34 files changed, 256 insertions, 231 deletions

diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 5f6509a5f640..5ce7cbabd7a7 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1727,12 +1727,14 @@ config KS8842
         tristate "Micrel KSZ8842"
         depends on HAS_IOMEM
         help
-          This platform driver is for Micrel KSZ8842 chip.
+          This platform driver is for Micrel KSZ8842 / KS8842
+          2-port ethernet switch chip (managed, VLAN, QoS).
 
 config KS8851
        tristate "Micrel KS8851 SPI"
        depends on SPI
        select MII
+        select CRC32
        help
          SPI driver for Micrel KS8851 SPI attached network chip.
 
diff --git a/drivers/net/arm/w90p910_ether.c b/drivers/net/arm/w90p910_ether.c
index 616fb7985a34..ddd231cb54b7 100644
--- a/drivers/net/arm/w90p910_ether.c
+++ b/drivers/net/arm/w90p910_ether.c
@@ -1080,7 +1080,7 @@ static struct platform_driver w90p910_ether_driver = {
         .probe          = w90p910_ether_probe,
         .remove         = __devexit_p(w90p910_ether_remove),
         .driver         = {
-                .name   = "w90p910-emc",
+                .name   = "nuc900-emc",
                 .owner  = THIS_MODULE,
         },
 };
@@ -1101,5 +1101,5 @@ module_exit(w90p910_ether_exit);
 MODULE_AUTHOR("Wan ZongShun <mcuos.com@gmail.com>");
 MODULE_DESCRIPTION("w90p910 MAC driver!");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:w90p910-emc");
+MODULE_ALIAS("platform:nuc900-emc");
 
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index fb5df5c6203e..c97ab82ec743 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -1286,6 +1286,7 @@ static int cxgb_open(struct net_device *dev)
         if (!other_ports)
                 schedule_chk_task(adapter);
 
+        cxgb3_event_notify(&adapter->tdev, OFFLOAD_PORT_UP, pi->port_id);
         return 0;
 }
 
@@ -1318,6 +1319,7 @@ static int cxgb_close(struct net_device *dev)
         if (!adapter->open_device_map)
                 cxgb_down(adapter);
 
+        cxgb3_event_notify(&adapter->tdev, OFFLOAD_PORT_DOWN, pi->port_id);
         return 0;
 }
 
@@ -2717,7 +2719,7 @@ static int t3_adapter_error(struct adapter *adapter, int reset)
 
         if (is_offload(adapter) &&
             test_bit(OFFLOAD_DEVMAP_BIT, &adapter->open_device_map)) {
-                cxgb3_err_notify(&adapter->tdev, OFFLOAD_STATUS_DOWN, 0);
+                cxgb3_event_notify(&adapter->tdev, OFFLOAD_STATUS_DOWN, 0);
                 offload_close(&adapter->tdev);
         }
 
@@ -2782,7 +2784,7 @@ static void t3_resume_ports(struct adapter *adapter)
         }
 
         if (is_offload(adapter) && !ofld_disable)
-                cxgb3_err_notify(&adapter->tdev, OFFLOAD_STATUS_UP, 0);
+                cxgb3_event_notify(&adapter->tdev, OFFLOAD_STATUS_UP, 0);
 }
 
 /*
diff --git a/drivers/net/cxgb3/cxgb3_offload.c b/drivers/net/cxgb3/cxgb3_offload.c
index f9f54b57b28c..75064eea1d87 100644
--- a/drivers/net/cxgb3/cxgb3_offload.c
+++ b/drivers/net/cxgb3/cxgb3_offload.c
@@ -153,14 +153,14 @@ void cxgb3_remove_clients(struct t3cdev *tdev)
         mutex_unlock(&cxgb3_db_lock);
 }
 
-void cxgb3_err_notify(struct t3cdev *tdev, u32 status, u32 error)
+void cxgb3_event_notify(struct t3cdev *tdev, u32 event, u32 port)
 {
         struct cxgb3_client *client;
 
         mutex_lock(&cxgb3_db_lock);
         list_for_each_entry(client, &client_list, client_list) {
-                if (client->err_handler)
-                        client->err_handler(tdev, status, error);
+                if (client->event_handler)
+                        client->event_handler(tdev, event, port);
         }
         mutex_unlock(&cxgb3_db_lock);
 }
diff --git a/drivers/net/cxgb3/cxgb3_offload.h b/drivers/net/cxgb3/cxgb3_offload.h
index 55945f422aec..670aa62042da 100644
--- a/drivers/net/cxgb3/cxgb3_offload.h
+++ b/drivers/net/cxgb3/cxgb3_offload.h
@@ -64,14 +64,16 @@ void cxgb3_register_client(struct cxgb3_client *client);
 void cxgb3_unregister_client(struct cxgb3_client *client);
 void cxgb3_add_clients(struct t3cdev *tdev);
 void cxgb3_remove_clients(struct t3cdev *tdev);
-void cxgb3_err_notify(struct t3cdev *tdev, u32 status, u32 error);
+void cxgb3_event_notify(struct t3cdev *tdev, u32 event, u32 port);
 
