18 files changed, 137 insertions, 159 deletions

diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index fb5df5c6203e..c97ab82ec743 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -1286,6 +1286,7 @@ static int cxgb_open(struct net_device *dev)
         if (!other_ports)
                 schedule_chk_task(adapter);
 
+        cxgb3_event_notify(&adapter->tdev, OFFLOAD_PORT_UP, pi->port_id);
         return 0;
 }
 
@@ -1318,6 +1319,7 @@ static int cxgb_close(struct net_device *dev)
         if (!adapter->open_device_map)
                 cxgb_down(adapter);
 
+        cxgb3_event_notify(&adapter->tdev, OFFLOAD_PORT_DOWN, pi->port_id);
         return 0;
 }
 
@@ -2717,7 +2719,7 @@ static int t3_adapter_error(struct adapter *adapter, int reset)
 
         if (is_offload(adapter) &&
             test_bit(OFFLOAD_DEVMAP_BIT, &adapter->open_device_map)) {
-                cxgb3_err_notify(&adapter->tdev, OFFLOAD_STATUS_DOWN, 0);
+                cxgb3_event_notify(&adapter->tdev, OFFLOAD_STATUS_DOWN, 0);
                 offload_close(&adapter->tdev);
         }
 
@@ -2782,7 +2784,7 @@ static void t3_resume_ports(struct adapter *adapter)
         }
 
         if (is_offload(adapter) && !ofld_disable)
-                cxgb3_err_notify(&adapter->tdev, OFFLOAD_STATUS_UP, 0);
+                cxgb3_event_notify(&adapter->tdev, OFFLOAD_STATUS_UP, 0);
 }
 
 /*
diff --git a/drivers/net/cxgb3/cxgb3_offload.c b/drivers/net/cxgb3/cxgb3_offload.c
index f9f54b57b28c..75064eea1d87 100644
--- a/drivers/net/cxgb3/cxgb3_offload.c
+++ b/drivers/net/cxgb3/cxgb3_offload.c
@@ -153,14 +153,14 @@ void cxgb3_remove_clients(struct t3cdev *tdev)
         mutex_unlock(&cxgb3_db_lock);
 }
 
-void cxgb3_err_notify(struct t3cdev *tdev, u32 status, u32 error)
+void cxgb3_event_notify(struct t3cdev *tdev, u32 event, u32 port)
 {
         struct cxgb3_client *client;
 
         mutex_lock(&cxgb3_db_lock);
         list_for_each_entry(client, &client_list, client_list) {
-                if (client->err_handler)
-                        client->err_handler(tdev, status, error);
+                if (client->event_handler)
+                        client->event_handler(tdev, event, port);
         }
         mutex_unlock(&cxgb3_db_lock);
 }
diff --git a/drivers/net/cxgb3/cxgb3_offload.h b/drivers/net/cxgb3/cxgb3_offload.h
index 55945f422aec..670aa62042da 100644
--- a/drivers/net/cxgb3/cxgb3_offload.h
+++ b/drivers/net/cxgb3/cxgb3_offload.h
@@ -64,14 +64,16 @@ void cxgb3_register_client(struct cxgb3_client *client);
 void cxgb3_unregister_client(struct cxgb3_client *client);
 void cxgb3_add_clients(struct t3cdev *tdev);
 void cxgb3_remove_clients(struct t3cdev *tdev);
-void cxgb3_err_notify(struct t3cdev *tdev, u32 status, u32 error);
+void cxgb3_event_notify(struct t3cdev *tdev, u32 event, u32 port);
 
 typedef int (*cxgb3_cpl_handler_func)(struct t3cdev *dev,
                                       struct sk_buff *skb, void *ctx);
 
 enum {
         OFFLOAD_STATUS_UP,
-        OFFLOAD_STATUS_DOWN
+        OFFLOAD_STATUS_DOWN,
+        OFFLOAD_PORT_DOWN,
+        OFFLOAD_PORT_UP
 };
 
 struct cxgb3_client {
@@ -82,7 +84,7 @@ struct cxgb3_client {
         int (*redirect)(void *ctx, struct dst_entry *old,
                         struct dst_entry *new, struct l2t_entry *l2t);
         struct list_head client_list;
-        void (*err_handler)(struct t3cdev *tdev, u32 status, u32 error);
+        void (*event_handler)(struct t3cdev *tdev, u32 event, u32 port);
 };
 
