strip the kernel version suffix from target directories, except for brcm-2.4 (the -2.4 will be included in the board name here). CONFIG_LINUX_<ver>_<board> becomes CONFIG_TARGET_<board>, same for profiles.

SVN-Revision: 8653

53 files changed, 8620 insertions, 0 deletions

diff --git a/target/linux/brcm63xx/Makefile b/target/linux/brcm63xx/Makefile
new file mode 100644
index 0000000..32bfd06
--- /dev/null
+++ b/target/linux/brcm63xx/Makefile
@@ -0,0 +1,26 @@
+# 
+# Copyright (C) 2006 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+include $(TOPDIR)/rules.mk
+
+ARCH:=mips
+BOARD:=brcm63xx
+BOARDNAME:=Broadcom BCM963xx
+FEATURES:=squashfs jffs2 broken usb atm
+
+LINUX_VERSION:=2.6.22.4
+
+define Target/Description
+	Build firmware images for Broadcom based xDSL/routers
+	(e.g. Inventel Livebox, Siemens SE515)
+endef
+
+include $(INCLUDE_DIR)/kernel-build.mk
+
+# include the profiles
+-include profiles/*.mk
+
+$(eval $(call BuildKernel))
diff --git a/target/linux/brcm63xx/config/default b/target/linux/brcm63xx/config/default
new file mode 100644
index 0000000..abef335
--- /dev/null
+++ b/target/linux/brcm63xx/config/default
@@ -0,0 +1,352 @@
+CONFIG_32BIT=y
+# CONFIG_64BIT is not set
+# CONFIG_64BIT_PHYS_ADDR is not set
+# CONFIG_8139TOO is not set
+# CONFIG_ARCH_HAS_ILOG2_U32 is not set
+# CONFIG_ARCH_HAS_ILOG2_U64 is not set
+CONFIG_ATM_DRIVERS=y
+CONFIG_AUDIT=y
+CONFIG_AUDIT_GENERIC=y
+CONFIG_BASE_SMALL=0
+CONFIG_BCM963XX=y
+CONFIG_BINFMT_MISC=m
+CONFIG_BITREVERSE=y
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_IO_TRACE=y
+# CONFIG_BLK_DEV_LOOP is not set
+# CONFIG_BLK_DEV_NBD is not set
+# CONFIG_BROADCOM_PHY is not set
+# CONFIG_BSD_DISKLABEL is not set
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_CFE=y
+CONFIG_CICADA_PHY=m
+# CONFIG_CIFS is not set
+# CONFIG_CLS_U32_MARK is not set
+# CONFIG_CONFIGFS_FS is not set
+CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_HAS_LLSC=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_SYNC=y
+# CONFIG_CPU_LITTLE_ENDIAN is not set
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_MIPS32_R1=y
+# CONFIG_CPU_MIPS32_R2 is not set
+# CONFIG_CPU_MIPS64_R1 is not set
+# CONFIG_CPU_MIPS64_R2 is not set
+CONFIG_CPU_MIPSR1=y
+# CONFIG_CPU_NEVADA is not set
+# CONFIG_CPU_R10000 is not set
+# CONFIG_CPU_R3000 is not set
+# CONFIG_CPU_R4300 is not set
+# CONFIG_CPU_R4X00 is not set
+# CONFIG_CPU_R5000 is not set
+# CONFIG_CPU_R5432 is not set
+# CONFIG_CPU_R6000 is not set
+# CONFIG_CPU_R8000 is not set
+# CONFIG_CPU_RM7000 is not set
+# CONFIG_CPU_RM9000 is not set
+# CONFIG_CPU_SB1 is not set
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+# CONFIG_CPU_TX39XX is not set
+# CONFIG_CPU_TX49XX is not set
+# CONFIG_CPU_VR41XX is not set
+CONFIG_CRAMFS=y
+CONFIG_CRYPTO_AES=y
+# CONFIG_CRYPTO_ANUBIS is not set
+CONFIG_CRYPTO_BLKCIPHER=m
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_CAST5 is not set
+# CONFIG_CRYPTO_CAST6 is not set
+CONFIG_CRYPTO_CBC=m
+# CONFIG_CRYPTO_CRC32C is not set
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HMAC=y
+# CONFIG_CRYPTO_KHAZAD is not set
+CONFIG_CRYPTO_MD4=y
+# CONFIG_CRYPTO_NULL is not set
+# CONFIG_CRYPTO_SERPENT is not set
+CONFIG_CRYPTO_SHA1=y
+# CONFIG_CRYPTO_SHA256 is not set
+# CONFIG_CRYPTO_SHA512 is not set
+# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_TEST is not set
+# CONFIG_CRYPTO_TGR192 is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+# CONFIG_CRYPTO_WP512 is not set
+CONFIG_DAVICOM_PHY=m
+# CONFIG_DDB5477 is not set
+CONFIG_DEBUG_FS=y
+CONFIG_DEFAULT_BIC=y
+CONFIG_DEFAULT_CFQ=y
+# CONFIG_DEFAULT_DEADLINE is not set
+CONFIG_DEFAULT_IOSCHED="cfq"
+CONFIG_DEFAULT_TCP_CONG="bic"
+# CONFIG_DEFAULT_VEGAS is not set
+# CONFIG_DM9000 is not set
+CONFIG_DMA_NEED_PCI_MAP_STATE=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DUMMY=m
+CONFIG_ELF_CORE=y
+CONFIG_EQUALIZER=m
+# CONFIG_EXT3_FS_POSIX_ACL is not set
+# CONFIG_EXT3_FS_SECURITY is not set
+CONFIG_EXT3_FS_XATTR=y
+# CONFIG_FIXED_PHY is not set
+CONFIG_FS_MBCACHE=m
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FUSE_FS=m
+CONFIG_FW_LOADER=m
+CONFIG_GENERIC_FIND_NEXT_BIT=y
+# CONFIG_GENERIC_GPIO is not set
+# CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ is not set
+# CONFIG_GEN_RTC is not set
+# CONFIG_HAMRADIO is not set
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
+CONFIG_HID=m
+CONFIG_HWMON=y
+# CONFIG_HWMON_DEBUG_CHIP is not set
+CONFIG_HW_HAS_PCI=y
+CONFIG_HW_RANDOM=y
+CONFIG_HZ=250
+# CONFIG_HZ_100 is not set
+CONFIG_HZ_250=y
+# CONFIG_I2C is not set
+# CONFIG_IDE is not set
+CONFIG_INOTIFY=y
+CONFIG_INOTIFY_USER=y
+# CONFIG_INPUT is not set
+CONFIG_IOSCHED_CFQ=y
+# CONFIG_IOSCHED_DEADLINE is not set
+# CONFIG_IP6_NF_MATCH_FRAG is not set
+# CONFIG_IP6_NF_MATCH_HL is not set
+# CONFIG_IP6_NF_MATCH_IPV6HEADER is not set
+# CONFIG_IP6_NF_MATCH_OPTS is not set
+# CONFIG_IP6_NF_MATCH_RT is not set
+# CONFIG_IP6_NF_RAW is not set
+# CONFIG_IP6_NF_TARGET_HL is not set
+# CONFIG_IP6_NF_TARGET_LOG is not set
+CONFIG_IPV6_PRIVACY=y
+CONFIG_IPV6_ROUTE_INFO=y
+CONFIG_IPV6_TUNNEL=m
+CONFIG_IP_MROUTE=y
+# CONFIG_IP_NF_ARPTABLES is not set
+# CONFIG_IP_NF_MATCH_ADDRTYPE is not set
+# CONFIG_IP_NF_TARGET_LOG is not set
+# CONFIG_IP_NF_TARGET_NETMAP is not set
+CONFIG_IP_NF_TARGET_REJECT=m
+# CONFIG_IP_NF_TARGET_SAME is not set
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_IP_SCTP=m
+CONFIG_IRQ_CPU=y
+# CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
+CONFIG_JFFS2_FS_DEBUG=0
+CONFIG_JFFS2_SUMMARY=y
+# CONFIG_JFS_FS is not set
+CONFIG_KALLSYMS=y
+CONFIG_KALLSYMS_EXTRA_PASS=y
+CONFIG_KEYBOARD_ATKBD=m
+# CONFIG_KEYBOARD_LKKBD is not set
+# CONFIG_KEYBOARD_NEWTON is not set
+# CONFIG_KEYBOARD_STOWAWAY is not set
+# CONFIG_KEYBOARD_SUNKBD is not set
+# CONFIG_KEYBOARD_XTKBD is not set
+CONFIG_KMOD=y
+CONFIG_LBD=y
+# CONFIG_LEDS_TRIGGER_HEARTBEAT is not set
+# CONFIG_LLC2 is not set
+CONFIG_LXT_PHY=m
+# CONFIG_MACH_ALCHEMY is not set
+# CONFIG_MACH_DECSTATION is not set
+# CONFIG_MACH_JAZZ is not set
+# CONFIG_MACH_VR41XX is not set
+# CONFIG_MAC_PARTITION is not set
+# CONFIG_MAC80211_DEBUGFS is not set
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MARVELL_PHY=m
+CONFIG_MII=m
+# CONFIG_MINIX_FS is not set
+CONFIG_MIPS=y
+# CONFIG_MIPS_ATLAS is not set
+# CONFIG_MIPS_BOSPORUS is not set
+# CONFIG_MIPS_COBALT is not set
+# CONFIG_MIPS_DB1000 is not set
+# CONFIG_MIPS_DB1100 is not set
+# CONFIG_MIPS_DB1200 is not set
+# CONFIG_MIPS_DB1500 is not set
+# CONFIG_MIPS_DB1550 is not set
+# CONFIG_MIPS_EV64120 is not set
+CONFIG_MIPS_L1_CACHE_SHIFT=5
+# CONFIG_MIPS_MALTA is not set
+# CONFIG_MIPS_MIRAGE is not set
+# CONFIG_MIPS_MTX1 is not set
+CONFIG_MIPS_MT_DISABLED=y
+# CONFIG_MIPS_MT_SMP is not set
+# CONFIG_MIPS_MT_SMTC is not set
+# CONFIG_MIPS_PB1000 is not set
+# CONFIG_MIPS_PB1100 is not set
+# CONFIG_MIPS_PB1200 is not set
+# CONFIG_MIPS_PB1500 is not set
+# CONFIG_MIPS_PB1550 is not set
+# CONFIG_MIPS_SEAD is not set
+# CONFIG_MIPS_SIM is not set
+# CONFIG_MIPS_VPE_LOADER is not set
+# CONFIG_MIPS_XXS1500 is not set
+CONFIG_MODULE_FORCE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+# CONFIG_MOMENCO_JAGUAR_ATX is not set
+# CONFIG_MOMENCO_OCELOT is not set
+# CONFIG_MOMENCO_OCELOT_3 is not set
+# CONFIG_MOMENCO_OCELOT_C is not set
+# CONFIG_MOMENCO_OCELOT_G is not set
+CONFIG_MTD=y
+# CONFIG_MTD_ABSENT is not set
+CONFIG_MTD_BCM963XX=y
+CONFIG_MTD_BLKDEVS=y
+CONFIG_MTD_BLOCK=y
+# CONFIG_MTD_BLOCK2MTD is not set
+CONFIG_MTD_CFI=y
+CONFIG_MTD_CFI_ADV_OPTIONS=y
+CONFIG_MTD_CFI_AMDSTD=y
+CONFIG_MTD_CFI_BE_BYTE_SWAP=y
+# CONFIG_MTD_CFI_GEOMETRY is not set
+CONFIG_MTD_CFI_I1=y
+CONFIG_MTD_CFI_I2=y
+# CONFIG_MTD_CFI_I4 is not set
+# CONFIG_MTD_CFI_I8 is not set
+CONFIG_MTD_CFI_INTELEXT=y
+# CONFIG_MTD_CFI_LE_BYTE_SWAP is not set
+# CONFIG_MTD_CFI_NOSWAP is not set
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_CFI_UTIL=y
+CONFIG_MTD_CHAR=y
+CONFIG_MTD_CMDLINE_PARTS=y
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+CONFIG_MTD_CONCAT=y
+CONFIG_MTD_DEBUG=y
+CONFIG_MTD_DEBUG_VERBOSE=3
+# CONFIG_MTD_DOC2000 is not set
+# CONFIG_MTD_DOC2001 is not set
+# CONFIG_MTD_DOC2001PLUS is not set
+CONFIG_MTD_GEN_PROBE=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_MAP_BANK_WIDTH_1=y
+# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
+CONFIG_MTD_MAP_BANK_WIDTH_2=y
+# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
+CONFIG_MTD_MAP_BANK_WIDTH_4=y
+# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
+# CONFIG_MTD_MTDRAM is not set
+# CONFIG_MTD_OBSOLETE_CHIPS is not set
+# CONFIG_MTD_ONENAND is not set
+# CONFIG_MTD_OTP is not set
+CONFIG_MTD_PARTITIONS=y
+# CONFIG_MTD_PHRAM is not set
+# CONFIG_MTD_PHYSMAP is not set
+# CONFIG_MTD_PLATRAM is not set
+# CONFIG_MTD_PMC551 is not set
+# CONFIG_MTD_RAM is not set
+CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK=-1
+CONFIG_MTD_REDBOOT_PARTS=y
+CONFIG_MTD_REDBOOT_PARTS_READONLY=y
+CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED=y
+# CONFIG_MTD_ROM is not set
+# CONFIG_MTD_SLRAM is not set
+# CONFIG_NATSEMI is not set
+# CONFIG_NE2K_PCI is not set
+CONFIG_NETFILTER_NETLINK=m
+CONFIG_NETFILTER_NETLINK_LOG=m
+CONFIG_NETFILTER_NETLINK_QUEUE=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+# CONFIG_NETFILTER_XT_MATCH_DSCP is not set
+# CONFIG_NETFILTER_XT_TARGET_DSCP is not set
+# CONFIG_NET_ACT_IPT is not set
+CONFIG_NET_ACT_SIMP=m
+CONFIG_NET_KEY=y
+CONFIG_NET_SCH_CLK_GETTIMEOFDAY=y
+# CONFIG_NET_SCH_CLK_JIFFIES is not set
+CONFIG_NET_SCH_FIFO=y
+# CONFIG_NET_VENDOR_3COM is not set
+# CONFIG_NETDEV_1000 is not set
+CONFIG_NLS=y
+CONFIG_NLS_ASCII=m
+# CONFIG_PAGE_SIZE_16KB is not set
+CONFIG_PAGE_SIZE_4KB=y
+# CONFIG_PAGE_SIZE_64KB is not set
+# CONFIG_PAGE_SIZE_8KB is not set
+CONFIG_PHYLIB=m
+# CONFIG_PMC_YOSEMITE is not set
+# CONFIG_PNPACPI is not set
+# CONFIG_PNX8550_JBS is not set
+# CONFIG_PNX8550_STB810 is not set
+CONFIG_POSIX_MQUEUE=y
+CONFIG_QSEMI_PHY=m
+CONFIG_RELAY=y
+# CONFIG_ROMFS_FS is not set
+# CONFIG_RTC is not set
+CONFIG_RWSEM_GENERIC_SPINLOCK=y
+CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+# CONFIG_SCSI_MULTI_LUN is not set
+# CONFIG_SCTP_DBG_MSG is not set
+# CONFIG_SCTP_DBG_OBJCNT is not set
+CONFIG_SCTP_HMAC_MD5=y
+# CONFIG_SCTP_HMAC_NONE is not set
+# CONFIG_SCTP_HMAC_SHA1 is not set
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIO=m
+CONFIG_SERIO_I8042=m
+CONFIG_SERIO_LIBPS2=m
+# CONFIG_SERIO_PCIPS2 is not set
+# CONFIG_SERIO_RAW is not set
+CONFIG_SERIO_SERPORT=m
+# CONFIG_SGI_IP22 is not set
+# CONFIG_SGI_IP27 is not set
+# CONFIG_SGI_IP32 is not set
+CONFIG_SHAPER=m
+# CONFIG_SIBYTE_BIGSUR is not set
+# CONFIG_SIBYTE_CARMEL is not set
+# CONFIG_SIBYTE_CRHINE is not set
+# CONFIG_SIBYTE_CRHONE is not set
+# CONFIG_SIBYTE_LITTLESUR is not set
+# CONFIG_SIBYTE_PTSWARM is not set
+# CONFIG_SIBYTE_RHONE is not set
+# CONFIG_SIBYTE_SENTOSA is not set
+# CONFIG_SIBYTE_SWARM is not set
+# CONFIG_SMB_FS is not set
+# CONFIG_SMSC_PHY is not set
+# CONFIG_SOUND is not set
+# CONFIG_SPARSEMEM_STATIC is not set
+CONFIG_SQUASHFS_EMBEDDED=y
+CONFIG_SQUASHFS_VMALLOC=y
+CONFIG_SYSVIPC_SYSCTL=y
+CONFIG_SYS_HAS_CPU_MIPS32_R1=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+# CONFIG_TC35815 is not set
+CONFIG_TCP_CONG_BIC=y
+# CONFIG_TCP_CONG_HSTCP is not set
+# CONFIG_TCP_CONG_HYBLA is not set
+# CONFIG_TCP_CONG_LP is not set
+# CONFIG_TCP_CONG_SCALABLE is not set
+# CONFIG_TCP_CONG_VEGAS is not set
+# CONFIG_TCP_CONG_VENO is not set
+CONFIG_TIPC=m
+# CONFIG_TIPC_ADVANCED is not set
+# CONFIG_TIPC_DEBUG is not set
+# CONFIG_TOSHIBA_JMR3927 is not set
+# CONFIG_TOSHIBA_RBTX4927 is not set
+# CONFIG_TOSHIBA_RBTX4938 is not set
+CONFIG_TRAD_SIGNALS=y
+# CONFIG_UNUSED_SYMBOLS is not set
+# CONFIG_USB_EHCI_HCD is not set
+# CONFIG_USB_GTCO is not set
+# CONFIG_USB_UHCI_HCD is not set
+# CONFIG_VIA_RHINE is not set
+CONFIG_VLAN_8021Q=m
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_WAN_ROUTER=m
+# CONFIG_WATCHDOG is not set
diff --git a/target/linux/brcm63xx/files/arch/mips/bcm963xx/Makefile b/target/linux/brcm63xx/files/arch/mips/bcm963xx/Makefile
new file mode 100644
index 0000000..a9d1e55
--- /dev/null
+++ b/target/linux/brcm63xx/files/arch/mips/bcm963xx/Makefile
@@ -0,0 +1,9 @@
+#
+# Makefile for the Broadcom BCM963xx SoC specific parts of the kernel
+#
+# Copyright (C) 2004 Broadcom Corporation
+#
+obj-y           := irq.o prom.o setup.o time.o ser_init.o int-handler.o info.o wdt.o
+
+SRCBASE         := $(TOPDIR)
+EXTRA_CFLAGS    += -I$(SRCBASE)/include
diff --git a/target/linux/brcm63xx/files/arch/mips/bcm963xx/info.c b/target/linux/brcm63xx/files/arch/mips/bcm963xx/info.c
new file mode 100644
index 0000000..d50b601
--- /dev/null
+++ b/target/linux/brcm63xx/files/arch/mips/bcm963xx/info.c
@@ -0,0 +1,102 @@
+/*
+ * $Id$
+ *
+ * Copyright (C) 2007 OpenWrt.org
+ * Copyright (C) 2007 Gabor Juhos <juhosg at openwrt.org>
+ * Copyright (C) 2007 Florian Fainelli <florian@openwrt.org>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/types.h>
+#include <linux/autoconf.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+
+#include <asm/bootinfo.h>
+#include <asm/addrspace.h>
+#include <asm/string.h>
+#include <asm/mach-bcm963xx/bootloaders.h>
+
+static char *boot_loader_names[BOOT_LOADER_LAST+1] = {
+        [BOOT_LOADER_UNKNOWN]   = "Unknown",
+        [BOOT_LOADER_CFE]       = "CFE",
+        [BOOT_LOADER_REDBOOT]	= "RedBoot",
+	[BOOT_LOADER_CFE2]	= "CFEv2"
+};
+
+/* boot loaders specific definitions */
+#define CFE_EPTSEAL	0x43464531 /* CFE1 is the magic number to recognize CFE from other bootloaders */
+
+int boot_loader_type;
+/*
+ * Boot loader detection routines
+ */
+static int __init detect_cfe(void)
+{
+	/*
+	 * This method only works, when we are booted directly from the CFE.
+	 */
+	uint32_t cfe_handle = (uint32_t) fw_arg0;
+	uint32_t cfe_a1_val = (uint32_t) fw_arg1;
+	uint32_t cfe_entry = (uint32_t) fw_arg2;
+	uint32_t cfe_seal = (uint32_t) fw_arg3;
+
+	/* Check for CFE by finding the CFE magic number */
+	if (cfe_seal != CFE_EPTSEAL)
+		/* We are not booted from CFE */
+		return 0;
+
+	/* cfe_a1_val must be 0, because only one CPU present in the ADM5120 SoC */
+	if (cfe_a1_val != 0)
+		return 0;
+
+	/* The cfe_handle, and the cfe_entry must be kernel mode addresses */
+	if ((cfe_handle < KSEG0) || (cfe_entry < KSEG0))
+		return 0;
+
+	return 1;
+}
+
+static int __init detect_redboot(void)
+{
+	/* On Inventel Livebox, the boot loader is passed as a command line argument, check for it */
+	if (!strncmp(arcs_cmdline, "boot_loader=RedBoot", 19))
+		return 1;
+	return 0;
+}
+
+void __init detect_bootloader(void)
+{
+	if (detect_cfe()) {
+		boot_loader_type = BOOT_LOADER_CFE;
+	}
+
+	if (detect_redboot()) {
+		boot_loader_type = BOOT_LOADER_REDBOOT;
+	}
+	else {
+		/* Some devices are using CFE, but it is not detected as is */
+		boot_loader_type = BOOT_LOADER_CFE2;
+	}
+	printk("Boot loader is : %s\n", boot_loader_names[boot_loader_type]);
+}
+
+void __init detect_board(void)
+{
+	switch (boot_loader_type)
+	{
+		case BOOT_LOADER_CFE:
+			break;
+		case BOOT_LOADER_REDBOOT:
+			break;
+		default:
+			break;
+	}
+}
+
+EXPORT_SYMBOL(boot_loader_type);
diff --git a/target/linux/brcm63xx/files/arch/mips/bcm963xx/int-handler.S b/target/linux/brcm63xx/files/arch/mips/bcm963xx/int-handler.S
new file mode 100644
index 0000000..a7a9c9d
--- /dev/null
+++ b/target/linux/brcm63xx/files/arch/mips/bcm963xx/int-handler.S
@@ -0,0 +1,59 @@
+/*
+<:copyright-gpl 
+ Copyright 2002 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+/*
+ * Generic interrupt handler for Broadcom MIPS boards
+ */
+
+#include <linux/autoconf.h>
+
+#include <asm/asm.h>
+#include <asm/mipsregs.h>
+#include <asm/regdef.h>
+#include <asm/stackframe.h>
+
+/*
+ *	MIPS IRQ	Source
+ *      --------        ------
+ *             0	Software (ignored)
+ *             1        Software (ignored)
+ *             2        Combined hardware interrupt (hw0)
+ *             3        Hardware
+ *             4        Hardware
+ *             5        Hardware
+ *             6        Hardware
+ *             7        R4k timer
+ */
+
+	.text
+	.set	noreorder
+	.set	noat
+	.align	5
+	NESTED(brcmIRQ, PT_SIZE, sp)
+	SAVE_ALL
+	CLI
+	.set	noreorder
+	.set	at
+
+	jal		plat_irq_dispatch
+	move	a0, sp
+
+	j	ret_from_irq
+	nop
+		
+	END(brcmIRQ)
diff --git a/target/linux/brcm63xx/files/arch/mips/bcm963xx/irq.c b/target/linux/brcm63xx/files/arch/mips/bcm963xx/irq.c
new file mode 100644
index 0000000..962cd37
--- /dev/null
+++ b/target/linux/brcm63xx/files/arch/mips/bcm963xx/irq.c
@@ -0,0 +1,258 @@
+/*
+<:copyright-gpl 
+ Copyright 2002 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+/*
+ * Interrupt control functions for Broadcom 963xx MIPS boards
+ */
+
+#include <asm/atomic.h>
+
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/irq.h>
+#include <linux/interrupt.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+
+#include <asm/irq.h>
+#include <asm/mipsregs.h>
+#include <asm/addrspace.h>
+#include <asm/signal.h>
+#include <6348_map_part.h>
+#include <6348_intr.h>
+#include <bcm_map_part.h>
+#include <bcm_intr.h>
+
+static void irq_dispatch_int(struct pt_regs *regs)
+{
+	unsigned int pendingIrqs;
+	static unsigned int irqBit;
+	static unsigned int isrNumber = 31;
+
+	pendingIrqs = PERF->IrqStatus & PERF->IrqMask;
+	if (!pendingIrqs) {
+		return;
+	}
+
+	while (1) {
+	irqBit <<= 1;
+	isrNumber++;
+	if (isrNumber == 32) {
+		isrNumber = 0;
+		irqBit = 0x1;
+	}
+	if (pendingIrqs & irqBit) {
+			PERF->IrqMask &= ~irqBit; // mask
+			do_IRQ(isrNumber + INTERNAL_ISR_TABLE_OFFSET);
+		break;
+	}
+	}
+}
+
+static void irq_dispatch_ext(uint32 irq)
+{
+	if (!(PERF->ExtIrqCfg & (1 << (irq - INTERRUPT_ID_EXTERNAL_0 + EI_MASK_SHFT)))) {
+	printk("**** Ext IRQ mask. Should not dispatch ****\n");
+	}
+	/* disable and clear interrupt in the controller */
+	PERF->ExtIrqCfg |= (1 << (irq - INTERRUPT_ID_EXTERNAL_0 + EI_CLEAR_SHFT));
+	PERF->ExtIrqCfg &= ~(1 << (irq - INTERRUPT_ID_EXTERNAL_0 + EI_MASK_SHFT));
+	do_IRQ(irq);
+}
+
+
+extern void brcm_timer_interrupt(struct pt_regs *regs);
+
+asmlinkage void plat_irq_dispatch(struct pt_regs *regs)
+{
+	u32 cause;
+	while((cause = (read_c0_cause()& CAUSEF_IP))) {
+		if (cause & CAUSEF_IP7)
+			brcm_timer_interrupt(regs);
+		else if (cause & CAUSEF_IP2)
+			irq_dispatch_int(regs);
+		else if (cause & CAUSEF_IP3)
+			irq_dispatch_ext(INTERRUPT_ID_EXTERNAL_0);
+		else if (cause & CAUSEF_IP4)
+			irq_dispatch_ext(INTERRUPT_ID_EXTERNAL_1);
+		else if (cause & CAUSEF_IP5)
+			irq_dispatch_ext(INTERRUPT_ID_EXTERNAL_2);
+		else if (cause & CAUSEF_IP6)
+			irq_dispatch_ext(INTERRUPT_ID_EXTERNAL_3);
+		local_irq_disable();
+	}
+}
+
+
+void enable_brcm_irq(unsigned int irq)
+{
+	unsigned long flags;
+
+	local_irq_save(flags);
+	if( irq >= INTERNAL_ISR_TABLE_OFFSET ) {
+	PERF->IrqMask |= (1 << (irq - INTERNAL_ISR_TABLE_OFFSET));
+	}
+	else if (irq >= INTERRUPT_ID_EXTERNAL_0 && irq <= INTERRUPT_ID_EXTERNAL_3) {
+	/* enable and clear interrupt in the controller */
+	PERF->ExtIrqCfg |= (1 << (irq - INTERRUPT_ID_EXTERNAL_0 + EI_CLEAR_SHFT));
+	PERF->ExtIrqCfg |= (1 << (irq - INTERRUPT_ID_EXTERNAL_0 + EI_MASK_SHFT));
+	}
+	local_irq_restore(flags);
+}
+
+void disable_brcm_irq(unsigned int irq)
+{
+	unsigned long flags;
+
+	local_irq_save(flags);
+	if( irq >= INTERNAL_ISR_TABLE_OFFSET ) {
+	PERF->IrqMask &= ~(1 << (irq - INTERNAL_ISR_TABLE_OFFSET));
+	}
+	else if (irq >= INTERRUPT_ID_EXTERNAL_0 && irq <= INTERRUPT_ID_EXTERNAL_3) {
+	/* disable interrupt in the controller */
+	PERF->ExtIrqCfg &= ~(1 << (irq - INTERRUPT_ID_EXTERNAL_0 + EI_MASK_SHFT));
+	}
+	local_irq_restore(flags);
+}
+
+void ack_brcm_irq(unsigned int irq)
+{
+	/* Already done in brcm_irq_dispatch */
+}
+
+unsigned int startup_brcm_irq(unsigned int irq)
+{
+	enable_brcm_irq(irq);
+
+	return 0; /* never anything pending */
+}
+
+unsigned int startup_brcm_none(unsigned int irq)
+{
+	return 0;
+}
+
+void end_brcm_irq(unsigned int irq)
+{
+	if (!(irq_desc[irq].status & (IRQ_DISABLED|IRQ_INPROGRESS)))
+		enable_brcm_irq(irq);
+}
+
+void end_brcm_none(unsigned int irq)
+{
+}
+
+static struct hw_interrupt_type brcm_irq_type = {
+	.typename	= "MIPS",
+	.startup	= startup_brcm_irq,
+	.shutdown	= disable_brcm_irq,
+	.enable	= enable_brcm_irq,
+	.disable	= disable_brcm_irq,
+	.ack	= ack_brcm_irq,
+	.end	= end_brcm_irq,
+	.set_affinity = NULL
+};
+
+static struct hw_interrupt_type brcm_irq_no_end_type = {
+	.typename	= "MIPS",
+	.startup	= startup_brcm_none,
+	.shutdown	= disable_brcm_irq,
+	.enable	= enable_brcm_irq,
+	.disable	= disable_brcm_irq,
+	.ack	= ack_brcm_irq,
+	.end	= end_brcm_none,
+	.set_affinity = NULL
+};
+
+void __init arch_init_irq(void)
+{
+	int i;
+
+	clear_c0_status(ST0_BEV);
+	change_c0_status(ST0_IM, (IE_IRQ0 | IE_IRQ1 | IE_IRQ2 | IE_IRQ3 | IE_IRQ4));
+
+	for (i = 0; i < NR_IRQS; i++) {
+		irq_desc[i].status = IRQ_DISABLED;
+		irq_desc[i].action = 0;
+		irq_desc[i].depth = 1;
+		irq_desc[i].chip = &brcm_irq_type;
+	}
+}
+
+int request_external_irq(unsigned int irq, 
+	FN_HANDLER handler,
+		unsigned long irqflags, 
+		const char * devname,
+		void *dev_id)
+{
+	unsigned long flags;
+
+	local_irq_save(flags);
+
+	PERF->ExtIrqCfg |= (1 << (irq - INTERRUPT_ID_EXTERNAL_0 + EI_CLEAR_SHFT));      // Clear
+	PERF->ExtIrqCfg &= ~(1 << (irq - INTERRUPT_ID_EXTERNAL_0 + EI_MASK_SHFT));      // Mask
+	PERF->ExtIrqCfg &= ~(1 << (irq - INTERRUPT_ID_EXTERNAL_0 + EI_INSENS_SHFT));    // Edge insesnsitive
+	PERF->ExtIrqCfg |= (1 << (irq - INTERRUPT_ID_EXTERNAL_0 + EI_LEVEL_SHFT));      // Level triggered
+	PERF->ExtIrqCfg &= ~(1 << (irq - INTERRUPT_ID_EXTERNAL_0 + EI_SENSE_SHFT));     // Low level
+
+	local_irq_restore(flags);
+
+	return( request_irq(irq, handler, irqflags, devname, dev_id) );
+}
+
+/* VxWorks compatibility function(s). */
+
+unsigned int BcmHalMapInterrupt(FN_HANDLER pfunc, unsigned int param,
+	unsigned int interruptId)
+{
+	int nRet = -1;
+	char *devname;
+
+	devname = kmalloc(16, GFP_KERNEL);
+	if (devname)
+		sprintf( devname, "brcm_%d", interruptId );
+
+	/* Set the IRQ description to not automatically enable the interrupt at
+	 * the end of an ISR.  The driver that handles the interrupt must
+	 * explicitly call BcmHalInterruptEnable or enable_brcm_irq.  This behavior
+	 * is consistent with interrupt handling on VxWorks.
+	 */
+	irq_desc[interruptId].chip = &brcm_irq_no_end_type;
+
+	if( interruptId >= INTERNAL_ISR_TABLE_OFFSET )
+	{	
+		printk("BcmHalMapInterrupt : internal IRQ\n");
+		nRet = request_irq( interruptId, pfunc, SA_SAMPLE_RANDOM | SA_INTERRUPT, devname, (void *) param );
+	}
+	else if (interruptId >= INTERRUPT_ID_EXTERNAL_0 && interruptId <= INTERRUPT_ID_EXTERNAL_3)
+	{
+		printk("BcmHalMapInterrupt : external IRQ\n");
+		nRet = request_external_irq( interruptId, pfunc, SA_SAMPLE_RANDOM | SA_INTERRUPT, devname, (void *) param );
+	}
+
+	return( nRet );
+}
+
+
+EXPORT_SYMBOL(enable_brcm_irq);
+EXPORT_SYMBOL(disable_brcm_irq);
+EXPORT_SYMBOL(request_external_irq);
+EXPORT_SYMBOL(BcmHalMapInterrupt);
+
diff --git a/target/linux/brcm63xx/files/arch/mips/bcm963xx/prom.c b/target/linux/brcm63xx/files/arch/mips/bcm963xx/prom.c
new file mode 100644
index 0000000..e02d31c
--- /dev/null
+++ b/target/linux/brcm63xx/files/arch/mips/bcm963xx/prom.c
@@ -0,0 +1,73 @@
+/*
+ Copyright 2004 Broadcom Corp. All Rights Reserved.
+ Copyright 2007 OpenWrt,org, Florian Fainelli <florian@openwrt.org>
+
+ This program is free software; you can distribute it and/or modify it
+ under the terms of the GNU General Public License (Version 2) as
+ published by the Free Software Foundation.
+
+ This program is distributed in the hope it will be useful, but WITHOUT
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ for more details.
+
+ You should have received a copy of the GNU General Public License along
+ with this program; if not, write to the Free Software Foundation, Inc.,
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
+*/
+/*
+ * prom.c: PROM library initialization code.
+ *
+ */
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/sched.h>
+#include <linux/bootmem.h>
+#include <linux/blkdev.h>
+
+#include <asm/addrspace.h>
+#include <asm/bootinfo.h>
+#include <asm/cpu.h>
+#include <asm/time.h>
+#include <asm/mach-bcm963xx/bootloaders.h>
+#include <asm/mach-bcm963xx/6348_map_part.h>
+
+#include "../cfe/cfe_private.h"
+
+extern void __init detect_bootloader(void); 
+extern void serial_init(void);
+extern int boot_loader_type;
+
+#define MACH_BCM                    MACH_BCM96348
+
+const char *get_system_type(void)
+{
+	return "Broadcom BCM963xx";
+}
+
+void __init prom_init(void)
+{
+    	serial_init();
+
+    	printk("%s prom init\n", get_system_type() );
+
+    	PERF->IrqMask = 0;
+	
+	/* Detect the bootloader */
+	detect_bootloader();
+
+	/* Do further initialisations depending on the bootloader */
+	if (boot_loader_type == BOOT_LOADER_CFE || boot_loader_type == BOOT_LOADER_CFE2) {
+		cfe_setup(fw_arg0, fw_arg1, fw_arg2, fw_arg3);
+	}
+	/* Register 16MB RAM minus the ADSL SDRAM by default */
+	add_memory_region(0, (0x01000000 - ADSL_SDRAM_IMAGE_SIZE), BOOT_MEM_RAM);
+
+	mips_machgroup = MACH_GROUP_BRCM;
+	mips_machtype = MACH_BCM;
+}
+
+void __init prom_free_prom_memory(void)
+{
+	/* We do not have any memory to free */
+}
diff --git a/target/linux/brcm63xx/files/arch/mips/bcm963xx/ser_init.c b/target/linux/brcm63xx/files/arch/mips/bcm963xx/ser_init.c
new file mode 100644
index 0000000..bb745ae
--- /dev/null
+++ b/target/linux/brcm63xx/files/arch/mips/bcm963xx/ser_init.c
@@ -0,0 +1,181 @@
+/*
+<:copyright-gpl 
+ Copyright 2004 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+/*
+ *  Broadcom bcm63xx serial port initialization, also prepare for printk
+ *  by registering with console_init
+ *   
+ */
+
+#include <linux/autoconf.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/console.h>
+#include <linux/sched.h>
+
+#include <asm/addrspace.h>
+#include <asm/irq.h>
+#include <asm/reboot.h>
+#include <asm/gdb-stub.h>
+#include <asm/mc146818rtc.h> 
+
+#include <bcm_map_part.h>
+#include <6348_map_part.h>
+#include <board.h>
+
+#define  SER63XX_DEFAULT_BAUD      115200
+#define BD_BCM63XX_TIMER_CLOCK_INPUT    (FPERIPH)
+#define stUart ((volatile Uart * const) UART_BASE)
+
+// Transmit interrupts
+#define TXINT       (TXFIFOEMT | TXUNDERR | TXOVFERR)
+// Receive interrupts
+#define RXINT       (RXFIFONE | RXOVFERR)
+
+/* --------------------------------------------------------------------------
+    Name: serial_init
+ Purpose: Initalize the UART
+-------------------------------------------------------------------------- */
+void __init serial_init(void)
+{
+    u32 tmpVal = SER63XX_DEFAULT_BAUD;
+    ULONG clockFreqHz;    
+
+#if defined(CONFIG_BCM96345)
+    // Make sure clock is ticking
+    PERF->blkEnables |= UART_CLK_EN;
+#endif
+		
+    /* Dissable channel's receiver and transmitter.                */
+    stUart->control &= ~(BRGEN|TXEN|RXEN);
+		
+    /*--------------------------------------------------------------------*/
+    /* Write the table value to the clock select register.                */
+    /* DPullen - this is the equation to use:                             */
+    /*       value = clockFreqHz / baud / 32-1;                           */
+    /*   (snmod) Actually you should also take into account any necessary */
+    /*           rounding.  Divide by 16, look at lsb, if 0, divide by 2  */
+    /*           and subtract 1.  If 1, just divide by 2                  */
+    /*--------------------------------------------------------------------*/
+    clockFreqHz = BD_BCM63XX_TIMER_CLOCK_INPUT;
+    tmpVal = (clockFreqHz / tmpVal) / 16;
+    if( tmpVal & 0x01 )
+        tmpVal /= 2;  //Rounding up, so sub is already accounted for
+    else
+        tmpVal = (tmpVal / 2) - 1; // Rounding down so we must sub 1
+    stUart->baudword = tmpVal;
+        
+    /* Finally, re-enable the transmitter and receiver.            */
+    stUart->control |= (BRGEN|TXEN|RXEN);
+
+    stUart->config   = (BITS8SYM | ONESTOP);
+    // Set the FIFO interrupt depth ... stUart->fifocfg  = 0xAA;
+    stUart->fifoctl  =  RSTTXFIFOS | RSTRXFIFOS;
+    stUart->intMask  = 0;       
+    stUart->intMask = RXINT | TXINT;
+}
+
+
+/* prom_putc()
+ * Output a character to the UART
+ */
+void prom_putc(char c)
+{
+	/* Wait for Tx uffer to empty */
+	while (! (READ16(stUart->intStatus) & TXFIFOEMT));
+	/* Send character */
+	stUart->Data = c;
+}
+
+/* prom_puts()
+ * Write a string to the UART
+ */
+void prom_puts(const char *s)
+{
+	while (*s) {
+		if (*s == '\n') {
+			prom_putc('\r');
+		}
+		prom_putc(*s++);
+	}
+}
+
+
+/* prom_getc_nowait()
+ * Returns a character from the UART
+ * Returns -1 if no characters available or corrupted
+ */
+int prom_getc_nowait(void)
+{
+    uint16  uStatus;
+    int    cData = -1;
+
+     uStatus = READ16(stUart->intStatus);
+
+     if (uStatus & RXFIFONE) { /* Do we have a character? */
+           cData =  READ16(stUart->Data) & 0xff; /* Read character */
+           if (uStatus & (RXFRAMERR | RXPARERR)) {  /* If we got an error, throw it away */
+               cData = -1;
+           }
+  }
+
+   return cData;
+}
+
+/* prom_getc()
+ * Returns a charcter from the serial port
+ * Will block until it receives a valid character
+*/
+char prom_getc(void)
+{
+    int    cData = -1;
+
+    /* Loop until we get a valid character */
+    while(cData == -1) {
+	cData = prom_getc_nowait();
+    }
+   return (char) cData;
+}
+
+/* prom_testc()
+ * Returns 0 if no characters available
+ */
+int prom_testc(void)
+{
+    uint16  uStatus;
+
+     uStatus = READ16(stUart->intStatus);
+
+     return (uStatus & RXFIFONE);
+}
+
+#if defined (CONFIG_REMOTE_DEBUG)
+/* Prevent other code from writing to the serial port */
+void _putc(char c) { }
+void _puts(const char *ptr) { }
+#else
+/* Low level outputs call prom routines */
+void _putc(char c) {
+	prom_putc(c);
+}
+void _puts(const char *ptr) {
+	prom_puts(ptr);
+}
+#endif
diff --git a/target/linux/brcm63xx/files/arch/mips/bcm963xx/setup.c b/target/linux/brcm63xx/files/arch/mips/bcm963xx/setup.c
new file mode 100644
index 0000000..70c6ebe
--- /dev/null
+++ b/target/linux/brcm63xx/files/arch/mips/bcm963xx/setup.c
@@ -0,0 +1,472 @@
+/*
+<:copyright-gpl 
+ Copyright 2002 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+/*
+ * Generic setup routines for Broadcom 963xx MIPS boards
+ */
+
+#include <linux/autoconf.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/kernel.h>
+#include <linux/kdev_t.h>
+#include <linux/types.h>
+#include <linux/console.h>
+#include <linux/sched.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/pm.h>
+#include <linux/bootmem.h>
+
+#include <asm/addrspace.h>
+#include <asm/bcache.h>
+#include <asm/irq.h>
+#include <asm/time.h>
+#include <asm/reboot.h>
+#include <asm/gdb-stub.h>
+#include <asm/bootinfo.h>
+#include <asm/cpu.h>
+#include <asm/mach-bcm963xx/bootloaders.h>
+
+extern void brcm_time_init(void);
+extern int boot_loader_type;
+
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include <bcm_map_part.h>
+#include <6348_map_part.h>
+#include <bcmpci.h>
+
+static volatile MpiRegisters * mpi = (MpiRegisters *)(MPI_BASE);
+
+/* This function should be in a board specific directory.  For now,
+ * assume that all boards that include this file use a Broadcom chip
+ * with a soft reset bit in the PLL control register.