 typedef int (*cxgb3_cpl_handler_func)(struct t3cdev *dev,
                                       struct sk_buff *skb, void *ctx);
 
 enum {
         OFFLOAD_STATUS_UP,
-        OFFLOAD_STATUS_DOWN
+        OFFLOAD_STATUS_DOWN,
+        OFFLOAD_PORT_DOWN,
+        OFFLOAD_PORT_UP
 };
 
 struct cxgb3_client {
@@ -82,7 +84,7 @@ struct cxgb3_client {
         int (*redirect)(void *ctx, struct dst_entry *old,
                         struct dst_entry *new, struct l2t_entry *l2t);
         struct list_head client_list;
-        void (*err_handler)(struct t3cdev *tdev, u32 status, u32 error);
+        void (*event_handler)(struct t3cdev *tdev, u32 event, u32 port);
 };
 
 /*
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 41b648a67fec..3a6735dc9f6a 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -1899,7 +1899,7 @@ static int e100_rx_indicate(struct nic *nic, struct rx *rx,
                                 nic->ru_running = RU_SUSPENDED;
                 pci_dma_sync_single_for_device(nic->pdev, rx->dma_addr,
                                                sizeof(struct rfd),
-                                               PCI_DMA_BIDIRECTIONAL);
+                                               PCI_DMA_FROMDEVICE);
                 return -ENODATA;
         }
 
diff --git a/drivers/net/fec_mpc52xx.c b/drivers/net/fec_mpc52xx.c
index cc786333d95c..c40113f58963 100644
--- a/drivers/net/fec_mpc52xx.c
+++ b/drivers/net/fec_mpc52xx.c
@@ -309,6 +309,7 @@ static int mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct mpc52xx_fec_priv *priv = netdev_priv(dev);
         struct bcom_fec_bd *bd;
+        unsigned long flags;
 
         if (bcom_queue_full(priv->tx_dmatsk)) {
                 if (net_ratelimit())
@@ -316,7 +317,7 @@ static int mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_BUSY;
         }
 
-        spin_lock_irq(&priv->lock);
+        spin_lock_irqsave(&priv->lock, flags);
         dev->trans_start = jiffies;
 
         bd = (struct bcom_fec_bd *)
@@ -332,7 +333,7 @@ static int mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 netif_stop_queue(dev);
         }
 
-        spin_unlock_irq(&priv->lock);
+        spin_unlock_irqrestore(&priv->lock, flags);
 
         return NETDEV_TX_OK;
 }
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index e212f2c5448b..a00ec639c380 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -491,6 +491,7 @@ static int gfar_remove(struct of_device *ofdev)
 
         dev_set_drvdata(&ofdev->dev, NULL);
 
+        unregister_netdev(priv->ndev);
         iounmap(priv->regs);
         free_netdev(priv->ndev);
 
diff --git a/drivers/net/ibm_newemac/core.c b/drivers/net/ibm_newemac/core.c
index beb84213b671..f0f890803710 100644
--- a/drivers/net/ibm_newemac/core.c
+++ b/drivers/net/ibm_newemac/core.c
@@ -1305,6 +1305,8 @@ static int emac_close(struct net_device *ndev)
 
         free_irq(dev->emac_irq, dev);
 
+        netif_carrier_off(ndev);
+
         return 0;
 }
 
diff --git a/drivers/net/irda/au1k_ir.c b/drivers/net/irda/au1k_ir.c
index c4361d466597..ee1cff5c9b21 100644
--- a/drivers/net/irda/au1k_ir.c
+++ b/drivers/net/irda/au1k_ir.c
@@ -23,7 +23,6 @@
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/netdevice.h>
-#include <linux/etherdevice.h>
 #include <linux/slab.h>
 #include <linux/rtnetlink.h>
 #include <linux/interrupt.h>
@@ -205,9 +204,6 @@ static const struct net_device_ops au1k_irda_netdev_ops = {
         .ndo_start_xmit         = au1k_irda_hard_xmit,
         .ndo_tx_timeout         = au1k_tx_timeout,
         .ndo_do_ioctl           = au1k_irda_ioctl,
-        .ndo_change_mtu         = eth_change_mtu,
-        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
 };
 
