrxpost;
+	di->rxoffset = rxoffset;
+	di->ddoffset = ddoffset;
+	di->dataoffset = dataoffset;
+
+	return ((void*)di);
+
+fail:
+	dma_detach((void*)di);
+	return (NULL);
+}
+
+/* may be called with core in reset */
+void
+dma_detach(dma_info_t *di)
+{
+	if (di == NULL)
+		return;
+
+	DMA_TRACE(("%s: dma_detach\n", di->name));
+
+	/* shouldn't be here if descriptors are unreclaimed */
+	ASSERT(di->txin == di->txout);
+	ASSERT(di->rxin == di->rxout);
+
+	/* free dma descriptor rings */
+	if (di->txd)
+		DMA_FREE_CONSISTENT(di->dev, (void *)((uint)di->txd - di->txdalign), (DMAMAXRINGSZ + DMARINGALIGN), di->txdpa);
+	if (di->rxd)
+		DMA_FREE_CONSISTENT(di->dev, (void *)((uint)di->rxd - di->rxdalign), (DMAMAXRINGSZ + DMARINGALIGN), di->rxdpa);
+
+	/* free our private info structure */
+	MFREE((void*)di, sizeof (dma_info_t));
+}
+
+
+void
+dma_txreset(dma_info_t *di)
+{
+	uint32 status;
+
+	DMA_TRACE(("%s: dma_txreset\n", di->name));
+
+	/* suspend tx DMA first */
+	W_REG(&di->regs->xmtcontrol, XC_SE);
+	SPINWAIT((status = (R_REG(&di->regs->xmtstatus) & XS_XS_MASK)) != XS_XS_DISABLED &&
+		 status != XS_XS_IDLE &&
+		 status != XS_XS_STOPPED,
+		 10000);
+
+	W_REG(&di->regs->xmtcontrol, 0);
+	SPINWAIT((status = (R_REG(&di->regs->xmtstatus) & XS_XS_MASK)) != XS_XS_DISABLED,
+		 10000);
+
+	if (status != XS_XS_DISABLED) {
+		DMA_ERROR(("%s: dma_txreset: dma cannot be stopped\n", di->name));
+	}
+
+	/* wait for the last transaction to complete */
+	OSL_DELAY(300);
+}
+
+void
+dma_rxreset(dma_info_t *di)
+{
+	uint32 status;
+
+	DMA_TRACE(("%s: dma_rxreset\n", di->name));
+
+	W_REG(&di->regs->rcvcontrol, 0);
+	SPINWAIT((status = (R_REG(&di->regs->rcvstatus) & RS_RS_MASK)) != RS_RS_DISABLED,
+		 10000);
+
+	if (status != RS_RS_DISABLED) {
+		DMA_ERROR(("%s: dma_rxreset: dma cannot be stopped\n", di->name));
+	}
+}
+
+void
+dma_txinit(dma_info_t *di)
+{
+	DMA_TRACE(("%s: dma_txinit\n", di->name));
+
+	di->txin = di->txout = 0;
+	di->txavail = di->ntxd - 1;
+
+	/* clear tx descriptor ring */
+	BZERO_SM((void*)di->txd, (di->ntxd * sizeof (dmadd_t)));
+
+	W_REG(&di->regs->xmtcontrol, XC_XE);
+	W_REG(&di->regs->xmtaddr, (di->txdpa + di->ddoffset));
+}
+
+bool
+dma_txenabled(dma_info_t *di)
+{
+	uint32 xc;
+
+	/* If the chip is dead, it is not enabled :-) */
+	xc = R_REG(&di->regs->xmtcontrol);
+	return ((xc != 0xffffffff) && (xc & XC_XE));
+}
+
+void
+dma_txsuspend(dma_info_t *di)
+{
+	DMA_TRACE(("%s: dma_txsuspend\n", di->name));
+	OR_REG(&di->regs->xmtcontrol, XC_SE);
+}
+
+void
+dma_txresume(dma_info_t *di)
+{
+	DMA_TRACE(("%s: dma_txresume\n", di->name));
+	AND_REG(&di->regs->xmtcontrol, ~XC_SE);
+}
+
+bool
+dma_txsuspended(dma_info_t *di)
+{
+	uint32 xc;
+	uint32 xs;
+
+	xc = R_REG(&di->regs->xmtcontrol);
+	if (xc & XC_SE) {
+		xs = R_REG(&di->regs->xmtstatus);
+		return ((xs & XS_XS_MASK) == XS_XS_IDLE);
+	}
+	return 0;
+}
+
+bool
+dma_txstopped(dma_info_t *di)
+{
+	return ((R_REG(&di->regs->xmtstatus) & XS_XS_MASK) == XS_XS_STOPPED);
+}
+
+bool
+dma_rxstopped(dma_info_t *di)
+{
+	return ((R_REG(&di->regs->rcvstatus) & RS_RS_MASK) == RS_RS_STOPPED);
+}
+
+void
+dma_fifoloopbackenable(dma_info_t *di)
+{
+	DMA_TRACE(("%s: dma_fifoloopbackenable\n", di->name));
+	OR_REG(&di->regs->xmtcontrol, XC_LE);
+}
+
+void
+dma_rxinit(dma_info_t *di)
+{
+	DMA_TRACE(("%s: dma_rxinit\n", di->name));
+
+	di->rxin = di->rxout = 0;
+
+	/* clear rx descriptor ring */
+	BZERO_SM((void*)di->rxd, (di->nrxd * sizeof (dmadd_t)));
+
+	dma_rxenable(di);
+	W_REG(&di->regs->rcvaddr, (di->rxdpa + di->ddoffset));
+}
+
+void
+dma_rxenable(dma_info_t *di)
+{
+	DMA_TRACE(("%s: dma_rxenable\n", di->name));
+	W_REG(&di->regs->rcvcontrol, ((di->rxoffset << RC_RO_SHIFT) | RC_RE));
+}
+
+bool
+dma_rxenabled(dma_info_t *di)
+{
+	uint32 rc;
+
+	rc = R_REG(&di->regs->rcvcontrol);
+	return ((rc != 0xffffffff) && (rc & RC_RE));
+}
+
+/*
+ * The BCM47XX family supports full 32bit dma engine buffer addressing so
+ * dma buffers can cross 4 Kbyte page boundaries.
+ */
+int
+dma_txfast(dma_info_t *di, void *p0, uint32 coreflags)
+{
+	void *p, *next;
+	uchar *data;
+	uint len;
+	uint txout;
+	uint32 ctrl;
+	uint32 pa;
+
+	DMA_TRACE(("%s: dma_txfast\n", di->name));
+
+	txout = di->txout;
+	ctrl = 0;
+
+	/*
+	 * Walk the chain of packet buffers
+	 * allocating and initializing transmit descriptor entries.
+	 */
+	for (p = p0; p; p = next) {
+		data = PKTDATA(di->drv, p);
+		len = PKTLEN(di->drv, p);
+		next = PKTNEXT(di->drv, p);
+
+		/* return nonzero if out of tx descriptors */
+		if (NEXTTXD(txout) == di->txin)
+			goto outoftxd;
+
+		if (len == 0)
+			continue;
+
+		/* get physical address of buffer start */
+		pa = (uint32) DMA_MAP(di->dev, data, len, DMA_TX, p);
+
+		/* build the descriptor control value */
+		ctrl = len & CTRL_BC_MASK;
+
+		ctrl |= coreflags;
+		
+		if (p == p0)
+			ctrl |= CTRL_SOF;
+		if (next == NULL)
+			ctrl |= (CTRL_IOC | CTRL_EOF);
+		if (txout == (di->ntxd - 1))
+			ctrl |= CTRL_EOT;
+
+		/* init the tx descriptor */
+		W_SM(&di->txd[txout].ctrl, BUS_SWAP32(ctrl));
+		W_SM(&di->txd[txout].addr, BUS_SWAP32(pa + di->dataoffset));
+
+		ASSERT(di->txp[txout] == NULL);
+
+		txout = NEXTTXD(txout);
+	}
+
+	/* if last txd eof not set, fix it */
+	if (!(ctrl & CTRL_EOF))
+		W_SM(&di->txd[PREVTXD(txout)].ctrl, BUS_SWAP32(ctrl | CTRL_IOC | CTRL_EOF));
+
+	/* save the packet */
+	di->txp[PREVTXD(txout)] = p0;
+
+	/* bump the tx descriptor index */
+	di->txout = txout;
+
+	/* kick the chip */
+	W_REG(&di->regs->xmtptr, I2B(txout));
+
+	/* tx flow control */
+	di->txavail = di->ntxd - NTXDACTIVE(di->txin, di->txout) - 1;
+
+	return (0);
+
+outoftxd:
+	DMA_ERROR(("%s: dma_txfast: out of txds\n", di->name));
+	PKTFREE(di->drv, p0, TRUE);
+	di->txavail = 0;
+	di->hnddma.txnobuf++;
+	return (-1);
+}
+
+#define	PAGESZ		4096
+#define	PAGEBASE(x)	((uint)(x) & ~4095)
+
+/*
+ * Just like above except go through the extra effort of splitting
+ * buffers that cross 4Kbyte boundaries into multiple tx descriptors.
+ */
+int
+dma_tx(dma_info_t *di, void *p0, uint32 coreflags)
+{
+	void *p, *next;
+	uchar *data;
+	uint plen, len;
+	uchar *page, *start, *end;
+	uint txout;
+	uint32 ctrl;
+	uint32 pa;
+
+	DMA_TRACE(("%s: dma_tx\n", di->name));
+
+	txout = di->txout;
+	ctrl = 0;
+
+	/*
+	 * Walk the chain of packet buffers
+	 * splitting those that cross 4 Kbyte boundaries
+	 * allocating and initializing transmit descriptor entries.
+	 */
+	for (p = p0; p; p = next) {
+		data = PKTDATA(di->drv, p);
+		plen = PKTLEN(di->drv, p);
+		next = PKTNEXT(di->drv, p);
+
+		if (plen == 0)
+			continue;
+
+		for (page = (uchar*)PAGEBASE(data);
+			page <= (uchar*)PAGEBASE(data + plen - 1);
+			page += PAGESZ) {
+
+			/* return nonzero if out of tx descriptors */
+			if (NEXTTXD(txout) == di->txin)
+				goto outoftxd;
+
+			start = (page == (uchar*)PAGEBASE(data))?  data: page;
+			end = (page == (uchar*)PAGEBASE(data + plen))?
+				(data + plen): (page + PAGESZ);
+			len = end - start;
+
+			/* build the descriptor control value */
+			ctrl = len & CTRL_BC_MASK;
+
+			ctrl |= coreflags;
+
+			if ((p == p0) && (start == data))
+				ctrl |= CTRL_SOF;
+			if ((next == NULL) && (end == (data + plen)))
+				ctrl |= (CTRL_IOC | CTRL_EOF);
+			if (txout == (di->ntxd - 1))
+				ctrl |= CTRL_EOT;
+
+			/* get physical address of buffer start */
+			pa = (uint32) DMA_MAP(di->dev, start, len, DMA_TX, p);
+
+			/* init the tx descriptor */
+			W_SM(&di->txd[txout].ctrl, BUS_SWAP32(ctrl));
+			W_SM(&di->txd[txout].addr, BUS_SWAP32(pa + di->dataoffset));
+
+			ASSERT(di->txp[txout] == NULL);
+
+			txout = NEXTTXD(txout);
+		}
+	}
+
+	/* if last txd eof not set, fix it */
+	if (!(ctrl & CTRL_EOF))
+		W_SM(&di->txd[PREVTXD(txout)].ctrl, BUS_SWAP32(ctrl | CTRL_IOC | CTRL_EOF));
+
+	/* save the packet */
+	di->txp[PREVTXD(txout)] = p0;
+
+	/* bump the tx descriptor index */
+	di->txout = txout;
+
+	/* kick the chip */
+	W_REG(&di->regs->xmtptr, I2B(txout));
+
+	/* tx flow control */
+	di->txavail = di->ntxd - NTXDACTIVE(di->txin, di->txout) - 1;
+
+	return (0);
+
+outoftxd:
+	DMA_ERROR(("%s: dma_tx: out of txds\n", di->name));
+	PKTFREE(di->drv, p0, TRUE);
+	di->txavail = 0;
+	di->hnddma.txnobuf++;
+	return (-1);
+}
+
+/* returns a pointer to the next frame received, or NULL if there are no more */
+void*
+dma_rx(dma_info_t *di)
+{
+	void *p;
+	uint len;
+	int skiplen = 0;
+
+	while ((p = dma_getnextrxp(di, FALSE))) {
+		/* skip giant packets which span multiple rx descriptors */
+		if (skiplen > 0) {
+			skiplen -= di->rxbufsize;
+			if (skiplen < 0)
+				skiplen = 0;
+			PKTFREE(di->drv, p, FALSE);
+			continue;
+		}
+
+		len = ltoh16(*(uint16*)(PKTDATA(di->drv, p)));
+		DMA_TRACE(("%s: dma_rx len %d\n", di->name, len));
+
+		/* bad frame length check */
+		if (len > (di->rxbufsize - di->rxoffset)) {
+			DMA_ERROR(("%s: dma_rx: bad frame length (%d)\n", di->name, len));
+			if (len > 0)
+				skiplen = len - (di->rxbufsize - di->rxoffset);
+			PKTFREE(di->drv, p, FALSE);
+			di->hnddma.rxgiants++;
+			continue;
+		}
+
+		/* set actual length */
+		PKTSETLEN(di->drv, p, (di->rxoffset + len));
+
+		break;
+	}
+
+	return (p);
+}
+
+/* post receive buffers */
+void
+dma_rxfill(dma_info_t *di)
+{
+	void *p;
+	uint rxin, rxout;
+	uint ctrl;
+	uint n;
+	uint i;
+	uint32 pa;
+	uint rxbufsize;
+
+	/*
+	 * Determine how many receive buffers we're lacking
+	 * from the full complement, allocate, initialize,
+	 * and post them, then update the chip rx lastdscr.
+	 */
+
+	rxin = di->rxin;
+	rxout = di->rxout;
+	rxbufsize = di->rxbufsize;
+
+	n = di->nrxpost - NRXDACTIVE(rxin, rxout);
+
+	DMA_TRACE(("%s: dma_rxfill: post %d\n", di->name, n));
+
+	for (i = 0; i < n; i++) {
+		if ((p = PKTGET(di->drv, rxbufsize, FALSE)) == NULL) {
+			DMA_ERROR(("%s: dma_rxfill: out of rxbufs\n", di->name));
+			di->hnddma.rxnobuf++;
+			break;
+		}
+
+		*(uint32*)(OSL_UNCACHED(PKTDATA(di->drv, p))) = 0;
+
+		pa = (uint32) DMA_MAP(di->dev, PKTDATA(di->drv, p), rxbufsize, DMA_RX, p);
+		ASSERT(ISALIGNED(pa, 4));
+
+		/* save the free packet pointer */
+		ASSERT(di->rxp[rxout] == NULL);
+		di->rxp[rxout] = p;
+
+		/* prep the descriptor control value */
+		ctrl = rxbufsize;
+		if (rxout == (di->nrxd - 1))
+			ctrl |= CTRL_EOT;
+
+		/* init the rx descriptor */
+		W_SM(&di->rxd[rxout].ctrl, BUS_SWAP32(ctrl));
+		W_SM(&di->rxd[rxout].addr, BUS_SWAP32(pa + di->dataoffset));
+
+		rxout = NEXTRXD(rxout);
+	}
+
+	di->rxout = rxout;
+
+	/* update the chip lastdscr pointer */
+	W_REG(&di->regs->rcvptr, I2B(rxout));
+}
+
+void
+dma_txreclaim(dma_info_t *di, bool forceall)
+{
+	void *p;
+
+	DMA_TRACE(("%s: dma_txreclaim %s\n", di->name, forceall ? "all" : ""));
+
+	while ((p = dma_getnexttxp(di, forceall)))
+		PKTFREE(di->drv, p, TRUE);
+}
+
+/*
+ * Reclaim next completed txd (txds if using chained buffers) and
+ * return associated packet.
+ * If 'force' is true, reclaim txd(s) and return associated packet
+ * regardless of the value of the hardware "curr" pointer.
+ */
+void*
+dma_getnexttxp(dma_info_t *di, bool forceall)
+{
+	uint start, end, i;
+	void *txp;
+
+	DMA_TRACE(("%s: dma_getnexttxp %s\n", di->name, forceall ? "all" : ""));
+
+	txp = NULL;
+
+	start = di->txin;
+	if (forceall)
+		end = di->txout;
+	else
+		end = B2I(R_REG(&di->regs->xmtstatus) & XS_CD_MASK);
+
+	if ((start == 0) && (end > di->txout))
+		goto bogus;
+
+	for (i = start; i != end && !txp; i = NEXTTXD(i)) {
+		DMA_UNMAP(di->dev, (BUS_SWAP32(R_SM(&di->txd[i].addr)) - di->dataoffset),
+			  (BUS_SWAP32(R_SM(&di->txd[i].ctrl)) & CTRL_BC_MASK), DMA_TX, di->txp[i]);
+		W_SM(&di->txd[i].addr, 0xdeadbeef);
+		txp = di->txp[i];
+		di->txp[i] = NULL;
+	}
+
+	di->txin = i;
+
+	/* tx flow control */
+	di->txavail = di->ntxd - NTXDACTIVE(di->txin, di->txout) - 1;
+
+	return (txp);
+
+bogus:
+/*
+	DMA_ERROR(("dma_getnexttxp: bogus curr: start %d end %d txout %d force %d\n",
+		start, end, di->txout, forceall));
+*/
+	return (NULL);
+}
+
+void
+dma_rxreclaim(dma_info_t *di)
+{
+	void *p;
+
+	DMA_TRACE(("%s: dma_rxreclaim\n", di->name));
+
+	while ((p = dma_getnextrxp(di, TRUE)))
+		PKTFREE(di->drv, p, FALSE);
+}
+
+void *
+dma_getnextrxp(dma_info_t *di, bool forceall)
+{
+	uint i;
+	void *rxp;
+
+	/* if forcing, dma engine must be disabled */
+	ASSERT(!forceall || !dma_rxenabled(di));
+
+	i = di->rxin;
+
+	/* return if no packets posted */
+	if (i == di->rxout)
+		return (NULL);
+
+	/* ignore curr if forceall */
+	if (!forceall && (i == B2I(R_REG(&di->regs->rcvstatus) & RS_CD_MASK)))
+		return (NULL);
+
+	/* get the packet pointer that corresponds to the rx descriptor */
+	rxp = di->rxp[i];
+	ASSERT(rxp);
+	di->rxp[i] = NULL;
+
+	/* clear this packet from the descriptor ring */
+	DMA_UNMAP(di->dev, (BUS_SWAP32(R_SM(&di->rxd[i].addr)) - di->dataoffset),
+		  di->rxbufsize, DMA_RX, rxp);
+	W_SM(&di->rxd[i].addr, 0xdeadbeef);
+
+	di->rxin = NEXTRXD(i);
+
+	return (rxp);
+}
+
+char*
+dma_dumptx(dma_info_t *di, char *buf)
+{
+	buf += sprintf(buf, "txd 0x%lx txdpa 0x%lx txp 0x%lx txin %d txout %d txavail %d\n",
+		(ulong)di->txd, di->txdpa, (ulong)di->txp, di->txin, di->txout, di->txavail);
+	buf += sprintf(buf, "xmtcontrol 0x%x xmtaddr 0x%x xmtptr 0x%x xmtstatus 0x%x\n",
+		R_REG(&di->regs->xmtcontrol),
+		R_REG(&di->regs->xmtaddr),
+		R_REG(&di->regs->xmtptr),
+		R_REG(&di->regs->xmtstatus));
+	return (buf);
+}
+
+char*
+dma_dumprx(dma_info_t *di, char *buf)
+{
+	buf += sprintf(buf, "rxd 0x%lx rxdpa 0x%lx rxp 0x%lx rxin %d rxout %d\n",
+		(ulong)di->rxd, di->rxdpa, (ulong)di->rxp, di->rxin, di->rxout);
+	buf += sprintf(buf, "rcvcontrol 0x%x rcvaddr 0x%x rcvptr 0x%x rcvstatus 0x%x\n",
+		R_REG(&di->regs->rcvcontrol),
+		R_REG(&di->regs->rcvaddr),
+		R_REG(&di->regs->rcvptr),
+		R_REG(&di->regs->rcvstatus));
+	return (buf);
+}
+
+char*
+dma_dump(dma_info_t *di, char *buf)
+{
+	buf = dma_dumptx(di, buf);
+	buf = dma_dumprx(di, buf);
+	return (buf);
+}
+
+uint
+dma_getvar(dma_info_t *di, char *name)
+{
+	if (!strcmp(name, "&txavail"))
+		return ((uint) &di->txavail);
+	else {
+		ASSERT(0);
+	}
+	return (0);
+}
+
+void
+dma_txblock(dma_info_t *di)
+{
+	di->txavail = 0;
+}
+
+void
+dma_txunblock(dma_info_t *di)
+{
+	di->txavail = di->ntxd - NTXDACTIVE(di->txin, di->txout) - 1;
+}
+
+uint
+dma_txactive(dma_info_t *di)
+{
+	return (NTXDACTIVE(di->txin, di->txout));
+}
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/broadcom/linux_osl.c linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/linux_osl.c
--- linux-2.6.12.5/arch/mips/bcm947xx/broadcom/linux_osl.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/linux_osl.c	2005-08-28 11:12:20.476852160 +0200
@@ -0,0 +1,420 @@
+/*
+ * Linux OS Independent Layer
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#define LINUX_OSL
+
+#include <typedefs.h>
+#include <bcmendian.h>
+#include <linuxver.h>
+#include <linux_osl.h>
+#include <bcmutils.h>
+#include <linux/delay.h>
+#ifdef mips
+#include <asm/paccess.h>
+#endif
+#include <pcicfg.h>
+
+#define PCI_CFG_RETRY 10	
+
+void*
+osl_pktget(void *drv, uint len, bool send)
+{
+	struct sk_buff *skb;
+
+	if ((skb = dev_alloc_skb(len)) == NULL)
+		return (NULL);
+
+	skb_put(skb, len);
+
+	/* ensure the cookie field is cleared */ 
+	PKTSETCOOKIE(skb, NULL);
+
+	return ((void*) skb);
+}
+
+void
+osl_pktfree(void *p)
+{
+	struct sk_buff *skb, *nskb;
+
+	skb = (struct sk_buff*) p;
+
+	/* perversion: we use skb->next to chain multi-skb packets */
+	while (skb) {
+		nskb = skb->next;
+		skb->next = NULL;
+		if (skb->destructor) {
+			/* cannot kfree_skb() on hard IRQ (net/core/skbuff.c) if destructor exists */
+			dev_kfree_skb_any(skb);
+		} else {
+			/* can free immediately (even in_irq()) if destructor does not exist */
+			dev_kfree_skb(skb);
+		}
+		skb = nskb;
+	}
+}
+
+uint32
+osl_pci_read_config(void *loc, uint offset, uint size)
+{
+	struct pci_dev *pdev;
+	uint val;
+	uint retry=PCI_CFG_RETRY;	 
+
+	/* only 4byte access supported */
+	ASSERT(size == 4);
+
+	pdev = (struct pci_dev*)loc;
+	do {
+		pci_read_config_dword(pdev, offset, &val);
+		if (val != 0xffffffff)
+			break;
+	} while (retry--);
+
+
+	return (val);
+}
+
+void
+osl_pci_write_config(void *loc, uint offset, uint size, uint val)
+{
+	struct pci_dev *pdev;
+	uint retry=PCI_CFG_RETRY;	 
+
+	/* only 4byte access supported */
+	ASSERT(size == 4);
+
+	pdev = (struct pci_dev*)loc;
+
+	do {
+		pci_write_config_dword(pdev, offset, val);
+		if (offset!=PCI_BAR0_WIN)
+			break;
+		if (osl_pci_read_config(loc,offset,size) == val) 
+			break;
+	} while (retry--);
+
+}
+
+void
+osl_pcmcia_read_attr(void *osh, uint offset, void *buf, int size)
+{
+	ASSERT(0);
+}
+
+void
+osl_pcmcia_write_attr(void *osh, uint offset, void *buf, int size)
+{
+	ASSERT(0);
+}
+
+void
+osl_assert(char *exp, char *file, int line)
+{
+	char tempbuf[255];
+
+	sprintf(tempbuf, "assertion \"%s\" failed: file \"%s\", line %d\n", exp, file, line);
+	panic(tempbuf);
+}
+
+/*
+ * BINOSL selects the slightly slower function-call-based binary compatible osl.
+ */
+#ifdef BINOSL
+
+int
+osl_printf(const char *format, ...)
+{
+	va_list args;
+	char buf[1024];
+	int len;
+
+	/* sprintf into a local buffer because there *is* no "vprintk()".. */
+	va_start(args, format);
+	len = vsprintf(buf, format, args);
+	va_end(args);
+
+	if (len > sizeof (buf)) {
+		printk("osl_printf: buffer overrun\n");
+		return (0);
+	}
+
+	return (printk(buf));
+}
+
+int
+osl_sprintf(char *buf, const char *format, ...)
+{
+	va_list args;
+	int rc;
+
+	va_start(args, format);
+	rc = vsprintf(buf, format, args);
+	va_end(args);
+	return (rc);
+}
+
+int
+osl_strcmp(const char *s1, const char *s2)
+{
+	return (strcmp(s1, s2));
+}
+
+int
+osl_strncmp(const char *s1, const char *s2, uint n)
+{
+	return (strncmp(s1, s2, n));
+}
+
+int
+osl_strlen(char *s)
+{
+	return (strlen(s));
+}
+
+char*
+osl_strcpy(char *d, const char *s)
+{
+	return (strcpy(d, s));
+}
+
+char*
+osl_strncpy(char *d, const char *s, uint n)
+{
+	return (strncpy(d, s, n));
+}
+
+void
+bcopy(const void *src, void *dst, int len)
+{
+	memcpy(dst, src, len);
+}
+
+int
+bcmp(const void *b1, const void *b2, int len)
+{
+	return (memcmp(b1, b2, len));
+}
+
+void
+bzero(void *b, int len)
+{
+	memset(b, '\0', len);
+}
+
+void*
+osl_malloc(uint size)
+{
+	return (kmalloc(size, GFP_ATOMIC));
+}
+
+void
+osl_mfree(void *addr, uint size)
+{
+	kfree(addr);
+}
+
+uint32
+osl_readl(volatile uint32 *r)
+{
+	return (readl(r));
+}
+
+uint16
+osl_readw(volatile uint16 *r)
+{
+	return (readw(r));
+}
+
+uint8
+osl_readb(volatile uint8 *r)
+{
+	return (readb(r));
+}
+
+void
+osl_writel(uint32 v, volatile uint32 *r)
+{
+	writel(v, r);
+}
+
+void
+osl_writew(uint16 v, volatile uint16 *r)
+{
+	writew(v, r);
+}
+
+void
+osl_writeb(uint8 v, volatile uint8 *r)
+{
+	writeb(v, r);
+}
+
+void *
+osl_uncached(void *va)
+{
+#ifdef mips
+	return ((void*)KSEG1ADDR(va));
+#else
+	return ((void*)va);
+#endif
+}
+
+uint
+osl_getcycles(void)
+{
+	uint cycles;
+
+#if defined(mips)
+	cycles = read_c0_count() * 2;
+#elif defined(__i386__)
+	rdtscl(cycles);
+#else
+	cycles = 0;
+#endif
+	return cycles;
+}
+
+void *
+osl_reg_map(uint32 pa, uint size)
+{
+	return (ioremap_nocache((unsigned long)pa, (unsigned long)size));
+}
+
+void
+osl_reg_unmap(void *va)
+{
+	iounmap(va);
+}
+
+int
+osl_busprobe(uint32 *val, uint32 addr)
+{
+#ifdef mips
+	return get_dbe(*val, (uint32*)addr);
+#else
+	*val = readl(addr);
+	return 0;
+#endif
+}
+
+void*
+osl_dma_alloc_consistent(void *dev, uint size, ulong *pap)
+{
+	return (pci_alloc_consistent((struct pci_dev*)dev, size, (dma_addr_t*)pap));
+}
+
+void
+osl_dma_free_consistent(void *dev, void *va, uint size, ulong pa)
+{
+	pci_free_consistent((struct pci_dev*)dev, size, va, (dma_addr_t)pa);
+}
+
+uint
+osl_dma_map(void *dev, void *va, uint size, int direction)
+{
+	int dir;
+
+	dir = (direction == DMA_TX)? PCI_DMA_TODEVICE: PCI_DMA_FROMDEVICE;
+	return (pci_map_single(dev, va, size, dir));
+}
+
+void
+osl_dma_unmap(void *dev, uint pa, uint size, int direction)
+{
+	int dir;
+
+	dir = (direction == DMA_TX)? PCI_DMA_TODEVICE: PCI_DMA_FROMDEVICE;
+	pci_unmap_single(dev, (uint32)pa, size, dir);
+}
+
+void
+osl_delay(uint usec)
+{
+	udelay(usec);
+}
+
+uchar*
+osl_pktdata(void *drv, void *skb)
+{
+	return (((struct sk_buff*)skb)->data);
+}
+
+uint
+osl_pktlen(void *drv, void *skb)
+{
+	return (((struct sk_buff*)skb)->len);
+}
+
+void*
+osl_pktnext(void *drv, void *skb)
+{
+	return (((struct sk_buff*)skb)->next);
+}
+
+void
+osl_pktsetnext(void *skb, void *x)
+{
+	((struct sk_buff*)skb)->next = (struct sk_buff*)x;
+}
+
+void
+osl_pktsetlen(void *drv, void *skb, uint len)
+{
+	__skb_trim((struct sk_buff*)skb, len);
+}
+
+uchar*
+osl_pktpush(void *drv, void *skb, int bytes)
+{
+	return (skb_push((struct sk_buff*)skb, bytes));
+}
+
+uchar*
+osl_pktpull(void *drv, void *skb, int bytes)
+{
+	return (skb_pull((struct sk_buff*)skb, bytes));
+}
+
+void*
+osl_pktdup(void *drv, void *skb)
+{
+	return (skb_clone((struct sk_buff*)skb, GFP_ATOMIC));
+}
+
+void*
+osl_pktcookie(void *skb)
+{
+	return ((void*)((struct sk_buff*)skb)->csum);
+}
+
+void
+osl_pktsetcookie(void *skb, void *x)
+{
+	((struct sk_buff*)skb)->csum = (uint)x;
+}
+
+void*
+osl_pktlink(void *skb)
+{
+	return (((struct sk_buff*)skb)->prev);
+}
+
+void
+osl_pktsetlink(void *skb, void *x)
+{
+	((struct sk_buff*)skb)->prev = (struct sk_buff*)x;
+}
+
+#endif
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/broadcom/sbmips.c linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/sbmips.c
--- linux-2.6.12.5/arch/mips/bcm947xx/broadcom/sbmips.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/sbmips.c	2005-08-28 11:12:20.478851856 +0200
@@ -0,0 +1,950 @@
+/*
+ * BCM47XX Sonics SiliconBackplane MIPS core routines
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <sbutils.h>
+#include <bcmdevs.h>
+#include <bcmnvram.h>
+#include <bcmutils.h>
+#include <hndmips.h>
+#include <sbconfig.h>
+#include <sbextif.h>
+#include <sbchipc.h>
+#include <sbmemc.h>
+
+/*
+ * Memory segments (32bit kernel mode addresses)
+ */
+#undef KUSEG
+#undef KSEG0
+#undef KSEG1
+#undef KSEG2
+#undef KSEG3
+#define KUSEG		0x00000000
+#define KSEG0		0x80000000
+#define KSEG1		0xa0000000
+#define KSEG2		0xc0000000
+#define KSEG3		0xe0000000
+
+/*
+ * Map an address to a certain kernel segment
+ */
+#undef KSEG0ADDR
+#undef KSEG1ADDR
+#undef KSEG2ADDR
+#undef KSEG3ADDR
+#define KSEG0ADDR(a)		(((a) & 0x1fffffff) | KSEG0)
+#define KSEG1ADDR(a)		(((a) & 0x1fffffff) | KSEG1)
+#define KSEG2ADDR(a)		(((a) & 0x1fffffff) | KSEG2)
+#define KSEG3ADDR(a)		(((a) & 0x1fffffff) | KSEG3)
+
+/*
+ * The following macros are especially useful for __asm__
+ * inline assembler.
+ */
+#ifndef __STR
+#define __STR(x) #x
+#endif
+#ifndef STR
+#define STR(x) __STR(x)
+#endif
+
+/*  *********************************************************************
+    *  CP0 Registers 
+    ********************************************************************* */
+
+#define C0_INX		0		/* CP0: TLB Index */
+#define C0_RAND		1		/* CP0: TLB Random */
+#define C0_TLBLO0	2		/* CP0: TLB EntryLo0 */
+#define C0_TLBLO	C0_TLBLO0	/* CP0: TLB EntryLo0 */
+#define C0_TLBLO1	3		/* CP0: TLB EntryLo1 */
+#define C0_CTEXT	4		/* CP0: Context */
+#define C0_PGMASK	5		/* CP0: TLB PageMask */
+#define C0_WIRED	6		/* CP0: TLB Wired */
+#define C0_BADVADDR	8		/* CP0: Bad Virtual Address */
+#define C0_COUNT 	9		/* CP0: Count */
+#define C0_TLBHI	10		/* CP0: TLB EntryHi */
+#define C0_COMPARE	11		/* CP0: Compare */
+#define C0_SR		12		/* CP0: Processor Status */
+#define C0_STATUS	C0_SR		/* CP0: Processor Status */
+#define C0_CAUSE	13		/* CP0: Exception Cause */
+#define C0_EPC		14		/* CP0: Exception PC */
+#define C0_PRID		15		/* CP0: Processor Revision Indentifier */
+#define C0_CONFIG	16		/* CP0: Config */
+#define C0_LLADDR	17		/* CP0: LLAddr */
+#define C0_WATCHLO	18		/* CP0: WatchpointLo */
+#define C0_WATCHHI	19		/* CP0: WatchpointHi */
+#define C0_XCTEXT	20		/* CP0: XContext */
+#define C0_DIAGNOSTIC	22		/* CP0: Diagnostic */
+#define C0_BROADCOM	C0_DIAGNOSTIC	/* CP0: Broadcom Register */
+#define C0_ECC		26		/* CP0: ECC */
+#define C0_CACHEERR	27		/* CP0: CacheErr */
+#define C0_TAGLO	28		/* CP0: TagLo */
+#define C0_TAGHI	29		/* CP0: TagHi */
+#define C0_ERREPC	30		/* CP0: ErrorEPC */
+
+/*
+ * Macros to access the system control coprocessor
+ */
+
+#define MFC0(source, sel)					\
+({								\
+	int __res;						\
+	__asm__ __volatile__(					\
+	".set\tnoreorder\n\t"					\
+	".set\tnoat\n\t"					\
+	".word\t"STR(0x40010000 | ((source)<<11) | (sel))"\n\t"	\
+	"move\t%0,$1\n\t"					\
+	".set\tat\n\t"						\
+	".set\treorder"						\
+	:"=r" (__res)						\
+	:							\
+	:"$1");							\
+	__res;							\
+})
+
+#define MTC0(source, sel, value)				\
+do {								\
+	__asm__ __volatile__(					\
+	".set\tnoreorder\n\t"					\
+	".set\tnoat\n\t"					\
+	"move\t$1,%z0\n\t"					\
+	".word\t"STR(0x40810000 | ((source)<<11) | (sel))"\n\t"	\
+	".set\tat\n\t"						\
+	".set\treorder"						\
+	:							\
+	:"Jr" (value)						\
+	:"$1");							\
+} while (0)
+
+/*
+ * R4x00 interrupt enable / cause bits
+ */
+#undef IE_SW0
+#undef IE_SW1
+#undef IE_IRQ0
+#undef IE_IRQ1
+#undef IE_IRQ2
+#undef IE_IRQ3
+#undef IE_IRQ4
+#undef IE_IRQ5
+#define IE_SW0		(1<< 8)
+#define IE_SW1		(1<< 9)
+#define IE_IRQ0		(1<<10)
+#define IE_IRQ1		(1<<11)
+#define IE_IRQ2		(1<<12)
+#define IE_IRQ3		(1<<13)
+#define IE_IRQ4		(1<<14)
+#define IE_IRQ5		(1<<15)
+
+/*
+ * Bitfields in the R4xx0 cp0 status register
+ */
+#define ST0_IE			0x00000001
+#define ST0_EXL			0x00000002
+#define ST0_ERL			0x00000004
+#define ST0_KSU			0x00000018
+#  define KSU_USER		0x00000010
+#  define KSU_SUPERVISOR	0x00000008
+#  define KSU_KERNEL		0x00000000
+#define ST0_UX			0x00000020
+#define ST0_SX			0x00000040
+#define ST0_KX 			0x00000080
+#define ST0_DE			0x00010000
+#define ST0_CE			0x00020000
+
+/*
+ * Status register bits available in all MIPS CPUs.
+ */
+#define ST0_IM			0x0000ff00
+#define ST0_CH			0x00040000
+#define ST0_SR			0x00100000
+#define ST0_TS			0x00200000
+#define ST0_BEV			0x00400000
+#define ST0_RE			0x02000000
+#define ST0_FR			0x04000000
+#define ST0_CU			0xf0000000
+#define ST0_CU0			0x10000000
+#define ST0_CU1			0x20000000
+#define ST0_CU2			0x40000000
+#define ST0_CU3			0x80000000
+#define ST0_XX			0x80000000	/* MIPS IV naming */
+
+/*
+ * Cache Operations
+ */
+
+#ifndef Fill_I
+#define Fill_I			0x14
+#endif
+
+#define cache_unroll(base,op)			\
+	__asm__ __volatile__("			\
+		.set noreorder;			\
+		.set mips3;			\
+		cache %1, (%0);			\
+		.set mips0;			\
+		.set reorder"			\
+		:				\
+		: "r" (base),			\
+		  "i" (op));
+
+/* 
+ * These are the UART port assignments, expressed as offsets from the base
+ * register.  These assignments should hold for any serial port based on
+ * a 8250, 16450, or 16550(A).
+ */
+
+#define UART_MCR	4	/* Out: Modem Control Register */
+#define UART_MSR	6	/* In:  Modem Status Register */
+#define UART_MCR_LOOP	0x10	/* Enable loopback test mode */
+
+/* 
+ * Returns TRUE if an external UART exists at the given base
+ * register.
+ */
+static bool
+serial_exists(uint8 *regs)
+{
+	uint8 save_mcr, status1;
+
+	save_mcr = R_REG(&regs[UART_MCR]);
+	W_REG(&regs[UART_MCR], UART_MCR_LOOP | 0x0a);
+	status1 = R_REG(&regs[UART_MSR]) & 0xf0;
+	W_REG(&regs[UART_MCR], save_mcr);
+
+	return (status1 == 0x90);
+}
+
+/* 
+ * Initializes UART access. The callback function will be called once
+ * per found UART.
+*/
+void
+sb_serial_init(void *sbh, void (*add)(void *regs, uint irq, uint baud_base, uint reg_shift))
+{
+	void *regs;
+	ulong base;
+	uint irq;
+	int i, n;
+
+	if ((regs = sb_setcore(sbh, SB_EXTIF, 0))) {
+		extifregs_t *eir = (extifregs_t *) regs;
+		sbconfig_t *sb;
+
+		/* Determine external UART register base */
+		sb = (sbconfig_t *)((ulong) eir + SBCONFIGOFF);
+		base = EXTIF_CFGIF_BASE(sb_base(R_REG(&sb->sbadmatch1)));
+
+		/* Determine IRQ */
+		irq = sb_irq(sbh);
+
+		/* Disable GPIO interrupt initially */
+		W_REG(&eir->gpiointpolarity, 0);
+		W_REG(&eir->gpiointmask, 0);
+
+		/* Search for external UARTs */
+		n = 2;
+		for (i = 0; i < 2; i++) {
+			regs = (void *) REG_MAP(base + (i * 8), 8);
+			if (serial_exists(regs)) {
+				/* Set GPIO 1 to be the external UART IRQ */
+				W_REG(&eir->gpiointmask, 2);
+				if (add)
+					add(regs, irq, 13500000, 0);
+			}
+		}
+
+		/* Add internal UART if enabled */
+		if (R_REG(&eir->corecontrol) & CC_UE)
+			if (add)
+				add((void *) &eir->uartdata, irq, sb_clock(sbh), 2);
+	} else if ((regs = sb_setcore(sbh, SB_CC, 0))) {
+		chipcregs_t *cc = (chipcregs_t *) regs;
+		uint32 rev, cap, pll, baud_base, div;
+
+		/* Determine core revision and capabilities */
+		rev = sb_corerev(sbh);
+		cap = R_REG(&cc->capabilities);
+		pll = cap & CAP_PLL_MASK;
+
+		/* Determine IRQ */
+		irq = sb_irq(sbh);
+
+		if (pll == PLL_TYPE1) {
+			/* PLL clock */
+			baud_base = sb_clock_rate(pll,
+						  R_REG(&cc->clockcontrol_n),
+						  R_REG(&cc->clockcontrol_m2));
+			div = 1;
+		} else if (rev >= 3) {
+			/* Internal backplane clock */
+			baud_base = sb_clock_rate(pll,
+						  R_REG(&cc->clockcontrol_n),
+						  R_REG(&cc->clockcontrol_sb));
+			div = 2;	/* Minimum divisor */
+			W_REG(&cc->uart_clkdiv, div);
+		} else {
+			/* Fixed internal backplane clock */
+			baud_base = 88000000;
+			div = 48;
+		}
+
+		/* Clock source depends on strapping if UartClkOverride is unset */
+		if ((rev > 0) && ((R_REG(&cc->corecontrol) & CC_UARTCLKO) == 0)) {
+			if ((cap & CAP_UCLKSEL) == CAP_UINTCLK) {
+				/* Internal divided backplane clock */
+				baud_base /= div;
+			} else {
+				/* Assume external clock of 1.8432 MHz */
+				baud_base = 1843200;
+			}
+		}
+
+		/* Add internal UARTs */
+		n = cap & CAP_UARTS_MASK;
+		for (i = 0; i < n; i++) {
+			/* Register offset changed after revision 0 */
+			if (rev)
+				regs = (void *)((ulong) &cc->uart0data + (i * 256));
+			else
+				regs = (void *)((ulong) &cc->uart0data + (i * 8));
+
+			if (add)
+				add(regs, irq, baud_base, 0);
+		}
+	}
+}
+
+/* Returns the SB interrupt flag of the current core. */
+uint32
+sb_flag(void *sbh)
+{
+	void *regs;
+	sbconfig_t *sb;
+
+	regs = sb_coreregs(sbh);
+	sb = (sbconfig_t *)((ulong) regs + SBCONFIGOFF);
+
+	return (R_REG(&sb->sbtpsflag) & SBTPS_NUM0_MASK);
+}
+
+static const uint32 sbips_int_mask[] = {
+	0,
+	SBIPS_INT1_MASK,
+	SBIPS_INT2_MASK,
+	SBIPS_INT3_MASK,
+	SBIPS_INT4_MASK
+};
+
+static const uint32 sbips_int_shift[] = {
+	0,
+	0,
+	SBIPS_INT2_SHIFT,
+	SBIPS_INT3_SHIFT,
+	SBIPS_INT4_SHIFT
+};
+
+/* 
+ * Returns the MIPS IRQ assignment of the current core. If unassigned,
+ * 0 is returned.
+ */
+uint
+sb_irq(void *sbh)
+{
+	uint idx;
+	void *regs;
+	sbconfig_t *sb;
+	uint32 flag, sbipsflag;
+	uint irq = 0;
+
+	flag = sb_flag(sbh);
+
+	idx = sb_coreidx(sbh);
+
+	if ((regs = sb_setcore(sbh, SB_MIPS, 0)) ||
+	    (regs = sb_setcore(sbh, SB_MIPS33, 0))) {
+		sb = (sbconfig_t *)((ulong) regs + SBCONFIGOFF);
+
+		/* sbipsflag specifies which core is routed to interrupts 1 to 4 */
+		sbipsflag = R_REG(&sb->sbipsflag);
+		for (irq = 1; irq <= 4; irq++) {
+			if (((sbipsflag & sbips_int_mask[irq]) >> sbips_int_shift[irq]) == flag)
+				break;
+		}
+		if (irq == 5)
+			irq = 0;
+	}
+
+	sb_setcoreidx(sbh, idx);
+
+	return irq;
+}
+
+/* Clears the specified MIPS IRQ. */
+static void
+sb_clearirq(void *sbh, uint irq)
+{
+	void *regs;
+	sbconfig_t *sb;
+
+	if (!(regs = sb_setcore(sbh, SB_MIPS, 0)) &&
+	    !(regs = sb_setcore(sbh, SB_MIPS33, 0)))
+		ASSERT(regs);
+	sb = (sbconfig_t *)((ulong) regs + SBCONFIGOFF);
+
+	if (irq == 0)
+		W_REG(&sb->sbintvec, 0);
+	else
+		OR_REG(&sb->sbipsflag, sbips_int_mask[irq]);
+}
+
+/* 
+ * Assigns the specified MIPS IRQ to the specified core. Shared MIPS
+ * IRQ 0 may be assigned more than once.
+ */
+static void
+sb_setirq(void *sbh, uint irq, uint coreid, uint coreunit)
+{
+	void *regs;
+	sbconfig_t *sb;
+	uint32 flag;
+
+	regs = sb_setcore(sbh, coreid, coreunit);
+	ASSERT(regs);
+	flag = sb_flag(sbh);
+
+	if (!(regs = sb_setcore(sbh, SB_MIPS, 0)) &&
+	    !(regs = sb_setcore(sbh, SB_MIPS33, 0)))
+		ASSERT(regs);
+	sb = (sbconfig_t *)((ulong) regs + SBCONFIGOFF);
+
+	if (irq == 0)
+		OR_REG(&sb->sbintvec, 1 << flag);
+	else {
+		flag <<= sbips_int_shift[irq];
+		ASSERT(!(flag & ~sbips_int_mask[irq]));
+		flag |= R_REG(&sb->sbipsflag) & ~sbips_int_mask[irq];
+		W_REG(&sb->sbipsflag, flag);
+	}
+}	
+
+/* 
+ * Initializes clocks and interrupts. SB and NVRAM access must be
+ * initialized prior to calling.
+ */
+void
+sb_mips_init(void *sbh)
+{
+	ulong hz, ns, tmp;
+	extifregs_t *eir;
+	chipcregs_t *cc;
+	char *value;
+	uint irq;
+
+	/* Figure out current SB clock speed */
+	if ((hz = sb_clock(sbh)) == 0)
+		hz = 100000000;
+	ns = 1000000000 / hz;
+
+	/* Setup external interface timing */
+	if ((eir = sb_setcore(sbh, SB_EXTIF, 0))) {
+		/* Initialize extif so we can get to the LEDs and external UART */
+		W_REG(&eir->prog_config, CF_EN);
+
+		/* Set timing for the flash */
+		tmp = CEIL(10, ns) << FW_W3_SHIFT;	/* W3 = 10nS */
+		tmp = tmp | (CEIL(40, ns) << FW_W1_SHIFT); /* W1 = 40nS */
+		tmp = tmp | CEIL(120, ns);		/* W0 = 120nS */
+		W_REG(&eir->prog_waitcount, tmp);	/* 0x01020a0c for a 100Mhz clock */
+
+		/* Set programmable interface timing for external uart */
+		tmp = CEIL(10, ns) << FW_W3_SHIFT;	/* W3 = 10nS */
+		tmp = tmp | (CEIL(20, ns) << FW_W2_SHIFT); /* W2 = 20nS */
+		tmp = tmp | (CEIL(100, ns) << FW_W1_SHIFT); /* W1 = 100nS */
+		tmp = tmp | CEIL(120, ns);		/* W0 = 120nS */
+		W_REG(&eir->prog_waitcount, tmp);	/* 0x01020a0c for a 100Mhz clock */
+	} else if ((cc = sb_setcore(sbh, SB_CC, 0))) {
+		/* Set timing for the flash */
+		tmp = CEIL(10, ns) << FW_W3_SHIFT;	/* W3 = 10nS */
+		tmp |= CEIL(10, ns) << FW_W1_SHIFT;	/* W1 = 10nS */
+		tmp |= CEIL(120, ns);			/* W0 = 120nS */
+		W_REG(&cc->parallelflashwaitcnt, tmp);
+
+		W_REG(&cc->cs01memwaitcnt, tmp);
+	}
+
+	/* Chip specific initialization */
+	switch (sb_chip(sbh)) {
+	case BCM4710_DEVICE_ID:
+		/* Clear interrupt map */
+		for (irq = 0; irq <= 4; irq++)
+			sb_clearirq(sbh, irq);
+		sb_setirq(sbh, 0, SB_CODEC, 0);
+		sb_setirq(sbh, 0, SB_EXTIF, 0);
+		sb_setirq(sbh, 2, SB_ENET, 1);
+		sb_setirq(sbh, 3, SB_ILINE20, 0);
+		sb_setirq(sbh, 4, SB_PCI, 0);
+		ASSERT(eir);
+		value = nvram_get("et0phyaddr");
+		if (value && !strcmp(value, "31")) {
+			/* Enable internal UART */
+			W_REG(&eir->corecontrol, CC_UE);
+			/* Give USB its own interrupt */
+			sb_setirq(sbh, 1, SB_USB, 0);
+		} else {
+			/* Disable internal UART */
+			W_REG(&eir->corecontrol, 0);
+			/* Give Ethernet its own interrupt */
+			sb_setirq(sbh, 1, SB_ENET, 0);
+			sb_setirq(sbh, 0, SB_USB, 0);
+		}
+		break;
+	case BCM4310_DEVICE_ID:
+		MTC0(C0_BROADCOM, 0, MFC0(C0_BROADCOM, 0) & ~(1 << 22));
+		break;
+	}
+}
+
+uint32
+sb_mips_clock(void *sbh)
+{
+	extifregs_t *eir;
+	chipcregs_t *cc;
+	uint32 n, m;
+	uint idx;
+	uint32 pll_type, rate = 0;
+
+	/* get index of the current core */
+	idx = sb_coreidx(sbh);
+	pll_type = PLL_TYPE1;
+
+	/* switch to extif or chipc core */
+	if ((eir = (extifregs_t *) sb_setcore(sbh, SB_EXTIF, 0))) {
+		n = R_REG(&eir->clockcontrol_n);
+		m = R_REG(&eir->clockcontrol_sb);
+	} else if ((cc = (chipcregs_t *) sb_setcore(sbh, SB_CC, 0))) {
+		pll_type = R_REG(&cc->capabilities) & CAP_PLL_MASK;
+		n = R_REG(&cc->clockcontrol_n);
+		if ((pll_type == PLL_TYPE2) || (pll_type == PLL_TYPE4))
+			m = R_REG(&cc->clockcontrol_mips);
+		else if (pll_type == PLL_TYPE3) {
+			rate = 200000000;
+			goto out;
+		} else
+			m = R_REG(&cc->clockcontrol_sb);
+	} else
+		goto out;
+
+	/* calculate rate */
+	rate = sb_clock_rate(pll_type, n, m);
+
+out:
+	/* switch back to previous core */
+	sb_setcoreidx(sbh, idx);
+
+	return rate;
+}
+
+static void
+icache_probe(int *size, int *lsize)
+{
+	uint32 config1;
+	uint sets, ways;
+
+	config1 = MFC0(C0_CONFIG, 1);
+
+	/* Instruction Cache Size = Associativity * Line Size * Sets Per Way */
+	if ((*lsize = ((config1 >> 19) & 7)))
+		*lsize = 2 << *lsize;
+	sets = 64 << ((config1 >> 22) & 7);
+	ways = 1 + ((config1 >> 16) & 7);
+	*size = *lsize * sets * ways;
+}
+
+#define ALLINTS (IE_IRQ0 | IE_IRQ1 | IE_IRQ2 | IE_IRQ3 | IE_IRQ4)
+
+static void
+handler(void)
+{
+	/* Step 11 */
+	__asm__ (
+		".set\tmips32\n\t"
+		"ssnop\n\t"
+		"ssnop\n\t"
+	/* Disable interrupts */
+	/*	MTC0(C0_STATUS, 0, MFC0(C0_STATUS, 0) & ~(ALLINTS | STO_IE)); */
+		"mfc0 $15, $12\n\t"
+		"and $15, $15, -31746\n\t"
+		"mtc0 $15, $12\n\t"
+		"eret\n\t"
+		"nop\n\t"
+		"nop\n\t"
+		".set\tmips0"
+	);
+}
+
+/* The following MUST come right after handler() */
+static void
+afterhandler(void)
+{
+}
+
+/*
+ * Set the MIPS, backplane and PCI clocks as closely as possible.
+ */
+bool
+sb_mips_setclock(void *sbh, uint32 mipsclock, uint32 sbclock, uint32 pciclock)
+{
+	extifregs_t *eir = NULL;
+	chipcregs_t *cc = NULL;
+	mipsregs_t *mipsr = NULL;
+	volatile uint32 *clockcontrol_n, *clockcontrol_sb, *clockcontrol_pci;
+	uint32 orig_n, orig_sb, orig_pci, orig_m2, orig_mips, orig_ratio_parm, new_ratio;
+	uint32 pll_type, sync_mode;
+	uint idx, i;
+	struct {
+		uint32 mipsclock;
+		uint16 n;
+		uint32 sb;
+		uint32 pci33;
+		uint32 pci25;
+	} type1_table[] = {
+		{  96000000, 0x0303, 0x04020011, 0x11030011, 0x11050011 }, /*  96.000 32.000 24.000 */
+		{ 100000000, 0x0009, 0x04020011, 0x11030011, 0x11050011 }, /* 100.000 33.333 25.000 */
+		{ 104000000, 0x0802, 0x04020011, 0x11050009, 0x11090009 }, /* 104.000 31.200 24.960 */
+		{ 108000000, 0x0403, 0x04020011, 0x11050009, 0x02000802 }, /* 108.000 32.400 24.923 */
+		{ 112000000, 0x0205, 0x04020011, 0x11030021, 0x02000403 }, /* 112.000 32.000 24.889 */
+		{ 115200000, 0x0303, 0x04020009, 0x11030011, 0x11050011 }, /* 115.200 32.000 24.000 */
+		{ 120000000, 0x0011, 0x04020011, 0x11050011, 0x11090011 }, /* 120.000 30.000 24.000 */
+		{ 124800000, 0x0802, 0x04020009, 0x11050009, 0x11090009 }, /* 124.800 31.200 24.960 */
+		{ 128000000, 0x0305, 0x04020011, 0x11050011, 0x02000305 }, /* 128.000 32.000 24.000 */
+		{ 132000000, 0x0603, 0x04020011, 0x11050011, 0x02000305 }, /* 132.000 33.000 24.750 */
+		{ 136000000, 0x0c02, 0x04020011, 0x11090009, 0x02000603 }, /* 136.000 32.640 24.727 */
+		{ 140000000, 0x0021, 0x04020011, 0x11050021, 0x02000c02 }, /* 140.000 30.000 24.706 */
+		{ 144000000, 0x0405, 0x04020011, 0x01020202, 0x11090021 }, /* 144.000 30.857 24.686 */
+		{ 150857142, 0x0605, 0x04020021, 0x02000305, 0x02000605 }, /* 150.857 33.000 24.000 */
+		{ 152000000, 0x0e02, 0x04020011, 0x11050021, 0x02000e02 }, /* 152.000 32.571 24.000 */
+		{ 156000000, 0x0802, 0x04020005, 0x11050009, 0x11090009 }, /* 156.000 31.200 24.960 */
+		{ 160000000, 0x0309, 0x04020011, 0x11090011, 0x02000309 }, /* 160.000 32.000 24.000 */
+		{ 163200000, 0x0c02, 0x04020009, 0x11090009, 0x02000603 }, /* 163.200 32.640 24.727 */
+		{ 168000000, 0x0205, 0x04020005, 0x11030021, 0x02000403 }, /* 168.000 32.000 24.889 */
+		{ 176000000, 0x0602, 0x04020003, 0x11050005, 0x02000602 }, /* 176.000 33.000 24.000 */
+	};
+	typedef struct {
+		uint32 mipsclock;
+		uint32 sbclock;
+		uint16 n;
+		uint32 sb;
+		uint32 pci33;
+		uint32 m2;
+		uint32 m3;
+		uint32 ratio;
+		uint32 ratio_parm;
+	} n4m_table_t;
+
+	n4m_table_t type2_table[] = {
+		{ 180000000,  80000000, 0x0403, 0x01010000, 0x01020300, 0x01020600, 0x05000100, 0x94, 0x012a0115 },
+		{ 180000000,  90000000, 0x0403, 0x01000100, 0x01020300, 0x01000100, 0x05000100, 0x21, 0x0aaa0555 },
+		{ 200000000, 100000000, 0x0303, 0x01000000, 0x01000600, 0x01000000, 0x05000000, 0x21, 0x0aaa0555 },
+		{ 211200000, 105600000, 0x0902, 0x01000200, 0x01030400, 0x01000200, 0x05000200, 0x21, 0x0aaa0555 },
+		{ 220800000, 110400000, 0x1500, 0x01000200, 0x01030400, 0x01000200, 0x05000200, 0x21, 0x0aaa0555 },
+		{ 230400000, 115200000, 0x0604, 0x01000200, 0x01020600, 0x01000200, 0x05000200, 0x21, 0x0aaa0555 },
+		{ 234000000, 104000000, 0x0b01, 0x01010000, 0x01010700, 0x01020600, 0x05000100, 0x94, 0x012a0115 },
+		{ 240000000, 120000000,	0x0803,	0x01000200, 0x01020600,	0x01000200, 0x05000200, 0x21, 0x0aaa0555 },
+		{ 252000000, 126000000,	0x0504,	0x01000100, 0x01020500,	0x01000100, 0x05000100, 0x21, 0x0aaa0555 },
+		{ 264000000, 132000000, 0x0903, 0x01000200, 0x01020700, 0x01000200, 0x05000200, 0x21, 0x0aaa0555 },
+		{ 270000000, 120000000, 0x0703, 0x01010000, 0x01030400, 0x01020600, 0x05000100, 0x94, 0x012a0115 },
+		{ 276000000, 122666666, 0x1500, 0x01010000, 0x01030400, 0x01020600, 0x05000100, 0x94, 0x012a0115 },
+		{ 280000000, 140000000, 0x0503, 0x01000000, 0x01010600, 0x01000000, 0x05000000, 0x21, 0x0aaa0555 },
+		{ 288000000, 128000000, 0x0604, 0x01010000, 0x01030400, 0x01020600, 0x05000100, 0x94, 0x012a0115 },
+		{ 288000000, 144000000, 0x0404, 0x01000000, 0x01010600, 0x01000000, 0x05000000, 0x21, 0x0aaa0555 },
+		{ 300000000, 133333333, 0x0803, 0x01010000, 0x01020600, 0x01020600, 0x05000100, 0x94, 0x012a0115 },
+		{ 300000000, 150000000, 0x0803, 0x01000100, 0x01020600, 0x01000100, 0x05000100, 0x21, 0x0aaa0555 }
+	};
+
+	n4m_table_t type4_table[] = {
+		{ 192000000,  96000000, 0x0702,	0x04020011, 0x11030011, 0x04020011, 0x04020003, 0x21, 0x0aaa0555 },
+		{ 200000000, 100000000, 0x0009,	0x04020011, 0x11030011, 0x04020011, 0x04020003, 0x21, 0x0aaa0555 },
+		{ 216000000, 108000000, 0x0211, 0x11020005, 0x11030303, 0x11020005, 0x04000005, 0x21, 0x0aaa0555 },
+		{ 228000000, 101333333, 0x0e02, 0x11030003, 0x11210005, 0x11030305, 0x04000005, 0x94, 0x012a00a9 },
+		{ 228000000, 114000000, 0x0e02, 0x11020005, 0x11210005, 0x11020005, 0x04000005, 0x21, 0x0aaa0555 },
+		{ 240000000, 120000000,	0x0109,	0x11030002, 0x01050203,	0x11030002, 0x04000003, 0x21, 0x0aaa0555 },
+		{ 252000000, 126000000,	0x0203,	0x04000005, 0x11050005,	0x04000005, 0x04000002, 0x21, 0x0aaa0555 },
+		{ 264000000, 132000000, 0x0602, 0x04000005, 0x11050005, 0x04000005, 0x04000002, 0x21, 0x0aaa0555 },
+		{ 272000000, 116571428, 0x0c02, 0x04000021, 0x02000909, 0x02000221, 0x04000003, 0x73, 0x254a14a9 },
+		{ 280000000, 120000000, 0x0209, 0x04000021, 0x01030303, 0x02000221, 0x04000003, 0x73, 0x254a14a9 },
+		{ 288000000, 123428571, 0x0111, 0x04000021, 0x01030303, 0x02000221, 0x04000003, 0x73, 0x254a14a9 },
+		{ 300000000, 120000000, 0x0009, 0x04000009, 0x01030203, 0x02000902, 0x04000002, 0x52, 0x02520129 }
+	};
+	uint icache_size, ic_lsize;
+	ulong start, end, dst;
+	bool ret = FALSE;
+
+	/* get index of the current core */
+	idx = sb_coreidx(sbh);
+
+	/* switch to extif or chipc core */
+	if ((eir = (extifregs_t *) sb_setcore(sbh, SB_EXTIF, 0))) {
+		pll_type = PLL_TYPE1;
+		clockcontrol_n = &eir->clockcontrol_n;
+		clockcontrol_sb = &eir->clockcontrol_sb;
+		clockcontrol_pci = &eir->clockcontrol_pci;
+	} else if ((cc = (chipcregs_t *) sb_setcore(sbh, SB_CC, 0))) {
+		pll_type = R_REG(&cc->capabilities) & CAP_PLL_MASK;
+		clockcontrol_n = &cc->clockcontrol_n;
+		clockcontrol_sb = &cc->clockcontrol_sb;
+		clockcontrol_pci = &cc->clockcontrol_pci;
+	} else
+		goto done;
+
+	/* Store the current clock register values */
+	orig_n = R_REG(clockcontrol_n);
+	orig_sb = R_REG(clockcontrol_sb);
+	orig_pci = R_REG(clockcontrol_pci);
+
+	if (pll_type == PLL_TYPE1) {
+		/* Keep the current PCI clock if not specified */
+		if (pciclock == 0) {
+			pciclock = sb_clock_rate(pll_type, R_REG(clockcontrol_n), R_REG(clockcontrol_pci));
+			pciclock = (pciclock <= 25000000) ? 25000000 : 33000000;
+		}
+
+		/* Search for the closest MIPS clock less than or equal to a preferred value */
+		for (i = 0; i < ARRAYSIZE(type1_table); i++) {
+			ASSERT(type1_table[i].mipsclock ==
+			       sb_clock_rate(pll_type, type1_table[i].n, type1_table[i].sb));
+			if (type1_table[i].mipsclock > mipsclock)
+				break;
+		}
+		if (i == 0) {
+			ret = FALSE;
+			goto done;
+		} else {
+			ret = TRUE;
+			i--;
+		}
+		ASSERT(type1_table[i].mipsclock <= mipsclock);
+
+		/* No PLL change */
+		if ((orig_n == type1_table[i].n) &&
+		    (orig_sb == type1_table[i].sb) &&
+		    (orig_pci == type1_table[i].pci33))
+			goto done;
+
+		/* Set the PLL controls */
+		W_REG(clockcontrol_n, type1_table[i].n);
+		W_REG(clockcontrol_sb, type1_table[i].sb);
+		if (pciclock == 25000000)
+			W_REG(clockcontrol_pci, type1_table[i].pci25);
+		else
+			W_REG(clockcontrol_pci, type1_table[i].pci33);
+
+		/* Reset */
+		sb_watchdog(sbh, 1);
+		while (1);
+	} else if ((pll_type == PLL_TYPE2) || (pll_type == PLL_TYPE4)) {
+		n4m_table_t *table = (pll_type == PLL_TYPE2) ? type2_table : type4_table;
+		uint tabsz = (pll_type == PLL_TYPE2) ? ARRAYSIZE(type2_table) : ARRAYSIZE(type4_table);
+
+		ASSERT(cc);
+
+		/* Store the current clock register values */
+		orig_m2 = R_REG(&cc->clockcontrol_m2);
+		orig_mips = R_REG(&cc->clockcontrol_mips);
+		orig_ratio_parm = 0;
+
+		/* Look up current ratio */
+		for (i = 0; i < tabsz; i++) {
+			if ((orig_n == table[i].n) &&
+			    (orig_sb == table[i].sb) &&
+			    (orig_pci == table[i].pci33) &&
+			    (orig_m2 == table[i].m2) &&
+			    (orig_mips == table[i].m3)) {
+				orig_ratio_parm = table[i].ratio_parm;
+				break;
+			}
+		}
+
+		/* Search for the closest MIPS clock greater or equal to a preferred value */
+		for (i = 0; i < tabsz; i++) {
+			ASSERT(table[i].mipsclock ==
+			       sb_clock_rate(pll_type, table[i].n, table[i].m3));
+			if ((mipsclock <= table[i].mipsclock) &&
+			    ((sbclock == 0) || (sbclock <= table[i].sbclock)))
+				break;
+		}
+		if (i == tabsz) {
+			ret = FALSE;
+			goto done;
+		} else {
+			ret = TRUE;
+		}
+
+		/* No PLL change */
+		if ((orig_n == table[i].n) &&
+		    (orig_sb == table[i].sb) &&
+		    (orig_pci == table[i].pci33) &&
+		    (orig_m2 == table[i].m2) &&
+		    (orig_mips == table[i].m3))
+			goto done;
+
+		/* Set the PLL controls */
+		W_REG(clockcontrol_n, table[i].n);
+		W_REG(clockcontrol_sb, table[i].sb);
+		W_REG(clockcontrol_pci, table[i].pci33);
+		W_REG(&cc->clockcontrol_m2, table[i].m2);
+		W_REG(&cc->clockcontrol_mips, table[i].m3);
+
+		/* No ratio change */
+		if (orig_ratio_parm == table[i].ratio_parm)
+			goto end_fill;
+
+		new_ratio = table[i].ratio_parm;
+
+		icache_probe(&icache_size, &ic_lsize);
+
+		/* Preload the code into the cache */
+		start = ((ulong) &&start_fill) & ~(ic_lsize - 1);
+		end = ((ulong) &&end_fill + (ic_lsize - 1)) & ~(ic_lsize - 1);
+		while (start < end) {
+			cache_unroll(start, Fill_I);
+			start += ic_lsize;
+		}
+
+		/* Copy the handler */
+		start = (ulong) &handler;
+		end = (ulong) &afterhandler;
+		dst = KSEG1ADDR(0x180);
+		for (i = 0; i < (end - start); i += 4)
+			*((ulong *)(dst + i)) = *((ulong *)(start + i));
+		
+		/* Preload handler into the cache one line at a time */
+		for (i = 0; i < (end - start); i += 4)
+			cache_unroll(dst + i, Fill_I);
+
+		/* Clear BEV bit */
+		MTC0(C0_STATUS, 0, MFC0(C0_STATUS, 0) & ~ST0_BEV);
+
+		/* Enable interrupts */
+		MTC0(C0_STATUS, 0, MFC0(C0_STATUS, 0) | (ALLINTS | ST0_IE));
+
+		/* Enable MIPS timer interrupt */
+		if (!(mipsr = sb_setcore(sbh, SB_MIPS, 0)) &&
+		    !(mipsr = sb_setcore(sbh, SB_MIPS33, 0)))
+			ASSERT(mipsr);
+		W_REG(&mipsr->intmask, 1);
+
+	start_fill:
+		/* step 1, set clock ratios */
+		MTC0(C0_BROADCOM, 3, new_ratio);
+		MTC0(C0_BROADCOM, 1, 8);
+
+		/* step 2: program timer intr */
+		W_REG(&mipsr->timer, 100);
+		(void) R_REG(&mipsr->timer);
+
+		/* step 3, switch to async */
+		sync_mode = MFC0(C0_BROADCOM, 4);
+		MTC0(C0_BROADCOM, 4, 1 << 22);
+
+		/* step 4, set cfg active */
+		MTC0(C0_BROADCOM, 2, 0x9);
+
+
+		/* steps 5 & 6 */ 
+		__asm__ __volatile__ (
+			".set\tmips3\n\t"
+			"wait\n\t"
+			".set\tmips0"
+		);
+
+		/* step 7, clear cfg_active */
+		MTC0(C0_BROADCOM, 2, 0);
+		
+		/* Additional Step: set back to orig sync mode */
+		MTC0(C0_BROADCOM, 4, sync_mode);
+
+		/* step 8, fake soft reset */
+		MTC0(C0_BROADCOM, 5, MFC0(C0_BROADCOM, 5) | 4);
+
+	end_fill:
+		/* step 9 set watchdog timer */
+		sb_watchdog(sbh, 20);
+		(void) R_REG(&cc->chipid);
+
+		/* step 11 */
+		__asm__ __volatile__ (
+			".set\tmips3\n\t"
+			"sync\n\t"
+			"wait\n\t"
+			".set\tmips0"
+		);
+		while (1);
+	}
+
+done:
+	/* switch back to previous core */
+	sb_setcoreidx(sbh, idx);
+
+	return ret;
+}
+
+
+/* returns the ncdl value to be programmed into sdram_ncdl for calibration */
+uint32
+sb_memc_get_ncdl(void *sbh)
+{
+	sbmemcregs_t *memc;
+	uint32 ret = 0;
+	uint32 config, rd, wr, misc, dqsg, cd, sm, sd;
+	uint idx, rev;
+
+	idx = sb_coreidx(sbh);
+
+	memc = (sbmemcregs_t *)sb_setcore(sbh, SB_MEMC, 0);
+	if (memc == 0)
+		goto out;
+
+	rev = sb_corerev(sbh);
+
+	config = R_REG(&memc->config);
+	wr = R_REG(&memc->wrncdlcor);
+	rd = R_REG(&memc->rdncdlcor);
+	misc = R_REG(&memc->miscdlyctl);
+	dqsg = R_REG(&memc->dqsgatencdl);
+
+	rd &= MEMC_RDNCDLCOR_RD_MASK;
+	wr &= MEMC_WRNCDLCOR_WR_MASK; 
+	dqsg &= MEMC_DQSGATENCDL_G_MASK;
+
+	if (config & MEMC_CONFIG_DDR) {
+		ret = (wr << 16) | (rd << 8) | dqsg;
+	} else {
+		if (rev > 0)
+			cd = rd;
+		else
+			cd = (rd == MEMC_CD_THRESHOLD) ? rd : (wr + MEMC_CD_THRESHOLD);
+		sm = (misc & MEMC_MISC_SM_MASK) >> MEMC_MISC_SM_SHIFT;
+		sd = (misc & MEMC_MISC_SD_MASK) >> MEMC_MISC_SD_SHIFT;
+		ret = (sm << 16) | (sd << 8) | cd;
+	}
+
+out:
+	/* switch back to previous core */
+	sb_setcoreidx(sbh, idx);
+
+	return ret;
+}
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/broadcom/sbpci.c linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/sbpci.c
--- linux-2.6.12.5/arch/mips/bcm947xx/broadcom/sbpci.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/sbpci.c	2005-08-28 11:12:20.479851704 +0200
@@ -0,0 +1,530 @@
+/*
+ * Low-Level PCI and SB support for BCM47xx
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#include <typedefs.h>
+#include <pcicfg.h>
+#include <bcmdevs.h>
+#include <sbconfig.h>
+#include <sbpci.h>
+#include <osl.h>
+#include <bcmendian.h>
+#include <bcmutils.h>
+#include <sbutils.h>
+#include <bcmnvram.h>
+#include <hndmips.h>
+
+/* Can free sbpci_init() memory after boot */
+#ifndef linux
+#define __init
+#endif
+
+/* Emulated configuration space */
+static pci_config_regs sb_config_regs[SB_MAXCORES];
+
+/* Banned cores */
+static uint16 pci_ban[32] = { 0 };
+static uint pci_banned = 0;
+
+/* CardBus mode */
+static bool cardbus = FALSE;
+
+/*
+ * Functions for accessing external PCI configuration space
+ */
+
+/* Assume one-hot slot wiring */
+#define PCI_SLOT_MAX 16
+
+static uint32
+config_cmd(void *sbh, uint bus, uint dev, uint func, uint off)
+{
+	uint coreidx;
+	sbpciregs_t *regs;
+	uint32 addr = 0;
+
+	/* CardBusMode supports only one device */
+	if (cardbus && dev > 1)
+		return 0;
+
+	coreidx = sb_coreidx(sbh);
+	regs = (sbpciregs_t *) sb_setcore(sbh, SB_PCI, 0);
+
+	/* Type 0 transaction */
+	if (bus == 1) {
+		/* Skip unwired slots */
+		if (dev < PCI_SLOT_MAX) {
+			/* Slide the PCI window to the appropriate slot */
+			W_REG(&regs->sbtopci1, SBTOPCI_CFG0 | ((1 << (dev + 16)) & SBTOPCI1_MASK));
+			addr = SB_PCI_CFG | ((1 << (dev + 16)) & ~SBTOPCI1_MASK) |
+				(func << 8) | (off & ~3);
+		}
+	}
+
+	/* Type 1 transaction */
+	else {
+		W_REG(&regs->sbtopci1, SBTOPCI_CFG1);
+		addr = SB_PCI_CFG | (bus << 16) | (dev << 11) | (func << 8) | (off & ~3);
+	}
+
+	sb_setcoreidx(sbh, coreidx);
+
+	return addr;
+}
+
+static int
+extpci_read_config(void *sbh, uint bus, uint dev, uint func, uint off, void *buf, int len)
+{
+	uint32 addr, *reg = NULL, val;
+	int ret = 0;
+
+	if (!(addr = config_cmd(sbh, bus, dev, func, off)) ||
+	    !(reg = (uint32 *) REG_MAP(addr, len)) ||
+	    BUSPROBE(val, reg))
+		val = 0xffffffff;
+
+	val >>= 8 * (off & 3);
+	if (len == 4)
+		*((uint32 *) buf) = val;
+	else if (len == 2)
+		*((uint16 *) buf) = (uint16) val;
+	else if (len == 1)
+		*((uint8 *) buf) = (uint8) val;
+	else
+		ret = -1;
+
+	if (reg)
+		REG_UNMAP(reg);
+
+	return ret;
+}
+
+static int
+extpci_write_config(void *sbh, uint bus, uint dev, uint func, uint off, void *buf, int len)
+{
+	uint32 addr, *reg = NULL, val;
+	int ret = 0;
+
+	if (!(addr = config_cmd(sbh, bus, dev, func, off)) ||
+	    !(reg = (uint32 *) REG_MAP(addr, len)) ||
+	    BUSPROBE(val, reg))
+		goto done;
+
+	if (len == 4)
+		val = *((uint32 *) buf);
+	else if (len == 2) {
+		val &= ~(0xffff << (8 * (off & 3)));
+		val |= *((uint16 *) buf) << (8 * (off & 3));
+	} else if (len == 1) {
+		val &= ~(0xff << (8 * (off & 3)));
+		val |= *((uint8 *) buf) << (8 * (off & 3));
+	} else
+		ret = -1;
+
+	W_REG(reg, val);
+
+ done:
+	if (reg)
+		REG_UNMAP(reg);
+
+	return ret;
+}
+
+/*
+ * Functions for accessing translated SB configuration space
+ */
+
+static int
+sb_read_config(void *sbh, uint bus, uint dev, uint func, uint off, void *buf, int len)
+{
+	pci_config_regs *cfg;
+
+	if (dev >= SB_MAXCORES || (off + len) > sizeof(pci_config_regs))
+		return -1;
+	cfg = &sb_config_regs[dev];
+
+	ASSERT(ISALIGNED(off, len));
+	ASSERT(ISALIGNED(buf, len));
+
+	if (len == 4)
+		*((uint32 *) buf) = ltoh32(*((uint32 *)((ulong) cfg + off)));
+	else if (len == 2)
+		*((uint16 *) buf) = ltoh16(*((uint16 *)((ulong) cfg + off)));
+	else if (len == 1)
+		*((uint8 *) buf) = *((uint8 *)((ulong) cfg + off));
+	else
+		return -1;
+
+	return 0;
+}
+
+static int
+sb_write_config(void *sbh, uint bus, uint dev, uint func, uint off, void *buf, int len)
+{
+	uint coreidx, n;
+	void *regs;
+	sbconfig_t *sb;
+	pci_config_regs *cfg;
+
+	if (dev >= SB_MAXCORES || (off + len) > sizeof(pci_config_regs))
+		return -1;
+	cfg = &sb_config_regs[dev];
+
+	ASSERT(ISALIGNED(off, len));
+	ASSERT(ISALIGNED(buf, len));
+
+	/* Emulate BAR sizing */
+	if (off >= OFFSETOF(pci_config_regs, base[0]) && off <= OFFSETOF(pci_config_regs, base[3]) &&
+	    len == 4 && *((uint32 *) buf) == ~0) {
+		coreidx = sb_coreidx(sbh);
+		if ((regs = sb_setcoreidx(sbh, dev))) {
+			sb = (sbconfig_t *)((ulong) regs + SBCONFIGOFF);
+			/* Highest numbered address match register */
+			n = (R_REG(&sb->sbidlow) & SBIDL_AR_MASK) >> SBIDL_AR_SHIFT;
+			if (off == OFFSETOF(pci_config_regs, base[0]))
+				cfg->base[0] = ~(sb_size(R_REG(&sb->sbadmatch0)) - 1);
+			/*else if (off == OFFSETOF(pci_config_regs, base[1]) && n >= 1)
+				cfg->base[1] = ~(sb_size(R_REG(&sb->sbadmatch1)) - 1);
+			else if (off == OFFSETOF(pci_config_regs, base[2]) && n >= 2)
+				cfg->base[2] = ~(sb_size(R_REG(&sb->sbadmatch2)) - 1);
+			else if (off == OFFSETOF(pci_config_regs, base[3]) && n >= 3)
+				cfg->base[3] = ~(sb_size(R_REG(&sb->sbadmatch3)) - 1);*/
+		}
+		sb_setcoreidx(sbh, coreidx);
+		return 0;
+	}
+
+	if (len == 4)
+		*((uint32 *)((ulong) cfg + off)) = htol32(*((uint32 *) buf));
+	else if (len == 2)
+		*((uint16 *)((ulong) cfg + off)) = htol16(*((uint16 *) buf));
+	else if (len == 1)
+		*((uint8 *)((ulong) cfg + off)) = *((uint8 *) buf);
+	else
+		return -1;
+
+	return 0;
+}
+
+int
+sbpci_read_config(void *sbh, uint bus, uint dev, uint func, uint off, void *buf, int len)
+{
+	if (bus == 0)
+		return sb_read_config(sbh, bus, dev, func, off, buf, len);
+	else
+		return extpci_read_config(sbh, bus, dev, func, off, buf, len);
+}
+
+int
+sbpci_write_config(void *sbh, uint bus, uint dev, uint func, uint off, void *buf, int len)
+{
+	if (bus == 0)
+		return sb_write_config(sbh, bus, dev, func, off, buf, len);
+	else
+		return extpci_write_config(sbh, bus, dev, func, off, buf, len);
+}
+
+void
+sbpci_ban(uint16 core)
+{
+	if (pci_banned < ARRAYSIZE(pci_ban))
+		pci_ban[pci_banned++] = core;
+}
+
+int __init
+sbpci_init(void *sbh)
+{
+	uint chip, chiprev, chippkg, coreidx, host, i;
+	sbpciregs_t *pci;
+	sbconfig_t *sb;
+	pci_config_regs *cfg;
+	void *regs;
+	char varname[8];
+	uint wlidx = 0;
+	uint16 vendor, core;
+	uint8 class, subclass, progif;
+	uint32 val;
+	uint32 sbips_int_mask[] = { 0, SBIPS_INT1_MASK, SBIPS_INT2_MASK, SBIPS_INT3_MASK, SBIPS_INT4_MASK };
+	uint32 sbips_int_shift[] = { 0, 0, SBIPS_INT2_SHIFT, SBIPS_INT3_SHIFT, SBIPS_INT4_SHIFT };
+
+	chip = sb_chip(sbh);
+	chiprev = sb_chiprev(sbh);
+	chippkg = sb_chippkg(sbh);
+	coreidx = sb_coreidx(sbh);
+
+	if (!(pci = (sbpciregs_t *) sb_setcore(sbh, SB_PCI, 0)))
+		return -1;
+	sb_core_reset(sbh, 0);
+
+	if (((chip == BCM4310_DEVICE_ID) && (chiprev == 0)) ||
+	    ((chip == BCM4712_DEVICE_ID) && (chippkg == BCM4712SMALL_PKG_ID)))
+		host = 0;
+	else
+		host = !BUSPROBE(val, &pci->control);
+
+	if (!host) {
+		/* Disable PCI interrupts in client mode */
+		sb = (sbconfig_t *)((ulong) pci + SBCONFIGOFF);
+		W_REG(&sb->sbintvec, 0);
+
+		/* Disable the PCI bridge in client mode */
+		sbpci_ban(SB_PCI);
+		printf("PCI: Disabled\n");
+	} else {
+		/* Reset the external PCI bus and enable the clock */
+		W_REG(&pci->control, 0x5);		/* enable the tristate drivers */
+		W_REG(&pci->control, 0xd);		/* enable the PCI clock */
+		OSL_DELAY(100);				/* delay 100 us */
+		W_REG(&pci->control, 0xf);		/* deassert PCI reset */
+		W_REG(&pci->arbcontrol, PCI_INT_ARB);	/* use internal arbiter */
+		OSL_DELAY(1);				/* delay 1 us */
+
+		/* Enable CardBusMode */
+		cardbus = nvram_match("cardbus", "1");
+		if (cardbus) {
+			printf("PCI: Enabling CardBus\n");
+			/* GPIO 1 resets the CardBus device on bcm94710ap */
+			sb_gpioout(sbh, 1, 1);
+			sb_gpioouten(sbh, 1, 1);
+			W_REG(&pci->sprom[0], R_REG(&pci->sprom[0]) | 0x400);
+		}
+
+		/* 64 MB I/O access window */
+		W_REG(&pci->sbtopci0, SBTOPCI_IO);
+		/* 64 MB configuration access window */
+		W_REG(&pci->sbtopci1, SBTOPCI_CFG0);
+		/* 1 GB memory access window */
+		W_REG(&pci->sbtopci2, SBTOPCI_MEM | SB_PCI_DMA);
+
+		/* Enable PCI bridge BAR0 prefetch and burst */
+		val = 6;
+		sbpci_write_config(sbh, 1, 0, 0, PCI_CFG_CMD, &val, sizeof(val));
+
+		/* Enable PCI interrupts */
+		W_REG(&pci->intmask, PCI_INTA);
+	}
+
+	/* Scan the SB bus */
+	bzero(sb_config_regs, sizeof(sb_config_regs));
+	for (cfg = sb_config_regs; cfg < &sb_config_regs[SB_MAXCORES]; cfg++) {
+		cfg->vendor = 0xffff;
+		if (!(regs = sb_setcoreidx(sbh, cfg - sb_config_regs)))
+			continue;
+		sb = (sbconfig_t *)((ulong) regs + SBCONFIGOFF);
+
+		/* Read ID register and parse vendor and core */
+		val = R_REG(&sb->sbidhigh);
+		vendor = (val & SBIDH_VC_MASK) >> SBIDH_VC_SHIFT;
+		core = (val & SBIDH_CC_MASK) >> SBIDH_CC_SHIFT;
+		progif = 0;
+
+		/* Check if this core is banned */
+		for (i = 0; i < pci_banned; i++)
+			if (core == pci_ban[i])
+				break;
+		if (i < pci_banned)
+			continue;
+
+		/* Known vendor translations */
+		switch (vendor) {
+		case SB_VEND_BCM:
+			vendor = VENDOR_BROADCOM;
+			break;
+		}
+
+		/* Determine class based on known core codes */
+		switch (core) {
+		case SB_ILINE20:
+			class = PCI_CLASS_NET;
+			subclass = PCI_NET_ETHER;
+			core = BCM47XX_ILINE_ID;
+			break;
+		case SB_ILINE100:
+			class = PCI_CLASS_NET;
+			subclass = PCI_NET_ETHER;
+			core = BCM4610_ILINE_ID;
+			break;
+		case SB_ENET:
+			class = PCI_CLASS_NET;
+			subclass = PCI_NET_ETHER;
+			core = BCM47XX_ENET_ID;
+			break;
+		case SB_SDRAM:
+		case SB_MEMC:
+			class = PCI_CLASS_MEMORY;
+			subclass = PCI_MEMORY_RAM;
+			break;
+		case SB_PCI:
+			class = PCI_CLASS_BRIDGE;
+			subclass = PCI_BRIDGE_PCI;
+			//break;
+		case SB_MIPS:
+		case SB_MIPS33:
+			class = PCI_CLASS_CPU;
+			subclass = PCI_CPU_MIPS;
+			break;
+		case SB_CODEC:
+			class = PCI_CLASS_COMM;
+			subclass = PCI_COMM_MODEM;
+			core = BCM47XX_V90_ID;
+			break;
+		case SB_USB:
+			class = PCI_CLASS_SERIAL;
+			subclass = PCI_SERIAL_USB;
+			progif = 0x10; /* OHCI */
+			core = BCM47XX_USB_ID;
+			break;
+		case SB_USB11H:
+			class = PCI_CLASS_SERIAL;
+			subclass = PCI_SERIAL_USB;
+			progif = 0x10; /* OHCI */
+			core = BCM47XX_USBH_ID;
+			break;
+		case SB_USB11D:
+			class = PCI_CLASS_SERIAL;
+			subclass = PCI_SERIAL_USB;
+			core = BCM47XX_USBD_ID;
+			break;
+		case SB_IPSEC:
+			class = PCI_CLASS_CRYPT;
+			subclass = PCI_CRYPT_NETWORK;
+			core = BCM47XX_IPSEC_ID;
+			break;
+		case SB_EXTIF:
+		case SB_CC:
+			class = PCI_CLASS_MEMORY;
+			subclass = PCI_MEMORY_FLASH;
+			break;
+		case SB_D11:
+			class = PCI_CLASS_NET;
+			subclass = PCI_NET_OTHER;
+			/* Let an nvram variable override this */
+			sprintf(varname, "wl%did", wlidx);
+			wlidx++;
+			if ((core = getintvar(NULL, varname)) == 0) {
+				if (chip == BCM4712_DEVICE_ID) {
+					if (chippkg == BCM4712SMALL_PKG_ID)
+						core = BCM4306_D11G_ID;
+					else
+						core = BCM4306_D11DUAL_ID;
+				} else {
+					/* 4310 */
+					core = BCM4310_D11B_ID;
+				}
+			}
+			break;
+
+		default:
+			class = subclass = progif = 0xff;
+			break;
+		}
+
+		/* Supported translations */
+		cfg->vendor = htol16(vendor);
+		cfg->device = htol16(core);
+		cfg->rev_id = chiprev;
+		cfg->prog_if = progif;
+		cfg->sub_class = subclass;
+		cfg->base_class = class;
+		cfg->base[0] = htol32(sb_base(R_REG(&sb->sbadmatch0)));
+		cfg->base[1] = 0/*htol32(sb_base(R_REG(&sb->sbadmatch1)))*/;
+		cfg->base[2] = 0/*htol32(sb_base(R_REG(&sb->sbadmatch2)))*/;
+		cfg->base[3] = 0/*htol32(sb_base(R_REG(&sb->sbadmatch3)))*/;
+		cfg->base[4] = 0;
+		cfg->base[5] = 0;
+		if (class == PCI_CLASS_BRIDGE && subclass == PCI_BRIDGE_PCI)
+			cfg->header_type = PCI_HEADER_BRIDGE;
+		else
+			cfg->header_type = PCI_HEADER_NORMAL;
+		/* Save core interrupt flag */
+		cfg->int_pin = R_REG(&sb->sbtpsflag) & SBTPS_NUM0_MASK;
+		/* Default to MIPS shared interrupt 0 */
+		cfg->int_line = 0;
+		/* MIPS sbipsflag maps core interrupt flags to interrupts 1 through 4 */
+		if ((regs = sb_setcore(sbh, SB_MIPS, 0)) ||
+		    (regs = sb_setcore(sbh, SB_MIPS33, 0))) {
+			sb = (sbconfig_t *)((ulong) regs + SBCONFIGOFF);
+			val = R_REG(&sb->sbipsflag);
+			for (cfg->int_line = 1; cfg->int_line <= 4; cfg->int_line++) {
+				if (((val & sbips_int_mask[cfg->int_line]) >> sbips_int_shift[cfg->int_line]) == cfg->int_pin)
+					break;
+			}
+			if (cfg->int_line > 4)
+				cfg->int_line = 0;
+		}
+		/* Emulated core */
+		*((uint32 *) &cfg->sprom_control) = 0xffffffff;
+	}
+
+	sb_setcoreidx(sbh, coreidx);
+	return 0;
+}
+
+void
+sbpci_check(void *sbh)
+{
+	uint coreidx;
+	sbpciregs_t *pci;
+	uint32 sbtopci1;
+	uint32 buf[64], *ptr, i;
+	ulong pa;
+	volatile uint j;
+
+	coreidx = sb_coreidx(sbh);
+	pci = (sbpciregs_t *) sb_setcore(sbh, SB_PCI, 0);
+
+	/* Clear the test array */
+	pa = (ulong) DMA_MAP(NULL, buf, sizeof(buf), DMA_RX, NULL);
+	ptr = (uint32 *) OSL_UNCACHED(&buf[0]);
+	memset(ptr, 0, sizeof(buf));
+
+	/* Point PCI window 1 to memory */
+	sbtopci1 = R_REG(&pci->sbtopci1);
+	W_REG(&pci->sbtopci1, SBTOPCI_MEM | (pa & SBTOPCI1_MASK));
+
+	/* Fill the test array via PCI window 1 */
+	ptr = (uint32 *) REG_MAP(SB_PCI_CFG + (pa & ~SBTOPCI1_MASK), sizeof(buf));
+	for (i = 0; i < ARRAYSIZE(buf); i++) {
+		for (j = 0; j < 2; j++);
+		W_REG(&ptr[i], i);
+	}
+	REG_UNMAP(ptr);
+
+	/* Restore PCI window 1 */
+	W_REG(&pci->sbtopci1, sbtopci1);
+
+	/* Check the test array */
+	DMA_UNMAP(NULL, pa, sizeof(buf), DMA_RX, NULL);
+	ptr = (uint32 *) OSL_UNCACHED(&buf[0]);
+	for (i = 0; i < ARRAYSIZE(buf); i++) {
+		if (ptr[i] != i)
+			break;
+	}
+
+	/* Change the clock if the test fails */
+	if (i < ARRAYSIZE(buf)) {
+		uint32 req, cur;
+
+		cur = sb_clock(sbh);
+		printf("PCI: Test failed at %d MHz\n", (cur + 500000) / 1000000);
+		for (req = 104000000; req < 176000000; req += 4000000) {
+			printf("PCI: Resetting to %d MHz\n", (req + 500000) / 1000000);
+			/* This will only reset if the clocks are valid and have changed */
+			sb_mips_setclock(sbh, req, 0, 0);
+		}
+		/* Should not reach here */
+		ASSERT(0);
+	}
+
+	sb_setcoreidx(sbh, coreidx);
+}
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/broadcom/sbutils.c linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/sbutils.c
--- linux-2.6.12.5/arch/mips/bcm947xx/broadcom/sbutils.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/broadcom/sbutils.c	2005-08-28 11:12:20.482851248 +0200
@@ -0,0 +1,1895 @@
+/*
+ * Misc utility routines for accessing chip-specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <bcmdevs.h>
+#include <sbconfig.h>
+#include <sbchipc.h>
+#include <sbpci.h>
+#include <pcicfg.h>
+#include <sbpcmcia.h>
+#include <sbextif.h>
+#include <sbutils.h>
+#include <bcmsrom.h>
+
+/* debug/trace */
+#define	SB_ERROR(args)
+
+typedef uint32 (*sb_intrsoff_t)(void *intr_arg);
+typedef void (*sb_intrsrestore_t)(void *intr_arg, uint32 arg);
+
+/* misc sb info needed by some of the routines */
+typedef struct sb_info {
+	uint	chip;			/* chip number */
+	uint	chiprev;		/* chip revision */
+	uint	chippkg;		/* chip package option */
+	uint	boardtype;		/* board type */
+	uint	boardvendor;		/* board vendor id */
+	uint	bus;			/* what bus type we are going through */
+
+	void	*osh;			/* osl os handle */
+	void	*sdh;			/* bcmsdh handle */
+
+	void	*curmap;		/* current regs va */
+	void	*regs[SB_MAXCORES];	/* other regs va */
+
+	uint	curidx;			/* current core index */
+	uint	dev_coreid;		/* the core provides driver functions */
+	uint	pciidx;			/* pci core index */
+	uint	pcirev;			/* pci core rev */
+
+	uint	pcmciaidx;		/* pcmcia core index */
+	uint	pcmciarev;		/* pcmcia core rev */
+	bool	memseg;			/* flag to toggle MEM_SEG register */
+
+	uint	ccrev;			/* chipc core rev */
+
+	uint	gpioidx;		/* gpio control core index */
+	uint	gpioid;			/* gpio control coretype */
+
+	uint	numcores;		/* # discovered cores */
+	uint	coreid[SB_MAXCORES];	/* id of each core */
+
+	void	*intr_arg;		/* interrupt callback function arg */
+	sb_intrsoff_t		intrsoff_fn;		/* function turns chip interrupts off */
+	sb_intrsrestore_t	intrsrestore_fn;	/* function restore chip interrupts */
+} sb_info_t;
+
+/* local prototypes */
+static void* sb_doattach(sb_info_t *si, uint devid, void *osh, void *regs, uint bustype, void *sdh, char **vars, int *varsz);
+static void sb_scan(sb_info_t *si);
+static uint sb_corereg(void *sbh, uint coreidx, uint regoff, uint mask, uint val);
+static uint _sb_coreidx(void *sbh);
+static uint sb_findcoreidx(void *sbh, uint coreid, uint coreunit);
+static uint sb_pcidev2chip(uint pcidev);
+static uint sb_chip2numcores(uint chip);
+
+#define	SB_INFO(sbh)	(sb_info_t*)sbh
+#define	SET_SBREG(sbh, r, mask, val)	W_SBREG((sbh), (r), ((R_SBREG((sbh), (r)) & ~(mask)) | (val)))
+#define	GOODCOREADDR(x)	(((x) >= SB_ENUM_BASE) && ((x) <= SB_ENUM_LIM) \
+				&& ISALIGNED((x), SB_CORE_SIZE))
+#define	GOODREGS(regs)	(regs && ISALIGNED(regs, SB_CORE_SIZE))
+#define	REGS2SB(va)	(sbconfig_t*) ((uint)(va) + SBCONFIGOFF)
+#define	GOODIDX(idx)	(((uint)idx) < SB_MAXCORES)
+#define	BADIDX		(SB_MAXCORES+1)
+
+#define	R_SBREG(sbh, sbr)	sb_read_sbreg((sbh), (sbr))
+#define	W_SBREG(sbh, sbr, v)	sb_write_sbreg((sbh), (sbr), (v))
+#define	AND_SBREG(sbh, sbr, v)	W_SBREG((sbh), (sbr), (R_SBREG((sbh), (sbr)) & (v)))
+#define	OR_SBREG(sbh, sbr, v)	W_SBREG((sbh), (sbr), (R_SBREG((sbh), (sbr)) | (v)))
+
+/* 
+ * Macros to disable/restore function core(D11, ENET, ILINE20, etc) interrupts before/
+ * after core switching to avoid invalid register accesss inside ISR.
+ */
+#define INTR_OFF(si, intr_val) \
+	if ((si)->intrsoff_fn && (si)->coreid[(si)->curidx] == (si)->dev_coreid) {	\
+		intr_val = (*(si)->intrsoff_fn)((si)->intr_arg); }
+#define INTR_RESTORE(si, intr_val) \
+	if ((si)->intrsrestore_fn && (si)->coreid[(si)->curidx] == (si)->dev_coreid) {	\
+		(*(si)->intrsrestore_fn)((si)->intr_arg, intr_val); }
+
+/* power control defines */
+#define	PLL_DELAY	150			/* 150us pll on delay */
+#define	FREF_DELAY	15			/* 15us fref change delay */
+#define	LPOMINFREQ	25000			/* low power oscillator min */
+#define	LPOMAXFREQ	43000			/* low power oscillator max */
+#define	XTALMINFREQ	19800000		/* 20mhz - 1% */
+#define	XTALMAXFREQ	20200000		/* 20mhz + 1% */
+#define	PCIMINFREQ	25000000		/* 25mhz */
+#define	PCIMAXFREQ	34000000		/* 33mhz + fudge */
+
+#define SCC_LOW2FAST_LIMIT	5000	/* turn on fast clock time, in unit of ms */
+
+
+static uint32
+sb_read_sbreg(void *sbh, volatile uint32 *sbr)
+{
+	sb_info_t *si;
+	uint8 tmp;
+	uint32 val, intr_val = 0;
+
+	si = SB_INFO(sbh);
+
+	/* 
+	 * compact flash only has 11 bits address, while we needs 12 bits address.
+	 * MEM_SEG will be OR'd with other 11 bits address in hardware, 
+	 * so we program MEM_SEG with 12th bit when necessary(access sb regsiters).
+	 * For normal PCMCIA bus(CFTable_regwinsz > 2k), do nothing special
+	 */
+	if(si->memseg) {
+		INTR_OFF(si, intr_val);
+		tmp = 1;
+		OSL_PCMCIA_WRITE_ATTR(si->osh, MEM_SEG, &tmp, 1);
+		(uint32)sbr &= ~(1 << 11);	/* mask out bit 11*/
+	}
+
+	val = R_REG(sbr);
+	
+	if(si->memseg) {
+		tmp = 0;
+		OSL_PCMCIA_WRITE_ATTR(si->osh, MEM_SEG, &tmp, 1);
+		INTR_RESTORE(si, intr_val);
+	}
+
+	return (val);
+}
+
+static void
+sb_write_sbreg(void *sbh, volatile uint32 *sbr, uint32 v)
+{
+	sb_info_t *si;
+	uint8 tmp;
+	volatile uint32 dummy;
+	uint32 intr_val = 0;
+
+	si = SB_INFO(sbh);
+
+	/* 
+	 * compact flash only has 11 bits address, while we needs 12 bits address.
+	 * MEM_SEG will be OR'd with other 11 bits address in hardware, 
+	 * so we program MEM_SEG with 12th bit when necessary(access sb regsiters).
+	 * For normal PCMCIA bus(CFTable_regwinsz > 2k), do nothing special 
+	 */
+	if(si->memseg) {
+		INTR_OFF(si, intr_val);
+		tmp = 1;
+		OSL_PCMCIA_WRITE_ATTR(si->osh, MEM_SEG, &tmp, 1);
+		(uint32)sbr &= ~(1 << 11);	/* mask out bit 11 */
+	}
+
+	if ((si->bus == PCMCIA_BUS) || (si->bus == PCI_BUS)) {
+#ifdef IL_BIGENDIAN
+		dummy = R_REG(sbr);
+		W_REG((volatile uint16 *)((uint32)sbr + 2), (uint16)((v >> 16) & 0xffff));
+		dummy = R_REG(sbr);
+		W_REG((volatile uint16 *)sbr, (uint16)(v & 0xffff));
+#else
+		dummy = R_REG(sbr);
+		W_REG((volatile uint16 *)sbr, (uint16)(v & 0xffff));
+		dummy = R_REG(sbr);
+		W_REG((volatile uint16 *)((uint32)sbr + 2), (uint16)((v >> 16) & 0xffff));
+#endif
+	} else
+		W_REG(sbr, v);
+
+	if(si->memseg) {
+		tmp = 0;
+		OSL_PCMCIA_WRITE_ATTR(si->osh, MEM_SEG, &tmp, 1);
+		INTR_RESTORE(si, intr_val);
+	}
+}
+
+/*
+ * Allocate a sb handle.
+ * devid - pci device id (used to determine chip#)
+ * osh - opaque OS handle
+ * regs - virtual address of initial core registers
+ * bustype - pci/pcmcia/sb/sdio/etc
+ * vars - pointer to a pointer area for "environment" variables
+ * varsz - pointer to int to return the size of the vars
+ */
+void*
+sb_attach(uint devid, void *osh, void *regs, uint bustype, void *sdh, char **vars, int *varsz)
+{
+	sb_info_t *si;
+
+	/* alloc sb_info_t */
+	if ((si = MALLOC(sizeof (sb_info_t))) == NULL) {
+		SB_ERROR(("sb_attach: malloc failed!\n"));
+		return (NULL);
+	}
+
+	return (sb_doattach(si, devid, osh, regs, bustype, sdh, vars, varsz));
+}
+
+/* global kernel resource */
+static sb_info_t ksi;
+
+/* generic kernel variant of sb_attach() */
+void*
+sb_kattach()
+{
+	uint32 *regs;
+	char *unused;
+	int varsz;
+
+	if (ksi.curmap == NULL) {
+		uint32 cid;
+		regs = (uint32 *)REG_MAP(SB_ENUM_BASE, SB_CORE_SIZE);
+		cid = R_REG((uint32 *)regs);
+		if ((cid == 0x08104712) || (cid == 0x08114712)) {
+			uint32 *scc, val;
+
+			scc = (uint32 *)((uint32)regs + OFFSETOF(chipcregs_t, slow_clk_ctl));
+			val = R_REG(scc);
+			SB_ERROR(("    initial scc = 0x%x\n", val));
+			val |= SCC_SS_XTAL;
+			W_REG(scc, val);
+		}
+
+		sb_doattach(&ksi, BCM4710_DEVICE_ID, NULL, (void*)regs,
+			    SB_BUS, NULL, &unused, &varsz);
+	}
+
+	return &ksi;
+}
+
+static void*
+sb_doattach(sb_info_t *si, uint devid, void *osh, void *regs, uint bustype, void *sdh, char **vars, int *varsz)
+{
+	uint origidx;
+	chipcregs_t *cc;
+	uint32 w;
+
+	ASSERT(GOODREGS(regs));
+
+	bzero((uchar*)si, sizeof (sb_info_t));
+
+	si->pciidx = si->gpioidx = BADIDX;
+
+	si->osh = osh;
+	si->curmap = regs;
+	si->sdh = sdh;
+
+	/* 4317A0 PCMCIA is no longer supported */ 
+	if ((bustype == PCMCIA_BUS) && (R_REG((uint32 *)regs) == 0x04104317))
+		return NULL;
+
+	/* check to see if we are a sb core mimic'ing a pci core */
+	if (bustype == PCI_BUS) {
+		if (OSL_PCI_READ_CONFIG(osh, PCI_SPROM_CONTROL, sizeof (uint32)) == 0xffffffff)
+			bustype = SB_BUS;
+		else
+			bustype = PCI_BUS;
+	}
+
+	si->bus = bustype;
+
+	/* kludge to enable the clock on the 4306 which lacks a slowclock */
+	if (si->bus == PCI_BUS)
+		sb_pwrctl_xtal((void*)si, XTAL|PLL, ON);
+
+	/* clear any previous epidiag-induced target abort */
+	sb_taclear((void*)si);
+
+	/* initialize current core index value */
+	si->curidx = _sb_coreidx((void*)si);
+
+	/* keep and reuse the initial register mapping */
+	origidx = si->curidx;
+	if (si->bus == SB_BUS)
+		si->regs[origidx] = regs;
+
+	/* initialize the vars */
+	if (srom_var_init(si->bus, si->curmap, osh, vars, varsz)) {
+		SB_ERROR(("sb_attach: srom_var_init failed\n"));
+		goto bad;
+	}
+	
+	if (si->bus == PCMCIA_BUS) {
+		w = getintvar(*vars, "regwindowsz");
+		si->memseg = (w <= CFTABLE_REGWIN_2K) ? TRUE : FALSE;
+	}
+
+	/* is core-0 a chipcommon core? */
+	si->numcores = 1;
+	cc = (chipcregs_t*) sb_setcoreidx((void*)si, 0);
+	if (sb_coreid((void*)si) != SB_CC)
+		cc = NULL;
+
+	/* determine chip id and rev */
+	if (cc) {
+		/* chip common core found! */
+		si->chip = R_REG(&cc->chipid) & CID_ID_MASK;
+		si->chiprev = (R_REG(&cc->chipid) & CID_REV_MASK) >> CID_REV_SHIFT;
+		si->chippkg = (R_REG(&cc->chipid) & CID_PKG_MASK) >> CID_PKG_SHIFT;
+	} else {
+		/* without chip common core, get devid for PCMCIA */
+		if (si->bus == PCMCIA_BUS)
+			devid = getintvar(*vars, "devid");
+
+		/* no chip common core -- must convert device id to chip id */
+		if ((si->chip = sb_pcidev2chip(devid)) == 0) {
+			SB_ERROR(("sb_attach: unrecognized device id 0x%04x\n", devid));
+			goto bad;
+		}
+
+		/*
+		 * The chip revision number is hardwired into all
+		 * of the pci function config rev fields and is
+		 * independent from the individual core revision numbers.
+		 * For example, the "A0" silicon of each chip is chip rev 0.
+		 * For PCMCIA we get it from the CIS instead.
+		 */
+		if (si->bus == PCMCIA_BUS) {
+			ASSERT(vars);
+			si->chiprev = getintvar(*vars, "chiprev");
+		} else if (si->bus == PCI_BUS) {
+			w = OSL_PCI_READ_CONFIG(osh, PCI_CFG_REV, sizeof (uint32));
+			si->chiprev = w & 0xff;
+		} else
+			si->chiprev = 0;
+	}
+
+	/* get chipcommon rev */
+	si->ccrev = cc? sb_corerev((void*)si) : 0;
+	
+	/* determine numcores */
+	if ((si->ccrev == 4) || (si->ccrev >= 6))
+		si->numcores = (R_REG(&cc->chipid) & CID_CC_MASK) >> CID_CC_SHIFT;
+	else
+		si->numcores = sb_chip2numcores(si->chip);
+
+	/* return to original core */
+	sb_setcoreidx((void*)si, origidx);
+
+	/* sanity checks */
+	ASSERT(si->chip);
+	/* 4704A1 is chiprev 8 :-( */
+	ASSERT((si->chiprev < 8) ||
+	       ((si->chip == BCM4704_DEVICE_ID) && ((si->chiprev == 8))));
+
+	/* scan for cores */
+	sb_scan(si);
+
+	/* pci core is required */
+	if (!GOODIDX(si->pciidx)) {
+		SB_ERROR(("sb_attach: pci core not found\n"));
+		goto bad;
+	}
+
+	/* gpio control core is required */
+	if (!GOODIDX(si->gpioidx)) {
+		SB_ERROR(("sb_attach: gpio control core not found\n"));
+		goto bad;
+	}
+
+	/* get boardtype and boardrev */
+	switch (si->bus) {
+	case PCI_BUS:
+		/* do a pci config read to get subsystem id and subvendor id */
+		w = OSL_PCI_READ_CONFIG(osh, PCI_CFG_SVID, sizeof (uint32));
+		si->boardvendor = w & 0xffff;
+		si->boardtype = (w >> 16) & 0xffff;
+		break;
+
+	case PCMCIA_BUS:
+	case SDIO_BUS:
+		si->boardvendor = getintvar(*vars, "manfid");
+		si->boardtype = getintvar(*vars, "prodid");
+		break;
+
+	case SB_BUS:
+		si->boardvendor = VENDOR_BROADCOM;
+		si->boardtype = 0xffff;
+		break;
+	}
+
+	if (si->boardtype == 0) {
+		SB_ERROR(("sb_attach: unknown board type\n"));
+		ASSERT(si->boardtype);
+	}
+
+	return ((void*)si);
+
+bad:
+	MFREE(si, sizeof (sb_info_t));
+	return (NULL);
+}
+
+uint
+sb_coreid(void *sbh)
+{
+	sb_info_t *si;
+	sbconfig_t *sb;
+
+	si = SB_INFO(sbh);
+	sb = REGS2SB(si->curmap);
+
+	return ((R_SBREG(sbh, &(sb)->sbidhigh) & SBIDH_CC_MASK) >> SBIDH_CC_SHIFT);
+}
+
+uint
+sb_coreidx(void *sbh)
+{
+	sb_info_t *si;
+
+	si = SB_INFO(sbh);
+	return (si->curidx);
+}
+
+/* return current index of core */
+static uint
+_sb_coreidx(void *sbh)
+{
+	sb_info_t *si;
+	sbconfig_t *sb;
+	uint32 sbaddr = 0;
+
+	si = SB_INFO(sbh);
+	ASSERT(si);
+
+	switch (si->bus) {
+	case SB_BUS:
+		sb = REGS2SB(si->curmap);
+		sbaddr = sb_base(R_SBREG(sbh, &sb->sbadmatch0));
+		break;
+
+	case PCI_BUS:
+		sbaddr = OSL_PCI_READ_CONFIG(si->osh, PCI_BAR0_WIN, sizeof (uint32));
+		break;
+
+	case PCMCIA_BUS: {
+		uint8 tmp;
+
+		OSL_PCMCIA_READ_ATTR(si->osh, PCMCIA_ADDR0, &tmp, 1);
+		sbaddr  = (uint)tmp << 12;
+		OSL_PCMCIA_READ_ATTR(si->osh, PCMCIA_ADDR1, &tmp, 1);
+		sbaddr |= (uint)tmp << 16;
+		OSL_PCMCIA_READ_ATTR(si->osh, PCMCIA_ADDR2, &tmp, 1);
+		sbaddr |= (uint)tmp << 24;
+		break;
+	}
+	default:
+		ASSERT(0);
+	}
+
+	ASSERT(GOODCOREADDR(sbaddr));
+	return ((sbaddr - SB_ENUM_BASE)/SB_CORE_SIZE);
+}
+
+uint
+sb_corevendor(void *sbh)
+{
+	sb_info_t *si;
+	sbconfig_t *sb;
+
+	si = SB_INFO(sbh);
+	sb = REGS2SB(si->curmap);
+
+	return ((R_SBREG(sbh, &(sb)->sbidhigh) & SBIDH_VC_MASK) >> SBIDH_VC_SHIFT);
+}
+
+uint
+sb_corerev(void *sbh)
+{
+	sb_info_t *si;
+	sbconfig_t *sb;
+
+	si = SB_INFO(sbh);
+	sb = REGS2SB(si->curmap);
+
+	return (R_SBREG(sbh, &(sb)->sbidhigh) & SBIDH_RC_MASK);
+}
+
+#define	SBTML_ALLOW	(SBTML_PE | SBTML_FGC | SBTML_FL_MASK)
+
+/* set/clear sbtmstatelow core-specific flags */
+uint32
+sb_coreflags(void *sbh, uint32 mask, uint32 val)
+{
+	sb_info_t *si;
+	sbconfig_t *sb;
+	uint32 w;
+
+	si = SB_INFO(sbh);
+	sb = REGS2SB(si->curmap);
+
+	ASSERT((val & ~mask) == 0);
+	ASSERT((mask & ~SBTML_ALLOW) == 0);
+
+	/* mask and set */
+	if (mask || val) {
+		w = (R_SBREG(sbh, &sb->sbtmstatelow) & ~mask) | val;
+		W_SBREG(sbh, &sb->sbtmstatelow, w);
+	}
+
+	/* return the new value */
+	return (R_SBREG(sbh, &sb->sbtmstatelow) & SBTML_ALLOW);
+}
+
+/* set/clear sbtmstatehigh core-specific flags */
+uint32
+sb_coreflagshi(void *sbh, uint32 mask, uint32 val)
+{
+	sb_info_t *si;
+	sbconfig_t *sb;
+	uint32 w;
+
+	si = SB_INFO(sbh);
+	sb = REGS2SB(si->curmap);
+
+	ASSERT((val & ~mask) == 0);
+	ASSERT((mask & ~SBTMH_FL_MASK) == 0);
+
+	/* mask and set */
+	if (mask || val) {
+		w = (R_SBREG(sbh, &sb->sbtmstatehigh) & ~mask) | val;
+		W_SBREG(sbh, &sb->sbtmstatehigh, w);
+	}
+
+	/* return the new value */
+	return (R_SBREG(sbh, &sb->sbtmstatehigh) & SBTMH_FL_MASK);
+}
+
+bool
+sb_iscoreup(void *sbh)
+{
+	sb_info_t *si;
+	sbconfig_t *sb;
+
+	si = SB_INFO(sbh);
+	sb = REGS2SB(si->curmap);
+
+	return ((R_SBREG(sbh, &(sb)->sbtmstatelow) & (SBTML_RESET | SBTML_REJ | SBTML_CLK)) == SBTML_CLK);
+}
+
+/*
+ * Switch to 'coreidx', issue a single arbitrary 32bit register mask&set operation,
+ * switch back to the original core, and return the new value.
+ */
+static uint
+sb_corereg(void *sbh, uint coreidx, uint regoff, uint mask, uint val)
+{
+	sb_info_t *si;
+	uint origidx;
+	uint32 *r;
+	uint w;
+	uint intr_val = 0;
+
+	ASSERT(GOODIDX(coreidx));
+	ASSERT(regoff < SB_CORE_SIZE);
+	ASSERT((val & ~mask) == 0);
+
+	si = SB_INFO(sbh);
+
+	/* save current core index */
+	origidx = sb_coreidx(sbh);
+
+	/* switch core */
+	INTR_OFF(si, intr_val);
+	r = (uint32*) ((uint) sb_setcoreidx(sbh, coreidx) + regoff);
+
+	/* mask and set */
+	if (mask || val) {
+		if (regoff >= SBCONFIGOFF) {
+			w = (R_SBREG(sbh, r) & ~mask) | val;
+			W_SBREG(sbh, r, w);
+		} else {
+			w = (R_REG(r) & ~mask) | val;
+			W_REG(r, w);
+		}
+	}
+
+	/* readback */
+	w = R_SBREG(sbh, r);
+
+	/* restore core index */