+ */
+static void brcm_machine_restart(char *command)
+{
+	const unsigned long ulSoftReset = 0x00000001;
+	unsigned long *pulPllCtrl = (unsigned long *) 0xfffe0008;
+	*pulPllCtrl |= ulSoftReset;
+}
+
+static void brcm_machine_halt(void)
+{
+	printk("System halted\n");
+	while (1);
+}
+
+static void mpi_SetLocalPciConfigReg(uint32 reg, uint32 value)
+{
+    /* write index then value */
+    mpi->pcicfgcntrl = PCI_CFG_REG_WRITE_EN + reg;;
+    mpi->pcicfgdata = value;
+}
+
+static uint32 mpi_GetLocalPciConfigReg(uint32 reg)
+{
+    /* write index then get value */
+    mpi->pcicfgcntrl = PCI_CFG_REG_WRITE_EN + reg;;
+    return mpi->pcicfgdata;
+}
+
+/*
+ * mpi_ResetPcCard: Set/Reset the PcCard
+ */
+static void mpi_ResetPcCard(int cardtype, BOOL bReset)
+{
+    if (cardtype == MPI_CARDTYPE_NONE) {
+        return;
+    }
+
+    if (cardtype == MPI_CARDTYPE_CARDBUS) {
+        bReset = ! bReset;
+    }
+
+    if (bReset) {
+        mpi->pcmcia_cntl1 = (mpi->pcmcia_cntl1 & ~PCCARD_CARD_RESET);
+    } else {
+        mpi->pcmcia_cntl1 = (mpi->pcmcia_cntl1 | PCCARD_CARD_RESET);
+    }
+}
+
+/*
+ * mpi_ConfigCs: Configure an MPI/EBI chip select
+ */
+static void mpi_ConfigCs(uint32 cs, uint32 base, uint32 size, uint32 flags)
+{
+    mpi->cs[cs].base = ((base & 0x1FFFFFFF) | size);
+    mpi->cs[cs].config = flags;
+}
+
+/*
+ * mpi_InitPcmciaSpace
+ */
+static void mpi_InitPcmciaSpace(void)
+{
+    // ChipSelect 4 controls PCMCIA Memory accesses
+    mpi_ConfigCs(PCMCIA_COMMON_BASE, pcmciaMem, EBI_SIZE_1M, (EBI_WORD_WIDE|EBI_ENABLE));
+    // ChipSelect 5 controls PCMCIA Attribute accesses
+    mpi_ConfigCs(PCMCIA_ATTRIBUTE_BASE, pcmciaAttr, EBI_SIZE_1M, (EBI_WORD_WIDE|EBI_ENABLE));
+    // ChipSelect 6 controls PCMCIA I/O accesses
+    mpi_ConfigCs(PCMCIA_IO_BASE, pcmciaIo, EBI_SIZE_64K, (EBI_WORD_WIDE|EBI_ENABLE));
+
+    mpi->pcmcia_cntl2 = ((PCMCIA_ATTR_ACTIVE << RW_ACTIVE_CNT_BIT) | 
+                         (PCMCIA_ATTR_INACTIVE << INACTIVE_CNT_BIT) | 
+                         (PCMCIA_ATTR_CE_SETUP << CE_SETUP_CNT_BIT) | 
+                         (PCMCIA_ATTR_CE_HOLD << CE_HOLD_CNT_BIT));
+
+    mpi->pcmcia_cntl2 |= (PCMCIA_HALFWORD_EN | PCMCIA_BYTESWAP_DIS);
+}
+
+/*
+ * cardtype_vcc_detect: PC Card's card detect and voltage sense connection
+ * 
+ *   CD1#/      CD2#/     VS1#/     VS2#/    Card       Initial Vcc
+ *  CCD1#      CCD2#     CVS1      CVS2      Type
+ *
+ *   GND        GND       open      open     16-bit     5 vdc
+ *
+ *   GND        GND       GND       open     16-bit     3.3 vdc
+ *
+ *   GND        GND       open      GND      16-bit     x.x vdc
+ *
+ *   GND        GND       GND       GND      16-bit     3.3 & x.x vdc
+ *
+ *====================================================================
+ *
+ *   CVS1       GND       CCD1#     open     CardBus    3.3 vdc
+ *
+ *   GND        CVS2      open      CCD2#    CardBus    x.x vdc
+ *
+ *   GND        CVS1      CCD2#     open     CardBus    y.y vdc
+ *
+ *   GND        CVS2      GND       CCD2#    CardBus    3.3 & x.x vdc
+ *
+ *   CVS2       GND       open      CCD1#    CardBus    x.x & y.y vdc
+ *
+ *   GND        CVS1      CCD2#     open     CardBus    3.3, x.x & y.y vdc
+ *
+ */
+static int cardtype_vcc_detect(void)
+{
+    uint32 data32;
+    int cardtype;
+
+    cardtype = MPI_CARDTYPE_NONE;
+    mpi->pcmcia_cntl1 = 0x0000A000; // Turn on the output enables and drive
+                                        // the CVS pins to 0.
+    data32 = mpi->pcmcia_cntl1;
+    switch (data32 & 0x00000003)  // Test CD1# and CD2#, see if card is plugged in.
+    {
+    case 0x00000003:  // No Card is in the slot.
+        printk("mpi: No Card is in the PCMCIA slot\n");
+        break;
+
+    case 0x00000002:  // Partial insertion, No CD2#.
+        printk("mpi: Card in the PCMCIA slot partial insertion, no CD2 signal\n");
+        break;
+
+    case 0x00000001:  // Partial insertion, No CD1#.
+        printk("mpi: Card in the PCMCIA slot partial insertion, no CD1 signal\n");
+        break;
+
+    case 0x00000000:
+        mpi->pcmcia_cntl1 = 0x0000A0C0; // Turn off the CVS output enables and
+                                        // float the CVS pins.
+        mdelay(1);
+        data32 = mpi->pcmcia_cntl1;
+        // Read the Register.
+        switch (data32 & 0x0000000C)  // See what is on the CVS pins.
+        {
+        case 0x00000000: // CVS1 and CVS2 are tied to ground, only 1 option.
+            printk("mpi: Detected 3.3 & x.x 16-bit PCMCIA card\n");
+            cardtype = MPI_CARDTYPE_PCMCIA;
+            break;
+          
+        case 0x00000004: // CVS1 is open or tied to CCD1/CCD2 and CVS2 is tied to ground.
+                         // 2 valid voltage options.
+        switch (data32 & 0x00000003)  // Test the values of CCD1 and CCD2.
+        {
+            case 0x00000003:  // CCD1 and CCD2 are tied to 1 of the CVS pins.
+                              // This is not a valid combination.
+                printk("mpi: Unknown card plugged into slot\n"); 
+                break;
+      
+            case 0x00000002:  // CCD2 is tied to either CVS1 or CVS2. 
+                mpi->pcmcia_cntl1 = 0x0000A080; // Drive CVS1 to a 0.
+                mdelay(1);
+                data32 = mpi->pcmcia_cntl1;
+                if (data32 & 0x00000002) { // CCD2 is tied to CVS2, not valid.
+                    printk("mpi: Unknown card plugged into slot\n"); 
+                } else {                   // CCD2 is tied to CVS1.
+                    printk("mpi: Detected 3.3, x.x and y.y Cardbus card\n");
+                    cardtype = MPI_CARDTYPE_CARDBUS;
+                }
+                break;
+                
+            case 0x00000001: // CCD1 is tied to either CVS1 or CVS2.
+                             // This is not a valid combination.
+                printk("mpi: Unknown card plugged into slot\n"); 
+                break;
+                
+            case 0x00000000:  // CCD1 and CCD2 are tied to ground.
+                printk("mpi: Detected x.x vdc 16-bit PCMCIA card\n");
+                cardtype = MPI_CARDTYPE_PCMCIA;
+                break;
+            }
+            break;
+          
+        case 0x00000008: // CVS2 is open or tied to CCD1/CCD2 and CVS1 is tied to ground.
+                         // 2 valid voltage options.
+            switch (data32 & 0x00000003)  // Test the values of CCD1 and CCD2.
+            {
+            case 0x00000003:  // CCD1 and CCD2 are tied to 1 of the CVS pins.
+                              // This is not a valid combination.
+                printk("mpi: Unknown card plugged into slot\n"); 
+                break;
+      
+            case 0x00000002:  // CCD2 is tied to either CVS1 or CVS2.
+                mpi->pcmcia_cntl1 = 0x0000A040; // Drive CVS2 to a 0.
+                mdelay(1);
+                data32 = mpi->pcmcia_cntl1;
+                if (data32 & 0x00000002) { // CCD2 is tied to CVS1, not valid.
+                    printk("mpi: Unknown card plugged into slot\n"); 
+                } else {// CCD2 is tied to CVS2.
+                    printk("mpi: Detected 3.3 and x.x Cardbus card\n");
+                    cardtype = MPI_CARDTYPE_CARDBUS;
+                }
+                break;
+
+            case 0x00000001: // CCD1 is tied to either CVS1 or CVS2.
+                             // This is not a valid combination.
+                printk("mpi: Unknown card plugged into slot\n"); 
+                break;
+
+            case 0x00000000:  // CCD1 and CCD2 are tied to ground.
+                cardtype = MPI_CARDTYPE_PCMCIA;
+                printk("mpi: Detected 3.3 vdc 16-bit PCMCIA card\n");
+                break;
+            }
+            break;
+          
+        case 0x0000000C:  // CVS1 and CVS2 are open or tied to CCD1/CCD2.
+                          // 5 valid voltage options.
+      
+            switch (data32 & 0x00000003)  // Test the values of CCD1 and CCD2.
+            {
+            case 0x00000003:  // CCD1 and CCD2 are tied to 1 of the CVS pins.
+                              // This is not a valid combination.
+                printk("mpi: Unknown card plugged into slot\n"); 
+                break;
+      
+            case 0x00000002:  // CCD2 is tied to either CVS1 or CVS2.
+                              // CCD1 is tied to ground.
+                mpi->pcmcia_cntl1 = 0x0000A040; // Drive CVS2 to a 0.
+                mdelay(1);
+                data32 = mpi->pcmcia_cntl1;
+                if (data32 & 0x00000002) {  // CCD2 is tied to CVS1.
+                    printk("mpi: Detected y.y vdc Cardbus card\n");
+                } else {                    // CCD2 is tied to CVS2.
+                    printk("mpi: Detected x.x vdc Cardbus card\n");
+                }
+                cardtype = MPI_CARDTYPE_CARDBUS;
+                break;
+      
+            case 0x00000001: // CCD1 is tied to either CVS1 or CVS2.
+                             // CCD2 is tied to ground.
+      
+                mpi->pcmcia_cntl1 = 0x0000A040; // Drive CVS2 to a 0.
+                mdelay(1);
+                data32 = mpi->pcmcia_cntl1;
+                if (data32 & 0x00000001) {// CCD1 is tied to CVS1.
+                    printk("mpi: Detected 3.3 vdc Cardbus card\n");
+                } else {                    // CCD1 is tied to CVS2.
+                    printk("mpi: Detected x.x and y.y Cardbus card\n");
+                }
+                cardtype = MPI_CARDTYPE_CARDBUS;
+                break;
+      
+            case 0x00000000:  // CCD1 and CCD2 are tied to ground.
+                cardtype = MPI_CARDTYPE_PCMCIA;
+                printk("mpi: Detected 5 vdc 16-bit PCMCIA card\n");
+                break;
+            }
+            break;
+      
+        default:
+            printk("mpi: Unknown card plugged into slot\n"); 
+            break;
+        
+        }
+    }
+    return cardtype;
+}
+
+/*
+ * mpi_DetectPcCard: Detect the plugged in PC-Card
+ * Return: < 0 => Unknown card detected
+ *         0 => No card detected
+ *         1 => 16-bit card detected
+ *         2 => 32-bit CardBus card detected
+ */
+static int mpi_DetectPcCard(void)
+{
+    int cardtype;
+
+    cardtype = cardtype_vcc_detect();
+    switch(cardtype) {
+        case MPI_CARDTYPE_PCMCIA:
+            mpi->pcmcia_cntl1 &= ~0x0000e000; // disable enable bits
+            //mpi->pcmcia_cntl1 = (mpi->pcmcia_cntl1 & ~PCCARD_CARD_RESET);
+            mpi->pcmcia_cntl1 |= (PCMCIA_ENABLE | PCMCIA_GPIO_ENABLE);
+            mpi_InitPcmciaSpace();
+            mpi_ResetPcCard(cardtype, FALSE);
+            // Hold card in reset for 10ms
+            mdelay(10);
+            mpi_ResetPcCard(cardtype, TRUE);
+            // Let card come out of reset
+            mdelay(100);
+            break;
+        case MPI_CARDTYPE_CARDBUS:
+            // 8 => CardBus Enable
+            // 1 => PCI Slot Number
+            // C => Float VS1 & VS2
+            mpi->pcmcia_cntl1 = (mpi->pcmcia_cntl1 & 0xFFFF0000) | 
+                                CARDBUS_ENABLE | 
+                                (CARDBUS_SLOT << 8)| 
+                                VS2_OEN |
+                                VS1_OEN;
+            /* access to this memory window will be to/from CardBus */
+            mpi->l2pmremap1 |= CARDBUS_MEM;
+
+            // Need to reset the Cardbus Card. There's no CardManager to do this, 
+            // and we need to be ready for PCI configuration. 
+            mpi_ResetPcCard(cardtype, FALSE);
+            // Hold card in reset for 10ms
+            mdelay(10);
+            mpi_ResetPcCard(cardtype, TRUE);
+            // Let card come out of reset
+            mdelay(100);
+            break;
+        default:
+            break;
+    }
+    return cardtype;
+}
+
+static int mpi_init(void)
+{
+	unsigned long data;
+    	unsigned int chipid, chiprev, sdramsize;
+
+	printk("Broadcom BCM963xx MPI\n");
+    	chipid  = (PERF->RevID & 0xFFFF0000) >> 16;
+    	chiprev = (PERF->RevID & 0xFF);
+
+	if (boot_loader_type == BOOT_LOADER_CFE)
+    		sdramsize = boot_mem_map.map[0].size;
+	else
+		sdramsize = 0x01000000; 
+    	/*
+     	 * Init the pci interface 
+     	 */
+    	data = GPIO->GPIOMode; // GPIO mode register
+    	data |= GROUP2_PCI | GROUP1_MII_PCCARD; // PCI internal arbiter + Cardbus
+    	GPIO->GPIOMode = data; // PCI internal arbiter
+
+    /*
+     * In the BCM6348 CardBus support is defaulted to Slot 0
+     * because there is no external IDSEL for CardBus.  To disable
+     * the CardBus and allow a standard PCI card in Slot 0 
+     * set the cbus_idsel field to 0x1f.
+    */
+    /*
+    uData = mpi->pcmcia_cntl1;
+    uData |= CARDBUS_IDSEL;
+    mpi->pcmcia_cntl1 = uData;
+    */
+    // Setup PCI I/O Window range. Give 64K to PCI I/O
+    mpi->l2piorange = ~(BCM_PCI_IO_SIZE_64KB-1);
+    // UBUS to PCI I/O base address 
+    mpi->l2piobase = BCM_PCI_IO_BASE & BCM_PCI_ADDR_MASK;
+    // UBUS to PCI I/O Window remap
+    mpi->l2pioremap = (BCM_PCI_IO_BASE | MEM_WINDOW_EN);
+
+    // enable PCI related GPIO pins and data swap between system and PCI bus
+    mpi->locbuscntrl = (EN_PCI_GPIO | DIR_U2P_NOSWAP);
+
+    /* Enable 6348 BusMaster and Memory access mode */
+    data = mpi_GetLocalPciConfigReg(PCI_COMMAND);
+    data |= (PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
+    mpi_SetLocalPciConfigReg(PCI_COMMAND, data);
+
+    /* Configure two 16 MByte PCI to System memory regions. */
+    /* These memory regions are used when PCI device is a bus master */
+    /* Accesses to the SDRAM from PCI bus will be "byte swapped" for this region */
+    mpi_SetLocalPciConfigReg(PCI_BASE_ADDRESS_3, BCM_HOST_MEM_SPACE1);
+    mpi->sp0remap = 0x0;
+
+    /* Accesses to the SDRAM from PCI bus will not be "byte swapped" for this region */
+    mpi_SetLocalPciConfigReg(PCI_BASE_ADDRESS_4, BCM_HOST_MEM_SPACE2);
+    mpi->sp1remap = 0x0;
+    mpi->pcimodesel |= (PCI_BAR2_NOSWAP | 0x40);
+
+    if ((chipid == 0x6348) && (chiprev == 0xb0)) {
+        mpi->sp0range = ~(sdramsize-1);
+        mpi->sp1range = ~(sdramsize-1);
+    }
+    /*
+     * Change 6348 PCI Cfg Reg. offset 0x40 to PCI memory read retry count infinity
+     * by set 0 in bit 8~15.  This resolve read Bcm4306 srom return 0xffff in
+     * first read.
+     */
+    data = mpi_GetLocalPciConfigReg(BRCM_PCI_CONFIG_TIMER);
+    data &= ~BRCM_PCI_CONFIG_TIMER_RETRY_MASK;
+    data |= 0x00000080;
+    mpi_SetLocalPciConfigReg(BRCM_PCI_CONFIG_TIMER, data);
+
+    /* enable pci interrupt */
+    mpi->locintstat |= (EXT_PCI_INT << 16);
+
+    mpi_DetectPcCard();
+
+    ioport_resource.start = BCM_PCI_IO_BASE;
+    ioport_resource.end = BCM_PCI_IO_BASE + BCM_PCI_IO_SIZE_64KB;
+
+#if defined(CONFIG_USB)
+    PERF->blkEnables |= USBH_CLK_EN;
+    mdelay(100);
+    *USBH_NON_OHCI = NON_OHCI_BYTE_SWAP;
+#endif
+
+    return 0;
+}
+
+void __init plat_mem_setup(void)
+{
+	_machine_restart = brcm_machine_restart;
+	_machine_halt = brcm_machine_halt;
+	pm_power_off = brcm_machine_halt;
+
+	board_time_init = brcm_time_init;
+
+    	/* mpi initialization */
+    	mpi_init();
+}
diff --git a/target/linux/brcm63xx/files/arch/mips/bcm963xx/time.c b/target/linux/brcm63xx/files/arch/mips/bcm963xx/time.c
new file mode 100644
index 0000000..8b82ada
--- /dev/null
+++ b/target/linux/brcm63xx/files/arch/mips/bcm963xx/time.c
@@ -0,0 +1,116 @@
+/*
+<:copyright-gpl
+ Copyright 2004 Broadcom Corp. All Rights Reserved.
+
+ This program is free software; you can distribute it and/or modify it
+ under the terms of the GNU General Public License (Version 2) as
+ published by the Free Software Foundation.
+
+ This program is distributed in the hope it will be useful, but WITHOUT
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ for more details.
+
+ You should have received a copy of the GNU General Public License along
+ with this program; if not, write to the Free Software Foundation, Inc.,
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
+:>
+*/
+/*
+ * Setup time for Broadcom 963xx MIPS boards
+ */
+
+#include <linux/autoconf.h>
+#include <linux/init.h>
+#include <linux/kernel_stat.h>
+#include <linux/sched.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/time.h>
+#include <linux/timex.h>
+
+#include <asm/mipsregs.h>
+#include <asm/ptrace.h>
+#include <asm/div64.h>
+#include <asm/time.h>
+
+#include <6348_map_part.h>
+#include <6348_intr.h>
+#include <bcm_map_part.h>
+#include <bcm_intr.h>
+
+static unsigned long r4k_offset;	/* Amount to increment compare reg each time */
+static unsigned long r4k_cur;		/* What counter should be at next timer irq */
+
+/*  *********************************************************************
+    *  calculateCpuSpeed()
+    *      Calculate the BCM6348 CPU speed by reading the PLL strap register
+    *      and applying the following formula:
+    *      cpu_clk = (.25 * 64MHz freq) * (N1 + 1) * (N2 + 2) / (M1_CPU + 1)
+    *  Input parameters:
+    *      none
+    *  Return value:
+    *      none
+    ********************************************************************* */
+
+static inline unsigned long __init calculateCpuSpeed(void)
+{
+    u32 pllStrap = PERF->PllStrap;
+    int n1 = (pllStrap & PLL_N1_MASK) >> PLL_N1_SHFT;
+    int n2 = (pllStrap & PLL_N2_MASK) >> PLL_N2_SHFT;
+    int m1cpu = (pllStrap & PLL_M1_CPU_MASK) >> PLL_M1_CPU_SHFT;
+
+	return (16 * (n1 + 1) * (n2 + 2) / (m1cpu + 1)) * 1000000;
+}
+
+
+static inline unsigned long __init cal_r4koff(void)
+{   
+	mips_hpt_frequency = calculateCpuSpeed() / 2;
+	return (mips_hpt_frequency / HZ);
+}
+
+
+/*
+ * There are a lot of conceptually broken versions of the MIPS timer interrupt
+ * handler floating around.  This one is rather different, but the algorithm
+ * is provably more robust.
+ */
+irqreturn_t brcm_timer_interrupt(struct pt_regs *regs)
+{
+	int irq = MIPS_TIMER_INT;
+
+	irq_enter();
+	kstat_this_cpu.irqs[irq]++;
+
+	timer_interrupt(irq, regs);
+	irq_exit();
+	return IRQ_HANDLED;
+}
+
+
+void __init brcm_time_init(void)
+{
+	unsigned int est_freq, flags;
+	local_irq_save(flags);
+
+	printk("calculating r4koff... ");
+	r4k_offset = cal_r4koff();
+	printk("%08lx(%d)\n", r4k_offset, (int)r4k_offset);
+
+	est_freq = 2 * r4k_offset * HZ;
+	est_freq += 5000;   /* round */
+	est_freq -= est_freq % 10000;
+	printk("CPU frequency %d.%02d MHz\n", est_freq / 1000000,
+		   (est_freq % 1000000) * 100 / 1000000);
+	local_irq_restore(flags);
+}
+
+
+void __init plat_timer_setup(struct irqaction *irq)
+{
+	r4k_cur = (read_c0_count() + r4k_offset);
+	write_c0_compare(r4k_cur);
+	set_c0_status(IE_IRQ5);
+}
diff --git a/target/linux/brcm63xx/files/arch/mips/bcm963xx/wdt.c b/target/linux/brcm63xx/files/arch/mips/bcm963xx/wdt.c
new file mode 100644
index 0000000..0ea36a6
--- /dev/null
+++ b/target/linux/brcm63xx/files/arch/mips/bcm963xx/wdt.c
@@ -0,0 +1,246 @@
+/*
+ * Watchdog driver for the BCM963xx devices
+ * 
+ * Copyright (C) 2007 OpenWrt.org
+ *			Florian Fainelli <florian@openwrt.org>
+ * 
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/miscdevice.h>
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <linux/notifier.h>
+#include <linux/watchdog.h>
+#include <linux/timer.h>
+#include <linux/jiffies.h>
+#include <linux/completion.h>
+#include <linux/ioport.h>
+
+typedef struct bcm963xx_timer {
+	unsigned short unused0;
+	unsigned char  timer_mask;
+#define TIMER0EN        0x01
+#define TIMER1EN        0x02
+#define TIMER2EN        0x04
+  	unsigned char  timer_ints;
+#define TIMER0          0x01
+#define TIMER1          0x02
+#define TIMER2          0x04
+#define WATCHDOG        0x08
+ 	unsigned long	timer_ctl0;
+  	unsigned long	timer_ctl1;
+  	unsigned long	timer_ctl2;
+#define TIMERENABLE     0x80000000
+#define RSTCNTCLR       0x40000000      
+  	unsigned long	timer_cnt0;
+  	unsigned long	timer_cnt1;
+  	unsigned long	timer_cnt2;
+  	unsigned long	wdt_def_count;
+
+  	/* Write 0xff00 0x00ff to Start timer
+   	* Write 0xee00 0x00ee to Stop and re-load default count
+   	* Read from this register returns current watch dog count
+   	*/
+  	unsigned long	wdt_ctl;
+
+  	/* Number of 40-MHz ticks for WD Reset pulse to last */
+  	unsigned long	wdt_rst_count;
+} bcm963xx_timer;
+
+static struct bcm963xx_wdt_device {
+	struct completion stop;
+	volatile int running;
+	struct timer_list timer;
+	volatile int queue;
+	int default_ticks;
+	unsigned long inuse;
+} bcm963xx_wdt_device;
+
+static int ticks = 1000;
+
+#define WDT_BASE	0xfffe0200
+#define WDT 		((volatile bcm963xx_timer * const) WDT_BASE)
+
+#define BCM963XX_INTERVAL        (HZ/10+1)
+
+static void bcm963xx_wdt_trigger(unsigned long unused)
+{
+	if (bcm963xx_wdt_device.running)
+		ticks--;
+
+	/* Load the default ticking value into the reset counter register */	
+	WDT->wdt_rst_count = bcm963xx_wdt_device.default_ticks;
+	
+	if (bcm963xx_wdt_device.queue && ticks) {
+		bcm963xx_wdt_device.timer.expires = jiffies + BCM963XX_INTERVAL;
+		add_timer(&bcm963xx_wdt_device.timer);
+	}
+	else {
+		complete(&bcm963xx_wdt_device.stop);
+	}
+}
+
+static void bcm963xx_wdt_reset(void)
+{
+	ticks = bcm963xx_wdt_device.default_ticks;
+	/* Also reload default count */
+	WDT->wdt_def_count = ticks;
+	WDT->wdt_ctl = 0xee00;
+	WDT->wdt_ctl = 0x00ee;
+}
+
+static void bcm963xx_wdt_start(void)
+{
+	if (!bcm963xx_wdt_device.queue) {
+		bcm963xx_wdt_device.queue;
+		/* Enable the watchdog by writing 0xff00 ,then 0x00ff to the control register */
+		WDT->wdt_ctl = 0xff00;
+		WDT->wdt_ctl = 0x00ff;
+		bcm963xx_wdt_device.timer.expires = jiffies + BCM963XX_INTERVAL;
+		add_timer(&bcm963xx_wdt_device.timer);
+	}
+	bcm963xx_wdt_device.running++;
+}
+
+static int bcm963xx_wdt_stop(void)
+{
+	if (bcm963xx_wdt_device.running)
+		bcm963xx_wdt_device.running = 0;
+	
+	ticks = bcm963xx_wdt_device.default_ticks;
+
+	/* Stop the watchdog by writing 0xee00 then 0x00ee to the control register */
+	WDT->wdt_ctl = 0xee00;
+	WDT->wdt_ctl = 0x00ee;
+
+	return -EIO;
+}
+
+static int bcm963xx_wdt_open(struct inode *inode, struct file *file)
+{
+	if (test_and_set_bit(0, &bcm963xx_wdt_device.inuse))
+		return -EBUSY;
+	return nonseekable_open(inode, file);
+}
+
+static int bcm963xx_wdt_release(struct inode *inode, struct file *file)
+{
+	clear_bit(0, &bcm963xx_wdt_device.inuse);
+	return 0;
+}
+
+static int bcm963xx_wdt_ioctl(struct inode *inode, struct file *file,
+				unsigned int cmd, unsigned long arg)
+{
+	void __user *argp = (void __user *)arg;
+	unsigned int value;
+
+	static struct watchdog_info ident = {
+		.options = WDIOF_CARDRESET,
+		.identity = "BCM963xx WDT",
+	};
+
+	switch (cmd) {
+		case WDIOC_KEEPALIVE:
+			bcm963xx_wdt_reset();
+			break;
+		case WDIOC_GETSTATUS:
+			/* Reading from the control register will return the current value */
+			value = WDT->wdt_ctl;
+			if ( copy_to_user(argp, &value, sizeof(int)) )
+				return -EFAULT;
+			break;
+		case WDIOC_GETSUPPORT:
+			if ( copy_to_user(argp, &ident, sizeof(ident)) )
+				return -EFAULT;
+			break;
+		case WDIOC_SETOPTIONS:
+			if ( copy_from_user(&value, argp, sizeof(int)) )
+				return -EFAULT;
+			switch(value) {
+				case WDIOS_ENABLECARD:
+					bcm963xx_wdt_start();
+					break;
+				case WDIOS_DISABLECARD:
+					bcm963xx_wdt_stop();
+					break;
+				default:
+					return -EINVAL;
+			}
+			break;
+		default:
+			return -ENOTTY;
+	}
+	return 0;		
+}
+
+static int bcm963xx_wdt_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
+{
+	if (!count)
+		return -EIO;
+	bcm963xx_wdt_reset();
+	return count;
+}
+
+static const struct file_operations bcm963xx_wdt_fops = {
+	.owner 		= THIS_MODULE,
+	.llseek		= no_llseek,
+	.write		= bcm963xx_wdt_write,
+	.ioctl		= bcm963xx_wdt_ioctl,
+	.open		= bcm963xx_wdt_open,
+	.release 	= bcm963xx_wdt_release,
+};	
+
+static struct miscdevice bcm963xx_wdt_miscdev = {
+	.minor 	= WATCHDOG_MINOR,
+	.name 	= "watchdog",
+	.fops	= &bcm963xx_wdt_fops,
+};
+
+static void __exit bcm963xx_wdt_exit(void)
+{
+	if (bcm963xx_wdt_device.queue ){
+		bcm963xx_wdt_device.queue = 0;
+		wait_for_completion(&bcm963xx_wdt_device.stop);
+	}	
+	misc_deregister(&bcm963xx_wdt_miscdev);
+}
+
+static int __init bcm963xx_wdt_init(void)
+{
+	int ret = 0;
+	
+	printk("Broadcom BCM963xx Watchdog timer\n");
+
+	ret = misc_register(&bcm963xx_wdt_miscdev);
+	if (ret) {
+		printk(KERN_CRIT "Cannot register miscdev on minor=%d (err=%d)\n", WATCHDOG_MINOR, ret);
+		return ret;
+	}
+	init_completion(&bcm963xx_wdt_device.stop);
+	bcm963xx_wdt_device.queue = 0;
+	
+	clear_bit(0, &bcm963xx_wdt_device.inuse);
+	
+	init_timer(&bcm963xx_wdt_device.timer);
+	bcm963xx_wdt_device.timer.function = bcm963xx_wdt_trigger;
+	bcm963xx_wdt_device.timer.data = 0;
+
+	bcm963xx_wdt_device.default_ticks = ticks;	
+	return ret;
+}
+
+	
+module_init(bcm963xx_wdt_init);
+module_exit(bcm963xx_wdt_exit);
+
+MODULE_AUTHOR("Florian Fainelli <florian@openwrt.org>");
+MODULE_DESCRIPTION("Broadcom BCM963xx Watchdog driver");
+MODULE_LICENSE("GPL");
diff --git a/target/linux/brcm63xx/files/arch/mips/cfe/Makefile b/target/linux/brcm63xx/files/arch/mips/cfe/Makefile
new file mode 100644
index 0000000..d9f046a
--- /dev/null
+++ b/target/linux/brcm63xx/files/arch/mips/cfe/Makefile
@@ -0,0 +1,5 @@
+#
+# Makefile for the Broadcom Common Firmware Environment support
+#
+
+obj-y += cfe.o
diff --git a/target/linux/brcm63xx/files/arch/mips/cfe/cfe.c b/target/linux/brcm63xx/files/arch/mips/cfe/cfe.c
new file mode 100644
index 0000000..6d16111
--- /dev/null
+++ b/target/linux/brcm63xx/files/arch/mips/cfe/cfe.c
@@ -0,0 +1,533 @@
+/*
+ * Broadcom Common Firmware Environment (CFE) support
+ *
+ * Copyright 2000, 2001, 2002
+ * Broadcom Corporation. All rights reserved.
+ *
+ * Copyright (C) 2006 Michael Buesch
+ *
+ * Original Authors:  Mitch Lichtenberg, Chris Demetriou
+ *
+ * This software is furnished under license and may be used and copied only
+ * in accordance with the following terms and conditions.  Subject to these
+ * conditions, you may download, copy, install, use, modify and distribute
+ * modified or unmodified copies of this software in source and/or binary
+ * form. No title or ownership is transferred hereby.
+ *
+ * 1) Any source code used, modified or distributed must reproduce and
+ *    retain this copyright notice and list of conditions as they appear in
+ *    the source file.
+ *
+ * 2) No right is granted to use any trade name, trademark, or logo of
+ *    Broadcom Corporation.  The "Broadcom Corporation" name may not be
+ *    used to endorse or promote products derived from this software
+ *    without the prior written permission of Broadcom Corporation.
+ *
+ * 3) THIS SOFTWARE IS PROVIDED "AS-IS" AND ANY EXPRESS OR IMPLIED
+ *    WARRANTIES, INCLUDING BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
+ *    NON-INFRINGEMENT ARE DISCLAIMED. IN NO EVENT SHALL BROADCOM BE LIABLE
+ *    FOR ANY DAMAGES WHATSOEVER, AND IN PARTICULAR, BROADCOM SHALL NOT BE
+ *    LIABLE FOR DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ *    CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ *    BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ *    WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ *    OR OTHERWISE), EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/init.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/spinlock.h>
+#include <asm/cfe.h>
+
+#include "cfe_private.h"
+
+
+static cfe_uint_t cfe_handle;
+static int (*cfe_trampoline)(long handle, long iocb);
+
+
+#include <linux/kernel.h>
+
+void __init cfe_setup(unsigned long fwarg0, unsigned long fwarg1,
+		      unsigned long fwarg2, unsigned long fwarg3)
+{
+	if (fwarg3 == 0x80300000) {
+		/* WRT54G workaround */
+		fwarg3 = CFE_EPTSEAL;
+		fwarg2 = 0xBFC00500;
+	}
+	if (fwarg3 != CFE_EPTSEAL) {
+		/* We are not booted from CFE */
+		return;
+	}
+	if (fwarg1 == 0) {
+		/* We are on the boot CPU */
+		cfe_handle = (cfe_uint_t)fwarg0;
+		cfe_trampoline = CFE_TO_PTR(fwarg2);
+	}
+}
+
+int cfe_vprintk(const char *fmt, va_list args)
+{
+	static char buffer[1024];
+	static DEFINE_SPINLOCK(lock);
+	static const char pfx[] = "CFE-console: ";
+	static const size_t pfx_len = sizeof(pfx) - 1;
+	unsigned long flags;
+	int len, cnt, pos;
+	int handle;
+	int res;
+
+	if (!cfe_present())
+		return -ENODEV;
+
+	spin_lock_irqsave(&lock, flags);
+	handle = cfe_getstdhandle(CFE_STDHANDLE_CONSOLE);
+	if (CFE_ISERR(handle)) {
+		len = -EIO;
+		goto out;
+	}
+	strcpy(buffer, pfx);
+	len = vscnprintf(buffer + pfx_len,
+			 sizeof(buffer) - pfx_len - 2,
+			 fmt, args);
+	len += pfx_len;
+	/* The CFE console requires CR-LF line-ends.
+	 * Add a CR, if we only terminate lines with a LF.
+	 * This does only fix CR-LF at the end of the string.
+	 * So for multiple lines, use multiple cfe_vprintk calls.
+	 */
+	if (len > 1 &&
+	    buffer[len - 1] == '\n' && buffer[len - 2] != '\r') {
+		buffer[len - 1] = '\r';
+		buffer[len] = '\n';
+		len += 1;
+	}
+	cnt = len;
+	pos = 0;
+	while (cnt > 0) {
+		res = cfe_write(handle, buffer + pos, len - pos);
+		if (CFE_ISERR(res)) {
+			len = -EIO;
+			goto out;
+		}
+		cnt -= res;
+		pos += res;
+	}
+out:
+	spin_unlock_irqrestore(&lock, flags);
+
+	return len;
+}
+
+int cfe_printk(const char *fmt, ...)