 static int au1k_irda_net_init(struct net_device *dev)
diff --git a/drivers/net/irda/pxaficp_ir.c b/drivers/net/irda/pxaficp_ir.c
index 3376a4f39e0a..77d10edefd25 100644
--- a/drivers/net/irda/pxaficp_ir.c
+++ b/drivers/net/irda/pxaficp_ir.c
@@ -803,9 +803,6 @@ static const struct net_device_ops pxa_irda_netdev_ops = {
         .ndo_stop               = pxa_irda_stop,
         .ndo_start_xmit         = pxa_irda_hard_xmit,
         .ndo_do_ioctl           = pxa_irda_ioctl,
-        .ndo_change_mtu         = eth_change_mtu,
-        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
 };
 
 static int pxa_irda_probe(struct platform_device *pdev)
@@ -830,6 +827,7 @@ static int pxa_irda_probe(struct platform_device *pdev)
         if (!dev)
                 goto err_mem_3;
 
+        SET_NETDEV_DEV(dev, &pdev->dev);
         si = netdev_priv(dev);
         si->dev = &pdev->dev;
         si->pdata = pdev->dev.platform_data;
diff --git a/drivers/net/irda/sa1100_ir.c b/drivers/net/irda/sa1100_ir.c
index 2aeb2e6aec1b..b039cb081e94 100644
--- a/drivers/net/irda/sa1100_ir.c
+++ b/drivers/net/irda/sa1100_ir.c
@@ -24,7 +24,6 @@
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/netdevice.h>
-#include <linux/etherdevice.h>
 #include <linux/slab.h>
 #include <linux/rtnetlink.h>
 #include <linux/interrupt.h>
@@ -881,9 +880,6 @@ static const struct net_device_ops sa1100_irda_netdev_ops = {
         .ndo_stop               = sa1100_irda_stop,
         .ndo_start_xmit         = sa1100_irda_hard_xmit,
         .ndo_do_ioctl           = sa1100_irda_ioctl,
-        .ndo_change_mtu         = eth_change_mtu,
-        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
 };
 
 static int sa1100_irda_probe(struct platform_device *pdev)
diff --git a/drivers/net/ixp2000/ixpdev.c b/drivers/net/ixp2000/ixpdev.c
index 2a0174b62e96..92fb8235c766 100644
--- a/drivers/net/ixp2000/ixpdev.c
+++ b/drivers/net/ixp2000/ixpdev.c
@@ -41,6 +41,7 @@ static int ixpdev_xmit(struct sk_buff *skb, struct net_device *dev)
         struct ixpdev_priv *ip = netdev_priv(dev);
         struct ixpdev_tx_desc *desc;
         int entry;
+        unsigned long flags;
 
         if (unlikely(skb->len > PAGE_SIZE)) {
                 /* @@@ Count drops.  */
@@ -63,11 +64,11 @@ static int ixpdev_xmit(struct sk_buff *skb, struct net_device *dev)
 
         dev->trans_start = jiffies;
 
-        local_irq_disable();
+        local_irq_save(flags);
         ip->tx_queue_entries++;
         if (ip->tx_queue_entries == TX_BUF_COUNT_PER_CHAN)
                 netif_stop_queue(dev);
-        local_irq_enable();
+        local_irq_restore(flags);
 
         return 0;
 }
diff --git a/drivers/net/macb.c b/drivers/net/macb.c
index 5b5c25368d1e..e3601cf3f931 100644
--- a/drivers/net/macb.c
+++ b/drivers/net/macb.c
@@ -620,6 +620,7 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
         dma_addr_t mapping;
         unsigned int len, entry;
         u32 ctrl;
+        unsigned long flags;
 
 #ifdef DEBUG
         int i;
@@ -635,12 +636,12 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
 #endif
 
         len = skb->len;
-        spin_lock_irq(&bp->lock);
+        spin_lock_irqsave(&bp->lock, flags);
 
         /* This is a hard error, log it. */
         if (TX_BUFFS_AVAIL(bp) < 1) {
                 netif_stop_queue(dev);
-                spin_unlock_irq(&bp->lock);
+                spin_unlock_irqrestore(&bp->lock, flags);
                 dev_err(&bp->pdev->dev,
                         "BUG! Tx Ring full when queue awake!\n");
                 dev_dbg(&bp->pdev->dev, "tx_head = %u, tx_tail = %u\n",
@@ -674,7 +675,7 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (TX_BUFFS_AVAIL(bp) < 1)
                 netif_stop_queue(dev);
 
