ssb: fix NULL ptr deref when pcihost_wrapper is used
[safe/jmp/linux-2.6] / drivers / ssb / pci.c
index 9777dcb..6dcda86 100644 (file)
@@ -17,6 +17,7 @@
 
 #include <linux/ssb/ssb.h>
 #include <linux/ssb/ssb_regs.h>
+#include <linux/slab.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
 
@@ -167,10 +168,16 @@ err_pci:
 }
 
 /* Get the word-offset for a SSB_SPROM_XXX define. */
-#define SPOFF(offset)  (((offset) - SSB_SPROM_BASE) / sizeof(u16))
+#define SPOFF(offset)  ((offset) / sizeof(u16))
 /* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */
-#define SPEX(_outvar, _offset, _mask, _shift)  \
+#define SPEX16(_outvar, _offset, _mask, _shift)        \
        out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift))
+#define SPEX32(_outvar, _offset, _mask, _shift)        \
+       out->_outvar = ((((u32)in[SPOFF((_offset)+2)] << 16 | \
+                          in[SPOFF(_offset)]) & (_mask)) >> (_shift))
+#define SPEX(_outvar, _offset, _mask, _shift) \
+       SPEX16(_outvar, _offset, _mask, _shift)
+
 
 static inline u8 ssb_crc8(u8 crc, u8 data)
 {
@@ -227,7 +234,7 @@ static u8 ssb_sprom_crc(const u16 *sprom, u16 size)
        return crc;
 }
 
-static int sprom_check_crc(const u16 *sprom, u16 size)
+static int sprom_check_crc(const u16 *sprom, size_t size)
 {
        u8 crc;
        u8 expected_crc;
@@ -242,12 +249,14 @@ static int sprom_check_crc(const u16 *sprom, u16 size)
        return 0;
 }
 
-static void sprom_do_read(struct ssb_bus *bus, u16 *sprom)
+static int sprom_do_read(struct ssb_bus *bus, u16 *sprom)
 {
        int i;
 
        for (i = 0; i < bus->sprom_size; i++)
-               sprom[i] = readw(bus->mmio + SSB_SPROM_BASE + (i * 2));
+               sprom[i] = ioread16(bus->mmio + bus->sprom_offset + (i * 2));
+
+       return 0;
 }
 
 static int sprom_do_write(struct ssb_bus *bus, const u16 *sprom)
@@ -276,7 +285,7 @@ static int sprom_do_write(struct ssb_bus *bus, const u16 *sprom)
                        ssb_printk("75%%");
                else if (i % 2)
                        ssb_printk(".");
-               writew(sprom[i], bus->mmio + SSB_SPROM_BASE + (i * 2));
+               writew(sprom[i], bus->mmio + bus->sprom_offset + (i * 2));
                mmiowb();
                msleep(20);
        }
@@ -297,17 +306,37 @@ err_ctlreg:
        return err;
 }
 
+static s8 r123_extract_antgain(u8 sprom_revision, const u16 *in,
+                              u16 mask, u16 shift)
+{
+       u16 v;
+       u8 gain;
+
+       v = in[SPOFF(SSB_SPROM1_AGAIN)];
+       gain = (v & mask) >> shift;
+       if (gain == 0xFF)
+               gain = 2; /* If unset use 2dBm */
+       if (sprom_revision == 1) {
+               /* Convert to Q5.2 */
+               gain <<= 2;
+       } else {
+               /* Q5.2 Fractional part is stored in 0xC0 */
+               gain = ((gain & 0xC0) >> 6) | ((gain & 0x3F) << 2);
+       }
+
+       return (s8)gain;
+}
+
 static void sprom_extract_r123(struct ssb_sprom *out, const u16 *in)
 {
        int i;
        u16 v;
+       s8 gain;
        u16 loc[3];
 
