--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -1,7 +1,9 @@
 /* b44.c: Broadcom 4400 device driver.
  *
  * Copyright (C) 2002 David S. Miller (davem@redhat.com)
- * Fixed by Pekka Pietikainen (pp@ee.oulu.fi)
+ * Copyright (C) 2004 Pekka Pietikainen (pp@ee.oulu.fi)
+ * Copyright (C) 2004 Florian Schirmer (jolt@tuxbox.org)
+ * Copyright (C) 2006 Felix Fietkau (nbd@openwrt.org)
  *
  * Distribute under GPL.
  */
@@ -25,6 +27,39 @@
 
 #include "b44.h"
 
+#include <typedefs.h>
+#include <bcmdevs.h>
+#include <osl.h>
+#include <bcmnvram.h>
+#include <sbconfig.h>
+#include <sbchipc.h>
+#include <sflash.h>
+
+#ifdef CONFIG_BCM947XX
+#define atoi(str) simple_strtoul(((str != NULL) ? str : ""), NULL, 0)
+ 
+static inline void e_aton(char *str, char *dest)
+{
+	int i = 0;
+	u16 *d = (u16 *) dest;
+
+	if (str == NULL) {
+		memset(dest, 0, 6);
+		return;
+	}
+	
+	for (;;) {
+		dest[i++] = (char) simple_strtoul(str, NULL, 16);
+		str += 2;
+		if (!*str++ || i == 6)
+			break;
+	}
+}
+
+static int instance = 0;
+#endif
+
+
 #define DRV_MODULE_NAME		"b44"
 #define PFX DRV_MODULE_NAME	": "
 #define DRV_MODULE_VERSION	"0.93"
@@ -75,7 +110,7 @@ static char version[] __devinitdata =
 	DRV_MODULE_NAME ".c:v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
 
 MODULE_AUTHOR("David S. Miller (davem@redhat.com)");
-MODULE_DESCRIPTION("Broadcom 4400 10/100 PCI ethernet driver");
+MODULE_DESCRIPTION("Broadcom 4400/47xx 10/100 PCI ethernet driver");
 MODULE_LICENSE("GPL");
 MODULE_PARM(b44_debug, "i");
 MODULE_PARM_DESC(b44_debug, "B44 bitmapped debugging message enable value");
@@ -89,6 +124,8 @@ static struct pci_device_id b44_pci_tbl[
 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0UL },
 	{ PCI_VENDOR_ID_BROADCOM, PCI_DEVICE_ID_BCM4401B1,
 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0UL },
+	{ PCI_VENDOR_ID_BROADCOM, PCI_DEVICE_ID_BCM4713,
+	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0UL },
 	{ }	/* terminate list with empty entry */
 };
 
@@ -113,11 +150,13 @@ static int b44_wait_bit(struct b44 *bp, 
 		udelay(10);
 	}
 	if (i == timeout) {
+#ifdef DEBUG
 		printk(KERN_ERR PFX "%s: BUG!  Timeout waiting for bit %08x of register "
 		       "%lx to %s.\n",
 		       bp->dev->name,
 		       bit, reg,
 		       (clear ? "clear" : "set"));
+#endif
 		return -ENODEV;
 	}
 	return 0;
@@ -236,6 +275,8 @@ static void ssb_core_reset(struct b44 *b
 	udelay(1);
 }
 
+static int b44_4713_instance;
+
 static int ssb_core_unit(struct b44 *bp)
 {
 #if 0
@@ -258,6 +299,9 @@ static int ssb_core_unit(struct b44 *bp)
 		break;
 	};
 #endif
+	if (bp->pdev->device == PCI_DEVICE_ID_BCM4713)
+		return b44_4713_instance++;
+	else
 	return 0;
 }
 
@@ -267,6 +311,28 @@ static int ssb_is_core_up(struct b44 *bp
 		== SBTMSLOW_CLOCK);
 }
 
