+@@ -1155,10 +1194,10 @@ void ssb_device_enable(struct ssb_device
+ }
+ EXPORT_SYMBOL(ssb_device_enable);
+
+-/* Wait for a bit in a register to get set or unset.
++/* Wait for bitmask in a register to get set or cleared.
+ * timeout is in units of ten-microseconds */
+-static int ssb_wait_bit(struct ssb_device *dev, u16 reg, u32 bitmask,
+- int timeout, int set)
++static int ssb_wait_bits(struct ssb_device *dev, u16 reg, u32 bitmask,
++ int timeout, int set)
+ {
+ int i;
+ u32 val;
+@@ -1166,7 +1205,7 @@ static int ssb_wait_bit(struct ssb_devic
+ for (i = 0; i < timeout; i++) {
+ val = ssb_read32(dev, reg);
+ if (set) {
+- if (val & bitmask)
++ if ((val & bitmask) == bitmask)
+ return 0;
+ } else {
+ if (!(val & bitmask))
+@@ -1183,20 +1222,38 @@ static int ssb_wait_bit(struct ssb_devic
+
+ void ssb_device_disable(struct ssb_device *dev, u32 core_specific_flags)
+ {
+- u32 reject;
++ u32 reject, val;
+
+ if (ssb_read32(dev, SSB_TMSLOW) & SSB_TMSLOW_RESET)
+ return;
+
+ reject = ssb_tmslow_reject_bitmask(dev);
+- ssb_write32(dev, SSB_TMSLOW, reject | SSB_TMSLOW_CLOCK);
+- ssb_wait_bit(dev, SSB_TMSLOW, reject, 1000, 1);
+- ssb_wait_bit(dev, SSB_TMSHIGH, SSB_TMSHIGH_BUSY, 1000, 0);
+- ssb_write32(dev, SSB_TMSLOW,
+- SSB_TMSLOW_FGC | SSB_TMSLOW_CLOCK |
+- reject | SSB_TMSLOW_RESET |
+- core_specific_flags);
+- ssb_flush_tmslow(dev);
++
++ if (ssb_read32(dev, SSB_TMSLOW) & SSB_TMSLOW_CLOCK) {
++ ssb_write32(dev, SSB_TMSLOW, reject | SSB_TMSLOW_CLOCK);
++ ssb_wait_bits(dev, SSB_TMSLOW, reject, 1000, 1);
++ ssb_wait_bits(dev, SSB_TMSHIGH, SSB_TMSHIGH_BUSY, 1000, 0);
++
++ if (ssb_read32(dev, SSB_IDLOW) & SSB_IDLOW_INITIATOR) {
++ val = ssb_read32(dev, SSB_IMSTATE);
++ val |= SSB_IMSTATE_REJECT;
++ ssb_write32(dev, SSB_IMSTATE, val);
++ ssb_wait_bits(dev, SSB_IMSTATE, SSB_IMSTATE_BUSY, 1000,
++ 0);
++ }
++
++ ssb_write32(dev, SSB_TMSLOW,
++ SSB_TMSLOW_FGC | SSB_TMSLOW_CLOCK |
++ reject | SSB_TMSLOW_RESET |
++ core_specific_flags);
++ ssb_flush_tmslow(dev);
++
++ if (ssb_read32(dev, SSB_IDLOW) & SSB_IDLOW_INITIATOR) {
++ val = ssb_read32(dev, SSB_IMSTATE);
++ val &= ~SSB_IMSTATE_REJECT;
++ ssb_write32(dev, SSB_IMSTATE, val);
++ }
++ }
+
+ ssb_write32(dev, SSB_TMSLOW,
+ reject | SSB_TMSLOW_RESET |
+--- a/drivers/ssb/pci.c
++++ b/drivers/ssb/pci.c
+@@ -17,6 +17,7 @@
+
+ #include <linux/ssb/ssb.h>
+ #include <linux/ssb/ssb_regs.h>
++#include <linux/slab.h>
+ #include <linux/pci.h>
+ #include <linux/delay.h>
+
+@@ -167,7 +168,7 @@ err_pci:
+ }
+
+ /* Get the word-offset for a SSB_SPROM_XXX define. */
+-#define SPOFF(offset) (((offset) - SSB_SPROM_BASE1) / sizeof(u16))
++#define SPOFF(offset) ((offset) / sizeof(u16))
+ /* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */
+ #define SPEX16(_outvar, _offset, _mask, _shift) \
+ out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift))
+@@ -405,6 +406,46 @@ static void sprom_extract_r123(struct ss