-       if (out->revision == 3) {                       /* rev 3 moved MAC */
+       if (out->revision == 3)                 /* rev 3 moved MAC */
                loc[0] = SSB_SPROM3_IL0MAC;
-               loc[1] = SSB_SPROM3_ET0MAC;
-               loc[2] = SSB_SPROM3_ET1MAC;
-       } else {
+       else {
                loc[0] = SSB_SPROM1_IL0MAC;
                loc[1] = SSB_SPROM1_ET0MAC;
                loc[2] = SSB_SPROM1_ET1MAC;
@@ -316,19 +345,28 @@ static void sprom_extract_r123(struct ssb_sprom *out, const u16 *in)
                v = in[SPOFF(loc[0]) + i];
                *(((__be16 *)out->il0mac) + i) = cpu_to_be16(v);
        }
-       for (i = 0; i < 3; i++) {
-               v = in[SPOFF(loc[1]) + i];
-               *(((__be16 *)out->et0mac) + i) = cpu_to_be16(v);
-       }
-       for (i = 0; i < 3; i++) {
-               v = in[SPOFF(loc[2]) + i];
-               *(((__be16 *)out->et1mac) + i) = cpu_to_be16(v);
+       if (out->revision < 3) {        /* only rev 1-2 have et0, et1 */
+               for (i = 0; i < 3; i++) {
+                       v = in[SPOFF(loc[1]) + i];
+                       *(((__be16 *)out->et0mac) + i) = cpu_to_be16(v);
+               }
+               for (i = 0; i < 3; i++) {
+                       v = in[SPOFF(loc[2]) + i];
+                       *(((__be16 *)out->et1mac) + i) = cpu_to_be16(v);
+               }
        }
        SPEX(et0phyaddr, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET0A, 0);
        SPEX(et1phyaddr, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET1A,
             SSB_SPROM1_ETHPHY_ET1A_SHIFT);
+       SPEX(et0mdcport, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET0M, 14);
+       SPEX(et1mdcport, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET1M, 15);
+       SPEX(board_rev, SSB_SPROM1_BINF, SSB_SPROM1_BINF_BREV, 0);
        SPEX(country_code, SSB_SPROM1_BINF, SSB_SPROM1_BINF_CCODE,
             SSB_SPROM1_BINF_CCODE_SHIFT);
+       SPEX(ant_available_a, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTA,
+            SSB_SPROM1_BINF_ANTA_SHIFT);
+       SPEX(ant_available_bg, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTBG,
+            SSB_SPROM1_BINF_ANTBG_SHIFT);
        SPEX(pa0b0, SSB_SPROM1_PA0B0, 0xFFFF, 0);
        SPEX(pa0b1, SSB_SPROM1_PA0B1, 0xFFFF, 0);
        SPEX(pa0b2, SSB_SPROM1_PA0B2, 0xFFFF, 0);
@@ -348,59 +386,193 @@ static void sprom_extract_r123(struct ssb_sprom *out, const u16 *in)
             SSB_SPROM1_ITSSI_A_SHIFT);
        SPEX(itssi_bg, SSB_SPROM1_ITSSI, SSB_SPROM1_ITSSI_BG, 0);
        SPEX(boardflags_lo, SSB_SPROM1_BFLLO, 0xFFFF, 0);
-       SPEX(antenna_gain_a, SSB_SPROM1_AGAIN, SSB_SPROM1_AGAIN_A, 0);
-       SPEX(antenna_gain_bg, SSB_SPROM1_AGAIN, SSB_SPROM1_AGAIN_BG,
-            SSB_SPROM1_AGAIN_BG_SHIFT);
+       if (out->revision >= 2)
+               SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
+
+       /* Extract the antenna gain values. */
+       gain = r123_extract_antgain(out->revision, in,
+                                   SSB_SPROM1_AGAIN_BG,
+                                   SSB_SPROM1_AGAIN_BG_SHIFT);
+       out->antenna_gain.ghz24.a0 = gain;
+       out->antenna_gain.ghz24.a1 = gain;
+       out->antenna_gain.ghz24.a2 = gain;
+       out->antenna_gain.ghz24.a3 = gain;
+       gain = r123_extract_antgain(out->revision, in,
+                                   SSB_SPROM1_AGAIN_A,
+                                   SSB_SPROM1_AGAIN_A_SHIFT);
+       out->antenna_gain.ghz5.a0 = gain;
+       out->antenna_gain.ghz5.a1 = gain;
+       out->antenna_gain.ghz5.a2 = gain;
+       out->antenna_gain.ghz5.a3 = gain;
 }
 
-static void sprom_extract_r4(struct ssb_sprom *out, const u16 *in)
+static void sprom_extract_r45(struct ssb_sprom *out, const u16 *in)
 {
        int i;
        u16 v;
+       u16 il0mac_offset;
 