 /*
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index e212f2c5448b..a00ec639c380 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -491,6 +491,7 @@ static int gfar_remove(struct of_device *ofdev)
 
         dev_set_drvdata(&ofdev->dev, NULL);
 
+        unregister_netdev(priv->ndev);
         iounmap(priv->regs);
         free_netdev(priv->ndev);
 
diff --git a/drivers/net/mlx4/cq.c b/drivers/net/mlx4/cq.c
index ac57b6a42c6e..ccfe276943f0 100644
--- a/drivers/net/mlx4/cq.c
+++ b/drivers/net/mlx4/cq.c
@@ -34,7 +34,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/hardirq.h>
 
 #include <linux/mlx4/cmd.h>
diff --git a/drivers/net/mlx4/eq.c b/drivers/net/mlx4/eq.c
index b9ceddde46c0..bffb7995cb70 100644
--- a/drivers/net/mlx4/eq.c
+++ b/drivers/net/mlx4/eq.c
@@ -31,7 +31,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/mm.h>
 #include <linux/dma-mapping.h>
@@ -42,6 +41,10 @@
 #include "fw.h"
 
 enum {
+        MLX4_IRQNAME_SIZE       = 64
+};
+
+enum {
         MLX4_NUM_ASYNC_EQE      = 0x100,
         MLX4_NUM_SPARE_EQE      = 0x80,
         MLX4_EQ_ENTRY_SIZE      = 0x20
@@ -526,48 +529,6 @@ static void mlx4_unmap_clr_int(struct mlx4_dev *dev)
         iounmap(priv->clr_base);
 }
 
-int mlx4_map_eq_icm(struct mlx4_dev *dev, u64 icm_virt)
-{
-        struct mlx4_priv *priv = mlx4_priv(dev);
-        int ret;
-
-        /*
-         * We assume that mapping one page is enough for the whole EQ
-         * context table.  This is fine with all current HCAs, because
-         * we only use 32 EQs and each EQ uses 64 bytes of context
-         * memory, or 1 KB total.
-         */
-        priv->eq_table.icm_virt = icm_virt;
-        priv->eq_table.icm_page = alloc_page(GFP_HIGHUSER);
-        if (!priv->eq_table.icm_page)
-                return -ENOMEM;
-        priv->eq_table.icm_dma  = pci_map_page(dev->pdev, priv->eq_table.icm_page, 0,
-                                               PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
-        if (pci_dma_mapping_error(dev->pdev, priv->eq_table.icm_dma)) {
-                __free_page(priv->eq_table.icm_page);
-                return -ENOMEM;
-        }
-
-        ret = mlx4_MAP_ICM_page(dev, priv->eq_table.icm_dma, icm_virt);
-        if (ret) {
-                pci_unmap_page(dev->pdev, priv->eq_table.icm_dma, PAGE_SIZE,
-                               PCI_DMA_BIDIRECTIONAL);
-                __free_page(priv->eq_table.icm_page);
-        }
-
-        return ret;
-}
-
-void mlx4_unmap_eq_icm(struct mlx4_dev *dev)
-{
-        struct mlx4_priv *priv = mlx4_priv(dev);
-
-        mlx4_UNMAP_ICM(dev, priv->eq_table.icm_virt, 1);
-        pci_unmap_page(dev->pdev, priv->eq_table.icm_dma, PAGE_SIZE,
-                       PCI_DMA_BIDIRECTIONAL);
-        __free_page(priv->eq_table.icm_page);
-}
-
 int mlx4_alloc_eq_table(struct mlx4_dev *dev)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
@@ -615,7 +576,9 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
         priv->eq_table.clr_int  = priv->clr_base +
                 (priv->eq_table.inta_pin < 32 ? 4 : 0);
 