+{
+	va_list args;
+	int res;
+
+	va_start(args, fmt);
+	res = cfe_vprintk(fmt, args);
+	va_end(args);
+
+	return res;
+}
+
+static int cfe_iocb_dispatch(struct cfe_iocb *iocb)
+{
+	if (!cfe_present())
+		return CFE_ERR_UNSUPPORTED;
+	return cfe_trampoline((long)cfe_handle, (long)iocb);
+}
+
+int cfe_present(void)
+{
+	return (cfe_trampoline != NULL);
+}
+
+int cfe_close(int handle)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_DEV_CLOSE;
+	iocb.handle = handle;
+
+	err = cfe_iocb_dispatch(&iocb);
+
+	return (CFE_ISERR(err)) ? err : iocb.status;
+}
+
+int cfe_cpu_start(int cpu, void (*fn)(void), long sp, long gp, long a1)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_FW_CPUCTL;
+	iocb.psize = sizeof(struct cfe_iocb_cpuctl);
+	iocb.cpuctl.number = cpu;
+	iocb.cpuctl.command = CFE_CPU_CMD_START;
+	iocb.cpuctl.gp = gp;
+	iocb.cpuctl.sp = sp;
+	iocb.cpuctl.a1 = a1;
+	iocb.cpuctl.start_addr = (long)fn;
+
+	err = cfe_iocb_dispatch(&iocb);
+
+	return (CFE_ISERR(err)) ? err : iocb.status;
+}
+
+int cfe_cpu_stop(int cpu)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_FW_CPUCTL;
+	iocb.psize = sizeof(struct cfe_iocb_cpuctl);
+	iocb.cpuctl.number = cpu;
+	iocb.cpuctl.command = CFE_CPU_CMD_STOP;
+
+	err = cfe_iocb_dispatch(&iocb);
+
+	return (CFE_ISERR(err)) ? err : iocb.status;
+}
+
+int cfe_enumenv(int idx, char *name, int namelen, char *val, int vallen)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_ENV_ENUM;
+	iocb.psize = sizeof(struct cfe_iocb_envbuf);
+	iocb.envbuf.index = idx;
+	iocb.envbuf.name = PTR_TO_CFE(name);
+	iocb.envbuf.name_len = namelen;
+	iocb.envbuf.val = PTR_TO_CFE(val);
+	iocb.envbuf.val_len = vallen;
+
+	err = cfe_iocb_dispatch(&iocb);
+
+	return (CFE_ISERR(err)) ? err : iocb.status;
+}
+
+int cfe_enumdev(int idx, char *name, int namelen)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+
+	iocb.fcode = CFE_CMD_DEV_ENUM;
+	iocb.psize = sizeof(struct cfe_iocb_envbuf);
+	iocb.envbuf.index = idx;
+	iocb.envbuf.name = PTR_TO_CFE(name);
+	iocb.envbuf.name_len = namelen;
+
+	err = cfe_iocb_dispatch(&iocb);
+
+	return (CFE_ISERR(err)) ? err : iocb.status;
+}
+
+int cfe_enummem(int idx, int flags, u64 *start, u64 *length,
+		u64 *type)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+
+	iocb.fcode = CFE_CMD_FW_MEMENUM;
+	iocb.flags = flags;
+	iocb.psize = sizeof(struct cfe_iocb_meminfo);
+	iocb.meminfo.index = idx;
+
+	err = cfe_iocb_dispatch(&iocb);
+	if (CFE_ISERR(err))
+		return err;
+	if (!CFE_ISERR(iocb.status)) {
+		*start = iocb.meminfo.addr;
+		*length = iocb.meminfo.size;
+		*type = iocb.meminfo.type;
+	}
+
+	return iocb.status;
+}
+
+int cfe_exit(int warm, int status)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+printk("CFE REBOOT\n");
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_FW_RESTART;
+	if (warm)
+		iocb.flags = CFE_FLG_WARMSTART;
+	iocb.psize = sizeof(struct cfe_iocb_exitstat);
+	iocb.exitstat.status = status;
+
+printk("CALL\n");
+	err = cfe_iocb_dispatch(&iocb);
+printk("DONE\n");
+
+	return (CFE_ISERR(err)) ? err : iocb.status;
+}
+
+int cfe_flushcache(int flags)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_FW_FLUSHCACHE;
+	iocb.flags = flags;
+
+	err = cfe_iocb_dispatch(&iocb);
+
+	return (CFE_ISERR(err)) ? err : iocb.status;
+}
+
+int cfe_getdevinfo(char *name)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_DEV_GETINFO;
+	iocb.psize = sizeof(struct cfe_iocb_buf);
+	iocb.buffer.ptr = PTR_TO_CFE(name);
+	iocb.buffer.length = strlen(name);
+
+	err = cfe_iocb_dispatch(&iocb);
+	if (CFE_ISERR(err))
+		return err;
+	if (CFE_ISERR(iocb.status))
+		return iocb.status;
+
+	return iocb.buffer.devflags;
+}
+
+int cfe_getenv(char *name, char *dest, int destlen)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	dest[0] = '\0';
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_ENV_GET;
+	iocb.psize = sizeof(struct cfe_iocb_envbuf);
+	iocb.envbuf.name = PTR_TO_CFE(name);
+	iocb.envbuf.name_len = strlen(name);
+	iocb.envbuf.val = PTR_TO_CFE(dest);
+	iocb.envbuf.val_len = destlen;
+
+	err = cfe_iocb_dispatch(&iocb);
+
+	return (CFE_ISERR(err)) ? err : iocb.status;
+}
+
+int cfe_getfwinfo(struct cfe_fwinfo *info)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_FW_GETINFO;
+	iocb.psize = sizeof(struct cfe_iocb_fwinfo);
+
+	err = cfe_iocb_dispatch(&iocb);
+	if (CFE_ISERR(err))
+		return err;
+	if (CFE_ISERR(iocb.status))
+		return err;
+
+	info->version = iocb.fwinfo.version;
+	info->totalmem = iocb.fwinfo.totalmem;
+	info->flags = iocb.fwinfo.flags;
+	info->boardid = iocb.fwinfo.boardid;
+	info->bootarea_va = iocb.fwinfo.bootarea_va;
+	info->bootarea_pa = iocb.fwinfo.bootarea_pa;
+	info->bootarea_size = iocb.fwinfo.bootarea_size;
+
+	return iocb.status;
+}
+
+int cfe_getstdhandle(int handletype)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_DEV_GETHANDLE;
+	iocb.flags = handletype;
+
+	err = cfe_iocb_dispatch(&iocb);
+	if (CFE_ISERR(err))
+		return err;
+	if (CFE_ISERR(iocb.status))
+		return iocb.status;
+
+	return iocb.handle;
+}
+
+int cfe_getticks(s64 *ticks)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_FW_GETTIME;
+	iocb.psize = sizeof(struct cfe_iocb_time);
+
+	err = cfe_iocb_dispatch(&iocb);
+	if (CFE_ISERR(err))
+		return err;
+	if (!CFE_ISERR(iocb.status))
+		*ticks = iocb.time.ticks;
+
+	return iocb.status;
+}
+
+int cfe_inpstat(int handle)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_DEV_INPSTAT;
+	iocb.handle = handle;
+	iocb.psize = sizeof(struct cfe_iocb_inpstat);
+
+	err = cfe_iocb_dispatch(&iocb);
+	if (CFE_ISERR(err))
+		return err;
+	if (CFE_ISERR(iocb.status))
+		return iocb.status;
+
+	return iocb.inpstat.status;
+}
+
+int cfe_ioctl(int handle, unsigned int ioctlnum,
+	      unsigned char *buffer, int length,
+	      int *retlen, u64 offset)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_DEV_IOCTL;
+	iocb.handle = handle;
+	iocb.psize = sizeof(struct cfe_iocb_buf);
+	iocb.buffer.offset = offset;
+	iocb.buffer.ioctlcmd = ioctlnum;
+	iocb.buffer.ptr = PTR_TO_CFE(buffer);
+	iocb.buffer.length = length;
+
+	err = cfe_iocb_dispatch(&iocb);
+	if (CFE_ISERR(err))
+		return err;
+	if (CFE_ISERR(iocb.status))
+		return iocb.status;
+	if (retlen)
+		*retlen = iocb.buffer.retlen;
+
+	return iocb.status;
+}
+
+int cfe_open(char *name)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_DEV_OPEN;
+	iocb.psize = sizeof(struct cfe_iocb_buf);
+	iocb.buffer.ptr = PTR_TO_CFE(name);
+	iocb.buffer.length = strlen(name);
+
+	err = cfe_iocb_dispatch(&iocb);
+	if (CFE_ISERR(err))
+		return err;
+	if (CFE_ISERR(iocb.status))
+		return iocb.status;
+
+	return iocb.handle;
+}
+
+int cfe_read(int handle, unsigned char *buffer, int length)
+{
+	return cfe_readblk(handle, 0, buffer, length);
+}
+
+int cfe_readblk(int handle, s64 offset, unsigned char *buffer, int length)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_DEV_READ;
+	iocb.handle = handle;
+	iocb.psize = sizeof(struct cfe_iocb_buf);
+	iocb.buffer.offset = offset;
+	iocb.buffer.ptr = PTR_TO_CFE(buffer);
+	iocb.buffer.length = length;
+
+	err = cfe_iocb_dispatch(&iocb);
+	if (CFE_ISERR(err))
+		return err;
+	if (CFE_ISERR(iocb.status))
+		return iocb.status;
+
+	return iocb.buffer.retlen;
+}
+
+int cfe_setenv(char *name, char *val)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_ENV_SET;
+	iocb.psize = sizeof(struct cfe_iocb_envbuf);
+	iocb.envbuf.name = PTR_TO_CFE(name);
+	iocb.envbuf.name_len = strlen(name);
+	iocb.envbuf.val = PTR_TO_CFE(val);
+	iocb.envbuf.val_len = strlen(val);
+
+	err = cfe_iocb_dispatch(&iocb);
+
+	return (CFE_ISERR(err)) ? err : iocb.status;
+}
+
+int cfe_write(int handle, unsigned char *buffer, int length)
+{
+	return cfe_writeblk(handle, 0, buffer, length);
+}
+
+int cfe_writeblk(int handle, s64 offset, unsigned char *buffer, int length)
+{
+	struct cfe_iocb iocb;
+	int err;
+
+	memset(&iocb, 0, sizeof(iocb));
+	iocb.fcode = CFE_CMD_DEV_WRITE;
+	iocb.handle = handle;
+	iocb.psize = sizeof(struct cfe_iocb_buf);
+	iocb.buffer.offset = offset;
+	iocb.buffer.ptr = PTR_TO_CFE(buffer);
+	iocb.buffer.length = length;
+
+	err = cfe_iocb_dispatch(&iocb);
+	if (CFE_ISERR(err))
+		return err;
+	if (CFE_ISERR(iocb.status))
+		return iocb.status;
+
+	return iocb.buffer.retlen;
+}
diff --git a/target/linux/brcm63xx/files/arch/mips/cfe/cfe_private.h b/target/linux/brcm63xx/files/arch/mips/cfe/cfe_private.h
new file mode 100644
index 0000000..0a604d3
--- /dev/null
+++ b/target/linux/brcm63xx/files/arch/mips/cfe/cfe_private.h
@@ -0,0 +1,176 @@
+/*
+ * Broadcom Common Firmware Environment (CFE) support
+ *
+ * Copyright 2000, 2001, 2002
+ * Broadcom Corporation. All rights reserved.
+ *
+ * Copyright (C) 2006 Michael Buesch
+ *
+ * Original Authors:  Mitch Lichtenberg, Chris Demetriou
+ *
+ * This software is furnished under license and may be used and copied only
+ * in accordance with the following terms and conditions.  Subject to these
+ * conditions, you may download, copy, install, use, modify and distribute
+ * modified or unmodified copies of this software in source and/or binary
+ * form. No title or ownership is transferred hereby.
+ *
+ * 1) Any source code used, modified or distributed must reproduce and
+ *    retain this copyright notice and list of conditions as they appear in
+ *    the source file.
+ *
+ * 2) No right is granted to use any trade name, trademark, or logo of
+ *    Broadcom Corporation.  The "Broadcom Corporation" name may not be
+ *    used to endorse or promote products derived from this software
+ *    without the prior written permission of Broadcom Corporation.
+ *
+ * 3) THIS SOFTWARE IS PROVIDED "AS-IS" AND ANY EXPRESS OR IMPLIED
+ *    WARRANTIES, INCLUDING BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
+ *    NON-INFRINGEMENT ARE DISCLAIMED. IN NO EVENT SHALL BROADCOM BE LIABLE
+ *    FOR ANY DAMAGES WHATSOEVER, AND IN PARTICULAR, BROADCOM SHALL NOT BE
+ *    LIABLE FOR DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ *    CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ *    BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ *    WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ *    OR OTHERWISE), EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LINUX_CFE_PRIVATE_H_
+#define LINUX_CFE_PRIVATE_H_
+
+#ifndef __ASSEMBLY__
+
+/* Seal indicating CFE's presence, passed to the kernel. */
+#define CFE_EPTSEAL		0x43464531
+
+#define CFE_CMD_FW_GETINFO	0
+#define CFE_CMD_FW_RESTART	1
+#define CFE_CMD_FW_BOOT		2
+#define CFE_CMD_FW_CPUCTL	3
+#define CFE_CMD_FW_GETTIME      4
+#define CFE_CMD_FW_MEMENUM	5
+#define CFE_CMD_FW_FLUSHCACHE	6
+
+#define CFE_CMD_DEV_GETHANDLE	9
+#define CFE_CMD_DEV_ENUM	10
+#define CFE_CMD_DEV_OPEN	11
+#define CFE_CMD_DEV_INPSTAT	12
+#define CFE_CMD_DEV_READ	13
+#define CFE_CMD_DEV_WRITE	14
+#define CFE_CMD_DEV_IOCTL	15
+#define CFE_CMD_DEV_CLOSE	16
+#define CFE_CMD_DEV_GETINFO	17
+
+#define CFE_CMD_ENV_ENUM	20
+#define CFE_CMD_ENV_GET		22
+#define CFE_CMD_ENV_SET		23
+#define CFE_CMD_ENV_DEL		24
+
+#define CFE_CMD_MAX		32
+
+#define CFE_CMD_VENDOR_USE	0x8000	/* codes above this are for customer use */
+
+typedef u64 cfe_uint_t;
+typedef s64 cfe_int_t;
+typedef s64 cfe_ptr_t;
+
+/* Cast a pointer from native to CFE-API pointer and back */
+#define CFE_TO_PTR(p)		((void *)(unsigned long)(p))
+#define PTR_TO_CFE(p)		((cfe_ptr_t)(unsigned long)(p))
+
+struct cfe_iocb_buf {
+	cfe_uint_t	offset;		/* offset on device (bytes) */
+	cfe_ptr_t	ptr;		/* pointer to a buffer */
+	cfe_uint_t	length;		/* length of this buffer */
+	cfe_uint_t	retlen;		/* returned length (for read ops) */
+	union {
+		cfe_uint_t	ioctlcmd;	/* IOCTL command (used only for IOCTLs) */
+		cfe_uint_t	devflags;	/* Returned device info flags */
+	};
+};
+
+struct cfe_iocb_inpstat {
+	cfe_uint_t	status;		/* 1 means input available */
+};
+
+struct cfe_iocb_envbuf {
+	cfe_int_t	index;		/* 0-based enumeration index */
+	cfe_ptr_t	name;		/* name string buffer */
+	cfe_int_t	name_len;	/* size of name buffer */
+	cfe_ptr_t	val;		/* value string buffer */
+	cfe_int_t	val_len;	/* size of value string buffer */
+};
+
+struct cfe_iocb_cpuctl {
+	cfe_uint_t	number;		/* cpu number to control */
+	cfe_uint_t	command;	/* command to issue to CPU */
+	cfe_uint_t	start_addr;	/* CPU start address */
+	cfe_uint_t	gp;		/* starting GP value */
+	cfe_uint_t	sp;		/* starting SP value */
+	cfe_uint_t	a1;		/* starting A1 value */
+};
+
+struct cfe_iocb_time {
+	cfe_int_t	ticks;		/* current time in ticks */
+};
+
+struct cfe_iocb_exitstat {
+	cfe_int_t	status;
+};
+
+struct cfe_iocb_meminfo {
+	cfe_int_t	index;		/* 0-based enumeration index */
+	cfe_int_t	type;		/* type of memory block */
+	cfe_uint_t	addr;		/* physical start address */
+	cfe_uint_t	size;		/* block size */
+};
+
+struct cfe_iocb_fwinfo {
+	cfe_int_t	version;	/* major, minor, eco version */
+	cfe_int_t	totalmem;	/* total installed mem */
+	cfe_int_t	flags;		/* various flags */
+	cfe_int_t	boardid;	/* board ID */
+	cfe_int_t	bootarea_va;	/* VA of boot area */
+	cfe_int_t	bootarea_pa;	/* PA of boot area */
+	cfe_int_t	bootarea_size;	/* size of boot area */
+	cfe_int_t	reserved1;
+	cfe_int_t	reserved2;
+	cfe_int_t	reserved3;
+};
+
+/* CFE I/O Control Block */
+struct cfe_iocb {
+	cfe_uint_t	fcode;		/* IOCB function code */
+	cfe_int_t	status;		/* return status */
+	cfe_int_t	handle;		/* file/device handle */
+	cfe_uint_t	flags;		/* flags for this IOCB */
+	cfe_uint_t	psize;		/* size of parameter list */
+	union {
+		struct cfe_iocb_buf		buffer;		/* buffer parameters */
+		struct cfe_iocb_inpstat		inpstat;	/* input status parameters */
+		struct cfe_iocb_envbuf		envbuf;		/* environment function parameters */
+		struct cfe_iocb_cpuctl		cpuctl;		/* CPU control parameters */
+		struct cfe_iocb_time		time;		/* timer parameters */
+		struct cfe_iocb_meminfo		meminfo;	/* memory arena info parameters */
+		struct cfe_iocb_fwinfo		fwinfo;		/* firmware information */
+		struct cfe_iocb_exitstat	exitstat;	/* Exit Status */
+	};
+};
+
+
+#include <linux/init.h>
+
+void __init cfe_setup(unsigned long fwarg0, unsigned long fwarg1,
+		      unsigned long fwarg2, unsigned long fwarg3);
+
+#else /* __ASSEMBLY__ */
+
+	.macro	cfe_early_init
+#ifdef CONFIG_CFE
+		jal	cfe_setup
+#endif
+	.endm
+
+#endif /* __ASSEMBLY__ */
+#endif /* LINUX_CFE_PRIVATE_H_ */
diff --git a/target/linux/brcm63xx/files/arch/mips/pci/fixup-bcm96348.c b/target/linux/brcm63xx/files/arch/mips/pci/fixup-bcm96348.c
new file mode 100644
index 0000000..ae71ebc
--- /dev/null
+++ b/target/linux/brcm63xx/files/arch/mips/pci/fixup-bcm96348.c
@@ -0,0 +1,95 @@
+/*
+<:copyright-gpl
+ Copyright 2002 Broadcom Corp. All Rights Reserved.
+
+ This program is free software; you can distribute it and/or modify it
+ under the terms of the GNU General Public License (Version 2) as
+ published by the Free Software Foundation.
+
+ This program is distributed in the hope it will be useful, but WITHOUT
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ for more details.
+
+ You should have received a copy of the GNU General Public License along
+ with this program; if not, write to the Free Software Foundation, Inc.,
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
+:>
+*/
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/pci.h>
+
+#include <bcmpci.h>
+#include <bcm_intr.h>
+#include <bcm_map_part.h>
+#include <6348_intr.h>
+#include <6348_map_part.h>
+
+static volatile MpiRegisters * mpi = (MpiRegisters *)(MPI_BASE);
+
+static char irq_tab_bcm96348[] __initdata = {
+    [0] = INTERRUPT_ID_MPI,
+    [1] = INTERRUPT_ID_MPI,
+#if defined(CONFIG_USB)
+    [USB_HOST_SLOT] = INTERRUPT_ID_USBH
+#endif
+};
+
+int __init pcibios_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
+{
+    return irq_tab_bcm96348[slot];
+}
+
+static void bcm96348_fixup(struct pci_dev *dev)
+{
+    uint32 memaddr;
+    uint32 size;
+
+    memaddr = pci_resource_start(dev, 0);
+    size = pci_resource_len(dev, 0);
+
+    switch (PCI_SLOT(dev->devfn)) {
+        case 0:
+            // UBUS to PCI address range
+            // Memory Window 1. Mask determines which bits are decoded.
+            mpi->l2pmrange1 = ~(size-1);
+            // UBUS to PCI Memory base address. This is akin to the ChipSelect base
+            // register.
+            mpi->l2pmbase1 = memaddr & BCM_PCI_ADDR_MASK;
+            // UBUS to PCI Remap Address. Replaces the masked address bits in the
+            // range register with this setting.
+            // Also, enable direct I/O and direct Memory accesses
+            mpi->l2pmremap1 = (memaddr | MEM_WINDOW_EN);
+            break;
+
+        case 1:
+            // Memory Window 2
+            mpi->l2pmrange2 = ~(size-1);
+            // UBUS to PCI Memory base address.
+            mpi->l2pmbase2 = memaddr & BCM_PCI_ADDR_MASK;
+            // UBUS to PCI Remap Address
+            mpi->l2pmremap2 = (memaddr | MEM_WINDOW_EN);
+            break;
+
+#if defined(CONFIG_USB)
+        case USB_HOST_SLOT:
+            dev->resource[0].start = USB_HOST_BASE;
+            dev->resource[0].end = USB_HOST_BASE+USB_BAR0_MEM_SIZE-1;
+            break;
+#endif
+    }
+}
+
+int pcibios_plat_dev_init(struct pci_dev *dev)
+{
+        return 0;
+}
+
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_BROADCOM, PCI_ANY_ID,
+          bcm96348_fixup);
+
+/*struct pci_fixup pcibios_fixups[] = {
+    { PCI_FIXUP_FINAL, PCI_ANY_ID, PCI_ANY_ID, bcm96348_fixup },
+    {0}
+};*/
diff --git a/target/linux/brcm63xx/files/arch/mips/pci/ops-bcm96348.c b/target/linux/brcm63xx/files/arch/mips/pci/ops-bcm96348.c
new file mode 100644
index 0000000..ee16471
--- /dev/null
+++ b/target/linux/brcm63xx/files/arch/mips/pci/ops-bcm96348.c
@@ -0,0 +1,278 @@
+/*
+<:copyright-gpl 
+ Copyright 2002 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <asm/addrspace.h>
+
+#include <bcm_intr.h>
+#include <bcm_map_part.h>
+#include <6348_intr.h>
+#include <6348_map_part.h>
+#include <bcmpci.h>
+
+#include <linux/delay.h>
+
+#if defined(CONFIG_USB)
+#if 0
+#define DPRINT(x...)        printk(x)
+#else
+#define DPRINT(x...)
+#endif
+
+static int 
+pci63xx_int_read(unsigned int devfn, int where, u32 * value, int size);
+static int 
+pci63xx_int_write(unsigned int devfn, int where, u32 * value, int size);
+
+static bool usb_mem_size_rd = FALSE;
+static uint32 usb_mem_base = 0;
+static uint32 usb_cfg_space_cmd_reg = 0;
+#endif
+static bool pci_mem_size_rd = FALSE;
+
+static volatile MpiRegisters * mpi = (MpiRegisters *)(MPI_BASE);
+
+static void mpi_SetupPciConfigAccess(uint32 addr)
+{
+    mpi->l2pcfgctl = (DIR_CFG_SEL | DIR_CFG_USEREG | addr) & ~CONFIG_TYPE;
+}
+
+static void mpi_ClearPciConfigAccess(void)
+{
+    mpi->l2pcfgctl = 0x00000000;
+}
+
+#if defined(CONFIG_USB)
+/* --------------------------------------------------------------------------
+    Name: pci63xx_int_write
+Abstract: PCI Config write on internal device(s)
+ -------------------------------------------------------------------------- */
+static int 
+pci63xx_int_write(unsigned int devfn, int where, u32 * value, int size)
+{
+    if (PCI_SLOT(devfn) != USB_HOST_SLOT) {
+        return PCIBIOS_SUCCESSFUL;
+    }
+
+    switch (size) {
+        case 1:
+            DPRINT("W => Slot: %d Where: %2X Len: %d Data: %02X\n", 
+                PCI_SLOT(devfn), where, size, *value);
+            break;
+        case 2:
+            DPRINT("W => Slot: %d Where: %2X Len: %d Data: %04X\n", 
+                PCI_SLOT(devfn), where, size, *value);
+            switch (where) {
+                case PCI_COMMAND:
+                    usb_cfg_space_cmd_reg = *value;
+                    break;
+                default:
+                    break;
+            }
+            break;
+        case 4:
+            DPRINT("W => Slot: %d Where: %2X Len: %d Data: %08lX\n", 
+                PCI_SLOT(devfn), where, size, *value);
+            switch (where) {
+                case PCI_BASE_ADDRESS_0:
+                    if (*value == 0xffffffff) {
+                        usb_mem_size_rd = TRUE;
+                    } else {
+                        usb_mem_base = *value;
+                    }
+                    break;
+                default:
+                    break;
+            }
+            break;
+        default:
+            break;
+    }
+
+    return PCIBIOS_SUCCESSFUL;
+}
+
+/* --------------------------------------------------------------------------
+    Name: pci63xx_int_read
+Abstract: PCI Config read on internal device(s)
+ -------------------------------------------------------------------------- */
+static int 
+pci63xx_int_read(unsigned int devfn, int where, u32 * value, int size)
+{
+    uint32 retValue = 0xFFFFFFFF;
+
+    if (PCI_SLOT(devfn) != USB_HOST_SLOT) {
+        return PCIBIOS_SUCCESSFUL;
+    }
+
+    // For now, this is specific to the USB Host controller. We can
+    // make it more general if we have to...
+    // Emulate PCI Config accesses
+    switch (where) {
+        case PCI_VENDOR_ID:     
+        case PCI_DEVICE_ID:
+            retValue = PCI_VENDOR_ID_BROADCOM | 0x63000000;
+            break;
+        case PCI_COMMAND:
+        case PCI_STATUS:
+            retValue = (0x0006 << 16) | usb_cfg_space_cmd_reg;
+            break;
+        case PCI_CLASS_REVISION:
+        case PCI_CLASS_DEVICE:
+            retValue = (PCI_CLASS_SERIAL_USB << 16) | (0x10 << 8) | 0x01;
+            break;
+        case PCI_BASE_ADDRESS_0:
+            if (usb_mem_size_rd) {
+                retValue = USB_BAR0_MEM_SIZE;
+            } else {
+                if (usb_mem_base != 0)
+                    retValue = usb_mem_base;
+                else
+                    retValue = USB_HOST_BASE;
+            }
+            usb_mem_size_rd = FALSE;
+            break;
+        case PCI_CACHE_LINE_SIZE:
+        case PCI_LATENCY_TIMER:
+            retValue = 0;
+            break;
+        case PCI_HEADER_TYPE:
+            retValue = PCI_HEADER_TYPE_NORMAL;
+            break;
+        case PCI_SUBSYSTEM_VENDOR_ID:
+            retValue = PCI_VENDOR_ID_BROADCOM;
+            break;
+        case PCI_SUBSYSTEM_ID:
+            retValue = 0x6300;
+            break;
+        case PCI_INTERRUPT_LINE:
+            retValue = INTERRUPT_ID_USBH; 
+            break;
+        default:
+            break;
+    }
+
+    switch (size) {
+        case 1:
+            *value = (retValue >> ((where & 3) << 3)) & 0xff;
+            DPRINT("R <= Slot: %d Where: %2X Len: %d Data: %02X\n", 
+                PCI_SLOT(devfn), where, size, *value);
+            break;
+        case 2:
+            *value = (retValue >> ((where & 3) << 3)) & 0xffff;
+            DPRINT("R <= Slot: %d Where: %2X Len: %d Data: %04X\n", 
+                PCI_SLOT(devfn), where, size, *value);
+            break;
+        case 4:
+            *value = retValue;
+            DPRINT("R <= Slot: %d Where: %2X Len: %d Data: %08lX\n", 
+                PCI_SLOT(devfn), where, size, *value);
+            break;
+        default:
+            break;
+    }
+
+    return PCIBIOS_SUCCESSFUL;
+}
+#endif
+
+static int bcm96348_pcibios_read(struct pci_bus *bus, unsigned int devfn,
+	int where, int size, u32 * val)
+{
+    volatile unsigned char *ioBase = (unsigned char *)(mpi->l2piobase | KSEG1);
+    uint32 data;
+
+#if defined(CONFIG_USB)
+    if (PCI_SLOT(devfn) == USB_HOST_SLOT)
+        return pci63xx_int_read(devfn, where, val, size);
+#endif
+
+    mpi_SetupPciConfigAccess(BCM_PCI_CFG(PCI_SLOT(devfn), PCI_FUNC(devfn), where));
+    data = *(uint32 *)ioBase;
+    switch(size) {
+        case 1:
+            *val = (data >> ((where & 3) << 3)) & 0xff;
+            break;
+        case 2:
+            *val = (data >> ((where & 3) << 3)) & 0xffff;
+            break;
+        case 4:
+            *val = data;
+             /* Special case for reading PCI device range */
+            if ((where >= PCI_BASE_ADDRESS_0) && (where <= PCI_BASE_ADDRESS_5)) {
+                if (pci_mem_size_rd) {
+                    /* bcm6348 PCI memory window minimum size is 64K */
+                    *val &= PCI_SIZE_64K;
+                }
+            }
+            break;
+        default:
+            break;
+    }
+    pci_mem_size_rd = FALSE;
+    mpi_ClearPciConfigAccess();
+
+    return PCIBIOS_SUCCESSFUL;
+}
+
+static int bcm96348_pcibios_write(struct pci_bus *bus, unsigned int devfn,
+	int where, int size, u32 val)
+{
+    volatile unsigned char *ioBase = (unsigned char *)(mpi->l2piobase | KSEG1);
+    uint32 data;
+
+#if defined(CONFIG_USB)
+    if (PCI_SLOT(devfn) == USB_HOST_SLOT)
+        return pci63xx_int_write(devfn, where, &val, size);
+#endif
+    mpi_SetupPciConfigAccess(BCM_PCI_CFG(PCI_SLOT(devfn), PCI_FUNC(devfn), where));
+    data = *(uint32 *)ioBase;
+    switch(size) {
+        case 1:
+            data = (data & ~(0xff << ((where & 3) << 3))) |
+                (val << ((where & 3) << 3));
+            break;
+        case 2:
+            data = (data & ~(0xffff << ((where & 3) << 3))) |
+                (val << ((where & 3) << 3));
+            break;
+        case 4:
+            data = val;
+            /* Special case for reading PCI device range */
+            if ((where >= PCI_BASE_ADDRESS_0) && (where <= PCI_BASE_ADDRESS_5)) {
+                if (val == 0xffffffff)
+                    pci_mem_size_rd = TRUE;
+            }
+            break;
+        default:
+            break;
+    }
+    *(uint32 *)ioBase = data;
+    udelay(500);
+    mpi_ClearPciConfigAccess();
+
+    return PCIBIOS_SUCCESSFUL;
+}
+
+struct pci_ops bcm96348_pci_ops = {
+    .read   = bcm96348_pcibios_read,
+    .write  = bcm96348_pcibios_write
+};
diff --git a/target/linux/brcm63xx/files/arch/mips/pci/pci-bcm96348.c b/target/linux/brcm63xx/files/arch/mips/pci/pci-bcm96348.c
new file mode 100644
index 0000000..bea3b7b
--- /dev/null
+++ b/target/linux/brcm63xx/files/arch/mips/pci/pci-bcm96348.c
@@ -0,0 +1,62 @@
+/*
+<:copyright-gpl
+ Copyright 2002 Broadcom Corp. All Rights Reserved.
+
+ This program is free software; you can distribute it and/or modify it
+ under the terms of the GNU General Public License (Version 2) as
+ published by the Free Software Foundation.
+
+ This program is distributed in the hope it will be useful, but WITHOUT
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ for more details.
+
+ You should have received a copy of the GNU General Public License along
+ with this program; if not, write to the Free Software Foundation, Inc.,
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
+:>
+*/
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+
+#include <bcmpci.h>
+
+static struct resource bcm_pci_io_resource = {
+	.name   = "bcm96348 pci IO space",
+	.start  = BCM_PCI_IO_BASE,
+	.end    = BCM_PCI_IO_BASE + BCM_PCI_IO_SIZE_64KB - 1,
+	.flags  = IORESOURCE_IO
+};
+
+static struct resource bcm_pci_mem_resource = {
+	.name   = "bcm96348 pci memory space",
+	.start  = BCM_PCI_MEM_BASE,
+	.end    = BCM_PCI_MEM_BASE + BCM_PCI_MEM_SIZE_16MB - 1,
+	.flags  = IORESOURCE_MEM
+};
+
+extern struct pci_ops bcm96348_pci_ops;
+
+struct pci_controller bcm96348_controller = {
+	.pci_ops   	= &bcm96348_pci_ops,
+	.io_resource	= &bcm_pci_io_resource,
+	.mem_resource	= &bcm_pci_mem_resource,
+};
+
+static __init int bcm96348_pci_init(void)
+{
+	/* Avoid ISA compat ranges.  */
+	PCIBIOS_MIN_IO = 0x00000000;
+	PCIBIOS_MIN_MEM = 0x00000000;
+
+	/* Set I/O resource limits.  */
+	ioport_resource.end = 0x1fffffff;
+	iomem_resource.end = 0xffffffff;
+
+	register_pci_controller(&bcm96348_controller);
+        return 0;
+}
+
+arch_initcall(bcm96348_pci_init);
diff --git a/target/linux/brcm63xx/files/drivers/mtd/maps/bcm963xx-flash.c b/target/linux/brcm63xx/files/drivers/mtd/maps/bcm963xx-flash.c
new file mode 100644
index 0000000..c4c4526
--- /dev/null
+++ b/target/linux/brcm63xx/files/drivers/mtd/maps/bcm963xx-flash.c
@@ -0,0 +1,277 @@
+/*
+ * $Id$
+ * Copyright (C) 2006  Florian Fainelli <florian@openwrt.org>
+ * 			Mike Albon <malbon@openwrt.org>
+ * Copyright (C) $Date$  $Author$
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/* This is the BCM963xx flash map driver, in its actual state it only supports BCM96348 devices
+ * this driver is able to manage both bootloader we found on these boards : CFE and RedBoot
+ *
+ * RedBoot :
+ *  - this bootloader allows us to parse partitions and therefore deduce the MTD partition table
+ *
+ * CFE :
+ *   - CFE partitionning can be detected as for BCM947xx devices 
+ *
+ */
+
+#include <asm/io.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/mtd/map.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/vmalloc.h>
+#include <board.h>
+
+#define WINDOW_ADDR 0x1FC00000         /* Real address of the flash */
+#define WINDOW_SIZE 0x400000           /* Size of flash */
+#define BUSWIDTH 2                     /* Buswidth */
+#define EXTENDED_SIZE 0xBFC00000       /* Extended flash address */
+#define IMAGE_LEN 10                   /* Length of Length Field */
+#define ADDRESS_LEN 12                 /* Length of Address field */
+#define ROUNDUP(x, y) ((((x)+((y)-1))/(y))*(y))
+
+extern int boot_loader_type;           /* For RedBoot / CFE detection */
+extern int parse_redboot_partitions(struct mtd_info *master, struct mtd_partition **pparts, unsigned long fis_origin);
+static struct mtd_partition *parsed_parts;
+
+static void __exit bcm963xx_mtd_cleanup(void);
+
+static struct mtd_info *bcm963xx_mtd_info;
+
+static struct map_info bcm963xx_map = {
+       .name = "bcm963xx",
+       .size = WINDOW_SIZE,
+       .bankwidth = BUSWIDTH,
+       .phys = WINDOW_ADDR,
+};
+
+
+int parse_cfe_partitions( struct mtd_info *master, struct mtd_partition **pparts)
+{
+       int nrparts = 2, curpart = 0; // CFE and NVRAM always present.
+       struct bcm963xx_cfe_map {
+       unsigned char tagVersion[4];                            // Version of the image tag
+       unsigned char sig_1[20];                                // Company Line 1
+       unsigned char sig_2[14];                                // Company Line 2
+       unsigned char chipid[6];                                        // Chip this image is for
+       unsigned char boardid[16];                              // Board name
+       unsigned char bigEndian[2];                             // Map endianness -- 1 BE 0 LE
+       unsigned char totalLength[IMAGE_LEN];           //Total length of image
+       unsigned char cfeAddress[ADDRESS_LEN];  // Address in memory of CFE
+       unsigned char cfeLength[IMAGE_LEN];             // Size of CFE
+       unsigned char rootAddress[ADDRESS_LEN];         // Address in memory of rootfs
+       unsigned char rootLength[IMAGE_LEN];            // Size of rootfs
+       unsigned char kernelAddress[ADDRESS_LEN];       // Address in memory of kernel
+       unsigned char kernelLength[IMAGE_LEN];  // Size of kernel
+       unsigned char dualImage[2];                             // Unused at present
+       unsigned char inactiveFlag[2];                  // Unused at present
+       unsigned char reserved1[74];                            // Reserved area not in use
+       unsigned char imageCRC[4];                              // CRC32 of images
+       unsigned char reserved2[16];                            // Unused at present
+       unsigned char headerCRC[4];                             // CRC32 of header excluding tagVersion
+       unsigned char reserved3[16];                            // Unused at present
+       } *buf;
+       struct mtd_partition *parts;
+       int ret;
+       size_t retlen;
+       unsigned int rootfsaddr, kerneladdr, spareaddr;
+       unsigned int rootfslen, kernellen, sparelen, totallen;
+       int namelen = 0;
+       int i;
+       // Allocate memory for buffer
+       buf = vmalloc(sizeof(struct bcm963xx_cfe_map));
+
+       if (!buf)
+               return -ENOMEM;
+
+       // Get the tag
+       ret = master->read(master,master->erasesize,sizeof(struct bcm963xx_cfe_map), &retlen, (void *)buf);
+       if (retlen != sizeof(struct bcm963xx_cfe_map)){
+               vfree(buf);
+               return -EIO;
+       };
+       printk("bcm963xx: CFE boot tag found with version %s and board type %s.\n",buf->tagVersion,buf->boardid);
+       // Get the values and calculate
+       sscanf(buf->rootAddress,"%u", &rootfsaddr);
+       rootfsaddr = rootfsaddr - EXTENDED_SIZE;
+       sscanf(buf->rootLength, "%u", &rootfslen);
+       sscanf(buf->kernelAddress, "%u", &kerneladdr);
+       kerneladdr = kerneladdr - EXTENDED_SIZE;
+       sscanf(buf->kernelLength, "%u", &kernellen);
+       sscanf(buf->totalLength, "%u", &totallen);
+       spareaddr = ROUNDUP(totallen,master->erasesize) + master->erasesize;
+       sparelen = master->size - spareaddr - master->erasesize;
+       // Determine number of partitions
+       namelen = 8;
+       if (rootfslen > 0){
+               nrparts++;
+               namelen =+ 6;
+       };
+       if (kernellen > 0){
+               nrparts++;
+               namelen =+ 6;
+       };
+       if (sparelen > 0){
+               nrparts++;
+               namelen =+ 6;
+       };
+       // Ask kernel for more memory.
+       parts = kmalloc(sizeof(*parts)*nrparts+10*nrparts, GFP_KERNEL);
+       if (!parts){
+               vfree(buf);
+               return -ENOMEM;
+       };
+       memset(parts,0,sizeof(*parts)*nrparts+10*nrparts);
+       // Start building partition list
+       parts[curpart].name = "CFE";
+       parts[curpart].offset = 0;
+       parts[curpart].size = master->erasesize;
+       curpart++;
+       if (kernellen > 0){
+               parts[curpart].name = "Kernel";
+               parts[curpart].offset = kerneladdr;
+               parts[curpart].size = kernellen;
+               curpart++;
+       };
+       if (rootfslen > 0){
+               parts[curpart].name = "Rootfs";
+               parts[curpart].offset = rootfsaddr;
+               parts[curpart].size = rootfslen;
+               curpart++;
+       };
+       if (sparelen > 0){
+               parts[curpart].name = "OpenWrt";
+               parts[curpart].offset = spareaddr;
+               parts[curpart].size = sparelen;
+               curpart++;
+       };
+       parts[curpart].name = "NVRAM";
+       parts[curpart].offset = master->size - master->erasesize;
+       parts[curpart].size = master->erasesize;
+       for (i = 0; i < nrparts; i++) {
+          printk("bcm963xx: Partition %d is %s offset %x and length %x\n", i, parts[i].name, parts[i].offset, parts[i].size);
+       }
+       *pparts = parts;
+       vfree(buf);
+       return nrparts;
+};
+
+static struct mtd_partition bcm963xx_parts[] = {
+        { name: "bootloader",  size: 0,        offset: 0,      mask_flags: MTD_WRITEABLE },
+        { name: "rootfs",              size: 0,        offset: 0},
+        { name: "jffs2",        size: 5 * 0x10000,      offset: 57*0x10000}
+};
+
+static int bcm963xx_parts_size = sizeof(bcm963xx_parts) / sizeof(bcm963xx_parts[0]);
+
+static int bcm963xx_detect_cfe(struct mtd_info *master)
+{
+       int idoffset = 0x4e0;
+       static char idstring[8] = "CFE1CFE1";
+       char buf[8];
+       int ret;
+       size_t retlen;
+
+       ret = master->read(master, idoffset, 8, &retlen, (void *)buf);
+       printk("bcm963xx: Read Signature value of %s\n", buf);
+       return strcmp(idstring,buf);
+}
+
+static int __init bcm963xx_mtd_init(void)
+{
+       printk("bcm963xx: 0x%08x at 0x%08x\n", WINDOW_SIZE, WINDOW_ADDR);
+       bcm963xx_map.virt = ioremap(WINDOW_ADDR, WINDOW_SIZE);
+
+       if (!bcm963xx_map.virt) {
+               printk("bcm963xx: Failed to ioremap\n");
+               return -EIO;
+       }
+
+       simple_map_init(&bcm963xx_map);
+
+       bcm963xx_mtd_info = do_map_probe("cfi_probe", &bcm963xx_map);
+
+       if (bcm963xx_mtd_info) {
+               bcm963xx_mtd_info->owner = THIS_MODULE;
+
+               //if (boot_loader_type == BOOT_CFE)
+               if (bcm963xx_detect_cfe(bcm963xx_mtd_info) == 0)
+               {
+                       int parsed_nr_parts = 0;
+                       char * part_type;
+                       printk("bcm963xx: CFE bootloader detected\n");
+                       //add_mtd_device(bcm963xx_mtd_info);
+                       //add_mtd_partitions(bcm963xx_mtd_info, bcm963xx_parts, bcm963xx_parts_size);
+                       if (parsed_nr_parts == 0) {
+                               int ret = parse_cfe_partitions(bcm963xx_mtd_info, &parsed_parts);
+                               if (ret > 0) {
+                                       part_type = "CFE";
+                                       parsed_nr_parts = ret;
+                               }
+                       }
+                       add_mtd_partitions(bcm963xx_mtd_info, parsed_parts, parsed_nr_parts);
+                       return 0;
+               }
+               else
+               {
+                       int parsed_nr_parts = 0;
+                       char * part_type;
+
+                       if (bcm963xx_mtd_info->size > 0x00400000) {
+                               printk("Support for extended flash memory size : 0x%08X ; ONLY 64MBIT SUPPORT\n", bcm963xx_mtd_info->size);
+                               bcm963xx_map.virt = (unsigned long)(EXTENDED_SIZE);
+                       }
+
+#ifdef CONFIG_MTD_REDBOOT_PARTS
+                       if (parsed_nr_parts == 0) {
+                               int ret = parse_redboot_partitions(bcm963xx_mtd_info, &parsed_parts, 0);
+                               if (ret > 0) {
+                                       part_type = "RedBoot";
+                                       parsed_nr_parts = ret;
+                               }
+                       }
+#endif
+                       add_mtd_partitions(bcm963xx_mtd_info, parsed_parts, parsed_nr_parts);
+
+                       return 0;
+               }
+       }
+       iounmap(bcm963xx_map.virt);
+       return -ENXIO;
+}
+
+static void __exit bcm963xx_mtd_cleanup(void)
+{
+       if (bcm963xx_mtd_info) {
+               del_mtd_partitions(bcm963xx_mtd_info);
+               map_destroy(bcm963xx_mtd_info);
+       }
+
+       if (bcm963xx_map.virt) {
+               iounmap(bcm963xx_map.virt);
+               bcm963xx_map.virt = 0;
+       }
+}
+
+module_init(bcm963xx_mtd_init);
+module_exit(bcm963xx_mtd_cleanup);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Florian Fainelli <florian@openwrt.org> Mike Albon <malbon@openwrt.org>");
diff --git a/target/linux/brcm63xx/files/drivers/serial/bcm63xx_cons.c b/target/linux/brcm63xx/files/drivers/serial/bcm63xx_cons.c
new file mode 100644
index 0000000..b026aa1
--- /dev/null
+++ b/target/linux/brcm63xx/files/drivers/serial/bcm63xx_cons.c
@@ -0,0 +1,1041 @@
+/*
+<:copyright-gpl 
+ Copyright 2002 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+
+/* Description: Serial port driver for the BCM963XX. */
+
+#define CARDNAME    "bcm963xx_serial driver"
+#define VERSION     "2.0"
+#define VER_STR     CARDNAME " v" VERSION "\n"
+
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/spinlock.h>
+
+/* for definition of struct console */
+#include <linux/console.h>
+#include <linux/tty.h>
+#include <linux/tty_flip.h>
+#include <linux/serial.h>
+#include <linux/serialP.h>
+#include <asm/uaccess.h>
+
+#include <bcmtypes.h>
+#include <board.h>
+#include <bcm_map_part.h>
+#include <bcm_intr.h>
+#include <6348_map_part.h>
+#include <6348_intr.h>
+
+static DEFINE_SPINLOCK(bcm963xx_serial_lock);
+
+extern void _putc(char);
+extern void _puts(const char *);
+
+typedef struct bcm_serial {
+	volatile Uart *port;
+	int type;
+	int flags;
+	int irq;
+	int baud_base;
+	int blocked_open;
+	unsigned short close_delay;
+	unsigned short closing_wait;
+	unsigned short line;	/* port/line number */
+	unsigned short cflags;	/* line configuration flag */
+	unsigned short x_char;	/* xon/xoff character */
+	unsigned short read_status_mask;	/* mask for read condition */
+	unsigned short ignore_status_mask;	/* mask for ignore condition */
+	unsigned long event;	/* mask used in BH */
+	int xmit_head;		/* Position of the head */
+	int xmit_tail;		/* Position of the tail */
+	int xmit_cnt;		/* Count of the chars in the buffer */
+	int count;		/* indicates how many times it has been opened */
+	int magic;
+
+	struct async_icount icount;	/* keep track of things ... */
+	struct tty_struct *tty;	/* tty associated */
+	struct ktermios normal_termios;
+
+	wait_queue_head_t open_wait;
+	wait_queue_head_t close_wait;
+
+	long session;		/* Session of opening process */
+	long pgrp;		/* pgrp of opening process */
+
+	unsigned char is_initialized;
+} Context;
+
+
+/*---------------------------------------------------------------------*/
+/* Define bits in the Interrupt Enable register                        */
+/*---------------------------------------------------------------------*/
+/* Enable receive interrupt              */
+#define RXINT   (RXFIFONE|RXOVFERR)
+
+/* Enable transmit interrupt             */
+#define TXINT    (TXFIFOEMT|TXUNDERR|TXOVFERR)
+
+/* Enable receiver line status interrupt */
+#define LSINT    (RXBRK|RXPARERR|RXFRAMERR)
+
+#define BCM_NUM_UARTS                   1
+
+#define BD_BCM63XX_TIMER_CLOCK_INPUT    (FPERIPH)
+
+
+static struct bcm_serial multi[BCM_NUM_UARTS];
+static struct bcm_serial *lines[BCM_NUM_UARTS];
+static struct tty_driver *serial_driver;
+static struct ktermios *serial_termios[BCM_NUM_UARTS];
+static struct ktermios *serial_termios_locked[BCM_NUM_UARTS];
+
+
+static void bcm_stop(struct tty_struct *tty);
+static void bcm_start(struct tty_struct *tty);
+static inline void receive_chars(struct bcm_serial *info);
+static int startup(struct bcm_serial *info);
+static void shutdown(struct bcm_serial *info);
+static void change_speed(volatile Uart * pUart, tcflag_t cFlag);
+static void bcm63xx_cons_flush_chars(struct tty_struct *tty);
+static int bcm63xx_cons_write(struct tty_struct *tty,
+			      const unsigned char *buf, int count);
+static int bcm63xx_cons_write_room(struct tty_struct *tty);
+static int bcm_chars_in_buffer(struct tty_struct *tty);
+static void bcm_flush_buffer(struct tty_struct *tty);
+static void bcm_throttle(struct tty_struct *tty);
+static void bcm_unthrottle(struct tty_struct *tty);
+static void bcm_send_xchar(struct tty_struct *tty, char ch);
+static int get_serial_info(struct bcm_serial *info,
+			   struct serial_struct *retinfo);
+static int set_serial_info(struct bcm_serial *info,
+			   struct serial_struct *new_info);
+static int get_lsr_info(struct bcm_serial *info, unsigned int *value);
+static void send_break(struct bcm_serial *info, int duration);
+static int bcm_ioctl(struct tty_struct *tty, struct file *file,
+		     unsigned int cmd, unsigned long arg);
+static void bcm_set_termios(struct tty_struct *tty,
+			    struct ktermios *old_termios);
+static void bcm63xx_cons_close(struct tty_struct *tty, struct file *filp);
+static void bcm_hangup(struct tty_struct *tty);
+static int block_til_ready(struct tty_struct *tty, struct file *filp,
+			   struct bcm_serial *info);
+static int bcm63xx_cons_open(struct tty_struct *tty, struct file *filp);
+static int __init bcm63xx_serialinit(void);
+
+
+/*
+ * ------------------------------------------------------------
+ * rs_stop () and rs_start ()
+ *
+ * These routines are called before setting or resetting 
+ * tty->stopped. They enable or disable transmitter interrupts, 
+ * as necessary.