-       /* extract the equivalent of the r1 variables */
+       if (out->revision == 4)
+               il0mac_offset = SSB_SPROM4_IL0MAC;
+       else
+               il0mac_offset = SSB_SPROM5_IL0MAC;
+       /* extract the MAC address */
        for (i = 0; i < 3; i++) {
-               v = in[SPOFF(SSB_SPROM4_IL0MAC) + i];
+               v = in[SPOFF(il0mac_offset) + i];
                *(((__be16 *)out->il0mac) + i) = cpu_to_be16(v);
        }
-       for (i = 0; i < 3; i++) {
-               v = in[SPOFF(SSB_SPROM4_ET0MAC) + i];
-               *(((__be16 *)out->et0mac) + i) = cpu_to_be16(v);
-       }
-       for (i = 0; i < 3; i++) {
-               v = in[SPOFF(SSB_SPROM4_ET1MAC) + i];
-               *(((__be16 *)out->et1mac) + i) = cpu_to_be16(v);
-       }
        SPEX(et0phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET0A, 0);
        SPEX(et1phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET1A,
             SSB_SPROM4_ETHPHY_ET1A_SHIFT);
-       SPEX(country_code, SSB_SPROM4_CCODE, 0xFFFF, 0);
-       SPEX(boardflags_lo, SSB_SPROM4_BFLLO, 0xFFFF, 0);
-       SPEX(antenna_gain_a, SSB_SPROM4_AGAIN, SSB_SPROM4_AGAIN_0, 0);
-       SPEX(antenna_gain_bg, SSB_SPROM4_AGAIN, SSB_SPROM4_AGAIN_1,
-            SSB_SPROM4_AGAIN_1_SHIFT);
+       if (out->revision == 4) {
+               SPEX(country_code, SSB_SPROM4_CCODE, 0xFFFF, 0);
+               SPEX(boardflags_lo, SSB_SPROM4_BFLLO, 0xFFFF, 0);
+               SPEX(boardflags_hi, SSB_SPROM4_BFLHI, 0xFFFF, 0);
+       } else {
+               SPEX(country_code, SSB_SPROM5_CCODE, 0xFFFF, 0);
+               SPEX(boardflags_lo, SSB_SPROM5_BFLLO, 0xFFFF, 0);
+               SPEX(boardflags_hi, SSB_SPROM5_BFLHI, 0xFFFF, 0);
+       }
+       SPEX(ant_available_a, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_A,
+            SSB_SPROM4_ANTAVAIL_A_SHIFT);
+       SPEX(ant_available_bg, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_BG,
+            SSB_SPROM4_ANTAVAIL_BG_SHIFT);
        SPEX(maxpwr_bg, SSB_SPROM4_MAXP_BG, SSB_SPROM4_MAXP_BG_MASK, 0);
        SPEX(itssi_bg, SSB_SPROM4_MAXP_BG, SSB_SPROM4_ITSSI_BG,
             SSB_SPROM4_ITSSI_BG_SHIFT);
        SPEX(maxpwr_a, SSB_SPROM4_MAXP_A, SSB_SPROM4_MAXP_A_MASK, 0);
        SPEX(itssi_a, SSB_SPROM4_MAXP_A, SSB_SPROM4_ITSSI_A,
             SSB_SPROM4_ITSSI_A_SHIFT);
-       SPEX(gpio0, SSB_SPROM4_GPIOA, SSB_SPROM4_GPIOA_P0, 0);
-       SPEX(gpio1, SSB_SPROM4_GPIOA, SSB_SPROM4_GPIOA_P1,
-            SSB_SPROM4_GPIOA_P1_SHIFT);
-       SPEX(gpio2, SSB_SPROM4_GPIOB, SSB_SPROM4_GPIOB_P2, 0);
-       SPEX(gpio3, SSB_SPROM4_GPIOB, SSB_SPROM4_GPIOB_P3,
-            SSB_SPROM4_GPIOB_P3_SHIFT);
+       if (out->revision == 4) {
+               SPEX(gpio0, SSB_SPROM4_GPIOA, SSB_SPROM4_GPIOA_P0, 0);
+               SPEX(gpio1, SSB_SPROM4_GPIOA, SSB_SPROM4_GPIOA_P1,
+                    SSB_SPROM4_GPIOA_P1_SHIFT);
+               SPEX(gpio2, SSB_SPROM4_GPIOB, SSB_SPROM4_GPIOB_P2, 0);
+               SPEX(gpio3, SSB_SPROM4_GPIOB, SSB_SPROM4_GPIOB_P3,
+                    SSB_SPROM4_GPIOB_P3_SHIFT);
+       } else {
+               SPEX(gpio0, SSB_SPROM5_GPIOA, SSB_SPROM5_GPIOA_P0, 0);
+               SPEX(gpio1, SSB_SPROM5_GPIOA, SSB_SPROM5_GPIOA_P1,
+                    SSB_SPROM5_GPIOA_P1_SHIFT);
+               SPEX(gpio2, SSB_SPROM5_GPIOB, SSB_SPROM5_GPIOB_P2, 0);
+               SPEX(gpio3, SSB_SPROM5_GPIOB, SSB_SPROM5_GPIOB_P3,
+                    SSB_SPROM5_GPIOB_P3_SHIFT);
+       }
+
+       /* Extract the antenna gain values. */
+       SPEX(antenna_gain.ghz24.a0, SSB_SPROM4_AGAIN01,
+            SSB_SPROM4_AGAIN0, SSB_SPROM4_AGAIN0_SHIFT);
+       SPEX(antenna_gain.ghz24.a1, SSB_SPROM4_AGAIN01,
+            SSB_SPROM4_AGAIN1, SSB_SPROM4_AGAIN1_SHIFT);
+       SPEX(antenna_gain.ghz24.a2, SSB_SPROM4_AGAIN23,
+            SSB_SPROM4_AGAIN2, SSB_SPROM4_AGAIN2_SHIFT);
+       SPEX(antenna_gain.ghz24.a3, SSB_SPROM4_AGAIN23,
+            SSB_SPROM4_AGAIN3, SSB_SPROM4_AGAIN3_SHIFT);
+       memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+              sizeof(out->antenna_gain.ghz5));
+
        /* TODO - get remaining rev 4 stuff needed */
 }
 