+	if (origidx != coreidx)
+		sb_setcoreidx(sbh, origidx);
+
+	INTR_RESTORE(si, intr_val);
+	return (w);
+}
+
+/* scan the sb enumerated space to identify all cores */
+static void
+sb_scan(sb_info_t *si)
+{
+	void *sbh;
+	uint origidx;
+	uint i;
+
+	sbh = (void*) si;
+
+	/* numcores should already be set */
+	ASSERT((si->numcores > 0) && (si->numcores <= SB_MAXCORES));
+
+	/* save current core index */
+	origidx = sb_coreidx(sbh);
+
+	si->pciidx = si->gpioidx = BADIDX;
+
+	for (i = 0; i < si->numcores; i++) {
+		sb_setcoreidx(sbh, i);
+		si->coreid[i] = sb_coreid(sbh);
+
+		if (si->coreid[i] == SB_CC)
+			si->ccrev = sb_corerev(sbh);
+
+		else if (si->coreid[i] == SB_PCI) {
+			si->pciidx = i;
+			si->pcirev = sb_corerev(sbh);
+
+		}else if (si->coreid[i] == SB_PCMCIA){
+			si->pcmciaidx = i;
+			si->pcmciarev = sb_corerev(sbh);
+		}
+	}
+
+	/*
+	 * Find the gpio "controlling core" type and index.
+	 * Precedence:
+	 * - if there's a chip common core - use that
+	 * - else if there's a pci core (rev >= 2) - use that
+	 * - else there had better be an extif core (4710 only)
+	 */
+	if (GOODIDX(sb_findcoreidx(sbh, SB_CC, 0))) {
+		si->gpioidx = sb_findcoreidx(sbh, SB_CC, 0);
+		si->gpioid = SB_CC;
+	} else if (GOODIDX(si->pciidx) && (si->pcirev >= 2)) {
+		si->gpioidx = si->pciidx;
+		si->gpioid = SB_PCI;
+	} else if (sb_findcoreidx(sbh, SB_EXTIF, 0)) {
+		si->gpioidx = sb_findcoreidx(sbh, SB_EXTIF, 0);
+		si->gpioid = SB_EXTIF;
+	}
+
+	/* return to original core index */
+	sb_setcoreidx(sbh, origidx);
+}
+
+/* may be called with core in reset */
+void
+sb_detach(void *sbh)
+{
+	sb_info_t *si;
+	uint idx;
+
+	si = SB_INFO(sbh);
+
+	if (si == NULL)
+		return;
+
+	if (si->bus == SB_BUS)
+		for (idx = 0; idx < SB_MAXCORES; idx++)
+			if (si->regs[idx]) {
+				REG_UNMAP(si->regs[idx]);
+				si->regs[idx] = NULL;
+			}
+
+	MFREE(si, sizeof (sb_info_t));
+}
+
+/* use pci dev id to determine chip id for chips not having a chipcommon core */
+static uint
+sb_pcidev2chip(uint pcidev)
+{
+	if ((pcidev >= BCM4710_DEVICE_ID) && (pcidev <= BCM47XX_USB_ID))
+		return (BCM4710_DEVICE_ID);
+	if ((pcidev >= BCM4610_DEVICE_ID) && (pcidev <= BCM4610_USB_ID))
+		return (BCM4610_DEVICE_ID);
+	if ((pcidev >= BCM4402_DEVICE_ID) && (pcidev <= BCM4402_V90_ID))
+		return (BCM4402_DEVICE_ID);
+	if ((pcidev >= BCM4307_V90_ID) && (pcidev <= BCM4307_D11B_ID))
+		return (BCM4307_DEVICE_ID);
+	if (pcidev == BCM4301_DEVICE_ID)
+		return (BCM4301_DEVICE_ID);
+
+	return (0);
+}
+
+/* convert chip number to number of i/o cores */
+static uint
+sb_chip2numcores(uint chip)
+{
+	if (chip == 0x4710)
+		return (9);
+	if (chip == 0x4610)
+		return (9);
+	if (chip == 0x4402)
+		return (3);
+	if ((chip == 0x4307) || (chip == 0x4301))
+		return (5);
+	if (chip == 0x4310)
+		return (8);
+	if (chip == 0x4306)	/* < 4306c0 */
+		return (6);
+	if (chip == 0x4704)
+		return (9);
+	if (chip == 0x5365)
+		return (7);
+
+	SB_ERROR(("sb_chip2numcores: unsupported chip 0x%x\n", chip));
+	ASSERT(0);
+	return (1);
+}
+
+/* return index of coreid or BADIDX if not found */
+static uint
+sb_findcoreidx(void *sbh, uint coreid, uint coreunit)
+{
+	sb_info_t *si;
+	uint found;
+	uint i;
+
+	si = SB_INFO(sbh);
+	found = 0;
+
+	for (i = 0; i < si->numcores; i++)
+		if (si->coreid[i] == coreid) {
+			if (found == coreunit)
+				return (i);
+			found++;
+		}
+
+	return (BADIDX);
+}
+
+/* change logical "focus" to the indiciated core */
+void*
+sb_setcoreidx(void *sbh, uint coreidx)
+{
+	sb_info_t *si;
+	uint32 sbaddr;
+	uint8 tmp;
+
+	si = SB_INFO(sbh);
+
+	if (coreidx >= si->numcores)
+		return (NULL);
+
+	/*
+	 * If the user has provided an interrupt mask enabled function,
+	 * then assert interrupts are disabled before switching the core.
+	 */
+	ASSERT((si->imf == NULL) || !(*si->imf)(si->imfarg));
+
+	sbaddr = SB_ENUM_BASE + (coreidx * SB_CORE_SIZE);
+
+	switch (si->bus) {
+	case SB_BUS:
+		/* map new one */
+		if (!si->regs[coreidx]) {
+			si->regs[coreidx] = (void*)REG_MAP(sbaddr, SB_CORE_SIZE);
+			ASSERT(GOODREGS(si->regs[coreidx]));
+		}
+		si->curmap = si->regs[coreidx];
+		break;
+
+	case PCI_BUS:
+		/* point bar0 window */
+		OSL_PCI_WRITE_CONFIG(si->osh, PCI_BAR0_WIN, 4, sbaddr);
+		break;
+
+	case PCMCIA_BUS:
+		tmp = (sbaddr >> 12) & 0x0f;
+		OSL_PCMCIA_WRITE_ATTR(si->osh, PCMCIA_ADDR0, &tmp, 1);
+		tmp = (sbaddr >> 16) & 0xff;
+		OSL_PCMCIA_WRITE_ATTR(si->osh, PCMCIA_ADDR1, &tmp, 1);
+		tmp = (sbaddr >> 24) & 0xff;
+		OSL_PCMCIA_WRITE_ATTR(si->osh, PCMCIA_ADDR2, &tmp, 1);
+		break;
+	}
+
+	si->curidx = coreidx;
+
+	return (si->curmap);
+}
+
+/* change logical "focus" to the indicated core */
+void*
+sb_setcore(void *sbh, uint coreid, uint coreunit)
+{
+	sb_info_t *si;
+	uint idx;
+
+	si = SB_INFO(sbh);
+
+	idx = sb_findcoreidx(sbh, coreid, coreunit);
+	if (!GOODIDX(idx))
+		return (NULL);
+
+	return (sb_setcoreidx(sbh, idx));
+}
+
+/* return chip number */
+uint
+sb_chip(void *sbh)
+{
+	sb_info_t *si;
+
+	si = SB_INFO(sbh);
+	return (si->chip);
+}
+
+/* return chip revision number */
+uint
+sb_chiprev(void *sbh)
+{
+	sb_info_t *si;
+
+	si = SB_INFO(sbh);
+	return (si->chiprev);
+}
+
+/* return chip package option */
+uint
+sb_chippkg(void *sbh)
+{
+	sb_info_t *si;
+
+	si = SB_INFO(sbh);
+	return (si->chippkg);
+}
+
+/* return board vendor id */
+uint
+sb_boardvendor(void *sbh)
+{
+	sb_info_t *si;
+
+	si = SB_INFO(sbh);
+	return (si->boardvendor);
+}
+
+/* return boardtype */
+uint
+sb_boardtype(void *sbh)
+{
+	sb_info_t *si;
+	char *var;
+
+	si = SB_INFO(sbh);
+
+	if (si->bus == SB_BUS && si->boardtype == 0xffff) {
+		/* boardtype format is a hex string */
+		si->boardtype = getintvar(NULL, "boardtype");
+
+		/* backward compatibility for older boardtype string format */
+		if ((si->boardtype == 0) && (var = getvar(NULL, "boardtype"))) {
+			if (!strcmp(var, "bcm94710dev"))
+				si->boardtype = BCM94710D_BOARD;
+			else if (!strcmp(var, "bcm94710ap"))
+				si->boardtype = BCM94710AP_BOARD;
+			else if (!strcmp(var, "bcm94310u"))
+				si->boardtype = BCM94310U_BOARD;
+			else if (!strcmp(var, "bu4711"))
+				si->boardtype = BU4711_BOARD;
+			else if (!strcmp(var, "bu4710"))
+				si->boardtype = BU4710_BOARD;
+			else if (!strcmp(var, "bcm94702mn"))
+				si->boardtype = BCM94702MN_BOARD;
+			else if (!strcmp(var, "bcm94710r1"))
+				si->boardtype = BCM94710R1_BOARD;
+			else if (!strcmp(var, "bcm94710r4"))
+				si->boardtype = BCM94710R4_BOARD;
+			else if (!strcmp(var, "bcm94702cpci"))
+    				si->boardtype = BCM94702CPCI_BOARD;
+			else if (!strcmp(var, "bcm95380_rr"))
+    				si->boardtype = BCM95380RR_BOARD; 
+		}
+	}
+
+	return (si->boardtype);
+}
+
+/* return board bus style */
+uint
+sb_boardstyle(void *sbh)
+{
+	sb_info_t *si;
+	uint16 w;
+
+	si = SB_INFO(sbh);
+
+	if (si->bus == PCMCIA_BUS)
+		return (BOARDSTYLE_PCMCIA);
+
+	if (si->bus == SB_BUS)
+		return (BOARDSTYLE_SOC);
+
+	/* bus is PCI */
+
+	if (OSL_PCI_READ_CONFIG(si->osh, PCI_CFG_CIS, sizeof (uint32)) != 0)
+		return (BOARDSTYLE_CARDBUS);
+
+	if ((srom_read(si->bus, si->curmap, si->osh, (SPROM_SIZE - 1) * 2, 2, &w) == 0) &&
+	    (w == 0x0313))
+		return (BOARDSTYLE_CARDBUS);
+
+	return (BOARDSTYLE_PCI);
+}
+
+/* return boolean if sbh device is in pci hostmode or client mode */
+uint
+sb_bus(void *sbh)
+{
+	sb_info_t *si;
+
+	si = SB_INFO(sbh);
+	return (si->bus);
+}
+
+/* return list of found cores */
+uint
+sb_corelist(void *sbh, uint coreid[])
+{
+	sb_info_t *si;
+
+	si = SB_INFO(sbh);
+
+	bcopy((uchar*)si->coreid, (uchar*)coreid, (si->numcores * sizeof (uint)));
+	return (si->numcores);
+}
+
+/* return current register mapping */
+void *
+sb_coreregs(void *sbh)
+{
+	sb_info_t *si;
+
+	si = SB_INFO(sbh);
+	ASSERT(GOODREGS(si->curmap));
+
+	return (si->curmap);
+}
+
+/* Check if a target abort has happened and clear it */
+bool
+sb_taclear(void *sbh)
+{
+	sb_info_t *si;
+	bool rc = FALSE;
+	sbconfig_t *sb;
+
+	si = SB_INFO(sbh);
+	sb = REGS2SB(si->curmap);
+
+	if (si->bus == PCI_BUS) {
+		uint32 stcmd;
+
+		stcmd = OSL_PCI_READ_CONFIG(si->osh, PCI_CFG_CMD, sizeof(stcmd));
+		rc = (stcmd & 0x08000000) != 0;
+
+		if (rc) {
+			/* Target abort bit is set, clear it */
+			OSL_PCI_WRITE_CONFIG(si->osh, PCI_CFG_CMD, sizeof(stcmd), stcmd);
+		}
+	} else if (si->bus == PCMCIA_BUS) {
+		rc = FALSE;
+	}
+	else if (si->bus == SDIO_BUS) {
+		/* due to 4317 A0 HW bug, sdio core wedged on target abort, 
+		   just clear SBSErr bit blindly */
+		if (0x0 != R_SBREG(sbh, &sb->sbtmerrlog)) {
+			SB_ERROR(("SDIO target abort, clean it"));
+			W_SBREG(sbh, &sb->sbtmstatehigh, 0);
+		}
+		rc = FALSE;
+	}
+
+	return (rc);
+}
+
+/* do buffered registers update */
+void
+sb_commit(void *sbh)
+{
+	sb_info_t *si;
+	sbpciregs_t *pciregs;
+	uint origidx;
+	uint intr_val = 0;
+
+	si = SB_INFO(sbh);
+
+	origidx = si->curidx;
+	ASSERT(GOODIDX(origidx));
+
+	INTR_OFF(si, intr_val);
+	/* switch over to pci core */
+	pciregs = (sbpciregs_t*) sb_setcore(sbh, SB_PCI, 0);
+
+	/* do the buffer registers update */
+	W_REG(&pciregs->bcastaddr, SB_COMMIT);
+	W_REG(&pciregs->bcastdata, 0x0);
+
+	/* restore core index */
+	sb_setcoreidx(sbh, origidx);
+	INTR_RESTORE(si, intr_val);
+}
+
+/* reset and re-enable a core */
+void
+sb_core_reset(void *sbh, uint32 bits)
+{
+	sb_info_t *si;
+	sbconfig_t *sb;
+	volatile uint32 dummy;
+
+	si = SB_INFO(sbh);
+	ASSERT(GOODREGS(si->curmap));
+	sb = REGS2SB(si->curmap);
+
+	/*
+	 * Must do the disable sequence first to work for arbitrary current core state.
+	 */
+	sb_core_disable(sbh, bits);
+
+	/*
+	 * Now do the initialization sequence.
+	 */
+
+	/* set reset while enabling the clock and forcing them on throughout the core */
+	W_SBREG(sbh, &sb->sbtmstatelow, (SBTML_FGC | SBTML_CLK | SBTML_RESET | bits));
+	dummy = R_SBREG(sbh, &sb->sbtmstatelow);
+
+	if (sb_coreid(sbh) == SB_ILINE100) {
+		bcm_mdelay(50);
+	} else {
+		OSL_DELAY(1);
+	}
+
+	if (R_SBREG(sbh, &sb->sbtmstatehigh) & SBTMH_SERR) {
+		W_SBREG(sbh, &sb->sbtmstatehigh, 0);
+	}
+	if ((dummy = R_SBREG(sbh, &sb->sbimstate)) & (SBIM_IBE | SBIM_TO)) {
+		AND_SBREG(sbh, &sb->sbimstate, ~(SBIM_IBE | SBIM_TO));
+	}
+
+	/* clear reset and allow it to propagate throughout the core */
+	W_SBREG(sbh, &sb->sbtmstatelow, (SBTML_FGC | SBTML_CLK | bits));
+	dummy = R_SBREG(sbh, &sb->sbtmstatelow);
+	OSL_DELAY(1);
+
+	/* leave clock enabled */
+	W_SBREG(sbh, &sb->sbtmstatelow, (SBTML_CLK | bits));
+	dummy = R_SBREG(sbh, &sb->sbtmstatelow);
+	OSL_DELAY(1);
+}
+
+void
+sb_core_tofixup(void *sbh)
+{
+	sb_info_t *si;
+	sbconfig_t *sb;
+
+	si = SB_INFO(sbh);
+
+	if (si->pcirev >= 5)
+		return;
+
+	ASSERT(GOODREGS(si->curmap));
+	sb = REGS2SB(si->curmap);
+
+	if (si->bus == SB_BUS) {
+		SET_SBREG(sbh, &sb->sbimconfiglow,
+			  SBIMCL_RTO_MASK | SBIMCL_STO_MASK,
+			  (0x5 << SBIMCL_RTO_SHIFT) | 0x3);
+	} else {
+		if (sb_coreid(sbh) == SB_PCI) {
+			SET_SBREG(sbh, &sb->sbimconfiglow,
+				  SBIMCL_RTO_MASK | SBIMCL_STO_MASK,
+				  (0x3 << SBIMCL_RTO_SHIFT) | 0x2);
+		} else {
+			SET_SBREG(sbh, &sb->sbimconfiglow, (SBIMCL_RTO_MASK | SBIMCL_STO_MASK), 0);
+		}
+	}
+
+	sb_commit(sbh);
+}
+
+void
+sb_core_disable(void *sbh, uint32 bits)
+{
+	sb_info_t *si;
+	volatile uint32 dummy;
+	sbconfig_t *sb;
+
+	si = SB_INFO(sbh);
+
+	ASSERT(GOODREGS(si->curmap));
+	sb = REGS2SB(si->curmap);
+
+	/* must return if core is already in reset */
+	if (R_SBREG(sbh, &sb->sbtmstatelow) & SBTML_RESET)
+		return;
+
+	/* put into reset and return if clocks are not enabled */
+	if ((R_SBREG(sbh, &sb->sbtmstatelow) & SBTML_CLK) == 0)
+		goto disable;
+
+	/* set the reject bit */
+	W_SBREG(sbh, &sb->sbtmstatelow, (SBTML_CLK | SBTML_REJ));
+
+	/* spin until reject is set */
+	while ((R_SBREG(sbh, &sb->sbtmstatelow) & SBTML_REJ) == 0)
+		OSL_DELAY(1);
+
+	/* spin until sbtmstatehigh.busy is clear */
+	while (R_SBREG(sbh, &sb->sbtmstatehigh) & SBTMH_BUSY)
+		OSL_DELAY(1);
+
+	/* set reset and reject while enabling the clocks */
+	W_SBREG(sbh, &sb->sbtmstatelow, (bits | SBTML_FGC | SBTML_CLK | SBTML_REJ | SBTML_RESET));
+	dummy = R_SBREG(sbh, &sb->sbtmstatelow);
+	OSL_DELAY(10);
+
+ disable:
+	/* leave reset and reject asserted */
+	W_SBREG(sbh, &sb->sbtmstatelow, (bits | SBTML_REJ | SBTML_RESET));
+	OSL_DELAY(1);
+}
+
+void
+sb_watchdog(void *sbh, uint ticks)
+{
+	sb_info_t *si = SB_INFO(sbh);
+
+	/* instant NMI */
+	switch (si->gpioid) {
+	case SB_CC:
+		sb_corereg(sbh, si->gpioidx, OFFSETOF(chipcregs_t, watchdog), ~0, ticks);
+		break;
+	case SB_EXTIF:
+		sb_corereg(sbh, si->gpioidx, OFFSETOF(extifregs_t, watchdog), ~0, ticks);
+		break;
+	}
+}
+
+/* initialize the pcmcia core */
+void
+sb_pcmcia_init(void *sbh)
+{
+	sb_info_t *si;
+	uint8 cor;
+
+	si = SB_INFO(sbh);
+
+	/* enable d11 mac interrupts */
+	if (si->chip == BCM4301_DEVICE_ID) {
+		/* Have to use FCR2 in 4301 */
+		OSL_PCMCIA_READ_ATTR(si->osh, PCMCIA_FCR2 + PCMCIA_COR, &cor, 1);
+		cor |= COR_IRQEN | COR_FUNEN;
+		OSL_PCMCIA_WRITE_ATTR(si->osh, PCMCIA_FCR2 + PCMCIA_COR, &cor, 1);
+	} else {
+		OSL_PCMCIA_READ_ATTR(si->osh, PCMCIA_FCR0 + PCMCIA_COR, &cor, 1);
+		cor |= COR_IRQEN | COR_FUNEN;
+		OSL_PCMCIA_WRITE_ATTR(si->osh, PCMCIA_FCR0 + PCMCIA_COR, &cor, 1);
+	}
+
+}
+
+
+/*
+ * Configure the pci core for pci client (NIC) action
+ * and get appropriate dma offset value.
+ * coremask is the bitvec of cores by index to be enabled.
+ */
+void
+sb_pci_setup(void *sbh, uint32 *dmaoffset, uint coremask)
+{
+	sb_info_t *si;
+	sbconfig_t *sb;
+	sbpciregs_t *pciregs;
+	uint32 sbflag;
+	uint32 w;
+	uint idx;
+
+	si = SB_INFO(sbh);
+
+	if (dmaoffset)
+		*dmaoffset = 0;
+
+	/* if not pci bus, we're done */
+	if (si->bus != PCI_BUS)
+		return;
+
+	ASSERT(si->pciidx);
+
+	/* get current core index */
+	idx = si->curidx;
+
+	/* we interrupt on this backplane flag number */
+	ASSERT(GOODREGS(si->curmap));
+	sb = REGS2SB(si->curmap);
+	sbflag = R_SBREG(sbh, &sb->sbtpsflag) & SBTPS_NUM0_MASK;
+
+	/* switch over to pci core */
+	pciregs = (sbpciregs_t*) sb_setcoreidx(sbh, si->pciidx);
+	sb = REGS2SB(pciregs);
+
+	/*
+	 * Enable sb->pci interrupts.  Assume
+	 * PCI rev 2.3 support was added in pci core rev 6 and things changed..
+	 */
+	if (si->pcirev < 6) {
+		/* set sbintvec bit for our flag number */
+		OR_SBREG(sbh, &sb->sbintvec, (1 << sbflag));
+	} else {
+		/* pci config write to set this core bit in PCIIntMask */
+		w = OSL_PCI_READ_CONFIG(si->osh, PCI_INT_MASK, sizeof(uint32));
+		w |= (coremask << PCI_SBIM_SHIFT);
+		OSL_PCI_WRITE_CONFIG(si->osh, PCI_INT_MASK, sizeof(uint32), w);
+	}
+
+	/* enable prefetch and bursts for sonics-to-pci translation 2 */
+	OR_REG(&pciregs->sbtopci2, (SBTOPCI_PREF|SBTOPCI_BURST));
+
+	if (si->pcirev < 5) {
+		SET_SBREG(sbh, &sb->sbimconfiglow, SBIMCL_RTO_MASK | SBIMCL_STO_MASK,
+			(0x3 << SBIMCL_RTO_SHIFT) | 0x2);
+		sb_commit(sbh);
+	}
+
+	/* switch back to previous core */
+	sb_setcoreidx(sbh, idx);
+
+	/* use large sb pci dma window */
+	if (dmaoffset)
+		*dmaoffset = SB_PCI_DMA;
+}
+
+uint32
+sb_base(uint32 admatch)
+{
+	uint32 base;
+	uint type;
+
+	type = admatch & SBAM_TYPE_MASK;
+	ASSERT(type < 3);
+
+	base = 0;
+
+	if (type == 0) {
+		base = admatch & SBAM_BASE0_MASK;
+	} else if (type == 1) {
+		ASSERT(!(admatch & SBAM_ADNEG));	/* neg not supported */
+		base = admatch & SBAM_BASE1_MASK;
+	} else if (type == 2) {
+		ASSERT(!(admatch & SBAM_ADNEG));	/* neg not supported */
+		base = admatch & SBAM_BASE2_MASK;
+	}
+
+	return (base);
+}
+
+uint32
+sb_size(uint32 admatch)
+{
+	uint32 size;
+	uint type;
+
+	type = admatch & SBAM_TYPE_MASK;
+	ASSERT(type < 3);
+
+	size = 0;
+
+	if (type == 0) {
+		size = 1 << (((admatch & SBAM_ADINT0_MASK) >> SBAM_ADINT0_SHIFT) + 1);
+	} else if (type == 1) {
+		ASSERT(!(admatch & SBAM_ADNEG));	/* neg not supported */
+		size = 1 << (((admatch & SBAM_ADINT1_MASK) >> SBAM_ADINT1_SHIFT) + 1);
+	} else if (type == 2) {
+		ASSERT(!(admatch & SBAM_ADNEG));	/* neg not supported */
+		size = 1 << (((admatch & SBAM_ADINT2_MASK) >> SBAM_ADINT2_SHIFT) + 1);
+	}
+
+	return (size);
+}
+
+/* return the core-type instantiation # of the current core */
+uint
+sb_coreunit(void *sbh)
+{
+	sb_info_t *si;
+	uint idx;
+	uint coreid;
+	uint coreunit;
+	uint i;
+
+	si = SB_INFO(sbh);
+	coreunit = 0;
+
+	idx = si->curidx;
+
+	ASSERT(GOODREGS(si->curmap));
+	coreid = sb_coreid(sbh);
+
+	/* count the cores of our type */
+	for (i = 0; i < idx; i++)
+		if (si->coreid[i] == coreid)
+			coreunit++;
+
+	return (coreunit);
+}
+
+static INLINE uint32
+factor6(uint32 x)
+{
+	switch (x) {
+	case CC_F6_2:	return 2;
+	case CC_F6_3:	return 3;
+	case CC_F6_4:	return 4;
+	case CC_F6_5:	return 5;
+	case CC_F6_6:	return 6;
+	case CC_F6_7:	return 7;
+	default:	return 0;
+	}
+}
+
+/* calculate the speed the SB would run at given a set of clockcontrol values */
+uint32
+sb_clock_rate(uint32 pll_type, uint32 n, uint32 m)
+{
+	uint32 n1, n2, clock, m1, m2, m3, mc;
+
+	n1 = n & CN_N1_MASK;
+	n2 = (n & CN_N2_MASK) >> CN_N2_SHIFT;
+
+	if ((pll_type == PLL_TYPE1) || (pll_type == PLL_TYPE4)) {
+		n1 = factor6(n1);
+		n2 += CC_F5_BIAS;
+	} else if (pll_type == PLL_TYPE2) {
+		n1 += CC_T2_BIAS;
+		n2 += CC_T2_BIAS;
+		ASSERT((n1 >= 2) && (n1 <= 7));
+		ASSERT((n2 >= 5) && (n2 <= 23));
+	} else if (pll_type == PLL_TYPE3) {
+		return (100000000);
+	} else
+		ASSERT((pll_type >= PLL_TYPE1) && (pll_type <= PLL_TYPE4));
+
+	clock = CC_CLOCK_BASE * n1 * n2;
+
+	if (clock == 0)
+		return 0;
+
+	m1 = m & CC_M1_MASK;
+	m2 = (m & CC_M2_MASK) >> CC_M2_SHIFT;
+	m3 = (m & CC_M3_MASK) >> CC_M3_SHIFT;
+	mc = (m & CC_MC_MASK) >> CC_MC_SHIFT;
+
+	if ((pll_type == PLL_TYPE1) || (pll_type == PLL_TYPE4)) {
+		m1 = factor6(m1);
+		if (pll_type == PLL_TYPE1)
+			m2 += CC_F5_BIAS;
+		else
+			m2 = factor6(m2);
+		m3 = factor6(m3);
+
+		switch (mc) {
+		case CC_MC_BYPASS:	return (clock);
+		case CC_MC_M1:		return (clock / m1);
+		case CC_MC_M1M2:	return (clock / (m1 * m2));
+		case CC_MC_M1M2M3:	return (clock / (m1 * m2 * m3));
+		case CC_MC_M1M3:	return (clock / (m1 * m3));
+		default:		return (0);
+		}
+	} else {
+		ASSERT(pll_type == PLL_TYPE2);
+
+		m1 += CC_T2_BIAS;
+		m2 += CC_T2M2_BIAS;
+		m3 += CC_T2_BIAS;
+		ASSERT((m1 >= 2) && (m1 <= 7));
+		ASSERT((m2 >= 3) && (m2 <= 10));
+		ASSERT((m3 >= 2) && (m3 <= 7));
+
+		if ((mc & CC_T2MC_M1BYP) == 0)
+			clock /= m1;
+		if ((mc & CC_T2MC_M2BYP) == 0)
+			clock /= m2;
+		if ((mc & CC_T2MC_M3BYP) == 0)
+			clock /= m3;
+
+		return(clock);
+	}
+}
+
+/* returns the current speed the SB is running at */
+uint32
+sb_clock(void *sbh)
+{
+	sb_info_t *si;
+	extifregs_t *eir;
+	chipcregs_t *cc;
+	uint32 n, m;
+	uint idx;
+	uint32 pll_type, rate;
+	uint intr_val = 0;
+
+	si = SB_INFO(sbh);
+	idx = si->curidx;
+	pll_type = PLL_TYPE1;
+
+	INTR_OFF(si, intr_val);
+
+	/* switch to extif or chipc core */
+	if ((eir = (extifregs_t *) sb_setcore(sbh, SB_EXTIF, 0))) {
+		n = R_REG(&eir->clockcontrol_n);
+		m = R_REG(&eir->clockcontrol_sb);
+	} else if ((cc = (chipcregs_t *) sb_setcore(sbh, SB_CC, 0))) {
+		pll_type = R_REG(&cc->capabilities) & CAP_PLL_MASK;
+		n = R_REG(&cc->clockcontrol_n);
+		m = R_REG(&cc->clockcontrol_sb);
+	} else {
+		INTR_RESTORE(si, intr_val);
+		return 0;
+	}
+
+	/* calculate rate */
+	rate = sb_clock_rate(pll_type, n, m);
+
+	/* switch back to previous core */
+	sb_setcoreidx(sbh, idx);
+
+	INTR_RESTORE(si, intr_val);
+
+	return rate;
+}
+
+/* change logical "focus" to the gpio core for optimized access */
+void*
+sb_gpiosetcore(void *sbh)
+{
+	sb_info_t *si;
+
+	si = SB_INFO(sbh);
+
+	return (sb_setcoreidx(sbh, si->gpioidx));
+}
+
+/* mask&set gpiocontrol bits */
+uint32
+sb_gpiocontrol(void *sbh, uint32 mask, uint32 val)
+{
+	sb_info_t *si;
+	uint regoff;
+
+	si = SB_INFO(sbh);
+	regoff = 0;
+
+	switch (si->gpioid) {
+	case SB_CC:
+		regoff = OFFSETOF(chipcregs_t, gpiocontrol);
+		break;
+
+	case SB_PCI:
+		regoff = OFFSETOF(sbpciregs_t, gpiocontrol);
+		break;
+
+	case SB_EXTIF:
+		return (0);
+	}
+
+	return (sb_corereg(sbh, si->gpioidx, regoff, mask, val));
+}
+
+/* mask&set gpio output enable bits */
+uint32
+sb_gpioouten(void *sbh, uint32 mask, uint32 val)
+{
+	sb_info_t *si;
+	uint regoff;
+
+	si = SB_INFO(sbh);
+	regoff = 0;
+
+	switch (si->gpioid) {
+	case SB_CC:
+		regoff = OFFSETOF(chipcregs_t, gpioouten);
+		break;
+
+	case SB_PCI:
+		regoff = OFFSETOF(sbpciregs_t, gpioouten);
+		break;
+
+	case SB_EXTIF:
+		regoff = OFFSETOF(extifregs_t, gpio[0].outen);
+		break;
+	}
+
+	return (sb_corereg(sbh, si->gpioidx, regoff, mask, val));
+}
+
+/* mask&set gpio output bits */
+uint32
+sb_gpioout(void *sbh, uint32 mask, uint32 val)
+{
+	sb_info_t *si;
+	uint regoff;
+
+	si = SB_INFO(sbh);
+	regoff = 0;
+
+	switch (si->gpioid) {
+	case SB_CC:
+		regoff = OFFSETOF(chipcregs_t, gpioout);
+		break;
+
+	case SB_PCI:
+		regoff = OFFSETOF(sbpciregs_t, gpioout);
+		break;
+
+	case SB_EXTIF:
+		regoff = OFFSETOF(extifregs_t, gpio[0].out);
+		break;
+	}
+
+	return (sb_corereg(sbh, si->gpioidx, regoff, mask, val));
+}
+
+/* return the current gpioin register value */
+uint32
+sb_gpioin(void *sbh)
+{
+	sb_info_t *si;
+	uint regoff;
+
+	si = SB_INFO(sbh);
+	regoff = 0;
+
+	switch (si->gpioid) {
+	case SB_CC:
+		regoff = OFFSETOF(chipcregs_t, gpioin);
+		break;
+
+	case SB_PCI:
+		regoff = OFFSETOF(sbpciregs_t, gpioin);
+		break;
+
+	case SB_EXTIF:
+		regoff = OFFSETOF(extifregs_t, gpioin);
+		break;
+	}
+
+	return (sb_corereg(sbh, si->gpioidx, regoff, 0, 0));
+}
+
+/* mask&set gpio interrupt polarity bits */
+uint32
+sb_gpiointpolarity(void *sbh, uint32 mask, uint32 val)
+{
+	sb_info_t *si;
+	uint regoff;
+
+	si = SB_INFO(sbh);
+	regoff = 0;
+
+	switch (si->gpioid) {
+	case SB_CC:
+		regoff = OFFSETOF(chipcregs_t, gpiointpolarity);
+		break;
+
+	case SB_PCI:
+		/* pci gpio implementation does not support interrupt polarity */
+		ASSERT(0);
+		break;
+
+	case SB_EXTIF:
+		regoff = OFFSETOF(extifregs_t, gpiointpolarity);
+		break;
+	}
+
+	return (sb_corereg(sbh, si->gpioidx, regoff, mask, val));
+}
+
+/* mask&set gpio interrupt mask bits */
+uint32
+sb_gpiointmask(void *sbh, uint32 mask, uint32 val)
+{
+	sb_info_t *si;
+	uint regoff;
+
+	si = SB_INFO(sbh);
+	regoff = 0;
+
+	switch (si->gpioid) {
+	case SB_CC:
+		regoff = OFFSETOF(chipcregs_t, gpiointmask);
+		break;
+
+	case SB_PCI:
+		/* pci gpio implementation does not support interrupt mask */
+		ASSERT(0);
+		break;
+
+	case SB_EXTIF:
+		regoff = OFFSETOF(extifregs_t, gpiointmask);
+		break;
+	}
+
+	return (sb_corereg(sbh, si->gpioidx, regoff, mask, val));
+}
+
+
+/*
+ * Return the slowclock min or max frequency.
+ * Three sources of SLOW CLOCK:
+ *	1. On Chip LPO         -     32khz or 160khz
+ *	2. On Chip Xtal OSC    -     20mhz/4*(divider+1) 
+ *	3. External PCI clock  -     66mhz/4*(divider+1)
+ */
+static uint
+slowfreq(void *sbh, bool max)
+{
+	sb_info_t *si;
+	chipcregs_t *cc;
+	uint32 v;
+	uint div;
+
+	si = SB_INFO(sbh);
+
+	ASSERT(sb_coreid(sbh) == SB_CC);
+
+	cc = (chipcregs_t*) sb_setcoreidx(sbh, si->curidx);
+
+	/* shouldn't be here unless we've established the chip has dynamic power control */
+	ASSERT(R_REG(&cc->capabilities) & CAP_PWR_CTL);
+
+	if (si->ccrev < 6) {
+		v = OSL_PCI_READ_CONFIG(si->osh, PCI_GPIO_OUT, sizeof (uint32));
+
+		if (v & PCI_CFG_GPIO_SCS)
+			return (max? (PCIMAXFREQ/64) : (PCIMINFREQ/64));
+		else
+			return (max? (XTALMAXFREQ/32) : (XTALMINFREQ/32));
+	} else {
+		v = R_REG(&cc->slow_clk_ctl) & SCC_SS_MASK;
+		div = 4 * (((R_REG(&cc->slow_clk_ctl) & SCC_CD_MASK) >> SCC_CD_SHF) + 1);
+		if (v == SCC_SS_LPO)
+			return (max? LPOMAXFREQ : LPOMINFREQ);
+		else if (v == SCC_SS_XTAL)
+			return (max? (XTALMAXFREQ/div) : (XTALMINFREQ/div));
+		else if (v == SCC_SS_PCI)
+			return (max? (PCIMAXFREQ/div) : (PCIMINFREQ/div));
+		else
+			ASSERT(0);
+	}
+	return (0);
+}
+
+/* initialize power control delay registers */
+void
+sb_pwrctl_init(void *sbh)
+{
+	sb_info_t *si;
+	uint origidx;
+	chipcregs_t *cc;
+	uint slowmaxfreq;
+	uint pll_on_delay, fref_sel_delay;
+
+	si = SB_INFO(sbh);
+
+	if (si->bus == SB_BUS)
+		return;
+
+	origidx = si->curidx;
+
+	if ((cc = (chipcregs_t*) sb_setcore(sbh, SB_CC, 0)) == NULL)
+		return;
+
+	if (!(R_REG(&cc->capabilities) & CAP_PWR_CTL))
+		goto done;
+
+	slowmaxfreq = slowfreq(sbh, TRUE);
+	pll_on_delay = ((slowmaxfreq * PLL_DELAY) + 999999) / 1000000;
+	fref_sel_delay = ((slowmaxfreq * FREF_DELAY) + 999999) / 1000000;
+
+	W_REG(&cc->pll_on_delay, pll_on_delay);
+	W_REG(&cc->fref_sel_delay, fref_sel_delay);
+
+	/* 4317pc does not work with SlowClock less than 5Mhz */
+	if (si->bus == PCMCIA_BUS)
+		SET_REG(&cc->slow_clk_ctl, SCC_CD_MASK, (0 << SCC_CD_SHF));
+
+done:
+	sb_setcoreidx(sbh, origidx);
+}
+
+/* return the value suitable for writing to the dot11 core FAST_PWRUP_DELAY register */
+uint16
+sb_pwrctl_fast_pwrup_delay(void *sbh)
+{
+	sb_info_t *si;
+	uint origidx;
+	chipcregs_t *cc;
+	uint slowminfreq;
+	uint16 fpdelay;
+	uint intr_val = 0;
+
+	si = SB_INFO(sbh);
+	fpdelay = 0;
+	origidx = si->curidx;
+
+	if (si->bus == SB_BUS)
+		goto done;
+
+	INTR_OFF(si, intr_val);
+
+	if ((cc = (chipcregs_t*) sb_setcore(sbh, SB_CC, 0)) == NULL)
+		goto done;
+
+	if (!(R_REG(&cc->capabilities) & CAP_PWR_CTL))
+		goto done;
+
+	slowminfreq = slowfreq(sbh, FALSE);
+	fpdelay = (((R_REG(&cc->pll_on_delay) + 2) * 1000000) + (slowminfreq - 1)) / slowminfreq;
+
+done:
+	sb_setcoreidx(sbh, origidx);
+	INTR_RESTORE(si, intr_val);
+	return (fpdelay);
+}
+
+/* turn primary xtal and/or pll off/on */
+int
+sb_pwrctl_xtal(void *sbh, uint what, bool on)
+{
+	sb_info_t *si;
+	uint32 in, out, outen;
+
+	si = SB_INFO(sbh);
+
+
+	if (si->bus == PCMCIA_BUS) {
+		return (0);
+	}
+
+	if (si->bus != PCI_BUS) 
+		return (-1);
+
+	in = OSL_PCI_READ_CONFIG(si->osh, PCI_GPIO_IN, sizeof (uint32));
+	out = OSL_PCI_READ_CONFIG(si->osh, PCI_GPIO_OUT, sizeof (uint32));
+	outen = OSL_PCI_READ_CONFIG(si->osh, PCI_GPIO_OUTEN, sizeof (uint32));
+
+	/*
+	 * We can't actually read the state of the PLLPD so we infer it
+	 * by the value of XTAL_PU which *is* readable via gpioin.
+	 */
+	if (on && (in & PCI_CFG_GPIO_XTAL))
+		return (0);
+
+	if (what & XTAL)
+		outen |= PCI_CFG_GPIO_XTAL;
+	if (what & PLL)
+		outen |= PCI_CFG_GPIO_PLL;
+
+	if (on) {
+		/* turn primary xtal on */
+		if (what & XTAL) {
+			out |= PCI_CFG_GPIO_XTAL;
+			if (what & PLL)
+				out |= PCI_CFG_GPIO_PLL;
+			OSL_PCI_WRITE_CONFIG(si->osh, PCI_GPIO_OUT, sizeof (uint32), out);
+			OSL_PCI_WRITE_CONFIG(si->osh, PCI_GPIO_OUTEN, sizeof (uint32), outen);
+			OSL_DELAY(200);
+		}
+
+		/* turn pll on */
+		if (what & PLL) {
+			out &= ~PCI_CFG_GPIO_PLL;
+			OSL_PCI_WRITE_CONFIG(si->osh, PCI_GPIO_OUT, sizeof (uint32), out);
+			OSL_DELAY(2000);
+		}
+	} else {
+		if (what & XTAL)
+			out &= ~PCI_CFG_GPIO_XTAL;
+		if (what & PLL)
+			out |= PCI_CFG_GPIO_PLL;
+		OSL_PCI_WRITE_CONFIG(si->osh, PCI_GPIO_OUT, sizeof (uint32), out);
+		OSL_PCI_WRITE_CONFIG(si->osh, PCI_GPIO_OUTEN, sizeof (uint32), outen);
+	}
+
+	return (0);
+}
+
+/* set dynamic power control mode (forceslow, forcefast, dynamic) */
+/*   returns true if ignore pll off is set and false if it is not */
+bool
+sb_pwrctl_clk(void *sbh, uint mode)
+{
+	sb_info_t *si;
+	uint origidx;
+	chipcregs_t *cc;
+	uint32 scc;
+	bool forcefastclk=FALSE;
+	uint intr_val = 0;
+
+	si = SB_INFO(sbh);
+
+	/* chipcommon cores prior to rev6 don't support slowclkcontrol */
+	if (si->ccrev < 6)
+		return (FALSE);
+
+	INTR_OFF(si, intr_val);
+
+	origidx = si->curidx;
+
+	cc = (chipcregs_t*) sb_setcore(sbh, SB_CC, 0);
+	ASSERT(cc != NULL);
+
+	if (!(R_REG(&cc->capabilities) & CAP_PWR_CTL))
+		goto done;
+
+	switch (mode) {
+	case CLK_FAST:	/* force fast (pll) clock */
+		/* don't forget to force xtal back on before we clear SCC_DYN_XTAL.. */
+		sb_pwrctl_xtal(sbh, XTAL, ON);
+
+		SET_REG(&cc->slow_clk_ctl, (SCC_XC | SCC_FS | SCC_IP), SCC_IP);
+		break;
+
+	case CLK_SLOW:	/* force slow clock */
+		if ((si->bus == SDIO_BUS) || (si->bus == PCMCIA_BUS))
+			return (-1);
+
+		if (si->ccrev >= 6)
+			OR_REG(&cc->slow_clk_ctl, SCC_FS);
+		break;
+
+	case CLK_DYNAMIC:	/* enable dynamic power control */
+		scc = R_REG(&cc->slow_clk_ctl);
+		scc &= ~(SCC_FS | SCC_IP | SCC_XC);
+		if ((scc & SCC_SS_MASK) != SCC_SS_XTAL)
+			scc |= SCC_XC;
+		W_REG(&cc->slow_clk_ctl, scc);
+
+		/* for dynamic control, we have to release our xtal_pu "force on" */
+		if (scc & SCC_XC)
+			sb_pwrctl_xtal(sbh, XTAL, OFF);
+		break;
+	}
+	
+	/* Is the h/w forcing the use of the fast clk */
+	forcefastclk = (bool)((R_REG(&cc->slow_clk_ctl) & SCC_IP) == SCC_IP);
+
+done:
+	sb_setcoreidx(sbh, origidx);
+	INTR_RESTORE(si, intr_val);
+	return (forcefastclk);
+}
+
+/* register driver interrupt disabling and restoring callback functions */
+void
+sb_register_intr_callback(void *sbh, void *intrsoff_fn, void *intrsrestore_fn, void *intr_arg)
+{
+	sb_info_t *si;
+
+	si = SB_INFO(sbh);
+	si->intr_arg = intr_arg;
+	si->intrsoff_fn = (sb_intrsoff_t)intrsoff_fn;
+	si->intrsrestore_fn = (sb_intrsrestore_t)intrsrestore_fn;
+	/* save current core id.  when this function called, the current core
+	 * must be the core which provides driver functions(il, et, wl, etc.)
+	 */
+	si->dev_coreid = si->coreid[si->curidx];
+}
+
+
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/bcm4710.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcm4710.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/bcm4710.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcm4710.h	2005-08-28 11:12:20.430859152 +0200
@@ -0,0 +1,90 @@
+/*
+ * BCM4710 address space map and definitions
+ * Think twice before adding to this file, this is not the kitchen sink
+ * These definitions are not guaranteed for all 47xx chips, only the 4710
+ *
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef _bcm4710_h_
+#define _bcm4710_h_
+
+/* Address map */
+#define BCM4710_SDRAM		0x00000000	/* Physical SDRAM */
+#define BCM4710_PCI_MEM		0x08000000	/* Host Mode PCI memory access space (64 MB) */
+#define BCM4710_PCI_CFG		0x0c000000	/* Host Mode PCI configuration space (64 MB) */
+#define BCM4710_PCI_DMA		0x40000000	/* Client Mode PCI memory access space (1 GB) */
+#define	BCM4710_SDRAM_SWAPPED	0x10000000	/* Byteswapped Physical SDRAM */
+#define BCM4710_ENUM		0x18000000	/* Beginning of core enumeration space */
+
+/* Core register space */
+#define BCM4710_REG_SDRAM	0x18000000	/* SDRAM core registers */
+#define BCM4710_REG_ILINE20	0x18001000	/* InsideLine20 core registers */
+#define BCM4710_REG_EMAC0	0x18002000	/* Ethernet MAC 0 core registers */
+#define BCM4710_REG_CODEC	0x18003000	/* Codec core registers */
+#define BCM4710_REG_USB		0x18004000	/* USB core registers */
+#define BCM4710_REG_PCI		0x18005000	/* PCI core registers */
+#define BCM4710_REG_MIPS	0x18006000	/* MIPS core registers */
+#define BCM4710_REG_EXTIF	0x18007000	/* External Interface core registers */
+#define BCM4710_REG_EMAC1	0x18008000	/* Ethernet MAC 1 core registers */
+
+#define	BCM4710_EXTIF		0x1f000000	/* External Interface base address */
+#define BCM4710_PCMCIA_MEM	0x1f000000	/* External Interface PCMCIA memory access */
+#define BCM4710_PCMCIA_IO	0x1f100000	/* PCMCIA I/O access */
+#define BCM4710_PCMCIA_CONF	0x1f200000	/* PCMCIA configuration */
+#define BCM4710_PROG		0x1f800000	/* Programable interface */
+#define BCM4710_FLASH		0x1fc00000	/* Flash */
+
+#define	BCM4710_EJTAG		0xff200000	/* MIPS EJTAG space (2M) */
+
+#define	BCM4710_UART		(BCM4710_REG_EXTIF + 0x00000300)
+
+#define	BCM4710_EUART		(BCM4710_EXTIF + 0x00800000)
+#define	BCM4710_LED		(BCM4710_EXTIF + 0x00900000)
+
+#define	SBFLAG_PCI	0
+#define	SBFLAG_ENET0	1
+#define	SBFLAG_ILINE20	2
+#define	SBFLAG_CODEC	3
+#define	SBFLAG_USB	4
+#define	SBFLAG_EXTIF	5
+#define	SBFLAG_ENET1	6
+
+#ifdef	CONFIG_HWSIM
+#define	BCM4710_TRACE(trval)        do { *((int *)0xa0000f18) = (trval); } while (0)
+#else
+#define	BCM4710_TRACE(trval)
+#endif
+
+
+/* BCM94702 CPCI -ExtIF used for LocalBus devs */
+
+#define BCM94702_CPCI_RESET_ADDR    	 BCM4710_EXTIF
+#define BCM94702_CPCI_BOARDID_ADDR  	(BCM4710_EXTIF | 0x4000)
+#define BCM94702_CPCI_DOC_ADDR      	(BCM4710_EXTIF | 0x6000)
+#define BCM94702_DOC_ADDR                BCM94702_CPCI_DOC_ADDR
+#define BCM94702_CPCI_LED_ADDR      	(BCM4710_EXTIF | 0xc000)
+#define BCM94702_CPCI_NVRAM_ADDR    	(BCM4710_EXTIF | 0xe000)
+#define BCM94702_CPCI_NVRAM_SIZE         0x1ff0 /* 8K NVRAM : DS1743/STM48txx*/
+#define BCM94702_CPCI_TOD_REG_BASE       (BCM94702_CPCI_NVRAM_ADDR | 0x1ff0)
+
+#define LED_REG(x)      \
+ (*(volatile unsigned char *) (KSEG1ADDR(BCM94702_CPCI_LED_ADDR) + (x)))
+
+/* 
+ * Reset function implemented in PLD.  Read or write should trigger hard reset 
+ */
+#define SYS_HARD_RESET()   \
+    { for (;;) \
+     *( (volatile unsigned char *)\
+      KSEG1ADDR(BCM94702_CPCI_RESET_ADDR) ) = 0x80; \
+    }
+
+#endif /* _bcm4710_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/bcmdevs.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmdevs.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/bcmdevs.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmdevs.h	2005-08-28 11:12:20.431859000 +0200
@@ -0,0 +1,238 @@
+/*
+ * Broadcom device-specific manifest constants.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ */
+
+#ifndef	_BCMDEVS_H
+#define	_BCMDEVS_H
+
+
+/* Known PCI vendor Id's */
+#define	VENDOR_EPIGRAM		0xfeda
+#define	VENDOR_BROADCOM		0x14e4
+#define	VENDOR_3COM		0x10b7
+#define	VENDOR_NETGEAR		0x1385
+#define	VENDOR_DIAMOND		0x1092
+#define	VENDOR_DELL		0x1028
+#define	VENDOR_HP		0x0e11
+#define	VENDOR_APPLE		0x106b
+
+/* PCI Device Id's */
+#define	BCM4210_DEVICE_ID	0x1072		/* never used */
+#define	BCM4211_DEVICE_ID	0x4211
+#define	BCM4230_DEVICE_ID	0x1086		/* never used */
+#define	BCM4231_DEVICE_ID	0x4231
+
+#define	BCM4410_DEVICE_ID	0x4410		/* bcm44xx family pci iline */
+#define	BCM4430_DEVICE_ID	0x4430		/* bcm44xx family cardbus iline */
+#define	BCM4412_DEVICE_ID	0x4412		/* bcm44xx family pci enet */
+#define	BCM4432_DEVICE_ID	0x4432		/* bcm44xx family cardbus enet */
+
+#define	BCM3352_DEVICE_ID	0x3352		/* bcm3352 device id */
+#define	BCM3360_DEVICE_ID	0x3360		/* bcm3360 device id */
+
+#define	EPI41210_DEVICE_ID	0xa0fa		/* bcm4210 */
+#define	EPI41230_DEVICE_ID	0xa10e		/* bcm4230 */
+
+#define	BCM47XX_ILINE_ID	0x4711		/* 47xx iline20 */
+#define	BCM47XX_V90_ID		0x4712		/* 47xx v90 codec */
+#define	BCM47XX_ENET_ID		0x4713		/* 47xx enet */
+#define	BCM47XX_EXT_ID		0x4714		/* 47xx external i/f */
+#define	BCM47XX_USB_ID		0x4715		/* 47xx usb */
+#define	BCM47XX_USBH_ID		0x4716		/* 47xx usb host */
+#define	BCM47XX_USBD_ID		0x4717		/* 47xx usb device */
+#define	BCM47XX_IPSEC_ID	0x4718		/* 47xx ipsec */
+
+#define	BCM4710_DEVICE_ID	0x4710		/* 4710 primary function 0 */
+
+#define	BCM4610_DEVICE_ID	0x4610		/* 4610 primary function 0 */
+#define	BCM4610_ILINE_ID	0x4611		/* 4610 iline100 */
+#define	BCM4610_V90_ID		0x4612		/* 4610 v90 codec */
+#define	BCM4610_ENET_ID		0x4613		/* 4610 enet */
+#define	BCM4610_EXT_ID		0x4614		/* 4610 external i/f */
+#define	BCM4610_USB_ID		0x4615		/* 4610 usb */
+
+#define	BCM4402_DEVICE_ID	0x4402		/* 4402 primary function 0 */
+#define	BCM4402_ENET_ID		0x4402		/* 4402 enet */
+#define	BCM4402_V90_ID		0x4403		/* 4402 v90 codec */
+
+#define	BCM4301_DEVICE_ID	0x4301		/* 4301 primary function 0 */
+#define	BCM4301_D11B_ID		0x4301		/* 4301 802.11b */
+
+#define	BCM4307_DEVICE_ID	0x4307		/* 4307 primary function 0 */
+#define	BCM4307_V90_ID		0x4305		/* 4307 v90 codec */
+#define	BCM4307_ENET_ID		0x4306		/* 4307 enet */
+#define	BCM4307_D11B_ID		0x4307		/* 4307 802.11b */
+
+#define	BCM4306_DEVICE_ID	0x4306		/* 4306 chipcommon chipid */
+#define	BCM4306_D11G_ID		0x4320		/* 4306 802.11g */
+#define	BCM4306_D11G_ID2	0x4325		
+#define	BCM4306_D11A_ID		0x4321		/* 4306 802.11a */
+#define	BCM4306_UART_ID		0x4322		/* 4306 uart */
+#define	BCM4306_V90_ID		0x4323		/* 4306 v90 codec */
+#define	BCM4306_D11DUAL_ID	0x4324		/* 4306 dual A+B */
+
+#define	BCM4309_PKG_ID		1		/* 4309 package id */
+
+#define	BCM4303_D11B_ID		0x4303		/* 4303 802.11b */
+#define	BCM4303_PKG_ID		2		/* 4303 package id */
+
+#define	BCM4310_DEVICE_ID	0x4310		/* 4310 chipcommon chipid */
+#define	BCM4310_D11B_ID		0x4311		/* 4310 802.11b */
+#define	BCM4310_UART_ID		0x4312		/* 4310 uart */
+#define	BCM4310_ENET_ID		0x4313		/* 4310 enet */
+#define	BCM4310_USB_ID		0x4315		/* 4310 usb */
+
+#define	BCM4704_DEVICE_ID	0x4704		/* 4704 chipcommon chipid */
+#define	BCM4704_ENET_ID		0x4706		/* 4704 enet (Use 47XX_ENET_ID instead!) */
+
+#define	BCM4317_DEVICE_ID	0x4317		/* 4317 chip common chipid */
+
+#define	BCM4712_DEVICE_ID	0x4712		/* 4712 chipcommon chipid */
+#define	BCM4712_MIPS_ID		0x4720		/* 4712 base devid */
+#define	BCM4712SMALL_PKG_ID	1		/* 200pin 4712 package id */
+
+#define	SDIOH_FPGA_ID		0x4380		/* sdio host fpga */
+
+#define BCM5365_DEVICE_ID       0x5365          /* 5365 chipcommon chipid */
+
+
+/* PCMCIA vendor Id's */
+
+#define	VENDOR_BROADCOM_PCMCIA	0x02d0
+
+/* SDIO vendor Id's */
+#define	VENDOR_BROADCOM_SDIO	0x00BF
+
+
+/* boardflags */
+#define	BFL_BTCOEXIST		0x0001	/* This board implements Bluetooth coexistance */
+#define	BFL_PACTRL		0x0002	/* This board has gpio 9 controlling the PA */
+#define	BFL_AIRLINEMODE		0x0004	/* This board implements gpio13 radio disable indication */
+#define	BFL_ENETSPI		0x0010	/* This board has ephy roboswitch spi */
+#define	BFL_CCKHIPWR		0x0040	/* Can do high-power CCK transmission */
+#define	BFL_ENETADM		0x0080	/* This board has ADMtek switch */
+#define	BFL_ENETVLAN		0x0100	/* This board can do vlan */
+
+/* board specific GPIO assignment, gpio 0-3 are also customer-configurable led */
+#define BOARD_GPIO_HWRAD_B	0x010	/* bit 4 is HWRAD input on 4301 */
+#define	BOARD_GPIO_BTC_IN	0x080	/* bit 7 is BT Coexistance Input */
+#define	BOARD_GPIO_BTC_OUT	0x100	/* bit 8 is BT Coexistance Out */
+#define	BOARD_GPIO_PACTRL	0x200	/* bit 9 controls the PA on new 4306 boards */
+#define	PCI_CFG_GPIO_SCS	0x10	/* PCI config space bit 4 for 4306c0 slow clock source */
+#define PCI_CFG_GPIO_HWRAD	0x20	/* PCI config space GPIO 13 for hw radio disable */
+#define PCI_CFG_GPIO_XTAL	0x40	/* PCI config space GPIO 14 for Xtal powerup */
+#define PCI_CFG_GPIO_PLL	0x80	/* PCI config space GPIO 15 for PLL powerdown */
+
+/* Bus types */
+#define	SB_BUS			0	/* Silicon Backplane */
+#define	PCI_BUS			1	/* PCI target */
+#define	PCMCIA_BUS		2	/* PCMCIA target */
+#define SDIO_BUS		3	/* SDIO target */
+
+/* Reference Board Types */
+
+#define	BU4710_BOARD		0x0400
+#define	VSIM4710_BOARD		0x0401
+#define	QT4710_BOARD		0x0402
+
+#define	BU4610_BOARD		0x0403
+#define	VSIM4610_BOARD		0x0404
+
+#define	BU4307_BOARD		0x0405
+#define	BCM94301CB_BOARD	0x0406
+#define	BCM94301PC_BOARD	0x0406		/* Pcmcia 5v card */
+#define	BCM94301MP_BOARD	0x0407
+#define	BCM94307MP_BOARD	0x0408
+#define	BCMAP4307_BOARD		0x0409
+
+#define	BU4309_BOARD		0x040a
+#define	BCM94309CB_BOARD	0x040b
+#define	BCM94309MP_BOARD	0x040c
+#define	BCM4309AP_BOARD		0x040d
+
+#define	BCM94302MP_BOARD	0x040e
+
+#define	VSIM4310_BOARD		0x040f
+#define	BU4711_BOARD		0x0410
+#define	BCM94310U_BOARD		0x0411
+#define	BCM94310AP_BOARD	0x0412
+#define	BCM94310MP_BOARD	0x0414
+
+#define	BU4306_BOARD		0x0416
+#define	BCM94306CB_BOARD	0x0417
+#define	BCM94306MP_BOARD	0x0418
+
+#define	BCM94710D_BOARD		0x041a
+#define	BCM94710R1_BOARD	0x041b
+#define	BCM94710R4_BOARD	0x041c
+#define	BCM94710AP_BOARD	0x041d
+
+
+#define	BU2050_BOARD		0x041f
+
+
+#define	BCM94309G_BOARD		0x0421
+
+#define	BCM94301PC3_BOARD	0x0422		/* Pcmcia 3.3v card */
+
+#define	BU4704_BOARD		0x0423
+#define	BU4702_BOARD		0x0424
+
+#define	BCM94306PC_BOARD	0x0425		/* pcmcia 3.3v 4306 card */
+
+#define	BU4317_BOARD		0x0426
+
+
+#define	BCM94702MN_BOARD	0x0428
+
+/* BCM4702 1U CompactPCI Board */
+#define	BCM94702CPCI_BOARD	0x0429
+
+/* BCM4702 with BCM95380 VLAN Router */
+#define	BCM95380RR_BOARD	0x042a
+
+/* cb4306 with SiGe PA */
+#define	BCM94306CBSG_BOARD	0x042b
+
+/* mp4301 with 2050 radio */
+#define	BCM94301MPL_BOARD	0x042c
+
+/* cb4306 with SiGe PA */
+#define	PCSG94306_BOARD		0x042d
+
+/* bu4704 with sdram */
+#define	BU4704SD_BOARD		0x042e
+
+/* Dual 11a/11g Router */
+#define	BCM94704AGR_BOARD	0x042f
+
+/* 11a-only minipci */
+#define	BCM94308MP_BOARD	0x0430
+
+
+
+/* BCM94317 boards */
+#define BCM94317CB_BOARD	0x0440
+#define BCM94317MP_BOARD	0x0441
+#define BCM94317PCMCIA_BOARD	0x0442
+#define BCM94317SDIO_BOARD	0x0443
+
+#define BU4712_BOARD		0x0444
+
+/* BCM4712 boards */
+#define BCM94712AGR_BOARD	0x0445
+#define BCM94712AP_BOARD	0x0446
+
+/* BCM4702 boards */
+#define CT4702AP_BOARD		0x0447
+
+#endif /* _BCMDEVS_H */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/bcmendian.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmendian.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/bcmendian.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmendian.h	2005-08-28 11:12:20.431859000 +0200
@@ -0,0 +1,125 @@
+/*******************************************************************************
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * local version of endian.h - byte order defines
+ ******************************************************************************/
+
+#ifndef _BCMENDIAN_H_
+#define _BCMENDIAN_H_
+
+#include <typedefs.h>
+
+/* Byte swap a 16 bit value */
+#define BCMSWAP16(val) \
+	((uint16)( \
+		(((uint16)(val) & (uint16)0x00ffU) << 8) | \
+		(((uint16)(val) & (uint16)0xff00U) >> 8) ))
+	
+/* Byte swap a 32 bit value */
+#define BCMSWAP32(val) \
+	((uint32)( \
+		(((uint32)(val) & (uint32)0x000000ffUL) << 24) | \
+		(((uint32)(val) & (uint32)0x0000ff00UL) <<  8) | \
+		(((uint32)(val) & (uint32)0x00ff0000UL) >>  8) | \
+		(((uint32)(val) & (uint32)0xff000000UL) >> 24) ))
+
+static INLINE uint16
+bcmswap16(uint16 val)
+{
+	return BCMSWAP16(val);
+}
+
+static INLINE uint32
+bcmswap32(uint32 val)
+{
+	return BCMSWAP32(val);
+}
+
+/* buf	- start of buffer of shorts to swap */
+/* len  - byte length of buffer */
+static INLINE void
+bcmswap16_buf(uint16 *buf, uint len)
+{
+	len = len/2;
+
+	while(len--){
+		*buf = bcmswap16(*buf);
+		buf++;
+	}
+}
+
+#ifndef hton16
+#ifndef IL_BIGENDIAN
+#define HTON16(i) BCMSWAP16(i)
+#define	hton16(i) bcmswap16(i)
+#define	hton32(i) bcmswap32(i)
+#define	ntoh16(i) bcmswap16(i)
+#define	ntoh32(i) bcmswap32(i)
+#define ltoh16(i) (i)
+#define ltoh32(i) (i)
+#define htol16(i) (i)
+#define htol32(i) (i)
+#else
+#define HTON16(i) (i)
+#define	hton16(i) (i)
+#define	hton32(i) (i)
+#define	ntoh16(i) (i)
+#define	ntoh32(i) (i)
+#define	ltoh16(i) bcmswap16(i)
+#define	ltoh32(i) bcmswap32(i)
+#define htol16(i) bcmswap16(i)
+#define htol32(i) bcmswap32(i)
+#endif
+#endif
+
+#ifndef IL_BIGENDIAN
+#define ltoh16_buf(buf, i)
+#define htol16_buf(buf, i)
+#else
+#define ltoh16_buf(buf, i) bcmswap16_buf((uint16*)buf, i)
+#define htol16_buf(buf, i) bcmswap16_buf((uint16*)buf, i)
+#endif
+
+/*
+* load 16-bit value from unaligned little endian byte array.
+*/
+static INLINE uint16
+ltoh16_ua(uint8 *bytes)
+{
+	return (bytes[1]<<8)+bytes[0];
+}
+
+/*
+* load 32-bit value from unaligned little endian byte array.
+*/
+static INLINE uint32
+ltoh32_ua(uint8 *bytes)
+{
+	return (bytes[3]<<24)+(bytes[2]<<16)+(bytes[1]<<8)+bytes[0];
+}
+
+/*
+* load 16-bit value from unaligned big(network) endian byte array.
+*/
+static INLINE uint16
+ntoh16_ua(uint8 *bytes)
+{
+	return (bytes[0]<<8)+bytes[1];
+}
+
+/*
+* load 32-bit value from unaligned big(network) endian byte array.
+*/
+static INLINE uint32
+ntoh32_ua(uint8 *bytes)
+{
+	return (bytes[0]<<24)+(bytes[1]<<16)+(bytes[2]<<8)+bytes[3];
+}
+
+#endif /* _BCMENDIAN_H_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/bcmenet47xx.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmenet47xx.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/bcmenet47xx.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmenet47xx.h	2005-08-28 11:12:20.432858848 +0200
@@ -0,0 +1,229 @@
+/*
+ * Hardware-specific definitions for
+ * Broadcom BCM47XX 10/100 Mbps Ethernet cores.
+ *
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef	_bcmenet_47xx_h_
+#define	_bcmenet_47xx_h_
+
+#include <bcmdevs.h>
+#include <hnddma.h>
+
+#define	BCMENET_NFILTERS	64		/* # ethernet address filter entries */
+#define	BCMENET_MCHASHBASE	0x200		/* multicast hash filter base address */
+#define	BCMENET_MCHASHSIZE	256		/* multicast hash filter size in bytes */
+#define	BCMENET_MAX_DMA		4096		/* chip has 12 bits of DMA addressing */
+
+/* power management event wakeup pattern constants */
+#define	BCMENET_NPMP		4		/* chip supports 4 wakeup patterns */
+#define	BCMENET_PMPBASE		0x400		/* wakeup pattern base address */
+#define	BCMENET_PMPSIZE		0x80		/* 128bytes each pattern */
+#define	BCMENET_PMMBASE		0x600		/* wakeup mask base address */
+#define	BCMENET_PMMSIZE		0x10		/* 128bits each mask */
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define	_PADLINE(line)	pad ## line
+#define	_XSTR(line)	_PADLINE(line)
+#define	PAD		_XSTR(__LINE__)
+#endif	/* PAD */
+
+/* sometimes you just need the enet mib definitions */
+#include <bcmenetmib.h>
+
+/*
+ * Host Interface Registers
+ */
+typedef volatile struct _bcmenettregs {
+	/* Device and Power Control */
+	uint32	devcontrol;
+	uint32	PAD[2];
+	uint32	biststatus;
+	uint32	wakeuplength;
+	uint32	PAD[3];
+	
+	/* Interrupt Control */
+	uint32	intstatus;
+	uint32	intmask;
+	uint32	gptimer;
+	uint32	PAD[23];
+
+	/* Ethernet MAC Address Filtering Control */
+	uint32	PAD[2];
+	uint32	enetftaddr;
+	uint32	enetftdata;
+	uint32	PAD[2];
+
+	/* Ethernet MAC Control */
+	uint32	emactxmaxburstlen;
+	uint32	emacrxmaxburstlen;
+	uint32	emaccontrol;
+	uint32	emacflowcontrol;
+
+	uint32	PAD[20];
+
+	/* DMA Lazy Interrupt Control */
+	uint32	intrecvlazy;
+	uint32	PAD[63];
+
+	/* DMA engine */
+	dmaregs_t	dmaregs;
+	dmafifo_t	dmafifo;
+	uint32	PAD[116];
+
+	/* EMAC Registers */
+	uint32 rxconfig;
+	uint32 rxmaxlength;
+	uint32 txmaxlength;
+	uint32 PAD;
+	uint32 mdiocontrol;
+	uint32 mdiodata;
+	uint32 emacintmask;
+	uint32 emacintstatus;
+	uint32 camdatalo;
+	uint32 camdatahi;
+	uint32 camcontrol;
+	uint32 enetcontrol;
+	uint32 txcontrol;
+	uint32 txwatermark;
+	uint32 mibcontrol;
+	uint32 PAD[49];
+
+	/* EMAC MIB counters */
+	bcmenetmib_t	mib;
+
+	uint32	PAD[585];
+
+	/* Sonics SiliconBackplane config registers */
+	sbconfig_t	sbconfig;
+} bcmenetregs_t;
+
+/* device control */
+#define	DC_PM		((uint32)1 << 7)	/* pattern filtering enable */
+#define	DC_IP		((uint32)1 << 10)	/* internal ephy present (rev >= 1) */
+#define	DC_ER		((uint32)1 << 15)	/* ephy reset */
+#define	DC_MP		((uint32)1 << 16)	/* mii phy mode enable */
+#define	DC_CO		((uint32)1 << 17)	/* mii phy mode: enable clocks */
+#define	DC_PA_MASK	0x7c0000		/* mii phy mode: mdc/mdio phy address */
+#define	DC_PA_SHIFT	18
+
+/* wakeup length */
+#define	WL_P0_MASK	0x7f			/* pattern 0 */
+#define	WL_D0		((uint32)1 << 7)
+#define	WL_P1_MASK	0x7f00			/* pattern 1 */
+#define	WL_P1_SHIFT	8
+#define	WL_D1		((uint32)1 << 15)
+#define	WL_P2_MASK	0x7f0000		/* pattern 2 */
+#define	WL_P2_SHIFT	16
+#define	WL_D2		((uint32)1 << 23)
+#define	WL_P3_MASK	0x7f000000		/* pattern 3 */
+#define	WL_P3_SHIFT	24
+#define	WL_D3		((uint32)1 << 31)
+
+/* intstatus and intmask */
+#define	I_PME		((uint32)1 << 6)	/* power management event */
+#define	I_TO		((uint32)1 << 7)	/* general purpose timeout */
+#define	I_PC		((uint32)1 << 10)	/* descriptor error */
+#define	I_PD		((uint32)1 << 11)	/* data error */
+#define	I_DE		((uint32)1 << 12)	/* descriptor protocol error */
+#define	I_RU		((uint32)1 << 13)	/* receive descriptor underflow */
+#define	I_RO		((uint32)1 << 14)	/* receive fifo overflow */
+#define	I_XU		((uint32)1 << 15)	/* transmit fifo underflow */
+#define	I_RI		((uint32)1 << 16)	/* receive interrupt */
+#define	I_XI		((uint32)1 << 24)	/* transmit interrupt */
+#define	I_EM		((uint32)1 << 26)	/* emac interrupt */
+#define	I_MW		((uint32)1 << 27)	/* mii write */
+#define	I_MR		((uint32)1 << 28)	/* mii read */
+
+/* emaccontrol */
+#define	EMC_CG		((uint32)1 << 0)	/* crc32 generation enable */
+#define	EMC_EP		((uint32)1 << 2)	/* onchip ephy: powerdown (rev >= 1) */
+#define	EMC_ED		((uint32)1 << 3)	/* onchip ephy: energy detected (rev >= 1) */
+#define	EMC_LC_MASK	0xe0			/* onchip ephy: led control (rev >= 1) */
+#define	EMC_LC_SHIFT	5
+
+/* emacflowcontrol */
+#define	EMF_RFH_MASK	0xff			/* rx fifo hi water mark */
+#define	EMF_PG		((uint32)1 << 15)	/* enable pause frame generation */
+
+/* interrupt receive lazy */
+#define	IRL_TO_MASK	0x00ffffff		/* timeout */
+#define	IRL_FC_MASK	0xff000000		/* frame count */
+#define	IRL_FC_SHIFT	24			/* frame count */
+
+/* emac receive config */
+#define	ERC_DB		((uint32)1 << 0)	/* disable broadcast */
+#define	ERC_AM		((uint32)1 << 1)	/* accept all multicast */
+#define	ERC_RDT		((uint32)1 << 2)	/* receive disable while transmitting */
+#define	ERC_PE		((uint32)1 << 3)	/* promiscuous enable */
+#define	ERC_LE		((uint32)1 << 4)	/* loopback enable */
+#define	ERC_FE		((uint32)1 << 5)	/* enable flow control */
+#define	ERC_UF		((uint32)1 << 6)	/* accept unicast flow control frame */
+#define	ERC_RF		((uint32)1 << 7)	/* reject filter */
+
+/* emac mdio control */
+#define	MC_MF_MASK	0x7f			/* mdc frequency */
+#define	MC_PE		((uint32)1 << 7)	/* mii preamble enable */
+
+/* emac mdio data */
+#define	MD_DATA_MASK	0xffff			/* r/w data */
+#define	MD_TA_MASK	0x30000			/* turnaround value */
+#define	MD_TA_SHIFT	16
+#define	MD_TA_VALID	(2 << MD_TA_SHIFT)	/* valid ta */
+#define	MD_RA_MASK	0x7c0000		/* register address */
+#define	MD_RA_SHIFT	18
+#define	MD_PMD_MASK	0xf800000		/* physical media device */
+#define	MD_PMD_SHIFT	23
+#define	MD_OP_MASK	0x30000000		/* opcode */
+#define	MD_OP_SHIFT	28
+#define	MD_OP_WRITE	(1 << MD_OP_SHIFT)	/* write op */
+#define	MD_OP_READ	(2 << MD_OP_SHIFT)	/* read op */
+#define	MD_SB_MASK	0xc0000000		/* start bits */
+#define	MD_SB_SHIFT	30
+#define	MD_SB_START	(0x1 << MD_SB_SHIFT)	/* start of frame */
+
+/* emac intstatus and intmask */
+#define	EI_MII		((uint32)1 << 0)	/* mii mdio interrupt */
+#define	EI_MIB		((uint32)1 << 1)	/* mib interrupt */
+#define	EI_FLOW		((uint32)1 << 2)	/* flow control interrupt */
+
+/* emac cam data high */
+#define	CD_V		((uint32)1 << 16)	/* valid bit */
+
+/* emac cam control */
+#define	CC_CE		((uint32)1 << 0)	/* cam enable */
+#define	CC_MS		((uint32)1 << 1)	/* mask select */
+#define	CC_RD		((uint32)1 << 2)	/* read */
+#define	CC_WR		((uint32)1 << 3)	/* write */
+#define	CC_INDEX_MASK	0x3f0000		/* index */
+#define	CC_INDEX_SHIFT	16
+#define	CC_CB		((uint32)1 << 31)	/* cam busy */
+
+/* emac ethernet control */
+#define	EC_EE		((uint32)1 << 0)	/* emac enable */
+#define	EC_ED		((uint32)1 << 1)	/* emac disable */
+#define	EC_ES		((uint32)1 << 2)	/* emac soft reset */
+#define	EC_EP		((uint32)1 << 3)	/* external phy select */
+
+/* emac transmit control */
+#define	EXC_FD		((uint32)1 << 0)	/* full duplex */
+#define	EXC_FM		((uint32)1 << 1)	/* flowmode */
+#define	EXC_SB		((uint32)1 << 2)	/* single backoff enable */
+#define	EXC_SS		((uint32)1 << 3)	/* small slottime */
+
+/* emac mib control */
+#define	EMC_RZ		((uint32)1 << 0)	/* autoclear on read */
+
+/* sometimes you just need the enet rxheader definitions */
+#include <bcmenetrxh.h>
+
+#endif	/* _bcmenet_47xx_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/bcmenetmib.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmenetmib.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/bcmenetmib.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmenetmib.h	2005-08-28 11:12:20.432858848 +0200
@@ -0,0 +1,81 @@
+/*
+ * Hardware-specific MIB definition for
+ * Broadcom Home Networking Division
+ * BCM44XX and BCM47XX 10/100 Mbps Ethernet cores.
+ * 
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef _bcmenetmib_h_
+#define _bcmenetmib_h_
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define	_PADLINE(line)	pad ## line
+#define	_XSTR(line)	_PADLINE(line)
+#define	PAD		_XSTR(__LINE__)
+#endif	/* PAD */
+
+/*
+ * EMAC MIB Registers
+ */
+typedef volatile struct {
+	uint32 tx_good_octets;
+	uint32 tx_good_pkts;
+	uint32 tx_octets;
+	uint32 tx_pkts;
+	uint32 tx_broadcast_pkts;
+	uint32 tx_multicast_pkts;
+	uint32 tx_len_64;
+	uint32 tx_len_65_to_127;
+	uint32 tx_len_128_to_255;
+	uint32 tx_len_256_to_511;
+	uint32 tx_len_512_to_1023;
+	uint32 tx_len_1024_to_max;
+	uint32 tx_jabber_pkts;
+	uint32 tx_oversize_pkts;
+	uint32 tx_fragment_pkts;
+	uint32 tx_underruns;
+	uint32 tx_total_cols;
+	uint32 tx_single_cols;
+	uint32 tx_multiple_cols;
+	uint32 tx_excessive_cols;
+	uint32 tx_late_cols;
+	uint32 tx_defered;
+	uint32 tx_carrier_lost;
+	uint32 tx_pause_pkts;
+	uint32 PAD[8];
+
+	uint32 rx_good_octets;
+	uint32 rx_good_pkts;
+	uint32 rx_octets;
+	uint32 rx_pkts;
+	uint32 rx_broadcast_pkts;
+	uint32 rx_multicast_pkts;
+	uint32 rx_len_64;
+	uint32 rx_len_65_to_127;
+	uint32 rx_len_128_to_255;
+	uint32 rx_len_256_to_511;
+	uint32 rx_len_512_to_1023;
+	uint32 rx_len_1024_to_max;
+	uint32 rx_jabber_pkts;
+	uint32 rx_oversize_pkts;
+	uint32 rx_fragment_pkts;
+	uint32 rx_missed_pkts;
+	uint32 rx_crc_align_errs;
+	uint32 rx_undersize;
+	uint32 rx_crc_errs;
+	uint32 rx_align_errs;
+	uint32 rx_symbol_errs;
+	uint32 rx_pause_pkts;
+	uint32 rx_nonpause_pkts;
+} bcmenetmib_t;
+
+#endif	/* _bcmenetmib_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/bcmenetrxh.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmenetrxh.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/bcmenetrxh.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmenetrxh.h	2005-08-28 11:12:20.433858696 +0200
@@ -0,0 +1,43 @@
+/*
+ * Hardware-specific Receive Data Header for the
+ * Broadcom Home Networking Division
+ * BCM44XX and BCM47XX 10/100 Mbps Ethernet cores.
+ *
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef _bcmenetrxh_h_
+#define	_bcmenetrxh_h_
+
+/*
+ * The Ethernet MAC core returns an 8-byte Receive Frame Data Header
+ * with every frame consisting of
+ * 16bits of frame length, followed by
+ * 16bits of EMAC rx descriptor info, followed by 32bits of undefined.
+ */
+typedef volatile struct {
+	uint16	len;
+	uint16	flags;
+	uint16	pad[12];
+} bcmenetrxh_t;
+
+#define	RXHDR_LEN	28
+
+#define	RXF_L		((uint16)1 << 11)	/* last buffer in a frame */
+#define	RXF_MISS	((uint16)1 << 7)	/* received due to promisc mode */
+#define	RXF_BRDCAST	((uint16)1 << 6)	/* dest is broadcast address */
+#define	RXF_MULT	((uint16)1 << 5)	/* dest is multicast address */
+#define	RXF_LG		((uint16)1 << 4)	/* frame length > rxmaxlength */
+#define	RXF_NO		((uint16)1 << 3)	/* odd number of nibbles */
+#define	RXF_RXER	((uint16)1 << 2)	/* receive symbol error */
+#define	RXF_CRC		((uint16)1 << 1)	/* crc error */
+#define	RXF_OV		((uint16)1 << 0)	/* fifo overflow */
+
+#endif	/* _bcmenetrxh_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/bcmnvram.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmnvram.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/bcmnvram.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmnvram.h	2005-08-28 11:12:20.433858696 +0200
@@ -0,0 +1,131 @@
+/*
+ * NVRAM variable manipulation
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef _bcmnvram_h_
+#define _bcmnvram_h_
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+#include <typedefs.h>
+
+struct nvram_header {
+	uint32 magic;
+	uint32 len;
+	uint32 crc_ver_init;	/* 0:7 crc, 8:15 ver, 16:27 init, mem. test 28, 29-31 reserved */
+	uint32 config_refresh;	/* 0:15 config, 16:31 refresh */
+	uint32 config_ncdl;	/* ncdl values for memc */
+};
+
+struct nvram_tuple {
+	char *name;
+	char *value;
+	struct nvram_tuple *next;
+};
+
+/*
+ * Initialize NVRAM access. May be unnecessary or undefined on certain
+ * platforms.
+ */
+extern int nvram_init(void *sbh);
+
+/*
+ * Disable NVRAM access. May be unnecessary or undefined on certain
+ * platforms.
+ */
+extern void nvram_exit(void);
+
+/*
+ * Get the value of an NVRAM variable. The pointer returned may be
+ * invalid after a set.
+ * @param	name	name of variable to get
+ * @return	value of variable or NULL if undefined
+ */
+extern char * nvram_get(const char *name);
+
+/* 
+ * Get the value of an NVRAM variable.
+ * @param	name	name of variable to get
+ * @return	value of variable or NUL if undefined
+ */
+#define nvram_safe_get(name) (nvram_get(name) ? : "")
+
+/*
+ * Match an NVRAM variable.
+ * @param	name	name of variable to match
+ * @param	match	value to compare against value of variable
+ * @return	TRUE if variable is defined and its value is string equal
+ *		to match or FALSE otherwise
+ */
+static INLINE int
+nvram_match(char *name, char *match) {
+	const char *value = nvram_get(name);
+	return (value && !strcmp(value, match));
+}
+
+/*
+ * Inversely match an NVRAM variable.
+ * @param	name	name of variable to match
+ * @param	match	value to compare against value of variable
+ * @return	TRUE if variable is defined and its value is not string
+ *		equal to invmatch or FALSE otherwise
+ */
+static INLINE int
+nvram_invmatch(char *name, char *invmatch) {
+	const char *value = nvram_get(name);
+	return (value && strcmp(value, invmatch));
+}
+
+/*
+ * Set the value of an NVRAM variable. The name and value strings are
+ * copied into private storage. Pointers to previously set values
+ * may become invalid. The new value may be immediately
+ * retrieved but will not be permanently stored until a commit.
+ * @param	name	name of variable to set
+ * @param	value	value of variable
+ * @return	0 on success and errno on failure
+ */
+extern int nvram_set(const char *name, const char *value);
+
+/*
+ * Unset an NVRAM variable. Pointers to previously set values
+ * remain valid until a set.
+ * @param	name	name of variable to unset
+ * @return	0 on success and errno on failure
+ * NOTE: use nvram_commit to commit this change to flash.
+ */
+extern int nvram_unset(const char *name);
+
+/*
+ * Commit NVRAM variables to permanent storage. All pointers to values
+ * may be invalid after a commit.
+ * NVRAM values are undefined after a commit.
+ * @return	0 on success and errno on failure
+ */
+extern int nvram_commit(void);
+
+/*
+ * Get all NVRAM variables (format name=value\0 ... \0\0).
+ * @param	buf	buffer to store variables
+ * @param	count	size of buffer in bytes
+ * @return	0 on success and errno on failure
+ */
+extern int nvram_getall(char *buf, int count);
+
+extern int kernel_write(unsigned char *buffer, int offset, int length);
+
+#endif /* _LANGUAGE_ASSEMBLY */
+
+#define NVRAM_MAGIC		0x48534C46	/* 'FLSH' */
+#define NVRAM_VERSION		1
+#define NVRAM_HEADER_SIZE	20
+#define NVRAM_LOC_GAP		0x100000
+#define NVRAM_SPACE		0x2000
+#define NVRAM_FIRST_LOC		(0xbfd00000 - NVRAM_SPACE)
+#define NVRAM_LAST_LOC		(0xc0000000 - NVRAM_SPACE)
+
+#endif /* _bcmnvram_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/bcmsrom.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmsrom.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/bcmsrom.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmsrom.h	2005-08-28 11:12:20.433858696 +0200
@@ -0,0 +1,24 @@
+/*
+ * Misc useful routines to access NIC srom
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef	_bcmsrom_h_
+#define	_bcmsrom_h_
+
+extern int srom_var_init(uint bus, void *curmap, void *osh, char **vars, int *count);
+
+extern int srom_read(uint bus, void *curmap, void *osh, uint byteoff, uint nbytes, uint16 *buf);
+extern int srom_write(uint bus, void *curmap, void *osh, uint byteoff, uint nbytes, uint16 *buf);
+extern int srom_parsecis(uint8 *cis, char **vars, int *count);
+	   
+#endif	/* _bcmsrom_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/bcmutils.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmutils.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/bcmutils.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bcmutils.h	2005-08-28 11:12:20.435858392 +0200
@@ -0,0 +1,136 @@
+/*
+ * Misc useful os-independent macros and functions.
+ *
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef	_bcmutils_h_
+#define	_bcmutils_h_
+
+#ifndef MIN
+#define	MIN(a, b)		(((a)<(b))?(a):(b))
+#endif
+
+#ifndef MAX
+#define	MAX(a, b)		(((a)>(b))?(a):(b))
+#endif
+
+#define CEIL(x, y)		(((x) + ((y)-1)) / (y))
+#define	ROUNDUP(x, y)		((((ulong)(x)+((y)-1))/(y))*(y))
+#define	ISALIGNED(a, x)		(((uint)(a) & ((x)-1)) == 0)
+#define	ISPOWEROF2(x)		((((x)-1)&(x))==0)
+#define	OFFSETOF(type, member)	((uint) &((type *)0)->member)
+#define ARRAYSIZE(a)		(sizeof(a)/sizeof(a[0]))
+
+/* bit map related macros */
+#ifndef setbit
+#define	NBBY	8	/* 8 bits per byte */
+#define	setbit(a,i)	((a)[(i)/NBBY] |= 1<<((i)%NBBY))
+#define	clrbit(a,i)	((a)[(i)/NBBY] &= ~(1<<((i)%NBBY)))
+#define	isset(a,i)	((a)[(i)/NBBY] & (1<<((i)%NBBY)))
+#define	isclr(a,i)	(((a)[(i)/NBBY] & (1<<((i)%NBBY))) == 0)
+#endif
+
+#define	NBITS(type)	(sizeof (type) * 8)
+
+#define _BCM_U	0x01	/* upper */
+#define _BCM_L	0x02	/* lower */
+#define _BCM_D	0x04	/* digit */
+#define _BCM_C	0x08	/* cntrl */
+#define _BCM_P	0x10	/* punct */
+#define _BCM_S	0x20	/* white space (space/lf/tab) */
+#define _BCM_X	0x40	/* hex digit */
+#define _BCM_SP	0x80	/* hard space (0x20) */
+
+extern unsigned char bcm_ctype[];
+#define bcm_ismask(x) (bcm_ctype[(int)(unsigned char)(x)])
+
+#define bcm_isalnum(c)	((bcm_ismask(c)&(_BCM_U|_BCM_L|_BCM_D)) != 0)
+#define bcm_isalpha(c)	((bcm_ismask(c)&(_BCM_U|_BCM_L)) != 0)
+#define bcm_iscntrl(c)	((bcm_ismask(c)&(_BCM_C)) != 0)
+#define bcm_isdigit(c)	((bcm_ismask(c)&(_BCM_D)) != 0)
+#define bcm_isgraph(c)	((bcm_ismask(c)&(_BCM_P|_BCM_U|_BCM_L|_BCM_D)) != 0)
+#define bcm_islower(c)	((bcm_ismask(c)&(_BCM_L)) != 0)
+#define bcm_isprint(c)	((bcm_ismask(c)&(_BCM_P|_BCM_U|_BCM_L|_BCM_D|_BCM_SP)) != 0)
+#define bcm_ispunct(c)	((bcm_ismask(c)&(_BCM_P)) != 0)
+#define bcm_isspace(c)	((bcm_ismask(c)&(_BCM_S)) != 0)
+#define bcm_isupper(c)	((bcm_ismask(c)&(_BCM_U)) != 0)
+#define bcm_isxdigit(c)	((bcm_ismask(c)&(_BCM_D|_BCM_X)) != 0)
+
+/*
+ * Spin at most 'us' microseconds while 'exp' is true.
+ * Caller should explicitly test 'exp' when this completes
+ * and take appropriate error action if 'exp' is still true.
+ */
+#define SPINWAIT(exp, us) { \
+	uint countdown = (us) + 9; \
+	while ((exp) && (countdown >= 10)) {\
+		OSL_DELAY(10); \
+		countdown -= 10; \
+	} \
+}
+
+/* generic osl packet queue */
+struct pktq {
+	void *head;
+	void *tail;
+	uint  len;
+	uint  maxlen; 
+};
+#define DEFAULT_QLEN	128
+
+#define	pktq_len(q)		((q)->len)
+#define	pktq_avail(q)	((q)->maxlen - (q)->len)
+#define	pktq_head(q)	((q)->head)
+#define	pktq_full(q)	((q)->len >= (q)->maxlen)
+
+/* crc defines */
+#define CRC8_INIT_VALUE  0xff		/* Initial CRC8 checksum value */
+#define CRC8_GOOD_VALUE  0x9f		/* Good final CRC8 checksum value */
+#define CRC16_INIT_VALUE 0xffff		/* Initial CRC16 checksum value */
+#define CRC16_GOOD_VALUE 0xf0b8		/* Good final CRC16 checksum value */
+#define CRC32_INIT_VALUE 0xffffffff /* Initial CRC32 checksum value */
+#define CRC32_GOOD_VALUE 0xdebb20e3 /* Good final CRC32 checksum value */
+
+/* tag_ID/length/value_buffer tuple */
+typedef struct bcm_tlv {
+	uint8	id;
+	uint8	len;
+	uint8	data[1];
+} bcm_tlv_t;
+
+/* externs */
+extern uint bcm_atoi(char *s);
+extern uchar bcm_toupper(uchar c);
+extern ulong bcm_strtoul(char *cp, char **endp, uint base);
+extern void deadbeef(char *p, uint len);
+extern void prhex(char *msg, uchar *buf, uint len);
+extern void prpkt(char *msg, void *drv, void *p0);
+extern uint pktcopy(void *drv, void *p, uint offset, int len, uchar *buf);
+extern uint pkttotlen(void *drv, void *);
+extern uchar *bcm_ether_ntoa(char *ea, char *buf);
+extern int bcm_ether_atoe(char *p, char *ea);
+extern void bcm_mdelay(uint ms);
+extern char *getvar(char *vars, char *name);
+extern int getintvar(char *vars, char *name);
+
+extern uint8 crc8(uint8 *p, uint nbytes, uint8 crc);
+extern uint16 crc16(uint8 *p, uint nbytes, uint16 crc);
+extern uint32 crc32(uint8 *p, uint nbytes, uint32 crc);
+extern bcm_tlv_t *bcm_parse_tlvs(void *buf, int buflen, uint key);
+extern bcm_tlv_t *bcm_parse_ordered_tlvs(void *buf, int buflen, uint key);
+extern void pktqinit(struct pktq *q, int maxlen);
+extern void pktenq(struct pktq *q, void *p, bool lifo);
+extern void *pktdeq(struct pktq *q);
+
+#define	bcmlog(fmt, a1, a2)
+#define	bcmdumplog(buf, size)	*buf = '\0'
+
+#endif	/* _bcmutils_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/bitfuncs.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bitfuncs.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/bitfuncs.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/bitfuncs.h	2005-08-28 11:12:20.435858392 +0200
@@ -0,0 +1,85 @@
+/*
+ * bit manipulation utility functions
+ *
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef _BITFUNCS_H
+#define _BITFUNCS_H
+
+#include <typedefs.h>
+
+/* local prototypes */
+static INLINE uint32 find_msbit(uint32 x);
+
+
+/*
+ * find_msbit: returns index of most significant set bit in x, with index
+ *   range defined as 0-31.  NOTE: returns zero if input is zero.
+ */
+
+#if defined(USE_PENTIUM_BSR) && defined(__GNUC__)
+
+/*
+ * Implementation for Pentium processors and gcc.  Note that this
+ * instruction is actually very slow on some processors (e.g., family 5,
+ * model 2, stepping 12, "Pentium 75 - 200"), so we use the generic
+ * implementation instead.
+ */
+static INLINE uint32 find_msbit(uint32 x)
+{
+	uint msbit;
+        __asm__("bsrl %1,%0"
+                :"=r" (msbit)
+                :"r" (x));
+        return msbit;
+}
+
+#else
+
+/*
+ * Generic Implementation
+ */
+
+#define DB_POW_MASK16	0xffff0000
+#define DB_POW_MASK8	0x0000ff00
+#define DB_POW_MASK4	0x000000f0
+#define DB_POW_MASK2	0x0000000c
+#define DB_POW_MASK1	0x00000002
+
+static INLINE uint32 find_msbit(uint32 x)
+{
+	uint32 temp_x = x;
+	uint msbit = 0;
+	if (temp_x & DB_POW_MASK16) {
+		temp_x >>= 16;
+		msbit = 16;
+	}
+	if (temp_x & DB_POW_MASK8) {
+		temp_x >>= 8;
+		msbit += 8;
+	}
+	if (temp_x & DB_POW_MASK4) {
+		temp_x >>= 4;
+		msbit += 4;
+	}
+	if (temp_x & DB_POW_MASK2) {
+		temp_x >>= 2;
+		msbit += 2;
+	}
+	if (temp_x & DB_POW_MASK1) {
+		msbit += 1;
+	}
+	return(msbit);
+}
+
+#endif
+
+#endif /* _BITFUNCS_H */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/epivers.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/epivers.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/epivers.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/epivers.h	2005-08-28 11:12:20.435858392 +0200
@@ -0,0 +1,69 @@
+/*
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ *
+*/
+
+#ifndef _epivers_h_
+#define _epivers_h_
+
+#ifdef	linux
+#include <linux/config.h>
+#endif
+
+/* Vendor Name, ASCII, 32 chars max */
+#ifdef COMPANYNAME
+#define	HPNA_VENDOR 		COMPANYNAME
+#else
+#define	HPNA_VENDOR 		"Broadcom Corporation"
+#endif
+
+/* Driver Date, ASCII, 32 chars max */
+#define HPNA_DRV_BUILD_DATE	__DATE__
+
+/* Hardware Manufacture Date, ASCII, 32 chars max */
+#define HPNA_HW_MFG_DATE	"Not Specified"
+
+/* See documentation for Device Type values, 32 values max */
+#ifndef	HPNA_DEV_TYPE
+
+#if	defined(CONFIG_BRCM_VJ)
+#define HPNA_DEV_TYPE		{ CDCF_V0_DEVICE_DISPLAY }
+
+#elif	defined(CONFIG_BCRM_93725)
+#define HPNA_DEV_TYPE		{ CDCF_V0_DEVICE_CM_BRIDGE, CDCF_V0_DEVICE_DISPLAY }
+
+#else
+#define HPNA_DEV_TYPE		{ CDCF_V0_DEVICE_PCINIC }
+
+#endif
+
+#endif	/* !HPNA_DEV_TYPE */
+
+
+#define	EPI_MAJOR_VERSION	1
+
+#define	EPI_MINOR_VERSION	1
+
+#define	EPI_RC_NUMBER		2
+
+#define	EPI_INCREMENTAL_NUMBER	0
+
+#define	EPI_BUILD_NUMBER	0
+
+#define	EPI_VERSION		1,1,2,0
+
+#define	EPI_VERSION_NUM		0x01010200
+
+/* Driver Version String, ASCII, 32 chars max */
+#define	EPI_VERSION_STR		"1.1.2.0"
+#define	EPI_ROUTER_VERSION_STR	"1.1.2.0"
+
+#endif /* _epivers_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/epivers.h.in linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/epivers.h.in
--- linux-2.6.12.5/arch/mips/bcm947xx/include/epivers.h.in	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/epivers.h.in	2005-08-28 11:12:20.436858240 +0200
@@ -0,0 +1,69 @@
+/*
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ *
+*/
+
+#ifndef _epivers_h_
+#define _epivers_h_
+
+#ifdef	linux
+#include <linux/config.h>
+#endif
+
+/* Vendor Name, ASCII, 32 chars max */
+#ifdef COMPANYNAME
+#define	HPNA_VENDOR 		COMPANYNAME
+#else
+#define	HPNA_VENDOR 		"Broadcom Corporation"
+#endif
+
+/* Driver Date, ASCII, 32 chars max */
+#define HPNA_DRV_BUILD_DATE	__DATE__
+
+/* Hardware Manufacture Date, ASCII, 32 chars max */
+#define HPNA_HW_MFG_DATE	"Not Specified"
+
+/* See documentation for Device Type values, 32 values max */
+#ifndef	HPNA_DEV_TYPE
+
+#if	defined(CONFIG_BRCM_VJ)
+#define HPNA_DEV_TYPE		{ CDCF_V0_DEVICE_DISPLAY }
+
+#elif	defined(CONFIG_BCRM_93725)
+#define HPNA_DEV_TYPE		{ CDCF_V0_DEVICE_CM_BRIDGE, CDCF_V0_DEVICE_DISPLAY }
+
+#else
+#define HPNA_DEV_TYPE		{ CDCF_V0_DEVICE_PCINIC }
+
+#endif
+
+#endif	/* !HPNA_DEV_TYPE */
+
+
+#define	EPI_MAJOR_VERSION	@EPI_MAJOR_VERSION@
+
+#define	EPI_MINOR_VERSION	@EPI_MINOR_VERSION@
+
+#define	EPI_RC_NUMBER		@EPI_RC_NUMBER@
+
+#define	EPI_INCREMENTAL_NUMBER	@EPI_INCREMENTAL_NUMBER@
+
+#define	EPI_BUILD_NUMBER	@EPI_BUILD_NUMBER@
+
+#define	EPI_VERSION		@EPI_VERSION@
+
+#define	EPI_VERSION_NUM		@EPI_VERSION_NUM@
+
+/* Driver Version String, ASCII, 32 chars max */
+#define	EPI_VERSION_STR		"@EPI_VERSION_STR@"
+#define	EPI_ROUTER_VERSION_STR	"@EPI_ROUTER_VERSION_STR@"
+
+#endif /* _epivers_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/etsockio.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/etsockio.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/etsockio.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/etsockio.h	2005-08-28 11:12:20.436858240 +0200
@@ -0,0 +1,60 @@
+/*
+ * Driver-specific socket ioctls
+ * used by BSD, Linux, and PSOS
+ * Broadcom BCM44XX 10/100Mbps Ethernet Device Driver
+ *
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef _etsockio_h_
+#define _etsockio_h_
+
+/* THESE MUST BE CONTIGUOUS AND CONSISTENT WITH VALUES IN ETC.H */
+
+
+#if defined(linux)
+#define SIOCSETCUP		(SIOCDEVPRIVATE + 0)
+#define SIOCSETCDOWN		(SIOCDEVPRIVATE + 1)
+#define SIOCSETCLOOP		(SIOCDEVPRIVATE + 2)
+#define SIOCGETCDUMP		(SIOCDEVPRIVATE + 3)
+#define SIOCSETCSETMSGLEVEL	(SIOCDEVPRIVATE + 4)
+#define SIOCSETCPROMISC		(SIOCDEVPRIVATE + 5)
+#define SIOCSETCTXDOWN		(SIOCDEVPRIVATE + 6)	/* obsolete */
+#define SIOCSETCSPEED		(SIOCDEVPRIVATE + 7)
+#define SIOCTXGEN		(SIOCDEVPRIVATE + 8)
+#define SIOCGETCPHYRD		(SIOCDEVPRIVATE + 9)
+#define SIOCSETCPHYWR		(SIOCDEVPRIVATE + 10)
+#define SIOCPERF		    (SIOCDEVPRIVATE + 11)
+#define SIOCPERFDMA		    (SIOCDEVPRIVATE + 12)
+
+#else	/* !linux */
+
+#define SIOCSETCUP		_IOWR('e', 130 + 0, struct ifreq)
+#define SIOCSETCDOWN		_IOWR('e', 130 + 1, struct ifreq)
+#define SIOCSETCLOOP		_IOWR('e', 130 + 2, struct ifreq)
+#define SIOCGETCDUMP		_IOWR('e', 130 + 3, struct ifreq)
+#define SIOCSETCSETMSGLEVEL	_IOWR('e', 130 + 4, struct ifreq)
+#define SIOCSETCPROMISC		_IOWR('e', 130 + 5, struct ifreq)
+#define SIOCSETCTXDOWN		_IOWR('e', 130 + 6, struct ifreq)	/* obsolete */
+#define SIOCSETCSPEED		_IOWR('e', 130 + 7, struct ifreq)
+#define SIOCTXGEN		_IOWR('e', 130 + 8, struct ifreq)
+
+#endif
+
+/* arg to SIOCTXGEN */
+struct txg {
+	uint32 num;		/* number of frames to send */
+	uint32 delay;		/* delay in microseconds between sending each */
+	uint32 size;		/* size of ether frame to send */
+	uchar buf[1514];	/* starting ether frame data */
+};
+
+#endif
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/flash.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/flash.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/flash.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/flash.h	2005-08-28 11:12:20.437858088 +0200
@@ -0,0 +1,184 @@
+/*
+ * flash.h: Common definitions for flash access.
+ *
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+/* Types of flashes we know about */
+typedef enum _flash_type {OLD, BSC, SCS, AMD, SST} flash_type_t;
+
+/* Commands to write/erase the flases */
+typedef struct _flash_cmds{
+	flash_type_t	type;
+	bool		need_unlock;
+	uint16		pre_erase;
+	uint16		erase_block;
+	uint16		erase_chip;
+	uint16		write_word;
+	uint16		write_buf;
+	uint16		clear_csr;
+	uint16		read_csr;
+	uint16		read_id;
+	uint16		confirm;
+	uint16		read_array;
+} flash_cmds_t;
+
+#define	UNLOCK_CMD_WORDS	2
+
+typedef struct _unlock_cmd {
+  uint		addr[UNLOCK_CMD_WORDS];
+  uint16	cmd[UNLOCK_CMD_WORDS];
+} unlock_cmd_t;
+
+/* Flash descriptors */
+typedef struct _flash_desc {
+	uint16		mfgid;		/* Manufacturer Id */
+	uint16		devid;		/* Device Id */
+	uint		size;		/* Total size in bytes */
+	uint		width;		/* Device width in bytes */
+	flash_type_t	type;		/* Device type old, S, J */
+	uint		bsize;		/* Block size */
+	uint		nb;		/* Number of blocks */
+	uint		ff;		/* First full block */
+	uint		lf;		/* Last full block */
+	uint		nsub;		/* Number of subblocks */
+	uint		*subblocks;	/* Offsets for subblocks */
+	char		*desc;		/* Description */
+} flash_desc_t;
+
+
+#ifdef	DECLARE_FLASHES
+
+flash_cmds_t flash_cmds[] = {
+/*	  type	needu	preera	eraseb	erasech	write	wbuf	clcsr	rdcsr	rdid	confrm	read */
+	{ BSC,	0,	0x00,	0x20,	0x00,	0x40,	0x00,	0x50,	0x70,	0x90,	0xd0,	0xff },
+	{ SCS,	0,	0x00,	0x20,	0x00,	0x40,	0xe8,	0x50,	0x70,	0x90,	0xd0,	0xff },
+	{ AMD,	1,	0x80,	0x30,	0x10,	0xa0,	0x00,	0x00,	0x00,	0x90,	0x00,	0xf0 },
+	{ SST,	1,	0x80,	0x50,	0x10,	0xa0,	0x00,	0x00,	0x00,	0x90,	0x00,	0xf0 },
+	{ 0 }
+};
+
+unlock_cmd_t unlock_cmd_amd = {
+#ifdef MIPSEB
+/* addr: */	{ 0x0aa8,	0x0556},
+#else
+/* addr: */	{ 0x0aaa,	0x0554},
+#endif
+/* data: */	{ 0xaa,		0x55}
+};
+
+unlock_cmd_t unlock_cmd_sst = {
+#ifdef MIPSEB
+/* addr: */	{ 0xaaa8,	0x5556},
+#else
+/* addr: */	{ 0xaaaa,	0x5554},
+#endif
+/* data: */	{ 0xaa,		0x55}
+};
+
+#define AMD_CMD 0xaaa
+#define SST_CMD 0xaaaa
+
+/* intel unlock block cmds */
+#define INTEL_UNLOCK1	0x60
+#define INTEL_UNLOCK2	0xD0
+
+/* Just eight blocks of 8KB byte each */
+
+uint blk8x8k[] = { 0x00000000,
+		   0x00002000,
+		   0x00004000,
+		   0x00006000,
+		   0x00008000,
+		   0x0000a000,
+		   0x0000c000,
+		   0x0000e000,
+		   0x00010000
+};
+
+/* Funky AMD arrangement for 29xx800's */
+uint amd800[] = { 0x00000000,		/* 16KB */
+		  0x00004000,		/* 32KB */
+		  0x0000c000,		/* 8KB */
+		  0x0000e000,		/* 8KB */
+		  0x00010000,		/* 8KB */
+		  0x00012000,		/* 8KB */
+		  0x00014000,		/* 32KB */
+		  0x0001c000,		/* 16KB */
+		  0x00020000
+};
+
+/* AMD arrangement for 29xx160's */
+uint amd4112[] = { 0x00000000,		/* 32KB */
+		   0x00008000,		/* 8KB */
+		   0x0000a000,		/* 8KB */
+		   0x0000c000,		/* 16KB */
+		   0x00010000
+};
+uint amd2114[] = { 0x00000000,		/* 16KB */
+		   0x00004000,		/* 8KB */
+		   0x00006000,		/* 8KB */
+		   0x00008000,		/* 32KB */
+		   0x00010000
+};
+
+
+
+flash_desc_t flashes[] = {
+	{ 0x00b0, 0x00d0, 0x0200000, 2,	SCS, 0x10000, 32,  0, 31,  0, NULL,    "Intel 28F160S3/5 1Mx16" },
+	{ 0x00b0, 0x00d4, 0x0400000, 2,	SCS, 0x10000, 64,  0, 63,  0, NULL,    "Intel 28F320S3/5 2Mx16" },
+	{ 0x0089, 0x8890, 0x0200000, 2,	BSC, 0x10000, 32,  0, 30,  8, blk8x8k, "Intel 28F160B3 1Mx16 TopB" },
+	{ 0x0089, 0x8891, 0x0200000, 2,	BSC, 0x10000, 32,  1, 31,  8, blk8x8k, "Intel 28F160B3 1Mx16 BotB" },
+	{ 0x0089, 0x8896, 0x0400000, 2,	BSC, 0x10000, 64,  0, 62,  8, blk8x8k, "Intel 28F320B3 2Mx16 TopB" },
+	{ 0x0089, 0x8897, 0x0400000, 2,	BSC, 0x10000, 64,  1, 63,  8, blk8x8k, "Intel 28F320B3 2Mx16 BotB" },
+	{ 0x0089, 0x8898, 0x0800000, 2,	BSC, 0x10000, 128, 0, 126, 8, blk8x8k, "Intel 28F640B3 4Mx16 TopB" },
+	{ 0x0089, 0x8899, 0x0800000, 2,	BSC, 0x10000, 128, 1, 127, 8, blk8x8k, "Intel 28F640B3 4Mx16 BotB" },
+	{ 0x0089, 0x88C2, 0x0200000, 2,	BSC, 0x10000, 32,  0, 30,  8, blk8x8k, "Intel 28F160C3 1Mx16 TopB" },
+	{ 0x0089, 0x88C3, 0x0200000, 2,	BSC, 0x10000, 32,  1, 31,  8, blk8x8k, "Intel 28F160C3 1Mx16 BotB" },
+	{ 0x0089, 0x88C4, 0x0400000, 2,	BSC, 0x10000, 64,  0, 62,  8, blk8x8k, "Intel 28F320C3 2Mx16 TopB" },
+	{ 0x0089, 0x88C5, 0x0400000, 2,	BSC, 0x10000, 64,  1, 63,  8, blk8x8k, "Intel 28F320C3 2Mx16 BotB" },
+	{ 0x0089, 0x88CC, 0x0800000, 2,	BSC, 0x10000, 128, 0, 126, 8, blk8x8k, "Intel 28F640C3 4Mx16 TopB" },
+	{ 0x0089, 0x88CD, 0x0800000, 2,	BSC, 0x10000, 128, 1, 127, 8, blk8x8k, "Intel 28F640C3 4Mx16 BotB" },
+	{ 0x0089, 0x0014, 0x0400000, 2,	SCS, 0x20000, 32,  0, 31,  0, NULL,    "Intel 28F320J5 2Mx16" },
+	{ 0x0089, 0x0015, 0x0800000, 2,	SCS, 0x20000, 64,  0, 63,  0, NULL,    "Intel 28F640J5 4Mx16" },
+	{ 0x0089, 0x0016, 0x0400000, 2,	SCS, 0x20000, 32,  0, 31,  0, NULL,    "Intel 28F320J3 2Mx16" },
+	{ 0x0089, 0x0017, 0x0800000, 2,	SCS, 0x20000, 64,  0, 63,  0, NULL,    "Intel 28F640J3 4Mx16" },
+	{ 0x0089, 0x0018, 0x1000000, 2,	SCS, 0x20000, 128, 0, 127, 0, NULL,    "Intel 28F128J3 8Mx16" },
+	{ 0x00b0, 0x00e3, 0x0400000, 2,	BSC, 0x10000, 64,  1, 63,  8, blk8x8k, "Sharp 28F320BJE 2Mx16 BotB" },
+	{ 0x0001, 0x224a, 0x0100000, 2,	AMD, 0x10000, 16,  0, 13,  8, amd800,  "AMD 29DL800BT 512Kx16 TopB" },
+	{ 0x0001, 0x22cb, 0x0100000, 2,	AMD, 0x10000, 16,  2, 15,  8, amd800,  "AMD 29DL800BB 512Kx16 BotB" },
+	{ 0x0001, 0x22c4, 0x0200000, 2,	AMD, 0x10000, 32,  0, 30,  4, amd2114, "AMD 29lv160DT 1Mx16 TopB" },
+	{ 0x0001, 0x2249, 0x0200000, 2,	AMD, 0x10000, 32,  1, 31,  4, amd4112, "AMD 29lv160DB 1Mx16 BotB" },
+	{ 0x0001, 0x22f6, 0x0400000, 2,	AMD, 0x10000, 64,  0, 62,  8, blk8x8k, "AMD 29lv320DT 2Mx16 TopB" },
+	{ 0x0001, 0x22f9, 0x0400000, 2,	AMD, 0x10000, 64,  1, 63,  8, blk8x8k, "AMD 29lv320DB 2Mx16 BotB" },
+	{ 0x0001, 0x2201, 0x0400000, 2,	AMD, 0x10000, 64,  0, 62,  8, blk8x8k, "AMD 29lv320MT 2Mx16 TopB" },
+	{ 0x0001, 0x2200, 0x0400000, 2,	AMD, 0x10000, 64,  1, 63,  8, blk8x8k, "AMD 29lv320MB 2Mx16 BotB" },
+	{ 0x0020, 0x22CA, 0x0400000, 2,	AMD, 0x10000, 64,  0, 62,  4, amd4112, "ST 29w320DT 2Mx16 TopB" },
+	{ 0x0020, 0x22CB, 0x0400000, 2,	AMD, 0x10000, 64,  1, 63,  4, amd2114, "ST 29w320DB 2Mx16 BotB" },
+	{ 0x00C2, 0x00A7, 0x0400000, 2,	AMD, 0x10000, 64,  0, 62,  4, amd4112, "MX29LV320T 2Mx16 TopB" },
+	{ 0x00C2, 0x00A8, 0x0400000, 2,	AMD, 0x10000, 64,  1, 63,  4, amd2114, "MX29LV320B 2Mx16 BotB" },
+	{ 0x0004, 0x22F6, 0x0400000, 2,	AMD, 0x10000, 64,  0, 62,  4, amd4112, "MBM29LV320TE 2Mx16 TopB" },
+	{ 0x0004, 0x22F9, 0x0400000, 2,	AMD, 0x10000, 64,  1, 63,  4, amd2114, "MBM29LV320BE 2Mx16 BotB" },
+	{ 0x0098, 0x009A, 0x0400000, 2,	AMD, 0x10000, 64,  0, 62,  4, amd4112, "TC58FVT321 2Mx16 TopB" },
+	{ 0x0098, 0x009C, 0x0400000, 2,	AMD, 0x10000, 64,  1, 63,  4, amd2114, "TC58FVB321 2Mx16 BotB" }, 
+	{ 0x00C2, 0x22A7, 0x0400000, 2,	AMD, 0x10000, 64,  0, 62,  4, amd4112, "MX29LV320T 2Mx16 TopB" },
+	{ 0x00C2, 0x22A8, 0x0400000, 2,	AMD, 0x10000, 64,  1, 63,  4, amd2114, "MX29LV320B 2Mx16 BotB" },
+	{ 0x00BF, 0x2783, 0x0400000, 2,	SST, 0x10000, 64,  0, 63,  0, NULL,    "SST39VF320 2Mx16" },
+	{ 0,      0,      0,         0,	OLD, 0,       0,   0, 0,   0, NULL,    NULL },
+};
+
+#else
+
+extern flash_cmds_t flash_cmds[];
+extern unlock_cmd_t unlock_cmd;
+extern flash_desc_t flashes[];
+
+#endif