-        priv->eq_table.irq_names = kmalloc(16 * dev->caps.num_comp_vectors, GFP_KERNEL);
+        priv->eq_table.irq_names =
+                kmalloc(MLX4_IRQNAME_SIZE * (dev->caps.num_comp_vectors + 1),
+                        GFP_KERNEL);
         if (!priv->eq_table.irq_names) {
                 err = -ENOMEM;
                 goto err_out_bitmap;
@@ -638,17 +601,25 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
                 goto err_out_comp;
 
         if (dev->flags & MLX4_FLAG_MSI_X) {
-                static const char async_eq_name[] = "mlx4-async";
                 const char *eq_name;
 
                 for (i = 0; i < dev->caps.num_comp_vectors + 1; ++i) {
                         if (i < dev->caps.num_comp_vectors) {
-                                snprintf(priv->eq_table.irq_names + i * 16, 16,
-                                         "mlx4-comp-%d", i);
-                                eq_name = priv->eq_table.irq_names + i * 16;
-                        } else
-                                eq_name = async_eq_name;
+                                snprintf(priv->eq_table.irq_names +
+                                         i * MLX4_IRQNAME_SIZE,
+                                         MLX4_IRQNAME_SIZE,
+                                         "mlx4-comp-%d@pci:%s", i,
+                                         pci_name(dev->pdev));
+                        } else {
+                                snprintf(priv->eq_table.irq_names +
+                                         i * MLX4_IRQNAME_SIZE,
+                                         MLX4_IRQNAME_SIZE,
+                                         "mlx4-async@pci:%s",
+                                         pci_name(dev->pdev));
+                        }
 
+                        eq_name = priv->eq_table.irq_names +
+                                  i * MLX4_IRQNAME_SIZE;
                         err = request_irq(priv->eq_table.eq[i].irq,
                                           mlx4_msi_x_interrupt, 0, eq_name,
                                           priv->eq_table.eq + i);
@@ -658,8 +629,12 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
                         priv->eq_table.eq[i].have_irq = 1;
                 }
         } else {
+                snprintf(priv->eq_table.irq_names,
+                         MLX4_IRQNAME_SIZE,
+                         DRV_NAME "@pci:%s",
+                         pci_name(dev->pdev));
                 err = request_irq(dev->pdev->irq, mlx4_interrupt,
-                                  IRQF_SHARED, DRV_NAME, dev);
+                                  IRQF_SHARED, priv->eq_table.irq_names, dev);
                 if (err)
                         goto err_out_async;
 
diff --git a/drivers/net/mlx4/icm.c b/drivers/net/mlx4/icm.c
index baf4bf66062c..04b382fcb8c8 100644
--- a/drivers/net/mlx4/icm.c
+++ b/drivers/net/mlx4/icm.c
@@ -31,7 +31,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/mm.h>
 #include <linux/scatterlist.h>
diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
index dac621b1e9fc..3dd481e77f92 100644
--- a/drivers/net/mlx4/main.c
+++ b/drivers/net/mlx4/main.c
@@ -525,7 +525,10 @@ static int mlx4_init_icm(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap,
                 goto err_unmap_aux;
         }
 
-        err = mlx4_map_eq_icm(dev, init_hca->eqc_base);
+        err = mlx4_init_icm_table(dev, &priv->eq_table.table,
+                                  init_hca->eqc_base, dev_cap->eqc_entry_sz,
+                                  dev->caps.num_eqs, dev->caps.num_eqs,
+                                  0, 0);
         if (err) {
                 mlx4_err(dev, "Failed to map EQ context memory, aborting.\n");
                 goto err_unmap_cmpt;
@@ -668,7 +671,7 @@ err_unmap_mtt:
         mlx4_cleanup_icm_table(dev, &priv->mr_table.mtt_table);
 
 err_unmap_eq:
-        mlx4_unmap_eq_icm(dev);
+        mlx4_cleanup_icm_table(dev, &priv->eq_table.table);
 