+ * ------------------------------------------------------------
+ */
+static void bcm_stop(struct tty_struct *tty)
+{
+}
+
+static void bcm_start(struct tty_struct *tty)
+{
+	_puts(CARDNAME " Start\n");
+}
+
+/*
+ * ------------------------------------------------------------
+ * receive_char ()
+ *
+ * This routine deals with inputs from any lines.
+ * ------------------------------------------------------------
+ */
+static inline void receive_chars(struct bcm_serial *info)
+{
+	struct tty_struct *tty = 0;
+	struct async_icount *icount;
+	int ignore = 0;
+	unsigned short status, tmp;
+	UCHAR ch = 0;
+	while ((status = info->port->intStatus) & RXINT) {
+		char flag_char = TTY_NORMAL;
+
+		if (status & RXFIFONE)
+			ch = info->port->Data;	// Read the character
+		tty = info->tty;	/* now tty points to the proper dev */
+		icount = &info->icount;
+		if (!tty)
+			break;
+		if (!tty_buffer_request_room(tty, 1))
+			break;
+		icount->rx++;
+		if (status & RXBRK) {
+			flag_char = TTY_BREAK;
+			icount->brk++;
+		}
+		// keep track of the statistics
+		if (status & (RXFRAMERR | RXPARERR | RXOVFERR)) {
+			if (status & RXPARERR)	/* parity error */
+				icount->parity++;
+			else if (status & RXFRAMERR)	/* frame error */
+				icount->frame++;
+			if (status & RXOVFERR) {
+				// Overflow. Reset the RX FIFO
+				info->port->fifoctl |= RSTRXFIFOS;
+				icount->overrun++;
+			}
+			// check to see if we should ignore the character
+			// and mask off conditions that should be ignored
+			if (status & info->ignore_status_mask) {
+				if (++ignore > 100)
+					break;
+				goto ignore_char;
+			}
+			// Mask off the error conditions we want to ignore
+			tmp = status & info->read_status_mask;
+			if (tmp & RXPARERR) {
+				flag_char = TTY_PARITY;
+			} else if (tmp & RXFRAMERR) {
+				flag_char = TTY_FRAME;
+			}
+			if (tmp & RXOVFERR) {
+				tty_insert_flip_char(tty, ch, flag_char);
+				ch = 0;
+				flag_char = TTY_OVERRUN;
+				if (!tty_buffer_request_room(tty, 1))
+					break;
+			}
+		}
+		tty_insert_flip_char(tty, ch, flag_char);
+	}
+      ignore_char:;
+	tty_flip_buffer_push(tty);
+	tty_schedule_flip(tty);
+
+}
+
+
+/*
+ * ------------------------------------------------------------
+ * bcm_interrupt ()
+ *
+ * this is the main interrupt routine for the chip.
+ * It deals with the multiple ports.
+ * ------------------------------------------------------------
+ */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+static irqreturn_t bcm_interrupt(int irq, void *dev)
+#else
+static void bcm_interrupt(int irq, void *dev, struct pt_regs *regs)
+#endif
+{
+	struct bcm_serial *info = lines[0];
+	UINT16 intStat;
+
+	/* get pending interrupt flags from UART  */
+
+	/* Mask with only the serial interrupts that are enabled */
+	intStat = info->port->intStatus & info->port->intMask;
+	while (intStat) {
+		if (intStat & RXINT)
+			receive_chars(info);
+		else if (intStat & TXINT)
+			info->port->intStatus = TXINT;
+		else		/* don't know what it was, so let's mask it */
+			info->port->intMask &= ~intStat;
+
+		intStat = info->port->intStatus & info->port->intMask;
+	}
+
+	// Clear the interrupt
+	enable_brcm_irq(INTERRUPT_ID_UART);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+	return IRQ_HANDLED;
+#endif
+}
+
+/*
+ * -------------------------------------------------------------------
+ * startup ()
+ *
+ * various initialization tasks
+ * ------------------------------------------------------------------- 
+ */
+static int startup(struct bcm_serial *info)
+{
+	// Port is already started...
+	return 0;
+}
+
+/* 
+ * -------------------------------------------------------------------
+ * shutdown ()
+ *
+ * This routine will shutdown a serial port; interrupts are disabled, and
+ * DTR is dropped if the hangup on close termio flag is on.
+ * ------------------------------------------------------------------- 
+ */
+static void shutdown(struct bcm_serial *info)
+{
+	unsigned long flags;
+	if (!info->is_initialized)
+		return;
+
+	spin_lock_irqsave(&bcm963xx_serial_lock, flags);
+
+	info->port->control &= ~(BRGEN | TXEN | RXEN);
+	if (info->tty)
+		set_bit(TTY_IO_ERROR, &info->tty->flags);
+	info->is_initialized = 0;
+
+	spin_unlock_irqrestore(&bcm963xx_serial_lock, flags);
+}
+
+/* 
+ * -------------------------------------------------------------------
+ * change_speed ()
+ *
+ * Set the baud rate, character size, parity and stop bits.
+ * ------------------------------------------------------------------- 
+ */
+static void change_speed(volatile Uart * pUart, tcflag_t cFlag)
+{
+	unsigned long ulFlags, ulBaud, ulClockFreqHz, ulTmp;
+
+	spin_lock_irqsave(&bcm963xx_serial_lock, ulFlags);
+	switch (cFlag & (CBAUD | CBAUDEX)) {
+	case B115200:
+		ulBaud = 115200;
+		break;
+	case B57600:
+		ulBaud = 57600;
+		break;
+	case B38400:
+		ulBaud = 38400;
+		break;
+	case B19200:
+		ulBaud = 19200;
+		break;
+	case B9600:
+		ulBaud = 9600;
+		break;
+	case B4800:
+		ulBaud = 4800;
+		break;
+	case B2400:
+		ulBaud = 2400;
+		break;
+	case B1800:
+		ulBaud = 1800;
+		break;
+	case B1200:
+		ulBaud = 1200;
+		break;
+	case B600:
+		ulBaud = 600;
+		break;
+	case B300:
+		ulBaud = 300;
+		break;
+	case B200:
+		ulBaud = 200;
+		break;
+	case B150:
+		ulBaud = 150;
+		break;
+	case B134:
+		ulBaud = 134;
+		break;
+	case B110:
+		ulBaud = 110;
+		break;
+	case B75:
+		ulBaud = 75;
+		break;
+	case B50:
+		ulBaud = 50;
+		break;
+	default:
+		ulBaud = 115200;
+		break;
+	}
+
+	/* Calculate buad rate.  */
+	ulClockFreqHz = BD_BCM63XX_TIMER_CLOCK_INPUT;
+	ulTmp = (ulClockFreqHz / ulBaud) / 16;
+	if (ulTmp & 0x01)
+		ulTmp /= 2;	/* Rounding up, so sub is already accounted for */
+	else
+		ulTmp = (ulTmp / 2) - 1;	/* Rounding down so we must sub 1 */
+	pUart->baudword = ulTmp;
+
+	/* Set character size, stop bits and parity.  */
+	switch (cFlag & CSIZE) {
+	case CS5:
+		ulTmp = BITS5SYM;	/* select transmit 5 bit data size */
+		break;
+	case CS6:
+		ulTmp = BITS6SYM;	/* select transmit 6 bit data size */
+		break;
+	case CS7:
+		ulTmp = BITS7SYM;	/* select transmit 7 bit data size */
+		break;
+	default:
+		ulTmp = BITS8SYM;	/* select transmit 8 bit data size */
+		break;
+	}
+	if (cFlag & CSTOPB)
+		ulTmp |= TWOSTOP;	/* select 2 stop bits */
+	else
+		ulTmp |= ONESTOP;	/* select one stop bit */
+
+	/* Write these values into the config reg.  */
+	pUart->config = ulTmp;
+	pUart->control &=
+	    ~(RXPARITYEN | TXPARITYEN | RXPARITYEVEN | TXPARITYEVEN);
+	switch (cFlag & (PARENB | PARODD)) {
+	case PARENB | PARODD:
+		pUart->control |= RXPARITYEN | TXPARITYEN;
+		break;
+	case PARENB:
+		pUart->control |=
+		    RXPARITYEN | TXPARITYEN | RXPARITYEVEN | TXPARITYEVEN;
+		break;
+	default:
+		pUart->control |= 0;
+		break;
+	}
+
+	/* Reset and flush uart */
+	pUart->fifoctl = RSTTXFIFOS | RSTRXFIFOS;
+	spin_unlock_irqrestore(&bcm963xx_serial_lock, ulFlags);
+}
+
+
+/* 
+ * -------------------------------------------------------------------
+ * bcm_flush_char ()
+ *
+ * Nothing to flush.  Polled I/O is used.
+ * ------------------------------------------------------------------- 
+ */
+static void bcm63xx_cons_flush_chars(struct tty_struct *tty)
+{
+}
+
+
+/* 
+ * -------------------------------------------------------------------
+ * bcm63xx_cons_write ()
+ *
+ * Main output routine using polled I/O.
+ * ------------------------------------------------------------------- 
+ */
+static int bcm63xx_cons_write(struct tty_struct *tty,
+			      const unsigned char *buf, int count)
+{
+	int c;
+
+	for (c = 0; c < count; c++)
+		_putc(buf[c]);
+	return count;
+}
+
+/* 
+ * -------------------------------------------------------------------
+ * bcm63xx_cons_write_room ()
+ *
+ * Compute the amount of space available for writing.
+ * ------------------------------------------------------------------- 
+ */
+static int bcm63xx_cons_write_room(struct tty_struct *tty)
+{
+	/* Pick a number.  Any number.  Polled I/O is used. */
+	return 1024;
+}
+
+/* 
+ * -------------------------------------------------------------------
+ * bcm_chars_in_buffer ()
+ *
+ * compute the amount of char left to be transmitted
+ * ------------------------------------------------------------------- 
+ */
+static int bcm_chars_in_buffer(struct tty_struct *tty)
+{
+	return 0;
+}
+
+/* 
+ * -------------------------------------------------------------------
+ * bcm_flush_buffer ()
+ *
+ * Empty the output buffer
+ * ------------------------------------------------------------------- 
+ */
+static void bcm_flush_buffer(struct tty_struct *tty)
+{
+	tty_wakeup(tty);
+}
+
+/*
+ * ------------------------------------------------------------
+ * bcm_throttle () and bcm_unthrottle ()
+ * 
+ * This routine is called by the upper-layer tty layer to signal that
+ * incoming characters should be throttled (or not).
+ * ------------------------------------------------------------
+ */
+static void bcm_throttle(struct tty_struct *tty)
+{
+	struct bcm_serial *info = (struct bcm_serial *) tty->driver_data;
+	if (I_IXOFF(tty))
+		info->x_char = STOP_CHAR(tty);
+}
+
+static void bcm_unthrottle(struct tty_struct *tty)
+{
+	struct bcm_serial *info = (struct bcm_serial *) tty->driver_data;
+	if (I_IXOFF(tty)) {
+		if (info->x_char)
+			info->x_char = 0;
+		else
+			info->x_char = START_CHAR(tty);
+	}
+}
+
+static void bcm_send_xchar(struct tty_struct *tty, char ch)
+{
+	struct bcm_serial *info = (struct bcm_serial *) tty->driver_data;
+	info->x_char = ch;
+	if (ch)
+		bcm_start(info->tty);
+}
+
+/*
+ * ------------------------------------------------------------
+ * rs_ioctl () and friends
+ * ------------------------------------------------------------
+ */
+static int get_serial_info(struct bcm_serial *info,
+			   struct serial_struct *retinfo)
+{
+	struct serial_struct tmp;
+
+	if (!retinfo)
+		return -EFAULT;
+
+	memset(&tmp, 0, sizeof(tmp));
+	tmp.type = info->type;
+	tmp.line = info->line;
+	tmp.port = (int) info->port;
+	tmp.irq = info->irq;
+	tmp.flags = 0;
+	tmp.baud_base = info->baud_base;
+	tmp.close_delay = info->close_delay;
+	tmp.closing_wait = info->closing_wait;
+
+	return copy_to_user(retinfo, &tmp, sizeof(*retinfo));
+}
+
+static int set_serial_info(struct bcm_serial *info,
+			   struct serial_struct *new_info)
+{
+	struct serial_struct new_serial;
+	struct bcm_serial old_info;
+	int retval = 0;
+
+	if (!new_info)
+		return -EFAULT;
+
+	copy_from_user(&new_serial, new_info, sizeof(new_serial));
+	old_info = *info;
+
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
+
+	if (info->count > 1)
+		return -EBUSY;
+
+	/* OK, past this point, all the error checking has been done.
+	 * At this point, we start making changes.....
+	 */
+	info->baud_base = new_serial.baud_base;
+	info->type = new_serial.type;
+	info->close_delay = new_serial.close_delay;
+	info->closing_wait = new_serial.closing_wait;
+	retval = startup(info);
+	return retval;
+}
+
+/*
+ * get_lsr_info - get line status register info
+ *
+ * Purpose: Let user call ioctl() to get info when the UART physically
+ *          is emptied.  On bus types like RS485, the transmitter must
+ *          release the bus after transmitting. This must be done when
+ *          the transmit shift register is empty, not be done when the
+ *          transmit holding register is empty.  This functionality
+ *          allows an RS485 driver to be written in user space. 
+ */
+static int get_lsr_info(struct bcm_serial *info, unsigned int *value)
+{
+	return (0);
+}
+
+/*
+ * This routine sends a break character out the serial port.
+ */
+static void send_break(struct bcm_serial *info, int duration)
+{
+	unsigned long flags;
+
+	if (!info->port)
+		return;
+
+	current->state = TASK_INTERRUPTIBLE;
+
+	/*save_flags (flags);
+	   cli(); */
+	spin_lock_irqsave(&bcm963xx_serial_lock, flags);
+
+	info->port->control |= XMITBREAK;
+	schedule_timeout(duration);
+	info->port->control &= ~XMITBREAK;
+
+	spin_unlock_irqrestore(&bcm963xx_serial_lock, flags);
+	//restore_flags (flags);
+}
+
+static int bcm_ioctl(struct tty_struct *tty, struct file *file,
+		     unsigned int cmd, unsigned long arg)
+{
+	int error;
+	struct bcm_serial *info = (struct bcm_serial *) tty->driver_data;
+	int retval;
+
+	if ((cmd != TIOCGSERIAL) && (cmd != TIOCSSERIAL) &&
+	    (cmd != TIOCSERCONFIG) && (cmd != TIOCSERGWILD) &&
+	    (cmd != TIOCSERSWILD) && (cmd != TIOCSERGSTRUCT)) {
+		if (tty->flags & (1 << TTY_IO_ERROR))
+			return -EIO;
+	}
+	switch (cmd) {
+
+	case TCSBRK:		/* SVID version: non-zero arg --> no break */
+		retval = tty_check_change(tty);
+		if (retval)
+			return retval;
+		tty_wait_until_sent(tty, 0);
+		if (!arg)
+			send_break(info, HZ / 4);	/* 1/4 second */
+		return 0;
+
+	case TCSBRKP:		/* support for POSIX tcsendbreak() */
+		retval = tty_check_change(tty);
+		if (retval)
+			return retval;
+		tty_wait_until_sent(tty, 0);
+		send_break(info, arg ? arg * (HZ / 10) : HZ / 4);
+		return 0;
+
+	case TIOCGSOFTCAR:
+		error =
+		    access_ok(VERIFY_WRITE, (void *) arg, sizeof(long));
+		if (!error)
+			return -EFAULT;
+		else {
+			put_user(C_CLOCAL(tty) ? 1 : 0,
+				 (unsigned long *) arg);
+			return 0;
+		}
+
+	case TIOCSSOFTCAR:
+		error = get_user(arg, (unsigned long *) arg);
+		if (error)
+			return error;
+		tty->termios->c_cflag =
+		    ((tty->termios->
+		      c_cflag & ~CLOCAL) | (arg ? CLOCAL : 0));
+		return 0;
+
+	case TIOCGSERIAL:
+		error =
+		    access_ok(VERIFY_WRITE, (void *) arg,
+			      sizeof(struct serial_struct));
+		if (!error)
+			return -EFAULT;
+		else
+			return get_serial_info(info,
+					       (struct serial_struct *)
+					       arg);
+
+	case TIOCSSERIAL:
+		return set_serial_info(info, (struct serial_struct *) arg);
+
+	case TIOCSERGETLSR:	/* Get line status register */
+		error =
+		    access_ok(VERIFY_WRITE, (void *) arg,
+			      sizeof(unsigned int));
+		if (!error)
+			return -EFAULT;
+		else
+			return get_lsr_info(info, (unsigned int *) arg);
+
+	case TIOCSERGSTRUCT:
+		error =
+		    access_ok(VERIFY_WRITE, (void *) arg,
+			      sizeof(struct bcm_serial));
+		if (!error)
+			return -EFAULT;
+		else {
+			copy_to_user((struct bcm_serial *) arg, info,
+				     sizeof(struct bcm_serial));
+			return 0;
+		}
+
+	default:
+		return -ENOIOCTLCMD;
+	}
+	return 0;
+}
+
+static void bcm_set_termios(struct tty_struct *tty,
+			    struct ktermios *old_termios)
+{
+	struct bcm_serial *info = (struct bcm_serial *) tty->driver_data;
+
+	if (tty->termios->c_cflag != old_termios->c_cflag)
+		change_speed(info->port, tty->termios->c_cflag);
+}
+
+/*
+ * ------------------------------------------------------------
+ * bcm63xx_cons_close()
+ * 
+ * This routine is called when the serial port gets closed.  First, we
+ * wait for the last remaining data to be sent.  Then, we turn off
+ * the transmit enable and receive enable flags.
+ * ------------------------------------------------------------
+ */
+static void bcm63xx_cons_close(struct tty_struct *tty, struct file *filp)
+{
+	struct bcm_serial *info = (struct bcm_serial *) tty->driver_data;
+	unsigned long flags;
+
+	if (!info)
+		return;
+
+	/*save_flags (flags); 
+	   cli(); */
+	spin_lock_irqsave(&bcm963xx_serial_lock, flags);
+
+	if (tty_hung_up_p(filp)) {
+		spin_unlock_irqrestore(&bcm963xx_serial_lock, flags);
+		//restore_flags (flags);
+		return;
+	}
+
+	if ((tty->count == 1) && (info->count != 1)) {
+
+		/* Uh, oh.  tty->count is 1, which means that the tty
+		 * structure will be freed.  Info->count should always
+		 * be one in these conditions.  If it's greater than
+		 * one, we've got real problems, since it means the
+		 * serial port won't be shutdown.
+		 */
+		printk
+		    ("bcm63xx_cons_close: bad serial port count; tty->count is 1, "
+		     "info->count is %d\n", info->count);
+		info->count = 1;
+	}
+
+	if (--info->count < 0) {
+		printk("ds_close: bad serial port count for ttys%d: %d\n",
+		       info->line, info->count);
+		info->count = 0;
+	}
+
+	if (info->count) {
+		//restore_flags (flags);
+		spin_unlock_irqrestore(&bcm963xx_serial_lock, flags);
+		return;
+	}
+
+	/* Now we wait for the transmit buffer to clear; and we notify 
+	 * the line discipline to only process XON/XOFF characters.
+	 */
+	tty->closing = 1;
+
+	/* At this point we stop accepting input.  To do this, we
+	 * disable the receive line status interrupts.
+	 */
+	shutdown(info);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+	if (tty->driver->flush_buffer)
+		tty->driver->flush_buffer(tty);
+#else
+	if (tty->driver.flush_buffer)
+		tty->driver.flush_buffer(tty);
+#endif
+	if (tty->ldisc.flush_buffer)
+		tty->ldisc.flush_buffer(tty);
+
+	tty->closing = 0;
+	info->event = 0;
+	info->tty = 0;
+	if (tty->ldisc.num != tty_ldisc_get(N_TTY)->num) {
+		if (tty->ldisc.close)
+			(tty->ldisc.close) (tty);
+		tty->ldisc = *tty_ldisc_get(N_TTY);
+		tty->termios->c_line = N_TTY;
+		if (tty->ldisc.open)
+			(tty->ldisc.open) (tty);
+	}
+	if (info->blocked_open) {
+		if (info->close_delay) {
+			current->state = TASK_INTERRUPTIBLE;
+			schedule_timeout(info->close_delay);
+		}
+		wake_up_interruptible(&info->open_wait);
+	}
+	wake_up_interruptible(&info->close_wait);
+
+	//restore_flags (flags);
+	spin_unlock_irqrestore(&bcm963xx_serial_lock, flags);
+}
+
+/*
+ * bcm_hangup () --- called by tty_hangup() when a hangup is signaled.
+ */
+static void bcm_hangup(struct tty_struct *tty)
+{
+
+	struct bcm_serial *info = (struct bcm_serial *) tty->driver_data;
+
+	shutdown(info);
+	info->event = 0;
+	info->count = 0;
+	info->tty = 0;
+	wake_up_interruptible(&info->open_wait);
+}
+
+/*
+ * ------------------------------------------------------------
+ * rs_open() and friends
+ * ------------------------------------------------------------
+ */
+static int block_til_ready(struct tty_struct *tty, struct file *filp,
+			   struct bcm_serial *info)
+{
+	return 0;
+}
+
+/*
+ * This routine is called whenever a serial port is opened.  It
+ * enables interrupts for a serial port. It also performs the 
+ * serial-specific initialization for the tty structure.
+ */
+static int bcm63xx_cons_open(struct tty_struct *tty, struct file *filp)
+{
+	struct bcm_serial *info;
+	int retval, line;
+
+	// Make sure we're only opening on of the ports we support
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+	line = MINOR(tty->driver->cdev.dev) - tty->driver->minor_start;
+#else
+	line = MINOR(tty->device) - tty->driver.minor_start;
+#endif
+
+	if ((line < 0) || (line >= BCM_NUM_UARTS))
+		return -ENODEV;
+
+	info = lines[line];
+
+	tty->low_latency = 1;
+	info->port->intMask = 0;	/* Clear any pending interrupts */
+	info->port->intMask = RXINT;	/* Enable RX */
+
+	info->count++;
+	tty->driver_data = info;
+	info->tty = tty;
+	enable_brcm_irq(INTERRUPT_ID_UART);
+
+	// Start up serial port
+	retval = startup(info);
+	if (retval)
+		return retval;
+
+	retval = block_til_ready(tty, filp, info);
+	if (retval)
+		return retval;
+
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+	info->pgrp = process_group(current);
+#else
+	info->session = current->session;
+	info->pgrp = current->pgrp;
+#endif
+
+	return 0;
+}
+
+
+static struct tty_operations rs_ops = {
+	.open = bcm63xx_cons_open,
+	.close = bcm63xx_cons_close,
+	.write = bcm63xx_cons_write,
+	.flush_chars = bcm63xx_cons_flush_chars,
+	.write_room = bcm63xx_cons_write_room,
+	.chars_in_buffer = bcm_chars_in_buffer,
+	.flush_buffer = bcm_flush_buffer,
+	.ioctl = bcm_ioctl,
+	.throttle = bcm_throttle,
+	.unthrottle = bcm_unthrottle,
+	.send_xchar = bcm_send_xchar,
+	.set_termios = bcm_set_termios,
+	.stop = bcm_stop,
+	.start = bcm_start,
+	.hangup = bcm_hangup,
+};
+
+/* --------------------------------------------------------------------------
+    Name: bcm63xx_serialinit
+ Purpose: Initialize our BCM63xx serial driver
+-------------------------------------------------------------------------- */
+static int __init bcm63xx_serialinit(void)
+{
+	int i, flags;
+	struct bcm_serial *info;
+
+	// Print the driver version information
+	printk(VER_STR);
+	serial_driver = alloc_tty_driver(BCM_NUM_UARTS);
+	if (!serial_driver)
+		return -ENOMEM;
+
+	serial_driver->owner = THIS_MODULE;
+	serial_driver->name = "ttyS";
+	serial_driver->major = TTY_MAJOR;
+	serial_driver->minor_start = 64;
+	serial_driver->num = 1;
+	serial_driver->type = TTY_DRIVER_TYPE_SERIAL;
+	serial_driver->subtype = SERIAL_TYPE_NORMAL;
+	serial_driver->init_termios = tty_std_termios;
+	serial_driver->init_termios.c_cflag = B115200 | CS8 | CREAD | HUPCL | CLOCAL;
+	serial_driver->flags = TTY_DRIVER_REAL_RAW;
+
+	serial_driver->termios = serial_termios;
+	serial_driver->termios_locked = serial_termios_locked;
+
+	tty_set_operations(serial_driver, &rs_ops);
+
+	if (tty_register_driver(serial_driver))
+		panic("Couldn't register serial driver\n");
+
+	//save_flags(flags); cli();
+	spin_lock_irqsave(&bcm963xx_serial_lock, flags);
+
+	for (i = 0; i < 1; i++) {
+		info = &multi[i];
+		lines[i] = info;
+		info->magic = SERIAL_MAGIC;
+		info->port = (Uart *) ((char *) UART_BASE + (i * 0x20));
+		info->tty = 0;
+		info->irq = (2 - i) + 8;
+		info->line = i;
+		info->close_delay = 50;
+		info->closing_wait = 3000;
+		info->x_char = 0;
+		info->event = 0;
+		info->count = 0;
+		info->blocked_open = 0;
+		info->normal_termios = serial_driver->init_termios;
+		init_waitqueue_head(&info->open_wait);
+		init_waitqueue_head(&info->close_wait);
+
+		/* If we are pointing to address zero then punt - not correctly
+		 * set up in setup.c to handle this. 
+		 */
+		if (!info->port)
+			return 0;
+		BcmHalMapInterrupt(bcm_interrupt, 0, INTERRUPT_ID_UART);
+	}
+
+	/* order matters here... the trick is that flags
+	 * is updated... in request_irq - to immediatedly obliterate
+	 * it is unwise. 
+	 */
+	spin_unlock_irqrestore(&bcm963xx_serial_lock, flags);
+	return 0;
+}
+
+module_init(bcm63xx_serialinit);
+
+/* --------------------------------------------------------------------------
+    Name: bcm_console_print
+ Purpose: bcm_console_print is registered for printk.
+          The console_lock must be held when we get here.
+-------------------------------------------------------------------------- */
+static void bcm_console_print(struct console *cons, const char *str,
+			      unsigned int count)
+{
+	unsigned int i;
+	//_puts(str);
+	for (i = 0; i < count; i++, str++) {
+		_putc(*str);
+		if (*str == 10) {
+			_putc(13);
+		}
+	}
+}
+
+static struct tty_driver *bcm_console_device(struct console *c, int *index)
+{
+	*index = c->index;
+	return serial_driver;
+}
+
+static int __init bcm_console_setup(struct console *co, char *options)
+{
+	return 0;
+}
+
+static struct console bcm_sercons = {
+	.name = "ttyS",
+	.write = bcm_console_print,
+	.device = bcm_console_device,
+	.setup = bcm_console_setup,
+	.flags = CON_PRINTBUFFER,
+	.index = -1,
+};
+
+static int __init bcm63xx_console_init(void)
+{
+	register_console(&bcm_sercons);
+	return 0;
+}
+
+console_initcall(bcm63xx_console_init);
diff --git a/target/linux/brcm63xx/files/include/asm-mips/cfe.h b/target/linux/brcm63xx/files/include/asm-mips/cfe.h
new file mode 100644
index 0000000..47c3f56
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/asm-mips/cfe.h
@@ -0,0 +1,189 @@
+/*
+ * Broadcom Common Firmware Environment (CFE) support
+ *
+ * Copyright 2000, 2001, 2002
+ * Broadcom Corporation. All rights reserved.
+ *
+ * Copyright (C) 2006 Michael Buesch
+ *
+ * Original Authors:  Mitch Lichtenberg, Chris Demetriou
+ *
+ * This software is furnished under license and may be used and copied only
+ * in accordance with the following terms and conditions.  Subject to these
+ * conditions, you may download, copy, install, use, modify and distribute
+ * modified or unmodified copies of this software in source and/or binary
+ * form. No title or ownership is transferred hereby.
+ *
+ * 1) Any source code used, modified or distributed must reproduce and
+ *    retain this copyright notice and list of conditions as they appear in
+ *    the source file.
+ *
+ * 2) No right is granted to use any trade name, trademark, or logo of
+ *    Broadcom Corporation.  The "Broadcom Corporation" name may not be
+ *    used to endorse or promote products derived from this software
+ *    without the prior written permission of Broadcom Corporation.
+ *
+ * 3) THIS SOFTWARE IS PROVIDED "AS-IS" AND ANY EXPRESS OR IMPLIED
+ *    WARRANTIES, INCLUDING BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF
+ *    MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
+ *    NON-INFRINGEMENT ARE DISCLAIMED. IN NO EVENT SHALL BROADCOM BE LIABLE
+ *    FOR ANY DAMAGES WHATSOEVER, AND IN PARTICULAR, BROADCOM SHALL NOT BE
+ *    LIABLE FOR DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ *    CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ *    BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ *    WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ *    OR OTHERWISE), EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LINUX_CFE_API_H_
+#define LINUX_CFE_API_H_
+
+#include <linux/types.h>
+
+
+#define CFE_MI_RESERVED		0		/* memory is reserved, do not use */
+#define CFE_MI_AVAILABLE	1		/* memory is available */
+
+#define CFE_FLG_WARMSTART	0x00000001
+#define CFE_FLG_FULL_ARENA	0x00000001
+#define CFE_FLG_ENV_PERMANENT	0x00000001
+
+#define CFE_CPU_CMD_START	1
+#define CFE_CPU_CMD_STOP	0
+
+#define CFE_STDHANDLE_CONSOLE	0
+
+#define CFE_DEV_NETWORK 	1
+#define CFE_DEV_DISK		2
+#define CFE_DEV_FLASH		3
+#define CFE_DEV_SERIAL		4
+#define CFE_DEV_CPU		5
+#define CFE_DEV_NVRAM		6
+#define CFE_DEV_CLOCK           7
+#define CFE_DEV_OTHER		8
+#define CFE_DEV_MASK		0x0F
+
+#define CFE_CACHE_FLUSH_D	1
+#define CFE_CACHE_INVAL_I	2
+#define CFE_CACHE_INVAL_D	4
+#define CFE_CACHE_INVAL_L2	8
+
+#define CFE_FWI_64BIT		0x00000001
+#define CFE_FWI_32BIT		0x00000002
+#define CFE_FWI_RELOC		0x00000004
+#define CFE_FWI_UNCACHED	0x00000008
+#define CFE_FWI_MULTICPU	0x00000010
+#define CFE_FWI_FUNCSIM		0x00000020
+#define CFE_FWI_RTLSIM		0x00000040
+
+struct cfe_fwinfo {
+	s64 version;		/* major, minor, eco version */
+	s64 totalmem;		/* total installed mem */
+	s64 flags;		/* various flags */
+	s64 boardid;		/* board ID */
+	s64 bootarea_va;	/* VA of boot area */
+	s64 bootarea_pa;	/* PA of boot area */
+	s64 bootarea_size;	/* size of boot area */
+};
+
+
+/* The public CFE API */
+
+int cfe_present(void);	/* Check if we booted from CFE. Returns bool */
+
+int cfe_getticks(s64 *ticks);
+int cfe_close(int handle);
+int cfe_cpu_start(int cpu, void (*fn)(void), long sp, long gp, long a1);
+int cfe_cpu_stop(int cpu);
+int cfe_enumenv(int idx, char *name, int namelen, char *val, int vallen);
+int cfe_enumdev(int idx, char *name, int namelen);
+int cfe_enummem(int idx, int flags, u64 *start, u64 *length,
+		u64 *type);
+int cfe_exit(int warm, int status);
+int cfe_flushcache(int flags);
+int cfe_getdevinfo(char *name);
+int cfe_getenv(char *name, char *dest, int destlen);
+int cfe_getfwinfo(struct cfe_fwinfo *info);
+int cfe_getstdhandle(int handletype);
+int cfe_inpstat(int handle);
+int cfe_ioctl(int handle, unsigned int ioctlnum, unsigned char *buffer,
+	      int length, int *retlen, u64 offset);
+int cfe_open(char *name);
+int cfe_read(int handle, unsigned char *buffer, int length);
+int cfe_readblk(int handle, s64 offset, unsigned char *buffer, int length);
+int cfe_setenv(char *name, char *val);
+int cfe_write(int handle, unsigned char *buffer, int length);
+int cfe_writeblk(int handle, s64 offset, unsigned char *buffer,
+		 int length);
+
+
+/* High level API */
+
+/* Print some information to CFE's console (most likely serial line) */
+int cfe_printk(const char *fmt, ...) __attribute__((format(printf, 1, 2)));
+int cfe_vprintk(const char *fmt, va_list args);
+
+
+
+/* Error codes returned by the low API functions */
+
+#define CFE_ISERR(errcode)	(errcode < 0)
+
+#define CFE_OK			 0
+#define CFE_ERR                 -1	/* generic error */
+#define CFE_ERR_INV_COMMAND	-2
+#define CFE_ERR_EOF		-3
+#define CFE_ERR_IOERR		-4
+#define CFE_ERR_NOMEM		-5
+#define CFE_ERR_DEVNOTFOUND	-6
+#define CFE_ERR_DEVOPEN		-7
+#define CFE_ERR_INV_PARAM	-8
+#define CFE_ERR_ENVNOTFOUND	-9
+#define CFE_ERR_ENVREADONLY	-10
+
+#define CFE_ERR_NOTELF		-11
+#define CFE_ERR_NOT32BIT 	-12
+#define CFE_ERR_WRONGENDIAN 	-13
+#define CFE_ERR_BADELFVERS 	-14
+#define CFE_ERR_NOTMIPS 	-15
+#define CFE_ERR_BADELFFMT 	-16
+#define CFE_ERR_BADADDR 	-17
+
+#define CFE_ERR_FILENOTFOUND	-18
+#define CFE_ERR_UNSUPPORTED	-19
+
+#define CFE_ERR_HOSTUNKNOWN	-20
+
+#define CFE_ERR_TIMEOUT		-21
+
+#define CFE_ERR_PROTOCOLERR	-22
+
+#define CFE_ERR_NETDOWN		-23
+#define CFE_ERR_NONAMESERVER	-24
+
+#define CFE_ERR_NOHANDLES	-25
+#define CFE_ERR_ALREADYBOUND	-26
+
+#define CFE_ERR_CANNOTSET	-27
+#define CFE_ERR_NOMORE		-28
+#define CFE_ERR_BADFILESYS	-29
+#define CFE_ERR_FSNOTAVAIL	-30
+
+#define CFE_ERR_INVBOOTBLOCK	-31
+#define CFE_ERR_WRONGDEVTYPE	-32
+#define CFE_ERR_BBCHECKSUM	-33
+#define CFE_ERR_BOOTPROGCHKSUM	-34
+
+#define CFE_ERR_LDRNOTAVAIL	-35
+
+#define CFE_ERR_NOTREADY	-36
+
+#define CFE_ERR_GETMEM          -37
+#define CFE_ERR_SETMEM          -38
+
+#define CFE_ERR_NOTCONN		-39
+#define CFE_ERR_ADDRINUSE	-40
+
+
+#endif /* LINUX_CFE_API_H_ */
diff --git a/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6338_intr.h b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6338_intr.h
new file mode 100644
index 0000000..3a6e00a
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6338_intr.h
@@ -0,0 +1,64 @@
+/*
+<:copyright-gpl 
+ Copyright 2003 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+
+#ifndef __6338_INTR_H
+#define __6338_INTR_H
+
+/*=====================================================================*/
+/* BCM6338 External Interrupt Level Assignments                       */
+/*=====================================================================*/
+#define INTERRUPT_ID_EXTERNAL_0         3
+#define INTERRUPT_ID_EXTERNAL_1         4
+#define INTERRUPT_ID_EXTERNAL_2         5
+#define INTERRUPT_ID_EXTERNAL_3         6
+
+/*=====================================================================*/
+/* BCM6338 Timer Interrupt Level Assignments                          */
+/*=====================================================================*/
+#define MIPS_TIMER_INT                  7
+
+/*=====================================================================*/
+/* Peripheral ISR Table Offset                                              */
+/*=====================================================================*/
+#define INTERNAL_ISR_TABLE_OFFSET       8
+
+/*=====================================================================*/
+/* Logical Peripheral Interrupt IDs                                    */
+/*=====================================================================*/
+
+#define INTERRUPT_ID_TIMER               (INTERNAL_ISR_TABLE_OFFSET + 0)
+#define INTERRUPT_ID_SPI                 (INTERNAL_ISR_TABLE_OFFSET + 1)
+#define INTERRUPT_ID_UART                (INTERNAL_ISR_TABLE_OFFSET + 2)
+#define INTERRUPT_ID_DG                  (INTERNAL_ISR_TABLE_OFFSET + 4)
+#define INTERRUPT_ID_ADSL                (INTERNAL_ISR_TABLE_OFFSET + 5)
+#define INTERRUPT_ID_ATM                 (INTERNAL_ISR_TABLE_OFFSET + 6)
+#define INTERRUPT_ID_USBS                (INTERNAL_ISR_TABLE_OFFSET + 7)
+#define INTERRUPT_ID_EMAC1               (INTERNAL_ISR_TABLE_OFFSET + 8)
+#define INTERRUPT_ID_EPHY                (INTERNAL_ISR_TABLE_OFFSET + 9)
+#define INTERRUPT_ID_SDRAM               (INTERNAL_ISR_TABLE_OFFSET + 10)
+#define INTERRUPT_ID_USB_CNTL_RX_DMA     (INTERNAL_ISR_TABLE_OFFSET + 11)
+#define INTERRUPT_ID_USB_CNTL_TX_DMA     (INTERNAL_ISR_TABLE_OFFSET + 12)
+#define INTERRUPT_ID_USB_BULK_RX_DMA     (INTERNAL_ISR_TABLE_OFFSET + 13)
+#define INTERRUPT_ID_USB_BULK_TX_DMA     (INTERNAL_ISR_TABLE_OFFSET + 14)
+#define INTERRUPT_ID_EMAC1_RX_DMA        (INTERNAL_ISR_TABLE_OFFSET + 15)
+#define INTERRUPT_ID_EMAC1_TX_DMA        (INTERNAL_ISR_TABLE_OFFSET + 16)
+#define INTERRUPT_ID_SDIO                (INTERNAL_ISR_TABLE_OFFSET + 17)
+
+#endif  /* __BCM6338_H */
+
diff --git a/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6338_map_part.h b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6338_map_part.h
new file mode 100644
index 0000000..70bf807
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6338_map_part.h
@@ -0,0 +1,334 @@
+/*
+<:copyright-gpl 
+ Copyright 2004 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+
+#ifndef __BCM6338_MAP_H
+#define __BCM6338_MAP_H
+
+#include "bcmtypes.h"
+
+#define PERF_BASE           0xfffe0000
+#define TIMR_BASE           0xfffe0200 
+#define UART_BASE           0xfffe0300
+#define GPIO_BASE           0xfffe0400
+#define SPI_BASE            0xfffe0c00
+
+typedef struct PerfControl {
+  uint32        RevID;
+  uint16        testControl;
+  uint16        blkEnables;
+#define EMAC_CLK_EN     0x0010
+#define USBS_CLK_EN     0x0010
+#define SAR_CLK_EN      0x0020
+
+#define SPI_CLK_EN      0x0200
+
+  uint32        pll_control;
+#define SOFT_RESET 0x00000001
+
+  uint32        IrqMask;
+  uint32        IrqStatus;
+
+  uint32        ExtIrqCfg;
+#define EI_SENSE_SHFT   0
+#define EI_STATUS_SHFT  5
+#define EI_CLEAR_SHFT   10
+#define EI_MASK_SHFT    15
+#define EI_INSENS_SHFT  20
+#define EI_LEVEL_SHFT   25
+
+  uint32        unused[4];      /* (18) */
+  uint32        BlockSoftReset; /* (28) */
+#define BSR_SPI             0x00000001
+#define BSR_EMAC            0x00000004
+#define BSR_USBH            0x00000008
+#define BSR_USBS            0x00000010
+#define BSR_ADSL            0x00000020
+#define BSR_DMAMEM          0x00000040
+#define BSR_SAR             0x00000080
+#define BSR_ACLC            0x00000100
+#define BSR_ADSL_MIPS_PLL   0x00000400
+#define BSR_ALL_BLOCKS      \
+    (BSR_SPI | BSR_EMAC | BSR_USBH | BSR_USBS | BSR_ADSL | BSR_DMAMEM | \
+     BSR_SAR | BSR_ACLC | BSR_ADSL_MIPS_PLL) 
+} PerfControl;
+
+#define PERF ((volatile PerfControl * const) PERF_BASE)
+
+
+typedef struct Timer {
+  uint16        unused0;
+  byte          TimerMask;
+#define TIMER0EN        0x01
+#define TIMER1EN        0x02
+#define TIMER2EN        0x04
+  byte          TimerInts;
+#define TIMER0          0x01
+#define TIMER1          0x02
+#define TIMER2          0x04
+#define WATCHDOG        0x08
+  uint32        TimerCtl0;
+  uint32        TimerCtl1;
+  uint32        TimerCtl2;
+#define TIMERENABLE     0x80000000
+#define RSTCNTCLR       0x40000000      
+  uint32        TimerCnt0;
+  uint32        TimerCnt1;
+  uint32        TimerCnt2;
+  uint32        WatchDogDefCount;
+
+  /* Write 0xff00 0x00ff to Start timer
+   * Write 0xee00 0x00ee to Stop and re-load default count
+   * Read from this register returns current watch dog count
+   */
+  uint32        WatchDogCtl;
+
+  /* Number of 40-MHz ticks for WD Reset pulse to last */
+  uint32        WDResetCount;
+} Timer;
+
+#define TIMER ((volatile Timer * const) TIMR_BASE)
+typedef struct UartChannel {
+  byte          unused0;
+  byte          control;
+#define BRGEN           0x80    /* Control register bit defs */
+#define TXEN            0x40
+#define RXEN            0x20
+#define LOOPBK          0x10
+#define TXPARITYEN      0x08
+#define TXPARITYEVEN    0x04
+#define RXPARITYEN      0x02
+#define RXPARITYEVEN    0x01
+
+  byte          config;
+#define XMITBREAK       0x40
+#define BITS5SYM        0x00
+#define BITS6SYM        0x10
+#define BITS7SYM        0x20
+#define BITS8SYM        0x30
+#define ONESTOP         0x07
+#define TWOSTOP         0x0f
+  /* 4-LSBS represent STOP bits/char
+   * in 1/8 bit-time intervals.  Zero
+   * represents 1/8 stop bit interval.