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/flashutl.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/flashutl.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/flashutl.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/flashutl.h	2005-08-28 11:12:20.437858088 +0200
@@ -0,0 +1,34 @@
+/*
+ * BCM47XX FLASH driver interface
+ *
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef _flashutl_h_
+#define _flashutl_h_
+
+#define FLASH_BASE      0xbfc00000		/* BCM4710 */
+
+int	flash_init(void* base_addr, char *flash_str);
+int	flash_erase(void);
+int	flash_eraseblk(unsigned long off);
+int	flash_write(unsigned long off, uint16 *src, uint nbytes);
+unsigned long	flash_block_base(unsigned long off);
+unsigned long	flash_block_lim(unsigned long off);
+int FlashWriteRange(unsigned short* dst, unsigned short* src, unsigned int numbytes);
+
+void nvWrite(unsigned short *data, unsigned int len);
+
+/* Global vars */
+extern char*		flashutl_base;
+extern flash_desc_t*	flashutl_desc;
+extern flash_cmds_t*	flashutl_cmd;
+
+#endif /* _flashutl_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/hnddma.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/hnddma.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/hnddma.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/hnddma.h	2005-08-28 11:12:20.438857936 +0200
@@ -0,0 +1,181 @@
+/*
+ * Generic Broadcom Home Networking Division (HND) DMA engine definitions.
+ * This supports the following chips: BCM42xx, 44xx, 47xx .
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ */
+
+#ifndef	_hnddma_h_
+#define	_hnddma_h_
+
+/*
+ * Each DMA processor consists of a transmit channel and a receive channel.
+ */
+typedef volatile struct {
+	/* transmit channel */
+	uint32	xmtcontrol;			/* enable, et al */
+	uint32	xmtaddr;			/* descriptor ring base address (4K aligned) */
+	uint32	xmtptr;				/* last descriptor posted to chip */
+	uint32	xmtstatus;			/* current active descriptor, et al */
+
+	/* receive channel */
+	uint32	rcvcontrol;			/* enable, et al */
+	uint32	rcvaddr;			/* descriptor ring base address (4K aligned) */
+	uint32	rcvptr;				/* last descriptor posted to chip */
+	uint32	rcvstatus;			/* current active descriptor, et al */
+} dmaregs_t;
+
+typedef volatile struct {
+	/* diag access */
+	uint32	fifoaddr;			/* diag address */
+	uint32	fifodatalow;			/* low 32bits of data */
+	uint32	fifodatahigh;			/* high 32bits of data */
+	uint32	pad;				/* reserved */
+} dmafifo_t;
+
+/* transmit channel control */
+#define	XC_XE		((uint32)1 << 0)	/* transmit enable */
+#define	XC_SE		((uint32)1 << 1)	/* transmit suspend request */
+#define	XC_LE		((uint32)1 << 2)	/* loopback enable */
+#define	XC_FL		((uint32)1 << 4)	/* flush request */
+
+/* transmit descriptor table pointer */
+#define	XP_LD_MASK	0xfff			/* last valid descriptor */
+
+/* transmit channel status */
+#define	XS_CD_MASK	0x0fff			/* current descriptor pointer */
+#define	XS_XS_MASK	0xf000			/* transmit state */
+#define	XS_XS_SHIFT	12
+#define	XS_XS_DISABLED	0x0000			/* disabled */
+#define	XS_XS_ACTIVE	0x1000			/* active */
+#define	XS_XS_IDLE	0x2000			/* idle wait */
+#define	XS_XS_STOPPED	0x3000			/* stopped */
+#define	XS_XS_SUSP	0x4000			/* suspend pending */
+#define	XS_XE_MASK	0xf0000			/* transmit errors */
+#define	XS_XE_SHIFT	16
+#define	XS_XE_NOERR	0x00000			/* no error */
+#define	XS_XE_DPE	0x10000			/* descriptor protocol error */
+#define	XS_XE_DFU	0x20000			/* data fifo underrun */
+#define	XS_XE_BEBR	0x30000			/* bus error on buffer read */
+#define	XS_XE_BEDA	0x40000			/* bus error on descriptor access */
+#define	XS_FL		((uint32)1 << 20)	/* flushed */
+
+/* receive channel control */
+#define	RC_RE		((uint32)1 << 0)	/* receive enable */
+#define	RC_RO_MASK	0xfe			/* receive frame offset */
+#define	RC_RO_SHIFT	1
+#define	RC_FM		((uint32)1 << 8)	/* direct fifo receive (pio) mode */
+
+/* receive descriptor table pointer */
+#define	RP_LD_MASK	0xfff			/* last valid descriptor */
+
+/* receive channel status */
+#define	RS_CD_MASK	0x0fff			/* current descriptor pointer */
+#define	RS_RS_MASK	0xf000			/* receive state */
+#define	RS_RS_SHIFT	12
+#define	RS_RS_DISABLED	0x0000			/* disabled */
+#define	RS_RS_ACTIVE	0x1000			/* active */
+#define	RS_RS_IDLE	0x2000			/* idle wait */
+#define	RS_RS_STOPPED	0x3000			/* reserved */
+#define	RS_RE_MASK	0xf0000			/* receive errors */
+#define	RS_RE_SHIFT	16
+#define	RS_RE_NOERR	0x00000			/* no error */
+#define	RS_RE_DPE	0x10000			/* descriptor protocol error */
+#define	RS_RE_DFO	0x20000			/* data fifo overflow */
+#define	RS_RE_BEBW	0x30000			/* bus error on buffer write */
+#define	RS_RE_BEDA	0x40000			/* bus error on descriptor access */
+
+/* fifoaddr */
+#define	FA_OFF_MASK	0xffff			/* offset */
+#define	FA_SEL_MASK	0xf0000			/* select */
+#define	FA_SEL_SHIFT	16
+#define	FA_SEL_XDD	0x00000			/* transmit dma data */
+#define	FA_SEL_XDP	0x10000			/* transmit dma pointers */
+#define	FA_SEL_RDD	0x40000			/* receive dma data */
+#define	FA_SEL_RDP	0x50000			/* receive dma pointers */
+#define	FA_SEL_XFD	0x80000			/* transmit fifo data */
+#define	FA_SEL_XFP	0x90000			/* transmit fifo pointers */
+#define	FA_SEL_RFD	0xc0000			/* receive fifo data */
+#define	FA_SEL_RFP	0xd0000			/* receive fifo pointers */
+
+/*
+ * DMA Descriptor
+ * Descriptors are only read by the hardware, never written back.
+ */
+typedef volatile struct {
+	uint32	ctrl;		/* misc control bits & bufcount */
+	uint32	addr;		/* data buffer address */
+} dmadd_t;
+
+/*
+ * Each descriptor ring must be 4096byte aligned
+ * and fit within a single 4096byte page.
+ */
+#define	DMAMAXRINGSZ	4096
+#define	DMARINGALIGN	4096
+
+/* control flags */
+#define	CTRL_BC_MASK	0x1fff			/* buffer byte count */
+#define	CTRL_EOT	((uint32)1 << 28)	/* end of descriptor table */
+#define	CTRL_IOC	((uint32)1 << 29)	/* interrupt on completion */
+#define	CTRL_EOF	((uint32)1 << 30)	/* end of frame */
+#define	CTRL_SOF	((uint32)1 << 31)	/* start of frame */
+
+/* control flags in the range [27:20] are core-specific and not defined here */
+#define	CTRL_CORE_MASK	0x0ff00000
+
+/* export structure */
+typedef volatile struct {
+	/* rx error counters */
+	uint		rxgiants;	/* rx giant frames */
+	uint		rxnobuf;	/* rx out of dma descriptors */
+	/* tx error counters */
+	uint		txnobuf;	/* tx out of dma descriptors */
+} hnddma_t;
+
+#ifndef di_t
+#define	di_t	void
+#endif
+
+/* externs */
+extern void *dma_attach(void *drv, void *dev, char *name, dmaregs_t *dmaregs,
+	uint ntxd, uint nrxd, uint rxbufsize, uint nrxpost, uint rxoffset,
+	uint ddoffset, uint dataoffset, uint *msg_level);
+extern void dma_detach(di_t *di);
+extern void dma_txreset(di_t *di);
+extern void dma_rxreset(di_t *di);
+extern void dma_txinit(di_t *di);
+extern bool dma_txenabled(di_t *di);
+extern void dma_rxinit(di_t *di);
+extern void dma_rxenable(di_t *di);
+extern bool dma_rxenabled(di_t *di);
+extern void dma_txsuspend(di_t *di);
+extern void dma_txresume(di_t *di);
+extern bool dma_txsuspended(di_t *di);
+extern bool dma_txstopped(di_t *di);
+extern bool dma_rxstopped(di_t *di);
+extern int dma_txfast(di_t *di, void *p, uint32 coreflags);
+extern int dma_tx(di_t *di, void *p, uint32 coreflags);
+extern void dma_fifoloopbackenable(di_t *di);
+extern void *dma_rx(di_t *di);
+extern void dma_rxfill(di_t *di);
+extern void dma_txreclaim(di_t *di, bool forceall);
+extern void dma_rxreclaim(di_t *di);
+extern char *dma_dump(di_t *di, char *buf);
+extern char *dma_dumptx(di_t *di, char *buf);
+extern char *dma_dumprx(di_t *di, char *buf);
+extern uint dma_getvar(di_t *di, char *name);
+extern void *dma_getnexttxp(di_t *di, bool forceall);
+extern void *dma_getnextrxp(di_t *di, bool forceall);
+extern void dma_txblock(di_t *di);
+extern void dma_txunblock(di_t *di);
+extern uint dma_txactive(di_t *di);
+
+#endif	/* _hnddma_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/hndmips.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/hndmips.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/hndmips.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/hndmips.h	2005-08-28 11:12:20.439857784 +0200
@@ -0,0 +1,16 @@
+/*
+ * Alternate include file for HND sbmips.h since CFE also ships with
+ * a sbmips.h.
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#include "sbmips.h"
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/linux_osl.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/linux_osl.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/linux_osl.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/linux_osl.h	2005-08-28 11:12:20.440857632 +0200
@@ -0,0 +1,313 @@
+/*
+ * Linux OS Independent Layer
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef _linux_osl_h_
+#define _linux_osl_h_
+
+#include <typedefs.h>
+
+/* use current 2.4.x calling conventions */
+#include <linuxver.h>
+
+/* assert and panic */
+#define	ASSERT(exp)		do {} while (0)
+
+/* PCMCIA attribute space access macros */
+#define	OSL_PCMCIA_READ_ATTR(osh, offset, buf, size) \
+	osl_pcmcia_read_attr((osh), (offset), (buf), (size))
+#define	OSL_PCMCIA_WRITE_ATTR(osh, offset, buf, size) \
+	osl_pcmcia_write_attr((osh), (offset), (buf), (size))
+extern void osl_pcmcia_read_attr(void *osh, uint offset, void *buf, int size);
+extern void osl_pcmcia_write_attr(void *osh, uint offset, void *buf, int size);
+
+/* PCI configuration space access macros */
+#define	OSL_PCI_READ_CONFIG(loc, offset, size) \
+	osl_pci_read_config((loc), (offset), (size))
+#define	OSL_PCI_WRITE_CONFIG(loc, offset, size, val) \
+	osl_pci_write_config((loc), (offset), (size), (val))
+extern uint32 osl_pci_read_config(void *loc, uint size, uint offset);
+extern void osl_pci_write_config(void *loc, uint offset, uint size, uint val);
+
+/* OSL initialization */
+#define osl_init()		do {} while (0)
+
+/* host/bus architecture-specific byte swap */
+#define BUS_SWAP32(v)		(v)
+
+/*
+ * BINOSL selects the slightly slower function-call-based binary compatible osl.
+ * Macros expand to calls to functions defined in linux_osl.c .
+ */
+#ifndef BINOSL
+
+/* string library, kernel mode */
+#define	printf(fmt, args...)	printk(fmt, ## args)
+#include <linux/kernel.h>
+#include <linux/string.h>
+
+/* register access macros */
+#define R_REG(r) ({ \
+	__typeof(*(r)) __osl_v; \
+	switch (sizeof(*(r))) { \
+	case sizeof(uint8):	__osl_v = readb((volatile uint8*)(r)); break; \
+	case sizeof(uint16):	__osl_v = readw((volatile uint16*)(r)); break; \
+	case sizeof(uint32):	__osl_v = readl((volatile uint32*)(r)); break; \
+	} \
+	__osl_v; \
+})
+#define W_REG(r, v) do { \
+	switch (sizeof(*(r))) { \
+	case sizeof(uint8):	writeb((uint8)(v), (volatile uint8*)(r)); break; \
+	case sizeof(uint16):	writew((uint16)(v), (volatile uint16*)(r)); break; \
+	case sizeof(uint32):	writel((uint32)(v), (volatile uint32*)(r)); break; \
+	} \
+} while (0)
+
+#define	AND_REG(r, v)		W_REG((r), R_REG(r) & (v))
+#define	OR_REG(r, v)		W_REG((r), R_REG(r) | (v))
+
+/* bcopy, bcmp, and bzero */
+#define	bcopy(src, dst, len)	memcpy((dst), (src), (len))
+#define	bcmp(b1, b2, len)	memcmp((b1), (b2), (len))
+#define	bzero(b, len)		memset((b), '\0', (len))
+
+/* general purpose memory allocation */
+#define	MALLOC(size)		kmalloc((size), GFP_ATOMIC)
+#define	MFREE(addr, size)	kfree((addr))
+
+/* uncached virtual address */
+#ifdef mips
+#define OSL_UNCACHED(va)	KSEG1ADDR((va))
+#include <asm/addrspace.h>
+#else
+#define OSL_UNCACHED(va)	(va)
+#endif
+
+/* get processor cycle count */
+#if defined(mips)
+#define	OSL_GETCYCLES(x)	((x) = read_c0_count() * 2)
+#elif defined(__i386__)
+#define	OSL_GETCYCLES(x)	rdtscl((x))
+#else
+#define OSL_GETCYCLES(x)	((x) = 0)
+#endif
+
+/* dereference an address that may cause a bus exception */
+#ifdef mips
+#if defined(MODULE) && (LINUX_VERSION_CODE < KERNEL_VERSION(2,4,17))
+#define BUSPROBE(val, addr)	panic("get_dbe() will not fixup a bus exception when compiled into a module")
+#else
+#define	BUSPROBE(val, addr)	get_dbe((val), (addr))
+#include <asm/paccess.h>
+#endif
+#else
+#define	BUSPROBE(val, addr)	({ (val) = R_REG((addr)); 0; })
+#endif
+
+/* map/unmap physical to virtual I/O */
+#define	REG_MAP(pa, size)	ioremap_nocache((unsigned long)(pa), (unsigned long)(size))
+#define	REG_UNMAP(va)		iounmap((void *)(va))
+
+/* allocate/free shared (dma-able) consistent (uncached) memory */
+#define	DMA_ALLOC_CONSISTENT(dev, size, pap) \
+	pci_alloc_consistent((dev), (size), (dma_addr_t*)(pap))
+#define	DMA_FREE_CONSISTENT(dev, va, size, pa) \
+	pci_free_consistent((dev), (size), (va), (dma_addr_t)(pa))
+
+/* map/unmap direction */
+#define	DMA_TX			PCI_DMA_TODEVICE
+#define	DMA_RX			PCI_DMA_FROMDEVICE
+
+/* map/unmap shared (dma-able) memory */
+#define	DMA_MAP(dev, va, size, direction, p) \
+	pci_map_single((dev), (va), (size), (direction))
+#define	DMA_UNMAP(dev, pa, size, direction, p) \
+	pci_unmap_single((dev), (dma_addr_t)(pa), (size), (direction))
+
+/* microsecond delay */
+#define	OSL_DELAY(usec)		udelay(usec)
+#include <linux/delay.h>
+#define OSL_SLEEP(usec) set_current_state(TASK_INTERRUPTIBLE); \
+                        schedule_timeout((usec*HZ)/1000000);
+#define OSL_IN_INTERRUPT() in_interrupt()
+
+/* shared (dma-able) memory access macros */
+#define	R_SM(r)			*(r)
+#define	W_SM(r, v)		(*(r) = (v))
+#define	BZERO_SM(r, len)	memset((r), '\0', (len))
+
+/* packet primitives */
+#define	PKTGET(drv, len, send)		osl_pktget((drv), (len), (send))
+#define	PKTFREE(drv, skb, send)		osl_pktfree((skb))
+#define	PKTDATA(drv, skb)		(((struct sk_buff*)(skb))->data)
+#define	PKTLEN(drv, skb)		(((struct sk_buff*)(skb))->len)
+#define PKTHEADROOM(drv, skb)		(PKTDATA(drv,skb)-(((struct sk_buff*)(skb))->head))
+#define PKTTAILROOM(drv, skb)		((((struct sk_buff*)(skb))->end)-(((struct sk_buff*)(skb))->tail))
+#define	PKTNEXT(drv, skb)		(((struct sk_buff*)(skb))->next)
+#define	PKTSETNEXT(skb, x)		(((struct sk_buff*)(skb))->next = (struct sk_buff*)(x))
+#define	PKTSETLEN(drv, skb, len)	__skb_trim((struct sk_buff*)(skb), (len))
+#define	PKTPUSH(drv, skb, bytes)	skb_push((struct sk_buff*)(skb), (bytes))
+#define	PKTPULL(drv, skb, bytes)	skb_pull((struct sk_buff*)(skb), (bytes))
+#define	PKTDUP(drv, skb)		skb_clone((struct sk_buff*)(skb), GFP_ATOMIC)
+#define	PKTCOOKIE(skb)			((void*)((struct sk_buff*)(skb))->csum)
+#define	PKTSETCOOKIE(skb, x)		(((struct sk_buff*)(skb))->csum = (uint)(x))
+#define	PKTLINK(skb)			(((struct sk_buff*)(skb))->prev)
+#define	PKTSETLINK(skb, x)		(((struct sk_buff*)(skb))->prev = (struct sk_buff*)(x))
+extern void *osl_pktget(void *drv, uint len, bool send);
+extern void osl_pktfree(void *skb);
+
+#else	/* BINOSL */                                    
+
+/* string library */
+#ifndef LINUX_OSL
+#undef printf
+#define	printf(fmt, args...)		osl_printf((fmt), ## args)
+#undef sprintf
+#define sprintf(buf, fmt, args...)	osl_sprintf((buf), (fmt), ## args)
+#undef strcmp
+#define	strcmp(s1, s2)			osl_strcmp((s1), (s2))
+#undef strncmp
+#define	strncmp(s1, s2, n)		osl_strncmp((s1), (s2), (n))
+#undef strlen
+#define strlen(s)			osl_strlen((s))
+#undef strcpy
+#define	strcpy(d, s)			osl_strcpy((d), (s))
+#undef strncpy
+#define	strncpy(d, s, n)		osl_strncpy((d), (s), (n))
+#endif
+extern int osl_printf(const char *format, ...);
+extern int osl_sprintf(char *buf, const char *format, ...);
+extern int osl_strcmp(const char *s1, const char *s2);
+extern int osl_strncmp(const char *s1, const char *s2, uint n);
+extern int osl_strlen(char *s);
+extern char* osl_strcpy(char *d, const char *s);
+extern char* osl_strncpy(char *d, const char *s, uint n);
+
+/* register access macros */
+#define R_REG(r) ({ \
+	__typeof(*(r)) __osl_v; \
+	switch (sizeof(*(r))) { \
+	case sizeof(uint8):	__osl_v = osl_readb((volatile uint8*)(r)); break; \
+	case sizeof(uint16):	__osl_v = osl_readw((volatile uint16*)(r)); break; \
+	case sizeof(uint32):	__osl_v = osl_readl((volatile uint32*)(r)); break; \
+	} \
+	__osl_v; \
+})
+#define W_REG(r, v) do { \
+	switch (sizeof(*(r))) { \
+	case sizeof(uint8):	osl_writeb((uint8)(v), (volatile uint8*)(r)); break; \
+	case sizeof(uint16):	osl_writew((uint16)(v), (volatile uint16*)(r)); break; \
+	case sizeof(uint32):	osl_writel((uint32)(v), (volatile uint32*)(r)); break; \
+	} \
+} while (0)
+#define	AND_REG(r, v)		W_REG((r), R_REG(r) & (v))
+#define	OR_REG(r, v)		W_REG((r), R_REG(r) | (v))
+extern uint8 osl_readb(volatile uint8 *r);
+extern uint16 osl_readw(volatile uint16 *r);
+extern uint32 osl_readl(volatile uint32 *r);
+extern void osl_writeb(uint8 v, volatile uint8 *r);
+extern void osl_writew(uint16 v, volatile uint16 *r);
+extern void osl_writel(uint32 v, volatile uint32 *r);
+
+/* bcopy, bcmp, and bzero */
+extern void bcopy(const void *src, void *dst, int len);
+extern int bcmp(const void *b1, const void *b2, int len);
+extern void bzero(void *b, int len);
+
+/* general purpose memory allocation */
+#define	MALLOC(size)		osl_malloc((size))
+#define	MFREE(addr, size)	osl_mfree((char*)(addr), (size))
+extern void *osl_malloc(uint size);
+extern void osl_mfree(void *addr, uint size);
+
+/* uncached virtual address */
+#define OSL_UNCACHED(va)	osl_uncached((va))
+extern void *osl_uncached(void *va);
+
+/* get processor cycle count */
+#define OSL_GETCYCLES(x)	((x) = osl_getcycles())
+extern uint osl_getcycles(void);
+
+/* dereference an address that may target abort */
+#define	BUSPROBE(val, addr)	osl_busprobe(&(val), (addr))
+extern int osl_busprobe(uint32 *val, uint32 addr);
+
+/* map/unmap physical to virtual */
+#define	REG_MAP(pa, size)	osl_reg_map((pa), (size))
+#define	REG_UNMAP(va)		osl_reg_unmap((va))
+extern void *osl_reg_map(uint32 pa, uint size);
+extern void osl_reg_unmap(void *va);
+
+/* allocate/free shared (dma-able) consistent (uncached) memory */
+#define	DMA_ALLOC_CONSISTENT(dev, size, pap) \
+	osl_dma_alloc_consistent((dev), (size), (pap))
+#define	DMA_FREE_CONSISTENT(dev, va, size, pa) \
+	osl_dma_free_consistent((dev), (void*)(va), (size), (pa))
+extern void *osl_dma_alloc_consistent(void *dev, uint size, ulong *pap);
+extern void osl_dma_free_consistent(void *dev, void *va, uint size, ulong pa);
+
+/* map/unmap direction */
+#define	DMA_TX	1
+#define	DMA_RX	2
+
+/* map/unmap shared (dma-able) memory */
+#define	DMA_MAP(dev, va, size, direction, p) \
+	osl_dma_map((dev), (va), (size), (direction))
+#define	DMA_UNMAP(dev, pa, size, direction, p) \
+	osl_dma_unmap((dev), (pa), (size), (direction))
+extern uint osl_dma_map(void *dev, void *va, uint size, int direction);
+extern void osl_dma_unmap(void *dev, uint pa, uint size, int direction);
+
+/* microsecond delay */
+#define	OSL_DELAY(usec)		osl_delay((usec))
+extern void osl_delay(uint usec);
+
+/* shared (dma-able) memory access macros */
+#define	R_SM(r)			*(r)
+#define	W_SM(r, v)		(*(r) = (v))
+#define	BZERO_SM(r, len)	bzero((r), (len))
+
+/* packet primitives */
+#define	PKTGET(drv, len, send)		osl_pktget((drv), (len), (send))
+#define	PKTFREE(drv, skb, send)		osl_pktfree((skb))
+#define	PKTDATA(drv, skb)		osl_pktdata((drv), (skb))
+#define	PKTLEN(drv, skb)		osl_pktlen((drv), (skb))
+#define	PKTNEXT(drv, skb)		osl_pktnext((drv), (skb))
+#define	PKTSETNEXT(skb, x)		osl_pktsetnext((skb), (x))
+#define	PKTSETLEN(drv, skb, len)	osl_pktsetlen((drv), (skb), (len))
+#define	PKTPUSH(drv, skb, bytes)	osl_pktpush((drv), (skb), (bytes))
+#define	PKTPULL(drv, skb, bytes)	osl_pktpull((drv), (skb), (bytes))
+#define	PKTDUP(drv, skb)		osl_pktdup((drv), (skb))
+#define	PKTCOOKIE(skb)			osl_pktcookie((skb))
+#define	PKTSETCOOKIE(skb, x)		osl_pktsetcookie((skb), (x))
+#define	PKTLINK(skb)			osl_pktlink((skb))
+#define	PKTSETLINK(skb, x)		osl_pktsetlink((skb), (x))
+extern void *osl_pktget(void *drv, uint len, bool send);
+extern void osl_pktfree(void *skb);
+extern uchar *osl_pktdata(void *drv, void *skb);
+extern uint osl_pktlen(void *drv, void *skb);
+extern void *osl_pktnext(void *drv, void *skb);
+extern void osl_pktsetnext(void *skb, void *x);
+extern void osl_pktsetlen(void *drv, void *skb, uint len);
+extern uchar *osl_pktpush(void *drv, void *skb, int bytes);
+extern uchar *osl_pktpull(void *drv, void *skb, int bytes);
+extern void *osl_pktdup(void *drv, void *skb);
+extern void *osl_pktcookie(void *skb);
+extern void osl_pktsetcookie(void *skb, void *x);
+extern void *osl_pktlink(void *skb);
+extern void osl_pktsetlink(void *skb, void *x);
+
+#endif	/* BINOSL */
+
+#endif	/* _linux_osl_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/linuxver.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/linuxver.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/linuxver.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/linuxver.h	2005-08-28 11:12:20.441857480 +0200
@@ -0,0 +1,326 @@
+/*
+ * Linux-specific abstractions to gain some independence from linux kernel versions.
+ * Pave over some 2.2 versus 2.4 kernel differences.
+ *
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef _linuxver_h_
+#define _linuxver_h_
+
+#include <linux/config.h>
+#include <linux/version.h>
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,3,0))
+/* __NO_VERSION__ must be defined for all linkables except one in 2.2 */
+#ifdef __UNDEF_NO_VERSION__
+#undef __NO_VERSION__
+#else
+#define __NO_VERSION__
+#endif
+#endif
+
+#if defined(MODULE) && defined(MODVERSIONS)
+#include <linux/modversions.h>
+#endif
+
+/* linux/malloc.h is deprecated, use linux/slab.h instead. */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,4,9))
+#include <linux/malloc.h>
+#else
+#include <linux/slab.h>
+#endif
+
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/mm.h>
+#include <linux/string.h>
+#include <linux/pci.h>
+#include <linux/interrupt.h>
+#include <linux/netdevice.h>
+#include <asm/io.h>
+
+#ifndef __exit
+#define __exit
+#endif
+#ifndef __devexit
+#define __devexit
+#endif
+#ifndef __devinit
+#define __devinit	__init
+#endif
+#ifndef __devinitdata
+#define __devinitdata
+#endif
+#ifndef __devexit_p
+#define __devexit_p(x)	x
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,4,0))
+
+#define pci_get_drvdata(dev)		(dev)->sysdata
+#define pci_set_drvdata(dev, value)	(dev)->sysdata=(value)
+
+/*
+ * New-style (2.4.x) PCI/hot-pluggable PCI/CardBus registration
+ */
+
+struct pci_device_id {
+	unsigned int vendor, device;		/* Vendor and device ID or PCI_ANY_ID */
+	unsigned int subvendor, subdevice;	/* Subsystem ID's or PCI_ANY_ID */
+	unsigned int class, class_mask;		/* (class,subclass,prog-if) triplet */
+	unsigned long driver_data;		/* Data private to the driver */
+};
+
+struct pci_driver {
+	struct list_head node;
+	char *name;
+	const struct pci_device_id *id_table;	/* NULL if wants all devices */
+	int (*probe)(struct pci_dev *dev, const struct pci_device_id *id);	/* New device inserted */
+	void (*remove)(struct pci_dev *dev);	/* Device removed (NULL if not a hot-plug capable driver) */
+	void (*suspend)(struct pci_dev *dev);	/* Device suspended */
+	void (*resume)(struct pci_dev *dev);	/* Device woken up */
+};
+
+#define MODULE_DEVICE_TABLE(type, name)
+#define PCI_ANY_ID (~0)
+
+/* compatpci.c */
+#define pci_module_init pci_register_driver
+extern int pci_register_driver(struct pci_driver *drv);
+extern void pci_unregister_driver(struct pci_driver *drv);
+
+#endif /* PCI registration */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,2,18))
+#ifdef MODULE
+#define module_init(x) int init_module(void) { return x(); }
+#define module_exit(x) void cleanup_module(void) { x(); }
+#else
+#define module_init(x)	__initcall(x);
+#define module_exit(x)	__exitcall(x);
+#endif
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,3,48))
+#define list_for_each(pos, head) \
+	for (pos = (head)->next; pos != (head); pos = pos->next)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,3,13))
+#define pci_resource_start(dev, bar)	((dev)->base_address[(bar)])
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(2,3,44))
+#define pci_resource_start(dev, bar)	((dev)->resource[(bar)].start)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,3,23))
+#define pci_enable_device(dev) do { } while (0)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,3,14))
+#define net_device device
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,3,42))
+
+/*
+ * DMA mapping
+ *
+ * See linux/Documentation/DMA-mapping.txt
+ */
+
+#ifndef PCI_DMA_TODEVICE
+#define	PCI_DMA_TODEVICE	1
+#define	PCI_DMA_FROMDEVICE	2
+#endif
+
+typedef u32 dma_addr_t;
+
+/* Pure 2^n version of get_order */
+static inline int get_order(unsigned long size)
+{
+	int order;
+
+	size = (size-1) >> (PAGE_SHIFT-1);
+	order = -1;
+	do {
+		size >>= 1;
+		order++;
+	} while (size);
+	return order;
+}
+
+static inline void *pci_alloc_consistent(struct pci_dev *hwdev, size_t size,
+					 dma_addr_t *dma_handle)
+{
+	void *ret;
+	int gfp = GFP_ATOMIC | GFP_DMA;
+
+	ret = (void *)__get_free_pages(gfp, get_order(size));
+
+	if (ret != NULL) {
+		memset(ret, 0, size);
+		*dma_handle = virt_to_bus(ret);
+	}
+	return ret;
+}
+static inline void pci_free_consistent(struct pci_dev *hwdev, size_t size,
+				       void *vaddr, dma_addr_t dma_handle)
+{
+	free_pages((unsigned long)vaddr, get_order(size));
+}
+#ifdef ILSIM
+extern uint pci_map_single(void *dev, void *va, uint size, int direction);
+extern void pci_unmap_single(void *dev, uint pa, uint size, int direction);
+#else
+#define pci_map_single(cookie, address, size, dir)	virt_to_bus(address)
+#define pci_unmap_single(cookie, address, size, dir)
+#endif
+
+#endif /* DMA mapping */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,3,43))
+
+#define dev_kfree_skb_any(a)		dev_kfree_skb(a)
+#define netif_down(dev)			do { (dev)->start = 0; } while(0)
+
+/* pcmcia-cs provides its own netdevice compatibility layer */
+#ifndef _COMPAT_NETDEVICE_H
+
+/*
+ * SoftNet
+ *
+ * For pre-softnet kernels we need to tell the upper layer not to
+ * re-enter start_xmit() while we are in there. However softnet
+ * guarantees not to enter while we are in there so there is no need
+ * to do the netif_stop_queue() dance unless the transmit queue really
+ * gets stuck. This should also improve performance according to tests
+ * done by Aman Singla.
+ */
+
+#define dev_kfree_skb_irq(a)		dev_kfree_skb(a)
+#define netif_wake_queue(dev)		do { clear_bit(0, &(dev)->tbusy); mark_bh(NET_BH); } while(0)
+#define netif_stop_queue(dev)		set_bit(0, &(dev)->tbusy)
+
+static inline void netif_start_queue(struct net_device *dev)
+{
+	dev->tbusy = 0;
+	dev->interrupt = 0;
+	dev->start = 1;
+}
+
+#define netif_queue_stopped(dev)	(dev)->tbusy
+#define netif_running(dev)		(dev)->start
+
+#endif /* _COMPAT_NETDEVICE_H */
+
+#define netif_device_attach(dev)	netif_start_queue(dev)
+#define netif_device_detach(dev)	netif_stop_queue(dev)
+
+/* 2.4.x renamed bottom halves to tasklets */
+#define tasklet_struct				tq_struct
+static inline void tasklet_schedule(struct tasklet_struct *tasklet)
+{
+	queue_task(tasklet, &tq_immediate);
+	mark_bh(IMMEDIATE_BH);
+}
+
+static inline void tasklet_init(struct tasklet_struct *tasklet,
+				void (*func)(unsigned long),
+				unsigned long data)
+{
+	tasklet->next = NULL;
+	tasklet->sync = 0;
+	tasklet->routine = (void (*)(void *))func;
+	tasklet->data = (void *)data;
+}
+#define tasklet_kill(tasklet)			{do{} while(0);}
+
+/* 2.4.x introduced del_timer_sync() */
+#define del_timer_sync(timer) del_timer(timer)
+
+#else
+
+#define netif_down(dev)
+
+#endif /* SoftNet */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,4,3))
+
+/*
+ * Emit code to initialise a tq_struct's routine and data pointers
+ */
+#define PREPARE_TQUEUE(_tq, _routine, _data)			\
+	do {							\
+		(_tq)->routine = _routine;			\
+		(_tq)->data = _data;				\
+	} while (0)
+
+/*
+ * Emit code to initialise all of a tq_struct
+ */
+#define INIT_TQUEUE(_tq, _routine, _data)			\
+	do {							\
+		INIT_LIST_HEAD(&(_tq)->list);			\
+		(_tq)->sync = 0;				\
+		PREPARE_TQUEUE((_tq), (_routine), (_data));	\
+	} while (0)
+
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,4,6))
+
+/* Power management related routines */
+
+static inline int
+pci_save_state(struct pci_dev *dev, u32 *buffer)
+{
+	int i;
+	if (buffer) {
+		for (i = 0; i < 16; i++)
+			pci_read_config_dword(dev, i * 4,&buffer[i]);
+	}
+	return 0;
+}
+
+static inline int 
+pci_restore_state(struct pci_dev *dev, u32 *buffer)
+{
+	int i;
+
+	if (buffer) {
+		for (i = 0; i < 16; i++)
+			pci_write_config_dword(dev,i * 4, buffer[i]);
+	}
+	/*
+	 * otherwise, write the context information we know from bootup.
+	 * This works around a problem where warm-booting from Windows
+	 * combined with a D3(hot)->D0 transition causes PCI config
+	 * header data to be forgotten.
+	 */	
+	else {
+		for (i = 0; i < 6; i ++)
+			pci_write_config_dword(dev,
+					       PCI_BASE_ADDRESS_0 + (i * 4),
+					       pci_resource_start(dev, i));
+		pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
+	}
+	return 0;
+}
+
+#endif /* PCI power management */
+
+/* Old cp0 access macros deprecated in 2.4.19 */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,4,19))
+#define read_c0_count() read_32bit_cp0_register(CP0_COUNT)
+#endif
+
+#endif /* _linuxver_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/nvports.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/nvports.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/nvports.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/nvports.h	2005-08-28 11:12:20.441857480 +0200
@@ -0,0 +1,62 @@
+/*
+ * Broadcom Home Gateway Reference Design
+ * Ports Web Page Configuration Support Routines
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef _nvports_h_
+#define _nvports_h_
+
+#define uint32 unsigned long
+#define uint16 unsigned short
+#define uint unsigned int
+#define uint8 unsigned char
+#define uint64 unsigned long long
+
+enum FORCE_PORT {
+	FORCE_OFF,
+	FORCE_10H,
+	FORCE_10F,
+	FORCE_100H,
+	FORCE_100F,
+	FORCE_DOWN,
+	POWER_OFF
+};
+
+typedef struct _PORT_ATTRIBS
+{
+	uint 	autoneg;
+	uint	force;
+	uint	native;	
+} PORT_ATTRIBS;
+
+extern uint
+nvExistsPortAttrib(char *attrib, uint portno);
+
+extern int
+nvExistsAnyForcePortAttrib(uint portno);
+
+extern void
+nvSetPortAttrib(char *attrib, uint portno);
+
+extern void
+nvUnsetPortAttrib(char *attrib, uint portno);
+
+extern void
+nvUnsetAllForcePortAttrib(uint portno);
+
+extern PORT_ATTRIBS
+nvGetSwitchPortAttribs(uint portno);
+
+#endif /* _nvports_h_ */
+
+
+
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/osl.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/osl.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/osl.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/osl.h	2005-08-28 11:12:20.441857480 +0200
@@ -0,0 +1,38 @@
+/*
+ * OS Independent Layer
+ * 
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef _osl_h_
+#define _osl_h_
+
+#ifdef V2_HAL
+#include <v2hal_osl.h>
+#elif defined(linux)
+#include <linux_osl.h>
+#elif PMON
+#include <pmon_osl.h>
+#elif defined(NDIS)
+#include <ndis_osl.h>
+#elif defined(_CFE_)
+#include <cfe_osl.h>
+#elif defined(MACOS9)
+#include <macos9_osl.h>
+#elif defined(MACOSX)
+#include <macosx_osl.h>
+#else
+#error "Unsupported OSL requested"
+#endif
+
+/* handy */
+#define	SET_REG(r, mask, val)	W_REG((r), ((R_REG(r) & ~(mask)) | (val)))
+
+#endif	/* _osl_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/pcicfg.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/pcicfg.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/pcicfg.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/pcicfg.h	2005-08-28 11:12:20.442857328 +0200
@@ -0,0 +1,362 @@
+/*
+ * pcicfg.h: PCI configuration  constants and structures.
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef	_h_pci_
+#define	_h_pci_
+
+/* The following inside ifndef's so we don't collide with NTDDK.H */
+#ifndef PCI_MAX_BUS
+#define PCI_MAX_BUS		0x100
+#endif
+#ifndef PCI_MAX_DEVICES
+#define PCI_MAX_DEVICES		0x20
+#endif
+#ifndef PCI_MAX_FUNCTION
+#define PCI_MAX_FUNCTION	0x8
+#endif
+
+#ifndef PCI_INVALID_VENDORID
+#define PCI_INVALID_VENDORID	0xffff
+#endif
+#ifndef PCI_INVALID_DEVICEID
+#define PCI_INVALID_DEVICEID	0xffff
+#endif
+
+
+/* Convert between bus-slot-function-register and config addresses */
+
+#define	PCICFG_BUS_SHIFT	16	/* Bus shift */
+#define	PCICFG_SLOT_SHIFT	11	/* Slot shift */
+#define	PCICFG_FUN_SHIFT	8	/* Function shift */
+#define	PCICFG_OFF_SHIFT	0	/* Bus shift */
+
+#define	PCICFG_BUS_MASK		0xff	/* Bus mask */
+#define	PCICFG_SLOT_MASK	0x1f	/* Slot mask */
+#define	PCICFG_FUN_MASK		7	/* Function mask */
+#define	PCICFG_OFF_MASK		0xff	/* Bus mask */
+
+#define	PCI_CONFIG_ADDR(b, s, f, o)					\
+		((((b) & PCICFG_BUS_MASK) << PCICFG_BUS_SHIFT)		\
+		 | (((s) & PCICFG_SLOT_MASK) << PCICFG_SLOT_SHIFT)	\
+		 | (((f) & PCICFG_FUN_MASK) << PCICFG_FUN_SHIFT)	\
+		 | (((o) & PCICFG_OFF_MASK) << PCICFG_OFF_SHIFT))
+
+#define	PCI_CONFIG_BUS(a)	(((a) >> PCICFG_BUS_SHIFT) & PCICFG_BUS_MASK)
+#define	PCI_CONFIG_SLOT(a)	(((a) >> PCICFG_SLOT_SHIFT) & PCICFG_SLOT_MASK)
+#define	PCI_CONFIG_FUN(a)	(((a) >> PCICFG_FUN_SHIFT) & PCICFG_FUN_MASK)
+#define	PCI_CONFIG_OFF(a)	(((a) >> PCICFG_OFF_SHIFT) & PCICFG_OFF_MASK)
+
+
+/* The actual config space */
+
+#define	PCI_BAR_MAX		6
+
+#define	PCI_ROM_BAR		8
+
+#define	PCR_RSVDA_MAX		2
+
+typedef struct _pci_config_regs {
+    unsigned short	vendor;
+    unsigned short	device;
+    unsigned short	command;
+    unsigned short	status;
+    unsigned char	rev_id;
+    unsigned char	prog_if;
+    unsigned char	sub_class;
+    unsigned char	base_class;
+    unsigned char	cache_line_size;
+    unsigned char	latency_timer;
+    unsigned char	header_type;
+    unsigned char	bist;
+    unsigned long	base[PCI_BAR_MAX];
+    unsigned long	cardbus_cis;
+    unsigned short	subsys_vendor;
+    unsigned short	subsys_id;
+    unsigned long	baserom;
+    unsigned long	rsvd_a[PCR_RSVDA_MAX];
+    unsigned char	int_line;
+    unsigned char	int_pin;
+    unsigned char	min_gnt;
+    unsigned char	max_lat;
+    unsigned char	dev_dep[192];
+} pci_config_regs;
+
+#define	SZPCR		(sizeof (pci_config_regs))
+#define	MINSZPCR	64		/* offsetof (dev_dep[0] */
+
+/* A structure for the config registers is nice, but in most
+ * systems the config space is not memory mapped, so we need
+ * filed offsetts. :-(
+ */
+#define	PCI_CFG_VID		0
+#define	PCI_CFG_DID		2
+#define	PCI_CFG_CMD		4
+#define	PCI_CFG_STAT		6
+#define	PCI_CFG_REV		8
+#define	PCI_CFG_PROGIF		9
+#define	PCI_CFG_SUBCL		0xa
+#define	PCI_CFG_BASECL		0xb
+#define	PCI_CFG_CLSZ		0xc
+#define	PCI_CFG_LATTIM		0xd
+#define	PCI_CFG_HDR		0xe
+#define	PCI_CFG_BIST		0xf
+#define	PCI_CFG_BAR0		0x10
+#define	PCI_CFG_BAR1		0x14
+#define	PCI_CFG_BAR2		0x18
+#define	PCI_CFG_BAR3		0x1c
+#define	PCI_CFG_BAR4		0x20
+#define	PCI_CFG_BAR5		0x24
+#define	PCI_CFG_CIS		0x28
+#define	PCI_CFG_SVID		0x2c
+#define	PCI_CFG_SSID		0x2e
+#define	PCI_CFG_ROMBAR		0x30
+#define	PCI_CFG_INT		0x3c
+#define	PCI_CFG_PIN		0x3d
+#define	PCI_CFG_MINGNT		0x3e
+#define	PCI_CFG_MAXLAT		0x3f
+
+/* Classes and subclasses */
+
+typedef enum {
+    PCI_CLASS_OLD = 0,
+    PCI_CLASS_DASDI,
+    PCI_CLASS_NET,
+    PCI_CLASS_DISPLAY,
+    PCI_CLASS_MMEDIA,
+    PCI_CLASS_MEMORY,
+    PCI_CLASS_BRIDGE,
+    PCI_CLASS_COMM,
+    PCI_CLASS_BASE,
+    PCI_CLASS_INPUT,
+    PCI_CLASS_DOCK,
+    PCI_CLASS_CPU,
+    PCI_CLASS_SERIAL,
+    PCI_CLASS_INTELLIGENT = 0xe,
+    PCI_CLASS_SATELLITE,
+    PCI_CLASS_CRYPT,
+    PCI_CLASS_DSP,
+    PCI_CLASS_MAX
+} pci_classes;
+
+typedef enum {
+    PCI_DASDI_SCSI,
+    PCI_DASDI_IDE,
+    PCI_DASDI_FLOPPY,
+    PCI_DASDI_IPI,
+    PCI_DASDI_RAID,
+    PCI_DASDI_OTHER = 0x80
+} pci_dasdi_subclasses;
+
+typedef enum {
+    PCI_NET_ETHER,
+    PCI_NET_TOKEN,
+    PCI_NET_FDDI,
+    PCI_NET_ATM,
+    PCI_NET_OTHER = 0x80
+} pci_net_subclasses;
+
+typedef enum {
+    PCI_DISPLAY_VGA,
+    PCI_DISPLAY_XGA,
+    PCI_DISPLAY_3D,
+    PCI_DISPLAY_OTHER = 0x80
+} pci_display_subclasses;
+
+typedef enum {
+    PCI_MMEDIA_VIDEO,
+    PCI_MMEDIA_AUDIO,
+    PCI_MMEDIA_PHONE,
+    PCI_MEDIA_OTHER = 0x80
+} pci_mmedia_subclasses;
+
+typedef enum {
+    PCI_MEMORY_RAM,
+    PCI_MEMORY_FLASH,
+    PCI_MEMORY_OTHER = 0x80
+} pci_memory_subclasses;
+
+typedef enum {
+    PCI_BRIDGE_HOST,
+    PCI_BRIDGE_ISA,
+    PCI_BRIDGE_EISA,
+    PCI_BRIDGE_MC,
+    PCI_BRIDGE_PCI,
+    PCI_BRIDGE_PCMCIA,
+    PCI_BRIDGE_NUBUS,
+    PCI_BRIDGE_CARDBUS,
+    PCI_BRIDGE_RACEWAY,
+    PCI_BRIDGE_OTHER = 0x80
+} pci_bridge_subclasses;
+
+typedef enum {
+    PCI_COMM_UART,
+    PCI_COMM_PARALLEL,
+    PCI_COMM_MULTIUART,
+    PCI_COMM_MODEM,
+    PCI_COMM_OTHER = 0x80
+} pci_comm_subclasses;
+
+typedef enum {
+    PCI_BASE_PIC,
+    PCI_BASE_DMA,
+    PCI_BASE_TIMER,
+    PCI_BASE_RTC,
+    PCI_BASE_PCI_HOTPLUG,
+    PCI_BASE_OTHER = 0x80
+} pci_base_subclasses;
+
+typedef enum {
+    PCI_INPUT_KBD,
+    PCI_INPUT_PEN,
+    PCI_INPUT_MOUSE,
+    PCI_INPUT_SCANNER,
+    PCI_INPUT_GAMEPORT,
+    PCI_INPUT_OTHER = 0x80
+} pci_input_subclasses;
+
+typedef enum {
+    PCI_DOCK_GENERIC,
+    PCI_DOCK_OTHER = 0x80
+} pci_dock_subclasses;
+
+typedef enum {
+    PCI_CPU_386,
+    PCI_CPU_486,
+    PCI_CPU_PENTIUM,
+    PCI_CPU_ALPHA = 0x10,
+    PCI_CPU_POWERPC = 0x20,
+    PCI_CPU_MIPS = 0x30,
+    PCI_CPU_COPROC = 0x40,
+    PCI_CPU_OTHER = 0x80
+} pci_cpu_subclasses;
+
+typedef enum {
+    PCI_SERIAL_IEEE1394,
+    PCI_SERIAL_ACCESS,
+    PCI_SERIAL_SSA,
+    PCI_SERIAL_USB,
+    PCI_SERIAL_FIBER,
+    PCI_SERIAL_SMBUS,
+    PCI_SERIAL_OTHER = 0x80
+} pci_serial_subclasses;
+
+typedef enum {
+    PCI_INTELLIGENT_I2O,
+} pci_intelligent_subclasses;
+
+typedef enum {
+    PCI_SATELLITE_TV,
+    PCI_SATELLITE_AUDIO,
+    PCI_SATELLITE_VOICE,
+    PCI_SATELLITE_DATA,
+    PCI_SATELLITE_OTHER = 0x80
+} pci_satellite_subclasses;
+
+typedef enum {
+    PCI_CRYPT_NETWORK,
+    PCI_CRYPT_ENTERTAINMENT,
+    PCI_CRYPT_OTHER = 0x80
+} pci_crypt_subclasses;
+
+typedef enum {
+    PCI_DSP_DPIO,
+    PCI_DSP_OTHER = 0x80
+} pci_dsp_subclasses;
+
+/* Header types */
+typedef enum {
+	PCI_HEADER_NORMAL,
+	PCI_HEADER_BRIDGE,
+	PCI_HEADER_CARDBUS
+} pci_header_types;
+
+
+/* Overlay for a PCI-to-PCI bridge */
+
+#define	PPB_RSVDA_MAX		2
+#define	PPB_RSVDD_MAX		8
+
+typedef struct _ppb_config_regs {
+    unsigned short	vendor;
+    unsigned short	device;
+    unsigned short	command;
+    unsigned short	status;
+    unsigned char	rev_id;
+    unsigned char	prog_if;
+    unsigned char	sub_class;
+    unsigned char	base_class;
+    unsigned char	cache_line_size;
+    unsigned char	latency_timer;
+    unsigned char	header_type;
+    unsigned char	bist;
+    unsigned long	rsvd_a[PPB_RSVDA_MAX];
+    unsigned char	prim_bus;
+    unsigned char	sec_bus;
+    unsigned char	sub_bus;
+    unsigned char	sec_lat;
+    unsigned char	io_base;
+    unsigned char	io_lim;
+    unsigned short	sec_status;
+    unsigned short	mem_base;
+    unsigned short	mem_lim;
+    unsigned short	pf_mem_base;
+    unsigned short	pf_mem_lim;
+    unsigned long	pf_mem_base_hi;
+    unsigned long	pf_mem_lim_hi;
+    unsigned short	io_base_hi;
+    unsigned short	io_lim_hi;
+    unsigned short	subsys_vendor;
+    unsigned short	subsys_id;
+    unsigned long	rsvd_b;
+    unsigned char	rsvd_c;
+    unsigned char	int_pin;
+    unsigned short	bridge_ctrl;
+    unsigned char	chip_ctrl;
+    unsigned char	diag_ctrl;
+    unsigned short	arb_ctrl;
+    unsigned long	rsvd_d[PPB_RSVDD_MAX];
+    unsigned char	dev_dep[192];
+} ppb_config_regs;
+
+/* Eveything below is BRCM HND proprietary */
+
+#define	PCI_BAR0_WIN		0x80	/* backplane addres space accessed by BAR0 */
+#define	PCI_BAR1_WIN		0x84	/* backplane addres space accessed by BAR1 */
+#define	PCI_SPROM_CONTROL	0x88	/* sprom property control */
+#define	PCI_BAR1_CONTROL	0x8c	/* BAR1 region burst control */
+#define	PCI_INT_STATUS		0x90	/* PCI and other cores interrupts */
+#define	PCI_INT_MASK		0x94	/* mask of PCI and other cores interrupts */
+#define PCI_TO_SB_MB		0x98	/* signal backplane interrupts */
+#define PCI_BACKPLANE_ADDR	0xA0	/* address an arbitrary location on the system backplane */
+#define PCI_BACKPLANE_DATA	0xA4	/* data at the location specified by above address register */
+#define	PCI_GPIO_IN		0xb0	/* pci config space gpio input (>=rev3) */
+#define	PCI_GPIO_OUT		0xb4	/* pci config space gpio output (>=rev3) */
+#define	PCI_GPIO_OUTEN		0xb8	/* pci config space gpio output enable (>=rev3) */
+
+#define	PCI_BAR0_SPROM_OFFSET	(4 * 1024)	/* bar0 + 4K accesses external sprom */
+#define	PCI_BAR0_PCIREGS_OFFSET	(6 * 1024)	/* bar0 + 6K accesses pci core registers */
+
+/* PCI_INT_MASK */
+#define	PCI_SBIM_SHIFT		8	/* backplane core interrupt mask bits offset */
+#define	PCI_SBIM_MASK		0xff00	/* backplane core interrupt mask */
+
+/* PCI_SPROM_CONTROL */
+#define	SPROM_BLANK		0x04  	/* indicating a blank sprom */
+#define SPROM_WRITEEN		0x10	/* sprom write enable */
+#define SPROM_BOOTROM_WE	0x20	/* external bootrom write enable */
+
+#define	SPROM_SIZE		256	/* sprom size in 16-bit */
+#define SPROM_CRC_RANGE		64	/* crc cover range in 16-bit */
+
+#endif
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/proto/802.11.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/proto/802.11.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/proto/802.11.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/proto/802.11.h	2005-08-28 11:12:20.450856112 +0200
@@ -0,0 +1,679 @@
+/*
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ *
+ * Fundamental types and constants relating to 802.11 
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef _802_11_H_
+#define _802_11_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+#ifndef _NET_ETHERNET_H_
+#include <proto/ethernet.h>
+#endif
+
+/* enable structure packing */
+#if !defined(__GNUC__)
+#pragma pack(1)
+#endif
+
+/* some platforms require stronger medicine */
+#if defined(__GNUC__)
+#define	PACKED	__attribute__((packed))
+#else
+#define	PACKED
+#endif
+
+
+#define DOT11_TU_TO_US			1024	/* 802.11 Time Unit is 1024 microseconds */
+
+/* Generic 802.11 frame constants */
+#define DOT11_A3_HDR_LEN		24
+#define DOT11_A4_HDR_LEN		30
+#define DOT11_MAC_HDR_LEN		DOT11_A3_HDR_LEN
+#define DOT11_FCS_LEN			4
+#define DOT11_ICV_LEN			4
+#define DOT11_ICV_AES_LEN		8
+
+
+#define DOT11_KEY_INDEX_SHIFT		6
+#define DOT11_IV_LEN			4
+#define DOT11_IV_TKIP_LEN		8
+#define DOT11_IV_AES_OCB_LEN		4
+#define DOT11_IV_AES_CCM_LEN		8
+
+#define DOT11_MAX_MPDU_BODY_LEN		2312
+#define DOT11_MAX_MPDU_LEN		2346	/* body len + A4 hdr + FCS */
+#define DOT11_MAX_SSID_LEN		32
+
+/* dot11RTSThreshold */
+#define DOT11_DEFAULT_RTS_LEN		2347
+#define DOT11_MAX_RTS_LEN		2347
+
+/* dot11FragmentationThreshold */
+#define DOT11_MIN_FRAG_LEN		256
+#define DOT11_MAX_FRAG_LEN		2346	/* Max frag is also limited by aMPDUMaxLength of the attached PHY */
+#define DOT11_DEFAULT_FRAG_LEN		2346
+
+/* dot11BeaconPeriod */
+#define DOT11_MIN_BEACON_PERIOD		1
+#define DOT11_MAX_BEACON_PERIOD		0xFFFF
+
+/* dot11DTIMPeriod */
+#define DOT11_MIN_DTIM_PERIOD		1
+#define DOT11_MAX_DTIM_PERIOD		0xFF
+
+/* 802.2 LLC/SNAP header used by 802.11 per 802.1H */
+#define DOT11_LLC_SNAP_HDR_LEN	8
+#define DOT11_OUI_LEN			3
+struct dot11_llc_snap_header {
+	uint8	dsap;				/* always 0xAA */
+	uint8	ssap;				/* always 0xAA */
+	uint8	ctl;				/* always 0x03 */
+	uint8	oui[DOT11_OUI_LEN];		/* RFC1042: 0x00 0x00 0x00
+						   Bridge-Tunnel: 0x00 0x00 0xF8 */
+	uint16	type;				/* ethertype */
+} PACKED;
+
+/* RFC1042 header used by 802.11 per 802.1H */
+#define RFC1042_HDR_LEN			(ETHER_HDR_LEN + DOT11_LLC_SNAP_HDR_LEN)
+
+/* Generic 802.11 MAC header */
+/*
+ * N.B.: This struct reflects the full 4 address 802.11 MAC header.
+ *		 The fields are defined such that the shorter 1, 2, and 3
+ *		 address headers just use the first k fields.
+ */
+struct dot11_header {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	a1;		/* address 1 */
+	struct ether_addr	a2;		/* address 2 */
+	struct ether_addr	a3;		/* address 3 */
+	uint16			seq;		/* sequence control */
+	struct ether_addr	a4;		/* address 4 */
+} PACKED;
+
+/* Control frames */
+
+struct dot11_rts_frame {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+	struct ether_addr	ta;		/* transmitter address */
+} PACKED;
+#define	DOT11_RTS_LEN		16
+
+struct dot11_cts_frame {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+} PACKED;
+#define	DOT11_CTS_LEN		10
+
+struct dot11_ack_frame {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+} PACKED;
+#define	DOT11_ACK_LEN		10
+
+struct dot11_ps_poll_frame {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* AID */
+	struct ether_addr	bssid;		/* receiver address, STA in AP */
+	struct ether_addr	ta;		/* transmitter address */
+} PACKED;
+#define	DOT11_PS_POLL_LEN	16
+
+struct dot11_cf_end_frame {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+	struct ether_addr	bssid;		/* transmitter address, STA in AP */
+} PACKED;
+#define	DOT11_CS_END_LEN	16
+
+/* Management frame header */
+struct dot11_management_header {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	da;		/* receiver address */
+	struct ether_addr	sa;		/* transmitter address */
+	struct ether_addr	bssid;		/* BSS ID */
+	uint16			seq;		/* sequence control */
+} PACKED;
+#define	DOT11_MGMT_HDR_LEN	24
+
+/* Management frame payloads */
+
+struct dot11_bcn_prb {
+	uint32			timestamp[2];
+	uint16			beacon_interval;
+	uint16			capability;
+} PACKED;
+#define	DOT11_BCN_PRB_LEN	12
+
+struct dot11_auth {
+	uint16			alg;		/* algorithm */
+	uint16			seq;		/* sequence control */
+	uint16			status;		/* status code */
+} PACKED;
+#define DOT11_AUTH_FIXED_LEN	6		/* length of auth frame without challenge info elt */
+
+struct dot11_assoc_req {
+	uint16			capability;	/* capability information */
+	uint16			listen;		/* listen interval */
+} PACKED;
+
+struct dot11_assoc_resp {
+	uint16			capability;	/* capability information */
+	uint16			status;		/* status code */
+	uint16			aid;		/* association ID */
+} PACKED;
+
+struct dot11_action_measure {
+	uint8	category;
+	uint8	action;
+	uint8	token;
+	uint8	data[1];
+} PACKED;
+#define DOT11_ACTION_MEASURE_LEN	3
+
+/**************
+  802.11h related definitions.
+**************/
+typedef struct {
+	uint8 id;
+	uint8 len;
+	uint8 power;
+} dot11_power_cnst_t;
+
+typedef struct {
+	uint8 min;
+	uint8 max;
+} dot11_power_cap_t;
+
+typedef struct {
+	uint8 id;
+	uint8 len;
+	uint8 tx_pwr;
+	uint8 margin;
+} dot11_tpc_rep_t;
+#define DOT11_MNG_IE_TPC_REPORT_LEN	2	/* length of IE data, not including 2 byte header */
+
+typedef struct {
+	uint8 id;
+	uint8 len;
+	uint8 first_channel;
+	uint8 num_channels;
+} dot11_supp_channels_t;
+
+struct dot11_channel_switch {
+	uint8 id;
+	uint8 len;
+	uint8 mode;
+	uint8 channel;
+	uint8 count;
+}  PACKED;
+typedef struct dot11_channel_switch dot11_channel_switch_t;
+
+/* 802.11h Measurement Request/Report IEs */
+/* Measurement Type field */
+#define DOT11_MEASURE_TYPE_BASIC 	0
+#define DOT11_MEASURE_TYPE_CCA 		1
+#define DOT11_MEASURE_TYPE_RPI	 	2
+
+/* Measurement Mode field */
+
+/* Measurement Request Modes */
+#define DOT11_MEASURE_MODE_ENABLE 	(1<<1)
+#define DOT11_MEASURE_MODE_REQUEST	(1<<2)
+#define DOT11_MEASURE_MODE_REPORT 	(1<<3)
+/* Measurement Report Modes */
+#define DOT11_MEASURE_MODE_LATE 	(1<<0)
+#define DOT11_MEASURE_MODE_INCAPABLE	(1<<1)
+#define DOT11_MEASURE_MODE_REFUSED	(1<<2)
+/* Basic Measurement Map bits */
+#define DOT11_MEASURE_BASIC_MAP_BSS	((uint8)(1<<0))
+#define DOT11_MEASURE_BASIC_MAP_OFDM	((uint8)(1<<1))
+#define DOT11_MEASURE_BASIC_MAP_UKNOWN	((uint8)(1<<2))
+#define DOT11_MEASURE_BASIC_MAP_RADAR	((uint8)(1<<3))
+#define DOT11_MEASURE_BASIC_MAP_UNMEAS	((uint8)(1<<4))
+
+typedef struct {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	uint8 channel;
+	uint8 start_time[8];
+	uint16 duration;
+} dot11_meas_req_t;
+#define DOT11_MNG_IE_MREQ_LEN 14
+/* length of Measure Request IE data not including variable len */
+#define DOT11_MNG_IE_MREQ_FIXED_LEN 3
+
+struct dot11_meas_rep {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	union 
+	{
+		struct {
+			uint8 channel;
+			uint8 start_time[8];
+			uint16 duration;
+			uint8 map;
+		} PACKED basic;
+		uint8 data[1];
+	} PACKED rep;
+} PACKED;
+typedef struct dot11_meas_rep dot11_meas_rep_t;
+
+/* length of Measure Report IE data not including variable len */
+#define DOT11_MNG_IE_MREP_FIXED_LEN	3
+
+struct dot11_meas_rep_basic {
+	uint8 channel;
+	uint8 start_time[8];
+	uint16 duration;
+	uint8 map;
+} PACKED;
+typedef struct dot11_meas_rep_basic dot11_meas_rep_basic_t;
+#define DOT11_MEASURE_BASIC_REP_LEN	12
+
+struct dot11_quiet {
+	uint8 id;
+	uint8 len;
+	uint8 count;	/* TBTTs until beacon interval in quiet starts */
+	uint8 period;	/* Beacon intervals between periodic quiet periods ? */
+	uint16 duration;/* Length of quiet period, in TU's */
+	uint16 offset;	/* TU's offset from TBTT in Count field */
+} PACKED;
+typedef struct dot11_quiet dot11_quiet_t;
+
+typedef struct {
+	uint8 channel;
+	uint8 map;
+} chan_map_tuple_t;
+
+typedef struct {
+	uint8 id;
+	uint8 len;
+	uint8 eaddr[ETHER_ADDR_LEN];
+	uint8 interval;
+	chan_map_tuple_t map[1];
+} dot11_ibss_dfs_t;
+
+
+/* Macro to take a pointer to a beacon or probe response
+ * header and return the char* pointer to the SSID info element
+ */
+#define BCN_PRB_SSID(hdr) ((char*)(hdr) + DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_LEN)
+
+/* Authentication frame payload constants */
+#define DOT11_OPEN_SYSTEM	0
+#define DOT11_SHARED_KEY	1
+#define DOT11_CHALLENGE_LEN	128
+
+/* Frame control macros */
+#define FC_PVER_MASK		0x3
+#define FC_PVER_SHIFT		0
+#define FC_TYPE_MASK		0xC
+#define FC_TYPE_SHIFT		2
+#define FC_SUBTYPE_MASK		0xF0
+#define FC_SUBTYPE_SHIFT	4
+#define FC_TODS			0x100
+#define FC_TODS_SHIFT		8
+#define FC_FROMDS		0x200
+#define FC_FROMDS_SHIFT		9
+#define FC_MOREFRAG		0x400
+#define FC_MOREFRAG_SHIFT	10
+#define FC_RETRY		0x800
+#define FC_RETRY_SHIFT		11
+#define FC_PM			0x1000
+#define FC_PM_SHIFT		12
+#define FC_MOREDATA		0x2000
+#define FC_MOREDATA_SHIFT	13
+#define FC_WEP			0x4000
+#define FC_WEP_SHIFT		14
+#define FC_ORDER		0x8000
+#define FC_ORDER_SHIFT		15
+
+/* sequence control macros */
+#define SEQNUM_SHIFT		4
+#define FRAGNUM_MASK		0xF
+
+/* Frame Control type/subtype defs */
+
+/* FC Types */
+#define FC_TYPE_MNG		0
+#define FC_TYPE_CTL		1
+#define FC_TYPE_DATA		2
+
+/* Management Subtypes */
+#define FC_SUBTYPE_ASSOC_REQ		0
+#define FC_SUBTYPE_ASSOC_RESP		1
+#define FC_SUBTYPE_REASSOC_REQ		2
+#define FC_SUBTYPE_REASSOC_RESP		3
+#define FC_SUBTYPE_PROBE_REQ		4
+#define FC_SUBTYPE_PROBE_RESP		5
+#define FC_SUBTYPE_BEACON		8
+#define FC_SUBTYPE_ATIM			9
+#define FC_SUBTYPE_DISASSOC		10
+#define FC_SUBTYPE_AUTH			11
+#define FC_SUBTYPE_DEAUTH		12
+#define FC_SUBTYPE_ACTION		13
+
+/* Control Subtypes */
+#define FC_SUBTYPE_PS_POLL		10
+#define FC_SUBTYPE_RTS			11
+#define FC_SUBTYPE_CTS			12
+#define FC_SUBTYPE_ACK			13
+#define FC_SUBTYPE_CF_END		14
+#define FC_SUBTYPE_CF_END_ACK		15
+
+/* Data Subtypes */
+#define FC_SUBTYPE_DATA			0
+#define FC_SUBTYPE_DATA_CF_ACK		1
+#define FC_SUBTYPE_DATA_CF_POLL		2
+#define FC_SUBTYPE_DATA_CF_ACK_POLL	3
+#define FC_SUBTYPE_NULL			4
+#define FC_SUBTYPE_CF_ACK		5
+#define FC_SUBTYPE_CF_POLL		6
+#define FC_SUBTYPE_CF_ACK_POLL		7
+
+/* type-subtype combos */
+#define FC_KIND_MASK		(FC_TYPE_MASK | FC_SUBTYPE_MASK)
+
+#define FC_KIND(t, s) (((t) << FC_TYPE_SHIFT) | ((s) << FC_SUBTYPE_SHIFT))
+
+#define FC_ASSOC_REQ	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_REQ)
+#define FC_ASSOC_RESP	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_RESP)
+#define FC_REASSOC_REQ	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_REQ)
+#define FC_REASSOC_RESP	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_RESP)
+#define FC_PROBE_REQ	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_REQ)
+#define FC_PROBE_RESP	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_RESP)
+#define FC_BEACON	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_BEACON)
+#define FC_DISASSOC	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DISASSOC)
+#define FC_AUTH		FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_AUTH)
+#define FC_DEAUTH	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DEAUTH)
+#define FC_ACTION	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION)
+
+#define FC_PS_POLL	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_PS_POLL)
+#define FC_RTS		FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_RTS)
+#define FC_CTS		FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTS)
+#define FC_ACK		FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_ACK)
+#define FC_CF_END	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END)
+#define FC_CF_END_ACK	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END_ACK)
+
+#define FC_DATA		FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA)
+#define FC_NULL_DATA	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_NULL)
+#define FC_DATA_CF_ACK	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA_CF_ACK)
+
+/* Management Frames */
+
+/* Management Frame Constants */
+
+/* Fixed fields */
+#define DOT11_MNG_AUTH_ALGO_LEN		2
+#define DOT11_MNG_AUTH_SEQ_LEN		2
+#define DOT11_MNG_BEACON_INT_LEN	2
+#define DOT11_MNG_CAP_LEN		2
+#define DOT11_MNG_AP_ADDR_LEN		6
+#define DOT11_MNG_LISTEN_INT_LEN	2
+#define DOT11_MNG_REASON_LEN		2
+#define DOT11_MNG_AID_LEN		2
+#define DOT11_MNG_STATUS_LEN		2
+#define DOT11_MNG_TIMESTAMP_LEN		8
+
+/* DUR/ID field in assoc resp is 0xc000 | AID */
+#define DOT11_AID_MASK			0x3fff
+
+/* Reason Codes */
+#define DOT11_RC_RESERVED			0
+#define DOT11_RC_UNSPECIFIED			1	/* Unspecified reason */
+#define DOT11_RC_AUTH_INVAL			2	/* Previous authentication no longer valid */
+#define DOT11_RC_DEAUTH_LEAVING			3	/* Deauthenticated because sending station is
+							   leaving (or has left) IBSS or ESS */
+#define DOT11_RC_INACTIVITY			4	/* Disassociated due to inactivity */
+#define DOT11_RC_BUSY				5	/* Disassociated because AP is unable to handle
+							   all currently associated stations */
+#define DOT11_RC_INVAL_CLASS_2			6	/* Class 2 frame received from
+							   nonauthenticated station */
+#define DOT11_RC_INVAL_CLASS_3			7	/* Class 3 frame received from
+							   nonassociated station */
+#define DOT11_RC_DISASSOC_LEAVING		8	/* Disassociated because sending station is
+							   leaving (or has left) BSS */
+#define DOT11_RC_NOT_AUTH			9	/* Station requesting (re)association is
+							   not authenticated with responding station */
+#define DOT11_RC_MAX				23	/* Reason codes > 23 are reserved */
+
+/* Status Codes */
+#define DOT11_STATUS_SUCCESS			0	/* Successful */
+#define DOT11_STATUS_FAILURE			1	/* Unspecified failure */
+#define DOT11_STATUS_CAP_MISMATCH		10	/* Cannot support all requested capabilities
+							   in the Capability Information field */
+#define DOT11_STATUS_REASSOC_FAIL		11	/* Reassociation denied due to inability to
+							   confirm that association exists */
+#define DOT11_STATUS_ASSOC_FAIL			12	/* Association denied due to reason outside
+							   the scope of this standard */
+#define DOT11_STATUS_AUTH_MISMATCH		13	/* Responding station does not support the
+							   specified authentication algorithm */
+#define DOT11_STATUS_AUTH_SEQ			14	/* Received an Authentication frame with
+							   authentication transaction sequence number
+							   out of expected sequence */
+#define DOT11_STATUS_AUTH_CHALLENGE_FAIL	15	/* Authentication rejected because of challenge failure */
+#define DOT11_STATUS_AUTH_TIMEOUT		16	/* Authentication rejected due to timeout waiting
+							   for next frame in sequence */
+#define DOT11_STATUS_ASSOC_BUSY_FAIL		17	/* Association denied because AP is unable to
+							   handle additional associated stations */
+#define DOT11_STATUS_ASSOC_RATE_MISMATCH	18	/* Association denied due to requesting station
+							   not supporting all of the data rates in the
+							   BSSBasicRateSet parameter */
+#define DOT11_STATUS_ASSOC_SHORT_REQUIRED	19	/* Association denied due to requesting station
+							   not supporting the Short Preamble option */
+#define DOT11_STATUS_ASSOC_PBCC_REQUIRED	20	/* Association denied due to requesting station
+							   not supporting the PBCC Modulation option */
+#define DOT11_STATUS_ASSOC_AGILITY_REQUIRED	21	/* Association denied due to requesting station
+							   not supporting the Channel Agility option */
+#define DOT11_STATUS_ASSOC_SPECTRUM_REQUIRED	22	/* Association denied because Spectrum Management 
+							   capability is required. */
+#define DOT11_STATUS_ASSOC_BAD_POWER_CAP	23	/* Association denied because the info in the 
+							   Power Cap element is unacceptable. */
+#define DOT11_STATUS_ASSOC_BAD_SUP_CHANNELS	24	/* Association denied because the info in the 
+							   Supported Channel element is unacceptable */
+#define DOT11_STATUS_ASSOC_SHORTSLOT_REQUIRED	25	/* Association denied due to requesting station
+							   not supporting the Short Slot Time option */
+#define DOT11_STATUS_ASSOC_ERPBCC_REQUIRED	26	/* Association denied due to requesting station
+							   not supporting the ER-PBCC Modulation option */
+#define DOT11_STATUS_ASSOC_DSSOFDM_REQUIRED	27	/* Association denied due to requesting station
+							   not supporting the DSS-OFDM option */
+
+/* Info Elts, length of INFORMATION portion of Info Elts */
+#define DOT11_MNG_DS_PARAM_LEN			1
+#define DOT11_MNG_IBSS_PARAM_LEN		2
+
+/* TIM Info element has 3 bytes fixed info in INFORMATION field,
+ * followed by 1 to 251 bytes of Partial Virtual Bitmap */
+#define DOT11_MNG_TIM_FIXED_LEN			3
+#define DOT11_MNG_TIM_DTIM_COUNT		0
+#define DOT11_MNG_TIM_DTIM_PERIOD		1
+#define DOT11_MNG_TIM_BITMAP_CTL		2
+#define DOT11_MNG_TIM_PVB			3
+
+/* TLV defines */
+#define TLV_TAG_OFF		0
+#define TLV_LEN_OFF		1
+#define TLV_HDR_LEN		2
+#define TLV_BODY_OFF		2
+
+/* Management Frame Information Element IDs */
+#define DOT11_MNG_SSID_ID			0
+#define DOT11_MNG_RATES_ID			1
+#define DOT11_MNG_FH_PARMS_ID			2
+#define DOT11_MNG_DS_PARMS_ID			3
+#define DOT11_MNG_CF_PARMS_ID			4
+#define DOT11_MNG_TIM_ID			5
+#define DOT11_MNG_IBSS_PARMS_ID			6
+#define DOT11_MNG_COUNTRY_ID			7
+#define DOT11_MNG_HOPPING_PARMS_ID		8
+#define DOT11_MNG_HOPPING_TABLE_ID		9
+#define DOT11_MNG_REQUEST_ID			10
+#define DOT11_MNG_CHALLENGE_ID			16
+#define DOT11_MNG_PWR_CONSTRAINT_ID		32    /* 11H PowerConstraint	*/
+#define DOT11_MNG_PWR_CAP_ID			33    /* 11H PowerCapability	*/
+#define DOT11_MNG_TPC_REQUEST_ID 		34    /* 11H TPC Request	*/
+#define DOT11_MNG_TPC_REPORT_ID			35    /* 11H TPC Report		*/
+#define DOT11_MNG_SUPP_CHANNELS_ID		36    /* 11H Supported Channels	*/
+#define DOT11_MNG_CHANNEL_SWITCH_ID		37    /* 11H ChannelSwitch Announcement*/
+#define DOT11_MNG_MEASURE_REQUEST_ID		38    /* 11H MeasurementRequest	*/
+#define DOT11_MNG_MEASURE_REPORT_ID		39    /* 11H MeasurementReport	*/
+#define DOT11_MNG_QUIET_ID			40    /* 11H Quiet		*/
+#define DOT11_MNG_IBSS_DFS_ID			41    /* 11H IBSS_DFS 		*/
+#define DOT11_MNG_ERP_ID			42
+#define DOT11_MNG_NONERP_ID			47
+#define DOT11_MNG_EXT_RATES_ID			50
+#define DOT11_MNG_WPA_ID			221
+#define DOT11_MNG_PROPR_ID			221
+
+/* ERP info element bit values */
+#define DOT11_MNG_ERP_LEN			1	/* ERP is currently 1 byte long */
+#define DOT11_MNG_NONERP_PRESENT		0x01	/* NonERP (802.11b) STAs are present in the BSS */
+#define DOT11_MNG_USE_PROTECTION		0x02	/* Use protection mechanisms for ERP-OFDM frames */
+#define DOT11_MNG_BARKER_PREAMBLE		0x04	/* Short Preambles: 0 == allowed, 1 == not allowed */
+
+/* Capability Information Field */
+#define DOT11_CAP_ESS				0x0001
+#define DOT11_CAP_IBSS				0x0002
+#define DOT11_CAP_POLLABLE			0x0004
+#define DOT11_CAP_POLL_RQ			0x0008
+#define DOT11_CAP_PRIVACY			0x0010
+#define DOT11_CAP_SHORT				0x0020
+#define DOT11_CAP_PBCC				0x0040
+#define DOT11_CAP_AGILITY			0x0080
+#define DOT11_CAP_SPECTRUM			0x0100
+#define DOT11_CAP_SHORTSLOT			0x0400
+#define DOT11_CAP_CCK_OFDM			0x2000
+
+/* Action Frame Constants */
+#define DOT11_ACTION_CAT_ERR_MASK	0x10
+#define DOT11_ACTION_CAT_SPECT_MNG	0x00
+
+#define DOT11_ACTION_ID_M_REQ		0
+#define DOT11_ACTION_ID_M_REP		1
+#define DOT11_ACTION_ID_TPC_REQ		2
+#define DOT11_ACTION_ID_TPC_REP		3
+#define DOT11_ACTION_ID_CHANNEL_SWITCH	4
+
+/* MLME Enumerations */
+#define DOT11_BSSTYPE_INFRASTRUCTURE		0
+#define DOT11_BSSTYPE_INDEPENDENT		1
+#define DOT11_BSSTYPE_ANY			2
+#define DOT11_SCANTYPE_ACTIVE			0
+#define DOT11_SCANTYPE_PASSIVE			1
+
+/* 802.11 A PHY constants */
+#define APHY_SLOT_TIME		9
+#define APHY_SIFS_TIME		16
+#define APHY_DIFS_TIME		(APHY_SIFS_TIME + (2 * APHY_SLOT_TIME))
+#define APHY_PREAMBLE_TIME	16
+#define APHY_SIGNAL_TIME	4
+#define APHY_SYMBOL_TIME	4
+#define APHY_SERVICE_NBITS	16
+#define APHY_TAIL_NBITS		6
+#define	APHY_CWMIN		15
+
+/* 802.11 B PHY constants */
+#define BPHY_SLOT_TIME		20
+#define BPHY_SIFS_TIME		10
+#define BPHY_DIFS_TIME		50
+#define BPHY_PLCP_TIME		192
+#define BPHY_PLCP_SHORT_TIME	96
+#define	BPHY_CWMIN		31
+
+/* 802.11 G constants */
+#define DOT11_OFDM_SIGNAL_EXTENSION	6
+
+#define PHY_CWMAX		1023
+
+#define	DOT11_MAXNUMFRAGS	16	/* max # fragments per MSDU */
+
+/* dot11Counters Table - 802.11 spec., Annex D */
+typedef struct d11cnt {
+	uint32		txfrag;		/* dot11TransmittedFragmentCount */
+	uint32		txmulti;	/* dot11MulticastTransmittedFrameCount */
+	uint32		txfail;		/* dot11FailedCount */
+	uint32		txretry;	/* dot11RetryCount */
+	uint32		txretrie;	/* dot11MultipleRetryCount */
+	uint32		rxdup;		/* dot11FrameduplicateCount */
+	uint32		txrts;		/* dot11RTSSuccessCount */
+	uint32		txnocts;	/* dot11RTSFailureCount */
+	uint32		txnoack;	/* dot11ACKFailureCount */
+	uint32		rxfrag;		/* dot11ReceivedFragmentCount */
+	uint32		rxmulti;	/* dot11MulticastReceivedFrameCount */
+	uint32		rxcrc;		/* dot11FCSErrorCount */
+	uint32		txfrmsnt;	/* dot11TransmittedFrameCount */
+	uint32		rxundec;	/* dot11WEPUndecryptableCount */
+} d11cnt_t;
+
+/* BRCM OUI */
+#define BRCM_OUI		"\x00\x10\x18"
+
+/* WPA definitions */
+#define WPA_VERSION		1
+#define WPA_OUI			"\x00\x50\xF2"
+
+#define WPA_OUI_LEN	3
+
+/* WPA authentication modes */
+#define WPA_AUTH_NONE		0	/* None */
+#define WPA_AUTH_UNSPECIFIED	1	/* Unspecified authentication over 802.1X: default for WPA */
+#define WPA_AUTH_PSK		2	/* Pre-shared Key over 802.1X */
+#define WPA_AUTH_DISABLED	255	/* Legacy (i.e., non-WPA) */
+				 
+#define IS_WPA_AUTH(auth)	((auth) == WPA_AUTH_NONE || \
+				 (auth) == WPA_AUTH_UNSPECIFIED || \
+				 (auth) == WPA_AUTH_PSK)
+
+
+/* Key related defines */
+#define DOT11_MAX_KEY_SIZE	32	/* max size of any key */
+#define DOT11_MAX_IV_SIZE	16	/* max size of any IV */
+#define DOT11_EXT_IV_FLAG	(1<<5)	/* flag to indicate IV is > 4 bytes */
+
+#define WEP1_KEY_SIZE		5	/* max size of any WEP key */
+#define WEP1_KEY_HEX_SIZE	10	/* size of WEP key in hex. */
+#define WEP128_KEY_SIZE		13	/* max size of any WEP key */
+#define WEP128_KEY_HEX_SIZE	26	/* size of WEP key in hex. */
+#define TKIP_MIC_SIZE		8	/* size of TKIP MIC */
+#define TKIP_EOM_SIZE		7	/* max size of TKIP EOM */
+#define TKIP_EOM_FLAG		0x5a	/* TKIP EOM flag byte */
+#define TKIP_KEY_SIZE		32	/* size of any TKIP key */
+#define TKIP_MIC_AUTH_TX	16	/* offset to Authenticator MIC TX key */
+#define TKIP_MIC_AUTH_RX	24	/* offset to Authenticator MIC RX key */
+#define TKIP_MIC_SUP_RX		16	/* offset to Supplicant MIC RX key */
+#define TKIP_MIC_SUP_TX		24	/* offset to Supplicant MIC TX key */
+#define AES_KEY_SIZE		16	/* size of AES key */
+
+#undef PACKED
+#if !defined(__GNUC__)
+#pragma pack()
+#endif
+
+#endif /* _802_11_H_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/proto/ethernet.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/proto/ethernet.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/proto/ethernet.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/proto/ethernet.h	2005-08-28 11:12:20.450856112 +0200
@@ -0,0 +1,145 @@
+/*******************************************************************************
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * From FreeBSD 2.2.7: Fundamental constants relating to ethernet.
+ ******************************************************************************/
+
+#ifndef _NET_ETHERNET_H_	    /* use native BSD ethernet.h when available */
+#define _NET_ETHERNET_H_
+
+#ifndef _TYPEDEFS_H_
+#include "typedefs.h"
+#endif
+
+#if defined(__GNUC__)
+#define	PACKED	__attribute__((packed))
+#else
+#define	PACKED
+#endif
+
+/*
+ * The number of bytes in an ethernet (MAC) address.
+ */
+#define	ETHER_ADDR_LEN		6
+
+/*
+ * The number of bytes in the type field.
+ */
+#define	ETHER_TYPE_LEN		2
+
+/*
+ * The number of bytes in the trailing CRC field.
+ */
+#define	ETHER_CRC_LEN		4
+
+/*
+ * The length of the combined header.
+ */
+#define	ETHER_HDR_LEN		(ETHER_ADDR_LEN*2+ETHER_TYPE_LEN)
+
+/*
+ * The minimum packet length.
+ */
+#define	ETHER_MIN_LEN		64
+
+/*
+ * The minimum packet user data length.
+ */
+#define	ETHER_MIN_DATA		46
+
+/*
+ * The maximum packet length.
+ */
+#define	ETHER_MAX_LEN		1518
+
+/*
+ * The maximum packet user data length.
+ */
+#define	ETHER_MAX_DATA		1500
+
+/*
+ * Used to uniquely identify a 802.1q VLAN-tagged header.
+ */
+#define	VLAN_TAG			0x8100
+
+/*
+ * Located after dest & src address in ether header.
+ */
+#define VLAN_FIELDS_OFFSET		(ETHER_ADDR_LEN * 2)
+
+/*
+ * 4 bytes of vlan field info.
+ */
+#define VLAN_FIELDS_SIZE		4
+
+/* location of pri bits in 16-bit vlan fields */
+#define VLAN_PRI_SHIFT			13
+
+/* 3 bits of priority */
+#define VLAN_PRI_MASK			7
+
+/* 802.1X ethertype */
+#define ETHER_TYPE_802_1X	0x888e
+
+/*
+ * A macro to validate a length with
+ */
+#define	ETHER_IS_VALID_LEN(foo)	\
+	((foo) >= ETHER_MIN_LEN && (foo) <= ETHER_MAX_LEN)
+
+
+#ifndef __INCif_etherh     /* Quick and ugly hack for VxWorks */
+/*
+ * Structure of a 10Mb/s Ethernet header.
+ */
+struct	ether_header {
+	uint8	ether_dhost[ETHER_ADDR_LEN];
+	uint8	ether_shost[ETHER_ADDR_LEN];
+	uint16	ether_type;
+} PACKED ;
+
+/*
+ * Structure of a 48-bit Ethernet address.
+ */
+struct	ether_addr {
+	uint8 octet[ETHER_ADDR_LEN];
+} PACKED ;
+#endif
+
+/*
+ * Takes a pointer, returns true if a 48-bit multicast address
+ * (including broadcast, since it is all ones)
+ */
+#define ETHER_ISMULTI(ea) (((uint8 *)(ea))[0] & 1)
+
+/*
+ * Takes a pointer, returns true if a 48-bit broadcast (all ones)
+ */
+#define ETHER_ISBCAST(ea) ((((uint8 *)(ea))[0] &		\
+			    ((uint8 *)(ea))[1] &		\
+			    ((uint8 *)(ea))[2] &		\
+			    ((uint8 *)(ea))[3] &		\
+			    ((uint8 *)(ea))[4] &		\
+			    ((uint8 *)(ea))[5]) == 0xff)
+
+static const struct ether_addr ether_bcast = {{255, 255, 255, 255, 255, 255}};
+
+/*
+ * Takes a pointer, returns true if a 48-bit null address (all zeros)
+ */
+#define ETHER_ISNULLADDR(ea) ((((uint8 *)(ea))[0] |		\
+			    ((uint8 *)(ea))[1] |		\
+			    ((uint8 *)(ea))[2] |		\
+			    ((uint8 *)(ea))[3] |		\
+			    ((uint8 *)(ea))[4] |		\
+			    ((uint8 *)(ea))[5]) == 0)
+
+#undef PACKED
+
+#endif /* _NET_ETHERNET_H_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/rts/crc.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/rts/crc.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/rts/crc.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/rts/crc.h	2005-08-28 11:12:20.451855960 +0200
@@ -0,0 +1,69 @@
+/*******************************************************************************
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * crc.h - a function to compute crc for iLine10 headers
+ ******************************************************************************/
+
+#ifndef _RTS_CRC_H_
+#define _RTS_CRC_H_ 1
+
+#include "typedefs.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+#define CRC8_INIT_VALUE  0xff       /* Initial CRC8 checksum value */
+#define CRC8_GOOD_VALUE  0x9f       /* Good final CRC8 checksum value */
+#define HCS_GOOD_VALUE   0x39       /* Good final header checksum value */
+
+#define CRC16_INIT_VALUE 0xffff     /* Initial CRC16 checksum value */
+#define CRC16_GOOD_VALUE 0xf0b8     /* Good final CRC16 checksum value */
+
+#define CRC32_INIT_VALUE 0xffffffff /* Initial CRC32 checksum value */
+#define CRC32_GOOD_VALUE 0xdebb20e3 /* Good final CRC32 checksum value */
+
+void   hcs(uint8 *, uint);
+uint8  crc8(uint8 *, uint, uint8);
+uint16 crc16(uint8 *, uint, uint16);
+uint32 crc32(uint8 *, uint, uint32);
+
+/* macros for common usage */
+
+#define APPEND_CRC8(pbytes, nbytes)                           \
+do {                                                          \
+    uint8 tmp = crc8(pbytes, nbytes, CRC8_INIT_VALUE) ^ 0xff; \
+    (pbytes)[(nbytes)] = tmp;                                 \
+    (nbytes) += 1;                                            \
+} while (0)
+
+#define APPEND_CRC16(pbytes, nbytes)                               \
+do {                                                               \
+    uint16 tmp = crc16(pbytes, nbytes, CRC16_INIT_VALUE) ^ 0xffff; \
+    (pbytes)[(nbytes) + 0] = (tmp >> 0) & 0xff;                    \
+    (pbytes)[(nbytes) + 1] = (tmp >> 8) & 0xff;                    \
+    (nbytes) += 2;                                                 \
+} while (0)
+
+#define APPEND_CRC32(pbytes, nbytes)                                   \
+do {                                                                   \
+    uint32 tmp = crc32(pbytes, nbytes, CRC32_INIT_VALUE) ^ 0xffffffff; \
+    (pbytes)[(nbytes) + 0] = (tmp >>  0) & 0xff;                       \
+    (pbytes)[(nbytes) + 1] = (tmp >>  8) & 0xff;                       \
+    (pbytes)[(nbytes) + 2] = (tmp >> 16) & 0xff;                       \
+    (pbytes)[(nbytes) + 3] = (tmp >> 24) & 0xff;                       \
+    (nbytes) += 4;                                                     \
+} while (0)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _RTS_CRC_H_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/s5.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/s5.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/s5.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/s5.h	2005-08-28 11:12:20.451855960 +0200
@@ -0,0 +1,103 @@
+#ifndef _S5_H_
+#define _S5_H_
+/*
+ *   Copyright 2003, Broadcom Corporation
+ *   All Rights Reserved.
+ * 
+ *   Broadcom Sentry5 (S5) BCM5365, 53xx, BCM58xx SOC Internal Core
+ *   and MIPS3301 (R4K) System Address Space
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License as
+ *   published by the Free Software Foundation, located in the file
+ *   LICENSE.
+ *
+ *   $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ * 
+ */
+
+/* BCM5365 Address map */
+#define KSEG1ADDR(x)    ( (x) | 0xa0000000)
+#define BCM5365_SDRAM		0x00000000 /* 0-128MB Physical SDRAM */
+#define BCM5365_PCI_MEM		0x08000000 /* Host Mode PCI mem space (64MB) */
+#define BCM5365_PCI_CFG		0x0c000000 /* Host Mode PCI cfg space (64MB) */
+#define BCM5365_PCI_DMA		0x40000000 /* Client Mode PCI mem space (1GB)*/
+#define	BCM5365_SDRAM_SWAPPED	0x10000000 /* Byteswapped Physical SDRAM */
+#define BCM5365_ENUM		0x18000000 /* Beginning of core enum space */
+
+/* BCM5365 Core register space */
+#define BCM5365_REG_CHIPC	0x18000000 /* Chipcommon  registers */
+#define BCM5365_REG_EMAC0	0x18001000 /* Ethernet MAC0 core registers */
+#define BCM5365_REG_IPSEC	0x18002000 /* BCM582x CryptoCore registers */
+#define BCM5365_REG_USB		0x18003000 /* USB core registers */
+#define BCM5365_REG_PCI		0x18004000 /* PCI core registers */
+#define BCM5365_REG_MIPS33	0x18005000 /* MIPS core registers */
+#define BCM5365_REG_MEMC	0x18006000 /* MEMC core registers */
+#define BCM5365_REG_UARTS       (BCM5365_REG_CHIPC + 0x300) /* UART regs */
+#define	BCM5365_EJTAG		0xff200000 /* MIPS EJTAG space (2M) */
+
+/* COM Ports 1/2 */
+#define	BCM5365_UART		(BCM5365_REG_UARTS)
+#define BCM5365_UART_COM2	(BCM5365_REG_UARTS + 0x00000100)
+
+/* Registers common to MIPS33 Core used in 5365 */
+#define MIPS33_FLASH_REGION           0x1fc00000 /* Boot FLASH Region  */
+#define MIPS33_EXTIF_REGION           0x1a000000 /* Chipcommon EXTIF region*/
+#define BCM5365_EXTIF                 0x1b000000 /* MISC_CS */
+#define MIPS33_FLASH_REGION_AUX       0x1c000000 /* FLASH Region 2*/
+
+/* Internal Core Sonics Backplane Devices */
+#define INTERNAL_UART_COM1            BCM5365_UART
+#define INTERNAL_UART_COM2            BCM5365_UART_COM2
+#define SB_REG_CHIPC                  BCM5365_REG_CHIPC
+#define SB_REG_ENET0                  BCM5365_REG_EMAC0
+#define SB_REG_IPSEC                  BCM5365_REG_IPSEC
+#define SB_REG_USB                    BCM5365_REG_USB
+#define SB_REG_PCI                    BCM5365_REG_PCI
+#define SB_REG_MIPS                   BCM5365_REG_MIPS33
+#define SB_REG_MEMC                   BCM5365_REG_MEMC
+#define SB_REG_MEMC_OFF               0x6000
+#define SB_EXTIF_SPACE                MIPS33_EXTIF_REGION
+#define SB_FLASH_SPACE                MIPS33_FLASH_REGION
+
+/*
+ * XXX
+ * 5365-specific backplane interrupt flag numbers.  This should be done
+ * dynamically instead.
+ */
+#define	SBFLAG_PCI	0
+#define	SBFLAG_ENET0	1
+#define	SBFLAG_ILINE20	2
+#define	SBFLAG_CODEC	3
+#define	SBFLAG_USB	4
+#define	SBFLAG_EXTIF	5
+#define	SBFLAG_ENET1	6
+
+/* BCM95365 Local Bus devices */
+#define BCM95365K_RESET_ADDR    	 BCM5365_EXTIF
+#define BCM95365K_BOARDID_ADDR  	(BCM5365_EXTIF | 0x4000)
+#define BCM95365K_DOC_ADDR      	(BCM5365_EXTIF | 0x6000)
+#define BCM95365K_LED_ADDR      	(BCM5365_EXTIF | 0xc000)
+#define BCM95365K_TOD_REG_BASE          (BCM95365K_NVRAM_ADDR | 0x1ff0)
+#define BCM95365K_NVRAM_ADDR    	(BCM5365_EXTIF | 0xe000)
+#define BCM95365K_NVRAM_SIZE             0x1ff0 /* 8K NVRAM : DS1743/STM48txx*/
+
+/* Write to DLR2416 VFD Display character RAM */
+#define LED_REG(x)      \
+ (*(volatile unsigned char *) (KSEG1ADDR(BCM95365K_LED_ADDR) + (x)))
+
+#ifdef	CONFIG_VSIM
+#define	BCM5365_TRACE(trval)        do { *((int *)0xa0002ff8) = (trval); \
+                                       } while (0)
+#else
+#define	BCM5365_TRACE(trval)        do { *((unsigned char *)\
+                                         KSEG1ADDR(BCM5365K_LED_ADDR)) = (trval); \
+				    *((int *)0xa0002ff8) = (trval); } while (0)
+#endif
+
+/* BCM9536R Local Bus devices */
+#define BCM95365R_DOC_ADDR      	BCM5365_EXTIF
+
+
+
+#endif /*!_S5_H_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/sbchipc.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbchipc.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/sbchipc.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbchipc.h	2005-08-28 11:12:20.468853376 +0200
@@ -0,0 +1,281 @@
+/*
+ * SiliconBackplane Chipcommon core hardware definitions.
+ *
+ * The chipcommon core provides chip identification, SB control,
+ * jtag, 0/1/2 uarts, clock frequency control, a watchdog interrupt timer,
+ * gpio interface, extbus, and support for serial and parallel flashes.
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef	_SBCHIPC_H
+#define	_SBCHIPC_H
+
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define	_PADLINE(line)	pad ## line
+#define	_XSTR(line)	_PADLINE(line)
+#define	PAD		_XSTR(__LINE__)
+#endif	/* PAD */
+
+typedef volatile struct {
+	uint32	chipid;			/* 0x0 */
+	uint32	capabilities;
+	uint32	corecontrol;		/* corerev >= 1 */
+	uint32	PAD[5];
+
+	/* Interrupt control */
+	uint32	intstatus;		/* 0x20 */
+	uint32	intmask;
+	uint32	PAD[6];
+
+	/* serial flash interface registers */
+	uint32	flashcontrol;		/* 0x40 */
+	uint32	flashaddress;
+	uint32	flashdata;
+	uint32	PAD[1];
+
+	/* Silicon backplane configuration broadcast control */
+	uint32	broadcastaddress;
+	uint32	broadcastdata;
+	uint32	PAD[2];
+
+	/* gpio - cleared only by power-on-reset */
+	uint32	gpioin;			/* 0x60 */
+	uint32	gpioout;
+	uint32	gpioouten;
+	uint32	gpiocontrol;
+	uint32	gpiointpolarity;
+	uint32	gpiointmask;
+	uint32	PAD[2];
+
+	/* Watchdog timer */
+	uint32	watchdog;		/* 0x80 */
+	uint32	PAD[3];
+
+	/* clock control */
+	uint32	clockcontrol_n;		/* 0x90 */
+	uint32	clockcontrol_sb;	/* aka m0 */
+	uint32	clockcontrol_pci;	/* aka m1 */
+	uint32	clockcontrol_m2;	/* mii/uart/mipsref */
+	uint32	clockcontrol_mips;	/* aka m3 */
+	uint32	uart_clkdiv;		/* corerev >= 3 */
+	uint32	PAD[2];
+
+	/* pll delay registers (corerev >= 4) */
+	uint32	pll_on_delay;		/* 0xb0 */
+	uint32	fref_sel_delay;
+	uint32	slow_clk_ctl;
+	uint32	PAD[17];
+
+	/* ExtBus control registers (corerev >= 3) */
+	uint32	cs01config;		/* 0x100 */
+	uint32	cs01memwaitcnt;
+	uint32	cs01attrwaitcnt;
+	uint32	cs01iowaitcnt;
+	uint32	cs23config;
+	uint32	cs23memwaitcnt;
+	uint32	cs23attrwaitcnt;
+	uint32	cs23iowaitcnt;
+	uint32	cs4config;
+	uint32	cs4waitcnt;
+	uint32	parallelflashconfig;
+	uint32	parallelflashwaitcnt;
+	uint32	PAD[116];
+
+	/* uarts */
+	uint8	uart0data;		/* 0x300 */
+	uint8	uart0imr;
+	uint8	uart0fcr;
+	uint8	uart0lcr;
+	uint8	uart0mcr;
+	uint8	uart0lsr;
+	uint8	uart0msr;
+	uint8	uart0scratch;
+	uint8	PAD[248];		/* corerev >= 1 */
+
+	uint8	uart1data;		/* 0x400 */
+	uint8	uart1imr;
+	uint8	uart1fcr;
+	uint8	uart1lcr;
+	uint8	uart1mcr;
+	uint8	uart1lsr;
+	uint8	uart1msr;
+	uint8	uart1scratch;
+} chipcregs_t;
+
+/* chipid */
+#define	CID_ID_MASK		0x0000ffff		/* Chip Id mask */
+#define	CID_REV_MASK		0x000f0000		/* Chip Revision mask */
+#define	CID_REV_SHIFT		16			/* Chip Revision shift */
+#define	CID_PKG_MASK		0x00f00000		/* Package Option mask */
+#define	CID_PKG_SHIFT		20			/* Package Option shift */
+#define	CID_CC_MASK		0x0f000000		/* CoreCount (corerev >= 4) */
+#define CID_CC_SHIFT		24
+
+/* capabilities */
+#define	CAP_UARTS_MASK		0x00000003		/* Number of uarts */
+#define CAP_MIPSEB		0x00000004		/* MIPS is in big-endian mode */
+#define CAP_UCLKSEL		0x00000018		/* UARTs clock select */
+#define CAP_UINTCLK		0x00000008		/* UARTs are driven by internal divided clock */
+#define CAP_UARTGPIO		0x00000020		/* UARTs own Gpio's 15:12 */
+#define CAP_EXTBUS		0x00000040		/* External bus present */
+#define	CAP_FLASH_MASK		0x00000700		/* Type of flash */
+#define	CAP_PLL_MASK		0x00038000		/* Type of PLL */
+#define CAP_PWR_CTL		0x00040000		/* Power control */
+
+/* PLL type */
+#define PLL_NONE		0x00000000
+#define PLL_TYPE1		0x00010000		/* 48Mhz base, 3 dividers */
+#define PLL_TYPE2		0x00020000		/* 48Mhz, 4 dividers */
+#define PLL_TYPE3		0x00030000		/* 25Mhz, 2 dividers */
+#define PLL_TYPE4		0x00008000		/* 48Mhz, 4 dividers */
+
+/* corecontrol */
+#define CC_UARTCLKO		0x00000001		/* Drive UART with internal clock */
+#define	CC_SE			0x00000002		/* sync clk out enable (corerev >= 3) */
+
+/* intstatus/intmask */
+#define	CI_EI			0x00000002		/* ro: ext intr pin (corerev >= 3) */
+
+/* slow_clk_ctl */
+#define SCC_SS_MASK		0x00000007		/* slow clock source mask */
+#define	SCC_SS_LPO		0x00000000		/* source of slow clock is LPO */
+#define	SCC_SS_XTAL		0x00000001		/* source of slow clock is crystal */
+#define	SCC_SS_PCI		0x00000002		/* source of slow clock is PCI */
+#define SCC_LF			0x00000200		/* LPOFreqSel, 1: 160Khz, 0: 32KHz */
+#define SCC_LP			0x00000400		/* LPOPowerDown, 1: LPO is disabled, 0: LPO is enabled */
+#define SCC_FS			0x00000800		/* ForceSlowClk, 1: sb/cores running on slow clock, 0: power logic control */