+static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
+{
+       int i;
+       u16 v;
+
+       /* extract the MAC address */
+       for (i = 0; i < 3; i++) {
+               v = in[SPOFF(SSB_SPROM8_IL0MAC) + i];
+               *(((__be16 *)out->il0mac) + i) = cpu_to_be16(v);
+       }
+       SPEX(country_code, SSB_SPROM8_CCODE, 0xFFFF, 0);
+       SPEX(boardflags_lo, SSB_SPROM8_BFLLO, 0xFFFF, 0);
+       SPEX(boardflags_hi, SSB_SPROM8_BFLHI, 0xFFFF, 0);
+       SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, 0xFFFF, 0);
+       SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, 0xFFFF, 0);
+       SPEX(ant_available_a, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_A,
+            SSB_SPROM8_ANTAVAIL_A_SHIFT);
+       SPEX(ant_available_bg, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_BG,
+            SSB_SPROM8_ANTAVAIL_BG_SHIFT);
+       SPEX(maxpwr_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_MAXP_BG_MASK, 0);
+       SPEX(itssi_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_ITSSI_BG,
+            SSB_SPROM8_ITSSI_BG_SHIFT);
+       SPEX(maxpwr_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_MAXP_A_MASK, 0);
+       SPEX(itssi_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_ITSSI_A,
+            SSB_SPROM8_ITSSI_A_SHIFT);
+       SPEX(maxpwr_ah, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AH_MASK, 0);
+       SPEX(maxpwr_al, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AL_MASK,
+            SSB_SPROM8_MAXP_AL_SHIFT);
+       SPEX(gpio0, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P0, 0);
+       SPEX(gpio1, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P1,
+            SSB_SPROM8_GPIOA_P1_SHIFT);
+       SPEX(gpio2, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P2, 0);
+       SPEX(gpio3, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P3,
+            SSB_SPROM8_GPIOB_P3_SHIFT);
+       SPEX(tri2g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI2G, 0);
+       SPEX(tri5g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI5G,
+            SSB_SPROM8_TRI5G_SHIFT);
+       SPEX(tri5gl, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GL, 0);
+       SPEX(tri5gh, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GH,
+            SSB_SPROM8_TRI5GH_SHIFT);
+       SPEX(rxpo2g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO2G, 0);
+       SPEX(rxpo5g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO5G,
+            SSB_SPROM8_RXPO5G_SHIFT);
+       SPEX(rssismf2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMF2G, 0);
+       SPEX(rssismc2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMC2G,
+            SSB_SPROM8_RSSISMC2G_SHIFT);
+       SPEX(rssisav2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISAV2G,
+            SSB_SPROM8_RSSISAV2G_SHIFT);
+       SPEX(bxa2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_BXA2G,
+            SSB_SPROM8_BXA2G_SHIFT);
+       SPEX(rssismf5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMF5G, 0);
+       SPEX(rssismc5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMC5G,
+            SSB_SPROM8_RSSISMC5G_SHIFT);
+       SPEX(rssisav5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISAV5G,
+            SSB_SPROM8_RSSISAV5G_SHIFT);
+       SPEX(bxa5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_BXA5G,
+            SSB_SPROM8_BXA5G_SHIFT);
+       SPEX(pa0b0, SSB_SPROM8_PA0B0, 0xFFFF, 0);
+       SPEX(pa0b1, SSB_SPROM8_PA0B1, 0xFFFF, 0);
+       SPEX(pa0b2, SSB_SPROM8_PA0B2, 0xFFFF, 0);
+       SPEX(pa1b0, SSB_SPROM8_PA1B0, 0xFFFF, 0);
+       SPEX(pa1b1, SSB_SPROM8_PA1B1, 0xFFFF, 0);
+       SPEX(pa1b2, SSB_SPROM8_PA1B2, 0xFFFF, 0);
+       SPEX(pa1lob0, SSB_SPROM8_PA1LOB0, 0xFFFF, 0);
+       SPEX(pa1lob1, SSB_SPROM8_PA1LOB1, 0xFFFF, 0);
+       SPEX(pa1lob2, SSB_SPROM8_PA1LOB2, 0xFFFF, 0);
+       SPEX(pa1hib0, SSB_SPROM8_PA1HIB0, 0xFFFF, 0);
+       SPEX(pa1hib1, SSB_SPROM8_PA1HIB1, 0xFFFF, 0);
+       SPEX(pa1hib2, SSB_SPROM8_PA1HIB2, 0xFFFF, 0);
+       SPEX(cck2gpo, SSB_SPROM8_CCK2GPO, 0xFFFF, 0);
+       SPEX32(ofdm2gpo, SSB_SPROM8_OFDM2GPO, 0xFFFFFFFF, 0);
+       SPEX32(ofdm5glpo, SSB_SPROM8_OFDM5GLPO, 0xFFFFFFFF, 0);
+       SPEX32(ofdm5gpo, SSB_SPROM8_OFDM5GPO, 0xFFFFFFFF, 0);
+       SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
+
+       /* Extract the antenna gain values. */
+       SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
+            SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
+       SPEX(antenna_gain.ghz24.a1, SSB_SPROM8_AGAIN01,
+            SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
+       SPEX(antenna_gain.ghz24.a2, SSB_SPROM8_AGAIN23,
+            SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
+       SPEX(antenna_gain.ghz24.a3, SSB_SPROM8_AGAIN23,
+            SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
+       memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+              sizeof(out->antenna_gain.ghz5));
+
+       /* TODO - get remaining rev 8 stuff needed */
+}
+
 static int sprom_extract(struct ssb_bus *bus, struct ssb_sprom *out,
                         const u16 *in, u16 size)
 {
        memset(out, 0, sizeof(*out));
 
