+-static int b44_writephy(struct b44 *bp, int reg, u32 val)
++static int b44_readphy(struct b44 *bp, int reg, u32 *val)
++{
++ if (bp->phy_addr == B44_PHY_ADDR_NO_PHY)
++ return 0;
++
++ return __b44_readphy(bp, bp->phy_addr, reg, val);
++}
++
++static int __b44_writephy(struct b44 *bp, int phy_addr, int reg, u32 val)
+ {
+ bw32(B44_EMAC_ISTAT, EMAC_INT_MII);
+ bw32(B44_MDIO_DATA, (MDIO_DATA_SB_START |
+ (MDIO_OP_WRITE << MDIO_DATA_OP_SHIFT) |
+- (bp->phy_addr << MDIO_DATA_PMD_SHIFT) |
++ (phy_addr << MDIO_DATA_PMD_SHIFT) |
+ (reg << MDIO_DATA_RA_SHIFT) |
+ (MDIO_TA_VALID << MDIO_DATA_TA_SHIFT) |
+ (val & MDIO_DATA_DATA)));
+ return b44_wait_bit(bp, B44_EMAC_ISTAT, EMAC_INT_MII, 100, 0);
+ }
+
++static int b44_writephy(struct b44 *bp, int reg, u32 val)
++{
++ if (bp->phy_addr == B44_PHY_ADDR_NO_PHY)
++ return 0;
++
++ return __b44_writephy(bp, bp->phy_addr, reg, val);
++}
++
+ static int b44_phy_reset(struct b44 *bp)
+ {
+ u32 val;
+ int err;
+
++ if (bp->phy_addr == B44_PHY_ADDR_NO_PHY)
++ return 0;
++
+ err = b44_writephy(bp, MII_BMCR, BMCR_RESET);
+ if (err)
+ return err;
+@@ -406,6 +493,23 @@
+ u32 val;
+ int err;
+
++
++ /*
++ * workaround for bad hardware design in Linksys WAP54G v1.0
++ * see https://dev.openwrt.org/ticket/146
++ * check and reset bit "isolate"
++ */
++ if ((bp->pdev->device == PCI_DEVICE_ID_BCM4713) &&
++ (atoi(nvram_get("boardnum")) == 2) &&
++ (__b44_readphy(bp, 0, MII_BMCR, &val) == 0) &&
++ (val & BMCR_ISOLATE) &&
++ (__b44_writephy(bp, 0, MII_BMCR, val & ~BMCR_ISOLATE) != 0)) {
++ printk(KERN_WARNING PFX "PHY: cannot reset MII transceiver isolate bit.\n");
++ }
++
++ if (bp->phy_addr == B44_PHY_ADDR_NO_PHY)
++ return 0;
++
+ if ((err = b44_readphy(bp, B44_MII_ALEDCTRL, &val)) != 0)
+ goto out;
+ if ((err = b44_writephy(bp, B44_MII_ALEDCTRL,
+@@ -498,6 +602,19 @@
+ {
+ u32 bmsr, aux;
+
++ if (bp->phy_addr == B44_PHY_ADDR_NO_PHY) {
++ bp->flags |= B44_FLAG_100_BASE_T;
++ bp->flags |= B44_FLAG_FULL_DUPLEX;
++ if (!netif_carrier_ok(bp->dev)) {
++ u32 val = br32(B44_TX_CTRL);
++ val |= TX_CTRL_DUPLEX;
++ bw32(B44_TX_CTRL, val);
++ netif_carrier_on(bp->dev);
++ b44_link_report(bp);
++ }
++ return;
++ }
++
+ if (!b44_readphy(bp, MII_BMSR, &bmsr) &&
+ !b44_readphy(bp, B44_MII_AUXCTRL, &aux) &&
+ (bmsr != 0xffff)) {
+@@ -765,6 +882,25 @@
+ return received;
+ }
+
++
++static inline void __b44_reset(struct b44 *bp)
++{
++ spin_lock_irq(&bp->lock);
++ b44_halt(bp);
++ b44_init_rings(bp);
++ b44_init_hw(bp);
++ spin_unlock_irq(&bp->lock);
++
++ b44_enable_ints(bp);
++ netif_wake_queue(bp->dev);
++}
++
++static inline void __b44_set_timeout(struct b44 *bp, int timeout)
++{
++ /* Set timeout for Rx to two seconds after the last Tx */
++ bw32(B44_GPTIMER, timeout ? 2 * 125000000 : 0);
++}
++
+ static int b44_poll(struct net_device *netdev, int *budget)
+ {
+ struct b44 *bp = netdev->priv;
+@@ -772,13 +908,13 @@
+
+ spin_lock_irq(&bp->lock);
+
+- if (bp->istat & (ISTAT_TX | ISTAT_TO)) {
++ if (bp->istat & ISTAT_TX) {
+ /* spin_lock(&bp->tx_lock); */
+ b44_tx(bp);
+ /* spin_unlock(&bp->tx_lock); */
+ }
+ spin_unlock_irq(&bp->lock);
+-
++
+ done = 1;
+ if (bp->istat & ISTAT_RX) {
+ int orig_budget = *budget;
+@@ -796,24 +932,18 @@
+ done = 0;
+ }
+
+- if (bp->istat & ISTAT_ERRORS) {
+- spin_lock_irq(&bp->lock);
+- b44_halt(bp);