+#define SCC_IP			0x00001000		/* IgnorePllOffReq, 1/0: power logic ignores/honors PLL clock disable requests from core */
+#define SCC_XC			0x00002000		/* XtalControlEn, 1/0: power logic does/doesn't disable crystal when appropriate */
+#define SCC_XP			0x00004000		/* XtalPU (RO), 1/0: crystal running/disabled */
+#define SCC_CD_MASK		0xffff0000		/* ClockDivider mask, SlowClk = 1/(4+divisor) * crystal/PCI clock */
+#define SCC_CD_SHF		16			/* CLockDivider shift */
+
+/* clockcontrol_n */
+#define	CN_N1_MASK		0x3f			/* n1 control */
+#define	CN_N2_MASK		0x3f00			/* n2 control */
+#define	CN_N2_SHIFT		8
+
+/* clockcontrol_sb/pci/uart */
+#define	CC_M1_MASK		0x3f			/* m1 control */
+#define	CC_M2_MASK		0x3f00			/* m2 control */
+#define	CC_M2_SHIFT		8
+#define	CC_M3_MASK		0x3f0000		/* m3 control */
+#define	CC_M3_SHIFT		16
+#define	CC_MC_MASK		0x1f000000		/* mux control */
+#define	CC_MC_SHIFT		24
+
+/* N3M Clock control values for 125Mhz */
+#define	CC_125_N		0x0802			/* Default values for bcm4310 */
+#define	CC_125_M		0x04020009
+#define	CC_125_M25		0x11090009
+#define	CC_125_M33		0x11090005
+
+/* N3M Clock control magic field values */
+#define	CC_F6_2			0x02			/* A factor of 2 in */
+#define	CC_F6_3			0x03			/* 6-bit fields like */
+#define	CC_F6_4			0x05			/* N1, M1 or M3 */
+#define	CC_F6_5			0x09
+#define	CC_F6_6			0x11
+#define	CC_F6_7			0x21
+
+#define	CC_F5_BIAS		5			/* 5-bit fields get this added */
+
+#define	CC_MC_BYPASS		0x08
+#define	CC_MC_M1		0x04
+#define	CC_MC_M1M2		0x02
+#define	CC_MC_M1M2M3		0x01
+#define	CC_MC_M1M3		0x11
+
+/* Type 2 Clock control magic field values */
+#define	CC_T2_BIAS		2			/* n1, n2, m1 & m3 bias */
+#define	CC_T2M2_BIAS		3			/* m2 bias */
+
+#define	CC_T2MC_M1BYP		1
+#define	CC_T2MC_M2BYP		2
+#define	CC_T2MC_M3BYP		4
+
+/* Common clock base */
+#define	CC_CLOCK_BASE		24000000		/* Half the clock freq */
+
+/* Flash types in the chipcommon capabilities register */
+#define FLASH_NONE		0x000		/* No flash */
+#define SFLASH_ST		0x100		/* ST serial flash */
+#define SFLASH_AT		0x200		/* Atmel serial flash */
+#define	PFLASH			0x700		/* Parallel flash */
+
+/* Bits in the config registers */
+#define	CC_CFG_EN		0x0001		/* Enable */
+#define	CC_CFG_EM_MASK		0x000e		/* Extif Mode */
+#define	CC_CFG_EM_ASYNC		0x0002		/*   Async/Parallel flash */
+#define	CC_CFG_EM_SYNC		0x0004		/*   Synchronous */
+#define	CC_CFG_EM_PCMCIA	0x0008		/*   PCMCIA */
+#define	CC_CFG_EM_IDE		0x000a		/*   IDE */
+#define	CC_CFG_DS		0x0010		/* Data size, 0=8bit, 1=16bit */
+#define	CC_CFG_CD_MASK		0x0060		/* Sync: Clock divisor */
+#define	CC_CFG_CE		0x0080		/* Sync: Clock enable */
+#define	CC_CFG_SB		0x0100		/* Sync: Size/Bytestrobe */
+
+/* Start/busy bit in flashcontrol */
+#define SFLASH_START		0x80000000
+#define SFLASH_BUSY		SFLASH_START
+
+/* flashcontrol opcodes for ST flashes */
+#define SFLASH_ST_WREN		0x0006		/* Write Enable */
+#define SFLASH_ST_WRDIS		0x0004		/* Write Disable */
+#define SFLASH_ST_RDSR		0x0105		/* Read Status Register */
+#define SFLASH_ST_WRSR		0x0101		/* Write Status Register */
+#define SFLASH_ST_READ		0x0303		/* Read Data Bytes */
+#define SFLASH_ST_PP		0x0302		/* Page Program */
+#define SFLASH_ST_SE		0x02d8		/* Sector Erase */
+#define SFLASH_ST_BE		0x00c7		/* Bulk Erase */
+#define SFLASH_ST_DP		0x00b9		/* Deep Power-down */
+#define SFLASH_ST_RES		0x03ab		/* Read Electronic Signature */
+
+/* Status register bits for ST flashes */
+#define SFLASH_ST_WIP		0x01		/* Write In Progress */
+#define SFLASH_ST_WEL		0x02		/* Write Enable Latch */
+#define SFLASH_ST_BP_MASK	0x1c		/* Block Protect */
+#define SFLASH_ST_BP_SHIFT	2
+#define SFLASH_ST_SRWD		0x80		/* Status Register Write Disable */
+
+/* flashcontrol opcodes for Atmel flashes */
+#define SFLASH_AT_READ				0x07e8
+#define SFLASH_AT_PAGE_READ			0x07d2
+#define SFLASH_AT_BUF1_READ
+#define SFLASH_AT_BUF2_READ
+#define SFLASH_AT_STATUS			0x01d7
+#define SFLASH_AT_BUF1_WRITE			0x0384
+#define SFLASH_AT_BUF2_WRITE			0x0387
+#define SFLASH_AT_BUF1_ERASE_PROGRAM		0x0283
+#define SFLASH_AT_BUF2_ERASE_PROGRAM		0x0286
+#define SFLASH_AT_BUF1_PROGRAM			0x0288
+#define SFLASH_AT_BUF2_PROGRAM			0x0289
+#define SFLASH_AT_PAGE_ERASE			0x0281
+#define SFLASH_AT_BLOCK_ERASE			0x0250
+#define SFLASH_AT_BUF1_WRITE_ERASE_PROGRAM	0x0382
+#define SFLASH_AT_BUF2_WRITE_ERASE_PROGRAM	0x0385
+#define SFLASH_AT_BUF1_LOAD			0x0253
+#define SFLASH_AT_BUF2_LOAD			0x0255
+#define SFLASH_AT_BUF1_COMPARE			0x0260
+#define SFLASH_AT_BUF2_COMPARE			0x0261
+#define SFLASH_AT_BUF1_REPROGRAM		0x0258
+#define SFLASH_AT_BUF2_REPROGRAM		0x0259
+
+/* Status register bits for Atmel flashes */
+#define SFLASH_AT_READY				0x80
+#define SFLASH_AT_MISMATCH			0x40
+#define SFLASH_AT_ID_MASK			0x38
+#define SFLASH_AT_ID_SHIFT			3
+
+#endif	/* _SBCHIPC_H */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/sbconfig.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbconfig.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/sbconfig.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbconfig.h	2005-08-28 11:12:20.469853224 +0200
@@ -0,0 +1,296 @@
+/*
+ * Broadcom SiliconBackplane hardware register definitions.
+ *
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef	_SBCONFIG_H
+#define	_SBCONFIG_H
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define	_PADLINE(line)	pad ## line
+#define	_XSTR(line)	_PADLINE(line)
+#define	PAD		_XSTR(__LINE__)
+#endif
+
+/*
+ * SiliconBackplane Address Map.
+ * All regions may not exist on all chips.
+ */
+#define SB_SDRAM_BASE		0x00000000	/* Physical SDRAM */
+#define SB_PCI_MEM		0x08000000	/* Host Mode PCI memory access space (64 MB) */
+#define SB_PCI_CFG		0x0c000000	/* Host Mode PCI configuration space (64 MB) */
+#define	SB_SDRAM_SWAPPED	0x10000000	/* Byteswapped Physical SDRAM */
+#define SB_ENUM_BASE    	0x18000000	/* Enumeration space base */
+#define	SB_ENUM_LIM		0x18010000	/* Enumeration space limit */
+#define	SB_EXTIF_BASE		0x1f000000	/* External Interface region base address */
+#define SB_PCI_DMA		0x40000000	/* Client Mode PCI memory access space (1 GB) */
+#define	SB_EUART		(SB_EXTIF_BASE + 0x00800000)
+#define	SB_LED			(SB_EXTIF_BASE + 0x00900000)
+
+/* enumeration space related defs */
+#define SB_CORE_SIZE    	0x1000		/* each core gets 4Kbytes for registers */
+#define	SB_MAXCORES		((SB_ENUM_LIM - SB_ENUM_BASE)/SB_CORE_SIZE)
+#define	SBCONFIGOFF		0xf00		/* core sbconfig regs are top 256bytes of regs */
+#define	SBCONFIGSIZE		256		/* sizeof (sbconfig_t) */
+
+/* mips address */
+#define	SB_EJTAG		0xff200000	/* MIPS EJTAG space (2M) */
+
+/*
+ * Sonics Configuration Space Registers.
+ */
+#ifdef _LANGUAGE_ASSEMBLY
+
+#define SBIPSFLAG		0x08
+#define SBTPSFLAG		0x18
+#define	SBTMERRLOGA		0x48		/* sonics >= 2.3 */
+#define	SBTMERRLOG		0x50		/* sonics >= 2.3 */
+#define SBADMATCH3		0x60
+#define SBADMATCH2		0x68
+#define SBADMATCH1		0x70
+#define SBIMSTATE		0x90
+#define SBINTVEC		0x94
+#define SBTMSTATELOW		0x98
+#define SBTMSTATEHIGH		0x9c
+#define SBBWA0			0xa0
+#define SBIMCONFIGLOW		0xa8
+#define SBIMCONFIGHIGH		0xac
+#define SBADMATCH0		0xb0
+#define SBTMCONFIGLOW		0xb8
+#define SBTMCONFIGHIGH		0xbc
+#define SBBCONFIG		0xc0
+#define SBBSTATE		0xc8
+#define SBACTCNFG		0xd8
+#define	SBFLAGST		0xe8
+#define SBIDLOW			0xf8
+#define SBIDHIGH		0xfc
+
+
+#else
+
+typedef volatile struct _sbconfig {
+	uint32	PAD[2];
+	uint32	sbipsflag;		/* initiator port ocp slave flag */
+	uint32	PAD[3];
+	uint32	sbtpsflag;		/* target port ocp slave flag */
+	uint32	PAD[11];
+	uint32	sbtmerrloga;		/* (sonics >= 2.3) */
+	uint32	PAD;
+	uint32	sbtmerrlog;		/* (sonics >= 2.3) */
+	uint32	PAD[3];
+	uint32	sbadmatch3;		/* address match3 */
+	uint32	PAD;
+	uint32	sbadmatch2;		/* address match2 */
+	uint32	PAD;
+	uint32	sbadmatch1;		/* address match1 */
+	uint32	PAD[7];
+	uint32	sbimstate;		/* initiator agent state */
+	uint32	sbintvec;		/* interrupt mask */
+	uint32	sbtmstatelow;		/* target state */
+	uint32	sbtmstatehigh;		/* target state */
+	uint32	sbbwa0;			/* bandwidth allocation table0 */
+	uint32	PAD;
+	uint32	sbimconfiglow;		/* initiator configuration */
+	uint32	sbimconfighigh;		/* initiator configuration */
+	uint32	sbadmatch0;		/* address match0 */
+	uint32	PAD;
+	uint32	sbtmconfiglow;		/* target configuration */
+	uint32	sbtmconfighigh;		/* target configuration */
+	uint32	sbbconfig;		/* broadcast configuration */
+	uint32	PAD;
+	uint32	sbbstate;		/* broadcast state */
+	uint32	PAD[3];
+	uint32	sbactcnfg;		/* activate configuration */
+	uint32	PAD[3];
+	uint32	sbflagst;		/* current sbflags */
+	uint32	PAD[3];
+	uint32	sbidlow;		/* identification */
+	uint32	sbidhigh;		/* identification */
+} sbconfig_t;
+
+#endif /* _LANGUAGE_ASSEMBLY */
+
+/* sbipsflag */
+#define	SBIPS_INT1_MASK		0x3f		/* which sbflags get routed to mips interrupt 1 */
+#define	SBIPS_INT1_SHIFT	0
+#define	SBIPS_INT2_MASK		0x3f00		/* which sbflags get routed to mips interrupt 2 */
+#define	SBIPS_INT2_SHIFT	8
+#define	SBIPS_INT3_MASK		0x3f0000	/* which sbflags get routed to mips interrupt 3 */
+#define	SBIPS_INT3_SHIFT	16
+#define	SBIPS_INT4_MASK		0x3f000000	/* which sbflags get routed to mips interrupt 4 */
+#define	SBIPS_INT4_SHIFT	24
+
+/* sbtpsflag */
+#define	SBTPS_NUM0_MASK		0x3f		/* interrupt sbFlag # generated by this core */
+#define	SBTPS_F0EN0		0x40		/* interrupt is always sent on the backplane */
+
+/* sbtmerrlog */
+#define	SBTMEL_CM		0x00000007	/* command */
+#define	SBTMEL_CI		0x0000ff00	/* connection id */
+#define	SBTMEL_EC		0x0f000000	/* error code */
+#define	SBTMEL_ME		0x80000000	/* multiple error */
+
+/* sbimstate */
+#define	SBIM_PC			0xf		/* pipecount */
+#define	SBIM_AP_MASK		0x30		/* arbitration policy */
+#define	SBIM_AP_BOTH		0x00		/* use both timeslaces and token */
+#define	SBIM_AP_TS		0x10		/* use timesliaces only */
+#define	SBIM_AP_TK		0x20		/* use token only */
+#define	SBIM_AP_RSV		0x30		/* reserved */
+#define	SBIM_IBE		0x20000		/* inbanderror */
+#define	SBIM_TO			0x40000		/* timeout */
+#define	SBIM_BY			0x01800000	/* busy (sonics >= 2.3) */
+#define	SBIM_RJ			0x02000000	/* reject (sonics >= 2.3) */
+
+/* sbtmstatelow */
+#define	SBTML_RESET		0x1		/* reset */
+#define	SBTML_REJ		0x2		/* reject */
+#define	SBTML_CLK		0x10000		/* clock enable */
+#define	SBTML_FGC		0x20000		/* force gated clocks on */
+#define	SBTML_FL_MASK		0x3ffc0000	/* core-specific flags */
+#define	SBTML_PE		0x40000000	/* pme enable */
+#define	SBTML_BE		0x80000000	/* bist enable */
+
+/* sbtmstatehigh */
+#define	SBTMH_SERR		0x1		/* serror */
+#define	SBTMH_INT		0x2		/* interrupt */
+#define	SBTMH_BUSY		0x4		/* busy */
+#define	SBTMH_TO		0x00000020	/* timeout (sonics >= 2.3) */
+#define	SBTMH_FL_MASK		0x1fff0000	/* core-specific flags */
+#define	SBTMH_GCR		0x20000000	/* gated clock request */
+#define	SBTMH_BISTF		0x40000000	/* bist failed */
+#define	SBTMH_BISTD		0x80000000	/* bist done */
+
+/* sbbwa0 */
+#define	SBBWA_TAB0_MASK		0xffff		/* lookup table 0 */
+#define	SBBWA_TAB1_MASK		0xffff		/* lookup table 1 */
+#define	SBBWA_TAB1_SHIFT	16
+
+/* sbimconfiglow */
+#define	SBIMCL_STO_MASK		0x7		/* service timeout */
+#define	SBIMCL_RTO_MASK		0x70		/* request timeout */
+#define	SBIMCL_RTO_SHIFT	4
+#define	SBIMCL_CID_MASK		0xff0000	/* connection id */
+#define	SBIMCL_CID_SHIFT	16
+
+/* sbimconfighigh */
+#define	SBIMCH_IEM_MASK		0xc		/* inband error mode */
+#define	SBIMCH_TEM_MASK		0x30		/* timeout error mode */
+#define	SBIMCH_TEM_SHIFT	4
+#define	SBIMCH_BEM_MASK		0xc0		/* bus error mode */
+#define	SBIMCH_BEM_SHIFT	6
+
+/* sbadmatch0 */
+#define	SBAM_TYPE_MASK		0x3		/* address type */
+#define	SBAM_AD64		0x4		/* reserved */
+#define	SBAM_ADINT0_MASK	0xf8		/* type0 size */
+#define	SBAM_ADINT0_SHIFT	3
+#define	SBAM_ADINT1_MASK	0x1f8		/* type1 size */
+#define	SBAM_ADINT1_SHIFT	3
+#define	SBAM_ADINT2_MASK	0x1f8		/* type2 size */
+#define	SBAM_ADINT2_SHIFT	3
+#define	SBAM_ADEN		0x400		/* enable */
+#define	SBAM_ADNEG		0x800		/* negative decode */
+#define	SBAM_BASE0_MASK		0xffffff00	/* type0 base address */
+#define	SBAM_BASE0_SHIFT	8
+#define	SBAM_BASE1_MASK		0xfffff000	/* type1 base address for the core */
+#define	SBAM_BASE1_SHIFT	12
+#define	SBAM_BASE2_MASK		0xffff0000	/* type2 base address for the core */
+#define	SBAM_BASE2_SHIFT	16
+
+/* sbtmconfiglow */
+#define	SBTMCL_CD_MASK		0xff		/* clock divide */
+#define	SBTMCL_CO_MASK		0xf800		/* clock offset */
+#define	SBTMCL_CO_SHIFT		11
+#define	SBTMCL_IF_MASK		0xfc0000	/* interrupt flags */
+#define	SBTMCL_IF_SHIFT		18
+#define	SBTMCL_IM_MASK		0x3000000	/* interrupt mode */
+#define	SBTMCL_IM_SHIFT		24
+
+/* sbtmconfighigh */
+#define	SBTMCH_BM_MASK		0x3		/* busy mode */
+#define	SBTMCH_RM_MASK		0x3		/* retry mode */
+#define	SBTMCH_RM_SHIFT		2
+#define	SBTMCH_SM_MASK		0x30		/* stop mode */
+#define	SBTMCH_SM_SHIFT		4
+#define	SBTMCH_EM_MASK		0x300		/* sb error mode */
+#define	SBTMCH_EM_SHIFT		8
+#define	SBTMCH_IM_MASK		0xc00		/* int mode */
+#define	SBTMCH_IM_SHIFT		10
+
+/* sbbconfig */
+#define	SBBC_LAT_MASK		0x3		/* sb latency */
+#define	SBBC_MAX0_MASK		0xf0000		/* maxccntr0 */
+#define	SBBC_MAX0_SHIFT		16
+#define	SBBC_MAX1_MASK		0xf00000	/* maxccntr1 */
+#define	SBBC_MAX1_SHIFT		20
+
+/* sbbstate */
+#define	SBBS_SRD		0x1		/* st reg disable */
+#define	SBBS_HRD		0x2		/* hold reg disable */
+
+/* sbidlow */
+#define	SBIDL_CS_MASK		0x3		/* config space */
+#define	SBIDL_AR_MASK		0x38		/* # address ranges supported */
+#define	SBIDL_AR_SHIFT		3
+#define	SBIDL_SYNCH		0x40		/* sync */
+#define	SBIDL_INIT		0x80		/* initiator */
+#define	SBIDL_MINLAT_MASK	0xf00		/* minimum backplane latency */
+#define	SBIDL_MINLAT_SHIFT	8
+#define	SBIDL_MAXLAT		0xf000		/* maximum backplane latency */
+#define	SBIDL_MAXLAT_SHIFT	12
+#define	SBIDL_FIRST		0x10000		/* this initiator is first */
+#define	SBIDL_CW_MASK		0xc0000		/* cycle counter width */
+#define	SBIDL_CW_SHIFT		18
+#define	SBIDL_TP_MASK		0xf00000	/* target ports */
+#define	SBIDL_TP_SHIFT		20
+#define	SBIDL_IP_MASK		0xf000000	/* initiator ports */
+#define	SBIDL_IP_SHIFT		24
+#define	SBIDL_RV_MASK		0xf0000000	/* sonics backplane revision code */
+#define	SBIDL_RV_SHIFT		28
+
+/* sbidhigh */
+#define	SBIDH_RC_MASK		0xf		/* revision code*/
+#define	SBIDH_CC_MASK		0xfff0		/* core code */
+#define	SBIDH_CC_SHIFT		4
+#define	SBIDH_VC_MASK		0xffff0000	/* vendor code */
+#define	SBIDH_VC_SHIFT		16
+
+#define	SB_COMMIT		0xfd8		/* update buffered registers value */
+
+/* vendor codes */
+#define	SB_VEND_BCM		0x4243		/* Broadcom's SB vendor code */
+
+/* core codes */
+#define	SB_CC			0x800		/* chipcommon core */
+#define	SB_ILINE20		0x801		/* iline20 core */
+#define	SB_SDRAM		0x803		/* sdram core */
+#define	SB_PCI			0x804		/* pci core */
+#define	SB_MIPS			0x805		/* mips core */
+#define	SB_ENET			0x806		/* enet mac core */
+#define	SB_CODEC		0x807		/* v90 codec core */
+#define	SB_USB			0x808		/* usb 1.1 host/device core */
+#define	SB_ILINE100		0x80a		/* iline100 core */
+#define	SB_IPSEC		0x80b		/* ipsec core */
+#define	SB_PCMCIA		0x80d		/* pcmcia core */
+#define	SB_MEMC			0x80f		/* memc sdram core */
+#define	SB_EXTIF		0x811		/* external interface core */
+#define	SB_D11			0x812		/* 802.11 MAC core */
+#define	SB_MIPS33		0x816		/* mips3302 core */
+#define	SB_USB11H		0x817		/* usb 1.1 host core */
+#define	SB_USB11D		0x818		/* usb 1.1 device core */
+#define	SB_USB20H		0x819		/* usb 2.0 host core */
+#define	SB_USB20D		0x81A		/* usb 2.0 device core */
+#define	SB_SDIOH		0x81B		/* sdio host core */
+#define SB_ROBO                 0x81C           /* robo switch core */
+
+#endif	/* _SBCONFIG_H */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/sbextif.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbextif.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/sbextif.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbextif.h	2005-08-28 11:12:20.470853072 +0200
@@ -0,0 +1,242 @@
+/*
+ * Hardware-specific External Interface I/O core definitions
+ * for the BCM47xx family of SiliconBackplane-based chips.
+ *
+ * The External Interface core supports a total of three external chip selects
+ * supporting external interfaces. One of the external chip selects is
+ * used for Flash, one is used for PCMCIA, and the other may be
+ * programmed to support either a synchronous interface or an
+ * asynchronous interface. The asynchronous interface can be used to
+ * support external devices such as UARTs and the BCM2019 Bluetooth
+ * baseband processor.
+ * The external interface core also contains 2 on-chip 16550 UARTs, clock
+ * frequency control, a watchdog interrupt timer, and a GPIO interface.
+ *
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef	_SBEXTIF_H
+#define	_SBEXTIF_H
+
+/* external interface address space */
+#define	EXTIF_PCMCIA_MEMBASE(x)	(x)
+#define	EXTIF_PCMCIA_IOBASE(x)	((x) + 0x100000)
+#define	EXTIF_PCMCIA_CFGBASE(x)	((x) + 0x200000)
+#define	EXTIF_CFGIF_BASE(x)	((x) + 0x800000)
+#define	EXTIF_FLASH_BASE(x)	((x) + 0xc00000)
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define	_PADLINE(line)	pad ## line
+#define	_XSTR(line)	_PADLINE(line)
+#define	PAD		_XSTR(__LINE__)
+#endif	/* PAD */
+
+/*
+ * The multiple instances of output and output enable registers
+ * are present to allow driver software for multiple cores to control
+ * gpio outputs without needing to share a single register pair.
+ */
+struct gpiouser {
+	uint32	out;
+	uint32	outen;
+};
+#define	NGPIOUSER	5
+
+typedef volatile struct {
+	uint32	corecontrol;
+	uint32	extstatus;
+	uint32	PAD[2];
+
+	/* pcmcia control registers */
+	uint32	pcmcia_config;
+	uint32	pcmcia_memwait;
+	uint32	pcmcia_attrwait;
+	uint32	pcmcia_iowait;
+
+	/* programmable interface control registers */
+	uint32	prog_config;
+	uint32	prog_waitcount;
+
+	/* flash control registers */
+	uint32	flash_config;
+	uint32	flash_waitcount;
+	uint32	PAD[4];
+
+	uint32	watchdog;
+
+	/* clock control */
+	uint32	clockcontrol_n;
+	uint32	clockcontrol_sb;
+	uint32	clockcontrol_pci;
+	uint32	clockcontrol_mii;
+	uint32	PAD[3];
+
+	/* gpio */
+	uint32	gpioin;
+	struct gpiouser	gpio[NGPIOUSER];
+	uint32	PAD;
+	uint32	ejtagouten;
+	uint32	gpiointpolarity;
+	uint32	gpiointmask;
+	uint32	PAD[153];
+
+	uint8	uartdata;
+	uint8	PAD[3];
+	uint8	uartimer;
+	uint8	PAD[3];
+	uint8	uartfcr;
+	uint8	PAD[3];
+	uint8	uartlcr;
+	uint8	PAD[3];
+	uint8	uartmcr;
+	uint8	PAD[3];
+	uint8	uartlsr;
+	uint8	PAD[3];
+	uint8	uartmsr;
+	uint8	PAD[3];
+	uint8	uartscratch;
+	uint8	PAD[3];
+} extifregs_t;
+
+/* corecontrol */
+#define	CC_UE		(1 << 0)		/* uart enable */
+
+/* extstatus */
+#define	ES_EM		(1 << 0)		/* endian mode (ro) */
+#define	ES_EI		(1 << 1)		/* external interrupt pin (ro) */
+#define	ES_GI		(1 << 2)		/* gpio interrupt pin (ro) */
+
+/* gpio bit mask */
+#define GPIO_BIT0	(1 << 0)
+#define GPIO_BIT1	(1 << 1)
+#define GPIO_BIT2	(1 << 2)
+#define GPIO_BIT3	(1 << 3)
+#define GPIO_BIT4	(1 << 4)
+#define GPIO_BIT5	(1 << 5)
+#define GPIO_BIT6	(1 << 6)
+#define GPIO_BIT7	(1 << 7)
+
+
+/* pcmcia/prog/flash_config */
+#define	CF_EN		(1 << 0)		/* enable */
+#define	CF_EM_MASK	0xe			/* mode */
+#define	CF_EM_SHIFT	1
+#define	CF_EM_FLASH	0x0			/* flash/asynchronous mode */
+#define	CF_EM_SYNC	0x2			/* synchronous mode */
+#define	CF_EM_PCMCIA	0x4			/* pcmcia mode */
+#define	CF_DS		(1 << 4)		/* destsize:  0=8bit, 1=16bit */
+#define	CF_BS		(1 << 5)		/* byteswap */
+#define	CF_CD_MASK	0xc0			/* clock divider */
+#define	CF_CD_SHIFT	6
+#define	CF_CD_DIV2	0x0			/* backplane/2 */
+#define	CF_CD_DIV3	0x40			/* backplane/3 */
+#define	CF_CD_DIV4	0x80			/* backplane/4 */
+#define	CF_CE		(1 << 8)		/* clock enable */
+#define	CF_SB		(1 << 9)		/* size/bytestrobe (synch only) */
+
+/* pcmcia_memwait */
+#define	PM_W0_MASK	0x3f			/* waitcount0 */
+#define	PM_W1_MASK	0x1f00			/* waitcount1 */
+#define	PM_W1_SHIFT	8
+#define	PM_W2_MASK	0x1f0000		/* waitcount2 */
+#define	PM_W2_SHIFT	16
+#define	PM_W3_MASK	0x1f000000		/* waitcount3 */
+#define	PM_W3_SHIFT	24
+
+/* pcmcia_attrwait */
+#define	PA_W0_MASK	0x3f			/* waitcount0 */
+#define	PA_W1_MASK	0x1f00			/* waitcount1 */
+#define	PA_W1_SHIFT	8
+#define	PA_W2_MASK	0x1f0000		/* waitcount2 */
+#define	PA_W2_SHIFT	16
+#define	PA_W3_MASK	0x1f000000		/* waitcount3 */
+#define	PA_W3_SHIFT	24
+
+/* pcmcia_iowait */
+#define	PI_W0_MASK	0x3f			/* waitcount0 */
+#define	PI_W1_MASK	0x1f00			/* waitcount1 */
+#define	PI_W1_SHIFT	8
+#define	PI_W2_MASK	0x1f0000		/* waitcount2 */
+#define	PI_W2_SHIFT	16
+#define	PI_W3_MASK	0x1f000000		/* waitcount3 */
+#define	PI_W3_SHIFT	24
+
+/* prog_waitcount */
+#define	PW_W0_MASK	0x0000001f			/* waitcount0 */
+#define	PW_W1_MASK	0x00001f00			/* waitcount1 */
+#define	PW_W1_SHIFT	8
+#define	PW_W2_MASK	0x001f0000		/* waitcount2 */
+#define	PW_W2_SHIFT	16
+#define	PW_W3_MASK	0x1f000000		/* waitcount3 */
+#define	PW_W3_SHIFT	24
+
+#define PW_W0       0x0000000c
+#define PW_W1       0x00000a00
+#define PW_W2       0x00020000
+#define PW_W3       0x01000000
+
+/* flash_waitcount */
+#define	FW_W0_MASK	0x1f			/* waitcount0 */
+#define	FW_W1_MASK	0x1f00			/* waitcount1 */
+#define	FW_W1_SHIFT	8
+#define	FW_W2_MASK	0x1f0000		/* waitcount2 */
+#define	FW_W2_SHIFT	16
+#define	FW_W3_MASK	0x1f000000		/* waitcount3 */
+#define	FW_W3_SHIFT	24
+
+/* watchdog */
+#define WATCHDOG_CLOCK	48000000		/* Hz */
+
+/* clockcontrol_n */
+#define	CN_N1_MASK	0x3f			/* n1 control */
+#define	CN_N2_MASK	0x3f00			/* n2 control */
+#define	CN_N2_SHIFT	8
+
+/* clockcontrol_sb/pci/mii */
+#define	CC_M1_MASK	0x3f			/* m1 control */
+#define	CC_M2_MASK	0x3f00			/* m2 control */
+#define	CC_M2_SHIFT	8
+#define	CC_M3_MASK	0x3f0000		/* m3 control */
+#define	CC_M3_SHIFT	16
+#define	CC_MC_MASK	0x1f000000		/* mux control */
+#define	CC_MC_SHIFT	24
+
+/* Clock control default values */
+#define CC_DEF_N	0x0009			/* Default values for bcm4710 */
+#define CC_DEF_100	0x04020011
+#define CC_DEF_33	0x11030011
+#define CC_DEF_25	0x11050011
+
+/* Clock control values for 125Mhz */
+#define	CC_125_N	0x0802
+#define	CC_125_M	0x04020009
+#define	CC_125_M25	0x11090009
+#define	CC_125_M33	0x11090005
+
+/* Clock control magic field values */
+#define	CC_F6_2		0x02			/* A factor of 2 in */
+#define	CC_F6_3		0x03			/*  6-bit fields like */
+#define	CC_F6_4		0x05			/*  N1, M1 or M3 */
+#define	CC_F6_5		0x09
+#define	CC_F6_6		0x11
+#define	CC_F6_7		0x21
+
+#define	CC_F5_BIAS	5			/* 5-bit fields get this added */
+
+#define	CC_MC_BYPASS	0x08
+#define	CC_MC_M1	0x04
+#define	CC_MC_M1M2	0x02
+#define	CC_MC_M1M2M3	0x01
+#define	CC_MC_M1M3	0x11
+
+#define	CC_CLOCK_BASE	24000000	/* Half the clock freq. in the 4710 */
+
+#endif	/* _SBEXTIF_H */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/sbmemc.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbmemc.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/sbmemc.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbmemc.h	2005-08-28 11:12:20.471852920 +0200
@@ -0,0 +1,144 @@
+/*
+ * BCM47XX Sonics SiliconBackplane DDR/SDRAM controller core hardware definitions.
+ *
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef	_SBMEMC_H
+#define	_SBMEMC_H
+
+#ifdef _LANGUAGE_ASSEMBLY
+
+#define	MEMC_CONTROL		0x00
+#define	MEMC_CONFIG		0x04
+#define	MEMC_REFRESH		0x08
+#define	MEMC_BISTSTAT		0x0c
+#define	MEMC_MODEBUF		0x10
+#define	MEMC_BKCLS		0x14
+#define	MEMC_PRIORINV		0x18
+#define	MEMC_DRAMTIM		0x1c
+#define	MEMC_INTSTAT		0x20
+#define	MEMC_INTMASK		0x24
+#define	MEMC_INTINFO		0x28
+#define	MEMC_NCDLCTL		0x30
+#define	MEMC_RDNCDLCOR		0x34
+#define	MEMC_WRNCDLCOR		0x38
+#define	MEMC_MISCDLYCTL		0x3c
+#define	MEMC_DQSGATENCDL	0x40
+#define	MEMC_SPARE		0x44
+#define	MEMC_TPADDR		0x48
+#define	MEMC_TPDATA		0x4c
+#define	MEMC_BARRIER		0x50
+#define	MEMC_CORE		0x54
+
+
+#else
+
+/* Sonics side: MEMC core registers */
+typedef volatile struct sbmemcregs {
+	uint32	control;
+	uint32	config;
+	uint32	refresh;
+	uint32	biststat;
+	uint32	modebuf;
+	uint32	bkcls;
+	uint32	priorinv;
+	uint32	dramtim;
+	uint32	intstat;
+	uint32	intmask;
+	uint32	intinfo;
+	uint32	reserved1;
+	uint32	ncdlctl;
+	uint32	rdncdlcor;
+	uint32	wrncdlcor;
+	uint32	miscdlyctl;
+	uint32	dqsgatencdl;
+	uint32	spare;
+	uint32	tpaddr;
+	uint32	tpdata;
+	uint32	barrier;
+	uint32	core;
+} sbmemcregs_t;
+
+#endif
+
+/* MEMC Core Init values (OCP ID 0x80f) */
+
+/* For sdr: */
+#define MEMC_SD_CONFIG_INIT	0x00048000
+#define MEMC_SD_DRAMTIM_INIT	0x000754da
+#define MEMC_SD_RDNCDLCOR_INIT	0x00000000
+#define MEMC_SD_WRNCDLCOR_INIT	0x49351200
+#define MEMC_SD1_WRNCDLCOR_INIT	0x14500200	/* For corerev 1 (4712) */
+#define MEMC_SD_MISCDLYCTL_INIT	0x00061c1b
+#define MEMC_SD1_MISCDLYCTL_INIT 0x00021416	/* For corerev 1 (4712) */
+#define MEMC_SD_CONTROL_INIT0	0x00000002
+#define MEMC_SD_CONTROL_INIT1	0x00000008
+#define MEMC_SD_CONTROL_INIT2	0x00000004
+#define MEMC_SD_CONTROL_INIT3	0x00000010
+#define MEMC_SD_CONTROL_INIT4	0x00000001
+#define MEMC_SD_MODEBUF_INIT	0x00000000
+#define MEMC_SD_REFRESH_INIT	0x0000840f
+
+
+/* This is for SDRM8X8X4 */
+#define	MEMC_SDR_INIT		0x0008
+#define	MEMC_SDR_MODE		0x32
+#define	MEMC_SDR_NCDL		0x00020032
+#define	MEMC_SDR1_NCDL		0x0002020f	/* For corerev 1 (4712) */
+
+/* For ddr: */
+#define MEMC_CONFIG_INIT	0x00048000
+#define MEMC_DRAMTIM_INIT	0x000754d9
+#define MEMC_RDNCDLCOR_INIT	0x00000000
+#define MEMC_WRNCDLCOR_INIT	0x49351200
+#define MEMC_1_WRNCDLCOR_INIT	0x14500200
+#define MEMC_DQSGATENCDL_INIT	0x00030000
+#define MEMC_MISCDLYCTL_INIT	0x21061c1b
+#define MEMC_1_MISCDLYCTL_INIT	0x21021400
+#define MEMC_NCDLCTL_INIT	0x00002001
+#define MEMC_CONTROL_INIT0	0x00000002
+#define MEMC_CONTROL_INIT1	0x00000008
+#define MEMC_MODEBUF_INIT0	0x00004000
+#define MEMC_CONTROL_INIT2	0x00000010
+#define MEMC_MODEBUF_INIT1	0x00000100
+#define MEMC_CONTROL_INIT3	0x00000010
+#define MEMC_CONTROL_INIT4	0x00000008
+#define MEMC_REFRESH_INIT	0x0000840f
+#define MEMC_CONTROL_INIT5	0x00000004
+#define MEMC_MODEBUF_INIT2	0x00000000
+#define MEMC_CONTROL_INIT6	0x00000010
+#define MEMC_CONTROL_INIT7	0x00000001
+
+
+/* This is for DDRM16X16X2 */
+#define	MEMC_DDR_INIT		0x0009
+#define	MEMC_DDR_MODE		0x62
+#define	MEMC_DDR_NCDL		0x0005050a
+#define	MEMC_DDR1_NCDL		0x00000a0a	/* For corerev 1 (4712) */
+
+/* mask for sdr/ddr calibration registers */
+#define MEMC_RDNCDLCOR_RD_MASK	0x000000ff
+#define MEMC_WRNCDLCOR_WR_MASK	0x000000ff
+#define MEMC_DQSGATENCDL_G_MASK	0x000000ff
+
+/* masks for miscdlyctl registers */
+#define MEMC_MISC_SM_MASK	0x30000000
+#define MEMC_MISC_SM_SHIFT	28
+#define MEMC_MISC_SD_MASK	0x0f000000
+#define MEMC_MISC_SD_SHIFT	24
+
+/* hw threshhold for calculating wr/rd for sdr memc */
+#define MEMC_CD_THRESHOLD	128
+
+/* Low bit of init register says if memc is ddr or sdr */
+#define MEMC_CONFIG_DDR		0x00000001
+
+#endif	/* _SBMEMC_H */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/sbmips.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbmips.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/sbmips.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbmips.h	2005-08-28 11:12:20.471852920 +0200
@@ -0,0 +1,56 @@
+/*
+ * Broadcom SiliconBackplane MIPS definitions
+ *
+ * SB MIPS cores are custom MIPS32 processors with SiliconBackplane
+ * OCP interfaces. The CP0 processor ID is 0x00024000, where bits
+ * 23:16 mean Broadcom and bits 15:8 mean a MIPS core with an OCP
+ * interface. The core revision is stored in the SB ID register in SB
+ * configuration space.
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef	_SBMIPS_H
+#define	_SBMIPS_H
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define	_PADLINE(line)	pad ## line
+#define	_XSTR(line)	_PADLINE(line)
+#define	PAD		_XSTR(__LINE__)
+#endif	/* PAD */
+
+typedef volatile struct {
+	uint32	corecontrol;
+	uint32	PAD[2];
+	uint32	biststatus;
+	uint32	PAD[4];
+	uint32	intstatus;
+	uint32	intmask;
+	uint32	timer;
+} mipsregs_t;
+
+extern uint32 sb_flag(void *sbh);
+extern uint sb_irq(void *sbh);
+
+extern void sb_serial_init(void *sbh, void (*add)(void *regs, uint irq, uint baud_base, uint reg_shift));
+
+extern void sb_mips_init(void *sbh);
+extern uint32 sb_mips_clock(void *sbh);
+extern bool sb_mips_setclock(void *sbh, uint32 mipsclock, uint32 sbclock, uint32 pciclock);
+
+extern uint32 sb_memc_get_ncdl(void *sbh);
+
+#endif /* _LANGUAGE_ASSEMBLY */
+
+#endif	/* _SBMIPS_H */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/sbpci.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbpci.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/sbpci.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbpci.h	2005-08-28 11:12:20.471852920 +0200
@@ -0,0 +1,113 @@
+/*
+ * BCM47XX Sonics SiliconBackplane PCI core hardware definitions.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ */
+
+#ifndef	_SBPCI_H
+#define	_SBPCI_H
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define	_PADLINE(line)	pad ## line
+#define	_XSTR(line)	_PADLINE(line)
+#define	PAD		_XSTR(__LINE__)
+#endif
+
+/* Sonics side: PCI core and host control registers */
+typedef struct sbpciregs {
+	uint32 control;		/* PCI control */
+	uint32 PAD[3];
+	uint32 arbcontrol;	/* PCI arbiter control */
+	uint32 PAD[3];
+	uint32 intstatus;	/* Interrupt status */
+	uint32 intmask;		/* Interrupt mask */
+	uint32 sbtopcimailbox;	/* Sonics to PCI mailbox */
+	uint32 PAD[9];
+	uint32 bcastaddr;	/* Sonics broadcast address */
+	uint32 bcastdata;	/* Sonics broadcast data */
+	uint32 PAD[2];
+	uint32 gpioin;		/* ro: gpio input (>=rev2) */
+	uint32 gpioout;		/* rw: gpio output (>=rev2) */
+	uint32 gpioouten;	/* rw: gpio output enable (>= rev2) */
+	uint32 gpiocontrol;	/* rw: gpio control (>= rev2) */
+	uint32 PAD[36];
+	uint32 sbtopci0;	/* Sonics to PCI translation 0 */
+	uint32 sbtopci1;	/* Sonics to PCI translation 1 */
+	uint32 sbtopci2;	/* Sonics to PCI translation 2 */
+	uint32 PAD[445];
+	uint16 sprom[36];	/* SPROM shadow Area */
+	uint32 PAD[46];
+} sbpciregs_t;
+
+/* PCI control */
+#define PCI_RST_OE	0x01	/* When set, drives PCI_RESET out to pin */
+#define PCI_RST		0x02	/* Value driven out to pin */
+#define PCI_CLK_OE	0x04	/* When set, drives clock as gated by PCI_CLK out to pin */
+#define PCI_CLK		0x08	/* Gate for clock driven out to pin */	
+
+/* PCI arbiter control */
+#define PCI_INT_ARB	0x01	/* When set, use an internal arbiter */
+#define PCI_EXT_ARB	0x02	/* When set, use an external arbiter */
+#define PCI_PARKID_MASK	0x06	/* Selects which agent is parked on an idle bus */
+#define PCI_PARKID_SHIFT   1
+#define PCI_PARKID_LAST	   0	/* Last requestor */
+#define PCI_PARKID_4710	   1	/* 4710 */
+#define PCI_PARKID_EXTREQ0 2	/* External requestor 0 */
+#define PCI_PARKID_EXTREQ1 3	/* External requestor 1 */
+
+/* Interrupt status/mask */
+#define PCI_INTA	0x01	/* PCI INTA# is asserted */
+#define PCI_INTB	0x02	/* PCI INTB# is asserted */
+#define PCI_SERR	0x04	/* PCI SERR# has been asserted (write one to clear) */
+#define PCI_PERR	0x08	/* PCI PERR# has been asserted (write one to clear) */
+#define PCI_PME		0x10	/* PCI PME# is asserted */
+
+/* (General) PCI/SB mailbox interrupts, two bits per pci function */
+#define	MAILBOX_F0_0	0x100	/* function 0, int 0 */
+#define	MAILBOX_F0_1	0x200	/* function 0, int 1 */
+#define	MAILBOX_F1_0	0x400	/* function 1, int 0 */
+#define	MAILBOX_F1_1	0x800	/* function 1, int 1 */
+#define	MAILBOX_F2_0	0x1000	/* function 2, int 0 */
+#define	MAILBOX_F2_1	0x2000	/* function 2, int 1 */
+#define	MAILBOX_F3_0	0x4000	/* function 3, int 0 */
+#define	MAILBOX_F3_1	0x8000	/* function 3, int 1 */
+
+/* Sonics broadcast address */
+#define BCAST_ADDR_MASK	0xff	/* Broadcast register address */
+
+/* Sonics to PCI translation types */
+#define SBTOPCI0_MASK	0xfc000000
+#define SBTOPCI1_MASK	0xfc000000
+#define SBTOPCI2_MASK	0xc0000000
+#define SBTOPCI_MEM	0
+#define SBTOPCI_IO	1
+#define SBTOPCI_CFG0	2
+#define SBTOPCI_CFG1	3
+#define	SBTOPCI_PREF	0x4	/* prefetch enable */
+#define	SBTOPCI_BURST	0x8	/* burst enable */
+
+/* PCI side: Reserved PCI configuration registers (see pcicfg.h) */
+#define cap_list	rsvd_a[0]
+#define bar0_window	dev_dep[0x80 - 0x40]
+#define bar1_window	dev_dep[0x84 - 0x40]
+#define sprom_control	dev_dep[0x88 - 0x40]
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+extern int sbpci_read_config(void *sbh, uint bus, uint dev, uint func, uint off, void *buf, int len);
+extern int sbpci_write_config(void *sbh, uint bus, uint dev, uint func, uint off, void *buf, int len);
+extern void sbpci_ban(uint16 core);
+extern int sbpci_init(void *sbh);
+extern void sbpci_check(void *sbh);
+
+#endif /* !_LANGUAGE_ASSEMBLY */
+
+#endif	/* _SBPCI_H */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/sbpcmcia.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbpcmcia.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/sbpcmcia.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbpcmcia.h	2005-08-28 11:12:20.472852768 +0200
@@ -0,0 +1,131 @@
+/*
+ * BCM43XX Sonics SiliconBackplane PCMCIA core hardware definitions.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ */
+
+#ifndef	_SBPCMCIA_H
+#define	_SBPCMCIA_H
+
+
+/* All the addresses that are offsets in attribute space are divided
+ * by two to account for the fact that odd bytes are invalid in
+ * attribute space and our read/write routines make the space appear
+ * as if they didn't exist. Still we want to show the original numbers
+ * as documented in the hnd_pcmcia core manual.
+ */
+
+/* PCMCIA Function Configuration Registers */
+#define	PCMCIA_FCR		(0x700 / 2)
+
+#define	FCR0_OFF		0
+#define	FCR1_OFF		(0x40 / 2)
+#define	FCR2_OFF		(0x80 / 2)
+#define	FCR3_OFF		(0xc0 / 2)
+
+#define	PCMCIA_FCR0		(0x700 / 2)
+#define	PCMCIA_FCR1		(0x740 / 2)
+#define	PCMCIA_FCR2		(0x780 / 2)
+#define	PCMCIA_FCR3		(0x7c0 / 2)
+
+/* Standard PCMCIA FCR registers */
+
+#define	PCMCIA_COR		0
+
+#define	COR_RST			0x80
+#define	COR_LEV			0x40
+#define	COR_IRQEN		0x04
+#define	COR_BLREN		0x01
+#define	COR_FUNEN		0x01
+
+
+#define	PCICIA_FCSR		(2 / 2)
+#define	PCICIA_PRR		(4 / 2)
+#define	PCICIA_SCR		(6 / 2)
+#define	PCICIA_ESR		(8 / 2)
+
+
+#define PCM_MEMOFF		0x0000
+#define F0_MEMOFF		0x1000
+#define F1_MEMOFF		0x2000
+#define F2_MEMOFF		0x3000
+#define F3_MEMOFF		0x4000
+
+/* Memory base in the function fcr's */
+#define MEM_ADDR0		(0x728 / 2)
+#define MEM_ADDR1		(0x72a / 2)
+#define MEM_ADDR2		(0x72c / 2)
+
+/* PCMCIA base plus Srom access in fcr0: */
+#define PCMCIA_ADDR0		(0x072e / 2)
+#define PCMCIA_ADDR1		(0x0730 / 2)
+#define PCMCIA_ADDR2		(0x0732 / 2)
+
+#define MEM_SEG			(0x0734 / 2)
+#define SROM_CS			(0x0736 / 2)
+#define SROM_DATAL		(0x0738 / 2)
+#define SROM_DATAH		(0x073a / 2)
+#define SROM_ADDRL		(0x073c / 2)
+#define SROM_ADDRH		(0x073e / 2)
+
+/*  Values for srom_cs: */
+#define SROM_IDLE		0
+#define SROM_WRITE		1
+#define SROM_READ		2
+#define SROM_WEN		4
+#define SROM_WDS		7
+#define SROM_DONE		8
+
+/* CIS stuff */
+
+/* The CIS stops where the FCRs start */
+#define	CIS_SIZE		PCMCIA_FCR
+
+/* Standard tuples we know about */
+
+#define	CISTPL_MANFID		0x20		/* Manufacturer and device id */
+#define	CISTPL_FUNCE		0x22		/* Function extensions */
+#define	CISTPL_CFTABLE		0x1b		/* Config table entry */
+
+/* Function extensions for LANs */
+
+#define	LAN_TECH		1		/* Technology type */
+#define	LAN_SPEED		2		/* Raw bit rate */
+#define	LAN_MEDIA		3		/* Transmission media */
+#define	LAN_NID			4		/* Node identification (aka MAC addr) */
+#define	LAN_CONN		5		/* Connector standard */
+
+
+/* CFTable */
+#define CFTABLE_REGWIN_2K	0x08		/* 2k reg windows size */
+#define CFTABLE_REGWIN_4K	0x10		/* 4k reg windows size */
+#define CFTABLE_REGWIN_8K	0x20		/* 8k reg windows size */
+
+/* Vendor unique tuples are 0x80-0x8f. Within Broadcom we'll
+ * take one for HNBU, and use "extensions" (a la FUNCE) within it.
+ */
+
+#define	CISTPL_BRCM_HNBU	0x80
+
+/* Subtypes of BRCM_HNBU: */
+
+#define	HNBU_CHIPID		0x01		/* Six bytes with PCI vendor &
+						 * device id and chiprev
+						 */
+#define	HNBU_BOARDREV		0x02		/* Two bytes board revision */
+#define	HNBU_PAPARMS		0x03		/* Eleven bytes PA parameters */
+#define	HNBU_OEM		0x04		/* Eight bytes OEM data */
+#define	HNBU_CC			0x05		/* Default country code */
+#define	HNBU_AA			0x06		/* Antennas available */
+#define	HNBU_AG			0x07		/* Antenna gain */
+#define HNBU_BOARDFLAGS		0x08		/* board flags */
+#define HNBU_LED		0x09		/* LED set */
+
+#endif	/* _SBPCMCIA_H */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/sbsdram.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbsdram.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/sbsdram.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbsdram.h	2005-08-28 11:12:20.472852768 +0200
@@ -0,0 +1,75 @@
+/*
+ * BCM47XX Sonics SiliconBackplane SDRAM controller core hardware definitions.
+ *
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef	_SBSDRAM_H
+#define	_SBSDRAM_H
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+/* Sonics side: SDRAM core registers */
+typedef volatile struct sbsdramregs {
+	uint32	initcontrol;	/* Generates external SDRAM initialization sequence */
+	uint32	config;		/* Initializes external SDRAM mode register */
+	uint32	refresh;	/* Controls external SDRAM refresh rate */
+	uint32	pad1;
+	uint32	pad2;
+} sbsdramregs_t;
+
+#endif
+
+/* SDRAM initialization control (initcontrol) register bits */
+#define SDRAM_CBR	0x0001	/* Writing 1 generates refresh cycle and toggles bit */
+#define SDRAM_PRE	0x0002	/* Writing 1 generates precharge cycle and toggles bit */
+#define SDRAM_MRS	0x0004	/* Writing 1 generates mode register select cycle and toggles bit */
+#define SDRAM_EN	0x0008	/* When set, enables access to SDRAM */
+#define SDRAM_16Mb	0x0000	/* Use 16 Megabit SDRAM */
+#define SDRAM_64Mb	0x0010	/* Use 64 Megabit SDRAM */
+#define SDRAM_128Mb	0x0020	/* Use 128 Megabit SDRAM */
+#define SDRAM_RSVMb	0x0030	/* Use special SDRAM */
+#define SDRAM_RST	0x0080	/* Writing 1 causes soft reset of controller */
+#define SDRAM_SELFREF	0x0100	/* Writing 1 enables self refresh mode */
+#define SDRAM_PWRDOWN	0x0200	/* Writing 1 causes controller to power down */
+#define SDRAM_32BIT	0x0400	/* When set, indicates 32 bit SDRAM interface */
+#define SDRAM_9BITCOL	0x0800	/* When set, indicates 9 bit column */
+
+/* SDRAM configuration (config) register bits */
+#define SDRAM_BURSTFULL	0x0000	/* Use full page bursts */
+#define SDRAM_BURST8	0x0001	/* Use burst of 8 */
+#define SDRAM_BURST4	0x0002	/* Use burst of 4 */
+#define SDRAM_BURST2	0x0003	/* Use burst of 2 */
+#define SDRAM_CAS3	0x0000	/* Use CAS latency of 3 */
+#define SDRAM_CAS2	0x0004	/* Use CAS latency of 2 */
+
+/* SDRAM refresh control (refresh) register bits */
+#define SDRAM_REF(p)	(((p)&0xff) | SDRAM_REF_EN)	/* Refresh period */
+#define SDRAM_REF_EN	0x8000		/* Writing 1 enables periodic refresh */
+
+/* SDRAM Core default Init values (OCP ID 0x803) */
+#define SDRAM_INIT	MEM4MX16X2
+#define SDRAM_CONFIG    SDRAM_BURSTFULL
+#define SDRAM_REFRESH   SDRAM_REF(0x40)
+
+#define MEM1MX16	0x009	/* 2 MB */
+#define MEM1MX16X2	0x409	/* 4 MB */
+#define MEM2MX8X2	0x809	/* 4 MB */
+#define MEM2MX8X4	0xc09	/* 8 MB */
+#define MEM2MX32	0x439	/* 8 MB */
+#define MEM4MX16	0x019	/* 8 MB */
+#define MEM4MX16X2	0x419	/* 16 MB */
+#define MEM8MX8X2	0x819	/* 16 MB */
+#define MEM8MX16	0x829	/* 16 MB */
+#define MEM4MX32	0x429	/* 16 MB */
+#define MEM8MX8X4	0xc19	/* 32 MB */
+#define MEM8MX16X2	0xc29	/* 32 MB */
+
+#endif	/* _SBSDRAM_H */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/sbutils.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbutils.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/sbutils.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sbutils.h	2005-08-28 11:12:20.473852616 +0200
@@ -0,0 +1,90 @@
+/*
+ * Misc utility routines for accessing chip-specific features
+ * of Broadcom HNBU SiliconBackplane-based chips.
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef	_sbutils_h_
+#define	_sbutils_h_
+
+/* Board styles (bustype) */
+#define	BOARDSTYLE_SOC		0		/* Silicon Backplane */
+#define	BOARDSTYLE_PCI		1		/* PCI/MiniPCI board */
+#define	BOARDSTYLE_PCMCIA	2		/* PCMCIA board */
+#define	BOARDSTYLE_CARDBUS	3		/* Cardbus board */
+
+/*
+ * Many of the routines below take an 'sbh' handle as their first arg.
+ * Allocate this by calling sb_attach().  Free it by calling sb_detach().
+ * At any one time, the sbh is logically focused on one particular sb core
+ * (the "current core").
+ * Use sb_setcore() or sb_setcoreidx() to change the association to another core.
+ */
+
+/* exported externs */
+extern void *sb_attach(uint pcidev, void *osh, void *regs, uint bustype, void *sdh, char **vars, int *varsz);
+extern void *sb_kattach(void);
+extern void sb_detach(void *sbh);
+extern uint sb_chip(void *sbh);
+extern uint sb_chiprev(void *sbh);
+extern uint sb_chippkg(void *sbh);
+extern uint sb_boardvendor(void *sbh);
+extern uint sb_boardtype(void *sbh);
+extern uint sb_boardstyle(void *sbh);
+extern uint sb_bus(void *sbh);
+extern uint sb_corelist(void *sbh, uint coreid[]);
+extern uint sb_coreid(void *sbh);
+extern uint sb_coreidx(void *sbh);
+extern uint sb_coreunit(void *sbh);
+extern uint sb_corevendor(void *sbh);
+extern uint sb_corerev(void *sbh);
+extern void *sb_coreregs(void *sbh);
+extern uint32 sb_coreflags(void *sbh, uint32 mask, uint32 val);
+extern uint32 sb_coreflagshi(void *sbh, uint32 mask, uint32 val);
+extern bool sb_iscoreup(void *sbh);
+extern void *sb_setcoreidx(void *sbh, uint coreidx);
+extern void *sb_setcore(void *sbh, uint coreid, uint coreunit);
+extern void sb_commit(void *sbh);
+extern uint32 sb_base(uint32 admatch);
+extern uint32 sb_size(uint32 admatch);
+extern void sb_core_reset(void *sbh, uint32 bits);
+extern void sb_core_tofixup(void *sbh);
+extern void sb_core_disable(void *sbh, uint32 bits);
+extern uint32 sb_clock_rate(uint32 pll_type, uint32 n, uint32 m);
+extern uint32 sb_clock(void *sbh);
+extern void sb_pci_setup(void *sbh, uint32 *dmaoffset, uint coremask);
+extern void sb_pcmcia_init(void *sbh);
+extern void sb_watchdog(void *sbh, uint ticks);
+extern void *sb_gpiosetcore(void *sbh);
+extern uint32 sb_gpiocontrol(void *sbh, uint32 mask, uint32 val);
+extern uint32 sb_gpioouten(void *sbh, uint32 mask, uint32 val);
+extern uint32 sb_gpioout(void *sbh, uint32 mask, uint32 val);
+extern uint32 sb_gpioin(void *sbh);
+extern uint32 sb_gpiointpolarity(void *sbh, uint32 mask, uint32 val);
+extern uint32 sb_gpiointmask(void *sbh, uint32 mask, uint32 val);
+extern bool sb_taclear(void *sbh);
+extern void sb_pwrctl_init(void *sbh);
+extern uint16 sb_pwrctl_fast_pwrup_delay(void *sbh);
+extern bool sb_pwrctl_clk(void *sbh, uint mode);
+extern int sb_pwrctl_xtal(void *sbh, uint what, bool on);
+extern void sb_register_intr_callback(void *sbh, void *intrsoff_fn, void *intrsrestore_fn, void *intr_arg);
+
+/* pwrctl xtal what flags */
+#define	XTAL		0x1			/* primary crystal oscillator (2050) */
+#define	PLL		0x2			/* main chip pll */
+
+/* pwrctl clk mode */
+#define	CLK_FAST	0			/* force fast (pll) clock */
+#define	CLK_SLOW	1			/* force slow clock */
+#define	CLK_DYNAMIC	2			/* enable dynamic power control */
+
+#endif	/* _sbutils_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/sflash.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sflash.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/sflash.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/sflash.h	2005-08-28 11:12:20.473852616 +0200
@@ -0,0 +1,46 @@
+/*
+ * Broadcom SiliconBackplane chipcommon serial flash interface
+ *
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef _sflash_h_
+#define _sflash_h_
+
+#include <typedefs.h>
+#include <sbchipc.h>
+
+/* GPIO based bank selection (1 GPIO bit) */
+#define SFLASH_MAX_BANKS	1
+#define SFLASH_GPIO_SHIFT	2
+#define SFLASH_GPIO_MASK	((SFLASH_MAX_BANKS - 1) << SFLASH_GPIO_SHIFT)
+
+struct sflash_bank {
+	uint offset;					/* Byte offset */
+	uint erasesize;					/* Block size */
+	uint numblocks;					/* Number of blocks */
+	uint size;					/* Total bank size in bytes */
+};
+
+struct sflash {
+	struct sflash_bank banks[SFLASH_MAX_BANKS];	/* GPIO selectable banks */
+	uint32 type;					/* Type */
+	uint size;					/* Total array size in bytes */
+};
+
+/* Utility functions */
+extern int sflash_poll(chipcregs_t *cc, uint offset);
+extern int sflash_read(chipcregs_t *cc, uint offset, uint len, uchar *buf);
+extern int sflash_write(chipcregs_t *cc, uint offset, uint len, const uchar *buf);
+extern int sflash_erase(chipcregs_t *cc, uint offset);
+extern struct sflash * sflash_init(chipcregs_t *cc);
+
+#endif /* _sflash_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/trxhdr.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/trxhdr.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/trxhdr.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/trxhdr.h	2005-08-28 11:12:20.474852464 +0200
@@ -0,0 +1,31 @@
+/*
+ * TRX image file header format.
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */ 
+
+#include <typedefs.h>
+
+#define TRX_MAGIC	0x30524448	/* "HDR0" */
+#define TRX_VERSION	1
+#define TRX_MAX_LEN	0x3A0000
+#define TRX_NO_HEADER	1		/* Do not write TRX header */	
+
+struct trx_header {
+	uint32 magic;		/* "HDR0" */
+	uint32 len;		/* Length of file including header */
+	uint32 crc32;		/* 32-bit CRC from flag_version to end of file */
+	uint32 flag_version;	/* 0:15 flags, 16:31 version */
+	uint32 offsets[3];	/* Offsets of partitions from start of header */
+};
+
+/* Compatibility */
+typedef struct trx_header TRXHDR, *PTRXHDR;
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/typedefs.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/typedefs.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/typedefs.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/typedefs.h	2005-08-28 11:12:20.474852464 +0200
@@ -0,0 +1,162 @@
+/*
+ * Copyright 2001-2003, Broadcom Corporation   
+ * All Rights Reserved.   
+ *    
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY   
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM   
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS   
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.   
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef _TYPEDEFS_H_
+#define _TYPEDEFS_H_
+
+/*----------------------- define TRUE, FALSE, NULL, bool ----------------*/
+#ifdef __cplusplus
+
+#ifndef FALSE
+#define FALSE	false
+#endif
+#ifndef TRUE
+#define TRUE	true
+#endif
+
+#else /* !__cplusplus */
+
+#if defined(_WIN32)
+
+typedef	unsigned char	bool;
+
+#else
+
+#if defined(MACOSX) && defined(KERNEL)
+#include <IOKit/IOTypes.h>
+#else
+typedef	int	bool;
+#endif
+
+#endif
+
+#ifndef FALSE
+#define FALSE	0
+#endif
+#ifndef TRUE
+#define TRUE	1
+
+#ifndef NULL
+#define	NULL 0
+#endif
+
+#endif
+
+#endif /* __cplusplus */
+
+#ifndef OFF
+#define	OFF	0
+#endif
+
+#ifndef ON
+#define	ON	1
+#endif
+
+/*----------------------- define uchar, ushort, uint, ulong ----------------*/
+
+typedef unsigned char uchar;
+
+#if defined(_WIN32) || defined(PMON) || defined(__MRC__) || defined(V2_HAL) || defined(_CFE_)
+
+#ifndef V2_HAL
+typedef unsigned short	ushort;
+#endif
+
+typedef unsigned int	uint;
+typedef unsigned long	ulong;
+
+#else
+
+/* pick up ushort & uint from standard types.h */
+#if defined(linux) && defined(__KERNEL__)
+#include <linux/types.h>	/* sys/types.h and linux/types.h are oil and water */
+#else
+#include <sys/types.h>	
+#if !defined(TARGETENV_sun4) && !defined(linux)
+typedef unsigned long	ulong;
+#endif /* TARGETENV_sun4 */
+#endif
+#if defined(PMON)
+typedef unsigned int	uint;
+typedef unsigned long long       uint64;
+#endif
+
+#endif /* WIN32 || PMON || .. */
+
+/*----------------------- define [u]int8/16/32/64 --------------------------*/
+
+
+#ifdef V2_HAL
+#include <bcmos.h>
+#else
+typedef signed char	int8;
+typedef signed short	int16;
+typedef signed int	int32;
+
+typedef unsigned char	uint8;
+typedef unsigned short	uint16;
+typedef unsigned int	uint32;
+#endif	/* V2_HAL */
+
+typedef float		float32;
+typedef double		float64;
+
+/*
+ * abstracted floating point type allows for compile time selection of
+ * single or double precision arithmetic.  Compiling with -DFLOAT32
+ * selects single precision; the default is double precision.
+ */
+
+#if defined(FLOAT32)
+typedef float32 float_t;
+#else /* default to double precision floating point */
+typedef float64 float_t;
+#endif /* FLOAT32 */
+
+#ifdef _MSC_VER	    /* Microsoft C */
+typedef signed __int64	int64;
+typedef unsigned __int64 uint64;
+
+#elif defined(__GNUC__) && !defined(__STRICT_ANSI__)
+/* gcc understands signed/unsigned 64 bit types, but complains in ANSI mode */
+typedef signed long long int64;
+typedef unsigned long long uint64;
+
+#elif defined(__ICL) && !defined(__STDC__)
+/* ICL accepts unsigned 64 bit type only, and complains in ANSI mode */
+typedef unsigned long long uint64;
+
+#endif /* _MSC_VER */
+
+
+/*----------------------- define PTRSZ, INLINE --------------------------*/
+
+#define	PTRSZ	sizeof (char*)
+
+#ifndef INLINE
+
+#ifdef _MSC_VER
+
+#define INLINE __inline
+
+#elif __GNUC__
+
+#define INLINE __inline__
+
+#else
+
+#define INLINE
+
+#endif /* _MSC_VER */
+
+#endif /* INLINE */
+
+#endif /* _TYPEDEFS_H_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/include/wlioctl.h linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/wlioctl.h
--- linux-2.6.12.5/arch/mips/bcm947xx/include/wlioctl.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/include/wlioctl.h	2005-08-28 11:12:20.475852312 +0200
@@ -0,0 +1,690 @@
+/*
+ * Custom OID/ioctl definitions for
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * Copyright 2001-2003, Broadcom Corporation
+ * All Rights Reserved.
+ * 
+ * THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ * KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ * SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ * $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ */
+
+#ifndef _wlioctl_h_
+#define	_wlioctl_h_
+
+#include <typedefs.h>
+#include <proto/ethernet.h>
+#include <proto/802.11.h>
+
+#if defined(__GNUC__)
+#define	PACKED	__attribute__((packed))
+#else
+#define	PACKED
+#endif
+
+/*
+ * Per-bss information structure.
+ */
+
+#define WL_NUMRATES		255	/* max # of rates in a rateset */
+
+typedef struct wl_rateset {
+	uint32	count;			/* # rates in this set */
+	uint8	rates[WL_NUMRATES];	/* rates in 500kbps units w/hi bit set if basic */
+} wl_rateset_t;
+
+#define	WL_LEGACY_BSS_INFO_VERSION	106	/* an older supported version of wl_bss_info struct */
+#define	WL_BSS_INFO_VERSION		107	/* current version of wl_bss_info struct */
+
+typedef struct wl_bss_info106 {
+	uint		version;	/* version field */
+	struct ether_addr BSSID;
+	uint8		SSID_len;
+	uint8		SSID[32];
+	uint8		Privacy;	/* 0=No WEP, 1=Use WEP */
+	int16		RSSI;		/* receive signal strength (in dBm) */
+	uint16		beacon_period;	/* units are Kusec */
+	uint16		atim_window;	/* units are Kusec */
+	uint8		channel;	/* Channel no. */
+	int8		infra;		/* 0=IBSS, 1=infrastructure, 2=unknown */
+	struct {
+		uint	count;		/* # rates in this set */
+		uint8	rates[12];	/* rates in 500kbps units w/hi bit set if basic */
+	} rateset;			/* supported rates */
+        uint8           dtim_period;    /* DTIM period */
+	int8		phy_noise;	/* noise right after tx (in dBm) */
+	uint16		capability;	/* Capability information */
+	struct dot11_bcn_prb *prb;	/* probe response frame (ioctl na) */
+	uint16		prb_len;	/* probe response frame length (ioctl na) */
+	struct {
+		uint8 supported;	/* wpa supported */
+		uint8 multicast;	/* multicast cipher */
+		uint8 ucount;		/* count of unicast ciphers */
+		uint8 unicast[4];	/* unicast ciphers */
+		uint8 acount;		/* count of auth modes */
+		uint8 auth[4];		/* Authentication modes */
+	} wpa;
+} wl_bss_info106_t;
+
+typedef struct wl_bss_info {
+	uint32		version;	/* version field */
+	uint32		length;		/* byte length of data in this record, starting at version and including IEs */
+	struct ether_addr BSSID;
+	uint16		beacon_period;	/* units are Kusec */
+	uint16		capability;	/* Capability information */
+	uint8		SSID_len;
+	uint8		SSID[32];
+	struct {
+		uint	count;		/* # rates in this set */
+		uint8	rates[16];	/* rates in 500kbps units w/hi bit set if basic */
+	} rateset;			/* supported rates */
+	uint8		channel;	/* Channel no. */
+	uint16		atim_window;	/* units are Kusec */
+        uint8           dtim_period;    /* DTIM period */
+	int16		RSSI;		/* receive signal strength (in dBm) */
+	int8		phy_noise;	/* noise (in dBm) */
+	uint32		ie_length;	/* byte length of Information Elements */
+	/* variable length Information Elements */
+} wl_bss_info_t;
+
+typedef struct wl_scan_results {
+	uint32 buflen;
+	uint32 version;
+	uint32 count;
+	wl_bss_info_t bss_info[1];
+} wl_scan_results_t;
+/* size of wl_scan_results not including variable length array */
+#define WL_SCAN_RESULTS_FIXED_SIZE 12
+
+/* uint32 list */
+typedef struct wl_uint32_list {
+	/* in - # of elements, out - # of entries */
+	uint32 count;
+	/* variable length uint32 list */
+	uint32 element[1];
+} wl_uint32_list_t;
+
+typedef struct wlc_ssid {
+	uint32		SSID_len;
+	uchar		SSID[32];
+} wlc_ssid_t;
+
+#define WLC_CNTRY_BUF_SZ        4       /* Country string is 3 bytes + NULL */
+
+typedef struct wl_channels_in_country {
+	uint32 buflen;
+	uint32 band;
+	char country_abbrev[WLC_CNTRY_BUF_SZ];
+	uint32 count;
+	uint32 channel[1];
+} wl_channels_in_country_t;
+
+typedef struct wl_country_list {
+	uint32 buflen;
+	uint32 band_set;
+	uint32 band;
+	uint32 count;
+	char country_abbrev[1];
+} wl_country_list_t;
+
+
+/*
+* Maximum # of keys that wl driver supports in S/W. Keys supported 
+* in H/W is less than or equal to WSEC_MAX_KEYS.
+*/
+#define WSEC_MAX_KEYS		54	/* Max # of keys (50 + 4 default keys) */
+#define WSEC_MAX_DEFAULT_KEYS	4	/* # of default keys */
+
+/*
+* Remove these two defines if access to crypto/tkhash.h 
+* is unconditionally permitted.
+*/
+#define TKHASH_P1_KEY_SIZE	10	/* size of TKHash Phase1 output, in bytes */
+#define TKHASH_P2_KEY_SIZE	16	/* size of TKHash Phase2 output */
+
+/* Enumerate crypto algorithms */
+#define	CRYPTO_ALGO_OFF			0
+#define	CRYPTO_ALGO_WEP1		1
+#define	CRYPTO_ALGO_TKIP		2
+#define	CRYPTO_ALGO_WEP128		3
+#define CRYPTO_ALGO_AES_CCM		4
+#define CRYPTO_ALGO_AES_OCB_MSDU	5
+#define CRYPTO_ALGO_AES_OCB_MPDU	6
+#define CRYPTO_ALGO_NALG		7
+
+/* For use with wlc_wep_key.flags */
+#define WSEC_PRIMARY_KEY	(1 << 1)	/* Indicates this key is the primary (ie tx) key */
+#define WSEC_TKIP_ERROR		(1 << 2)	/* Provoke deliberate MIC error */
+#define WSEC_REPLAY_ERROR	(1 << 3)	/* Provoke deliberate replay */
+
+#define WSEC_GEN_MIC_ERROR	0x0001
+#define WSEC_GEN_REPLAY		0x0002
+
+typedef struct tkip_info {
+	uint16		phase1[TKHASH_P1_KEY_SIZE/sizeof(uint16)];	/* tkhash phase1 result */
+	uint8		phase2[TKHASH_P2_KEY_SIZE];	/* tkhash phase2 result */
+	uint32		micl;
+	uint32		micr;
+} tkip_info_t;
+
+typedef struct wsec_iv {
+	uint32		hi;	/* upper 32 bits of IV */
+	uint16		lo;	/* lower 16 bits of IV */
+} wsec_iv_t;
+
+typedef struct wsec_key {
+	uint32		index;		/* key index */
+	uint32		len;		/* key length */
+	uint8		data[DOT11_MAX_KEY_SIZE];	/* key data */
+	tkip_info_t	tkip_tx;	/* tkip transmit state */
+	tkip_info_t	tkip_rx;	/* tkip receive state */
+	uint32		algo;		/* CRYPTO_ALGO_AES_CCM, CRYPTO_ALGO_WEP128, etc */
+	uint32		flags;		/* misc flags */
+	uint32 		algo_hw;	/* cache for hw register*/
+	uint32 		aes_mode;	/* cache for hw register*/
+	int		iv_len;		/* IV length */		
+	int		iv_initialized;	/* has IV been initialized already? */		
+	int		icv_len;	/* ICV length */
+	wsec_iv_t	rxiv;		/* Rx IV */
+	wsec_iv_t	txiv;		/* Tx IV */
+	struct ether_addr ea;		/* per station */
+} wsec_key_t;
+
+/* wireless security bitvec */
+#define WEP_ENABLED		1
+#define TKIP_ENABLED		2
+#define AES_ENABLED		4
+#define WSEC_SWFLAG		8
+
+#define WSEC_SW(wsec)		((wsec) & WSEC_SWFLAG)
+#define WSEC_HW(wsec)		(!WSEC_SW(wsec))
+#define WSEC_WEP_ENABLED(wsec)	((wsec) & WEP_ENABLED)
+#define WSEC_TKIP_ENABLED(wsec)	((wsec) & TKIP_ENABLED)
+#define WSEC_AES_ENABLED(wsec)	((wsec) & AES_ENABLED)
+#define WSEC_ENABLED(wsec)	((wsec) & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED))
+
+/* wireless authentication bit vector */
+#define WPA_ENABLED	1
+#define PSK_ENABLED	2
+
+#define WAUTH_WPA_ENABLED(wauth)	((wauth) & WPA_ENABLED)
+#define WAUTH_PSK_ENABLED(wauth)	((wauth) & PSK_ENABLED)
+#define WAUTH_ENABLED(wauth)		((wauth) & (WPA_ENABLED | PSK_ENABLED))
+
+/* group/mcast cipher */
+#define WPA_MCAST_CIPHER(wsec)	(((wsec) & TKIP_ENABLED) ? WPA_CIPHER_TKIP : \
+				((wsec) & AES_ENABLED) ? WPA_CIPHER_AES_CCM : \
+				WPA_CIPHER_NONE)
+
+typedef struct wl_led_info {
+	uint32		index;		/* led index */
+	uint32		behavior;
+	bool		activehi;
+} wl_led_info_t;
+
+/*
+ * definitions for driver messages passed from WL to NAS.
+ */
+/* Use this to recognize wpa and 802.1x driver messages. */
+static const uint8 wl_wpa_snap_template[] =
+	{ 0xaa, 0xaa, 0x03, 0x00, 0x90, 0x4c };
+
+#define WL_WPA_MSG_IFNAME_MAX	16
+
+/* WPA driver message */
+typedef struct wl_wpa_header {
+	struct ether_header eth;
+	struct dot11_llc_snap_header snap;
+	uint8 version;
+	uint8 type;
+	/* version 2 additions */
+	char ifname[WL_WPA_MSG_IFNAME_MAX];
+	/* version specific data */
+	/* uint8 data[1]; */
+} wl_wpa_header_t PACKED;
+
+#define WL_WPA_HEADER_LEN	(ETHER_HDR_LEN + DOT11_LLC_SNAP_HDR_LEN + 2 + WL_WPA_MSG_IFNAME_MAX)
+
+/* WPA driver message ethertype - private between wlc and nas */
+#define WL_WPA_ETHER_TYPE	0x9999
+
+/* WPA driver message current version */
+#define WL_WPA_MSG_VERSION	2
+
+/* Type field values for the 802.2 driver messages for WPA. */
+#define WLC_ASSOC_MSG		1
+#define WLC_DISASSOC_MSG	2
+#define WLC_PTK_MIC_MSG		3
+#define WLC_GTK_MIC_MSG		4
+
+/* 802.1x driver message */
+typedef struct wl_eapol_header {
+	struct ether_header eth;
+	struct dot11_llc_snap_header snap;
+	uint8 version;
+	uint8 reserved;
+	char ifname[WL_WPA_MSG_IFNAME_MAX];
+	/* version specific data */
+	/* uint8 802_1x_msg[1]; */
+} wl_eapol_header_t PACKED;
+
+#define WL_EAPOL_HEADER_LEN	(ETHER_HDR_LEN + DOT11_LLC_SNAP_HDR_LEN + 2 + WL_WPA_MSG_IFNAME_MAX)
+
+/* 802.1x driver message ethertype - private between wlc and nas */
+#define WL_EAPOL_ETHER_TYPE	0x999A
+
+/* 802.1x driver message current version */
+#define WL_EAPOL_MSG_VERSION	1
+
+/* srom read/write struct passed through ioctl */
+typedef struct {
+	uint   byteoff;		/* byte offset */
+	uint   nbytes;		/* number of bytes */
+	uint16 buf[1];
+} srom_rw_t;
+
+/* R_REG and W_REG struct passed through ioctl */
+typedef struct {
+	uint32	byteoff;	/* byte offset of the field in d11regs_t */
+	uint32	val;		/* read/write value of the field */
+	uint32	size;		/* sizeof the field */
+} rw_reg_t;
+
+/* Structure used by GET/SET_ATTEN ioctls */
+typedef struct {
+	uint16	auto_ctrl;	/* 1: Automatic control, 0: overriden */
+	uint16	bb;		/* Baseband attenuation */
+	uint16	radio;		/* Radio attenuation */
+	uint16	txctl1;		/* Radio TX_CTL1 value */
+} atten_t;
+
+/* Used to get specific STA parameters */ 
+typedef struct {
+	uint32	val;
+	struct ether_addr ea;
+} scb_val_t;
+
+/* callback registration data types */
+
+typedef struct _mac_event_params {
+	uint msg;
+	struct ether_addr *addr;
+	uint result;
+	uint status; 
+	uint auth_type;
+} mac_event_params_t;
+
+typedef struct _mic_error_params {
+	struct ether_addr *ea;
+	bool group;
+	bool flush_txq;
+} mic_error_params_t;
+
+typedef enum _wl_callback {
+	WL_MAC_EVENT_CALLBACK = 0,
+	WL_LINK_UP_CALLBACK,
+	WL_LINK_DOWN_CALLBACK,
+	WL_MIC_ERROR_CALLBACK,
+	WL_LAST_CALLBACK
+} wl_callback_t;
+
+typedef struct _callback {
+	void (*fn)(void *, void *);
+	void *context;
+} callback_t;
+
+typedef struct _scan_callback {
+	void (*fn)(void *);
+	void *context;
+} scan_callback_t;
+
+/* used to register an arbitrary callback via the IOCTL interface */
+typedef struct _set_callback {
+	int index;
+	callback_t callback;
+} set_callback_t;
+
+/*
+ * Country locale determines which channels are available to us.
+ */
+typedef enum _wlc_locale {
+	WLC_WW = 0,	/* Worldwide */
+	WLC_THA,	/* Thailand */
+	WLC_ISR,	/* Israel */
+	WLC_JDN,	/* Jordan */
+	WLC_PRC,	/* China */
+	WLC_JPN,	/* Japan */
+	WLC_FCC,	/* USA */
+	WLC_EUR,	/* Europe */
+	WLC_USL,	/* US Low Band only */
+	WLC_JPH,	/* Japan High Band only */
+	WLC_ALL,	/* All the channels in this band */
+	WLC_11D,	/* Represents locale recieved by 11d beacons */
+	WLC_LAST_LOCALE,
+	WLC_UNDEFINED_LOCALE = 0xf
+} wlc_locale_t;
+
+/* channel encoding */
+typedef struct channel_info {
+	int hw_channel;
+	int target_channel;
+	int scan_channel;
+} channel_info_t;
+
+/* For ioctls that take a list of MAC addresses */
+struct maclist {
+	uint count;			/* number of MAC addresses */
+	struct ether_addr ea[1];	/* variable length array of MAC addresses */
+};
+
+/* get pkt count struct passed through ioctl */
+typedef struct get_pktcnt {
+	uint rx_good_pkt;
+	uint rx_bad_pkt;
+	uint tx_good_pkt;
+	uint tx_bad_pkt;
+} get_pktcnt_t;
+
+/* Linux network driver ioctl encoding */
+typedef struct wl_ioctl {
+	int cmd;	/* common ioctl definition */
+	void *buf;	/* pointer to user buffer */
+	int len;	/* length of user buffer */
+} wl_ioctl_t;
+
+/* 
+ * Structure for passing hardware and software 
+ * revision info up from the driver. 
+ */
+typedef struct wlc_rev_info {
+	uint		vendorid;	/* PCI vendor id */
+	uint		deviceid;	/* device id of chip */
+	uint		radiorev;	/* radio revision */
+	uint		chiprev;	/* chip revision */
+	uint		corerev;	/* core revision */
+	uint		boardid;	/* board identifier (usu. PCI sub-device id) */
+	uint		boardvendor;	/* board vendor (usu. PCI sub-vendor id) */
+	uint		boardrev;	/* board revision */
+	uint		driverrev;	/* driver version */
+	uint		ucoderev;	/* microcode version */
+	uint		bus;		/* bus type */
+	uint        chipnum;    /* chip number */
+} wlc_rev_info_t;
+
+/* check this magic number */
+#define WLC_IOCTL_MAGIC		0x14e46c77
+
+/* bump this number if you change the ioctl interface */
+#define WLC_IOCTL_VERSION	1
+
+/* maximum length buffer required */
+#define WLC_IOCTL_MAXLEN	8192
+
+/* common ioctl definitions */
+#define WLC_GET_MAGIC				0
+#define WLC_GET_VERSION				1
+#define WLC_UP					2
+#define WLC_DOWN				3
+#define WLC_DUMP				6
+#define WLC_GET_MSGLEVEL			7
+#define WLC_SET_MSGLEVEL			8
+#define WLC_GET_PROMISC				9
+#define WLC_SET_PROMISC				10
+#define WLC_GET_RATE				12
+#define WLC_SET_RATE				13
+#define WLC_GET_INSTANCE			14
+#define WLC_GET_FRAG				15
+#define WLC_SET_FRAG				16
+#define WLC_GET_RTS				17
+#define WLC_SET_RTS				18
+#define WLC_GET_INFRA				19
+#define WLC_SET_INFRA				20
+#define WLC_GET_AUTH				21
+#define WLC_SET_AUTH				22
+#define WLC_GET_BSSID				23
+#define WLC_SET_BSSID				24
+#define WLC_GET_SSID				25
+#define WLC_SET_SSID				26
+#define WLC_RESTART				27
+#define WLC_GET_CHANNEL				29
+#define WLC_SET_CHANNEL				30
+#define WLC_GET_SRL				31
+#define WLC_SET_SRL				32
+#define WLC_GET_LRL				33
+#define WLC_SET_LRL				34
+#define WLC_GET_PLCPHDR				35
+#define WLC_SET_PLCPHDR				36
+#define WLC_GET_RADIO				37
+#define WLC_SET_RADIO				38
+#define WLC_GET_PHYTYPE				39
+#define WLC_GET_WEP				42
+#define WLC_SET_WEP				43
+#define WLC_GET_KEY				44
+#define WLC_SET_KEY				45
+#define WLC_SCAN				50
+#define WLC_SCAN_RESULTS			51
+#define WLC_DISASSOC				52
+#define WLC_REASSOC				53
+#define WLC_GET_ROAM_TRIGGER			54
+#define WLC_SET_ROAM_TRIGGER			55
+#define WLC_GET_TXANT				61
+#define WLC_SET_TXANT				62
+#define WLC_GET_ANTDIV				63
+#define WLC_SET_ANTDIV				64
+#define WLC_GET_TXPWR				65
+#define WLC_SET_TXPWR				66
+#define WLC_GET_CLOSED				67
+#define WLC_SET_CLOSED				68
+#define WLC_GET_MACLIST				69
+#define WLC_SET_MACLIST				70
+#define WLC_GET_RATESET				71
+#define WLC_SET_RATESET				72
+#define WLC_GET_LOCALE				73
+#define WLC_SET_LOCALE				74
+#define WLC_GET_BCNPRD				75
+#define WLC_SET_BCNPRD				76
+#define WLC_GET_DTIMPRD				77
+#define WLC_SET_DTIMPRD				78
+#define WLC_GET_SROM				79
+#define WLC_SET_SROM				80
+#define WLC_GET_WEP_RESTRICT			81
+#define WLC_SET_WEP_RESTRICT			82
+#define WLC_GET_COUNTRY				83
+#define WLC_SET_COUNTRY				84
+#define WLC_GET_REVINFO				98
+#define WLC_GET_MACMODE				105
+#define WLC_SET_MACMODE				106
+#define WLC_GET_GMODE				109
+#define WLC_SET_GMODE				110
+#define WLC_GET_CURR_RATESET			114	/* current rateset */
+#define WLC_GET_SCANSUPPRESS			115
+#define WLC_SET_SCANSUPPRESS			116
+#define WLC_GET_AP				117
+#define WLC_SET_AP				118
+#define WLC_GET_EAP_RESTRICT			119
+#define WLC_SET_EAP_RESTRICT			120
+#define WLC_GET_WDSLIST				123
+#define WLC_SET_WDSLIST				124
+#define WLC_GET_RSSI				127
+#define WLC_GET_WSEC				133
+#define WLC_SET_WSEC				134
+#define WLC_GET_BSS_INFO			136
+#define WLC_GET_LAZYWDS				138
+#define WLC_SET_LAZYWDS				139
+#define WLC_GET_BANDLIST			140
+#define WLC_GET_BAND				141
+#define WLC_SET_BAND				142
+#define WLC_GET_SHORTSLOT			144
+#define WLC_GET_SHORTSLOT_OVERRIDE		145
+#define WLC_SET_SHORTSLOT_OVERRIDE		146
+#define WLC_GET_SHORTSLOT_RESTRICT		147
+#define WLC_SET_SHORTSLOT_RESTRICT		148
+#define WLC_GET_GMODE_PROTECTION		149
+#define WLC_GET_GMODE_PROTECTION_OVERRIDE	150
+#define WLC_SET_GMODE_PROTECTION_OVERRIDE	151
+#define WLC_UPGRADE				152
+#define WLC_GET_ASSOCLIST			159
+#define WLC_GET_CLK				160
+#define WLC_SET_CLK				161
+#define WLC_GET_UP				162
+#define WLC_OUT					163
+#define WLC_GET_WPA_AUTH			164
+#define WLC_SET_WPA_AUTH			165
+#define WLC_GET_GMODE_PROTECTION_CONTROL	178
+#define WLC_SET_GMODE_PROTECTION_CONTROL	179
+#define WLC_GET_PHYLIST				180
+#define WLC_GET_GMODE_PROTECTION_CTS		198
+#define WLC_SET_GMODE_PROTECTION_CTS		199
+#define WLC_GET_PIOMODE				203
+#define WLC_SET_PIOMODE				204
+#define WLC_SET_LED				209
+#define WLC_GET_LED				210
+#define WLC_GET_CHANNEL_SEL			215
+#define WLC_START_CHANNEL_SEL			216
+#define WLC_GET_VALID_CHANNELS			217
+#define WLC_GET_FAKEFRAG			218
+#define WLC_SET_FAKEFRAG			219
+#define WLC_GET_WET				230
+#define WLC_SET_WET				231
+#define WLC_GET_KEY_PRIMARY			235
+#define WLC_SET_KEY_PRIMARY			236
+#define WLC_SCAN_WITH_CALLBACK			240
+#define WLC_SET_CS_SCAN_TIMER			248
+#define WLC_GET_CS_SCAN_TIMER			249
+#define WLC_CURRENT_PWR				256
+#define WLC_GET_CHANNELS_IN_COUNTRY		260
+#define WLC_GET_COUNTRY_LIST			261
+#define WLC_NVRAM_GET				264
+#define WLC_NVRAM_SET				265
+#define WLC_LAST				271	/* bump after adding */
+
+/*
+ * Minor kludge alert:
+ * Duplicate a few definitions that irelay requires from epiioctl.h here
+ * so caller doesn't have to include this file and epiioctl.h .
+ * If this grows any more, it would be time to move these irelay-specific
+ * definitions out of the epiioctl.h and into a separate driver common file.
+ */
+#ifndef EPICTRL_COOKIE
+#define EPICTRL_COOKIE		0xABADCEDE
+#endif
+
+/* vx wlc ioctl's offset */
+#define CMN_IOCTL_OFF 0x180
+
+/*
+ * custom OID support
+ *
+ * 0xFF - implementation specific OID
+ * 0xE4 - first byte of Broadcom PCI vendor ID
+ * 0x14 - second byte of Broadcom PCI vendor ID
+ * 0xXX - the custom OID number
+ */
+
+/* begin 0x1f values beyond the start of the ET driver range. */
+#define WL_OID_BASE		0xFFE41420
+
+/* NDIS overrides */
+#define OID_WL_GETINSTANCE	(WL_OID_BASE + WLC_GET_INSTANCE)
+
+#define WL_DECRYPT_STATUS_SUCCESS	1
+#define WL_DECRYPT_STATUS_FAILURE	2
+#define WL_DECRYPT_STATUS_UNKNOWN	3
+
+/* allows user-mode app to poll the status of USB image upgrade */
+#define WLC_UPGRADE_SUCCESS			0
+#define WLC_UPGRADE_PENDING			1
+
+/* Bit masks for radio disabled status - returned by WL_GET_RADIO */
+#define WL_RADIO_SW_DISABLE	(1<<0)
+#define WL_RADIO_HW_DISABLE	(1<<1)
+
+/* Override bit for WLC_SET_TXPWR.  if set, ignore other level limits */
+#define WL_TXPWR_OVERRIDE	(1<<31)
+
+
+/* Bus types */
+#define WL_SB_BUS	0	/* Silicon Backplane */
+#define WL_PCI_BUS	1	/* PCI target */
+#define WL_PCMCIA_BUS	2	/* PCMCIA target */
+
+/* band types */
+#define	WLC_BAND_AUTO		0	/* auto-select */
+#define	WLC_BAND_A		1	/* "a" band (5   Ghz) */
+#define	WLC_BAND_B		2	/* "b" band (2.4 Ghz) */
+
+/* MAC list modes */
+#define WLC_MACMODE_DISABLED	0	/* MAC list disabled */
+#define WLC_MACMODE_DENY	1	/* Deny specified (i.e. allow unspecified) */
+#define WLC_MACMODE_ALLOW	2	/* Allow specified (i.e. deny unspecified) */	
+
+/* 
+ *
+ */
+#define GMODE_LEGACY_B		0
+#define GMODE_AUTO		1
+#define GMODE_ONLY		2
+#define GMODE_B_DEFERRED	3
+#define GMODE_PERFORMANCE	4
+#define GMODE_LRS		5
+#define GMODE_MAX		6
+
+/* values for PLCPHdr_override */
+#define WLC_PLCP_AUTO	-1
+#define WLC_PLCP_SHORT	0
+#define WLC_PLCP_LONG	1
+
+/* values for g_protection_override */
+#define WLC_G_PROTECTION_AUTO	-1
+#define WLC_G_PROTECTION_OFF	0
+#define WLC_G_PROTECTION_ON	1
+
+/* values for g_protection_control */
+#define WLC_G_PROTECTION_CTL_OFF	0
+#define WLC_G_PROTECTION_CTL_LOCAL	1
+#define WLC_G_PROTECTION_CTL_OVERLAP	2
+
+
+
+
+
+
+/* max # of leds supported by GPIO (gpio pin# == led index#) */
+#define	WL_LED_NUMGPIO		16	/* gpio 0-15 */
+
+/* led per-pin behaviors */
+#define	WL_LED_OFF		0		/* always off */
+#define	WL_LED_ON		1		/* always on */
+#define	WL_LED_ACTIVITY		2		/* activity */
+#define	WL_LED_RADIO		3		/* radio enabled */
+#define	WL_LED_ARADIO		4		/* 5  Ghz radio enabled */
+#define	WL_LED_BRADIO		5		/* 2.4Ghz radio enabled */
+#define	WL_LED_BGMODE		6		/* on if gmode, off if bmode */
+#define	WL_LED_WI1		7		
+#define	WL_LED_WI2		8		
+#define	WL_LED_WI3		9		
+#define	WL_LED_ASSOC		10		/* associated state indicator */
+#define	WL_LED_INACTIVE		11		/* null behavior (clears default behavior) */
+#define	WL_LED_NUMBEHAVIOR	12
+
+/* led behavior numeric value format */
+#define	WL_LED_BEH_MASK		0x7f		/* behavior mask */
+#define	WL_LED_AL_MASK		0x80		/* activelow (polarity) bit */
+
+
+/* rate check */
+#define WL_RATE_OFDM(r)		(((r) & 0x7f) == 12 || ((r) & 0x7f) == 18 || \
+				 ((r) & 0x7f) == 24 || ((r) & 0x7f) == 36 || \
+				 ((r) & 0x7f) == 48 || ((r) & 0x7f) == 72 || \
+				 ((r) & 0x7f) == 96 || ((r) & 0x7f) == 108)
+
+
+#undef PACKED
+
+#endif /* _wlioctl_h_ */
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/int-handler.S linux-2.6.12.5-brcm/arch/mips/bcm947xx/int-handler.S
--- linux-2.6.12.5/arch/mips/bcm947xx/int-handler.S	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/int-handler.S	2005-08-28 16:58:08.027788792 +0200
@@ -0,0 +1,48 @@
+/*
+ *  Copyright (C) 2004 Florian Schirmer (jolt@tuxbox.org)
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
+ *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
+ *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
+ *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
+ *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *  You should have received a copy of the  GNU General Public License along
+ *  with this program; if not, write  to the Free Software Foundation, Inc.,
+ *  675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <asm/asm.h>
+#include <asm/mipsregs.h>
+#include <asm/regdef.h>
+#include <asm/stackframe.h>
+
+	.text
+	.set	noreorder
+	.set	noat
+	.align	5
+
+	NESTED(bcm47xx_irq_handler, PT_SIZE, sp)
+	SAVE_ALL
+	CLI
+
+	.set	at
+	.set    noreorder
+
+	jal	bcm47xx_irq_dispatch
+	move	a0, sp
+
+	j	ret_from_irq
+	nop
+		
+	END(bcm47xx_irq_handler)
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/irq.c linux-2.6.12.5-brcm/arch/mips/bcm947xx/irq.c
--- linux-2.6.12.5/arch/mips/bcm947xx/irq.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/irq.c	2005-08-28 16:58:26.178029536 +0200
@@ -0,0 +1,68 @@
+/*
+ *  Copyright (C) 2004 Florian Schirmer (jolt@tuxbox.org)
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
+ *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
+ *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
+ *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
+ *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *  You should have received a copy of the  GNU General Public License along
+ *  with this program; if not, write  to the Free Software Foundation, Inc.,
+ *  675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/config.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/module.h>
+#include <linux/smp.h>
+#include <linux/types.h>
+
+#include <asm/cpu.h>
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/irq_cpu.h>
+#include <asm/gdb-stub.h>
+
+extern asmlinkage void bcm47xx_irq_handler(void);
+
+void bcm47xx_irq_dispatch(struct pt_regs *regs)
+{
+	u32 cause;
+
+	cause = read_c0_cause() & read_c0_status() & CAUSEF_IP;
+
+	clear_c0_status(cause);
+
+	if (cause & CAUSEF_IP7)
+		do_IRQ(7, regs);
+	if (cause & CAUSEF_IP2)
+		do_IRQ(2, regs);
+	if (cause & CAUSEF_IP3)
+		do_IRQ(3, regs);
+	if (cause & CAUSEF_IP4)
+		do_IRQ(4, regs);
+	if (cause & CAUSEF_IP5)
+		do_IRQ(5, regs);
+	if (cause & CAUSEF_IP6)
+		do_IRQ(6, regs);
+}
+
+void __init arch_init_irq(void)
+{
+	set_except_vector(0, bcm47xx_irq_handler);
+	mips_cpu_irq_init(0);
+}
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/prom.c linux-2.6.12.5-brcm/arch/mips/bcm947xx/prom.c
--- linux-2.6.12.5/arch/mips/bcm947xx/prom.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/prom.c	2005-08-28 16:58:41.789656208 +0200
@@ -0,0 +1,59 @@
+/*
+ *  Copyright (C) 2004 Florian Schirmer (jolt@tuxbox.org)
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
+ *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
+ *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
+ *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
+ *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *  You should have received a copy of the  GNU General Public License along
+ *  with this program; if not, write  to the Free Software Foundation, Inc.,
+ *  675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/sched.h>
+#include <linux/bootmem.h>
+
+#include <asm/addrspace.h>
+#include <asm/bootinfo.h>
+#include <asm/pmon.h>
+
+const char *get_system_type(void)
+{
+	return "Broadcom BCM47xx";
+}
+
+void __init prom_init(void)
+{
+	unsigned long mem;
+
+        mips_machgroup = MACH_GROUP_BRCM;
+        mips_machtype = MACH_BCM47XX;
+
+	/* Figure out memory size by finding aliases */
+	for (mem = (1 << 20); mem < (128 << 20); mem += (1 << 20)) {
+		if (*(unsigned long *)((unsigned long)(prom_init) + mem) == 
+		    *(unsigned long *)(prom_init))
+			break;
+	}
+
+	add_memory_region(0, mem, BOOT_MEM_RAM);
+}
+
+unsigned long __init prom_free_prom_memory(void)
+{
+	return 0;
+}
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/setup.c linux-2.6.12.5-brcm/arch/mips/bcm947xx/setup.c
--- linux-2.6.12.5/arch/mips/bcm947xx/setup.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/setup.c	2005-08-28 16:57:28.317825624 +0200
@@ -0,0 +1,127 @@
+/*
+ *  Copyright (C) 2004 Florian Schirmer (jolt@tuxbox.org)
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
+ *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
+ *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
+ *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
+ *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *  You should have received a copy of the  GNU General Public License along
+ *  with this program; if not, write  to the Free Software Foundation, Inc.,
+ *  675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/tty.h>
+#include <linux/serial.h>
+#include <linux/serial_core.h>
+#include <linux/serial_reg.h>
+#include <asm/time.h>
+#include <asm/reboot.h>
+
+#include <typedefs.h>
+#include <sbutils.h>
+#include <sbmips.h>
+#include <sbpci.h>
+#include <sbconfig.h>
+#include <bcmdevs.h>
+
+#if 1
+
+#define SER_PORT1(reg)	(*((volatile unsigned char *)(0xb8000400+reg)))
+
+int putDebugChar(char c)
+{
+	while (!(SER_PORT1(UART_LSR) & UART_LSR_THRE));
+	SER_PORT1(UART_TX) = c;
+	
+	return 1;
+}
+
+char getDebugChar(void)
+{
+	while (!(SER_PORT1(UART_LSR) & 1));
+	return SER_PORT1(UART_RX);
+}
+
+
+static int ser_line = 0;
+
+static void
+serial_add(void *regs, uint irq, uint baud_base, uint reg_shift)
+{
+	struct uart_port s;
+
+	memset(&s, 0, sizeof(s));
+
+	s.line = ser_line++;
+	s.membase = regs;
+	s.irq = irq + 2;
+	s.uartclk = baud_base;
+	s.flags = ASYNC_BOOT_AUTOCONF;
+	s.iotype = SERIAL_IO_MEM;
+	s.regshift = reg_shift;
+
+	if (early_serial_setup(&s) != 0) {
+		printk(KERN_ERR "Serial setup failed!\n");
+	}
+}
+#endif
+
+extern void bcm47xx_time_init(void);
+extern void bcm47xx_timer_setup(struct irqaction *irq);
+
+void *nvram_get(char *foo)
+{
+	return NULL;
+}
+
+void *sbh;
+
+static void bcm47xx_machine_restart(char *command)
+{
+	/* Set the watchdog timer to reset immediately */
+	cli();
+	sb_watchdog(sbh, 1);
+	while (1);
+}
+
+static void bcm47xx_machine_halt(void)
+{
+	/* Disable interrupts and watchdog and spin forever */
+	cli();
+	sb_watchdog(sbh, 0);
+	while (1);
+}
+
+static int __init bcm47xx_init(void)
+{
+
+	sbh = sb_kattach();
+	sb_mips_init(sbh);
+	sbpci_init(sbh);
+	sb_serial_init(sbh, serial_add);
+
+	_machine_restart = bcm47xx_machine_restart;
+	_machine_halt = bcm47xx_machine_halt;
+	_machine_power_off = bcm47xx_machine_halt;
+	
+	board_time_init = bcm47xx_time_init;
+	board_timer_setup = bcm47xx_timer_setup;
+	
+	return 0;
+}
+
+early_initcall(bcm47xx_init);
diff -Nur linux-2.6.12.5/arch/mips/bcm947xx/time.c linux-2.6.12.5-brcm/arch/mips/bcm947xx/time.c
--- linux-2.6.12.5/arch/mips/bcm947xx/time.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/bcm947xx/time.c	2005-08-28 16:57:55.440702320 +0200
@@ -0,0 +1,59 @@
+/*
+ *  Copyright (C) 2004 Florian Schirmer (jolt@tuxbox.org)
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
+ *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
+ *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
+ *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
+ *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *  You should have received a copy of the  GNU General Public License along
+ *  with this program; if not, write  to the Free Software Foundation, Inc.,
+ *  675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/config.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/serial_reg.h>
+#include <linux/interrupt.h>
+#include <asm/addrspace.h>
+#include <asm/io.h>
+#include <asm/time.h>
+
+void __init
+bcm47xx_time_init(void)
+{
+	unsigned int hz;
+
+	/*
+	 * Use deterministic values for initial counter interrupt
+	 * so that calibrate delay avoids encountering a counter wrap.
+	 */
+	write_c0_count(0);
+	write_c0_compare(0xffff);
+
+	hz = 200 * 1000 * 1000;
+
+	/* Set MIPS counter frequency for fixed_rate_gettimeoffset() */
+	mips_hpt_frequency = hz / 2;
+
+}
+
+void __init
+bcm47xx_timer_setup(struct irqaction *irq)
+{
+	/* Enable the timer interrupt */
+	setup_irq(7, irq);
+}
diff -Nur linux-2.6.12.5/arch/mips/kernel/cpu-probe.c linux-2.6.12.5-brcm/arch/mips/kernel/cpu-probe.c
--- linux-2.6.12.5/arch/mips/kernel/cpu-probe.c	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/arch/mips/kernel/cpu-probe.c	2005-08-28 11:12:20.538842736 +0200
@@ -555,6 +555,28 @@
 	}
 }
 