+static inline void __b44_cam_read(struct b44 *bp, unsigned char *data, int index)
+{
+	u32 val;
+
+	bw32(B44_CAM_CTRL, (CAM_CTRL_READ |
+			    (index << CAM_CTRL_INDEX_SHIFT)));
+
+	b44_wait_bit(bp, B44_CAM_CTRL, CAM_CTRL_BUSY, 100, 1);
+
+	val = br32(B44_CAM_DATA_LO);
+
+	data[2] = (val >> 24) & 0xFF;
+	data[3] = (val >> 16) & 0xFF;
+	data[4] = (val >> 8) & 0xFF;
+	data[5] = (val >> 0) & 0xFF;
+
+	val = br32(B44_CAM_DATA_HI);
+
+	data[0] = (val >> 8) & 0xFF;
+	data[1] = (val >> 0) & 0xFF;
+}
+
 static void __b44_cam_write(struct b44 *bp, unsigned char *data, int index)
 {
 	u32 val;
@@ -287,7 +353,7 @@ static void __b44_cam_write(struct b44 *
 
 static inline void __b44_disable_ints(struct b44 *bp)
 {
-	bw32(B44_IMASK, 0);
+	bw32(B44_IMASK, ISTAT_TO); /* leave the timeout interrupt active */
 }
 
 static void b44_disable_ints(struct b44 *bp)
@@ -303,14 +369,14 @@ static void b44_enable_ints(struct b44 *
 	bw32(B44_IMASK, bp->imask);
 }
 
-static int b44_readphy(struct b44 *bp, int reg, u32 *val)
+static int __b44_readphy(struct b44 *bp, int phy_addr, int reg, u32 *val)
 {
 	int err;
 
 	bw32(B44_EMAC_ISTAT, EMAC_INT_MII);
 	bw32(B44_MDIO_DATA, (MDIO_DATA_SB_START |
 			     (MDIO_OP_READ << MDIO_DATA_OP_SHIFT) |
-			     (bp->phy_addr << MDIO_DATA_PMD_SHIFT) |
+			     (phy_addr << MDIO_DATA_PMD_SHIFT) |
 			     (reg << MDIO_DATA_RA_SHIFT) |
 			     (MDIO_TA_VALID << MDIO_DATA_TA_SHIFT)));
 	err = b44_wait_bit(bp, B44_EMAC_ISTAT, EMAC_INT_MII, 100, 0);
@@ -319,23 +385,42 @@ static int b44_readphy(struct b44 *bp, i
 	return err;
 }
 
-static int b44_writephy(struct b44 *bp, int reg, u32 val)
+static int b44_readphy(struct b44 *bp, int reg, u32 *val)
+{
+	if (bp->phy_addr == B44_PHY_ADDR_NO_PHY)
+		return 0;
+
+	return __b44_readphy(bp, bp->phy_addr, reg, val);
+}
+
+static int __b44_writephy(struct b44 *bp, int phy_addr, int reg, u32 val)
 {
 	bw32(B44_EMAC_ISTAT, EMAC_INT_MII);
 	bw32(B44_MDIO_DATA, (MDIO_DATA_SB_START |
 			     (MDIO_OP_WRITE << MDIO_DATA_OP_SHIFT) |
-			     (bp->phy_addr << MDIO_DATA_PMD_SHIFT) |
+			     (phy_addr << MDIO_DATA_PMD_SHIFT) |
 			     (reg << MDIO_DATA_RA_SHIFT) |
 			     (MDIO_TA_VALID << MDIO_DATA_TA_SHIFT) |
 			     (val & MDIO_DATA_DATA)));
 	return b44_wait_bit(bp, B44_EMAC_ISTAT, EMAC_INT_MII, 100, 0);
 }
 
+static int b44_writephy(struct b44 *bp, int reg, u32 val)
+{
+	if (bp->phy_addr == B44_PHY_ADDR_NO_PHY)
+		return 0;
+		
+	return __b44_writephy(bp, bp->phy_addr, reg, val);
+}
+
 static int b44_phy_reset(struct b44 *bp)
 {
 	u32 val;
 	int err;
 