+   * Fifteen represents 2 stop bits.
+   */
+  byte          fifoctl;
+#define RSTTXFIFOS      0x80
+#define RSTRXFIFOS      0x40
+  /* 5-bit TimeoutCnt is in low bits of this register.
+   *  This count represents the number of characters 
+   *  idle times before setting receive Irq when below threshold
+   */
+  uint32        baudword;
+  /* When divide SysClk/2/(1+baudword) we should get 32*bit-rate
+   */
+
+  byte          txf_levl;       /* Read-only fifo depth */
+  byte          rxf_levl;       /* Read-only fifo depth */
+  byte          fifocfg;        /* Upper 4-bits are TxThresh, Lower are
+                                 *      RxThreshold.  Irq can be asserted
+                                 *      when rx fifo> thresh, txfifo<thresh
+                                 */
+  byte          prog_out;       /* Set value of DTR (Bit0), RTS (Bit1)
+                                 *  if these bits are also enabled to GPIO_o
+                                 */
+#define	DTREN	0x01
+#define	RTSEN	0x02
+
+  byte          unused1;
+  byte          DeltaIPEdgeNoSense;     /* Low 4-bits, set corr bit to 1 to 
+                                         * detect irq on rising AND falling 
+                                         * edges for corresponding GPIO_i
+                                         * if enabled (edge insensitive)
+                                         */
+  byte          DeltaIPConfig_Mask;     /* Upper 4 bits: 1 for posedge sense
+                                         *      0 for negedge sense if
+                                         *      not configured for edge
+                                         *      insensitive (see above)
+                                         * Lower 4 bits: Mask to enable change
+                                         *  detection IRQ for corresponding
+                                         *  GPIO_i
+                                         */
+  byte          DeltaIP_SyncIP;         /* Upper 4 bits show which bits
+                                         *  have changed (may set IRQ).
+                                         *  read automatically clears bit
+                                         * Lower 4 bits are actual status
+                                         */
+
+  uint16        intMask;				/* Same Bit defs for Mask and status */
+  uint16        intStatus;
+#define DELTAIP         0x0001
+#define TXUNDERR        0x0002
+#define TXOVFERR        0x0004
+#define TXFIFOTHOLD     0x0008
+#define TXREADLATCH     0x0010
+#define TXFIFOEMT       0x0020
+#define RXUNDERR        0x0040
+#define RXOVFERR        0x0080
+#define RXTIMEOUT       0x0100
+#define RXFIFOFULL      0x0200
+#define RXFIFOTHOLD     0x0400
+#define RXFIFONE        0x0800
+#define RXFRAMERR       0x1000
+#define RXPARERR        0x2000
+#define RXBRK           0x4000
+
+  uint16        unused2;
+  uint16        Data;                   /* Write to TX, Read from RX */
+                                        /* bits 11:8 are BRK,PAR,FRM errors */
+
+  uint32		unused3;
+  uint32		unused4;
+} Uart;
+
+#define UART ((volatile Uart * const) UART_BASE)
+
+typedef struct GpioControl {
+  uint32        unused0;
+  uint32        GPIODir;      /* bits 7:0 */
+  uint32        unused1;
+  uint32        GPIOio;       /* bits 7:0 */
+  uint32        LEDCtrl;
+#define         LED3_STROBE             0x08000000
+#define         LED2_STROBE             0x04000000
+#define         LED1_STROBE             0x02000000
+#define         LED0_STROBE             0x01000000
+#define         LED_TEST                0x00010000
+#define         LED3_DISABLE_LINK_ACT   0x00008000
+#define         LED2_DISABLE_LINK_ACT   0x00004000
+#define         LED1_DISABLE_LINK_ACT   0x00002000
+#define         LED0_DISABLE_LINK_ACT   0x00001000
+#define         LED_INTERVAL_SET_MASK   0x00000f00
+#define         LED_INTERVAL_SET_320MS  0x00000500
+#define         LED_INTERVAL_SET_160MS  0x00000400
+#define         LED_INTERVAL_SET_80MS   0x00000300
+#define         LED_INTERVAL_SET_40MS   0x00000200
+#define         LED_INTERVAL_SET_20MS   0x00000100
+#define         LED3_ON                 0x00000080
+#define         LED2_ON                 0x00000040
+#define         LED1_ON                 0x00000020
+#define         LED0_ON                 0x00000010
+#define         LED3_ENABLE             0x00000008
+#define         LED2_ENABLE             0x00000004
+#define         LED1_ENABLE             0x00000002
+#define         LED0_ENABLE             0x00000001
+  uint32        SpiSlaveCfg;
+#define         SPI_SLAVE_RESET         0x00010000
+#define         SPI_RESTRICT            0x00000400
+#define         SPI_DELAY_DISABLE       0x00000200
+#define         SPI_PROBE_MUX_SEL_MASK  0x000001e0
+#define         SPI_SER_ADDR_CFG_MASK   0x0000000c
+#define         SPI_MODE                0x00000001
+  uint32        vRegConfig;
+} GpioControl;
+
+#define GPIO ((volatile GpioControl * const) GPIO_BASE)
+
+/* Number to mask conversion macro used for GPIODir and GPIOio */
+#define GPIO_NUM_MAX_BITS_MASK          0x0f
+#define GPIO_NUM_TO_MASK(X)             (1 << ((X) & GPIO_NUM_MAX_BITS_MASK))
+
+/*
+** Spi Controller
+*/
+
+typedef struct SpiControl {
+  uint16        spiCmd;                 /* (0x0): SPI command */
+#define SPI_CMD_START_IMMEDIATE         3
+
+#define SPI_CMD_COMMAND_SHIFT           0
+#define SPI_CMD_DEVICE_ID_SHIFT         4
+#define SPI_CMD_PREPEND_BYTE_CNT_SHIFT  8
+
+  byte          spiIntStatus;           /* (0x2): SPI interrupt status */
+  byte          spiMaskIntStatus;       /* (0x3): SPI masked interrupt status */
+
+  byte          spiIntMask;             /* (0x4): SPI interrupt mask */
+#define SPI_INTR_CMD_DONE               0x01
+#define SPI_INTR_CLEAR_ALL              0x1f
+
+  byte          spiStatus;              /* (0x5): SPI status */
+
+  byte          spiClkCfg;              /* (0x6): SPI clock configuration */
+
+  byte          spiFillByte;            /* (0x7): SPI fill byte */
+
+  byte          unused0; 
+  byte          spiMsgTail;             /* (0x9): msgtail */
+  byte          unused1; 
+  byte          spiRxTail;              /* (0xB): rxtail */
+
+  uint32        unused2[13];            /* (0x0c - 0x3c) reserved */
+
+  byte          spiMsgCtl;              /* (0x40) control byte */
+#define HALF_DUPLEX_W                   1
+#define HALF_DUPLEX_R                   2
+#define SPI_MSG_TYPE_SHIFT              6
+#define SPI_BYTE_CNT_SHIFT              0
+  byte          spiMsgData[63];         /* (0x41 - 0x7f) msg data */
+  byte          spiRxDataFifo[64];      /* (0x80 - 0xbf) rx data */
+  byte          unused3[64];            /* (0xc0 - 0xff) reserved */
+} SpiControl;
+
+#define SPI ((volatile SpiControl * const) SPI_BASE)
+
+/*
+** External Bus Interface
+*/
+typedef struct EbiChipSelect {
+  uint32        base;                   /* base address in upper 24 bits */
+#define EBI_SIZE_8K         0
+#define EBI_SIZE_16K        1
+#define EBI_SIZE_32K        2
+#define EBI_SIZE_64K        3
+#define EBI_SIZE_128K       4
+#define EBI_SIZE_256K       5
+#define EBI_SIZE_512K       6
+#define EBI_SIZE_1M         7
+#define EBI_SIZE_2M         8
+#define EBI_SIZE_4M         9
+#define EBI_SIZE_8M         10
+#define EBI_SIZE_16M        11
+#define EBI_SIZE_32M        12
+#define EBI_SIZE_64M        13
+#define EBI_SIZE_128M       14
+#define EBI_SIZE_256M       15
+  uint32        config;
+#define EBI_ENABLE          0x00000001      /* .. enable this range */
+#define EBI_WAIT_STATES     0x0000000e      /* .. mask for wait states */
+#define EBI_WTST_SHIFT      1               /* .. for shifting wait states */
+#define EBI_WORD_WIDE       0x00000010      /* .. 16-bit peripheral, else 8 */
+#define EBI_WREN            0x00000020      /* enable posted writes */
+#define EBI_POLARITY        0x00000040      /* .. set to invert something, 
+                                        **    don't know what yet */
+#define EBI_TS_TA_MODE      0x00000080      /* .. use TS/TA mode */
+#define EBI_TS_SEL          0x00000100      /* .. drive tsize, not bs_b */
+#define EBI_FIFO            0x00000200      /* .. use fifo */
+#define EBI_RE              0x00000400      /* .. Reverse Endian */
+} EbiChipSelect;
+
+typedef struct MpiRegisters {
+  EbiChipSelect cs[1];                  /* size chip select configuration */
+} MpiRegisters;
+
+#define MPI ((volatile MpiRegisters * const) MPI_BASE)
+
+
+#endif
+
diff --git a/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6345_intr.h b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6345_intr.h
new file mode 100644
index 0000000..fb77cbc
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6345_intr.h
@@ -0,0 +1,72 @@
+/*
+<:copyright-gpl 
+ Copyright 2002 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+
+#ifndef __6345_INTR_H
+#define __6345_INTR_H
+
+
+/*=====================================================================*/
+/* BCM6345 External Interrupt Level Assignments                       */
+/*=====================================================================*/
+#define INTERRUPT_ID_EXTERNAL_0         3
+#define INTERRUPT_ID_EXTERNAL_1         4
+#define INTERRUPT_ID_EXTERNAL_2         5
+#define INTERRUPT_ID_EXTERNAL_3         6
+
+/*=====================================================================*/
+/* BCM6345 Timer Interrupt Level Assignments                          */
+/*=====================================================================*/
+#define MIPS_TIMER_INT                  7
+
+/*=====================================================================*/
+/* Peripheral ISR Table Offset                                              */
+/*=====================================================================*/
+#define INTERNAL_ISR_TABLE_OFFSET       8
+#define DMA_ISR_TABLE_OFFSET            (INTERNAL_ISR_TABLE_OFFSET + 13)
+
+/*=====================================================================*/
+/* Logical Peripheral Interrupt IDs                                    */
+/*=====================================================================*/
+
+/* Internal peripheral interrupt IDs */
+#define INTERRUPT_ID_TIMER              (INTERNAL_ISR_TABLE_OFFSET +  0)
+#define INTERRUPT_ID_UART               (INTERNAL_ISR_TABLE_OFFSET +  2)
+#define INTERRUPT_ID_ADSL               (INTERNAL_ISR_TABLE_OFFSET +  3)
+#define INTERRUPT_ID_ATM                (INTERNAL_ISR_TABLE_OFFSET +  4)
+#define INTERRUPT_ID_USB                (INTERNAL_ISR_TABLE_OFFSET +  5)
+#define INTERRUPT_ID_EMAC               (INTERNAL_ISR_TABLE_OFFSET +  8)
+#define INTERRUPT_ID_EPHY               (INTERNAL_ISR_TABLE_OFFSET +  12)
+
+/* DMA channel interrupt IDs */        
+#define INTERRUPT_ID_EMAC_RX_CHAN       (DMA_ISR_TABLE_OFFSET + EMAC_RX_CHAN)
+#define INTERRUPT_ID_EMAC_TX_CHAN       (DMA_ISR_TABLE_OFFSET + EMAC_TX_CHAN)
+#define INTERRUPT_ID_EBI_RX_CHAN        (DMA_ISR_TABLE_OFFSET + EBI_RX_CHAN)
+#define INTERRUPT_ID_EBI_TX_CHAN        (DMA_ISR_TABLE_OFFSET + EBI_TX_CHAN)
+#define INTERRUPT_ID_RESERVED_RX_CHAN   (DMA_ISR_TABLE_OFFSET + RESERVED_RX_CHAN)
+#define INTERRUPT_ID_RESERVED_TX_CHAN   (DMA_ISR_TABLE_OFFSET + RESERVED_TX_CHAN)
+#define INTERRUPT_ID_USB_BULK_RX_CHAN   (DMA_ISR_TABLE_OFFSET + USB_BULK_RX_CHAN)
+#define INTERRUPT_ID_USB_BULK_TX_CHAN   (DMA_ISR_TABLE_OFFSET + USB_BULK_TX_CHAN)
+#define INTERRUPT_ID_USB_CNTL_RX_CHAN   (DMA_ISR_TABLE_OFFSET + USB_CNTL_RX_CHAN)
+#define INTERRUPT_ID_USB_CNTL_TX_CHAN   (DMA_ISR_TABLE_OFFSET + USB_CNTL_TX_CHAN)
+#define INTERRUPT_ID_USB_ISO_RX_CHAN    (DMA_ISR_TABLE_OFFSET + USB_ISO_RX_CHAN)
+#define INTERRUPT_ID_USB_ISO_TX_CHAN    (DMA_ISR_TABLE_OFFSET + USB_ISO_TX_CHAN)
+
+
+#endif  /* __BCM6345_H */
+
diff --git a/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6345_map_part.h b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6345_map_part.h
new file mode 100644
index 0000000..78e59a4
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6345_map_part.h
@@ -0,0 +1,163 @@
+/*
+<:copyright-gpl 
+ Copyright 2002 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+
+#ifndef __BCM6345_MAP_H
+#define __BCM6345_MAP_H
+
+
+#include "bcmtypes.h"
+#include "6345_intr.h"
+
+typedef struct IntControl {
+  uint32        RevID;
+  uint16        testControl;
+  uint16        blkEnables;
+#define USB_CLK_EN      0x0100
+#define EMAC_CLK_EN     0x0080
+#define UART_CLK_EN     0x0008
+#define CPU_CLK_EN      0x0001
+
+  uint32        pll_control;
+#define SOFT_RESET	0x00000001
+
+  uint32        IrqMask;
+  uint32        IrqStatus;
+
+  uint32        ExtIrqCfg;
+#define EI_SENSE_SHFT   0
+#define EI_STATUS_SHFT  4
+#define EI_CLEAR_SHFT   8
+#define EI_MASK_SHFT    12
+#define EI_INSENS_SHFT  16
+#define EI_LEVEL_SHFT   20
+} IntControl;
+
+#define INTC_BASE     0xfffe0000
+#define PERF ((volatile IntControl * const) INTC_BASE)
+
+#define TIMR_BASE     0xfffe0200    
+typedef struct Timer {
+  uint16        unused0;
+  byte          TimerMask;
+#define TIMER0EN        0x01
+#define TIMER1EN        0x02
+#define TIMER2EN        0x04
+  byte          TimerInts;
+#define TIMER0          0x01
+#define TIMER1          0x02
+#define TIMER2          0x04
+#define WATCHDOG        0x08
+  uint32        TimerCtl0;
+  uint32        TimerCtl1;
+  uint32        TimerCtl2;
+#define TIMERENABLE     0x80000000
+#define RSTCNTCLR       0x40000000      
+  uint32        TimerCnt0;
+  uint32        TimerCnt1;
+  uint32        TimerCnt2;
+  uint32        WatchDogDefCount;
+
+  /* Write 0xff00 0x00ff to Start timer
+   * Write 0xee00 0x00ee to Stop and re-load default count
+   * Read from this register returns current watch dog count
+   */
+  uint32        WatchDogCtl;
+
+  /* Number of 40-MHz ticks for WD Reset pulse to last */
+  uint32        WDResetCount;
+} Timer;
+
+#define TIMER ((volatile Timer * const) TIMR_BASE)
+
+typedef struct UartChannel {
+  byte          unused0;
+  byte          control;
+#define BRGEN           0x80    /* Control register bit defs */
+#define TXEN            0x40
+#define RXEN            0x20
+#define TXPARITYEN      0x08
+#define TXPARITYEVEN    0x04
+#define RXPARITYEN      0x02
+#define RXPARITYEVEN    0x01
+  byte          config;
+#define BITS5SYM        0x00
+#define BITS6SYM        0x10
+#define BITS7SYM        0x20
+#define BITS8SYM        0x30
+#define XMITBREAK       0x40
+#define ONESTOP         0x07
+#define TWOSTOP         0x0f
+
+  byte          fifoctl;
+#define RSTTXFIFOS      0x80
+#define RSTRXFIFOS      0x40
+  uint32        baudword;
+
+  byte          txf_levl;
+  byte          rxf_levl;
+  byte          fifocfg;
+  byte          prog_out;
+
+  byte          unused1;
+  byte          DeltaIPEdgeNoSense;
+  byte          DeltaIPConfig_Mask;
+  byte          DeltaIP_SyncIP;
+  uint16        intMask;
+  uint16        intStatus;
+#define TXUNDERR        0x0002
+#define TXOVFERR        0x0004
+#define TXFIFOEMT       0x0020
+#define RXOVFERR        0x0080
+#define RXFIFONE        0x0800
+#define RXFRAMERR       0x1000
+#define RXPARERR        0x2000
+#define RXBRK           0x4000
+
+  uint16        unused2;
+  uint16        Data;
+  uint32		unused3;
+  uint32		unused4;
+} Uart;
+
+#define UART_BASE     0xfffe0300
+#define UART ((volatile Uart * const) UART_BASE)
+
+typedef struct GpioControl {
+  uint16        unused0;
+  byte          unused1;
+  byte          TBusSel;
+
+  uint16        unused2;
+  uint16        GPIODir;
+  byte          unused3;
+  byte          Leds;
+  uint16        GPIOio;
+
+  uint32        UartCtl;
+} GpioControl;
+
+#define GPIO_BASE     0xfffe0400
+#define GPIO ((volatile GpioControl * const) GPIO_BASE)
+
+#define GPIO_NUM_MAX_BITS_MASK          0x0f
+#define GPIO_NUM_TO_MASK(X)             (1 << ((X) & GPIO_NUM_MAX_BITS_MASK))
+
+
+#endif
+
diff --git a/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6348_intr.h b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6348_intr.h
new file mode 100644
index 0000000..da3ee9f
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6348_intr.h
@@ -0,0 +1,74 @@
+/*
+<:copyright-gpl 
+ Copyright 2003 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+
+#ifndef __6348_INTR_H
+#define __6348_INTR_H
+
+
+/*=====================================================================*/
+/* BCM6348 External Interrupt Level Assignments                       */
+/*=====================================================================*/
+#define INTERRUPT_ID_EXTERNAL_0         3
+#define INTERRUPT_ID_EXTERNAL_1         4
+#define INTERRUPT_ID_EXTERNAL_2         5
+#define INTERRUPT_ID_EXTERNAL_3         6
+
+/*=====================================================================*/
+/* BCM6348 Timer Interrupt Level Assignments                          */
+/*=====================================================================*/
+#define MIPS_TIMER_INT                  7
+
+/*=====================================================================*/
+/* Peripheral ISR Table Offset                                              */
+/*=====================================================================*/
+#define INTERNAL_ISR_TABLE_OFFSET       8
+
+/*=====================================================================*/
+/* Logical Peripheral Interrupt IDs                                    */
+/*=====================================================================*/
+
+#define INTERRUPT_ID_TIMER               (INTERNAL_ISR_TABLE_OFFSET + 0)
+#define INTERRUPT_ID_SPI                 (INTERNAL_ISR_TABLE_OFFSET + 1)
+#define INTERRUPT_ID_UART                (INTERNAL_ISR_TABLE_OFFSET + 2)
+#define INTERRUPT_ID_ADSL                (INTERNAL_ISR_TABLE_OFFSET + 4)
+#define INTERRUPT_ID_ATM                 (INTERNAL_ISR_TABLE_OFFSET + 5)
+#define INTERRUPT_ID_USBS                (INTERNAL_ISR_TABLE_OFFSET + 6)
+#define INTERRUPT_ID_EMAC2               (INTERNAL_ISR_TABLE_OFFSET + 7)
+#define INTERRUPT_ID_EMAC1               (INTERNAL_ISR_TABLE_OFFSET + 8)
+#define INTERRUPT_ID_EPHY                (INTERNAL_ISR_TABLE_OFFSET + 9)
+#define INTERRUPT_ID_M2M                 (INTERNAL_ISR_TABLE_OFFSET + 10)
+#define INTERRUPT_ID_ACLC                (INTERNAL_ISR_TABLE_OFFSET + 11)
+#define INTERRUPT_ID_USBH                (INTERNAL_ISR_TABLE_OFFSET + 12)
+#define INTERRUPT_ID_SDRAM               (INTERNAL_ISR_TABLE_OFFSET + 13)
+#define INTERRUPT_ID_USB_CNTL_RX_DMA     (INTERNAL_ISR_TABLE_OFFSET + 14)
+#define INTERRUPT_ID_USB_CNTL_TX_DMA     (INTERNAL_ISR_TABLE_OFFSET + 15)
+#define INTERRUPT_ID_USB_BULK_RX_DMA     (INTERNAL_ISR_TABLE_OFFSET + 16)
+#define INTERRUPT_ID_USB_BULK_TX_DMA     (INTERNAL_ISR_TABLE_OFFSET + 17)
+#define INTERRUPT_ID_USB_ISO_RX_DMA      (INTERNAL_ISR_TABLE_OFFSET + 18)
+#define INTERRUPT_ID_USB_ISO_TX_DMA      (INTERNAL_ISR_TABLE_OFFSET + 19)
+#define INTERRUPT_ID_EMAC1_RX_DMA        (INTERNAL_ISR_TABLE_OFFSET + 20)
+#define INTERRUPT_ID_EMAC1_TX_DMA        (INTERNAL_ISR_TABLE_OFFSET + 21)
+#define INTERRUPT_ID_EMAC2_RX_DMA        (INTERNAL_ISR_TABLE_OFFSET + 22)
+#define INTERRUPT_ID_EMAC2_TX_DMA        (INTERNAL_ISR_TABLE_OFFSET + 23)
+#define INTERRUPT_ID_MPI                 (INTERNAL_ISR_TABLE_OFFSET + 24)
+#define INTERRUPT_ID_DG                  (INTERNAL_ISR_TABLE_OFFSET + 25)
+
+
+#endif  /* __BCM6348_H */
+
diff --git a/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6348_map_part.h b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6348_map_part.h
new file mode 100644
index 0000000..199ef9e
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/6348_map_part.h
@@ -0,0 +1,500 @@
+/*
+<:copyright-gpl 
+ Copyright 2002 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+
+#ifndef __BCM6348_MAP_H
+#define __BCM6348_MAP_H
+
+#include "bcmtypes.h"
+
+#define PERF_BASE           0xfffe0000
+#define TIMR_BASE           0xfffe0200    
+#define UART_BASE           0xfffe0300
+#define GPIO_BASE           0xfffe0400
+#define MPI_BASE            0xfffe2000    /* MPI control registers */
+#define USB_HOST_BASE       0xfffe1b00    /* USB host registers */
+#define USB_HOST_NON_OHCI   0xfffe1c00    /* USB host non-OHCI registers */
+
+typedef struct PerfControl {
+  uint32        RevID;
+  uint16        testControl;
+  uint16        blkEnables;
+#define EMAC_CLK_EN     0x0010
+#define SAR_CLK_EN      0x0020
+#define USBS_CLK_EN     0x0040
+#define USBH_CLK_EN     0x0100
+
+  uint32        pll_control;
+#define SOFT_RESET 0x00000001
+
+  uint32        IrqMask;
+  uint32        IrqStatus;
+
+  uint32        ExtIrqCfg;
+#define EI_SENSE_SHFT   0
+#define EI_STATUS_SHFT  5
+#define EI_CLEAR_SHFT   10
+#define EI_MASK_SHFT    15
+#define EI_INSENS_SHFT  20
+#define EI_LEVEL_SHFT   25
+
+  uint32        unused[4];      /* (18) */
+  uint32        BlockSoftReset; /* (28) */
+#define BSR_SPI             0x00000001
+#define BSR_EMAC            0x00000004
+#define BSR_USBH            0x00000008
+#define BSR_USBS            0x00000010
+#define BSR_ADSL            0x00000020
+#define BSR_DMAMEM          0x00000040
+#define BSR_SAR             0x00000080
+#define BSR_ACLC            0x00000100
+#define BSR_ADSL_MIPS_PLL   0x00000400
+#define BSR_ALL_BLOCKS      \
+    (BSR_SPI | BSR_EMAC | BSR_USBH | BSR_USBS | BSR_ADSL | BSR_DMAMEM | \
+     BSR_SAR | BSR_ACLC | BSR_ADSL_MIPS_PLL) 
+  uint32        unused2[2];     /* (2c) */
+  uint32        PllStrap;       /* (34) */
+#define PLL_N1_SHFT         20
+#define PLL_N1_MASK         (7<<PLL_N1_SHFT)
+#define PLL_N2_SHFT         15
+#define PLL_N2_MASK         (0x1f<<PLL_N2_SHFT)
+#define PLL_M1_REF_SHFT     12
+#define PLL_M1_REF_MASK     (7<<PLL_M1_REF_SHFT)
+#define PLL_M2_REF_SHFT     9
+#define PLL_M2_REF_MASK     (7<<PLL_M2_REF_SHFT)
+#define PLL_M1_CPU_SHFT     6
+#define PLL_M1_CPU_MASK     (7<<PLL_M1_CPU_SHFT)
+#define PLL_M1_BUS_SHFT     3
+#define PLL_M1_BUS_MASK     (7<<PLL_M1_BUS_SHFT)
+#define PLL_M2_BUS_SHFT     0
+#define PLL_M2_BUS_MASK     (7<<PLL_M2_BUS_SHFT)
+} PerfControl;
+
+#define PERF ((volatile PerfControl * const) PERF_BASE)
+
+typedef struct Timer {
+  uint16        unused0;
+  byte          TimerMask;
+#define TIMER0EN        0x01
+#define TIMER1EN        0x02
+#define TIMER2EN        0x04
+  byte          TimerInts;
+#define TIMER0          0x01
+#define TIMER1          0x02
+#define TIMER2          0x04
+#define WATCHDOG        0x08
+  uint32        TimerCtl0;
+  uint32        TimerCtl1;
+  uint32        TimerCtl2;
+#define TIMERENABLE     0x80000000
+#define RSTCNTCLR       0x40000000      
+  uint32        TimerCnt0;
+  uint32        TimerCnt1;
+  uint32        TimerCnt2;
+  uint32        WatchDogDefCount;
+
+  /* Write 0xff00 0x00ff to Start timer
+   * Write 0xee00 0x00ee to Stop and re-load default count
+   * Read from this register returns current watch dog count
+   */
+  uint32        WatchDogCtl;
+
+  /* Number of 40-MHz ticks for WD Reset pulse to last */
+  uint32        WDResetCount;
+} Timer;
+
+#define TIMER ((volatile Timer * const) TIMR_BASE)
+
+typedef struct UartChannel {
+  byte          unused0;
+  byte          control;
+#define BRGEN           0x80    /* Control register bit defs */
+#define TXEN            0x40
+#define RXEN            0x20
+#define LOOPBK          0x10
+#define TXPARITYEN      0x08
+#define TXPARITYEVEN    0x04
+#define RXPARITYEN      0x02
+#define RXPARITYEVEN    0x01
+
+  byte          config;
+#define XMITBREAK       0x40
+#define BITS5SYM        0x00
+#define BITS6SYM        0x10
+#define BITS7SYM        0x20
+#define BITS8SYM        0x30
+#define ONESTOP         0x07
+#define TWOSTOP         0x0f
+  /* 4-LSBS represent STOP bits/char
+   * in 1/8 bit-time intervals.  Zero
+   * represents 1/8 stop bit interval.
+   * Fifteen represents 2 stop bits.
+   */
+  byte          fifoctl;
+#define RSTTXFIFOS      0x80
+#define RSTRXFIFOS      0x40
+  /* 5-bit TimeoutCnt is in low bits of this register.
+   *  This count represents the number of characters 
+   *  idle times before setting receive Irq when below threshold
+   */
+  uint32        baudword;
+  /* When divide SysClk/2/(1+baudword) we should get 32*bit-rate
+   */
+
+  byte          txf_levl;       /* Read-only fifo depth */
+  byte          rxf_levl;       /* Read-only fifo depth */
+  byte          fifocfg;        /* Upper 4-bits are TxThresh, Lower are
+                                 *      RxThreshold.  Irq can be asserted
+                                 *      when rx fifo> thresh, txfifo<thresh
+                                 */
+  byte          prog_out;       /* Set value of DTR (Bit0), RTS (Bit1)
+                                 *  if these bits are also enabled to GPIO_o
+                                 */
+#define	DTREN	0x01
+#define	RTSEN	0x02
+
+  byte          unused1;
+  byte          DeltaIPEdgeNoSense;     /* Low 4-bits, set corr bit to 1 to 
+                                         * detect irq on rising AND falling 
+                                         * edges for corresponding GPIO_i
+                                         * if enabled (edge insensitive)
+                                         */
+  byte          DeltaIPConfig_Mask;     /* Upper 4 bits: 1 for posedge sense
+                                         *      0 for negedge sense if
+                                         *      not configured for edge
+                                         *      insensitive (see above)
+                                         * Lower 4 bits: Mask to enable change
+                                         *  detection IRQ for corresponding
+                                         *  GPIO_i
+                                         */
+  byte          DeltaIP_SyncIP;         /* Upper 4 bits show which bits
+                                         *  have changed (may set IRQ).