        out->revision = in[size - 1] & 0x00FF;
-       ssb_printk(KERN_INFO PFX "SPROM revision %d detected.\n", out->revision);
+       ssb_dprintk(KERN_DEBUG PFX "SPROM revision %d detected.\n", out->revision);
+       memset(out->et0mac, 0xFF, 6);           /* preset et0 and et1 mac */
+       memset(out->et1mac, 0xFF, 6);
        if ((bus->chip_id & 0xFF00) == 0x4400) {
                /* Workaround: The BCM44XX chip has a stupid revision
                 * number stored in the SPROM.
@@ -410,33 +582,56 @@ static int sprom_extract(struct ssb_bus *bus, struct ssb_sprom *out,
        } else if (bus->chip_id == 0x4321) {
                /* the BCM4328 has a chipid == 0x4321 and a rev 4 SPROM */
                out->revision = 4;
-               sprom_extract_r4(out, in);
+               sprom_extract_r45(out, in);
        } else {
-               if (out->revision == 0)
-                       goto unsupported;
-               if (out->revision >= 1 && out->revision <= 3) {
+               switch (out->revision) {
+               case 1:
+               case 2:
+               case 3:
+                       sprom_extract_r123(out, in);
+                       break;
+               case 4:
+               case 5:
+                       sprom_extract_r45(out, in);
+                       break;
+               case 8:
+                       sprom_extract_r8(out, in);
+                       break;
+               default:
+                       ssb_printk(KERN_WARNING PFX "Unsupported SPROM"
+                                  "  revision %d detected. Will extract"
+                                  " v1\n", out->revision);
+                       out->revision = 1;
                        sprom_extract_r123(out, in);
                }
-               if (out->revision == 4)
-                       sprom_extract_r4(out, in);
-               if (out->revision >= 5)
-                       goto unsupported;
        }
 