+	if (bp->phy_addr == B44_PHY_ADDR_NO_PHY)
+		return 0;
+
 	err = b44_writephy(bp, MII_BMCR, BMCR_RESET);
 	if (err)
 		return err;
@@ -406,6 +491,23 @@ static int b44_setup_phy(struct b44 *bp)
 	u32 val;
 	int err;
 
+
+	/*
+	 * workaround for bad hardware design in Linksys WAP54G v1.0
+	 * see https://dev.openwrt.org/ticket/146
+	 * check and reset bit "isolate"
+	 */
+	if ((bp->pdev->device == PCI_DEVICE_ID_BCM4713) &&
+			(atoi(nvram_get("boardnum")) == 2) &&
+			(__b44_readphy(bp, 0, MII_BMCR, &val) == 0) && 
+			(val & BMCR_ISOLATE) &&
+			(__b44_writephy(bp, 0, MII_BMCR, val & ~BMCR_ISOLATE) != 0)) {
+		printk(KERN_WARNING PFX "PHY: cannot reset MII transceiver isolate bit.\n");
+	}
+	
+	if (bp->phy_addr == B44_PHY_ADDR_NO_PHY)
+		return 0;
+
 	if ((err = b44_readphy(bp, B44_MII_ALEDCTRL, &val)) != 0)
 		goto out;
 	if ((err = b44_writephy(bp, B44_MII_ALEDCTRL,
@@ -498,6 +600,19 @@ static void b44_check_phy(struct b44 *bp
 {
 	u32 bmsr, aux;
 
+	if (bp->phy_addr == B44_PHY_ADDR_NO_PHY) {
+		bp->flags |= B44_FLAG_100_BASE_T;
+		bp->flags |= B44_FLAG_FULL_DUPLEX;
+		if (!netif_carrier_ok(bp->dev)) {
+			u32 val = br32(B44_TX_CTRL);
+			val |= TX_CTRL_DUPLEX;
+			bw32(B44_TX_CTRL, val);
+			netif_carrier_on(bp->dev);
+			b44_link_report(bp);
+		}
+		return;
+	}
+
 	if (!b44_readphy(bp, MII_BMSR, &bmsr) &&
 	    !b44_readphy(bp, B44_MII_AUXCTRL, &aux) &&
 	    (bmsr != 0xffff)) {
@@ -765,6 +880,25 @@ static int b44_rx(struct b44 *bp, int bu
 	return received;
 }
 
+
+static inline void __b44_reset(struct b44 *bp)
+{
+	spin_lock_irq(&bp->lock);
+	b44_halt(bp);
+	b44_init_rings(bp);
+	b44_init_hw(bp);
+	spin_unlock_irq(&bp->lock);
+
+	b44_enable_ints(bp);
+	netif_wake_queue(bp->dev);
+}
+
+static inline void __b44_set_timeout(struct b44 *bp, int timeout)
+{
+	/* Set timeout for Rx to two seconds after the last Tx */
+	bw32(B44_GPTIMER, timeout ? 2 * 125000000 : 0);
+}
+
 static int b44_poll(struct net_device *netdev, int *budget)
 {
 	struct b44 *bp = netdev->priv;
@@ -772,13 +906,13 @@ static int b44_poll(struct net_device *n
 
 	spin_lock_irq(&bp->lock);
 
-	if (bp->istat & (ISTAT_TX | ISTAT_TO)) {
+	if (bp->istat & ISTAT_TX) {
 		/* spin_lock(&bp->tx_lock); */
 		b44_tx(bp);
 		/* spin_unlock(&bp->tx_lock); */
 	}
 	spin_unlock_irq(&bp->lock);
-
+	
 	done = 1;
 	if (bp->istat & ISTAT_RX) {
 		int orig_budget = *budget;
@@ -796,24 +930,18 @@ static int b44_poll(struct net_device *n
 			done = 0;
 	}
 