+ out->antenna_gain.ghz5.a3 = gain;
+ }
+
++/* Revs 4 5 and 8 have partially shared layout */
++static void sprom_extract_r458(struct ssb_sprom *out, const u16 *in)
++{
++ SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01,
++ SSB_SPROM4_TXPID2G0, SSB_SPROM4_TXPID2G0_SHIFT);
++ SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01,
++ SSB_SPROM4_TXPID2G1, SSB_SPROM4_TXPID2G1_SHIFT);
++ SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23,
++ SSB_SPROM4_TXPID2G2, SSB_SPROM4_TXPID2G2_SHIFT);
++ SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23,
++ SSB_SPROM4_TXPID2G3, SSB_SPROM4_TXPID2G3_SHIFT);
++
++ SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01,
++ SSB_SPROM4_TXPID5GL0, SSB_SPROM4_TXPID5GL0_SHIFT);
++ SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01,
++ SSB_SPROM4_TXPID5GL1, SSB_SPROM4_TXPID5GL1_SHIFT);
++ SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23,
++ SSB_SPROM4_TXPID5GL2, SSB_SPROM4_TXPID5GL2_SHIFT);
++ SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23,
++ SSB_SPROM4_TXPID5GL3, SSB_SPROM4_TXPID5GL3_SHIFT);
++
++ SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01,
++ SSB_SPROM4_TXPID5G0, SSB_SPROM4_TXPID5G0_SHIFT);
++ SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01,
++ SSB_SPROM4_TXPID5G1, SSB_SPROM4_TXPID5G1_SHIFT);
++ SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23,
++ SSB_SPROM4_TXPID5G2, SSB_SPROM4_TXPID5G2_SHIFT);
++ SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23,
++ SSB_SPROM4_TXPID5G3, SSB_SPROM4_TXPID5G3_SHIFT);
++
++ SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01,
++ SSB_SPROM4_TXPID5GH0, SSB_SPROM4_TXPID5GH0_SHIFT);
++ SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01,
++ SSB_SPROM4_TXPID5GH1, SSB_SPROM4_TXPID5GH1_SHIFT);
++ SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23,
++ SSB_SPROM4_TXPID5GH2, SSB_SPROM4_TXPID5GH2_SHIFT);
++ SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23,
++ SSB_SPROM4_TXPID5GH3, SSB_SPROM4_TXPID5GH3_SHIFT);
++}
++
+ static void sprom_extract_r45(struct ssb_sprom *out, const u16 *in)
+ {
+ int i;
+@@ -427,10 +468,14 @@ static void sprom_extract_r45(struct ssb
+ SPEX(country_code, SSB_SPROM4_CCODE, 0xFFFF, 0);
+ SPEX(boardflags_lo, SSB_SPROM4_BFLLO, 0xFFFF, 0);
+ SPEX(boardflags_hi, SSB_SPROM4_BFLHI, 0xFFFF, 0);
++ SPEX(boardflags2_lo, SSB_SPROM4_BFL2LO, 0xFFFF, 0);
++ SPEX(boardflags2_hi, SSB_SPROM4_BFL2HI, 0xFFFF, 0);
+ } else {
+ SPEX(country_code, SSB_SPROM5_CCODE, 0xFFFF, 0);
+ SPEX(boardflags_lo, SSB_SPROM5_BFLLO, 0xFFFF, 0);
+ SPEX(boardflags_hi, SSB_SPROM5_BFLHI, 0xFFFF, 0);
++ SPEX(boardflags2_lo, SSB_SPROM5_BFL2LO, 0xFFFF, 0);
++ SPEX(boardflags2_hi, SSB_SPROM5_BFL2HI, 0xFFFF, 0);
+ }
+ SPEX(ant_available_a, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_A,
+ SSB_SPROM4_ANTAVAIL_A_SHIFT);