-       return 0;
-unsupported:
-       ssb_printk(KERN_WARNING PFX "Unsupported SPROM revision %d "
-                  "detected. Will extract v1\n", out->revision);
-       sprom_extract_r123(out, in);
+       if (out->boardflags_lo == 0xFFFF)
+               out->boardflags_lo = 0;  /* per specs */
+       if (out->boardflags_hi == 0xFFFF)
+               out->boardflags_hi = 0;  /* per specs */
+
        return 0;
 }
 
 static int ssb_pci_sprom_get(struct ssb_bus *bus,
                             struct ssb_sprom *sprom)
 {
+       const struct ssb_sprom *fallback;
        int err = -ENOMEM;
        u16 *buf;
 
+       if (!ssb_is_sprom_available(bus)) {
+               ssb_printk(KERN_ERR PFX "No SPROM available!\n");
+               return -ENODEV;
+       }
+       if (bus->chipco.dev) {  /* can be unavailible! */
+               bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
+                       SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
+       } else {
+               bus->sprom_offset = SSB_SPROM_BASE1;
+       }
+
        buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
        if (!buf)
                goto out;
@@ -444,25 +639,32 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
        sprom_do_read(bus, buf);
        err = sprom_check_crc(buf, bus->sprom_size);
        if (err) {
-               /* check for rev 4 sprom - has special signature */
-               if (buf [32] == 0x5372) {
-                       ssb_printk(KERN_WARNING PFX "Extracting a rev 4"
-                                  " SPROM\n");
-                       kfree(buf);
-                       buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
-                                     GFP_KERNEL);
-                       if (!buf)
-                               goto out;
-                       bus->sprom_size = SSB_SPROMSIZE_WORDS_R4;
-                       sprom_do_read(bus, buf);
-                       err = sprom_check_crc(buf, bus->sprom_size);
-               }
-               if (err)
+               /* try for a 440 byte SPROM - revision 4 and higher */
+               kfree(buf);
+               buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
+                             GFP_KERNEL);
+               if (!buf)
+                       goto out;
+               bus->sprom_size = SSB_SPROMSIZE_WORDS_R4;
+               sprom_do_read(bus, buf);
+               err = sprom_check_crc(buf, bus->sprom_size);
+               if (err) {
+                       /* All CRC attempts failed.
+                        * Maybe there is no SPROM on the device?
+                        * If we have a fallback, use that. */
+                       fallback = ssb_get_fallback_sprom();
+                       if (fallback) {
+                               memcpy(sprom, fallback, sizeof(*sprom));
+                               err = 0;
+                               goto out_free;
+                       }
                        ssb_printk(KERN_WARNING PFX "WARNING: Invalid"
                                   " SPROM CRC (corrupt SPROM)\n");
+               }
        }
        err = sprom_extract(bus, sprom, buf, bus->sprom_size);
 
+out_free:
        kfree(buf);
 out:
        return err;
@@ -515,6 +717,19 @@ static inline int ssb_pci_assert_buspower(struct ssb_bus *bus)
 }
 #endif /* DEBUG */
 
+static u8 ssb_pci_read8(struct ssb_device *dev, u16 offset)
+{
+       struct ssb_bus *bus = dev->bus;
+
+       if (unlikely(ssb_pci_assert_buspower(bus)))
+               return 0xFF;
+       if (unlikely(bus->mapped_device != dev)) {
+               if (unlikely(ssb_pci_switch_core(bus, dev)))
+                       return 0xFF;
+       }
+       return ioread8(bus->mmio + offset);
+}
+
 static u16 ssb_pci_read16(struct ssb_device *dev, u16 offset)
 {
        struct ssb_bus *bus = dev->bus;
@@ -541,6 +756,54 @@ static u32 ssb_pci_read32(struct ssb_device *dev, u16 offset)
        return ioread32(bus->mmio + offset);
 }
 