-	if (bp->istat & ISTAT_ERRORS) {
-		spin_lock_irq(&bp->lock);
-		b44_halt(bp);
-		b44_init_rings(bp);
-		b44_init_hw(bp);
-		netif_wake_queue(bp->dev);
-		spin_unlock_irq(&bp->lock);
-		done = 1;
-	}
-
 	if (done) {
 		netif_rx_complete(netdev);
 		b44_enable_ints(bp);
 	}
 
+	if ((bp->core_unit == 1) && (bp->istat & (ISTAT_TX | ISTAT_RX)))
+		__b44_set_timeout(bp, (bp->istat & ISTAT_TX) ? 1 : 0);
+
 	return (done ? 0 : 1);
 }
 
+
 static irqreturn_t b44_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 {
 	struct net_device *dev = dev_id;
@@ -832,6 +960,18 @@ static irqreturn_t b44_interrupt(int irq
 	 */
 	istat &= imask;
 	if (istat) {
+		/* Workaround for the WL-500g WAN port hang */
+		if (istat & (ISTAT_TO | ISTAT_ERRORS)) {
+			/*
+			 * no rx before the watchdog timeout
+			 * reset the interface
+			 */
+			__b44_reset(bp);
+		} 
+		
+		if ((bp->core_unit == 1) && (bp->istat & (ISTAT_TX | ISTAT_RX)))
+			__b44_set_timeout(bp, (bp->istat & ISTAT_TX) ? 1 : 0);
+
 		handled = 1;
 		if (netif_rx_schedule_prep(dev)) {
 			/* NOTE: These writes are posted by the readback of
@@ -848,6 +988,7 @@ static irqreturn_t b44_interrupt(int irq
 		bw32(B44_ISTAT, istat);
 		br32(B44_ISTAT);
 	}
+
 	spin_unlock_irqrestore(&bp->lock, flags);
 	return IRQ_RETVAL(handled);
 }
@@ -859,16 +1000,7 @@ static void b44_tx_timeout(struct net_de
 	printk(KERN_ERR PFX "%s: transmit timed out, resetting\n",
 	       dev->name);
 
-	spin_lock_irq(&bp->lock);
-
-	b44_halt(bp);
-	b44_init_rings(bp);
-	b44_init_hw(bp);
-
-	spin_unlock_irq(&bp->lock);
-
-	b44_enable_ints(bp);
-
+	__b44_reset(bp);
 	netif_wake_queue(dev);
 }
 
@@ -1092,6 +1224,8 @@ static void b44_clear_stats(struct b44 *
 /* bp->lock is held. */
 static void b44_chip_reset(struct b44 *bp)
 {
+	unsigned int sb_clock;
+
 	if (ssb_is_core_up(bp)) {
 		bw32(B44_RCV_LAZY, 0);
 		bw32(B44_ENET_CTRL, ENET_CTRL_DISABLE);
@@ -1105,9 +1239,10 @@ static void b44_chip_reset(struct b44 *b
 		bw32(B44_DMARX_CTRL, 0);
 		bp->rx_prod = bp->rx_cons = 0;
 	} else {
-		ssb_pci_setup(bp, (bp->core_unit == 0 ?
-				   SBINTVEC_ENET0 :
-				   SBINTVEC_ENET1));
+		/*if (bp->pdev->device != PCI_DEVICE_ID_BCM4713)*/
+			ssb_pci_setup(bp, (bp->core_unit == 0 ?
+				   	SBINTVEC_ENET0 :
+				   	SBINTVEC_ENET1));
 	}
 
 	ssb_core_reset(bp);
@@ -1115,6 +1250,11 @@ static void b44_chip_reset(struct b44 *b
 	b44_clear_stats(bp);
 
 	/* Make PHY accessible. */
+	if (bp->pdev->device == PCI_DEVICE_ID_BCM4713)
+		sb_clock = 100000000; /* 100 MHz */
+	else
+		sb_clock = 62500000; /* 62.5 MHz */
+
 	bw32(B44_MDIO_CTRL, (MDIO_CTRL_PREAMBLE |
 			     (0x0d & MDIO_CTRL_MAXF_MASK)));
 	br32(B44_MDIO_CTRL);
@@ -1216,6 +1356,8 @@ static int b44_open(struct net_device *d
 	struct b44 *bp = dev->priv;
 	int err;
 