 err_unmap_cmpt:
         mlx4_cleanup_icm_table(dev, &priv->eq_table.cmpt_table);
@@ -698,11 +701,11 @@ static void mlx4_free_icms(struct mlx4_dev *dev)
         mlx4_cleanup_icm_table(dev, &priv->qp_table.qp_table);
         mlx4_cleanup_icm_table(dev, &priv->mr_table.dmpt_table);
         mlx4_cleanup_icm_table(dev, &priv->mr_table.mtt_table);
+        mlx4_cleanup_icm_table(dev, &priv->eq_table.table);
         mlx4_cleanup_icm_table(dev, &priv->eq_table.cmpt_table);
         mlx4_cleanup_icm_table(dev, &priv->cq_table.cmpt_table);
         mlx4_cleanup_icm_table(dev, &priv->srq_table.cmpt_table);
         mlx4_cleanup_icm_table(dev, &priv->qp_table.cmpt_table);
-        mlx4_unmap_eq_icm(dev);
 
         mlx4_UNMAP_ICM_AUX(dev);
         mlx4_free_icm(dev, priv->fw.aux_icm, 0);
@@ -786,7 +789,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
         return 0;
 
 err_close:
-        mlx4_close_hca(dev);
+        mlx4_CLOSE_HCA(dev, 0);
 
 err_free_icm:
         mlx4_free_icms(dev);
@@ -1070,18 +1073,12 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 goto err_disable_pdev;
         }
 
-        err = pci_request_region(pdev, 0, DRV_NAME);
+        err = pci_request_regions(pdev, DRV_NAME);
         if (err) {
-                dev_err(&pdev->dev, "Cannot request control region, aborting.\n");
+                dev_err(&pdev->dev, "Couldn't get PCI resources, aborting\n");
                 goto err_disable_pdev;
         }
 
-        err = pci_request_region(pdev, 2, DRV_NAME);
-        if (err) {
-                dev_err(&pdev->dev, "Cannot request UAR region, aborting.\n");
-                goto err_release_bar0;
-        }
-
         pci_set_master(pdev);
 
         err = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
@@ -1090,7 +1087,7 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
                 if (err) {
                         dev_err(&pdev->dev, "Can't set PCI DMA mask, aborting.\n");
-                        goto err_release_bar2;
+                        goto err_release_regions;
                 }
         }
         err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
@@ -1101,7 +1098,7 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 if (err) {
                         dev_err(&pdev->dev, "Can't set consistent PCI DMA mask, "
                                 "aborting.\n");
-                        goto err_release_bar2;
+                        goto err_release_regions;
                 }
         }
 
@@ -1110,7 +1107,7 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 dev_err(&pdev->dev, "Device struct alloc failed, "
                         "aborting.\n");
                 err = -ENOMEM;
-                goto err_release_bar2;
+                goto err_release_regions;
         }
 
         dev       = &priv->dev;
@@ -1205,11 +1202,8 @@ err_cmd:
 err_free_dev:
         kfree(priv);
 
-err_release_bar2:
-        pci_release_region(pdev, 2);
-
-err_release_bar0:
-        pci_release_region(pdev, 0);
+err_release_regions:
+        pci_release_regions(pdev);
 
 err_disable_pdev:
         pci_disable_device(pdev);
@@ -1265,8 +1259,7 @@ static void mlx4_remove_one(struct pci_dev *pdev)
                         pci_disable_msix(pdev);
 
                 kfree(priv);
-                pci_release_region(pdev, 2);
-                pci_release_region(pdev, 0);
+                pci_release_regions(pdev);
                 pci_disable_device(pdev);
                 pci_set_drvdata(pdev, NULL);
         }
diff --git a/drivers/net/mlx4/mcg.c b/drivers/net/mlx4/mcg.c
index 6053c357a470..5ccbce9866fe 100644
--- a/drivers/net/mlx4/mcg.c
+++ b/drivers/net/mlx4/mcg.c
@@ -31,7 +31,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/string.h>
 #include <linux/slab.h>
 