+static inline void cpu_probe_broadcom(struct cpuinfo_mips *c)
+{
+	decode_config1(c);
+	switch (c->processor_id & 0xff00) {
+		case PRID_IMP_BCM3302:
+			c->cputype = CPU_BCM3302;
+			c->isa_level = MIPS_CPU_ISA_M32;
+			c->options = MIPS_CPU_TLB | MIPS_CPU_4KEX |
+					MIPS_CPU_4KTLB | MIPS_CPU_COUNTER;
+		break;
+		case PRID_IMP_BCM4710:
+			c->cputype = CPU_BCM4710;
+			c->isa_level = MIPS_CPU_ISA_M32;
+			c->options = MIPS_CPU_TLB | MIPS_CPU_4KEX |
+					MIPS_CPU_4KTLB | MIPS_CPU_COUNTER;
+		break;
+	default:
+		c->cputype = CPU_UNKNOWN;
+		break;
+	}
+}
+
 __init void cpu_probe(void)
 {
 	struct cpuinfo_mips *c = &current_cpu_data;
@@ -577,7 +599,9 @@
 	case PRID_COMP_SIBYTE:
 		cpu_probe_sibyte(c);
 		break;
-
+	case PRID_COMP_BROADCOM:
+		cpu_probe_broadcom(c);
+		break;
 	case PRID_COMP_SANDCRAFT:
 		cpu_probe_sandcraft(c);
 		break;
diff -Nur linux-2.6.12.5/arch/mips/kernel/head.S linux-2.6.12.5-brcm/arch/mips/kernel/head.S
--- linux-2.6.12.5/arch/mips/kernel/head.S	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/arch/mips/kernel/head.S	2005-08-28 11:12:20.539842584 +0200
@@ -122,6 +122,14 @@
 #endif
 	.endm
 