+                                         *  read automatically clears bit
+                                         * Lower 4 bits are actual status
+                                         */
+
+  uint16        intMask;				/* Same Bit defs for Mask and status */
+  uint16        intStatus;
+#define DELTAIP         0x0001
+#define TXUNDERR        0x0002
+#define TXOVFERR        0x0004
+#define TXFIFOTHOLD     0x0008
+#define TXREADLATCH     0x0010
+#define TXFIFOEMT       0x0020
+#define RXUNDERR        0x0040
+#define RXOVFERR        0x0080
+#define RXTIMEOUT       0x0100
+#define RXFIFOFULL      0x0200
+#define RXFIFOTHOLD     0x0400
+#define RXFIFONE        0x0800
+#define RXFRAMERR       0x1000
+#define RXPARERR        0x2000
+#define RXBRK           0x4000
+
+  uint16        unused2;
+  uint16        Data;                   /* Write to TX, Read from RX */
+                                        /* bits 11:8 are BRK,PAR,FRM errors */
+
+  uint32		unused3;
+  uint32		unused4;
+} Uart;
+
+#define UART ((volatile Uart * const) UART_BASE)
+
+typedef struct GpioControl {
+  uint32        GPIODir_high; /* bits 36:32 */
+  uint32        GPIODir;      /* bits 31:00 */
+  uint32        GPIOio_high;  /* bits 36:32 */
+  uint32        GPIOio;       /* bits 31:00 */
+  uint32        LEDCtrl;
+#define         LED3_STROBE             0x08000000
+#define         LED2_STROBE             0x04000000
+#define         LED1_STROBE             0x02000000
+#define         LED0_STROBE             0x01000000
+#define         LED_TEST                0x00010000
+#define         LED3_DISABLE_LINK_ACT   0x00008000
+#define         LED2_DISABLE_LINK_ACT   0x00004000
+#define         LED1_DISABLE_LINK_ACT   0x00002000
+#define         LED0_DISABLE_LINK_ACT   0x00001000
+#define         LED_INTERVAL_SET_MASK   0x00000f00
+#define         LED_INTERVAL_SET_320MS  0x00000500
+#define         LED_INTERVAL_SET_160MS  0x00000400
+#define         LED_INTERVAL_SET_80MS   0x00000300
+#define         LED_INTERVAL_SET_40MS   0x00000200
+#define         LED_INTERVAL_SET_20MS   0x00000100
+#define         LED3_ON                 0x00000080
+#define         LED2_ON                 0x00000040
+#define         LED1_ON                 0x00000020
+#define         LED0_ON                 0x00000010
+#define         LED3_ENABLE             0x00000008
+#define         LED2_ENABLE             0x00000004
+#define         LED1_ENABLE             0x00000002
+#define         LED0_ENABLE             0x00000001
+  uint32        SpiSlaveCfg;
+#define         SPI_SLAVE_RESET         0x00010000
+#define         SPI_RESTRICT            0x00000400
+#define         SPI_DELAY_DISABLE       0x00000200
+#define         SPI_PROBE_MUX_SEL_MASK  0x000001e0
+#define         SPI_SER_ADDR_CFG_MASK   0x0000000c
+#define         SPI_MODE                0x00000001
+  uint32        GPIOMode;
+#define         GROUP4_DIAG             0x00090000
+#define         GROUP4_UTOPIA           0x00080000
+#define         GROUP4_LEGACY_LED       0x00030000
+#define         GROUP4_MII_SNOOP        0x00020000
+#define         GROUP4_EXT_EPHY         0x00010000
+#define         GROUP3_DIAG             0x00009000
+#define         GROUP3_UTOPIA           0x00008000
+#define         GROUP3_EXT_MII          0x00007000
+#define         GROUP2_DIAG             0x00000900
+#define         GROUP2_PCI              0x00000500
+#define         GROUP1_DIAG             0x00000090
+#define         GROUP1_UTOPIA           0x00000080
+#define         GROUP1_SPI_UART         0x00000060
+#define         GROUP1_SPI_MASTER       0x00000060
+#define         GROUP1_MII_PCCARD       0x00000040
+#define         GROUP1_MII_SNOOP        0x00000020
+#define         GROUP1_EXT_EPHY         0x00000010
+#define         GROUP0_DIAG             0x00000009
+#define         GROUP0_EXT_MII          0x00000007
+
+} GpioControl;
+
+#define GPIO ((volatile GpioControl * const) GPIO_BASE)
+
+/* Number to mask conversion macro used for GPIODir and GPIOio */
+#define GPIO_NUM_TOTAL_BITS_MASK        0x3f
+#define GPIO_NUM_MAX_BITS_MASK          0x1f
+#define GPIO_NUM_TO_MASK(X)             ( (((X) & GPIO_NUM_TOTAL_BITS_MASK) < 32) ? (1 << ((X) & GPIO_NUM_MAX_BITS_MASK)) : (0) )
+
+/* Number to mask conversion macro used for GPIODir_high and GPIOio_high */
+#define GPIO_NUM_MAX_BITS_MASK_HIGH     0x07
+#define GPIO_NUM_TO_MASK_HIGH(X)        ( (((X) & GPIO_NUM_TOTAL_BITS_MASK) >= 32) ? (1 << ((X-32) & GPIO_NUM_MAX_BITS_MASK_HIGH)) : (0) )
+
+
+/*
+** External Bus Interface
+*/
+typedef struct EbiChipSelect {
+  uint32        base;                   /* base address in upper 24 bits */
+#define EBI_SIZE_8K         0
+#define EBI_SIZE_16K        1
+#define EBI_SIZE_32K        2
+#define EBI_SIZE_64K        3
+#define EBI_SIZE_128K       4
+#define EBI_SIZE_256K       5
+#define EBI_SIZE_512K       6
+#define EBI_SIZE_1M         7
+#define EBI_SIZE_2M         8
+#define EBI_SIZE_4M         9
+#define EBI_SIZE_8M         10
+#define EBI_SIZE_16M        11
+#define EBI_SIZE_32M        12
+#define EBI_SIZE_64M        13
+#define EBI_SIZE_128M       14
+#define EBI_SIZE_256M       15
+  uint32        config;
+#define EBI_ENABLE          0x00000001      /* .. enable this range */
+#define EBI_WAIT_STATES     0x0000000e      /* .. mask for wait states */
+#define EBI_WTST_SHIFT      1               /* .. for shifting wait states */
+#define EBI_WORD_WIDE       0x00000010      /* .. 16-bit peripheral, else 8 */
+#define EBI_WREN            0x00000020      /* enable posted writes */
+#define EBI_POLARITY        0x00000040      /* .. set to invert something, 
+                                        **    don't know what yet */
+#define EBI_TS_TA_MODE      0x00000080      /* .. use TS/TA mode */
+#define EBI_TS_SEL          0x00000100      /* .. drive tsize, not bs_b */
+#define EBI_FIFO            0x00000200      /* .. use fifo */
+#define EBI_RE              0x00000400      /* .. Reverse Endian */
+} EbiChipSelect;
+
+typedef struct MpiRegisters {
+  EbiChipSelect cs[7];                  /* size chip select configuration */
+#define EBI_CS0_BASE            0
+#define EBI_CS1_BASE            1
+#define EBI_CS2_BASE            2
+#define EBI_CS3_BASE            3
+#define PCMCIA_COMMON_BASE      4
+#define PCMCIA_ATTRIBUTE_BASE   5
+#define PCMCIA_IO_BASE          6
+  uint32        unused0[2];             /* reserved */
+  uint32        ebi_control;            /* ebi control */
+  uint32        unused1[4];             /* reserved */
+#define EBI_ACCESS_TIMEOUT      0x000007FF
+  uint32        pcmcia_cntl1;           /* pcmcia control 1 */
+#define PCCARD_CARD_RESET       0x00040000
+#define CARDBUS_ENABLE          0x00008000
+#define PCMCIA_ENABLE           0x00004000
+#define PCMCIA_GPIO_ENABLE      0x00002000
+#define CARDBUS_IDSEL           0x00001F00
+#define VS2_OEN                 0x00000080
+#define VS1_OEN                 0x00000040
+#define VS2_OUT                 0x00000020
+#define VS1_OUT                 0x00000010
+#define VS2_IN                  0x00000008
+#define VS1_IN                  0x00000004
+#define CD2_IN                  0x00000002
+#define CD1_IN                  0x00000001
+#define VS_MASK                 0x0000000C
+#define CD_MASK                 0x00000003
+  uint32        unused2;                /* reserved */
+  uint32        pcmcia_cntl2;           /* pcmcia control 2 */
+#define PCMCIA_BYTESWAP_DIS     0x00000002
+#define PCMCIA_HALFWORD_EN      0x00000001
+#define RW_ACTIVE_CNT_BIT       2
+#define INACTIVE_CNT_BIT        8
+#define CE_SETUP_CNT_BIT        16
+#define CE_HOLD_CNT_BIT         24
+  uint32        unused3[40];            /* reserved */
+
+  uint32        sp0range;               /* PCI to internal system bus address space */
+  uint32        sp0remap;
+  uint32        sp0cfg;
+  uint32        sp1range;
+  uint32        sp1remap;
+  uint32        sp1cfg;
+
+  uint32        EndianCfg;
+
+  uint32        l2pcfgctl;              /* internal system bus to PCI IO/Cfg control */
+#define DIR_CFG_SEL             0x80000000 /* change from PCI I/O access to PCI config access */
+#define DIR_CFG_USEREG          0x40000000 /* use this register info for PCI configuration access */
+#define DEVICE_NUMBER           0x00007C00 /* device number for the PCI configuration access */
+#define FUNC_NUMBER             0x00000300 /* function number for the PCI configuration access */
+#define REG_NUMBER              0x000000FC /* register number for the PCI configuration access */
+#define CONFIG_TYPE             0x00000003 /* configuration type for the PCI configuration access */
+
+  uint32        l2pmrange1;             /* internal system bus to PCI memory space */
+#define PCI_SIZE_64K            0xFFFF0000
+#define PCI_SIZE_128K           0xFFFE0000
+#define PCI_SIZE_256K           0xFFFC0000
+#define PCI_SIZE_512K           0xFFF80000
+#define PCI_SIZE_1M             0xFFF00000
+#define PCI_SIZE_2M             0xFFE00000
+#define PCI_SIZE_4M             0xFFC00000
+#define PCI_SIZE_8M             0xFF800000
+#define PCI_SIZE_16M            0xFF000000
+#define PCI_SIZE_32M            0xFE000000
+  uint32        l2pmbase1;              /* kseg0 or kseg1 address & 0x1FFFFFFF */
+  uint32        l2pmremap1;
+#define CARDBUS_MEM             0x00000004
+#define MEM_WINDOW_EN           0x00000001
+  uint32        l2pmrange2;
+  uint32        l2pmbase2;
+  uint32        l2pmremap2;
+  uint32        l2piorange;             /* internal system bus to PCI I/O space */
+  uint32        l2piobase;
+  uint32        l2pioremap;
+
+  uint32        pcimodesel;
+#define PCI2_INT_BUS_RD_PREFECH 0x000000F0
+#define PCI_BAR2_NOSWAP         0x00000002 /* BAR at offset 0x20 */
+#define PCI_BAR1_NOSWAP         0x00000001 /* BAR at affset 0x1c */
+
+  uint32        pciintstat;             /* PCI interrupt mask/status */
+#define MAILBOX1_SENT           0x08
+#define MAILBOX0_SENT           0x04
+#define MAILBOX1_MSG_RCV        0x02
+#define MAILBOX0_MSG_RCV        0x01
+  uint32        locbuscntrl;            /* internal system bus control */
+#define DIR_U2P_NOSWAP          0x00000002
+#define EN_PCI_GPIO             0x00000001
+  uint32        locintstat;             /* internal system bus interrupt mask/status */
+#define CSERR                   0x0200
+#define SERR                    0x0100
+#define EXT_PCI_INT             0x0080
+#define DIR_FAILED              0x0040
+#define DIR_COMPLETE            0x0020
+#define PCI_CFG                 0x0010
+  uint32        unused5[7];
+
+  uint32        mailbox0;
+  uint32        mailbox1;
+
+  uint32        pcicfgcntrl;            /* internal system bus PCI configuration control */
+#define PCI_CFG_REG_WRITE_EN    0x00000080
+#define PCI_CFG_ADDR            0x0000003C
+  uint32        pcicfgdata;             /* internal system bus PCI configuration data */
+
+  uint32        locch2ctl;              /* PCI to interrnal system bus DMA (downstream) local control */
+#define MPI_DMA_HALT            0x00000008  /* idle after finish current memory burst */
+#define MPI_DMA_PKT_HALT        0x00000004  /* idle after an EOP flag is detected */
+#define MPI_DMA_STALL           0x00000002  /* idle after an EOP flag is detected */
+#define MPI_DMA_ENABLE          0x00000001  /* set to enable channel */
+  uint32        locch2intStat;
+#define MPI_DMA_NO_DESC         0x00000004  /* no valid descriptors */
+#define MPI_DMA_DONE            0x00000002  /* packet xfer complete */
+#define MPI_DMA_BUFF_DONE       0x00000001  /* buffer done */
+  uint32        locch2intMask;
+  uint32        unused6;
+  uint32        locch2descaddr;
+  uint32        locch2status1;
+#define LOCAL_DESC_STATE        0xE0000000
+#define PCI_DESC_STATE          0x1C000000
+#define BYTE_DONE               0x03FFC000
+#define RING_ADDR               0x00003FFF
+  uint32        locch2status2;
+#define BUFPTR_OFFSET           0x1FFF0000
+#define PCI_MASTER_STATE        0x000000C0
+#define LOC_MASTER_STATE        0x00000038
+#define CONTROL_STATE           0x00000007
+  uint32        unused7;
+
+  uint32        locch1Ctl;              /*internal system bus to PCI DMA (upstream) local control */
+#define DMA_U2P_LE              0x00000200  /* local bus is little endian */
+#define DMA_U2P_NOSWAP          0x00000100  /* lccal bus is little endian but no data swapped */
+  uint32        locch1intstat;
+  uint32        locch1intmask;
+  uint32        unused8;
+  uint32        locch1descaddr;
+  uint32        locch1status1;
+  uint32        locch1status2;
+  uint32        unused9;
+
+  uint32        pcich1ctl;              /* internal system bus to PCI DMA PCI control */
+  uint32        pcich1intstat;
+  uint32        pcich1intmask;
+  uint32        pcich1descaddr;
+  uint32        pcich1status1;
+  uint32        pcich1status2;
+
+  uint32        pcich2Ctl;              /* PCI to internal system bus DMA PCI control */
+  uint32        pcich2intstat;
+  uint32        pcich2intmask;
+  uint32        pcich2descaddr;
+  uint32        pcich2status1;
+  uint32        pcich2status2;
+
+  uint32        perm_id;                /* permanent device and vendor id */
+  uint32        perm_rev;               /* permanent revision id */
+} MpiRegisters;
+
+#define MPI ((volatile MpiRegisters * const) MPI_BASE)
+
+/* PCI configuration address space start offset 0x40 */
+#define BRCM_PCI_CONFIG_TIMER               0x40
+#define BRCM_PCI_CONFIG_TIMER_RETRY_MASK	0x0000FF00
+#define BRCM_PCI_CONFIG_TIMER_TRDY_MASK		0x000000FF
+
+/* USB host non-Open HCI register, USB_HOST_NON_OHCI, bit definitions. */
+#define NON_OHCI_ENABLE_PORT1   0x00000001 /* Use USB port 1 for host, not dev */
+#define NON_OHCI_BYTE_SWAP      0x00000008 /* Swap USB host registers */
+
+#define USBH_NON_OHCI ((volatile unsigned long * const) USB_HOST_NON_OHCI)
+
+#endif
+
diff --git a/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bcmTag.h b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bcmTag.h
new file mode 100644
index 0000000..e902e96
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bcmTag.h
@@ -0,0 +1,153 @@
+/*
+<:copyright-gpl 
+ Copyright 2002 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+//**************************************************************************************
+// File Name  : bcmTag.h
+//
+// Description: add tag with validation system to the firmware image file to be uploaded
+//              via http
+//
+// Created    : 02/28/2002  seanl
+//**************************************************************************************
+
+#ifndef _BCMTAG_H_
+#define _BCMTAG_H_
+
+
+#define BCM_SIG_1   "Broadcom Corporation"
+#define BCM_SIG_2   "ver. 2.0"          // was "firmware version 2.0" now it is split 6 char out for chip id.
+
+#define BCM_TAG_VER         "6"
+#define BCM_TAG_VER_LAST    "26"
+
+// file tag (head) structure all is in clear text except validationTokens (crc, md5, sha1, etc). Total: 128 unsigned chars
+#define TAG_LEN         256
+#define TAG_VER_LEN     4
+#define SIG_LEN         20
+#define SIG_LEN_2       14   // Original second SIG = 20 is now devided into 14 for SIG_LEN_2 and 6 for CHIP_ID
+#define CHIP_ID_LEN		6	
+#define IMAGE_LEN       10
+#define ADDRESS_LEN     12
+#define FLAG_LEN        2
+#define TOKEN_LEN       20
+#define BOARD_ID_LEN    16
+#define RESERVED_LEN    (TAG_LEN - TAG_VER_LEN - SIG_LEN - SIG_LEN_2 - CHIP_ID_LEN - BOARD_ID_LEN - \
+                        (4*IMAGE_LEN) - (3*ADDRESS_LEN) - (3*FLAG_LEN) - (2*TOKEN_LEN))
+
+
+// TAG for downloadable image (kernel plus file system)
+typedef struct _FILE_TAG
+{
+    unsigned char tagVersion[TAG_VER_LEN];       // tag version.  Will be 2 here.
+    unsigned char signiture_1[SIG_LEN];          // text line for company info
+    unsigned char signiture_2[SIG_LEN_2];        // additional info (can be version number)
+    unsigned char chipId[CHIP_ID_LEN];			 // chip id 
+    unsigned char boardId[BOARD_ID_LEN];         // board id
+    unsigned char bigEndian[FLAG_LEN];           // if = 1 - big, = 0 - little endia of the host
+    unsigned char totalImageLen[IMAGE_LEN];      // the sum of all the following length
+    unsigned char cfeAddress[ADDRESS_LEN];       // if non zero, cfe starting address
+    unsigned char cfeLen[IMAGE_LEN];             // if non zero, cfe size in clear ASCII text.
+    unsigned char rootfsAddress[ADDRESS_LEN];    // if non zero, filesystem starting address
+    unsigned char rootfsLen[IMAGE_LEN];          // if non zero, filesystem size in clear ASCII text.
+    unsigned char kernelAddress[ADDRESS_LEN];    // if non zero, kernel starting address
+    unsigned char kernelLen[IMAGE_LEN];          // if non zero, kernel size in clear ASCII text.
+    unsigned char dualImage[FLAG_LEN];           // if 1, dual image
+    unsigned char inactiveLen[FLAG_LEN];         // if 1, the image is INACTIVE; if 0, active 
+    unsigned char reserved[RESERVED_LEN];        // reserved for later use
+    unsigned char imageValidationToken[TOKEN_LEN];// image validation token - can be crc, md5, sha;  for
+                                                 // now will be 4 unsigned char crc
+    unsigned char tagValidationToken[TOKEN_LEN]; // validation token for tag(from signiture_1 to end of // mageValidationToken)
+} FILE_TAG, *PFILE_TAG;
+
+#define CRC32_INIT_VALUE 0xffffffff /* Initial CRC32 checksum value */
+#define CRC_LEN 4
+
+// only included if for bcmTag.exe program
+#ifdef BCMTAG_EXE_USE
+
+static unsigned long Crc32_table[256] = {
+    0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA,
+    0x076DC419, 0x706AF48F, 0xE963A535, 0x9E6495A3,
+    0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988,
+    0x09B64C2B, 0x7EB17CBD, 0xE7B82D07, 0x90BF1D91,
+    0x1DB71064, 0x6AB020F2, 0xF3B97148, 0x84BE41DE,
+    0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7,
+    0x136C9856, 0x646BA8C0, 0xFD62F97A, 0x8A65C9EC,
+    0x14015C4F, 0x63066CD9, 0xFA0F3D63, 0x8D080DF5,
+    0x3B6E20C8, 0x4C69105E, 0xD56041E4, 0xA2677172,
+    0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B,
+    0x35B5A8FA, 0x42B2986C, 0xDBBBC9D6, 0xACBCF940,
+    0x32D86CE3, 0x45DF5C75, 0xDCD60DCF, 0xABD13D59,
+    0x26D930AC, 0x51DE003A, 0xC8D75180, 0xBFD06116,
+    0x21B4F4B5, 0x56B3C423, 0xCFBA9599, 0xB8BDA50F,
+    0x2802B89E, 0x5F058808, 0xC60CD9B2, 0xB10BE924,
+    0x2F6F7C87, 0x58684C11, 0xC1611DAB, 0xB6662D3D,
+    0x76DC4190, 0x01DB7106, 0x98D220BC, 0xEFD5102A,
+    0x71B18589, 0x06B6B51F, 0x9FBFE4A5, 0xE8B8D433,
+    0x7807C9A2, 0x0F00F934, 0x9609A88E, 0xE10E9818,
+    0x7F6A0DBB, 0x086D3D2D, 0x91646C97, 0xE6635C01,
+    0x6B6B51F4, 0x1C6C6162, 0x856530D8, 0xF262004E,
+    0x6C0695ED, 0x1B01A57B, 0x8208F4C1, 0xF50FC457,
+    0x65B0D9C6, 0x12B7E950, 0x8BBEB8EA, 0xFCB9887C,
+    0x62DD1DDF, 0x15DA2D49, 0x8CD37CF3, 0xFBD44C65,
+    0x4DB26158, 0x3AB551CE, 0xA3BC0074, 0xD4BB30E2,
+    0x4ADFA541, 0x3DD895D7, 0xA4D1C46D, 0xD3D6F4FB,
+    0x4369E96A, 0x346ED9FC, 0xAD678846, 0xDA60B8D0,
+    0x44042D73, 0x33031DE5, 0xAA0A4C5F, 0xDD0D7CC9,
+    0x5005713C, 0x270241AA, 0xBE0B1010, 0xC90C2086,
+    0x5768B525, 0x206F85B3, 0xB966D409, 0xCE61E49F,
+    0x5EDEF90E, 0x29D9C998, 0xB0D09822, 0xC7D7A8B4,
+    0x59B33D17, 0x2EB40D81, 0xB7BD5C3B, 0xC0BA6CAD,
+    0xEDB88320, 0x9ABFB3B6, 0x03B6E20C, 0x74B1D29A,
+    0xEAD54739, 0x9DD277AF, 0x04DB2615, 0x73DC1683,
+    0xE3630B12, 0x94643B84, 0x0D6D6A3E, 0x7A6A5AA8,
+    0xE40ECF0B, 0x9309FF9D, 0x0A00AE27, 0x7D079EB1,
+    0xF00F9344, 0x8708A3D2, 0x1E01F268, 0x6906C2FE,
+    0xF762575D, 0x806567CB, 0x196C3671, 0x6E6B06E7,
+    0xFED41B76, 0x89D32BE0, 0x10DA7A5A, 0x67DD4ACC,
+    0xF9B9DF6F, 0x8EBEEFF9, 0x17B7BE43, 0x60B08ED5,
+    0xD6D6A3E8, 0xA1D1937E, 0x38D8C2C4, 0x4FDFF252,
+    0xD1BB67F1, 0xA6BC5767, 0x3FB506DD, 0x48B2364B,
+    0xD80D2BDA, 0xAF0A1B4C, 0x36034AF6, 0x41047A60,
+    0xDF60EFC3, 0xA867DF55, 0x316E8EEF, 0x4669BE79,
+    0xCB61B38C, 0xBC66831A, 0x256FD2A0, 0x5268E236,
+    0xCC0C7795, 0xBB0B4703, 0x220216B9, 0x5505262F,
+    0xC5BA3BBE, 0xB2BD0B28, 0x2BB45A92, 0x5CB36A04,
+    0xC2D7FFA7, 0xB5D0CF31, 0x2CD99E8B, 0x5BDEAE1D,
+    0x9B64C2B0, 0xEC63F226, 0x756AA39C, 0x026D930A,
+    0x9C0906A9, 0xEB0E363F, 0x72076785, 0x05005713,
+    0x95BF4A82, 0xE2B87A14, 0x7BB12BAE, 0x0CB61B38,
+    0x92D28E9B, 0xE5D5BE0D, 0x7CDCEFB7, 0x0BDBDF21,
+    0x86D3D2D4, 0xF1D4E242, 0x68DDB3F8, 0x1FDA836E,
+    0x81BE16CD, 0xF6B9265B, 0x6FB077E1, 0x18B74777,
+    0x88085AE6, 0xFF0F6A70, 0x66063BCA, 0x11010B5C,
+    0x8F659EFF, 0xF862AE69, 0x616BFFD3, 0x166CCF45,
+    0xA00AE278, 0xD70DD2EE, 0x4E048354, 0x3903B3C2,
+    0xA7672661, 0xD06016F7, 0x4969474D, 0x3E6E77DB,
+    0xAED16A4A, 0xD9D65ADC, 0x40DF0B66, 0x37D83BF0,
+    0xA9BCAE53, 0xDEBB9EC5, 0x47B2CF7F, 0x30B5FFE9,
+    0xBDBDF21C, 0xCABAC28A, 0x53B39330, 0x24B4A3A6,
+    0xBAD03605, 0xCDD70693, 0x54DE5729, 0x23D967BF,
+    0xB3667A2E, 0xC4614AB8, 0x5D681B02, 0x2A6F2B94,
+    0xB40BBE37, 0xC30C8EA1, 0x5A05DF1B, 0x2D02EF8D
+};
+#endif // BCMTAG_USE
+
+
+#endif // _BCMTAG_H_
+
diff --git a/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bcm_intr.h b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bcm_intr.h
new file mode 100644
index 0000000..8c56840
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bcm_intr.h
@@ -0,0 +1,59 @@
+/*
+<:copyright-gpl 
+ Copyright 2003 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+
+#ifndef __BCM_INTR_H
+#define __BCM_INTR_H
+
+#ifdef __cplusplus
+    extern "C" {
+#endif
+
+#if defined(CONFIG_BCM96338)
+#include <6338_intr.h>
+#endif
+#if defined(CONFIG_BCM96345)
+#include <6345_intr.h>
+#endif
+#if defined(CONFIG_BCM96348)
+#include <6348_intr.h>
+#endif
+
+/* defines */
+struct pt_regs;
+typedef int (*FN_HANDLER) (int, void *);
+
+/* prototypes */
+extern void enable_brcm_irq(unsigned int irq);
+extern void disable_brcm_irq(unsigned int irq);
+extern int request_external_irq(unsigned int irq,
+    FN_HANDLER handler, unsigned long irqflags, 
+    const char * devname, void *dev_id);
+extern unsigned int BcmHalMapInterrupt(FN_HANDLER isr, unsigned int param,
+    unsigned int interruptId);
+extern void dump_intr_regs(void);
+
+/* compatibility definitions */
+#define BcmHalInterruptEnable(irq)      enable_brcm_irq( irq )
+#define BcmHalInterruptDisable(irq)     disable_brcm_irq( irq )
+
+#ifdef __cplusplus
+    }
+#endif
+
+#endif
diff --git a/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bcm_map_part.h b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bcm_map_part.h
new file mode 100644
index 0000000..ccfe965
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bcm_map_part.h
@@ -0,0 +1,34 @@
+/*
+<:copyright-gpl 
+ Copyright 2004 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+
+#ifndef __BCM_MAP_PART_H
+#define __BCM_MAP_PART_H
+
+#if defined(CONFIG_BCM96338)
+#include <6338_map_part.h>
+#endif
+#if defined(CONFIG_BCM96345)
+#include <6345_map_part.h>
+#endif
+#if defined(CONFIG_BCM96348)
+#include <6348_map_part.h>
+#endif
+
+#endif
+
diff --git a/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bcmpci.h b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bcmpci.h
new file mode 100644
index 0000000..cecbd99
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bcmpci.h
@@ -0,0 +1,87 @@
+/*
+<:copyright-gpl 
+ Copyright 2004 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+
+//
+// bcmpci.h - bcm96348 PCI, Cardbus, and PCMCIA definition
+//
+#ifndef BCMPCI_H
+#define BCMPCI_H
+
+/* Memory window in internal system bus address space */ 
+#define BCM_PCI_MEM_BASE        0x08000000
+/* IO window in internal system bus address space */ 
+#define BCM_PCI_IO_BASE         0x0C000000
+
+#define BCM_PCI_ADDR_MASK       0x1fffffff
+
+/* Memory window size (range) */
+#define BCM_PCI_MEM_SIZE_16MB   0x01000000
+/* IO window size (range) */
+#define BCM_PCI_IO_SIZE_64KB    0x00010000
+
+/* PCI Configuration and I/O space acesss */
+#define BCM_PCI_CFG(d, f, o)    ( (d << 11) | (f << 8) | (o/4 << 2) )
+
+/* fake USB PCI slot */
+#define USB_HOST_SLOT           9
+#define USB_BAR0_MEM_SIZE       0x0800
+
+#define BCM_HOST_MEM_SPACE1     0x10000000
+#define BCM_HOST_MEM_SPACE2     0x00000000
+
+/* 
+ * EBI bus clock is 33MHz and share with PCI bus
+ * each clock cycle is 30ns.
+ */
+/* attribute memory access wait cnt for 4306 */
+#define PCMCIA_ATTR_CE_HOLD     3  // data hold time 70ns
+#define PCMCIA_ATTR_CE_SETUP    3  // data setup time 50ns
+#define PCMCIA_ATTR_INACTIVE    6  // time between read/write cycles 180ns. For the total cycle time 600ns (cnt1+cnt2+cnt3+cnt4)
+#define PCMCIA_ATTR_ACTIVE      10 // OE/WE pulse width 300ns
+
+/* common memory access wait cnt for 4306 */
+#define PCMCIA_MEM_CE_HOLD      1  // data hold time 30ns
+#define PCMCIA_MEM_CE_SETUP     1  // data setup time 30ns
+#define PCMCIA_MEM_INACTIVE     2  // time between read/write cycles 40ns. For the total cycle time 250ns (cnt1+cnt2+cnt3+cnt4)
+#define PCMCIA_MEM_ACTIVE       5  // OE/WE pulse width 150ns
+
+#define PCCARD_VCC_MASK     0x00070000  // Mask Reset also
+#define PCCARD_VCC_33V      0x00010000
+#define PCCARD_VCC_50V      0x00020000
+
+typedef enum {
+    MPI_CARDTYPE_NONE,      // No Card in slot
+    MPI_CARDTYPE_PCMCIA,    // 16-bit PCMCIA card in slot    
+    MPI_CARDTYPE_CARDBUS,   // 32-bit CardBus card in slot
+}   CardType;
+
+#define CARDBUS_SLOT        0    // Slot 0 is default for CardBus
+
+#define pcmciaAttrOffset    0x00200000
+#define pcmciaMemOffset     0x00000000
+// Needs to be right above PCI I/O space. Give 0x8000 (32K) to PCMCIA. 
+#define pcmciaIoOffset      (BCM_PCI_IO_BASE + 0x80000)
+// Base Address is that mapped into the MPI ChipSelect registers. 
+// UBUS bridge MemoryWindow 0 outputs a 0x00 for the base.
+#define pcmciaBase          0xbf000000
+#define pcmciaAttr          (pcmciaAttrOffset | pcmciaBase)
+#define pcmciaMem           (pcmciaMemOffset  | pcmciaBase)
+#define pcmciaIo            (pcmciaIoOffset   | pcmciaBase)
+
+#endif
diff --git a/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bcmtypes.h b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bcmtypes.h
new file mode 100644
index 0000000..43aebc9
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bcmtypes.h
@@ -0,0 +1,160 @@
+/*
+<:copyright-gpl 
+ Copyright 2002 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+
+//
+// bcmtypes.h - misc useful typedefs
+//
+#ifndef BCMTYPES_H
+#define BCMTYPES_H
+
+// These are also defined in typedefs.h in the application area, so I need to
+// protect against re-definition.
+
+#ifndef _TYPEDEFS_H_
+typedef unsigned char   uint8;
+typedef unsigned short  uint16;
+typedef unsigned long   uint32;
+typedef signed char     int8;
+typedef signed short    int16;
+typedef signed long     int32;
+#endif
+
+typedef unsigned char   byte;
+// typedef unsigned long   sem_t;
+
+typedef unsigned long   HANDLE,*PULONG,DWORD,*PDWORD;
+typedef signed long     LONG,*PLONG;
+
+typedef unsigned int    *PUINT;
+typedef signed int      INT;
+
+typedef unsigned short  *PUSHORT;
+typedef signed short    SHORT,*PSHORT;
+typedef unsigned short  WORD,*PWORD;
+
+typedef unsigned char   *PUCHAR;
+typedef signed char     *PCHAR;
+
+typedef void            *PVOID;
+
+typedef unsigned char   BOOLEAN, *PBOOL, *PBOOLEAN;
+
+typedef unsigned char   BYTE,*PBYTE;
+
+//#ifndef __GNUC__
+//The following has been defined in Vxworks internally: vxTypesOld.h
+//redefine under vxworks will cause error
+typedef signed int      *PINT;
+
+typedef signed char     INT8;
+typedef signed short    INT16;
+typedef signed long     INT32;
+
+typedef unsigned char   UINT8;
+typedef unsigned short  UINT16;
+typedef unsigned long   UINT32;
+
+typedef unsigned char   UCHAR;
+typedef unsigned short  USHORT;
+typedef unsigned int    UINT;
+typedef unsigned long   ULONG;
+
+typedef void            VOID;
+typedef unsigned char   BOOL;
+
+//#endif  /* __GNUC__ */
+
+
+// These are also defined in typedefs.h in the application area, so I need to
+// protect against re-definition.
+#ifndef TYPEDEFS_H
+
+// Maximum and minimum values for a signed 16 bit integer.
+#define MAX_INT16 32767
+#define MIN_INT16 -32768
+
+// Useful for true/false return values.  This uses the
+// Taligent notation (k for constant).
+typedef enum
+{
+    kFalse = 0,
+    kTrue = 1
+} Bool;
+
+#endif
+
+/* macros to protect against unaligned accesses */
+
+#if 0
+/* first arg is an address, second is a value */
+#define PUT16( a, d ) { 		\
+  *((byte *)a) = (byte)((d)>>8); 	\
+  *(((byte *)a)+1) = (byte)(d); 	\
+}
+
+#define PUT32( a, d ) { 		\
+  *((byte *)a) = (byte)((d)>>24); 	\
+  *(((byte *)a)+1) = (byte)((d)>>16); 	\
+  *(((byte *)a)+2) = (byte)((d)>>8); 	\
+  *(((byte *)a)+3) = (byte)(d); 	\
+}
+
+/* first arg is an address, returns a value */
+#define GET16( a ) ( 			\
+  (*((byte *)a) << 8) |			\
+  (*(((byte *)a)+1))	 		\
+)
+
+#define GET32( a ) ( 			\
+  (*((byte *)a) << 24)     |		\
+  (*(((byte *)a)+1) << 16) | 		\
+  (*(((byte *)a)+2) << 8)  | 		\
+  (*(((byte *)a)+3))	 		\
+)
+#endif
+
+#ifndef YES
+#define YES 1
+#endif
+
+#ifndef NO
+#define NO  0
+#endif
+
+#ifndef IN
+#define IN
+#endif
+
+#ifndef OUT
+#define OUT
+#endif
+
+#ifndef TRUE
+#define TRUE 1
+#endif
+
+#ifndef FALSE
+#define FALSE  0
+#endif
+
+#define READ32(addr)        (*(volatile UINT32 *)((ULONG)&addr))
+#define READ16(addr)        (*(volatile UINT16 *)((ULONG)&addr))
+#define READ8(addr)         (*(volatile UINT8  *)((ULONG)&addr))
+
+#endif
diff --git a/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/board.h b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/board.h
new file mode 100644
index 0000000..e674cb1
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/board.h
@@ -0,0 +1,373 @@
+/*
+<:copyright-gpl 
+ Copyright 2002 Broadcom Corp. All Rights Reserved. 
+ 
+ This program is free software; you can distribute it and/or modify it 
+ under the terms of the GNU General Public License (Version 2) as 
+ published by the Free Software Foundation. 
+ 
+ This program is distributed in the hope it will be useful, but WITHOUT 
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License 
+ for more details. 
+ 
+ You should have received a copy of the GNU General Public License along 
+ with this program; if not, write to the Free Software Foundation, Inc., 
+ 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. 
+:>
+*/
+/***********************************************************************/
+/*                                                                     */
+/*   MODULE:  board.h                                                  */
+/*   DATE:    97/02/18                                                 */
+/*   PURPOSE: Board specific information.  This module should include  */
+/*            all base device addresses and board specific macros.     */
+/*                                                                     */
+/***********************************************************************/
+#ifndef _BOARD_H
+#define _BOARD_H
+
+/*****************************************************************************/
+/*                    Misc board definitions                                 */
+/*****************************************************************************/
+
+#define	DYING_GASP_API
+
+/*****************************************************************************/
+/*                    Physical Memory Map                                    */
+/*****************************************************************************/
+
+#define PHYS_DRAM_BASE           0x00000000     /* Dynamic RAM Base */
+#define PHYS_FLASH_BASE          0x1FC00000     /* Flash Memory         */
+
+/*****************************************************************************/
+/* Note that the addresses above are physical addresses and that programs    */
+/* have to use converted addresses defined below:                            */
+/*****************************************************************************/
+#define DRAM_BASE           (0x80000000 | PHYS_DRAM_BASE)   /* cached DRAM */
+#define DRAM_BASE_NOCACHE   (0xA0000000 | PHYS_DRAM_BASE)   /* uncached DRAM */
+#define FLASH_BASE          (0xA0000000 | PHYS_FLASH_BASE)  /* uncached Flash  */
+
+/*****************************************************************************/
+/*  Select the PLL value to get the desired CPU clock frequency.             */
+/*                                                                           */
+/*                                                                           */
+/*****************************************************************************/
+#define FPERIPH            50000000
+
+#define ONEK                            1024
+#define BLK64K                          (64*ONEK)
+#define FLASH45_BLKS_BOOT_ROM           1
+#define FLASH45_LENGTH_BOOT_ROM         (FLASH45_BLKS_BOOT_ROM * BLK64K)
+#define FLASH_RESERVED_AT_END           (64*ONEK) /*reserved for PSI, scratch pad*/
+    
+/*****************************************************************************/
+/* Note that the addresses above are physical addresses and that programs    */
+/* have to use converted addresses defined below:                            */
+/*****************************************************************************/
+#define DRAM_BASE           (0x80000000 | PHYS_DRAM_BASE)   /* cached DRAM */
+#define DRAM_BASE_NOCACHE   (0xA0000000 | PHYS_DRAM_BASE)   /* uncached DRAM */
+#define FLASH_BASE          (0xA0000000 | PHYS_FLASH_BASE)  /* uncached Flash  */
+
+/*****************************************************************************/
+/*  Select the PLL value to get the desired CPU clock frequency.             */
+/*                                                                           */
+/*                                                                           */
+/*****************************************************************************/
+#define FPERIPH            50000000
+    
+#define SDRAM_TYPE_ADDRESS_OFFSET   16
+#define NVRAM_DATA_OFFSET           0x0580
+#define NVRAM_DATA_ID               0x0f1e2d3c
+#define BOARD_SDRAM_TYPE            *(unsigned long *) \
+                                    (FLASH_BASE + SDRAM_TYPE_ADDRESS_OFFSET)
+
+#define ONEK                1024
+#define BLK64K              (64*ONEK)
+
+// nvram and psi flash definitions for 45
+#define FLASH45_LENGTH_NVRAM            ONEK            // 1k nvram 
+#define NVRAM_PSI_DEFAULT               24              // default psi in K byes
+
+/*****************************************************************************/
+/*       NVRAM Offset and definition                                         */
+/*****************************************************************************/
+
+#define NVRAM_VERSION_NUMBER            2
+#define NVRAM_VERSION_NUMBER_ADDRESS    0
+
+#define NVRAM_BOOTLINE_LEN              256
+#define NVRAM_BOARD_ID_STRING_LEN       16
+#define NVRAM_MAC_ADDRESS_LEN           6
+#define NVRAM_MAC_COUNT_MAX             32
+
+/*****************************************************************************/
+/*       Misc Offsets                                                        */
+/*****************************************************************************/
+
+#define CFE_VERSION_OFFSET           0x0570
+#define CFE_VERSION_MARK_SIZE        5
+#define CFE_VERSION_SIZE             5
+
+typedef struct
+{
+    unsigned long ulVersion;
+    char szBootline[NVRAM_BOOTLINE_LEN];
+    char szBoardId[NVRAM_BOARD_ID_STRING_LEN];
+    unsigned long ulReserved1[2];
+    unsigned long ulNumMacAddrs;
+    unsigned char ucaBaseMacAddr[NVRAM_MAC_ADDRESS_LEN];
+    char chReserved[2];
+    unsigned long ulCheckSum;
+} NVRAM_DATA, *PNVRAM_DATA;
+
+
+/*****************************************************************************/
+/*          board ioctl calls for flash, led and some other utilities        */
+/*****************************************************************************/
+
+
+/* Defines. for board driver */
+#define BOARD_IOCTL_MAGIC       'B'
+#define BOARD_DRV_MAJOR          206
+
+#define MAC_ADDRESS_ANY         (unsigned long) -1
+
+#define BOARD_IOCTL_FLASH_INIT \
+    _IOWR(BOARD_IOCTL_MAGIC, 0, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_FLASH_WRITE \
+    _IOWR(BOARD_IOCTL_MAGIC, 1, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_FLASH_READ \
+    _IOWR(BOARD_IOCTL_MAGIC, 2, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_GET_NR_PAGES \
+    _IOWR(BOARD_IOCTL_MAGIC, 3, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_DUMP_ADDR \
+    _IOWR(BOARD_IOCTL_MAGIC, 4, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_SET_MEMORY \
+    _IOWR(BOARD_IOCTL_MAGIC, 5, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_MIPS_SOFT_RESET \
+    _IOWR(BOARD_IOCTL_MAGIC, 6, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_LED_CTRL \
+    _IOWR(BOARD_IOCTL_MAGIC, 7, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_GET_ID \
+    _IOWR(BOARD_IOCTL_MAGIC, 8, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_GET_MAC_ADDRESS \
+    _IOWR(BOARD_IOCTL_MAGIC, 9, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_RELEASE_MAC_ADDRESS \
+    _IOWR(BOARD_IOCTL_MAGIC, 10, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_GET_PSI_SIZE \
+    _IOWR(BOARD_IOCTL_MAGIC, 11, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_GET_SDRAM_SIZE \
+    _IOWR(BOARD_IOCTL_MAGIC, 12, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_SET_MONITOR_FD \
+    _IOWR(BOARD_IOCTL_MAGIC, 13, BOARD_IOCTL_PARMS)
+    
+#define BOARD_IOCTL_WAKEUP_MONITOR_TASK \
+    _IOWR(BOARD_IOCTL_MAGIC, 14, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_GET_BOOTLINE \
+    _IOWR(BOARD_IOCTL_MAGIC, 15, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_SET_BOOTLINE \
+    _IOWR(BOARD_IOCTL_MAGIC, 16, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_GET_BASE_MAC_ADDRESS \
+    _IOWR(BOARD_IOCTL_MAGIC, 17, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_GET_CHIP_ID \
+    _IOWR(BOARD_IOCTL_MAGIC, 18, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_GET_NUM_ENET \
+    _IOWR(BOARD_IOCTL_MAGIC, 19, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_GET_CFE_VER \
+    _IOWR(BOARD_IOCTL_MAGIC, 20, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_GET_ENET_CFG \
+    _IOWR(BOARD_IOCTL_MAGIC, 21, BOARD_IOCTL_PARMS)
+
+#define BOARD_IOCTL_GET_WLAN_ANT_INUSE \
+    _IOWR(BOARD_IOCTL_MAGIC, 22, BOARD_IOCTL_PARMS)
+    
+#define BOARD_IOCTL_SET_TRIGGER_EVENT \
+    _IOWR(BOARD_IOCTL_MAGIC, 23, BOARD_IOCTL_PARMS)        
+
+#define BOARD_IOCTL_GET_TRIGGER_EVENT \
+    _IOWR(BOARD_IOCTL_MAGIC, 24, BOARD_IOCTL_PARMS)        
+
+#define BOARD_IOCTL_UNSET_TRIGGER_EVENT \
+    _IOWR(BOARD_IOCTL_MAGIC, 25, BOARD_IOCTL_PARMS) 
+
+#define BOARD_IOCTL_SET_SES_LED \
+    _IOWR(BOARD_IOCTL_MAGIC, 26, BOARD_IOCTL_PARMS)
+
+//<<JUNHON, 2004/09/15, get reset button status , tim hou , 05/04/12
+#define RESET_BUTTON_UP           1
+#define RESET_BUTTON_PRESSDOWN    0
+#define BOARD_IOCTL_GET_RESETHOLD \
+    _IOWR(BOARD_IOCTL_MAGIC, 27, BOARD_IOCTL_PARMS)
+//>>JUNHON, 2004/09/15    
+    
+// for the action in BOARD_IOCTL_PARMS for flash operation
+typedef enum 
+{
+    PERSISTENT,
+    NVRAM,
+    BCM_IMAGE_CFE,
+    BCM_IMAGE_FS,
+    BCM_IMAGE_KERNEL,
+    BCM_IMAGE_WHOLE,
+    SCRATCH_PAD,
+    FLASH_SIZE,
+} BOARD_IOCTL_ACTION;
+    
+    
+typedef struct boardIoctParms
+{
+    char *string;
+    char *buf;
+    int strLen;
+    int offset;
+    BOARD_IOCTL_ACTION  action;        /* flash read/write: nvram, persistent, bcm image */
+    int result;
+} BOARD_IOCTL_PARMS;
+
+
+// LED defines 
+typedef enum
+{   
+    kLedAdsl,
+    kLedWireless,
+    kLedUsb,
+    kLedHpna,
+    kLedWanData,
+    kLedPPP,
+    kLedVoip,
+    kLedSes,
+    kLedLan,
+    kLedSelfTest,
+    kLedEnd,                // NOTE: Insert the new led name before this one.  Alway stay at the end.
+} BOARD_LED_NAME;
+
+typedef enum
+{
+    kLedStateOff,                        /* turn led off */
+    kLedStateOn,                         /* turn led on */
+    kLedStateFail,                       /* turn led on red */
+    kLedStateBlinkOnce,                  /* blink once, ~100ms and ignore the same call during the 100ms period */
+    kLedStateSlowBlinkContinues,         /* slow blink continues at ~600ms interval */
+    kLedStateFastBlinkContinues,         /* fast blink continues at ~200ms interval */
+} BOARD_LED_STATE;
+
+
+// virtual and physical map pair defined in board.c
+typedef struct ledmappair
+{
+    BOARD_LED_NAME ledName;         // virtual led name
+    BOARD_LED_STATE ledInitState;   // initial led state when the board boots.
+    unsigned short ledMask;         // physical GPIO pin mask
+    unsigned short ledActiveLow;    // reset bit to turn on LED
+    unsigned short ledMaskFail;     // physical GPIO pin mask for state failure
+    unsigned short ledActiveLowFail;// reset bit to turn on LED
+} LED_MAP_PAIR, *PLED_MAP_PAIR;
+
+typedef void (*HANDLE_LED_FUNC)(BOARD_LED_NAME ledName, BOARD_LED_STATE ledState);
+
+/* Flash storage address information that is determined by the flash driver. */
+typedef struct flashaddrinfo
+{
+    int flash_persistent_start_blk;
+    int flash_persistent_number_blk;
+    int flash_persistent_length;
+    unsigned long flash_persistent_blk_offset;
+    int flash_scratch_pad_start_blk;         // start before psi (SP_BUF_LEN)
+    int flash_scratch_pad_number_blk;
+    int flash_scratch_pad_length;
+    unsigned long flash_scratch_pad_blk_offset;
+    int flash_nvram_start_blk;
+    int flash_nvram_number_blk;
+    int flash_nvram_length;
+    unsigned long flash_nvram_blk_offset;
+} FLASH_ADDR_INFO, *PFLASH_ADDR_INFO;
+
+// scratch pad defines
+/* SP - Persisten Scratch Pad format:
+       sp header        : 32 bytes
+       tokenId-1        : 8 bytes
+       tokenId-1 len    : 4 bytes
+       tokenId-1 data    
+       ....