diff --git a/drivers/net/mlx4/mlx4.h b/drivers/net/mlx4/mlx4.h
index 5bd79c2b184f..bc72d6e4919b 100644
--- a/drivers/net/mlx4/mlx4.h
+++ b/drivers/net/mlx4/mlx4.h
@@ -205,9 +205,7 @@ struct mlx4_eq_table {
         void __iomem          **uar_map;
         u32                     clr_mask;
         struct mlx4_eq         *eq;
-        u64                     icm_virt;
-        struct page            *icm_page;
-        dma_addr_t              icm_dma;
+        struct mlx4_icm_table   table;
         struct mlx4_icm_table   cmpt_table;
         int                     have_irq;
         u8                      inta_pin;
@@ -373,9 +371,6 @@ u64 mlx4_make_profile(struct mlx4_dev *dev,
                       struct mlx4_dev_cap *dev_cap,
                       struct mlx4_init_hca_param *init_hca);
 
-int mlx4_map_eq_icm(struct mlx4_dev *dev, u64 icm_virt);
-void mlx4_unmap_eq_icm(struct mlx4_dev *dev);
-
 int mlx4_cmd_init(struct mlx4_dev *dev);
 void mlx4_cmd_cleanup(struct mlx4_dev *dev);
 void mlx4_cmd_event(struct mlx4_dev *dev, u16 token, u8 status, u64 out_param);
diff --git a/drivers/net/mlx4/mr.c b/drivers/net/mlx4/mr.c
index f96948be0a44..ca7ab8e7b4cc 100644
--- a/drivers/net/mlx4/mr.c
+++ b/drivers/net/mlx4/mr.c
@@ -32,7 +32,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/errno.h>
 
 #include <linux/mlx4/cmd.h>
diff --git a/drivers/net/mlx4/pd.c b/drivers/net/mlx4/pd.c
index 26d1a7a9e375..c4988d6bd5b2 100644
--- a/drivers/net/mlx4/pd.c
+++ b/drivers/net/mlx4/pd.c
@@ -31,7 +31,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/errno.h>
 
 #include <asm/page.h>
diff --git a/drivers/net/mlx4/profile.c b/drivers/net/mlx4/profile.c
index bd22df95adf9..ca25b9dc8378 100644
--- a/drivers/net/mlx4/profile.c
+++ b/drivers/net/mlx4/profile.c
@@ -32,8 +32,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
-
 #include "mlx4.h"
 #include "fw.h"
 
diff --git a/drivers/net/mlx4/qp.c b/drivers/net/mlx4/qp.c
index 1c565ef8d179..42ab9fc01d3e 100644
--- a/drivers/net/mlx4/qp.c
+++ b/drivers/net/mlx4/qp.c
@@ -33,8 +33,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
-
 #include <linux/mlx4/cmd.h>
 #include <linux/mlx4/qp.h>
 
diff --git a/drivers/net/mlx4/reset.c b/drivers/net/mlx4/reset.c
index 3951b884c0fb..e5741dab3825 100644
--- a/drivers/net/mlx4/reset.c
+++ b/drivers/net/mlx4/reset.c
@@ -31,7 +31,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
diff --git a/drivers/net/mlx4/srq.c b/drivers/net/mlx4/srq.c
index fe9f218691f5..1377d0dc8f1f 100644
--- a/drivers/net/mlx4/srq.c
+++ b/drivers/net/mlx4/srq.c
@@ -31,8 +31,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
-
 #include <linux/mlx4/cmd.h>
 
 #include "mlx4.h"
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 42b6c6319bc2..87214a257d2a 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -130,17 +130,10 @@ static inline struct tun_sock *tun_sk(struct sock *sk)
 static int tun_attach(struct tun_struct *tun, struct file *file)
 {
         struct tun_file *tfile = file->private_data;
-        const struct cred *cred = current_cred();
         int err;
 
         ASSERT_RTNL();
 