+#ifdef CONFIG_BCM4710
+#undef eret
+#define eret nop; nop; eret
+#endif
+
+	j	kernel_entry
+	nop
+
 	/*
 	 * Reserved space for exception handlers.
 	 * Necessary for machines which link their kernels at KSEG0.
diff -Nur linux-2.6.12.5/arch/mips/kernel/proc.c linux-2.6.12.5-brcm/arch/mips/kernel/proc.c
--- linux-2.6.12.5/arch/mips/kernel/proc.c	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/arch/mips/kernel/proc.c	2005-08-28 11:12:20.553840456 +0200
@@ -75,7 +75,9 @@
 	[CPU_VR4133]	"NEC VR4133",
 	[CPU_VR4181]	"NEC VR4181",
 	[CPU_VR4181A]	"NEC VR4181A",
-	[CPU_SR71000]	"Sandcraft SR71000"
+	[CPU_SR71000]	"Sandcraft SR71000",
+	[CPU_BCM3302]	"Broadcom BCM3302",
+	[CPU_BCM4710]	"Broadcom BCM4710"
 };
 
 
diff -Nur linux-2.6.12.5/arch/mips/mm/tlbex.c linux-2.6.12.5-brcm/arch/mips/mm/tlbex.c
--- linux-2.6.12.5/arch/mips/mm/tlbex.c	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/arch/mips/mm/tlbex.c	2005-08-28 11:12:20.587835288 +0200
@@ -851,6 +851,8 @@
 	case CPU_4KSC:
 	case CPU_20KC:
 	case CPU_25KF:
+	case CPU_BCM3302:
+	case CPU_BCM4710:
 		tlbw(p);
 		break;
 