+#ifdef CONFIG_SSB_BLOCKIO
+static void ssb_pci_block_read(struct ssb_device *dev, void *buffer,
+                              size_t count, u16 offset, u8 reg_width)
+{
+       struct ssb_bus *bus = dev->bus;
+       void __iomem *addr = bus->mmio + offset;
+
+       if (unlikely(ssb_pci_assert_buspower(bus)))
+               goto error;
+       if (unlikely(bus->mapped_device != dev)) {
+               if (unlikely(ssb_pci_switch_core(bus, dev)))
+                       goto error;
+       }
+       switch (reg_width) {
+       case sizeof(u8):
+               ioread8_rep(addr, buffer, count);
+               break;
+       case sizeof(u16):
+               SSB_WARN_ON(count & 1);
+               ioread16_rep(addr, buffer, count >> 1);
+               break;
+       case sizeof(u32):
+               SSB_WARN_ON(count & 3);
+               ioread32_rep(addr, buffer, count >> 2);
+               break;
+       default:
+               SSB_WARN_ON(1);
+       }
+
+       return;
+error:
+       memset(buffer, 0xFF, count);
+}
+#endif /* CONFIG_SSB_BLOCKIO */
+
+static void ssb_pci_write8(struct ssb_device *dev, u16 offset, u8 value)
+{
+       struct ssb_bus *bus = dev->bus;
+
+       if (unlikely(ssb_pci_assert_buspower(bus)))
+               return;
+       if (unlikely(bus->mapped_device != dev)) {
+               if (unlikely(ssb_pci_switch_core(bus, dev)))
+                       return;
+       }
+       iowrite8(value, bus->mmio + offset);
+}
+
 static void ssb_pci_write16(struct ssb_device *dev, u16 offset, u16 value)
 {
        struct ssb_bus *bus = dev->bus;
@@ -567,79 +830,63 @@ static void ssb_pci_write32(struct ssb_device *dev, u16 offset, u32 value)
        iowrite32(value, bus->mmio + offset);
 }
 
+#ifdef CONFIG_SSB_BLOCKIO
+static void ssb_pci_block_write(struct ssb_device *dev, const void *buffer,
+                               size_t count, u16 offset, u8 reg_width)
+{
+       struct ssb_bus *bus = dev->bus;
+       void __iomem *addr = bus->mmio + offset;
+
+       if (unlikely(ssb_pci_assert_buspower(bus)))
+               return;
+       if (unlikely(bus->mapped_device != dev)) {
+               if (unlikely(ssb_pci_switch_core(bus, dev)))
+                       return;
+       }
+       switch (reg_width) {
+       case sizeof(u8):
+               iowrite8_rep(addr, buffer, count);
+               break;
+       case sizeof(u16):
+               SSB_WARN_ON(count & 1);
+               iowrite16_rep(addr, buffer, count >> 1);
+               break;
+       case sizeof(u32):
+               SSB_WARN_ON(count & 3);
+               iowrite32_rep(addr, buffer, count >> 2);
+               break;
+       default:
+               SSB_WARN_ON(1);
+       }
+}
+#endif /* CONFIG_SSB_BLOCKIO */
+
 /* Not "static", as it's used in main.c */
 const struct ssb_bus_ops ssb_pci_ops = {
+       .read8          = ssb_pci_read8,
        .read16         = ssb_pci_read16,
        .read32         = ssb_pci_read32,
+       .write8         = ssb_pci_write8,
        .write16        = ssb_pci_write16,
        .write32        = ssb_pci_write32,
+#ifdef CONFIG_SSB_BLOCKIO
+       .block_read     = ssb_pci_block_read,
+       .block_write    = ssb_pci_block_write,
+#endif
 };
 
-static int sprom2hex(const u16 *sprom, char *buf, size_t buf_len, u16 size)
-{
-       int i, pos = 0;
-
-       for (i = 0; i < size; i++)
-               pos += snprintf(buf + pos, buf_len - pos - 1,
-                               "%04X", swab16(sprom[i]) & 0xFFFF);
-       pos += snprintf(buf + pos, buf_len - pos - 1, "\n");
-
-       return pos + 1;
-}
-
-static int hex2sprom(u16 *sprom, const char *dump, size_t len, u16 size)
-{
-       char tmp[5] = { 0 };
-       int cnt = 0;
-       unsigned long parsed;
-
-       if (len < size * 2)
-               return -EINVAL;
-
-       while (cnt < size) {
-               memcpy(tmp, dump, 4);
-               dump += 4;
-               parsed = simple_strtoul(tmp, NULL, 16);
-               sprom[cnt++] = swab16((u16)parsed);
-       }
-
-       return 0;
-}
-
 static ssize_t ssb_pci_attr_sprom_show(struct device *pcidev,
                                       struct device_attribute *attr,
                                       char *buf)
 {
        struct pci_dev *pdev = container_of(pcidev, struct pci_dev, dev);
        struct ssb_bus *bus;
-       u16 *sprom;
-       int err = -ENODEV;
-       ssize_t count = 0;
 