-        /* Check permissions */
-        if (((tun->owner != -1 && cred->euid != tun->owner) ||
-             (tun->group != -1 && !in_egroup_p(tun->group))) &&
-                !capable(CAP_NET_ADMIN))
-                return -EPERM;
-
         netif_tx_lock_bh(tun->dev);
 
         err = -EINVAL;
@@ -926,6 +919,8 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
         dev = __dev_get_by_name(net, ifr->ifr_name);
         if (dev) {
+                const struct cred *cred = current_cred();
+
                 if (ifr->ifr_flags & IFF_TUN_EXCL)
                         return -EBUSY;
                 if ((ifr->ifr_flags & IFF_TUN) && dev->netdev_ops == &tun_netdev_ops)
@@ -935,6 +930,14 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                 else
                         return -EINVAL;
 
+                if (((tun->owner != -1 && cred->euid != tun->owner) ||
+                     (tun->group != -1 && !in_egroup_p(tun->group))) &&
+                    !capable(CAP_NET_ADMIN))
+                        return -EPERM;
+                err = security_tun_dev_attach(tun->sk);
+                if (err < 0)
+                        return err;
+
                 err = tun_attach(tun, file);
                 if (err < 0)
                         return err;
@@ -947,6 +950,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
+                err = security_tun_dev_create();
+                if (err < 0)
+                        return err;
 
                 /* Set dev type */
                 if (ifr->ifr_flags & IFF_TUN) {
@@ -989,6 +995,8 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                 tun->sk = sk;
                 container_of(sk, struct tun_sock, sk)->tun = tun;
 
+                security_tun_dev_post_create(sk);
+
                 tun_net_init(dev);
 
                 if (strchr(dev->name, '%')) {
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 6dcac73b4d29..f593fbbb4e52 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -2874,45 +2874,27 @@ static int ipw_fw_dma_add_command_block(struct ipw_priv *priv,
         return 0;
 }
 
-static int ipw_fw_dma_add_buffer(struct ipw_priv *priv,
-                                 u32 src_phys, u32 dest_address, u32 length)
+static int ipw_fw_dma_add_buffer(struct ipw_priv *priv, dma_addr_t *src_address,
+                                 int nr, u32 dest_address, u32 len)
 {
-        u32 bytes_left = length;
-        u32 src_offset = 0;
-        u32 dest_offset = 0;
-        int status = 0;
+        int ret, i;
+        u32 size;
+
         IPW_DEBUG_FW(">> \n");
-        IPW_DEBUG_FW_INFO("src_phys=0x%x dest_address=0x%x length=0x%x\n",
-                          src_phys, dest_address, length);
-        while (bytes_left > CB_MAX_LENGTH) {
-                status = ipw_fw_dma_add_command_block(priv,
-                                                      src_phys + src_offset,
-                                                      dest_address +
-                                                      dest_offset,
-                                                      CB_MAX_LENGTH, 0, 0);
-                if (status) {
+        IPW_DEBUG_FW_INFO("nr=%d dest_address=0x%x len=0x%x\n",
+                          nr, dest_address, len);
+
+        for (i = 0; i < nr; i++) {
+                size = min_t(u32, len - i * CB_MAX_LENGTH, CB_MAX_LENGTH);
+                ret = ipw_fw_dma_add_command_block(priv, src_address[i],
+                                                   dest_address +
+                                                   i * CB_MAX_LENGTH, size,
+                                                   0, 0);
+                if (ret) {
                         IPW_DEBUG_FW_INFO(": Failed\n");
                         return -1;
                 } else
                         IPW_DEBUG_FW_INFO(": Added new cb\n");
-
-                src_offset += CB_MAX_LENGTH;
-                dest_offset += CB_MAX_LENGTH;
-                bytes_left -= CB_MAX_LENGTH;
-        }
-
-        /* add the buffer tail */
-        if (bytes_left > 0) {
-                status =
-                    ipw_fw_dma_add_command_block(priv, src_phys + src_offset,
-                                                 dest_address + dest_offset,
-                                                 bytes_left, 0, 0);
-                if (status) {
-                        IPW_DEBUG_FW_INFO(": Failed on the buffer tail\n");
-                        return -1;
-                } else
-                        IPW_DEBUG_FW_INFO
-                            (": Adding new cb - the buffer tail\n");
         }
 