diff -Nur linux-2.6.12.5/arch/mips/pci/Makefile linux-2.6.12.5-brcm/arch/mips/pci/Makefile
--- linux-2.6.12.5/arch/mips/pci/Makefile	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/arch/mips/pci/Makefile	2005-08-28 16:41:44.565297816 +0200
@@ -18,6 +18,7 @@
 obj-$(CONFIG_MIPS_TX3927)	+= ops-jmr3927.o
 obj-$(CONFIG_PCI_VR41XX)	+= ops-vr41xx.o pci-vr41xx.o
 obj-$(CONFIG_NEC_CMBVR4133)	+= fixup-vr4133.o
+obj-$(CONFIG_BCM947XX)		+= ops-sb.o fixup-bcm47xx.o pci-bcm47xx.o
 
 #
 # These are still pretty much in the old state, watch, go blind.
diff -Nur linux-2.6.12.5/arch/mips/pci/fixup-bcm47xx.c linux-2.6.12.5-brcm/arch/mips/pci/fixup-bcm47xx.c
--- linux-2.6.12.5/arch/mips/pci/fixup-bcm47xx.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/pci/fixup-bcm47xx.c	2005-08-28 11:12:20.611831640 +0200
@@ -0,0 +1,23 @@
+#include <linux/init.h>
+#include <linux/pci.h>
+
+/* Do platform specific device initialization at pci_enable_device() time */
+int pcibios_plat_dev_init(struct pci_dev *dev)
+{
+	return 0;
+}
+
+int __init pcibios_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
+{
+	u8 irq;
+	
+	if (dev->bus->number == 1)
+		return 2;
+
+	pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &irq);
+	return irq + 2;
+}
+
+struct pci_fixup pcibios_fixups[] __initdata = {
+	{ 0 }
+};
diff -Nur linux-2.6.12.5/arch/mips/pci/ops-sb.c linux-2.6.12.5-brcm/arch/mips/pci/ops-sb.c
--- linux-2.6.12.5/arch/mips/pci/ops-sb.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/pci/ops-sb.c	2005-08-28 11:12:20.612831488 +0200
@@ -0,0 +1,44 @@
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/types.h>
+#include <asm/pci.h>
+
+#include <typedefs.h>
+#include <sbpci.h>
+
+extern void *sbh;
+//extern spinlock_t bcm47xx_sbh_lock;
+
+static int
+sb_pci_read_config(struct pci_bus *bus, unsigned int devfn,
+		     int reg, int size, u32 *val)
+{
+	//unsigned long flags;
+	int ret;
+
+
+	//spin_lock_irqsave(&sbh_lock, flags);
+	ret = sbpci_read_config(sbh, bus->number, PCI_SLOT(devfn), PCI_FUNC(devfn), reg, val, size);
+	//spin_unlock_irqrestore(&sbh_lock, flags);
+
+	return ret ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
+}
+
+static int
+sb_pci_write_config(struct pci_bus *bus, unsigned int devfn,
+		      int reg, int size, u32 val)
+{
+//	unsigned long flags;
+	int ret;
+
+//	spin_lock_irqsave(&sbh_lock, flags);
+	ret = sbpci_write_config(sbh, bus->number, PCI_SLOT(devfn), PCI_FUNC(devfn), reg, &val, size);
+//	spin_unlock_irqrestore(&sbh_lock, flags);
+	return ret ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
+}
+
+struct pci_ops sb_pci_ops = {
+	.read = sb_pci_read_config,
+	.write = sb_pci_write_config,
+};
diff -Nur linux-2.6.12.5/arch/mips/pci/pci-bcm47xx.c linux-2.6.12.5-brcm/arch/mips/pci/pci-bcm47xx.c
--- linux-2.6.12.5/arch/mips/pci/pci-bcm47xx.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/arch/mips/pci/pci-bcm47xx.c	2005-08-28 11:12:20.612831488 +0200
@@ -0,0 +1,61 @@
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/types.h>
+
+#include <asm/cpu.h>
+#include <asm/io.h>
+
+#include <typedefs.h>
+#include <sbconfig.h>
+
+extern struct pci_ops sb_pci_ops;
+
+static struct resource sb_pci_mem_resource = {
+	.name   = "SB PCI Memory resources",
+	.start  = SB_ENUM_BASE,
+	.end    = SB_ENUM_LIM - 1,
+	.flags  = IORESOURCE_MEM,
+};
+
+static struct resource sb_pci_io_resource = {
+	.name   = "SB PCI I/O resources",
+	.start  = 0x100,
+	.end    = 0x1FF,
+	.flags  = IORESOURCE_IO,
+};
+
+static struct pci_controller bcm47xx_sb_pci_controller = {
+	.pci_ops        = &sb_pci_ops,
+	.mem_resource	= &sb_pci_mem_resource,
+	.io_resource	= &sb_pci_io_resource,
+};
+
+static struct resource ext_pci_mem_resource = {
+	.name   = "Ext PCI Memory resources",
+	.start  = SB_PCI_DMA,
+//	.end    = 0x7FFFFFFF,
+	.end    = 0x40FFFFFF,
+	.flags  = IORESOURCE_MEM,
+};
+
+static struct resource ext_pci_io_resource = {
+	.name   = "Ext PCI I/O resources",
+	.start  = 0x200,
+	.end    = 0x2FF,
+	.flags  = IORESOURCE_IO,
+};
+
+static struct pci_controller bcm47xx_ext_pci_controller = {
+	.pci_ops        = &sb_pci_ops,
+	.mem_resource	= &ext_pci_mem_resource,
+	.io_resource	= &ext_pci_io_resource,
+};
+
+static int __init bcm47xx_pci_init(void)
+{
+	register_pci_controller(&bcm47xx_sb_pci_controller);
+	register_pci_controller(&bcm47xx_ext_pci_controller);
+	return 0;
+}
+
+early_initcall(bcm47xx_pci_init);
diff -Nur linux-2.6.12.5/arch/mips/pci/pci.c linux-2.6.12.5-brcm/arch/mips/pci/pci.c
--- linux-2.6.12.5/arch/mips/pci/pci.c	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/arch/mips/pci/pci.c	2005-08-28 11:12:20.629828904 +0200
@@ -238,7 +238,8 @@
 		if (dev->resource[i].flags & IORESOURCE_IO)
 			offset = hose->io_offset;
 		else if (dev->resource[i].flags & IORESOURCE_MEM)
-			offset = hose->mem_offset;
+			offset = 0x26000000;
+		//	offset = hose->mem_offset;
 