+       tokenId-n        : 8 bytes
+       tokenId-n len    : 4 bytes
+       tokenId-n data    
+*/
+
+#define MAGIC_NUM_LEN       8
+#define MAGIC_NUMBER        "gOGoBrCm"
+#define TOKEN_NAME_LEN      16
+#define SP_VERSION          1
+#define SP_MAX_LEN          8 * 1024            // 8k buf before psi
+#define SP_RESERVERD        16
+
+typedef struct _SP_HEADER
+{
+    char SPMagicNum[MAGIC_NUM_LEN];             // 8 bytes of magic number
+    int SPVersion;                              // version number
+    int SPUsedLen;                              // used sp len   
+    char SPReserved[SP_RESERVERD];              // reservied, total 32 bytes
+} SP_HEADER, *PSP_HEADER;
+
+typedef struct _TOKEN_DEF
+{
+    char tokenName[TOKEN_NAME_LEN];
+    int tokenLen;
+} SP_TOKEN, *PSP_TOKEN;
+
+
+/*****************************************************************************/
+/*          Function Prototypes                                              */
+/*****************************************************************************/
+#if !defined(__ASM_ASM_H)
+void dumpaddr( unsigned char *pAddr, int nLen );
+
+int kerSysNvRamGet(char *string, int strLen, int offset);
+int kerSysNvRamSet(char *string, int strLen, int offset);
+int kerSysPersistentGet(char *string, int strLen, int offset);
+int kerSysPersistentSet(char *string, int strLen, int offset);
+int kerSysScratchPadGet(char *tokName, char *tokBuf, int tokLen);
+int kerSysScratchPadSet(char *tokName, char *tokBuf, int tokLen);
+int kerSysBcmImageSet( int flash_start_addr, char *string, int size);
+int kerSysGetMacAddress( unsigned char *pucaAddr, unsigned long ulId );
+int kerSysReleaseMacAddress( unsigned char *pucaAddr );
+int kerSysGetSdramSize( void );
+void kerSysGetBootline(char *string, int strLen);
+void kerSysSetBootline(char *string, int strLen);
+void kerSysMipsSoftReset(void);
+void kerSysLedCtrl(BOARD_LED_NAME, BOARD_LED_STATE);
+void kerSysLedRegisterHwHandler( BOARD_LED_NAME, HANDLE_LED_FUNC, int );
+int kerSysFlashSizeGet(void);
+void kerSysRegisterDyingGaspHandler(char *devname, void *cbfn, void *context);
+void kerSysDeregisterDyingGaspHandler(char *devname);    
+void kerSysWakeupMonitorTask( void );
+#endif
+
+#define BOOT_CFE     0
+#define BOOT_REDBOOT 1
+
+extern int boot_loader_type;
+
+#endif /* _BOARD_H */
+
diff --git a/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bootloaders.h b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bootloaders.h
new file mode 100644
index 0000000..e169bb0
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/bootloaders.h
@@ -0,0 +1,7 @@
+#define ADSL_SDRAM_IMAGE_SIZE (384*1024)
+
+#define BOOT_LOADER_UNKNOWN 	0
+#define BOOT_LOADER_CFE 	1
+#define BOOT_LOADER_REDBOOT 	2
+#define BOOT_LOADER_CFE2	3
+#define BOOT_LOADER_LAST 	3
diff --git a/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/cpu-feature-overrides.h b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/cpu-feature-overrides.h
new file mode 100644
index 0000000..ea9b358
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/asm-mips/mach-bcm963xx/cpu-feature-overrides.h
@@ -0,0 +1,36 @@
+#ifndef __ASM_MACH_BCM963XX_CPU_FEATURE_OVERRIDES_H
+#define __ASM_MACH_BCM963XX_CPU_FEATURE_OVERRIDES_H
+
+#define cpu_has_tlb                    	1
+#define cpu_has_4kex                   	4
+#define cpu_has_4ktlb                  	8
+#define cpu_has_fpu                    	0
+#define cpu_has_32fpr                  	0
+#define cpu_has_counter			0x40
+#define cpu_has_watch                  	0
+#define cpu_has_mips16                 	0
+#define cpu_has_divec                  	0x200
+#define cpu_has_vce                    	0
+#define cpu_has_cache_cdex_p           	0
+#define cpu_has_cache_cdex_s           	0
+#define cpu_has_prefetch               	0x40000
+#define cpu_has_mcheck                 	0x2000
+#define cpu_has_ejtag                  	0x4000
+#define cpu_has_llsc                   	0x10000
+#define cpu_has_vtag_icache            	0
+#define cpu_has_dc_aliases             	0
+#define cpu_has_ic_fills_f_dc          	0
+
+#define cpu_has_nofpuex               	0
+#define cpu_has_64bits                 	0
+#define cpu_has_64bit_zero_reg         	0
+#define cpu_has_64bit_gp_regs          	0
+#define cpu_has_64bit_addresses        	0
+
+#define cpu_has_subset_pcaches         	0
+
+#define cpu_dcache_line_size()         	16
+#define cpu_icache_line_size()         	16
+#define cpu_scache_line_size()         	0
+
+#endif /* __ASM_MACH_BCM963XX_CPU_FEATURE_OVERRIDES_H */
diff --git a/target/linux/brcm63xx/files/include/linux/atmrt2684.h b/target/linux/brcm63xx/files/include/linux/atmrt2684.h
new file mode 100644
index 0000000..f138c64
--- /dev/null
+++ b/target/linux/brcm63xx/files/include/linux/atmrt2684.h
@@ -0,0 +1,48 @@
+#ifndef _LINUX_ATMRT2684_H
+#define _LINUX_ATMRT2684_H
+
+#include <linux/atm.h>
+#include <linux/if.h>		/* For IFNAMSIZ */
+
+#define RT2684_ENCAPS_NULL	(0)	/* VC-mux */
+#define RT2684_ENCAPS_LLC	(1)
+#define RT2684_ENCAPS_AUTODETECT (2)	/* Unsuported */
+
+/*
+ * This is for the ATM_NEWBACKENDIF call - these are like socket families:
+ * the first element of the structure is the backend number and the rest
+ * is per-backend specific
+ */
+struct atm_newif_rt2684 {
+	atm_backend_t	backend_num;	/* ATM_BACKEND_RT2684 */
+	char		ifname[IFNAMSIZ];
+};
+
+/*
+ * This structure is used to specify a rt2684 interface - either by a
+ * positive integer (returned by ATM_NEWBACKENDIF) or the interfaces name
+ */
+#define RT2684_FIND_BYNOTHING	(0)
+#define RT2684_FIND_BYNUM	(1)
+#define RT2684_FIND_BYIFNAME	(2)
+struct rt2684_if_spec {
+	int method;			/* RT2684_FIND_* */
+	union {
+		char		ifname[IFNAMSIZ];
+		int		devnum;
+	} spec;
+};
+
+/*
+ * This is for the ATM_SETBACKEND call - these are like socket families:
+ * the first element of the structure is the backend number and the rest
+ * is per-backend specific
+ */
+struct atm_backend_rt2684 {
+	atm_backend_t	backend_num;	/* ATM_BACKEND_RT2684 */
+	struct rt2684_if_spec ifspec;
+	unsigned char	encaps;		/* RT2684_ENCAPS_* */
+};
+
+
+#endif /* _LINUX_ATMRT2684_H */
diff --git a/target/linux/brcm63xx/image/Makefile b/target/linux/brcm63xx/image/Makefile
new file mode 100644
index 0000000..fa1ccf7
--- /dev/null
+++ b/target/linux/brcm63xx/image/Makefile
@@ -0,0 +1,48 @@
+# 
+# Copyright (C) 2006 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/image.mk
+
+LOADADDR = 0x8108c8f4		# RAM start + 16M 
+KERNEL_ENTRY = 0x80100000	# Default kernel entry in arch/mips/Makefile
+RAMSIZE = 0x01000000		# 64MB
+
+LOADER_MAKEOPTS= \
+		KDIR=$(KDIR) \
+		LOADADDR=$(LOADADDR) \
+		KERNEL_ENTRY=$(KERNEL_ENTRY) \
+		RAMSIZE=$(RAMSIZE)
+
+define trxalign/jffs2-128k
+-a 0x20000
+endef
+define trxalign/jffs2-64k
+-a 0x10000
+endef
+define trxalign/squashfs
+-a 1024
+endef
+
+define Build/Clean
+	$(MAKE) -C lzma-loader clean
+endef
+
+define Image/Prepare
+	cat $(KDIR)/vmlinux | $(STAGING_DIR_HOST)/bin/lzma e -si -so -eos -lc1 -lp2 -pb2 > $(KDIR)/vmlinux.lzma
+	rm -f $(KDIR)/loader.gz
+	$(MAKE) -C lzma-loader \
+		BUILD_DIR="$(KDIR)" \
+		TARGET="$(KDIR)" \
+		clean install
+	echo -ne "\\x00" >> $(KDIR)/loader.gz
+endef
+
+define Image/Build
+	$(STAGING_DIR_HOST)/bin/trx -o $(BIN_DIR)/openwrt-$(BOARD)-$(KERNEL)-$(1).trx -f $(KDIR)/loader.gz -f $(KDIR)/vmlinux.lzma $(call trxalign/$(1)) -f $(KDIR)/root.$(1)
+endef
+
+$(eval $(call BuildImage))
diff --git a/target/linux/brcm63xx/image/lzma-loader/Makefile b/target/linux/brcm63xx/image/lzma-loader/Makefile
new file mode 100644
index 0000000..b56cbaa
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/Makefile
@@ -0,0 +1,34 @@
+# 
+# Copyright (C) 2006 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+# $Id$
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME := lzma-loader
+PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
+
+$(PKG_BUILD_DIR)/.prepared:
+	mkdir $(PKG_BUILD_DIR)
+	$(CP) ./src/* $(PKG_BUILD_DIR)/
+	touch $@
+
+$(PKG_BUILD_DIR)/loader.gz: $(PKG_BUILD_DIR)/.prepared
+	$(MAKE) -C $(PKG_BUILD_DIR) CC="$(TARGET_CC)" \
+		LD="$(TARGET_CROSS)ld" CROSS_COMPILE="$(TARGET_CROSS)"
+
+download: 
+prepare: $(PKG_BUILD_DIR)/.prepared
+compile: $(PKG_BUILD_DIR)/loader.gz
+install:
+
+ifneq ($(TARGET),)
+install: compile
+	$(CP) $(PKG_BUILD_DIR)/loader.gz $(PKG_BUILD_DIR)/loader.elf $(TARGET)/
+endif
+
+clean:
+	rm -rf $(PKG_BUILD_DIR)
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/LzmaDecode.c b/target/linux/brcm63xx/image/lzma-loader/src/LzmaDecode.c
new file mode 100644
index 0000000..951700b
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/LzmaDecode.c
@@ -0,0 +1,663 @@
+/*
+  LzmaDecode.c
+  LZMA Decoder
+  
+  LZMA SDK 4.05 Copyright (c) 1999-2004 Igor Pavlov (2004-08-25)
+  http://www.7-zip.org/
+
+  LZMA SDK is licensed under two licenses:
+  1) GNU Lesser General Public License (GNU LGPL)
+  2) Common Public License (CPL)
+  It means that you can select one of these two licenses and 
+  follow rules of that license.
+
+  SPECIAL EXCEPTION:
+  Igor Pavlov, as the author of this code, expressly permits you to 
+  statically or dynamically link your code (or bind by name) to the 
+  interfaces of this file without subjecting your linked code to the 
+  terms of the CPL or GNU LGPL. Any modifications or additions 
+  to this file, however, are subject to the LGPL or CPL terms.
+*/
+
+#include "LzmaDecode.h"
+
+#ifndef Byte
+#define Byte unsigned char
+#endif
+
+#define kNumTopBits 24
+#define kTopValue ((UInt32)1 << kNumTopBits)
+
+#define kNumBitModelTotalBits 11
+#define kBitModelTotal (1 << kNumBitModelTotalBits)
+#define kNumMoveBits 5
+
+typedef struct _CRangeDecoder
+{
+  Byte *Buffer;
+  Byte *BufferLim;
+  UInt32 Range;
+  UInt32 Code;
+  #ifdef _LZMA_IN_CB
+  ILzmaInCallback *InCallback;
+  int Result;
+  #endif
+  int ExtraBytes;
+} CRangeDecoder;
+
+Byte RangeDecoderReadByte(CRangeDecoder *rd)
+{
+  if (rd->Buffer == rd->BufferLim)
+  {
+    #ifdef _LZMA_IN_CB
+    UInt32 size;
+    rd->Result = rd->InCallback->Read(rd->InCallback, &rd->Buffer, &size);
+    rd->BufferLim = rd->Buffer + size;
+    if (size == 0)
+    #endif
+    {
+      rd->ExtraBytes = 1;
+      return 0xFF;
+    }
+  }
+  return (*rd->Buffer++);
+}
+
+/* #define ReadByte (*rd->Buffer++) */
+#define ReadByte (RangeDecoderReadByte(rd))
+
+void RangeDecoderInit(CRangeDecoder *rd,
+  #ifdef _LZMA_IN_CB
+    ILzmaInCallback *inCallback
+  #else
+    Byte *stream, UInt32 bufferSize
+  #endif
+    )
+{
+  int i;
+  #ifdef _LZMA_IN_CB
+  rd->InCallback = inCallback;
+  rd->Buffer = rd->BufferLim = 0;
+  #else
+  rd->Buffer = stream;
+  rd->BufferLim = stream + bufferSize;
+  #endif
+  rd->ExtraBytes = 0;
+  rd->Code = 0;
+  rd->Range = (0xFFFFFFFF);
+  for(i = 0; i < 5; i++)
+    rd->Code = (rd->Code << 8) | ReadByte;
+}
+
+#define RC_INIT_VAR UInt32 range = rd->Range; UInt32 code = rd->Code;        
+#define RC_FLUSH_VAR rd->Range = range; rd->Code = code;
+#define RC_NORMALIZE if (range < kTopValue) { range <<= 8; code = (code << 8) | ReadByte; }
+
+UInt32 RangeDecoderDecodeDirectBits(CRangeDecoder *rd, int numTotalBits)
+{
+  RC_INIT_VAR
+  UInt32 result = 0;
+  int i;
+  for (i = numTotalBits; i > 0; i--)
+  {
+    /* UInt32 t; */
+    range >>= 1;
+
+    result <<= 1;
+    if (code >= range)
+    {
+      code -= range;
+      result |= 1;
+    }
+    /*
+    t = (code - range) >> 31;
+    t &= 1;
+    code -= range & (t - 1);
+    result = (result + result) | (1 - t);
+    */
+    RC_NORMALIZE
+  }
+  RC_FLUSH_VAR
+  return result;
+}
+
+int RangeDecoderBitDecode(CProb *prob, CRangeDecoder *rd)
+{
+  UInt32 bound = (rd->Range >> kNumBitModelTotalBits) * *prob;
+  if (rd->Code < bound)
+  {
+    rd->Range = bound;
+    *prob += (kBitModelTotal - *prob) >> kNumMoveBits;
+    if (rd->Range < kTopValue)
+    {
+      rd->Code = (rd->Code << 8) | ReadByte;
+      rd->Range <<= 8;
+    }
+    return 0;
+  }
+  else
+  {
+    rd->Range -= bound;
+    rd->Code -= bound;
+    *prob -= (*prob) >> kNumMoveBits;
+    if (rd->Range < kTopValue)
+    {
+      rd->Code = (rd->Code << 8) | ReadByte;
+      rd->Range <<= 8;
+    }
+    return 1;
+  }
+}
+
+#define RC_GET_BIT2(prob, mi, A0, A1) \
+  UInt32 bound = (range >> kNumBitModelTotalBits) * *prob; \
+  if (code < bound) \
+    { A0; range = bound; *prob += (kBitModelTotal - *prob) >> kNumMoveBits; mi <<= 1; } \
+  else \
+    { A1; range -= bound; code -= bound; *prob -= (*prob) >> kNumMoveBits; mi = (mi + mi) + 1; } \
+  RC_NORMALIZE
+
+#define RC_GET_BIT(prob, mi) RC_GET_BIT2(prob, mi, ; , ;)               
+
+int RangeDecoderBitTreeDecode(CProb *probs, int numLevels, CRangeDecoder *rd)
+{
+  int mi = 1;
+  int i;
+  #ifdef _LZMA_LOC_OPT
+  RC_INIT_VAR
+  #endif
+  for(i = numLevels; i > 0; i--)
+  {
+    #ifdef _LZMA_LOC_OPT
+    CProb *prob = probs + mi;
+    RC_GET_BIT(prob, mi)
+    #else
+    mi = (mi + mi) + RangeDecoderBitDecode(probs + mi, rd);
+    #endif
+  }
+  #ifdef _LZMA_LOC_OPT
+  RC_FLUSH_VAR
+  #endif
+  return mi - (1 << numLevels);
+}
+
+int RangeDecoderReverseBitTreeDecode(CProb *probs, int numLevels, CRangeDecoder *rd)
+{
+  int mi = 1;
+  int i;
+  int symbol = 0;
+  #ifdef _LZMA_LOC_OPT
+  RC_INIT_VAR
+  #endif
+  for(i = 0; i < numLevels; i++)
+  {
+    #ifdef _LZMA_LOC_OPT
+    CProb *prob = probs + mi;
+    RC_GET_BIT2(prob, mi, ; , symbol |= (1 << i))
+    #else
+    int bit = RangeDecoderBitDecode(probs + mi, rd);
+    mi = mi + mi + bit;
+    symbol |= (bit << i);
+    #endif
+  }
+  #ifdef _LZMA_LOC_OPT
+  RC_FLUSH_VAR
+  #endif
+  return symbol;
+}
+
+Byte LzmaLiteralDecode(CProb *probs, CRangeDecoder *rd)
+{ 
+  int symbol = 1;
+  #ifdef _LZMA_LOC_OPT
+  RC_INIT_VAR
+  #endif
+  do
+  {
+    #ifdef _LZMA_LOC_OPT
+    CProb *prob = probs + symbol;
+    RC_GET_BIT(prob, symbol)
+    #else
+    symbol = (symbol + symbol) | RangeDecoderBitDecode(probs + symbol, rd);
+    #endif
+  }
+  while (symbol < 0x100);
+  #ifdef _LZMA_LOC_OPT
+  RC_FLUSH_VAR
+  #endif
+  return symbol;
+}
+
+Byte LzmaLiteralDecodeMatch(CProb *probs, CRangeDecoder *rd, Byte matchByte)
+{ 
+  int symbol = 1;
+  #ifdef _LZMA_LOC_OPT
+  RC_INIT_VAR
+  #endif
+  do
+  {
+    int bit;
+    int matchBit = (matchByte >> 7) & 1;
+    matchByte <<= 1;
+    #ifdef _LZMA_LOC_OPT
+    {
+      CProb *prob = probs + ((1 + matchBit) << 8) + symbol;
+      RC_GET_BIT2(prob, symbol, bit = 0, bit = 1)
+    }
+    #else
+    bit = RangeDecoderBitDecode(probs + ((1 + matchBit) << 8) + symbol, rd);
+    symbol = (symbol << 1) | bit;
+    #endif
+    if (matchBit != bit)
+    {
+      while (symbol < 0x100)
+      {
+        #ifdef _LZMA_LOC_OPT
+        CProb *prob = probs + symbol;
+        RC_GET_BIT(prob, symbol)
+        #else
+        symbol = (symbol + symbol) | RangeDecoderBitDecode(probs + symbol, rd);
+        #endif
+      }
+      break;
+    }
+  }
+  while (symbol < 0x100);
+  #ifdef _LZMA_LOC_OPT
+  RC_FLUSH_VAR
+  #endif
+  return symbol;
+}
+
+#define kNumPosBitsMax 4
+#define kNumPosStatesMax (1 << kNumPosBitsMax)
+
+#define kLenNumLowBits 3
+#define kLenNumLowSymbols (1 << kLenNumLowBits)
+#define kLenNumMidBits 3
+#define kLenNumMidSymbols (1 << kLenNumMidBits)
+#define kLenNumHighBits 8
+#define kLenNumHighSymbols (1 << kLenNumHighBits)
+
+#define LenChoice 0
+#define LenChoice2 (LenChoice + 1)
+#define LenLow (LenChoice2 + 1)
+#define LenMid (LenLow + (kNumPosStatesMax << kLenNumLowBits))
+#define LenHigh (LenMid + (kNumPosStatesMax << kLenNumMidBits))
+#define kNumLenProbs (LenHigh + kLenNumHighSymbols) 
+
+int LzmaLenDecode(CProb *p, CRangeDecoder *rd, int posState)
+{
+  if(RangeDecoderBitDecode(p + LenChoice, rd) == 0)
+    return RangeDecoderBitTreeDecode(p + LenLow +
+        (posState << kLenNumLowBits), kLenNumLowBits, rd);
+  if(RangeDecoderBitDecode(p + LenChoice2, rd) == 0)
+    return kLenNumLowSymbols + RangeDecoderBitTreeDecode(p + LenMid +
+        (posState << kLenNumMidBits), kLenNumMidBits, rd);
+  return kLenNumLowSymbols + kLenNumMidSymbols + 
+      RangeDecoderBitTreeDecode(p + LenHigh, kLenNumHighBits, rd);
+}
+
+#define kNumStates 12
+
+#define kStartPosModelIndex 4
+#define kEndPosModelIndex 14
+#define kNumFullDistances (1 << (kEndPosModelIndex >> 1))
+
+#define kNumPosSlotBits 6
+#define kNumLenToPosStates 4
+
+#define kNumAlignBits 4
+#define kAlignTableSize (1 << kNumAlignBits)
+
+#define kMatchMinLen 2
+
+#define IsMatch 0
+#define IsRep (IsMatch + (kNumStates << kNumPosBitsMax))
+#define IsRepG0 (IsRep + kNumStates)
+#define IsRepG1 (IsRepG0 + kNumStates)
+#define IsRepG2 (IsRepG1 + kNumStates)
+#define IsRep0Long (IsRepG2 + kNumStates)
+#define PosSlot (IsRep0Long + (kNumStates << kNumPosBitsMax))
+#define SpecPos (PosSlot + (kNumLenToPosStates << kNumPosSlotBits))
+#define Align (SpecPos + kNumFullDistances - kEndPosModelIndex)
+#define LenCoder (Align + kAlignTableSize)
+#define RepLenCoder (LenCoder + kNumLenProbs)
+#define Literal (RepLenCoder + kNumLenProbs)
+
+#if Literal != LZMA_BASE_SIZE
+StopCompilingDueBUG
+#endif
+
+#ifdef _LZMA_OUT_READ
+
+typedef struct _LzmaVarState
+{
+  CRangeDecoder RangeDecoder;
+  Byte *Dictionary;
+  UInt32 DictionarySize;
+  UInt32 DictionaryPos;
+  UInt32 GlobalPos;
+  UInt32 Reps[4];
+  int lc;
+  int lp;
+  int pb;
+  int State;
+  int PreviousIsMatch;
+  int RemainLen;
+} LzmaVarState;
+
+int LzmaDecoderInit(
+    unsigned char *buffer, UInt32 bufferSize,
+    int lc, int lp, int pb,
+    unsigned char *dictionary, UInt32 dictionarySize,
+    #ifdef _LZMA_IN_CB
+    ILzmaInCallback *inCallback
+    #else
+    unsigned char *inStream, UInt32 inSize
+    #endif
+    )
+{
+  LzmaVarState *vs = (LzmaVarState *)buffer;
+  CProb *p = (CProb *)(buffer + sizeof(LzmaVarState));
+  UInt32 numProbs = Literal + ((UInt32)LZMA_LIT_SIZE << (lc + lp));
+  UInt32 i;
+  if (bufferSize < numProbs * sizeof(CProb) + sizeof(LzmaVarState))
+    return LZMA_RESULT_NOT_ENOUGH_MEM;
+  vs->Dictionary = dictionary;
+  vs->DictionarySize = dictionarySize;
+  vs->DictionaryPos = 0;
+  vs->GlobalPos = 0;
+  vs->Reps[0] = vs->Reps[1] = vs->Reps[2] = vs->Reps[3] = 1;
+  vs->lc = lc;
+  vs->lp = lp;
+  vs->pb = pb;
+  vs->State = 0;
+  vs->PreviousIsMatch = 0;
+  vs->RemainLen = 0;
+  dictionary[dictionarySize - 1] = 0;
+  for (i = 0; i < numProbs; i++)
+    p[i] = kBitModelTotal >> 1; 
+  RangeDecoderInit(&vs->RangeDecoder, 
+      #ifdef _LZMA_IN_CB
+      inCallback
+      #else
+      inStream, inSize
+      #endif
+  );
+  return LZMA_RESULT_OK;
+}
+
+int LzmaDecode(unsigned char *buffer, 
+    unsigned char *outStream, UInt32 outSize,
+    UInt32 *outSizeProcessed)
+{
+  LzmaVarState *vs = (LzmaVarState *)buffer;
+  CProb *p = (CProb *)(buffer + sizeof(LzmaVarState));
+  CRangeDecoder rd = vs->RangeDecoder;
+  int state = vs->State;
+  int previousIsMatch = vs->PreviousIsMatch;
+  Byte previousByte;
+  UInt32 rep0 = vs->Reps[0], rep1 = vs->Reps[1], rep2 = vs->Reps[2], rep3 = vs->Reps[3];
+  UInt32 nowPos = 0;
+  UInt32 posStateMask = (1 << (vs->pb)) - 1;
+  UInt32 literalPosMask = (1 << (vs->lp)) - 1;
+  int lc = vs->lc;
+  int len = vs->RemainLen;
+  UInt32 globalPos = vs->GlobalPos;
+
+  Byte *dictionary = vs->Dictionary;
+  UInt32 dictionarySize = vs->DictionarySize;
+  UInt32 dictionaryPos = vs->DictionaryPos;
+
+  if (len == -1)
+  {
+    *outSizeProcessed = 0;
+    return LZMA_RESULT_OK;
+  }
+
+  while(len > 0 && nowPos < outSize)
+  {
+    UInt32 pos = dictionaryPos - rep0;
+    if (pos >= dictionarySize)
+      pos += dictionarySize;
+    outStream[nowPos++] = dictionary[dictionaryPos] = dictionary[pos];
+    if (++dictionaryPos == dictionarySize)
+      dictionaryPos = 0;
+    len--;
+  }
+  if (dictionaryPos == 0)
+    previousByte = dictionary[dictionarySize - 1];
+  else
+    previousByte = dictionary[dictionaryPos - 1];
+#else
+
+int LzmaDecode(
+    Byte *buffer, UInt32 bufferSize,
+    int lc, int lp, int pb,
+    #ifdef _LZMA_IN_CB
+    ILzmaInCallback *inCallback,
+    #else
+    unsigned char *inStream, UInt32 inSize,
+    #endif
+    unsigned char *outStream, UInt32 outSize,
+    UInt32 *outSizeProcessed)
+{
+  UInt32 numProbs = Literal + ((UInt32)LZMA_LIT_SIZE << (lc + lp));
+  CProb *p = (CProb *)buffer;
+  CRangeDecoder rd;
+  UInt32 i;
+  int state = 0;
+  int previousIsMatch = 0;
+  Byte previousByte = 0;
+  UInt32 rep0 = 1, rep1 = 1, rep2 = 1, rep3 = 1;
+  UInt32 nowPos = 0;
+  UInt32 posStateMask = (1 << pb) - 1;
+  UInt32 literalPosMask = (1 << lp) - 1;
+  int len = 0;
+  if (bufferSize < numProbs * sizeof(CProb))
+    return LZMA_RESULT_NOT_ENOUGH_MEM;
+  for (i = 0; i < numProbs; i++)
+    p[i] = kBitModelTotal >> 1; 
+  RangeDecoderInit(&rd, 
+      #ifdef _LZMA_IN_CB
+      inCallback
+      #else
+      inStream, inSize
+      #endif
+      );
+#endif
+
+  *outSizeProcessed = 0;
+  while(nowPos < outSize)
+  {
+    int posState = (int)(
+        (nowPos 
+        #ifdef _LZMA_OUT_READ
+        + globalPos
+        #endif
+        )
+        & posStateMask);
+    #ifdef _LZMA_IN_CB
+    if (rd.Result != LZMA_RESULT_OK)
+      return rd.Result;
+    #endif
+    if (rd.ExtraBytes != 0)
+      return LZMA_RESULT_DATA_ERROR;
+    if (RangeDecoderBitDecode(p + IsMatch + (state << kNumPosBitsMax) + posState, &rd) == 0)
+    {
+      CProb *probs = p + Literal + (LZMA_LIT_SIZE * 
+        (((
+        (nowPos 
+        #ifdef _LZMA_OUT_READ
+        + globalPos
+        #endif
+        )
+        & literalPosMask) << lc) + (previousByte >> (8 - lc))));
+
+      if (state < 4) state = 0;
+      else if (state < 10) state -= 3;
+      else state -= 6;
+      if (previousIsMatch)
+      {
+        Byte matchByte;
+        #ifdef _LZMA_OUT_READ
+        UInt32 pos = dictionaryPos - rep0;
+        if (pos >= dictionarySize)
+          pos += dictionarySize;
+        matchByte = dictionary[pos];
+        #else
+        matchByte = outStream[nowPos - rep0];
+        #endif
+        previousByte = LzmaLiteralDecodeMatch(probs, &rd, matchByte);
+        previousIsMatch = 0;
+      }
+      else
+        previousByte = LzmaLiteralDecode(probs, &rd);
+      outStream[nowPos++] = previousByte;
+      #ifdef _LZMA_OUT_READ
+      dictionary[dictionaryPos] = previousByte;
+      if (++dictionaryPos == dictionarySize)
+        dictionaryPos = 0;
+      #endif
+    }
+    else             
+    {
+      previousIsMatch = 1;
+      if (RangeDecoderBitDecode(p + IsRep + state, &rd) == 1)
+      {
+        if (RangeDecoderBitDecode(p + IsRepG0 + state, &rd) == 0)
+        {
+          if (RangeDecoderBitDecode(p + IsRep0Long + (state << kNumPosBitsMax) + posState, &rd) == 0)
+          {
+            #ifdef _LZMA_OUT_READ
+            UInt32 pos;
+            #endif
+            if (
+               (nowPos 
+                #ifdef _LZMA_OUT_READ
+                + globalPos
+                #endif
+               )
+               == 0)
+              return LZMA_RESULT_DATA_ERROR;
+            state = state < 7 ? 9 : 11;
+            #ifdef _LZMA_OUT_READ
+            pos = dictionaryPos - rep0;
+            if (pos >= dictionarySize)
+              pos += dictionarySize;
+            previousByte = dictionary[pos];
+            dictionary[dictionaryPos] = previousByte;
+            if (++dictionaryPos == dictionarySize)
+              dictionaryPos = 0;
+            #else
+            previousByte = outStream[nowPos - rep0];
+            #endif
+            outStream[nowPos++] = previousByte;
+            continue;
+          }
+        }
+        else
+        {
+          UInt32 distance;
+          if(RangeDecoderBitDecode(p + IsRepG1 + state, &rd) == 0)
+            distance = rep1;
+          else 
+          {
+            if(RangeDecoderBitDecode(p + IsRepG2 + state, &rd) == 0)
+              distance = rep2;
+            else
+            {
+              distance = rep3;
+              rep3 = rep2;
+            }
+            rep2 = rep1;
+          }
+          rep1 = rep0;
+          rep0 = distance;
+        }
+        len = LzmaLenDecode(p + RepLenCoder, &rd, posState);
+        state = state < 7 ? 8 : 11;
+      }
+      else
+      {
+        int posSlot;
+        rep3 = rep2;
+        rep2 = rep1;
+        rep1 = rep0;
+        state = state < 7 ? 7 : 10;
+        len = LzmaLenDecode(p + LenCoder, &rd, posState);
+        posSlot = RangeDecoderBitTreeDecode(p + PosSlot +
+            ((len < kNumLenToPosStates ? len : kNumLenToPosStates - 1) << 
+            kNumPosSlotBits), kNumPosSlotBits, &rd);
+        if (posSlot >= kStartPosModelIndex)
+        {
+          int numDirectBits = ((posSlot >> 1) - 1);
+          rep0 = ((2 | ((UInt32)posSlot & 1)) << numDirectBits);
+          if (posSlot < kEndPosModelIndex)
+          {
+            rep0 += RangeDecoderReverseBitTreeDecode(
+                p + SpecPos + rep0 - posSlot - 1, numDirectBits, &rd);
+          }
+          else
+          {
+            rep0 += RangeDecoderDecodeDirectBits(&rd, 
+                numDirectBits - kNumAlignBits) << kNumAlignBits;
+            rep0 += RangeDecoderReverseBitTreeDecode(p + Align, kNumAlignBits, &rd);
+          }
+        }
+        else
+          rep0 = posSlot;
+        rep0++;
+      }
+      if (rep0 == (UInt32)(0))
+      {
+        /* it's for stream version */
+        len = -1;
+        break;
+      }
+      if (rep0 > nowPos 
+        #ifdef _LZMA_OUT_READ
+        + globalPos
+        #endif
+        )
+      {
+        return LZMA_RESULT_DATA_ERROR;
+      }
+      len += kMatchMinLen;
+      do
+      {
+        #ifdef _LZMA_OUT_READ
+        UInt32 pos = dictionaryPos - rep0;
+        if (pos >= dictionarySize)
+          pos += dictionarySize;
+        previousByte = dictionary[pos];
+        dictionary[dictionaryPos] = previousByte;
+        if (++dictionaryPos == dictionarySize)
+          dictionaryPos = 0;
+        #else
+        previousByte = outStream[nowPos - rep0];
+        #endif
+        outStream[nowPos++] = previousByte;
+        len--;
+      }
+      while(len > 0 && nowPos < outSize);
+    }
+  }
+
+  #ifdef _LZMA_OUT_READ
+  vs->RangeDecoder = rd;
+  vs->DictionaryPos = dictionaryPos;
+  vs->GlobalPos = globalPos + nowPos;
+  vs->Reps[0] = rep0;
+  vs->Reps[1] = rep1;
+  vs->Reps[2] = rep2;
+  vs->Reps[3] = rep3;
+  vs->State = state;
+  vs->PreviousIsMatch = previousIsMatch;
+  vs->RemainLen = len;
+  #endif
+
+  *outSizeProcessed = nowPos;
+  return LZMA_RESULT_OK;
+}
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/LzmaDecode.h b/target/linux/brcm63xx/image/lzma-loader/src/LzmaDecode.h
new file mode 100644
index 0000000..f58944e
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/LzmaDecode.h
@@ -0,0 +1,100 @@
+/* 
+  LzmaDecode.h
+  LZMA Decoder interface
+
+  LZMA SDK 4.05 Copyright (c) 1999-2004 Igor Pavlov (2004-08-25)
+  http://www.7-zip.org/
+
+  LZMA SDK is licensed under two licenses:
+  1) GNU Lesser General Public License (GNU LGPL)
+  2) Common Public License (CPL)
+  It means that you can select one of these two licenses and 
+  follow rules of that license.
+
+  SPECIAL EXCEPTION:
+  Igor Pavlov, as the author of this code, expressly permits you to 
+  statically or dynamically link your code (or bind by name) to the 
+  interfaces of this file without subjecting your linked code to the 
+  terms of the CPL or GNU LGPL. Any modifications or additions 
+  to this file, however, are subject to the LGPL or CPL terms.
+*/
+
+#ifndef __LZMADECODE_H
+#define __LZMADECODE_H
+
+/* #define _LZMA_IN_CB */
+/* Use callback for input data */
+
+/* #define _LZMA_OUT_READ */
+/* Use read function for output data */
+
+/* #define _LZMA_PROB32 */
+/* It can increase speed on some 32-bit CPUs, 
+   but memory usage will be doubled in that case */
+
+/* #define _LZMA_LOC_OPT */
+/* Enable local speed optimizations inside code */
+
+#ifndef UInt32
+#ifdef _LZMA_UINT32_IS_ULONG
+#define UInt32 unsigned long
+#else
+#define UInt32 unsigned int
+#endif
+#endif
+
+#ifdef _LZMA_PROB32
+#define CProb UInt32
+#else
+#define CProb unsigned short
+#endif
+
+#define LZMA_RESULT_OK 0
+#define LZMA_RESULT_DATA_ERROR 1
+#define LZMA_RESULT_NOT_ENOUGH_MEM 2
+
+#ifdef _LZMA_IN_CB
+typedef struct _ILzmaInCallback
+{
+  int (*Read)(void *object, unsigned char **buffer, UInt32 *bufferSize);
+} ILzmaInCallback;
+#endif
+
+#define LZMA_BASE_SIZE 1846
+#define LZMA_LIT_SIZE 768
+
+/* 
+bufferSize = (LZMA_BASE_SIZE + (LZMA_LIT_SIZE << (lc + lp)))* sizeof(CProb)
+bufferSize += 100 in case of _LZMA_OUT_READ
+by default CProb is unsigned short, 
+but if specify _LZMA_PROB_32, CProb will be UInt32(unsigned int)
+*/
+
+#ifdef _LZMA_OUT_READ
+int LzmaDecoderInit(
+    unsigned char *buffer, UInt32 bufferSize,
+    int lc, int lp, int pb,
+    unsigned char *dictionary, UInt32 dictionarySize,
+  #ifdef _LZMA_IN_CB
+    ILzmaInCallback *inCallback
+  #else
+    unsigned char *inStream, UInt32 inSize
+  #endif
+);
+#endif
+
+int LzmaDecode(
+    unsigned char *buffer, 
+  #ifndef _LZMA_OUT_READ
+    UInt32 bufferSize,
+    int lc, int lp, int pb,
+  #ifdef _LZMA_IN_CB
+    ILzmaInCallback *inCallback,
+  #else
+    unsigned char *inStream, UInt32 inSize,
+  #endif
+  #endif
+    unsigned char *outStream, UInt32 outSize,
+    UInt32 *outSizeProcessed);
+
+#endif
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/Makefile b/target/linux/brcm63xx/image/lzma-loader/src/Makefile
new file mode 100644
index 0000000..85a8646
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/Makefile
@@ -0,0 +1,77 @@
+#
+# Makefile for Broadcom BCM947XX boards
+#
+# Copyright 2001-2003, Broadcom Corporation
+# All Rights Reserved.
+# 
+# THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+# KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+# SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+# FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+#
+# Copyright 2004  Manuel Novoa III <mjn3@codepoet.org>
+#   Modified to support bzip'd kernels.
+#   Of course, it would be better to integrate bunzip capability into CFE.