        bus = ssb_pci_dev_to_bus(pdev);
        if (!bus)
-               goto out;
-       err = -ENOMEM;
-       sprom = kcalloc(bus->sprom_size, sizeof(u16), GFP_KERNEL);
-       if (!sprom)
-               goto out;
-
-       /* Use interruptible locking, as the SPROM write might
-        * be holding the lock for several seconds. So allow userspace
-        * to cancel operation. */
-       err = -ERESTARTSYS;
-       if (mutex_lock_interruptible(&bus->pci_sprom_mutex))
-               goto out_kfree;
-       sprom_do_read(bus, sprom);
-       mutex_unlock(&bus->pci_sprom_mutex);
+               return -ENODEV;
 
-       count = sprom2hex(sprom, buf, PAGE_SIZE, bus->sprom_size);
-       err = 0;
-
-out_kfree:
-       kfree(sprom);
-out:
-       return err ? err : count;
+       return ssb_attr_sprom_show(bus, buf, sprom_do_read);
 }
 
 static ssize_t ssb_pci_attr_sprom_store(struct device *pcidev,
@@ -648,55 +895,13 @@ static ssize_t ssb_pci_attr_sprom_store(struct device *pcidev,
 {
        struct pci_dev *pdev = container_of(pcidev, struct pci_dev, dev);
        struct ssb_bus *bus;
-       u16 *sprom;
-       int res = 0, err = -ENODEV;
 
        bus = ssb_pci_dev_to_bus(pdev);
        if (!bus)
-               goto out;
-       err = -ENOMEM;
-       sprom = kcalloc(bus->sprom_size, sizeof(u16), GFP_KERNEL);
-       if (!sprom)
-               goto out;
-       err = hex2sprom(sprom, buf, count, bus->sprom_size);
-       if (err) {
-               err = -EINVAL;
-               goto out_kfree;
-       }
-       err = sprom_check_crc(sprom, bus->sprom_size);
-       if (err) {
-               err = -EINVAL;
-               goto out_kfree;
-       }
+               return -ENODEV;
 
-       /* Use interruptible locking, as the SPROM write might
-        * be holding the lock for several seconds. So allow userspace
-        * to cancel operation. */
-       err = -ERESTARTSYS;
-       if (mutex_lock_interruptible(&bus->pci_sprom_mutex))
-               goto out_kfree;
-       err = ssb_devices_freeze(bus);
-       if (err == -EOPNOTSUPP) {
-               ssb_printk(KERN_ERR PFX "SPROM write: Could not freeze devices. "
-                          "No suspend support. Is CONFIG_PM enabled?\n");
-               goto out_unlock;
-       }
-       if (err) {
-               ssb_printk(KERN_ERR PFX "SPROM write: Could not freeze all devices\n");
-               goto out_unlock;
-       }
-       res = sprom_do_write(bus, sprom);
-       err = ssb_devices_thaw(bus);
-       if (err)
-               ssb_printk(KERN_ERR PFX "SPROM write: Could not thaw all devices\n");
-out_unlock:
-       mutex_unlock(&bus->pci_sprom_mutex);
-out_kfree:
-       kfree(sprom);
-out:
-       if (res)
-               return res;
-       return err ? err : count;
+       return ssb_attr_sprom_store(bus, buf, count,
+                                   sprom_check_crc, sprom_do_write);
 }
 
 static DEVICE_ATTR(ssb_sprom, 0600,
@@ -723,7 +928,7 @@ int ssb_pci_init(struct ssb_bus *bus)
                return 0;
 
        pdev = bus->host_pci;
-       mutex_init(&bus->pci_sprom_mutex);
+       mutex_init(&bus->sprom_mutex);
        err = device_create_file(&pdev->dev, &dev_attr_ssb_sprom);
        if (err)
                goto out;