 		dev->resource[i].start += offset;
 		dev->resource[i].end += offset;
diff -Nur linux-2.6.12.5/drivers/mtd/maps/Kconfig linux-2.6.12.5-brcm/drivers/mtd/maps/Kconfig
--- linux-2.6.12.5/drivers/mtd/maps/Kconfig	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/drivers/mtd/maps/Kconfig	2005-08-28 16:21:23.595930936 +0200
@@ -357,6 +357,12 @@
 	  Mapping for the Flaga digital module. If you don't have one, ignore
 	  this setting.
 
+config MTD_BCM47XX
+	tristate "BCM47xx flash device"
+	depends on MIPS && MTD_CFI && BCM947XX
+	help
+	  Support for the flash chips on the BCM947xx board.
+	  
 config MTD_BEECH
 	tristate "CFI Flash device mapped on IBM 405LP Beech"
 	depends on MTD_CFI && PPC32 && 40x && BEECH
diff -Nur linux-2.6.12.5/drivers/mtd/maps/Makefile linux-2.6.12.5-brcm/drivers/mtd/maps/Makefile
--- linux-2.6.12.5/drivers/mtd/maps/Makefile	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/drivers/mtd/maps/Makefile	2005-08-28 11:12:20.666823280 +0200
@@ -31,6 +31,7 @@
 obj-$(CONFIG_MTD_PCMCIA)	+= pcmciamtd.o
 obj-$(CONFIG_MTD_RPXLITE)	+= rpxlite.o
 obj-$(CONFIG_MTD_TQM8XXL)	+= tqm8xxl.o
+obj-$(CONFIG_MTD_BCM47XX)	+= bcm47xx-flash.o
 obj-$(CONFIG_MTD_SA1100)	+= sa1100-flash.o
 obj-$(CONFIG_MTD_IPAQ)		+= ipaq-flash.o
 obj-$(CONFIG_MTD_SBC_GXX)	+= sbc_gxx.o
diff -Nur linux-2.6.12.5/drivers/mtd/maps/bcm47xx-flash.c linux-2.6.12.5-brcm/drivers/mtd/maps/bcm47xx-flash.c
--- linux-2.6.12.5/drivers/mtd/maps/bcm47xx-flash.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.12.5-brcm/drivers/mtd/maps/bcm47xx-flash.c	2005-09-03 18:50:05.090478752 +0200
@@ -0,0 +1,247 @@
+/*
+ *  Copyright (C) 2004 Florian Schirmer (jolt@tuxbox.org)
+ *  Copyright (C) 2005 Waldemar Brodkorb <wbx@openwrt.org>
+ *
+ *  original functions for finding root filesystem from Mike Baker 
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
+ *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
+ *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
+ *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
+ *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *  You should have received a copy of the  GNU General Public License along
+ *  with this program; if not, write  to the Free Software Foundation, Inc.,
+ *  675 Mass Ave, Cambridge, MA 02139, USA.
+ * 
+ *  Copyright 2001-2003, Broadcom Corporation
+ *  All Rights Reserved.
+ * 
+ *  THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+ *  KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+ *  SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+ *  FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+ *
+ *  $Id: 001-bcm947xx.patch,v 1.3 2005/09/03 17:56:50 wbx Exp $
+ *
+ *  Flash mapping for BCM947XX boards
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <asm/io.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/map.h>
+#include <linux/mtd/partitions.h>
+#include <linux/config.h>
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <bcmnvram.h>
+#include <trxhdr.h>
+
+#ifdef CONFIG_MTD_PARTITIONS
+extern struct mtd_partition * init_mtd_partitions(struct mtd_info *mtd, size_t size);
+#endif
+
+#define WINDOW_ADDR 0x1c000000
+#define WINDOW_SIZE (0x400000*2)
+#define BUSWIDTH 2
+
+static struct mtd_info *bcm947xx_mtd;
+
+static void bcm947xx_map_copy_from(struct map_info *map, void *to, unsigned long from, ssize_t len)
+{
+#define MIPS_MEMCPY_ALIGN 4
+	map_word ret;
+	ssize_t transfer;
+	ssize_t done = 0;
+	if ((len >= MIPS_MEMCPY_ALIGN) && (!(from & (MIPS_MEMCPY_ALIGN - 1))) && (!(((unsigned int)to & (MIPS_MEMCPY_ALIGN - 1))))) {
+		done = len & ~(MIPS_MEMCPY_ALIGN - 1);
+		memcpy_fromio(to, map->virt + from, done);
+	}
+	while (done < len) {
+		ret = map->read(map, from + done);
+		transfer = len - done;
+		if (transfer > map->bankwidth)
+			transfer = map->bankwidth;
+		memcpy((void *)((unsigned long)to + done), &ret.x[0], transfer);
+		done += transfer;
+	}
+}
+
+static struct map_info bcm947xx_map = {
+	name: "Physically mapped flash",
+	size: WINDOW_SIZE,
+	bankwidth: BUSWIDTH,
+	phys: WINDOW_ADDR,
+};
+
+#ifdef CONFIG_MTD_PARTITIONS
+
+static struct mtd_partition bcm947xx_parts[] = {
+	{ name: "cfe",	offset: 0, size: 0, mask_flags: MTD_WRITEABLE, },
+	{ name: "linux", offset: 0, size: 0, },
+	{ name: "rootfs", offset: 0, size: 0, },
+	{ name: "nvram", offset: 0, size: 0, },
+	{ name: "OpenWrt", offset: 0, size: 0, },
+	{ name: NULL, },
+};
+
+static int __init
+find_root(struct mtd_info *mtd, size_t size, struct mtd_partition *part)
+{
+	struct trx_header *trx;
+	unsigned char buf[512];
+	int off;
+	size_t len;
+
+	trx = (struct trx_header *) buf;
+
+	printk(KERN_NOTICE 
+		"MTD erasesize: %d, Size: %d\n", 
+		mtd->erasesize, size);
+
+	for (off = (384*1024); off < size; off += mtd->erasesize) {
+		memset(buf, 0xe5, sizeof(buf));
+
+		/*
+		 * Read into buffer 
+		 */
+		if (MTD_READ(mtd, off, sizeof(buf), &len, buf) ||
+		    len != sizeof(buf))
+			continue;
+
+		/* found a TRX header */
+		if (le32_to_cpu(trx->magic) == TRX_MAGIC) {
+			printk(KERN_NOTICE "Found TRX Header!\n");
+
+			part->offset = le32_to_cpu(trx->offsets[2]) ? : 
+				le32_to_cpu(trx->offsets[1]);
+			part->size = le32_to_cpu(trx->len); 
+
+			part->size -= part->offset;
+			part->offset += off;
+
+			goto done;
+		}
+	}
+
+	printk(KERN_NOTICE
+	       "%s: Couldn't find root filesystem\n",
+	       mtd->name);
+	return -1;
+
+ done:
+		return part->size;
+}
+
+struct mtd_partition * __init
+init_mtd_partitions(struct mtd_info *mtd, size_t size)
+{
+
+	/* boot loader */
+	bcm947xx_parts[0].offset=0;
+	bcm947xx_parts[0].size=384*1024;
+
+	/* nvram */
+	bcm947xx_parts[3].offset = size - (128*1024);
+	bcm947xx_parts[3].size   = size - bcm947xx_parts[3].offset;
+
+	/* Size linux (kernel and rootfs) */
+	bcm947xx_parts[1].offset = bcm947xx_parts[0].size;
+	bcm947xx_parts[1].size   = bcm947xx_parts[3].offset - bcm947xx_parts[1].offset;
+
+	/* Find and size rootfs */
+	if (find_root(mtd,size,&bcm947xx_parts[2])==0) {
+		/* entirely jffs2 */
+		bcm947xx_parts[2].size = bcm947xx_parts[3].offset - bcm947xx_parts[2].offset; 
+		bcm947xx_parts[4].name = NULL;
+	} else {
+		/* legacy setup */
+		/* calculate leftover flash, and assign it to the jffs2 partition */
+		bcm947xx_parts[4].offset = bcm947xx_parts[2].offset + bcm947xx_parts[2].size;
+		bcm947xx_parts[4].offset = ROUNDUP(bcm947xx_parts[4].offset, mtd->erasesize);
+		bcm947xx_parts[4].size = bcm947xx_parts[3].offset - bcm947xx_parts[4].offset;
+	}
+
+	return bcm947xx_parts;
+}
+
+EXPORT_SYMBOL(init_mtd_partitions);
+#endif
+
+int __init init_bcm947xx_map(void)
+{
+	size_t size;
+	int ret = 0;
+#ifdef CONFIG_MTD_PARTITIONS
+	struct mtd_partition *parts;
+	int i;
+#endif
+
+	bcm947xx_map.virt = ioremap(WINDOW_ADDR, WINDOW_SIZE);
+
+	if (!bcm947xx_map.virt) {
+		printk("Failed to ioremap\n");
+		return -EIO;
+	}
+	simple_map_init(&bcm947xx_map);
+	
+	bcm947xx_map.copy_from = bcm947xx_map_copy_from;
+	
+	if (!(bcm947xx_mtd = do_map_probe("cfi_probe", &bcm947xx_map))) {
+		printk("Failed to do_map_probe\n");
+		iounmap((void *)bcm947xx_map.virt);
+		return -ENXIO;
+	}
+
+	bcm947xx_mtd->owner = THIS_MODULE;
+
+	size = bcm947xx_mtd->size;
+
+	printk(KERN_NOTICE "Flash device: 0x%x at 0x%x\n", bcm947xx_mtd->size, WINDOW_ADDR);
+
+#ifdef CONFIG_MTD_PARTITIONS
+	parts = init_mtd_partitions(bcm947xx_mtd, size);
+	for (i = 0; parts[i].name; i++);
+	ret = add_mtd_partitions(bcm947xx_mtd, parts, i);
+	if (ret) {
+		printk(KERN_ERR "Flash: add_mtd_partitions failed\n");
+		goto fail;
+	}
+#endif
+
+	return 0;
+
+ fail:
+	if (bcm947xx_mtd)
+		map_destroy(bcm947xx_mtd);
+	if (bcm947xx_map.map_priv_1)
+		iounmap((void *) bcm947xx_map.map_priv_1);
+	bcm947xx_map.map_priv_1 = 0;
+	return ret;
+}
+
+void __exit cleanup_bcm947xx_map(void)
+{
+#ifdef CONFIG_MTD_PARTITIONS
+	del_mtd_partitions(bcm947xx_mtd);
+#endif
+	map_destroy(bcm947xx_mtd);
+	iounmap((void *)bcm947xx_map.virt);
+}
+
+module_init(init_bcm947xx_map);
+module_exit(cleanup_bcm947xx_map);
diff -Nur linux-2.6.12.5/drivers/net/b44.c linux-2.6.12.5-brcm/drivers/net/b44.c
--- linux-2.6.12.5/drivers/net/b44.c	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/drivers/net/b44.c	2005-08-28 11:12:20.691819480 +0200
@@ -1,7 +1,8 @@
-/* b44.c: Broadcom 4400 device driver.
+/* b44.c: Broadcom 4400/47xx device driver.
  *
  * Copyright (C) 2002 David S. Miller (davem@redhat.com)
- * Fixed by Pekka Pietikainen (pp@ee.oulu.fi)
+ * Copyright (C) 2004 Pekka Pietikainen (pp@ee.oulu.fi)
+ * Copyright (C) 2004 Florian Schirmer (jolt@tuxbox.org)
  *
  * Distribute under GPL.
  */
@@ -78,7 +79,7 @@
 	DRV_MODULE_NAME ".c:v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
 
 MODULE_AUTHOR("Florian Schirmer, Pekka Pietikainen, David S. Miller");
-MODULE_DESCRIPTION("Broadcom 4400 10/100 PCI ethernet driver");
+MODULE_DESCRIPTION("Broadcom 4400/47xx 10/100 PCI ethernet driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_MODULE_VERSION);
 
@@ -93,6 +94,8 @@
 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0UL },
 	{ PCI_VENDOR_ID_BROADCOM, PCI_DEVICE_ID_BCM4401B1,
 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0UL },
+	{ PCI_VENDOR_ID_BROADCOM, PCI_DEVICE_ID_BCM4713,
+	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0UL },
 	{ }	/* terminate list with empty entry */
 };
 
@@ -106,24 +109,13 @@
 static void b44_poll_controller(struct net_device *dev);
 #endif
 
-static inline unsigned long br32(const struct b44 *bp, unsigned long reg)
-{
-	return readl(bp->regs + reg);
-}
-
-static inline void bw32(const struct b44 *bp, 
-			unsigned long reg, unsigned long val)
-{
-	writel(val, bp->regs + reg);
-}
-
 static int b44_wait_bit(struct b44 *bp, unsigned long reg,
 			u32 bit, unsigned long timeout, const int clear)
 {
 	unsigned long i;
 
 	for (i = 0; i < timeout; i++) {
-		u32 val = br32(bp, reg);
+		u32 val = br32(reg);
 
 		if (clear && !(val & bit))
 			break;
@@ -154,7 +146,7 @@
 
 static u32 ssb_get_core_rev(struct b44 *bp)
 {
-	return (br32(bp, B44_SBIDHIGH) & SBIDHIGH_RC_MASK);
+	return (br32(B44_SBIDHIGH) & SBIDHIGH_RC_MASK);
 }
 
 static u32 ssb_pci_setup(struct b44 *bp, u32 cores)
@@ -165,13 +157,13 @@
 	pci_write_config_dword(bp->pdev, SSB_BAR0_WIN, BCM4400_PCI_CORE_ADDR);
 	pci_rev = ssb_get_core_rev(bp);
 
-	val = br32(bp, B44_SBINTVEC);
+	val = br32(B44_SBINTVEC);
 	val |= cores;
-	bw32(bp, B44_SBINTVEC, val);
+	bw32(B44_SBINTVEC, val);
 
-	val = br32(bp, SSB_PCI_TRANS_2);
+	val = br32(SSB_PCI_TRANS_2);
 	val |= SSB_PCI_PREF | SSB_PCI_BURST;
-	bw32(bp, SSB_PCI_TRANS_2, val);
+	bw32(SSB_PCI_TRANS_2, val);
 
 	pci_write_config_dword(bp->pdev, SSB_BAR0_WIN, bar_orig);
 
@@ -180,18 +172,18 @@
 
 static void ssb_core_disable(struct b44 *bp)
 {
-	if (br32(bp, B44_SBTMSLOW) & SBTMSLOW_RESET)
+	if (br32(B44_SBTMSLOW) & SBTMSLOW_RESET)
 		return;
 
-	bw32(bp, B44_SBTMSLOW, (SBTMSLOW_REJECT | SBTMSLOW_CLOCK));
+	bw32(B44_SBTMSLOW, (SBTMSLOW_REJECT | SBTMSLOW_CLOCK));
 	b44_wait_bit(bp, B44_SBTMSLOW, SBTMSLOW_REJECT, 100000, 0);
 	b44_wait_bit(bp, B44_SBTMSHIGH, SBTMSHIGH_BUSY, 100000, 1);
-	bw32(bp, B44_SBTMSLOW, (SBTMSLOW_FGC | SBTMSLOW_CLOCK |
+	bw32(B44_SBTMSLOW, (SBTMSLOW_FGC | SBTMSLOW_CLOCK |
 			    SBTMSLOW_REJECT | SBTMSLOW_RESET));
-	br32(bp, B44_SBTMSLOW);
+	br32(B44_SBTMSLOW);
 	udelay(1);
-	bw32(bp, B44_SBTMSLOW, (SBTMSLOW_REJECT | SBTMSLOW_RESET));
-	br32(bp, B44_SBTMSLOW);
+	bw32(B44_SBTMSLOW, (SBTMSLOW_REJECT | SBTMSLOW_RESET));
+	br32(B44_SBTMSLOW);
 	udelay(1);
 }
 
@@ -200,58 +192,65 @@
 	u32 val;
 
 	ssb_core_disable(bp);
-	bw32(bp, B44_SBTMSLOW, (SBTMSLOW_RESET | SBTMSLOW_CLOCK | SBTMSLOW_FGC));
-	br32(bp, B44_SBTMSLOW);
+	bw32(B44_SBTMSLOW, (SBTMSLOW_RESET | SBTMSLOW_CLOCK | SBTMSLOW_FGC));
+	br32(B44_SBTMSLOW);
 	udelay(1);
 
 	/* Clear SERR if set, this is a hw bug workaround.  */
-	if (br32(bp, B44_SBTMSHIGH) & SBTMSHIGH_SERR)
-		bw32(bp, B44_SBTMSHIGH, 0);
+	if (br32(B44_SBTMSHIGH) & SBTMSHIGH_SERR)
+		bw32(B44_SBTMSHIGH, 0);
 
-	val = br32(bp, B44_SBIMSTATE);
+	val = br32(B44_SBIMSTATE);
 	if (val & (SBIMSTATE_IBE | SBIMSTATE_TO))
-		bw32(bp, B44_SBIMSTATE, val & ~(SBIMSTATE_IBE | SBIMSTATE_TO));
+		bw32(B44_SBIMSTATE, val & ~(SBIMSTATE_IBE | SBIMSTATE_TO));
 
-	bw32(bp, B44_SBTMSLOW, (SBTMSLOW_CLOCK | SBTMSLOW_FGC));
-	br32(bp, B44_SBTMSLOW);
+	bw32(B44_SBTMSLOW, (SBTMSLOW_CLOCK | SBTMSLOW_FGC));
+	br32(B44_SBTMSLOW);
 	udelay(1);
 
-	bw32(bp, B44_SBTMSLOW, (SBTMSLOW_CLOCK));
-	br32(bp, B44_SBTMSLOW);
+	bw32(B44_SBTMSLOW, (SBTMSLOW_CLOCK));
+	br32(B44_SBTMSLOW);
 	udelay(1);
 }
 
+static int b44_4713_instance;
+
 static int ssb_core_unit(struct b44 *bp)
 {
-#if 0
-	u32 val = br32(bp, B44_SBADMATCH0);
-	u32 base;
-
-	type = val & SBADMATCH0_TYPE_MASK;
-	switch (type) {
-	case 0:
-		base = val & SBADMATCH0_BS0_MASK;
-		break;
-
-	case 1:
-		base = val & SBADMATCH0_BS1_MASK;
-		break;
-
-	case 2:
-	default:
-		base = val & SBADMATCH0_BS2_MASK;
-		break;
-	};
-#endif
-	return 0;
+	if (bp->pdev->device == PCI_DEVICE_ID_BCM4713)
+		return b44_4713_instance++;
+	else
+		return 0;
 }
 
 static int ssb_is_core_up(struct b44 *bp)
 {
-	return ((br32(bp, B44_SBTMSLOW) & (SBTMSLOW_RESET | SBTMSLOW_REJECT | SBTMSLOW_CLOCK))
+	return ((br32(B44_SBTMSLOW) & (SBTMSLOW_RESET | SBTMSLOW_REJECT | SBTMSLOW_CLOCK))
 		== SBTMSLOW_CLOCK);
 }
 
+static void __b44_cam_read(struct b44 *bp, unsigned char *data, int index)
+{
+	u32 val;
+
+	bw32(B44_CAM_CTRL, (CAM_CTRL_READ |
+			    (index << CAM_CTRL_INDEX_SHIFT)));
+
+	b44_wait_bit(bp, B44_CAM_CTRL, CAM_CTRL_BUSY, 100, 1);	
+
+	val = br32(B44_CAM_DATA_LO);
+
+	data[2] = (val >> 24) & 0xFF;
+	data[3] = (val >> 16) & 0xFF;
+	data[4] = (val >> 8) & 0xFF;
+	data[5] = (val >> 0) & 0xFF;
+
+	val = br32(B44_CAM_DATA_HI);
+	
+	data[0] = (val >> 8) & 0xFF;
+	data[1] = (val >> 0) & 0xFF;
+}
+
 static void __b44_cam_write(struct b44 *bp, unsigned char *data, int index)
 {
 	u32 val;
@@ -260,19 +259,19 @@
 	val |= ((u32) data[3]) << 16;
 	val |= ((u32) data[4]) <<  8;
 	val |= ((u32) data[5]) <<  0;
-	bw32(bp, B44_CAM_DATA_LO, val);
+	bw32(B44_CAM_DATA_LO, val);
 	val = (CAM_DATA_HI_VALID | 
 	       (((u32) data[0]) << 8) |
 	       (((u32) data[1]) << 0));
-	bw32(bp, B44_CAM_DATA_HI, val);
-	bw32(bp, B44_CAM_CTRL, (CAM_CTRL_WRITE |
+	bw32(B44_CAM_DATA_HI, val);
+	bw32(B44_CAM_CTRL, (CAM_CTRL_WRITE |
 			    (index << CAM_CTRL_INDEX_SHIFT)));
 	b44_wait_bit(bp, B44_CAM_CTRL, CAM_CTRL_BUSY, 100, 1);	
 }
 
 static inline void __b44_disable_ints(struct b44 *bp)
 {
-	bw32(bp, B44_IMASK, 0);
+	bw32(B44_IMASK, 0);
 }
 
 static void b44_disable_ints(struct b44 *bp)
@@ -280,34 +279,40 @@
 	__b44_disable_ints(bp);
 
 	/* Flush posted writes. */
-	br32(bp, B44_IMASK);
+	br32(B44_IMASK);
 }
 
 static void b44_enable_ints(struct b44 *bp)
 {
-	bw32(bp, B44_IMASK, bp->imask);
+	bw32(B44_IMASK, bp->imask);
 }
 
 static int b44_readphy(struct b44 *bp, int reg, u32 *val)
 {
 	int err;
 
-	bw32(bp, B44_EMAC_ISTAT, EMAC_INT_MII);
-	bw32(bp, B44_MDIO_DATA, (MDIO_DATA_SB_START |
+	if (bp->phy_addr == B44_PHY_ADDR_NO_PHY)
+		return 0;
+
+	bw32(B44_EMAC_ISTAT, EMAC_INT_MII);
+	bw32(B44_MDIO_DATA, (MDIO_DATA_SB_START |
 			     (MDIO_OP_READ << MDIO_DATA_OP_SHIFT) |
 			     (bp->phy_addr << MDIO_DATA_PMD_SHIFT) |
 			     (reg << MDIO_DATA_RA_SHIFT) |
 			     (MDIO_TA_VALID << MDIO_DATA_TA_SHIFT)));
 	err = b44_wait_bit(bp, B44_EMAC_ISTAT, EMAC_INT_MII, 100, 0);
-	*val = br32(bp, B44_MDIO_DATA) & MDIO_DATA_DATA;
+	*val = br32(B44_MDIO_DATA) & MDIO_DATA_DATA;
 
 	return err;
 }
 
 static int b44_writephy(struct b44 *bp, int reg, u32 val)
 {
-	bw32(bp, B44_EMAC_ISTAT, EMAC_INT_MII);
-	bw32(bp, B44_MDIO_DATA, (MDIO_DATA_SB_START |
+	if (bp->phy_addr == B44_PHY_ADDR_NO_PHY)
+		return 0;
+
+	bw32(B44_EMAC_ISTAT, EMAC_INT_MII);
+	bw32(B44_MDIO_DATA, (MDIO_DATA_SB_START |
 			     (MDIO_OP_WRITE << MDIO_DATA_OP_SHIFT) |
 			     (bp->phy_addr << MDIO_DATA_PMD_SHIFT) |
 			     (reg << MDIO_DATA_RA_SHIFT) |
@@ -344,6 +349,9 @@
 	u32 val;
 	int err;
 
+	if (bp->phy_addr == B44_PHY_ADDR_NO_PHY)
+		return 0;
+
 	err = b44_writephy(bp, MII_BMCR, BMCR_RESET);
 	if (err)
 		return err;
@@ -367,20 +375,20 @@
 	bp->flags &= ~(B44_FLAG_TX_PAUSE | B44_FLAG_RX_PAUSE);
 	bp->flags |= pause_flags;
 
-	val = br32(bp, B44_RXCONFIG);
+	val = br32(B44_RXCONFIG);
 	if (pause_flags & B44_FLAG_RX_PAUSE)
 		val |= RXCONFIG_FLOW;
 	else
 		val &= ~RXCONFIG_FLOW;
-	bw32(bp, B44_RXCONFIG, val);
+	bw32(B44_RXCONFIG, val);
 
-	val = br32(bp, B44_MAC_FLOW);
+	val = br32(B44_MAC_FLOW);
 	if (pause_flags & B44_FLAG_TX_PAUSE)
 		val |= (MAC_FLOW_PAUSE_ENAB |
 			(0xc0 & MAC_FLOW_RX_HI_WATER));
 	else
 		val &= ~MAC_FLOW_PAUSE_ENAB;
-	bw32(bp, B44_MAC_FLOW, val);
+	bw32(B44_MAC_FLOW, val);
 }
 
 static void b44_set_flow_ctrl(struct b44 *bp, u32 local, u32 remote)
@@ -414,6 +422,9 @@
 	u32 val;
 	int err;
 
+	if (bp->phy_addr == B44_PHY_ADDR_NO_PHY)
+		return 0;
+
 	if ((err = b44_readphy(bp, B44_MII_ALEDCTRL, &val)) != 0)
 		goto out;
 	if ((err = b44_writephy(bp, B44_MII_ALEDCTRL,
@@ -476,11 +487,11 @@
 
 	val = &bp->hw_stats.tx_good_octets;
 	for (reg = B44_TX_GOOD_O; reg <= B44_TX_PAUSE; reg += 4UL) {
-		*val++ += br32(bp, reg);
+		*val++ += br32(reg);
 	}
 	val = &bp->hw_stats.rx_good_octets;
 	for (reg = B44_RX_GOOD_O; reg <= B44_RX_NPAUSE; reg += 4UL) {
-		*val++ += br32(bp, reg);
+		*val++ += br32(reg);
 	}
 }
 
@@ -506,6 +517,19 @@
 {
 	u32 bmsr, aux;
 
+	if (bp->phy_addr == B44_PHY_ADDR_NO_PHY) {
+		bp->flags |= B44_FLAG_100_BASE_T;
+		bp->flags |= B44_FLAG_FULL_DUPLEX;
+		if (!netif_carrier_ok(bp->dev)) {
+			u32 val = br32(B44_TX_CTRL);
+			val |= TX_CTRL_DUPLEX;
+			bw32(B44_TX_CTRL, val);
+			netif_carrier_on(bp->dev);
+			b44_link_report(bp);
+		}
+		return;
+	}
+
 	if (!b44_readphy(bp, MII_BMSR, &bmsr) &&
 	    !b44_readphy(bp, B44_MII_AUXCTRL, &aux) &&
 	    (bmsr != 0xffff)) {
@@ -520,14 +544,14 @@
 
 		if (!netif_carrier_ok(bp->dev) &&
 		    (bmsr & BMSR_LSTATUS)) {
-			u32 val = br32(bp, B44_TX_CTRL);
+			u32 val = br32(B44_TX_CTRL);
 			u32 local_adv, remote_adv;
 
 			if (bp->flags & B44_FLAG_FULL_DUPLEX)
 				val |= TX_CTRL_DUPLEX;
 			else
 				val &= ~TX_CTRL_DUPLEX;
-			bw32(bp, B44_TX_CTRL, val);
+			bw32(B44_TX_CTRL, val);
 
 			if (!(bp->flags & B44_FLAG_FORCE_LINK) &&
 			    !b44_readphy(bp, MII_ADVERTISE, &local_adv) &&
@@ -572,7 +596,7 @@
 {
 	u32 cur, cons;
 
-	cur  = br32(bp, B44_DMATX_STAT) & DMATX_STAT_CDMASK;
+	cur  = br32(B44_DMATX_STAT) & DMATX_STAT_CDMASK;
 	cur /= sizeof(struct dma_desc);
 
 	/* XXX needs updating when NETIF_F_SG is supported */
@@ -596,7 +620,7 @@
 	    TX_BUFFS_AVAIL(bp) > B44_TX_WAKEUP_THRESH)
 		netif_wake_queue(bp->dev);
 
-	bw32(bp, B44_GPTIMER, 0);
+	bw32(B44_GPTIMER, 0);
 }
 
 /* Works like this.  This chip writes a 'struct rx_header" 30 bytes
@@ -713,7 +737,7 @@
 	u32 cons, prod;
 
 	received = 0;
-	prod  = br32(bp, B44_DMARX_STAT) & DMARX_STAT_CDMASK;
+	prod  = br32(B44_DMARX_STAT) & DMARX_STAT_CDMASK;
 	prod /= sizeof(struct dma_desc);
 	cons = bp->rx_cons;
 
@@ -792,7 +816,7 @@
 	}
 
 	bp->rx_cons = cons;
-	bw32(bp, B44_DMARX_PTR, cons * sizeof(struct dma_desc));
+	bw32(B44_DMARX_PTR, cons * sizeof(struct dma_desc));
 
 	return received;
 }
@@ -856,8 +880,8 @@
 
 	spin_lock_irqsave(&bp->lock, flags);
 
-	istat = br32(bp, B44_ISTAT);
-	imask = br32(bp, B44_IMASK);
+	istat = br32(B44_ISTAT);
+	imask = br32(B44_IMASK);
 
 	/* ??? What the fuck is the purpose of the interrupt mask
 	 * ??? register if we have to mask it out by hand anyways?
@@ -877,8 +901,8 @@
 			       dev->name);
 		}
 
-		bw32(bp, B44_ISTAT, istat);
-		br32(bp, B44_ISTAT);
+		bw32(B44_ISTAT, istat);
+		br32(B44_ISTAT);
 	}
 	spin_unlock_irqrestore(&bp->lock, flags);
 	return IRQ_RETVAL(handled);
@@ -965,11 +989,11 @@
 
 	wmb();
 
-	bw32(bp, B44_DMATX_PTR, entry * sizeof(struct dma_desc));
+	bw32(B44_DMATX_PTR, entry * sizeof(struct dma_desc));
 	if (bp->flags & B44_FLAG_BUGGY_TXPTR)
-		bw32(bp, B44_DMATX_PTR, entry * sizeof(struct dma_desc));
+		bw32(B44_DMATX_PTR, entry * sizeof(struct dma_desc));
 	if (bp->flags & B44_FLAG_REORDER_BUG)
-		br32(bp, B44_DMATX_PTR);
+		br32(B44_DMATX_PTR);
 
 	if (TX_BUFFS_AVAIL(bp) < 1)
 		netif_stop_queue(dev);
@@ -1137,32 +1161,35 @@
 {
 	unsigned long reg;
 
-	bw32(bp, B44_MIB_CTRL, MIB_CTRL_CLR_ON_READ);
+	bw32(B44_MIB_CTRL, MIB_CTRL_CLR_ON_READ);
 	for (reg = B44_TX_GOOD_O; reg <= B44_TX_PAUSE; reg += 4UL)
-		br32(bp, reg);
+		br32(reg);
 	for (reg = B44_RX_GOOD_O; reg <= B44_RX_NPAUSE; reg += 4UL)
-		br32(bp, reg);
+		br32(reg);
 }
 
 /* bp->lock is held. */
 static void b44_chip_reset(struct b44 *bp)
 {
+	unsigned int sb_clock;
+
 	if (ssb_is_core_up(bp)) {
-		bw32(bp, B44_RCV_LAZY, 0);
-		bw32(bp, B44_ENET_CTRL, ENET_CTRL_DISABLE);
+		bw32(B44_RCV_LAZY, 0);
+		bw32(B44_ENET_CTRL, ENET_CTRL_DISABLE);
 		b44_wait_bit(bp, B44_ENET_CTRL, ENET_CTRL_DISABLE, 100, 1);
-		bw32(bp, B44_DMATX_CTRL, 0);
+		bw32(B44_DMATX_CTRL, 0);
 		bp->tx_prod = bp->tx_cons = 0;
-		if (br32(bp, B44_DMARX_STAT) & DMARX_STAT_EMASK) {
+		if (br32(B44_DMARX_STAT) & DMARX_STAT_EMASK) {
 			b44_wait_bit(bp, B44_DMARX_STAT, DMARX_STAT_SIDLE,
 				     100, 0);
 		}
-		bw32(bp, B44_DMARX_CTRL, 0);
+		bw32(B44_DMARX_CTRL, 0);
 		bp->rx_prod = bp->rx_cons = 0;
 	} else {
-		ssb_pci_setup(bp, (bp->core_unit == 0 ?
-				   SBINTVEC_ENET0 :
-				   SBINTVEC_ENET1));
+		if (bp->pdev->device != PCI_DEVICE_ID_BCM4713)
+			ssb_pci_setup(bp, (bp->core_unit == 0 ?
+					   SBINTVEC_ENET0 :
+					   SBINTVEC_ENET1));
 	}
 
 	ssb_core_reset(bp);
@@ -1170,20 +1197,26 @@
 	b44_clear_stats(bp);
 
 	/* Make PHY accessible. */
-	bw32(bp, B44_MDIO_CTRL, (MDIO_CTRL_PREAMBLE |
-			     (0x0d & MDIO_CTRL_MAXF_MASK)));
-	br32(bp, B44_MDIO_CTRL);
-
-	if (!(br32(bp, B44_DEVCTRL) & DEVCTRL_IPP)) {
-		bw32(bp, B44_ENET_CTRL, ENET_CTRL_EPSEL);
-		br32(bp, B44_ENET_CTRL);
+	if (bp->pdev->device == PCI_DEVICE_ID_BCM4713)
+		sb_clock = 100000000; /* 100 MHz */
+	else
+		sb_clock = 62500000; /* 62.5 MHz */
+
+	bw32(B44_MDIO_CTRL, (MDIO_CTRL_PREAMBLE |
+			     (((sb_clock + (B44_MDC_RATIO / 2)) / B44_MDC_RATIO)
+			     & MDIO_CTRL_MAXF_MASK)));
+	br32(B44_MDIO_CTRL);
+
+	if (!(br32(B44_DEVCTRL) & DEVCTRL_IPP)) {
+		bw32(B44_ENET_CTRL, ENET_CTRL_EPSEL);
+		br32(B44_ENET_CTRL);
 		bp->flags &= ~B44_FLAG_INTERNAL_PHY;
 	} else {
-		u32 val = br32(bp, B44_DEVCTRL);
+		u32 val = br32(B44_DEVCTRL);
 
 		if (val & DEVCTRL_EPR) {
-			bw32(bp, B44_DEVCTRL, (val & ~DEVCTRL_EPR));
-			br32(bp, B44_DEVCTRL);
+			bw32(B44_DEVCTRL, (val & ~DEVCTRL_EPR));
+			br32(B44_DEVCTRL);
 			udelay(100);
 		}
 		bp->flags |= B44_FLAG_INTERNAL_PHY;
@@ -1200,13 +1233,13 @@
 /* bp->lock is held. */
 static void __b44_set_mac_addr(struct b44 *bp)
 {
-	bw32(bp, B44_CAM_CTRL, 0);
+	bw32(B44_CAM_CTRL, 0);
 	if (!(bp->dev->flags & IFF_PROMISC)) {
 		u32 val;
 
 		__b44_cam_write(bp, bp->dev->dev_addr, 0);
-		val = br32(bp, B44_CAM_CTRL);
-		bw32(bp, B44_CAM_CTRL, val | CAM_CTRL_ENABLE);
+		val = br32(B44_CAM_CTRL);
+		bw32(B44_CAM_CTRL, val | CAM_CTRL_ENABLE);
 	}
 }
 
@@ -1240,30 +1273,30 @@
 	b44_setup_phy(bp);
 
 	/* Enable CRC32, set proper LED modes and power on PHY */
-	bw32(bp, B44_MAC_CTRL, MAC_CTRL_CRC32_ENAB | MAC_CTRL_PHY_LEDCTRL);
-	bw32(bp, B44_RCV_LAZY, (1 << RCV_LAZY_FC_SHIFT));
+	bw32(B44_MAC_CTRL, MAC_CTRL_CRC32_ENAB | MAC_CTRL_PHY_LEDCTRL);
+	bw32(B44_RCV_LAZY, (1 << RCV_LAZY_FC_SHIFT));
 
 	/* This sets the MAC address too.  */
 	__b44_set_rx_mode(bp->dev);
 
 	/* MTU + eth header + possible VLAN tag + struct rx_header */
-	bw32(bp, B44_RXMAXLEN, bp->dev->mtu + ETH_HLEN + 8 + RX_HEADER_LEN);
-	bw32(bp, B44_TXMAXLEN, bp->dev->mtu + ETH_HLEN + 8 + RX_HEADER_LEN);
+	bw32(B44_RXMAXLEN, bp->dev->mtu + ETH_HLEN + 8 + RX_HEADER_LEN);
+	bw32(B44_TXMAXLEN, bp->dev->mtu + ETH_HLEN + 8 + RX_HEADER_LEN);
 
-	bw32(bp, B44_TX_WMARK, 56); /* XXX magic */
-	bw32(bp, B44_DMATX_CTRL, DMATX_CTRL_ENABLE);
-	bw32(bp, B44_DMATX_ADDR, bp->tx_ring_dma + bp->dma_offset);
-	bw32(bp, B44_DMARX_CTRL, (DMARX_CTRL_ENABLE |
+	bw32(B44_TX_WMARK, 56); /* XXX magic */
+	bw32(B44_DMATX_CTRL, DMATX_CTRL_ENABLE);
+	bw32(B44_DMATX_ADDR, bp->tx_ring_dma + bp->dma_offset);
+	bw32(B44_DMARX_CTRL, (DMARX_CTRL_ENABLE |
 			      (bp->rx_offset << DMARX_CTRL_ROSHIFT)));
-	bw32(bp, B44_DMARX_ADDR, bp->rx_ring_dma + bp->dma_offset);
+	bw32(B44_DMARX_ADDR, bp->rx_ring_dma + bp->dma_offset);
 
-	bw32(bp, B44_DMARX_PTR, bp->rx_pending);
+	bw32(B44_DMARX_PTR, bp->rx_pending);
 	bp->rx_prod = bp->rx_pending;	
 
-	bw32(bp, B44_MIB_CTRL, MIB_CTRL_CLR_ON_READ);
+	bw32(B44_MIB_CTRL, MIB_CTRL_CLR_ON_READ);
 
-	val = br32(bp, B44_ENET_CTRL);
-	bw32(bp, B44_ENET_CTRL, (val | ENET_CTRL_ENABLE));
+	val = br32(B44_ENET_CTRL);
+	bw32(B44_ENET_CTRL, (val | ENET_CTRL_ENABLE));
 }
 
 static int b44_open(struct net_device *dev)
@@ -1416,11 +1449,11 @@
 	int i=0;
 	unsigned char zero[6] = {0,0,0,0,0,0};
 
-	val = br32(bp, B44_RXCONFIG);
+	val = br32(B44_RXCONFIG);
 	val &= ~(RXCONFIG_PROMISC | RXCONFIG_ALLMULTI);
 	if (dev->flags & IFF_PROMISC) {
 		val |= RXCONFIG_PROMISC;
-		bw32(bp, B44_RXCONFIG, val);
+		bw32(B44_RXCONFIG, val);
 	} else {
 		__b44_set_mac_addr(bp);
 
@@ -1432,9 +1465,9 @@
 		for(;i<64;i++) {
 			__b44_cam_write(bp, zero, i);			
 		}
-		bw32(bp, B44_RXCONFIG, val);
-        	val = br32(bp, B44_CAM_CTRL);
-	        bw32(bp, B44_CAM_CTRL, val | CAM_CTRL_ENABLE);
+		bw32(B44_RXCONFIG, val);
+        	val = br32(B44_CAM_CTRL);
+	        bw32(B44_CAM_CTRL, val | CAM_CTRL_ENABLE);
 	}
 }
 
@@ -1704,19 +1737,41 @@
 {
 	u8 eeprom[128];
 	int err;
+	unsigned long flags;
 
-	err = b44_read_eeprom(bp, &eeprom[0]);
-	if (err)
-		goto out;
-
-	bp->dev->dev_addr[0] = eeprom[79];
-	bp->dev->dev_addr[1] = eeprom[78];
-	bp->dev->dev_addr[2] = eeprom[81];
-	bp->dev->dev_addr[3] = eeprom[80];
-	bp->dev->dev_addr[4] = eeprom[83];
-	bp->dev->dev_addr[5] = eeprom[82];
-
-	bp->phy_addr = eeprom[90] & 0x1f;
+	if (bp->pdev->device == PCI_DEVICE_ID_BCM4713) {
+		/* 
+		 * BCM47xx boards don't have a EEPROM. The MAC is stored in
+		 * a NVRAM area somewhere in the flash memory. As we don't
+		 * know the location and/or the format of the NVRAM area
+		 * here, we simply rely on the bootloader to write the
+		 * MAC into the CAM.
+		 */
+		spin_lock_irqsave(&bp->lock, flags);
+		__b44_cam_read(bp, bp->dev->dev_addr, 0);
+		spin_unlock_irqrestore(&bp->lock, flags);
+
+		/* 
+		 * BCM47xx boards don't have a PHY. Usually there is a switch
+		 * chip with multiple PHYs connected to the PHY port.
+		 */
+		bp->phy_addr = B44_PHY_ADDR_NO_PHY;
+		bp->dma_offset = 0;
+	} else {
+		err = b44_read_eeprom(bp, &eeprom[0]);
+		if (err)
+			return err;
+
+		bp->dev->dev_addr[0] = eeprom[79];
+		bp->dev->dev_addr[1] = eeprom[78];
+		bp->dev->dev_addr[2] = eeprom[81];
+		bp->dev->dev_addr[3] = eeprom[80];
+		bp->dev->dev_addr[4] = eeprom[83];
+		bp->dev->dev_addr[5] = eeprom[82];
+
+		bp->phy_addr = eeprom[90] & 0x1f;
+		bp->dma_offset = SB_PCI_DMA;
+	} 
 
 	/* With this, plus the rx_header prepended to the data by the
 	 * hardware, we'll land the ethernet header on a 2-byte boundary.
@@ -1726,13 +1781,12 @@
 	bp->imask = IMASK_DEF;
 
 	bp->core_unit = ssb_core_unit(bp);
-	bp->dma_offset = SB_PCI_DMA;
 
 	/* XXX - really required? 
 	   bp->flags |= B44_FLAG_BUGGY_TXPTR;
          */
-out:
-	return err;
+
+	return 0;
 }
 
 static int __devinit b44_init_one(struct pci_dev *pdev,
@@ -1810,7 +1864,7 @@
 
 	spin_lock_init(&bp->lock);
 
-	bp->regs = ioremap(b44reg_base, b44reg_len);
+	bp->regs = (unsigned long) ioremap(b44reg_base, b44reg_len);
 	if (bp->regs == 0UL) {
 		printk(KERN_ERR PFX "Cannot map device registers, "
 		       "aborting.\n");
@@ -1871,7 +1925,8 @@
 
 	pci_save_state(bp->pdev);
 
-	printk(KERN_INFO "%s: Broadcom 4400 10/100BaseT Ethernet ", dev->name);
+	printk(KERN_INFO "%s: Broadcom %s 10/100BaseT Ethernet ", dev->name,
+		(pdev->device == PCI_DEVICE_ID_BCM4713) ? "47xx" : "4400");
 	for (i = 0; i < 6; i++)
 		printk("%2.2x%c", dev->dev_addr[i],
 		       i == 5 ? '\n' : ':');
@@ -1879,7 +1934,7 @@
 	return 0;
 
 err_out_iounmap:
-	iounmap(bp->regs);
+	iounmap((void *) bp->regs);
 
 err_out_free_dev:
 	free_netdev(dev);
@@ -1901,7 +1956,7 @@
 		struct b44 *bp = netdev_priv(dev);
 
 		unregister_netdev(dev);
-		iounmap(bp->regs);
+		iounmap((void *) bp->regs);
 		free_netdev(dev);
 		pci_release_regions(pdev);
 		pci_disable_device(pdev);
diff -Nur linux-2.6.12.5/drivers/net/b44.h linux-2.6.12.5-brcm/drivers/net/b44.h
--- linux-2.6.12.5/drivers/net/b44.h	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/drivers/net/b44.h	2005-08-28 11:12:20.694819024 +0200
@@ -292,6 +292,9 @@
 #define SSB_PCI_MASK1		0xfc000000
 #define SSB_PCI_MASK2		0xc0000000
 
+#define br32(REG)	readl(bp->regs + (REG))
+#define bw32(REG,VAL)	writel((VAL), bp->regs + (REG))
+
 /* 4400 PHY registers */
 #define B44_MII_AUXCTRL		24	/* Auxiliary Control */
 #define  MII_AUXCTRL_DUPLEX	0x0001  /* Full Duplex */
@@ -345,6 +348,8 @@
 };
 
 #define B44_MCAST_TABLE_SIZE	32
+#define B44_PHY_ADDR_NO_PHY	30
+#define B44_MDC_RATIO		5000000
 
 /* SW copy of device statistics, kept up to date by periodic timer
  * which probes HW values.  Must have same relative layout as HW
@@ -410,7 +415,7 @@
 	struct net_device_stats	stats;
 	struct b44_hw_stats	hw_stats;
 
-	void __iomem		*regs;
+	unsigned long		regs;
 	struct pci_dev		*pdev;
 	struct net_device	*dev;
 
diff -Nur linux-2.6.12.5/include/asm-mips/bootinfo.h linux-2.6.12.5-brcm/include/asm-mips/bootinfo.h
--- linux-2.6.12.5/include/asm-mips/bootinfo.h	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/include/asm-mips/bootinfo.h	2005-08-28 11:12:20.695818872 +0200
@@ -213,6 +213,12 @@
 #define MACH_GROUP_TITAN       22	/* PMC-Sierra Titan		*/
 #define  MACH_TITAN_YOSEMITE	1	/* PMC-Sierra Yosemite		*/
 
+/*
+ * Valid machtype for group Broadcom
+ */
+#define MACH_GROUP_BRCM		23	/* Broadcom			*/
+#define MACH_BCM47XX		1	/* Broadcom BCM47xx		*/
+
 #define CL_SIZE			COMMAND_LINE_SIZE
 
 const char *get_system_type(void);
diff -Nur linux-2.6.12.5/include/asm-mips/cpu.h linux-2.6.12.5-brcm/include/asm-mips/cpu.h
--- linux-2.6.12.5/include/asm-mips/cpu.h	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/include/asm-mips/cpu.h	2005-08-28 11:12:20.695818872 +0200
@@ -87,6 +87,13 @@
 #define PRID_IMP_SR71000        0x0400
 
 /*
+ * These are the PRID's for when 23:16 == PRID_COMP_BROADCOM
+ */
+
+#define PRID_IMP_BCM4710	0x4000
+#define PRID_IMP_BCM3302	0x9000
+
+/*
  * Definitions for 7:0 on legacy processors
  */
 
@@ -177,7 +184,9 @@
 #define CPU_VR4133		56
 #define CPU_AU1550		57
 #define CPU_24K			58
-#define CPU_LAST		58
+#define CPU_BCM3302		59
+#define CPU_BCM4710		60
+#define CPU_LAST		60
 
 /*
  * ISA Level encodings
diff -Nur linux-2.6.12.5/include/asm-mips/mipsregs.h linux-2.6.12.5-brcm/include/asm-mips/mipsregs.h
--- linux-2.6.12.5/include/asm-mips/mipsregs.h	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/include/asm-mips/mipsregs.h	2005-08-28 11:12:20.722814768 +0200
@@ -790,10 +790,18 @@
 #define read_c0_config1()	__read_32bit_c0_register($16, 1)
 #define read_c0_config2()	__read_32bit_c0_register($16, 2)
 #define read_c0_config3()	__read_32bit_c0_register($16, 3)
+#define read_c0_config4()	__read_32bit_c0_register($16, 4)
+#define read_c0_config5()	__read_32bit_c0_register($16, 5)
+#define read_c0_config6()	__read_32bit_c0_register($16, 6)
+#define read_c0_config7()	__read_32bit_c0_register($16, 7)
 #define write_c0_config(val)	__write_32bit_c0_register($16, 0, val)
 #define write_c0_config1(val)	__write_32bit_c0_register($16, 1, val)
 #define write_c0_config2(val)	__write_32bit_c0_register($16, 2, val)
 #define write_c0_config3(val)	__write_32bit_c0_register($16, 3, val)
+#define write_c0_config4(val)	__write_32bit_c0_register($16, 4, val)
+#define write_c0_config5(val)	__write_32bit_c0_register($16, 5, val)
+#define write_c0_config6(val)	__write_32bit_c0_register($16, 6, val)
+#define write_c0_config7(val)	__write_32bit_c0_register($16, 7, val)
 
 /*
  * The WatchLo register.  There may be upto 8 of them.
diff -Nur linux-2.6.12.5/include/linux/init.h linux-2.6.12.5-brcm/include/linux/init.h
--- linux-2.6.12.5/include/linux/init.h	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/include/linux/init.h	2005-08-28 11:12:20.723814616 +0200
@@ -86,6 +86,8 @@
 	static initcall_t __initcall_##fn __attribute_used__ \
 	__attribute__((__section__(".initcall" level ".init"))) = fn
 
+#define early_initcall(fn)		__define_initcall(".early1",fn)
+
 #define core_initcall(fn)		__define_initcall("1",fn)
 #define postcore_initcall(fn)		__define_initcall("2",fn)
 #define arch_initcall(fn)		__define_initcall("3",fn)
diff -Nur linux-2.6.12.5/include/linux/pci_ids.h linux-2.6.12.5-brcm/include/linux/pci_ids.h
--- linux-2.6.12.5/include/linux/pci_ids.h	2005-08-15 02:20:18.000000000 +0200
+++ linux-2.6.12.5-brcm/include/linux/pci_ids.h	2005-08-28 11:12:20.726814160 +0200
@@ -2110,6 +2110,7 @@
 #define PCI_DEVICE_ID_TIGON3_5901_2	0x170e
 #define PCI_DEVICE_ID_BCM4401		0x4401
 #define PCI_DEVICE_ID_BCM4401B0		0x4402
+#define PCI_DEVICE_ID_BCM4713		0x4713
 
 #define PCI_VENDOR_ID_TOPIC		0x151f
 #define PCI_DEVICE_ID_TOPIC_TP560	0x0000