+#
+# Copyright 2005  Oleg I. Vdovikin <oleg@cs.msu.su>
+#   Cleaned up, modified for lzma support, removed from kernel
+#
+
+TEXT_START	:= 0x80001000
+BZ_TEXT_START	:= 0x80300000
+
+OBJCOPY		:= $(CROSS_COMPILE)objcopy -O binary -R .reginfo -R .note -R .comment -R .mdebug -S
+
+CFLAGS		= -D__KERNEL__ -Wall -Wstrict-prototypes -Wno-trigraphs -Os \
+		  -fno-strict-aliasing -fno-common -fomit-frame-pointer -G 0 -mno-abicalls -fno-pic \
+		  -ffunction-sections -pipe -mlong-calls -fno-common \
+		  -mabi=32 -march=mips32 -Wa,-32 -Wa,-march=mips32 -Wa,-mips32 -Wa,--trap
+CFLAGS		+= -DLOADADDR=$(TEXT_START) -D_LZMA_IN_CB
+
+ASFLAGS		= $(CFLAGS) -D__ASSEMBLY__ -DBZ_TEXT_START=$(BZ_TEXT_START)
+
+SEDFLAGS	:= s/BZ_TEXT_START/$(BZ_TEXT_START)/;s/TEXT_START/$(TEXT_START)/
+
+OBJECTS		:= head.o data.o
+
+all: loader.gz loader.elf
+
+# Don't build dependencies, this may die if $(CC) isn't gcc
+dep:
+
+install:
+
+loader.gz: loader
+	gzip -nc9 $< > $@
+
+loader.elf: loader.o
+	cp $< $@
+
+loader: loader.o
+	$(OBJCOPY) $< $@
+
+loader.o: loader.lds $(OBJECTS)
+	$(LD) -static --gc-sections -no-warn-mismatch -T loader.lds -o $@ $(OBJECTS)
+
+loader.lds: loader.lds.in Makefile
+	@sed "$(SEDFLAGS)" < $< > $@
+
+data.o: data.lds decompress.image
+	$(LD) -no-warn-mismatch -T data.lds -r -o $@ -b binary decompress.image -b elf32-tradlittlemips
+
+data.lds:
+	@echo "SECTIONS { .data : { code_start = .; *(.data) code_stop = .; }}" > $@
+
+decompress.image: decompress
+	$(OBJCOPY) $< $@
+
+decompress: decompress.lds decompress.o LzmaDecode.o
+	$(LD) -static --gc-sections -no-warn-mismatch -T decompress.lds -o $@ decompress.o LzmaDecode.o
+
+decompress.lds: decompress.lds.in Makefile
+	@sed "$(SEDFLAGS)" < $< > $@
+
+mrproper: clean
+
+clean:
+	rm -f loader.gz loader decompress *.lds *.o *.image
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/README b/target/linux/brcm63xx/image/lzma-loader/src/README
new file mode 100644
index 0000000..16649e9
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/README
@@ -0,0 +1,55 @@
+/*
+ * LZMA compressed kernel decompressor for bcm947xx boards
+ *
+ * Copyright (C) 2005 by Oleg I. Vdovikin <oleg@cs.msu.su>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
+
+The code is intended to decompress kernel, being compressed using lzma utility
+build using 7zip LZMA SDK. This utility is located in the LZMA_Alone directory
+
+decompressor code expects that your .trx file consist of three partitions: 
+
+1) decompressor itself (this is gziped code which pmon/cfe will extract and run
+on boot-up instead of real kernel)
+2) LZMA compressed kernel (both streamed and regular modes are supported now)
+3) Root filesystem
+
+Please be sure to apply the following patch for use this new trx layout (it will
+allow using both new and old trx files for root filesystem lookup code)
+
+--- linuz/arch/mips/brcm-boards/bcm947xx/setup.c        2005-01-23 19:24:27.503322896 +0300
++++ linux/arch/mips/brcm-boards/bcm947xx/setup.c        2005-01-23 19:29:05.237100944 +0300
+@@ -221,7 +221,9 @@
+                /* Try looking at TRX header for rootfs offset */
+                if (le32_to_cpu(trx->magic) == TRX_MAGIC) {
+                        bcm947xx_parts[1].offset = off;
+-                       if (le32_to_cpu(trx->offsets[1]) > off)
++                       if (le32_to_cpu(trx->offsets[2]) > off)
++                               off = le32_to_cpu(trx->offsets[2]);
++                       else if (le32_to_cpu(trx->offsets[1]) > off)
+                                off = le32_to_cpu(trx->offsets[1]);
+                        continue;
+                }
+
+
+Revision history:
+	0.02	Initial release
+	0.03	Added Mineharu Takahara <mtakahar@yahoo.com> patch to pass actual
+		output size to decoder (stream mode compressed input is not 
+		a requirement anymore)
+	0.04	Reordered functions using lds script
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/decompress.c b/target/linux/brcm63xx/image/lzma-loader/src/decompress.c
new file mode 100644
index 0000000..ec510e2
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/decompress.c
@@ -0,0 +1,175 @@
+/*
+ * LZMA compressed kernel decompressor for bcm947xx boards
+ *
+ * Copyright (C) 2005 by Oleg I. Vdovikin <oleg@cs.msu.su>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ *
+ * Please note, this was code based on the bunzip2 decompressor code
+ * by Manuel Novoa III  (mjn3@codepoet.org), although the only thing left
+ * is an idea and part of original vendor code
+ *
+ *
+ * 12-Mar-2005  Mineharu Takahara <mtakahar@yahoo.com>
+ *   pass actual output size to decoder (stream mode
+ *   compressed input is not a requirement anymore)
+ *
+ * 24-Apr-2005 Oleg I. Vdovikin
+ *   reordered functions using lds script, removed forward decl
+ *
+ */
+
+#include "LzmaDecode.h"
+
+#define BCM4710_FLASH		0x1fc00000	/* Flash */
+
+#define KSEG0			0x80000000
+#define KSEG1			0xa0000000
+
+#define KSEG1ADDR(a)		((((unsigned)(a)) & 0x1fffffffU) | KSEG1)
+
+#define Index_Invalidate_I	0x00
+#define Index_Writeback_Inv_D   0x01
+
+#define cache_unroll(base,op)	\
+	__asm__ __volatile__(		\
+		".set noreorder;\n"		\
+		".set mips3;\n"			\
+		"cache %1, (%0);\n"		\
+		".set mips0;\n"			\
+		".set reorder\n"		\
+		:						\
+		: "r" (base),			\
+		  "i" (op));
+
+static __inline__ void blast_icache(unsigned long size, unsigned long lsize)
+{
+	unsigned long start = KSEG0;
+	unsigned long end = (start + size);
+
+	while(start < end) {
+		cache_unroll(start,Index_Invalidate_I);
+		start += lsize;
+	}
+}
+
+static __inline__ void blast_dcache(unsigned long size, unsigned long lsize)
+{
+	unsigned long start = KSEG0;
+	unsigned long end = (start + size);
+
+	while(start < end) {
+		cache_unroll(start,Index_Writeback_Inv_D);
+		start += lsize;
+	}
+}
+
+#define TRX_MAGIC       0x30524448      /* "HDR0" */
+
+struct trx_header {
+	unsigned int magic;		/* "HDR0" */
+	unsigned int len;		/* Length of file including header */
+	unsigned int crc32;		/* 32-bit CRC from flag_version to end of file */
+	unsigned int flag_version;	/* 0:15 flags, 16:31 version */
+	unsigned int offsets[3];	/* Offsets of partitions from start of header */
+};
+
+/* beyound the image end, size not known in advance */
+extern unsigned char workspace[];
+
+unsigned int offset;
+unsigned char *data;
+
+/* flash access should be aligned, so wrapper is used */
+/* read byte from the flash, all accesses are 32-bit aligned */
+static int read_byte(void *object, unsigned char **buffer, UInt32 *bufferSize)
+{
+	static unsigned int val;
+
+	if (((unsigned int)offset % 4) == 0) {
+		val = *(unsigned int *)data;
+		data += 4;
+	}
+	
+	*bufferSize = 1;
+	*buffer = ((unsigned char *)&val) + (offset++ & 3);
+	
+	return LZMA_RESULT_OK;
+}
+
+static __inline__ unsigned char get_byte(void)
+{
+	unsigned char *buffer;
+	UInt32 fake;
+	
+	return read_byte(0, &buffer, &fake), *buffer;
+}
+
+/* should be the first function */
+void entry(unsigned long icache_size, unsigned long icache_lsize, 
+	unsigned long dcache_size, unsigned long dcache_lsize)
+{
+	unsigned int i;  /* temp value */
+	unsigned int lc; /* literal context bits */
+	unsigned int lp; /* literal pos state bits */
+	unsigned int pb; /* pos state bits */
+	unsigned int osize; /* uncompressed size */
+
+	ILzmaInCallback callback;
+	callback.Read = read_byte;
+
+	/* look for trx header, 32-bit data access */
+	for (data = ((unsigned char *) KSEG1ADDR(BCM4710_FLASH));
+		((struct trx_header *)data)->magic != TRX_MAGIC; data += 65536);
+
+	/* compressed kernel is in the partition 0 or 1 */
+	if (((struct trx_header *)data)->offsets[1] > 65536) 
+		data += ((struct trx_header *)data)->offsets[0];
+	else
+		data += ((struct trx_header *)data)->offsets[1];
+
+	offset = 0;
+
+	/* lzma args */
+	i = get_byte();
+	lc = i % 9, i = i / 9;
+	lp = i % 5, pb = i / 5;
+
+	/* skip rest of the LZMA coder property */
+	for (i = 0; i < 4; i++)
+		get_byte();
+
+	/* read the lower half of uncompressed size in the header */
+	osize = ((unsigned int)get_byte()) +
+		((unsigned int)get_byte() << 8) +
+		((unsigned int)get_byte() << 16) +
+		((unsigned int)get_byte() << 24);
+
+	/* skip rest of the header (upper half of uncompressed size) */
+	for (i = 0; i < 4; i++) 
+		get_byte();
+
+	/* decompress kernel */
+	if (LzmaDecode(workspace, ~0, lc, lp, pb, &callback,
+		(unsigned char*)LOADADDR, osize, &i) == LZMA_RESULT_OK)
+	{
+		blast_dcache(dcache_size, dcache_lsize);
+		blast_icache(icache_size, icache_lsize);
+
+		/* Jump to load address */
+		((void (*)(void)) LOADADDR)();
+	}
+}
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/decompress.lds.in b/target/linux/brcm63xx/image/lzma-loader/src/decompress.lds.in
new file mode 100644
index 0000000..33f56f8
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/decompress.lds.in
@@ -0,0 +1,20 @@
+OUTPUT_ARCH(mips)
+ENTRY(entry)
+SECTIONS {
+	. = BZ_TEXT_START;
+	.text : {
+		*(.text.entry)
+		*(.text)
+		*(.rodata)
+	}
+
+	.data : {
+		*(.data)
+	}
+
+	.bss : {
+		*(.bss)
+	}
+
+	workspace = .;
+}
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/head.S b/target/linux/brcm63xx/image/lzma-loader/src/head.S
new file mode 100644
index 0000000..9bfbd53
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/head.S
@@ -0,0 +1,155 @@
+/* Copyright 2005 Oleg I. Vdovikin (oleg@cs.msu.su)	*/
+/* cache manipulation adapted from Broadcom code 	*/
+/* idea taken from original bunzip2 decompressor code	*/
+/* Copyright 2004 Manuel Novoa III (mjn3@codepoet.org)	*/
+/* Licensed under the linux kernel's version of the GPL.*/
+
+#include <asm/asm.h>
+#include <asm/regdef.h>
+
+#define KSEG0		0x80000000
+
+#define C0_CONFIG	$16
+#define C0_TAGLO	$28
+#define C0_TAGHI	$29
+
+#define	CONF1_DA_SHIFT	7			/* D$ associativity */
+#define CONF1_DA_MASK	0x00000380
+#define CONF1_DA_BASE	1
+#define CONF1_DL_SHIFT	10			/* D$ line size */
+#define CONF1_DL_MASK	0x00001c00
+#define CONF1_DL_BASE	2
+#define CONF1_DS_SHIFT	13			/* D$ sets/way */
+#define CONF1_DS_MASK	0x0000e000
+#define CONF1_DS_BASE	64
+#define CONF1_IA_SHIFT	16			/* I$ associativity */
+#define CONF1_IA_MASK	0x00070000
+#define CONF1_IA_BASE	1
+#define CONF1_IL_SHIFT	19			/* I$ line size */
+#define CONF1_IL_MASK	0x00380000
+#define CONF1_IL_BASE	2
+#define CONF1_IS_SHIFT	22			/* Instruction cache sets/way */
+#define CONF1_IS_MASK	0x01c00000
+#define CONF1_IS_BASE	64
+
+#define Index_Invalidate_I	0x00
+#define Index_Writeback_Inv_D   0x01
+
+	.text
+	LEAF(startup)
+	.set noreorder
+	
+	/* Copy decompressor code to the right place */
+	li	t2, BZ_TEXT_START
+	add	a0, t2, 0
+	la      a1, code_start
+	la	a2, code_stop
+$L1:
+	lw	t0, 0(a1)
+	sw	t0, 0(a0)
+	add	a1, 4
+	add	a0, 4
+	blt	a1, a2, $L1
+	nop
+	
+	/* At this point we need to invalidate dcache and */
+	/* icache before jumping to new code */
+
+1:	/* Get cache sizes */
+	.set	mips32
+	mfc0	s0,C0_CONFIG,1
+	.set	mips0
+
+	li	s1,CONF1_DL_MASK
+	and	s1,s0
+	beq	s1,zero,nodc
+	nop
+
+	srl	s1,CONF1_DL_SHIFT
+	li	t0,CONF1_DL_BASE
+	sll	s1,t0,s1		/* s1 has D$ cache line size */
+
+	li	s2,CONF1_DA_MASK
+	and	s2,s0
+	srl	s2,CONF1_DA_SHIFT
+	addiu	s2,CONF1_DA_BASE	/* s2 now has D$ associativity */
+
+	li	t0,CONF1_DS_MASK
+	and	t0,s0
+	srl	t0,CONF1_DS_SHIFT
+	li	s3,CONF1_DS_BASE
+	sll	s3,s3,t0		/* s3 has D$ sets per way */
+
+	multu	s2,s3			/* sets/way * associativity */
+	mflo	t0			/* total cache lines */
+
+	multu	s1,t0			/* D$ linesize * lines */
+	mflo	s2			/* s2 is now D$ size in bytes */
+
+	/* Initilize the D$: */
+	mtc0	zero,C0_TAGLO
+	mtc0	zero,C0_TAGHI
+
+	li	t0,KSEG0		/* Just an address for the first $ line */
+	addu	t1,t0,s2		/*  + size of cache == end */
+
+	.set	mips3
+1:	cache	Index_Writeback_Inv_D,0(t0)
+	.set	mips0
+	bne	t0,t1,1b
+	addu	t0,s1
+	
+nodc:
+	/* Now we get to do it all again for the I$ */
+	
+	move	s3,zero			/* just in case there is no icache */
+	move	s4,zero
+
+	li	t0,CONF1_IL_MASK
+	and	t0,s0
+	beq	t0,zero,noic
+	nop
+
+	srl	t0,CONF1_IL_SHIFT
+	li	s3,CONF1_IL_BASE
+	sll	s3,t0			/* s3 has I$ cache line size */
+
+	li	t0,CONF1_IA_MASK
+	and	t0,s0
+	srl	t0,CONF1_IA_SHIFT
+	addiu	s4,t0,CONF1_IA_BASE	/* s4 now has I$ associativity */
+
+	li	t0,CONF1_IS_MASK
+	and	t0,s0
+	srl	t0,CONF1_IS_SHIFT
+	li	s5,CONF1_IS_BASE
+	sll	s5,t0			/* s5 has I$ sets per way */
+
+	multu	s4,s5			/* sets/way * associativity */
+	mflo	t0			/* s4 is now total cache lines */
+
+	multu	s3,t0			/* I$ linesize * lines */
+	mflo	s4			/* s4 is cache size in bytes */
+
+	/* Initilize the I$: */
+	mtc0	zero,C0_TAGLO
+	mtc0	zero,C0_TAGHI
+
+	li	t0,KSEG0		/* Just an address for the first $ line */
+	addu	t1,t0,s4		/*  + size of cache == end */
+
+	.set	mips3
+1:	cache	Index_Invalidate_I,0(t0)
+	.set	mips0
+	bne	t0,t1,1b
+	addu	t0,s3
+
+noic:
+	move	a0,s3			/* icache line size */
+	move	a1,s4			/* icache size */
+	move	a2,s1			/* dcache line size */
+	jal	t2
+	move	a3,s2			/* dcache size */
+	
+	.set reorder
+	END(startup)
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/loader.lds.in b/target/linux/brcm63xx/image/lzma-loader/src/loader.lds.in
new file mode 100644
index 0000000..20f2ea9
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/loader.lds.in
@@ -0,0 +1,17 @@
+OUTPUT_ARCH(mips)
+ENTRY(startup)
+SECTIONS {
+	. = TEXT_START;
+	.text : {
+		*(.text)
+		*(.rodata)
+	}
+
+	.data : {
+		*(.data)
+	}
+
+	.bss : {
+		*(.bss)
+	}
+}
diff --git a/target/linux/brcm63xx/patches/001-bcm963xx.patch b/target/linux/brcm63xx/patches/001-bcm963xx.patch
new file mode 100644
index 0000000..f85ceb9
--- /dev/null
+++ b/target/linux/brcm63xx/patches/001-bcm963xx.patch
@@ -0,0 +1,222 @@
+diff -urN linux-2.6.19/arch/mips/Kconfig linux-2.6.19.new/arch/mips/Kconfig
+--- linux-2.6.19/arch/mips/Kconfig	2006-11-29 22:57:37.000000000 +0100
++++ linux-2.6.19.new/arch/mips/Kconfig	2006-12-16 18:46:31.000000000 +0100
+@@ -4,6 +4,10 @@
+ 	# Horrible source of confusion.  Die, die, die ...
+ 	select EMBEDDED
+ 
++config CFE
++       bool
++       # Common Firmware Environment
++
+ mainmenu "Linux/MIPS Kernel Configuration"
+ 
+ menu "Machine selection"
+@@ -15,6 +15,18 @@
+ 	prompt "System type"
+ 	default SGI_IP22
+ 
++config BCM963XX 
++	bool "Support for Broadcom BCM963xx SoC"
++	select SYS_SUPPORTS_32BIT_KERNEL
++	select SYS_SUPPORTS_BIG_ENDIAN
++	select SYS_HAS_CPU_MIPS32_R1
++	select HW_HAS_PCI
++	select DMA_NONCOHERENT
++	select IRQ_CPU
++	select CFE
++	help
++	 This is a fmaily of boards based on the Broadcom MIPS32
++
+ config MACH_ALCHEMY
+ 	bool "Alchemy processor based machines"
+ 
+diff -urN linux-2.6.19/arch/mips/Makefile linux-2.6.19.new/arch/mips/Makefile
+--- linux-2.6.19/arch/mips/Makefile	2006-12-16 17:36:29.000000000 +0100
++++ linux-2.6.19.new/arch/mips/Makefile	2006-12-16 18:46:31.000000000 +0100
+@@ -158,6 +158,19 @@
+ #
+ 
+ #
++# Broadcom BCM963xx SoC
++#
++core-$(CONFIG_BCM963XX)	+= arch/mips/bcm963xx/
++cflags-$(CONFIG_BCM963XX)     	+= -Iinclude/asm-mips/mach-bcm963xx
++load-$(CONFIG_BCM963XX)	+= 0xffffffff80010000
++
++
++#
++# Common Firmware Environment
++#
++core-$(CONFIG_CFE)             += arch/mips/cfe/
++
++#
+ # Acer PICA 61, Mips Magnum 4000 and Olivetti M700.
+ #
+ core-$(CONFIG_MACH_JAZZ)	+= arch/mips/jazz/
+diff -urN linux-2.6.19/arch/mips/kernel/cpu-probe.c linux-2.6.19.new/arch/mips/kernel/cpu-probe.c
+--- linux-2.6.19/arch/mips/kernel/cpu-probe.c	2006-11-29 22:57:37.000000000 +0100
++++ linux-2.6.19.new/arch/mips/kernel/cpu-probe.c	2006-12-16 18:46:31.000000000 +0100
+@@ -590,6 +590,28 @@
+ 		return;
+ }
+ 
++static inline void cpu_probe_broadcom(struct cpuinfo_mips *c)
++{
++       decode_configs(c);
++       switch (c->processor_id & 0xff00) {
++       case PRID_IMP_BCM6338:
++               c->cputype = CPU_BCM6338;
++               break;
++       case PRID_IMP_BCM6345:
++               c->cputype = CPU_BCM6345;
++               break;
++       case PRID_IMP_BCM6348:
++               c->cputype = CPU_BCM6348;
++               break;
++	case PRID_IMP_BCM6358:
++		c->cputype = CPU_BCM6358;
++		break;
++       default:
++               c->cputype = CPU_UNKNOWN;
++               break;
++       }
++}
++
+ static inline void cpu_probe_mips(struct cpuinfo_mips *c)
+ {
+ 	decode_configs(c);
+@@ -724,6 +743,9 @@
+ 	case PRID_COMP_LEGACY:
+ 		cpu_probe_legacy(c);
+ 		break;
++        case PRID_COMP_BROADCOM:
++                cpu_probe_broadcom(c);
++                break;
+ 	case PRID_COMP_MIPS:
+ 		cpu_probe_mips(c);
+ 		break;
+diff -urN linux-2.6.19/arch/mips/kernel/proc.c linux-2.6.19.new/arch/mips/kernel/proc.c
+--- linux-2.6.19/arch/mips/kernel/proc.c	2006-11-29 22:57:37.000000000 +0100
++++ linux-2.6.19.new/arch/mips/kernel/proc.c	2006-12-16 18:46:31.000000000 +0100
+@@ -84,6 +84,10 @@
+ 	[CPU_VR4181A]	= "NEC VR4181A",
+ 	[CPU_SR71000]	= "Sandcraft SR71000",
+ 	[CPU_PR4450]	= "Philips PR4450",
++	[CPU_BCM6338]   = "BCM6338",
++	[CPU_BCM6345]   = "BCM6345",
++	[CPU_BCM6348]   = "BCM6348",
++	[CPU_BCM6358]	= "BCM6358",
+ };
+ 
+ 
+diff -urN linux-2.6.19/arch/mips/mm/c-r4k.c linux-2.6.19.new/arch/mips/mm/c-r4k.c
+--- linux-2.6.19/arch/mips/mm/c-r4k.c	2006-11-29 22:57:37.000000000 +0100
++++ linux-2.6.19.new/arch/mips/mm/c-r4k.c	2006-12-16 18:46:31.000000000 +0100
+@@ -852,6 +852,13 @@
+ 		if (!(config & MIPS_CONF_M))
+ 			panic("Don't know how to probe P-caches on this cpu.");
+ 
++		if (c->cputype == CPU_BCM6338 || c->cputype == CPU_BCM6345 || c->cputype == CPU_BCM6348 || c->cputype == CPU_BCM6358)
++		{
++			printk("bcm963xx: enabling icache and dcache...\n");
++			/* Enable caches */
++			write_c0_diag(read_c0_diag() | 0xC0000000);
++		}
++
+ 		/*
+ 		 * So we seem to be a MIPS32 or MIPS64 CPU
+ 		 * So let's probe the I-cache ...
+diff -urN linux-2.6.19/arch/mips/mm/tlbex.c linux-2.6.19.new/arch/mips/mm/tlbex.c
+--- linux-2.6.19/arch/mips/mm/tlbex.c	2006-11-29 22:57:37.000000000 +0100
++++ linux-2.6.19.new/arch/mips/mm/tlbex.c	2006-12-16 18:46:31.000000000 +0100
+@@ -892,6 +892,10 @@
+ 	case CPU_4KSC:
+ 	case CPU_20KC:
+ 	case CPU_25KF:
++	case CPU_BCM6338:
++	case CPU_BCM6345:
++	case CPU_BCM6348:
++	case CPU_BCM6358:
+ 		tlbw(p);
+ 		break;
+ 
+diff -urN linux-2.6.19/arch/mips/pci/Makefile linux-2.6.19.new/arch/mips/pci/Makefile
+--- linux-2.6.19/arch/mips/pci/Makefile	2006-11-29 22:57:37.000000000 +0100
++++ linux-2.6.19.new/arch/mips/pci/Makefile	2006-12-16 18:48:18.000000000 +0100
+@@ -16,6 +16,7 @@
+ obj-$(CONFIG_PCI_VR41XX)	+= ops-vr41xx.o pci-vr41xx.o
+ obj-$(CONFIG_NEC_CMBVR4133)	+= fixup-vr4133.o
+ obj-$(CONFIG_MARKEINS)		+= ops-emma2rh.o pci-emma2rh.o fixup-emma2rh.o
++obj-$(CONFIG_BCM963XX)		+= fixup-bcm96348.o pci-bcm96348.o ops-bcm96348.o
+ 
+ #
+ # These are still pretty much in the old state, watch, go blind.
+diff -urN linux-2.6.19/include/asm-mips/bootinfo.h linux-2.6.19.new/include/asm-mips/bootinfo.h
+--- linux-2.6.19/include/asm-mips/bootinfo.h	2006-11-29 22:57:37.000000000 +0100
++++ linux-2.6.19.new/include/asm-mips/bootinfo.h	2006-12-16 18:46:31.000000000 +0100
+@@ -213,6 +213,15 @@
+ #define MACH_GROUP_NEC_EMMA2RH 25	/* NEC EMMA2RH (was 23)		*/
+ #define  MACH_NEC_MARKEINS	0	/* NEC EMMA2RH Mark-eins	*/
+ 
++/*
++ * Valid machtype for group BRCM
++ */
++#define MACH_GROUP_BRCM        23      /* Broadcom boards              */
++#define MACH_BCM96338          0
++#define MACH_BCM96345          1
++#define MACH_BCM96348          2
++#define MACH_BCM96358		3
++
+ #define CL_SIZE			COMMAND_LINE_SIZE
+ 
+ const char *get_system_type(void);
+diff -urN linux-2.6.19/include/asm-mips/cpu.h linux-2.6.19.new/include/asm-mips/cpu.h
+--- linux-2.6.19/include/asm-mips/cpu.h	2006-11-29 22:57:37.000000000 +0100
++++ linux-2.6.19.new/include/asm-mips/cpu.h	2006-12-16 18:46:31.000000000 +0100
+@@ -103,6 +103,14 @@
+ 
+ #define PRID_IMP_SR71000        0x0400
+ 
++/* These are the PRID's for when 23:16 == PRID_COMP_BROADCOM
++ */
++
++#define PRID_IMP_BCM6338       	0x9000
++#define PRID_IMP_BCM6345       	0x8000
++#define PRID_IMP_BCM6348       	0x9100
++#define PRID_IMP_BCM6358		0xA000
++
+ /*
+  * Definitions for 7:0 on legacy processors
+  */
+@@ -200,7 +207,11 @@
+ #define CPU_SB1A		62
+ #define CPU_74K			63
+ #define CPU_R14000		64
+-#define CPU_LAST		64
++#define CPU_BCM6338             65
++#define CPU_BCM6345             66
++#define CPU_BCM6348             67
++#define CPU_BCM6358		 68	
++#define CPU_LAST		68
+ 
+ /*
+  * ISA Level encodings
+diff -urN linux-2.6.19/include/asm-mips/module.h linux-2.6.19.new/include/asm-mips/module.h
+--- linux-2.6.19/include/asm-mips/module.h	2006-11-29 22:57:37.000000000 +0100
++++ linux-2.6.19.new/include/asm-mips/module.h	2006-12-16 19:03:22.000000000 +0100
+@@ -112,6 +112,14 @@
+ #define MODULE_PROC_FAMILY "RM9000 "
+ #elif defined CONFIG_CPU_SB1
+ #define MODULE_PROC_FAMILY "SB1 "
++#elif defined CONFIG_CPU_BCM6338
++#define MODULE_PROC_FAMILY "BCM6338 "
++#elif defined CONFIG_CPU_BCM6345
++#define MODULE_PROC_FAMILY "BCM6345 "
++#elif defined CONFIG_CPU_BCM6348
++#define MODULE_PROC_FAMILY "BCM6348 "
++#elif defined CONFIG_CPU_BCM6358
++#define MODULE_PROC_FAMILY "BCM6358 "
+ #else
+ #error MODULE_PROC_FAMILY undefined for your processor configuration
+ #endif
diff --git a/target/linux/brcm63xx/patches/002-bcm963xx_serial.patch b/target/linux/brcm63xx/patches/002-bcm963xx_serial.patch
new file mode 100644
index 0000000..69dadf0
--- /dev/null
+++ b/target/linux/brcm63xx/patches/002-bcm963xx_serial.patch
@@ -0,0 +1,8 @@
+diff -urN linux-2.6.21.1/drivers/serial/Makefile linux-2.6.21.1.new/drivers/serial/Makefile
+--- linux-2.6.21.1/drivers/serial/Makefile	2007-04-27 23:49:26.000000000 +0200
++++ linux-2.6.21.1.new/drivers/serial/Makefile	2007-05-30 20:32:27.000000000 +0200
+@@ -62,3 +62,4 @@
+ obj-$(CONFIG_SERIAL_NETX) += netx-serial.o
+ obj-$(CONFIG_SERIAL_OF_PLATFORM) += of_serial.o
+ obj-$(CONFIG_SERIAL_KS8695) += serial_ks8695.o
++obj-$(CONFIG_BCM963XX) += bcm63xx_cons.o
diff --git a/target/linux/brcm63xx/patches/040-bcm963xx_flashmap.patch b/target/linux/brcm63xx/patches/040-bcm963xx_flashmap.patch
new file mode 100644
index 0000000..08c91be
--- /dev/null
+++ b/target/linux/brcm63xx/patches/040-bcm963xx_flashmap.patch
@@ -0,0 +1,63 @@
+diff -urN linux-2.6.19/drivers/mtd/maps/Kconfig linux-2.6.19.new/drivers/mtd/maps/Kconfig
+--- linux-2.6.19/drivers/mtd/maps/Kconfig	2006-11-29 22:57:37.000000000 +0100
++++ linux-2.6.19.new/drivers/mtd/maps/Kconfig	2006-12-18 17:21:07.000000000 +0100
+@@ -283,6 +283,13 @@
+ 	  Flash memory access on 4G Systems MTX-1 Board. If you have one of
+ 	  these boards and would like to use the flash chips on it, say 'Y'.
+ 
++config MTD_BCM963XX
++        tristate "BCM963xx Flash device"
++        depends on MIPS && BCM963XX
++        help
++	  Flash memory access on BCM963xx boards. Currently only works with
++	  RedBoot and CFE.
++
+ config MTD_DILNETPC
+ 	tristate "CFI Flash device mapped on DIL/Net PC"
+ 	depends on X86 && MTD_CONCAT && MTD_PARTITIONS && MTD_CFI_INTELEXT
+diff -urN linux-2.6.19/drivers/mtd/maps/Makefile linux-2.6.19.new/drivers/mtd/maps/Makefile
+--- linux-2.6.19/drivers/mtd/maps/Makefile	2006-11-29 22:57:37.000000000 +0100
++++ linux-2.6.19.new/drivers/mtd/maps/Makefile	2006-12-18 17:21:07.000000000 +0100
+@@ -72,3 +72,4 @@
+ obj-$(CONFIG_MTD_OMAP_NOR)	+= omap_nor.o
+ obj-$(CONFIG_MTD_MTX1)		+= mtx-1_flash.o
+ obj-$(CONFIG_MTD_TQM834x)	+= tqm834x.o
++obj-$(CONFIG_MTD_BCM963XX)      += bcm963xx-flash.o
+diff -urN linux-2.6.19/drivers/mtd/redboot.c linux-2.6.19.new/drivers/mtd/redboot.c
+--- linux-2.6.19/drivers/mtd/redboot.c	2006-12-18 17:09:14.000000000 +0100
++++ linux-2.6.19.new/drivers/mtd/redboot.c	2006-12-18 17:14:26.000000000 +0100
+@@ -39,7 +39,7 @@
+ 	return 1;
+ }
+ 
+-static int parse_redboot_partitions(struct mtd_info *master,
++int parse_redboot_partitions(struct mtd_info *master,
+                              struct mtd_partition **pparts,
+                              unsigned long fis_origin)
+ {
+@@ -146,6 +146,14 @@
+ 		goto out;
+ 	}
+ 
++	if (!fis_origin) {
++		for (i = 0; i < numslots; i++) {
++			if (!strncmp(buf[i].name, "RedBoot", 8)) {
++				fis_origin = (buf[i].flash_base & (master->size << 1) - 1);
++			}
++		}
++	}
++
+ 	for (i = 0; i < numslots; i++) {
+ 		struct fis_list *new_fl, **prev;
+ 
+@@ -168,9 +176,8 @@
+ 		new_fl->img = &buf[i];
+                 if (fis_origin) {
+                         buf[i].flash_base -= fis_origin;
+-                } else {
+-                        buf[i].flash_base &= master->size-1;
+                 }
++		buf[i].flash_base &= (master->size << 1) - 1;
+ 
+ 		/* I'm sure the JFFS2 code has done me permanent damage.
+ 		 * I now think the following is _normal_
diff --git a/target/linux/brcm63xx/patches/100-atm_hacks.patch b/target/linux/brcm63xx/patches/100-atm_hacks.patch
new file mode 100644
index 0000000..7535c22
--- /dev/null
+++ b/target/linux/brcm63xx/patches/100-atm_hacks.patch
@@ -0,0 +1,186 @@
+diff -urN linux-2.6.19.1/include/linux/atm.h linux-2.6.19.1.new/include/linux/atm.h
+--- linux-2.6.19.1/include/linux/atm.h	2006-12-11 20:32:53.000000000 +0100
++++ linux-2.6.19.1.new/include/linux/atm.h	2007-01-07 18:38:50.000000000 +0100
+@@ -48,6 +48,9 @@
+ #define ATM_AAL2	2		/* AAL2 (VBR) */
+ #define ATM_AAL34	3		/* AAL3/4 (data) */
+ #define ATM_AAL5	5		/* AAL5 (data) */
++#if defined(CONFIG_MIPS_BCM963XX)
++#define ATM_BCM_AAL0    14              /* "raw" ATM cells */
++#endif
+ 
+ /*
+  * socket option name coding functions
+diff -urN linux-2.6.19.1/include/linux/atmbr2684.h linux-2.6.19.1.new/include/linux/atmbr2684.h
+--- linux-2.6.19.1/include/linux/atmbr2684.h	2006-12-11 20:32:53.000000000 +0100
++++ linux-2.6.19.1.new/include/linux/atmbr2684.h	2007-01-07 18:24:01.000000000 +0100
+@@ -78,6 +78,10 @@
+ 	__u8	vpn_id[7];
+ 	int	send_padding;	/* unsupported */
+ 	int	min_size;	/* we will pad smaller packets than this */
++#if defined(CONFIG_MIPS_BCM963XX)
++#define FILTER_PPPOE	1
++	int	proto_filter;	/* protocol filter flag, current only PPPoE */
++#endif
+ };
+ 
+ /*
+diff -urN linux-2.6.19.1/include/linux/atmdev.h linux-2.6.19.1.new/include/linux/atmdev.h
+--- linux-2.6.19.1/include/linux/atmdev.h	2006-12-11 20:32:53.000000000 +0100
++++ linux-2.6.19.1.new/include/linux/atmdev.h	2007-01-07 18:37:34.000000000 +0100
+@@ -29,6 +29,10 @@
+ #define ATM_DS3_PCR	(8000*12)
+ 			/* DS3: 12 cells in a 125 usec time slot */
+ 
++#if defined(CONFIG_MIPS_BCM963XX)
++#define atm_sk(__sk) ((struct atm_vcc *)(__sk)->sk_protinfo)
++#define ATM_SD(s)      (atm_sk((s)->sk))
++#endif
+ 
+ #define __AAL_STAT_ITEMS \
+     __HANDLE_ITEM(tx);			/* TX okay */ \
+@@ -111,6 +115,9 @@
+ #define ATM_BACKEND_RAW		0	
+ #define ATM_BACKEND_PPP		1	/* PPPoATM - RFC2364 */
+ #define ATM_BACKEND_BR2684	2	/* Bridged RFC1483/2684 */
++#if defined(CONFIG_MIPS_BCM963XX)
++#define ATM_BACKEND_RT2684      3       /* Routed RFC1483/2684 */
++#endif
+ 
+ /* for ATM_GETTYPE */
+ #define ATM_ITFTYP_LEN	8	/* maximum length of interface type name */
+@@ -274,6 +281,9 @@
+ 
+ 
+ enum {
++#if defined(CONFIG_MIPS_BCM963XX)
++	ATM_DF_CLOSE,           /* close device when last VCC is closed */
++#endif
+ 	ATM_DF_REMOVED,		/* device was removed from atm_devs list */
+ };
+ 
+@@ -285,8 +295,10 @@
+ #define ATM_ATMOPT_CLP	1	/* set CLP bit */
+ 
+ struct atm_vcc {
++#if !defined(CONFIG_MIPS_BCM963XX)
+ 	/* struct sock has to be the first member of atm_vcc */
+ 	struct sock	sk;
++#endif
+ 	unsigned long	flags;		/* VCC flags (ATM_VF_*) */
+ 	short		vpi;		/* VPI and VCI (types must be equal */
+ 					/* with sockaddr) */
+@@ -303,6 +315,9 @@
+ 	void		*dev_data;	/* per-device data */
+ 	void		*proto_data;	/* per-protocol data */
+ 	struct k_atm_aal_stats *stats;	/* pointer to AAL stats group */
++#if defined(CONFIG_MIPS_BCM963XX)
++	struct sock	*sk;		/* socket backpointer */
++#endif
+ 	/* SVC part --- may move later ------------------------------------- */
+ 	short		itf;		/* interface number */
+ 	struct sockaddr_atmsvc local;
+@@ -332,7 +347,11 @@
+ 
+ struct atm_dev_addr {
+ 	struct sockaddr_atmsvc addr;	/* ATM address */
++#if defined(CONFIG_MIPS_BCM963XX)
++	struct atm_dev_addr *next;      /* next address */
++#else
+ 	struct list_head entry;		/* next address */
++#endif
+ };
+ 
+ enum atm_addr_type_t { ATM_ADDR_LOCAL, ATM_ADDR_LECS };
+@@ -346,8 +365,12 @@
+ 	void		*dev_data;	/* per-device data */
+ 	void		*phy_data;	/* private PHY date */
+ 	unsigned long	flags;		/* device flags (ATM_DF_*) */
++#if defined(CONFIG_MIPS_BCM963XX)
++	struct atm_dev_addr *local;     /* local ATM addresses */
++#else
+ 	struct list_head local;		/* local ATM addresses */
+ 	struct list_head lecs;		/* LECS ATM addresses learned via ILMI */
++#endif
+ 	unsigned char	esi[ESI_LEN];	/* ESI ("MAC" addr) */
+ 	struct atm_cirange ci_range;	/* VPI/VCI range */
+ 	struct k_atm_dev_stats stats;	/* statistics */
+@@ -359,7 +382,9 @@
+ 	struct proc_dir_entry *proc_entry; /* proc entry */
+ 	char *proc_name;		/* proc entry name */
+ #endif
++#if !defined(CONFIG_MIPS_BCM963XX)
+ 	struct class_device class_dev;	/* sysfs class device */
++#endif
+ 	struct list_head dev_list;	/* linkage */
+ };
+ 
+@@ -416,7 +441,13 @@
+     int number,unsigned long *flags); /* number == -1: pick first available */
+ struct atm_dev *atm_dev_lookup(int number);
+ void atm_dev_deregister(struct atm_dev *dev);
++#if defined(CONFIG_MIPS_BCM963XX)
++void shutdown_atm_dev(struct atm_dev *dev);
++#endif
+ void vcc_insert_socket(struct sock *sk);
++#if defined(CONFIG_MIPS_BCM963XX)
++void vcc_remove_socket(struct sock *sk);
++#endif
+ 
+ 
+ /*
+@@ -432,20 +463,33 @@
+ 
+ static inline void atm_force_charge(struct atm_vcc *vcc,int truesize)
+ {
++#if defined(CONFIG_MIPS_BCM963XX)
++	atomic_add(truesize, &vcc->sk->sk_rmem_alloc);
++#else
+ 	atomic_add(truesize, &sk_atm(vcc)->sk_rmem_alloc);
++#endif
+ }
+ 
+ 
+ static inline void atm_return(struct atm_vcc *vcc,int truesize)
+ {
++#if defined(CONFIG_MIPS_BCM963XX)
++	atomic_sub(truesize, &vcc->sk->sk_rmem_alloc);
++#else
+ 	atomic_sub(truesize, &sk_atm(vcc)->sk_rmem_alloc);
++#endif
+ }
+ 
+ 
+ static inline int atm_may_send(struct atm_vcc *vcc,unsigned int size)
+ {
++#if defined(CONFIG_MIPS_BCM963XX)
++	return (size + atomic_read(&vcc->sk->sk_wmem_alloc)) <
++		vcc->sk->sk_sndbuf;
++#else
+ 	return (size + atomic_read(&sk_atm(vcc)->sk_wmem_alloc)) <
+ 	       sk_atm(vcc)->sk_sndbuf;
++#endif
+ }
+ 
+ 
+@@ -457,12 +501,20 @@
+ 
+ static inline void atm_dev_put(struct atm_dev *dev)
+ {
++#if defined(CONFIG_MIPS_BCM963XX)
++	atomic_dec(&dev->refcnt);
++	
++	if ((atomic_read(&dev->refcnt) == 1) &&
++	     test_bit(ATM_DF_CLOSE,&dev->flags))
++		shutdown_atm_dev(dev);
++#else
+ 	if (atomic_dec_and_test(&dev->refcnt)) {
+ 		BUG_ON(!test_bit(ATM_DF_REMOVED, &dev->flags));
+ 		if (dev->ops->dev_close)
+ 			dev->ops->dev_close(dev);
+ 		class_device_put(&dev->class_dev);
+ 	}
++#endif
+ }
+ 
+ 
diff --git a/target/linux/brcm63xx/patches/150-sst_flash.patch b/target/linux/brcm63xx/patches/150-sst_flash.patch
new file mode 100644
index 0000000..ba9fcb9
--- /dev/null
+++ b/target/linux/brcm63xx/patches/150-sst_flash.patch
@@ -0,0 +1,36 @@
+diff -urN linux-2.6.19.2/drivers/mtd/chips/jedec_probe.c linux-2.6.19.2.new/drivers/mtd/chips/jedec_probe.c
+--- linux-2.6.19.2/drivers/mtd/chips/jedec_probe.c	2007-01-10 20:10:37.000000000 +0100
++++ linux-2.6.19.2.new/drivers/mtd/chips/jedec_probe.c	2007-04-09 22:33:05.000000000 +0200
+@@ -158,6 +158,7 @@
+ #define SST49LF030A	0x001C
+ #define SST49LF040A	0x0051
+ #define SST49LF080A	0x005B
++#define SST39VF6402B   	0x236C
+ 
+ /* Toshiba */
+ #define TC58FVT160	0x00C2
+@@ -1494,7 +1495,23 @@
+                        ERASEINFO(0x1000,256),
+                        ERASEINFO(0x1000,256)
+                }
+-
++	}, {
++		.mfr_id         = MANUFACTURER_SST,
++		.dev_id         = SST39VF6402B,
++		.name           = "SST 39VF6402B",
++		.uaddr          = {
++			[0] = MTD_UADDR_0x5555_0x2AAA,  /* x8 */
++			[1] = MTD_UADDR_0x5555_0x2AAA   /* x16 */
++		},
++		.DevSize        = SIZE_8MiB,
++		.CmdSet         = P_ID_AMD_STD,
++		.NumEraseRegions= 4,
++		.regions        = {
++			ERASEINFO(0x2000,256),
++			ERASEINFO(0x2000,256),
++			ERASEINFO(0x2000,256),
++			ERASEINFO(0x2000,256)
++		}
+        }, {
+ 		.mfr_id		= MANUFACTURER_ST,	/* FIXME - CFI device? */
+ 		.dev_id		= M29W800DT,
diff --git a/target/linux/brcm63xx/profiles/Atheros.mk b/target/linux/brcm63xx/profiles/Atheros.mk
new file mode 100644
index 0000000..0295868
--- /dev/null
+++ b/target/linux/brcm63xx/profiles/Atheros.mk
@@ -0,0 +1,17 @@
+#
+# Copyright (C) 2006 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Atheros
+  NAME:=Atheros WiFi (default)
+  PACKAGES:=kmod-madwifi
+endef
+
+define Profile/Atheros/Description
+	Package set compatible with hardware using Atheros WiFi cards
+endef
+$(eval $(call Profile,Atheros))
+
diff --git a/target/linux/brcm63xx/profiles/Broadcom.mk b/target/linux/brcm63xx/profiles/Broadcom.mk
new file mode 100644
index 0000000..5fe71bb
--- /dev/null
+++ b/target/linux/brcm63xx/profiles/Broadcom.mk
@@ -0,0 +1,17 @@
+#
+# Copyright (C) 2006 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom
+  NAME:=Broadcom WiFi (default)
+  PACKAGES:=kmod-net-bcm43xx
+endef
+
+define Profile/Broadcom/Description
+	Package set compatible with hardware using Broadcom WiFi cards
+endef
+$(eval $(call Profile,Broadcom))
+
diff --git a/target/linux/brcm63xx/profiles/Ralink.mk b/target/linux/brcm63xx/profiles/Ralink.mk
new file mode 100644
index 0000000..f4c435d
--- /dev/null
+++ b/target/linux/brcm63xx/profiles/Ralink.mk
@@ -0,0 +1,13 @@
+#
+# Copyright (C) 2006 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Ralink
+  NAME:=Ralink WiFi
+  PACKAGES:=kmod-rt61
+endef
+$(eval $(call Profile,Ralink))
+