+	netif_carrier_off(dev);
+
 	err = b44_alloc_consistent(bp);
 	if (err)
 		return err;
@@ -1236,9 +1378,10 @@ static int b44_open(struct net_device *d
 	bp->timer.expires = jiffies + HZ;
 	bp->timer.data = (unsigned long) bp;
 	bp->timer.function = b44_timer;
-	add_timer(&bp->timer);
+	b44_timer((unsigned long) bp);
 
 	b44_enable_ints(bp);
+	netif_start_queue(dev);
 
 	return 0;
 
@@ -1638,7 +1781,7 @@ static int b44_ioctl(struct net_device *
 		u32 mii_regval;
 
 		spin_lock_irq(&bp->lock);
-		err = b44_readphy(bp, data->reg_num & 0x1f, &mii_regval);
+		err = __b44_readphy(bp, data->phy_id & 0x1f, data->reg_num & 0x1f, &mii_regval);
 		spin_unlock_irq(&bp->lock);
 
 		data->val_out = mii_regval;
@@ -1651,7 +1794,7 @@ static int b44_ioctl(struct net_device *
 			return -EPERM;
 
 		spin_lock_irq(&bp->lock);
-		err = b44_writephy(bp, data->reg_num & 0x1f, data->val_in);
+		err = __b44_writephy(bp, data->phy_id & 0x1f, data->reg_num & 0x1f, data->val_in);
 		spin_unlock_irq(&bp->lock);
 
 		return err;
@@ -1678,21 +1821,52 @@ static int b44_read_eeprom(struct b44 *b
 static int __devinit b44_get_invariants(struct b44 *bp)
 {
 	u8 eeprom[128];
+	u8 buf[32];
 	int err;
+	unsigned long flags;
 
-	err = b44_read_eeprom(bp, &eeprom[0]);
-	if (err)
-		goto out;
-
-	bp->dev->dev_addr[0] = eeprom[79];
-	bp->dev->dev_addr[1] = eeprom[78];
-	bp->dev->dev_addr[2] = eeprom[81];
-	bp->dev->dev_addr[3] = eeprom[80];
-	bp->dev->dev_addr[4] = eeprom[83];
-	bp->dev->dev_addr[5] = eeprom[82];
-
-	bp->phy_addr = eeprom[90] & 0x1f;
-	bp->mdc_port = (eeprom[90] >> 14) & 0x1;
+	if (bp->pdev->device == PCI_DEVICE_ID_BCM4713) {
+#ifdef CONFIG_BCM947XX
+		sprintf(buf, "et%dmacaddr", instance - 1);
+		e_aton(nvram_get(buf), bp->dev->dev_addr);
+
+		sprintf(buf, "et%dphyaddr", instance - 1);
+		bp->phy_addr = B44_PHY_ADDR_NO_PHY;
+#else
+		/*
+		 * BCM47xx boards don't have a EEPROM. The MAC is stored in
+		 * a NVRAM area somewhere in the flash memory. As we don't
+		 * know the location and/or the format of the NVRAM area
+		 * here, we simply rely on the bootloader to write the
+		 * MAC into the CAM.
+		 */
+		spin_lock_irqsave(&bp->lock, flags);
+		__b44_cam_read(bp, bp->dev->dev_addr, 0);
+		spin_unlock_irqrestore(&bp->lock, flags);
+
+		/*
+		 * BCM47xx boards don't have a PHY. Usually there is a switch
+		 * chip with multiple PHYs connected to the PHY port.
+		 */
+		bp->phy_addr = B44_PHY_ADDR_NO_PHY;
+#endif
+		bp->dma_offset = 0;
+	} else {
+		err = b44_read_eeprom(bp, &eeprom[0]);
+		if (err)
+			return err;
+
+		bp->dev->dev_addr[0] = eeprom[79];
+		bp->dev->dev_addr[1] = eeprom[78];
+		bp->dev->dev_addr[2] = eeprom[81];
+		bp->dev->dev_addr[3] = eeprom[80];
+		bp->dev->dev_addr[4] = eeprom[83];
+		bp->dev->dev_addr[5] = eeprom[82];
+
+		bp->phy_addr = eeprom[90] & 0x1f;
+		bp->dma_offset = SB_PCI_DMA;
+		bp->mdc_port = (eeprom[90] >> 14) & 0x1;
+	}
 