+@@ -470,6 +515,8 @@ static void sprom_extract_r45(struct ssb
+ memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+ sizeof(out->antenna_gain.ghz5));
+
++ sprom_extract_r458(out, in);
++
+ /* TODO - get remaining rev 4 stuff needed */
+ }
+
+@@ -560,6 +607,8 @@ static void sprom_extract_r8(struct ssb_
+ memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+ sizeof(out->antenna_gain.ghz5));
+
++ sprom_extract_r458(out, in);
++
+ /* TODO - get remaining rev 8 stuff needed */
+ }
+
+@@ -572,37 +621,34 @@ static int sprom_extract(struct ssb_bus
+ ssb_dprintk(KERN_DEBUG PFX "SPROM revision %d detected.\n", out->revision);
+ memset(out->et0mac, 0xFF, 6); /* preset et0 and et1 mac */
+ memset(out->et1mac, 0xFF, 6);
++
+ if ((bus->chip_id & 0xFF00) == 0x4400) {
+ /* Workaround: The BCM44XX chip has a stupid revision
+ * number stored in the SPROM.
+ * Always extract r1. */
+ out->revision = 1;
++ ssb_dprintk(KERN_DEBUG PFX "SPROM treated as revision %d\n", out->revision);
++ }
++
++ switch (out->revision) {
++ case 1:
++ case 2:
++ case 3:
+ sprom_extract_r123(out, in);
+- } else if (bus->chip_id == 0x4321) {
+- /* the BCM4328 has a chipid == 0x4321 and a rev 4 SPROM */
+- out->revision = 4;
++ break;
++ case 4:
++ case 5:
+ sprom_extract_r45(out, in);
+- } else {
+- switch (out->revision) {
+- case 1:
+- case 2:
+- case 3:
+- sprom_extract_r123(out, in);
+- break;
+- case 4:
+- case 5:
+- sprom_extract_r45(out, in);
+- break;
+- case 8:
+- sprom_extract_r8(out, in);
+- break;
+- default:
+- ssb_printk(KERN_WARNING PFX "Unsupported SPROM"
+- " revision %d detected. Will extract"
+- " v1\n", out->revision);
+- out->revision = 1;
+- sprom_extract_r123(out, in);
+- }
++ break;
++ case 8:
++ sprom_extract_r8(out, in);
++ break;
++ default:
++ ssb_printk(KERN_WARNING PFX "Unsupported SPROM"
++ " revision %d detected. Will extract"
++ " v1\n", out->revision);
++ out->revision = 1;
++ sprom_extract_r123(out, in);
+ }
+
+ if (out->boardflags_lo == 0xFFFF)
+@@ -617,7 +663,7 @@ static int ssb_pci_sprom_get(struct ssb_
+ struct ssb_sprom *sprom)
+ {
+ const struct ssb_sprom *fallback;
+- int err = -ENOMEM;
++ int err;
+ u16 *buf;
+
+ if (!ssb_is_sprom_available(bus)) {
+@@ -644,7 +690,7 @@ static int ssb_pci_sprom_get(struct ssb_
+
+ buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
+ if (!buf)
+- goto out;
++ return -ENOMEM;
+ bus->sprom_size = SSB_SPROMSIZE_WORDS_R123;
+ sprom_do_read(bus, buf);
+ err = sprom_check_crc(buf, bus->sprom_size);
+@@ -654,7 +700,7 @@ static int ssb_pci_sprom_get(struct ssb_
+ buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
+ GFP_KERNEL);
+ if (!buf)
+- goto out;
++ return -ENOMEM;
+ bus->sprom_size = SSB_SPROMSIZE_WORDS_R4;
+ sprom_do_read(bus, buf);
+ err = sprom_check_crc(buf, bus->sprom_size);
+@@ -676,7 +722,6 @@ static int ssb_pci_sprom_get(struct ssb_
+
+ out_free:
+ kfree(buf);
+-out:
+ return err;
+ }
+