         IPW_DEBUG_FW("<< \n");
@@ -3160,59 +3142,91 @@ static int ipw_load_ucode(struct ipw_priv *priv, u8 * data, size_t len)
 
 static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
 {
-        int rc = -1;
+        int ret = -1;
         int offset = 0;
         struct fw_chunk *chunk;
-        dma_addr_t shared_phys;
-        u8 *shared_virt;
+        int total_nr = 0;
+        int i;
+        struct pci_pool *pool;
+        u32 *virts[CB_NUMBER_OF_ELEMENTS_SMALL];
+        dma_addr_t phys[CB_NUMBER_OF_ELEMENTS_SMALL];
 
         IPW_DEBUG_TRACE("<< : \n");
-        shared_virt = pci_alloc_consistent(priv->pci_dev, len, &shared_phys);
 
-        if (!shared_virt)
+        pool = pci_pool_create("ipw2200", priv->pci_dev, CB_MAX_LENGTH, 0, 0);
+        if (!pool) {
+                IPW_ERROR("pci_pool_create failed\n");
                 return -ENOMEM;
-
-        memmove(shared_virt, data, len);
+        }
 
         /* Start the Dma */
-        rc = ipw_fw_dma_enable(priv);
+        ret = ipw_fw_dma_enable(priv);
 
         /* the DMA is already ready this would be a bug. */
         BUG_ON(priv->sram_desc.last_cb_index > 0);
 
         do {
+                u32 chunk_len;
+                u8 *start;
+                int size;
+                int nr = 0;
+
                 chunk = (struct fw_chunk *)(data + offset);
                 offset += sizeof(struct fw_chunk);
+                chunk_len = le32_to_cpu(chunk->length);
+                start = data + offset;
+
+                nr = (chunk_len + CB_MAX_LENGTH - 1) / CB_MAX_LENGTH;
+                for (i = 0; i < nr; i++) {
+                        virts[total_nr] = pci_pool_alloc(pool, GFP_KERNEL,
+                                                         &phys[total_nr]);
+                        if (!virts[total_nr]) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
+                        size = min_t(u32, chunk_len - i * CB_MAX_LENGTH,
+                                     CB_MAX_LENGTH);
+                        memcpy(virts[total_nr], start, size);
+                        start += size;
+                        total_nr++;
+                        /* We don't support fw chunk larger than 64*8K */
+                        BUG_ON(total_nr > CB_NUMBER_OF_ELEMENTS_SMALL);
+                }
+
                 /* build DMA packet and queue up for sending */
                 /* dma to chunk->address, the chunk->length bytes from data +
                  * offeset*/
                 /* Dma loading */
-                rc = ipw_fw_dma_add_buffer(priv, shared_phys + offset,
-                                           le32_to_cpu(chunk->address),
-                                           le32_to_cpu(chunk->length));
-                if (rc) {
+                ret = ipw_fw_dma_add_buffer(priv, &phys[total_nr - nr],
+                                            nr, le32_to_cpu(chunk->address),
+                                            chunk_len);
+                if (ret) {
                         IPW_DEBUG_INFO("dmaAddBuffer Failed\n");
                         goto out;
                 }
 
-                offset += le32_to_cpu(chunk->length);
+                offset += chunk_len;
         } while (offset < len);
 
         /* Run the DMA and wait for the answer */
-        rc = ipw_fw_dma_kick(priv);
-        if (rc) {
+        ret = ipw_fw_dma_kick(priv);
+        if (ret) {
                 IPW_ERROR("dmaKick Failed\n");
                 goto out;
         }
 
-        rc = ipw_fw_dma_wait(priv);
-        if (rc) {
+        ret = ipw_fw_dma_wait(priv);
+        if (ret) {
                 IPW_ERROR("dmaWaitSync Failed\n");
                 goto out;
         }
-      out:
-        pci_free_consistent(priv->pci_dev, len, shared_virt, shared_phys);
-        return rc;
+ out:
+        for (i = 0; i < total_nr; i++)
+                pci_pool_free(pool, virts[i], phys[i]);
+
+        pci_pool_destroy(pool);
+
+        return ret;
 }
 
 /* stop nic */