 	/* With this, plus the rx_header prepended to the data by the
 	 * hardware, we'll land the ethernet header on a 2-byte boundary.
@@ -1702,13 +1876,12 @@ static int __devinit b44_get_invariants(
 	bp->imask = IMASK_DEF;
 
 	bp->core_unit = ssb_core_unit(bp);
-	bp->dma_offset = ssb_get_addr(bp, SBID_PCI_DMA, 0);
 
 	/* XXX - really required? 
 	   bp->flags |= B44_FLAG_BUGGY_TXPTR;
          */
-out:
-	return err;
+
+	return 0;
 }
 
 static int __devinit b44_init_one(struct pci_dev *pdev,
@@ -1720,6 +1893,10 @@ static int __devinit b44_init_one(struct
 	struct b44 *bp;
 	int err, i;
 
+#ifdef CONFIG_BCM947XX
+	instance++;
+#endif
+
 	if (b44_version_printed++ == 0)
 		printk(KERN_INFO "%s", version);
 
@@ -1834,11 +2011,17 @@ static int __devinit b44_init_one(struct
 	 */ 
 	b44_chip_reset(bp);
 
-	printk(KERN_INFO "%s: Broadcom 4400 10/100BaseT Ethernet ", dev->name);
+	printk(KERN_INFO "%s: Broadcom %s 10/100BaseT Ethernet ", dev->name,
+		(pdev->device == PCI_DEVICE_ID_BCM4713) ? "47xx" : "4400");
 	for (i = 0; i < 6; i++)
 		printk("%2.2x%c", dev->dev_addr[i],
 		       i == 5 ? '\n' : ':');
 
+	/* Initialize phy */
+	spin_lock_irq(&bp->lock);
+	b44_chip_reset(bp);
+	spin_unlock_irq(&bp->lock);
+	
 	return 0;
 
 err_out_iounmap:
--- a/drivers/net/b44.h
+++ b/drivers/net/b44.h
@@ -229,8 +229,6 @@
 #define  SBIPSFLAG_IMASK4	0x3f000000 /* Which sbflags --> mips interrupt 4 */
 #define  SBIPSFLAG_ISHIFT4	24
 #define B44_SBTPSFLAG	0x0F18UL /* SB Target Port OCP Slave Flag */
-#define  SBTPS_NUM0_MASK	0x0000003f
-#define  SBTPS_F0EN0		0x00000040
 #define B44_SBADMATCH3	0x0F60UL /* SB Address Match 3 */
 #define B44_SBADMATCH2	0x0F68UL /* SB Address Match 2 */
 #define B44_SBADMATCH1	0x0F70UL /* SB Address Match 1 */
@@ -461,6 +459,8 @@ struct ring_info {
 };
 
 #define B44_MCAST_TABLE_SIZE	32
+#define B44_PHY_ADDR_NO_PHY	30
+#define B44_MDC_RATIO		5000000
 
 /* SW copy of device statistics, kept up to date by periodic timer
  * which probes HW values.  Must have same relative layout as HW
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -1765,6 +1765,7 @@
 #define PCI_DEVICE_ID_TIGON3_5901_2	0x170e
 #define PCI_DEVICE_ID_BCM4401		0x4401
 #define PCI_DEVICE_ID_BCM4401B0		0x4402
+#define PCI_DEVICE_ID_BCM4713		0x4713
 
 #define PCI_VENDOR_ID_ENE		0x1524
 #define PCI_DEVICE_ID_ENE_1211		0x1211