+- b44_init_rings(bp);
+- b44_init_hw(bp);
+- netif_wake_queue(bp->dev);
+- spin_unlock_irq(&bp->lock);
+- done = 1;
+- }
+-
+ if (done) {
+ netif_rx_complete(netdev);
+ b44_enable_ints(bp);
+ }
+
++ if ((bp->core_unit == 1) && (bp->istat & (ISTAT_TX | ISTAT_RX)))
++ __b44_set_timeout(bp, (bp->istat & ISTAT_TX) ? 1 : 0);
++
+ return (done ? 0 : 1);
+ }
+
++
+ static irqreturn_t b44_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+ {
+ struct net_device *dev = dev_id;
+@@ -832,6 +962,18 @@
+ */
+ istat &= imask;
+ if (istat) {
++ /* Workaround for the WL-500g WAN port hang */
++ if (istat & (ISTAT_TO | ISTAT_ERRORS)) {
++ /*
++ * no rx before the watchdog timeout
++ * reset the interface
++ */
++ __b44_reset(bp);
++ }
++
++ if ((bp->core_unit == 1) && (bp->istat & (ISTAT_TX | ISTAT_RX)))
++ __b44_set_timeout(bp, (bp->istat & ISTAT_TX) ? 1 : 0);
++
+ handled = 1;
+ if (netif_rx_schedule_prep(dev)) {
+ /* NOTE: These writes are posted by the readback of
+@@ -848,6 +990,7 @@
+ bw32(B44_ISTAT, istat);
+ br32(B44_ISTAT);
+ }
++
+ spin_unlock_irqrestore(&bp->lock, flags);
+ return IRQ_RETVAL(handled);
+ }
+@@ -859,16 +1002,7 @@
+ printk(KERN_ERR PFX "%s: transmit timed out, resetting\n",
+ dev->name);
+
+- spin_lock_irq(&bp->lock);
+-
+- b44_halt(bp);
+- b44_init_rings(bp);
+- b44_init_hw(bp);
+-
+- spin_unlock_irq(&bp->lock);
+-
+- b44_enable_ints(bp);
+-
++ __b44_reset(bp);
+ netif_wake_queue(dev);
+ }
+
+@@ -1092,6 +1226,8 @@
+ /* bp->lock is held. */
+ static void b44_chip_reset(struct b44 *bp)
+ {
++ unsigned int sb_clock;
++
+ if (ssb_is_core_up(bp)) {
+ bw32(B44_RCV_LAZY, 0);
+ bw32(B44_ENET_CTRL, ENET_CTRL_DISABLE);
+@@ -1105,9 +1241,10 @@
+ bw32(B44_DMARX_CTRL, 0);
+ bp->rx_prod = bp->rx_cons = 0;
+ } else {
+- ssb_pci_setup(bp, (bp->core_unit == 0 ?
+- SBINTVEC_ENET0 :
+- SBINTVEC_ENET1));
++ /*if (bp->pdev->device != PCI_DEVICE_ID_BCM4713)*/
++ ssb_pci_setup(bp, (bp->core_unit == 0 ?
++ SBINTVEC_ENET0 :
++ SBINTVEC_ENET1));
+ }
+
+ ssb_core_reset(bp);
+@@ -1115,6 +1252,11 @@
+ b44_clear_stats(bp);
+
+ /* Make PHY accessible. */
++ if (bp->pdev->device == PCI_DEVICE_ID_BCM4713)
++ sb_clock = 100000000; /* 100 MHz */
++ else
++ sb_clock = 62500000; /* 62.5 MHz */
++
+ bw32(B44_MDIO_CTRL, (MDIO_CTRL_PREAMBLE |
+ (0x0d & MDIO_CTRL_MAXF_MASK)));
+ br32(B44_MDIO_CTRL);
+@@ -1215,6 +1357,8 @@
+ struct b44 *bp = dev->priv;
+ int err;
+
++ netif_carrier_off(dev);
++
+ err = b44_alloc_consistent(bp);
+ if (err)
+ return err;
+@@ -1235,9 +1379,10 @@
+ bp->timer.expires = jiffies + HZ;
+ bp->timer.data = (unsigned long) bp;
+ bp->timer.function = b44_timer;
+- add_timer(&bp->timer);
++ b44_timer((unsigned long) bp);
+
+ b44_enable_ints(bp);
++ netif_start_queue(dev);
+
+ return 0;
+
+@@ -1628,7 +1773,7 @@
+ u32 mii_regval;
+
+ spin_lock_irq(&bp->lock);
+- err = b44_readphy(bp, data->reg_num & 0x1f, &mii_regval);
++ err = __b44_readphy(bp, data->phy_id & 0x1f, data->reg_num & 0x1f, &mii_regval);
+ spin_unlock_irq(&bp->lock);
+
+ data->val_out = mii_regval;
+@@ -1641,7 +1786,7 @@
+ return -EPERM;
+
+ spin_lock_irq(&bp->lock);
+- err = b44_writephy(bp, data->reg_num & 0x1f, data->val_in);
++ err = __b44_writephy(bp, data->phy_id & 0x1f, data->reg_num & 0x1f, data->val_in);
+ spin_unlock_irq(&bp->lock);
+
+ return err;
+@@ -1668,21 +1813,52 @@