-        spin_unlock_irq(&bp->lock);
+        spin_unlock_irqrestore(&bp->lock, flags);
 
         dev->trans_start = jiffies;
 
diff --git a/drivers/net/mlx4/cq.c b/drivers/net/mlx4/cq.c
index ac57b6a42c6e..ccfe276943f0 100644
--- a/drivers/net/mlx4/cq.c
+++ b/drivers/net/mlx4/cq.c
@@ -34,7 +34,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/hardirq.h>
 
 #include <linux/mlx4/cmd.h>
diff --git a/drivers/net/mlx4/en_tx.c b/drivers/net/mlx4/en_tx.c
index 5a88b3f57693..62208401c4df 100644
--- a/drivers/net/mlx4/en_tx.c
+++ b/drivers/net/mlx4/en_tx.c
@@ -437,6 +437,7 @@ static inline void mlx4_en_xmit_poll(struct mlx4_en_priv *priv, int tx_ind)
 {
         struct mlx4_en_cq *cq = &priv->tx_cq[tx_ind];
         struct mlx4_en_tx_ring *ring = &priv->tx_ring[tx_ind];
+        unsigned long flags;
 
         /* If we don't have a pending timer, set one up to catch our recent
            post in case the interface becomes idle */
@@ -445,9 +446,9 @@ static inline void mlx4_en_xmit_poll(struct mlx4_en_priv *priv, int tx_ind)
 
         /* Poll the CQ every mlx4_en_TX_MODER_POLL packets */
         if ((++ring->poll_cnt & (MLX4_EN_TX_POLL_MODER - 1)) == 0)
-                if (spin_trylock_irq(&ring->comp_lock)) {
+                if (spin_trylock_irqsave(&ring->comp_lock, flags)) {
                         mlx4_en_process_tx_cq(priv->dev, cq);
-                        spin_unlock_irq(&ring->comp_lock);
+                        spin_unlock_irqrestore(&ring->comp_lock, flags);
                 }
 }
 
diff --git a/drivers/net/mlx4/eq.c b/drivers/net/mlx4/eq.c
index b9ceddde46c0..bffb7995cb70 100644
--- a/drivers/net/mlx4/eq.c
+++ b/drivers/net/mlx4/eq.c
@@ -31,7 +31,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/mm.h>
 #include <linux/dma-mapping.h>
@@ -42,6 +41,10 @@
 #include "fw.h"
 
 enum {
+        MLX4_IRQNAME_SIZE       = 64
+};
+
+enum {
         MLX4_NUM_ASYNC_EQE      = 0x100,
         MLX4_NUM_SPARE_EQE      = 0x80,
         MLX4_EQ_ENTRY_SIZE      = 0x20
@@ -526,48 +529,6 @@ static void mlx4_unmap_clr_int(struct mlx4_dev *dev)
         iounmap(priv->clr_base);
 }
 
-int mlx4_map_eq_icm(struct mlx4_dev *dev, u64 icm_virt)
-{
-        struct mlx4_priv *priv = mlx4_priv(dev);
-        int ret;
-
-        /*
-         * We assume that mapping one page is enough for the whole EQ
-         * context table.  This is fine with all current HCAs, because
-         * we only use 32 EQs and each EQ uses 64 bytes of context
-         * memory, or 1 KB total.
-         */
-        priv->eq_table.icm_virt = icm_virt;
-        priv->eq_table.icm_page = alloc_page(GFP_HIGHUSER);
-        if (!priv->eq_table.icm_page)
-                return -ENOMEM;
-        priv->eq_table.icm_dma  = pci_map_page(dev->pdev, priv->eq_table.icm_page, 0,
-                                               PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
-        if (pci_dma_mapping_error(dev->pdev, priv->eq_table.icm_dma)) {
-                __free_page(priv->eq_table.icm_page);
-                return -ENOMEM;
-        }
-
-        ret = mlx4_MAP_ICM_page(dev, priv->eq_table.icm_dma, icm_virt);
-        if (ret) {
-                pci_unmap_page(dev->pdev, priv->eq_table.icm_dma, PAGE_SIZE,
-                               PCI_DMA_BIDIRECTIONAL);
-                __free_page(priv->eq_table.icm_page);
-        }
-
-        return ret;
-}
-
-void mlx4_unmap_eq_icm(struct mlx4_dev *dev)
-{
-        struct mlx4_priv *priv = mlx4_priv(dev);
-
-        mlx4_UNMAP_ICM(dev, priv->eq_table.icm_virt, 1);
-        pci_unmap_page(dev->pdev, priv->eq_table.icm_dma, PAGE_SIZE,
-                       PCI_DMA_BIDIRECTIONAL);
-        __free_page(priv->eq_table.icm_page);
-}
-
 int mlx4_alloc_eq_table(struct mlx4_dev *dev)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
@@ -615,7 +576,9 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
         priv->eq_table.clr_int  = priv->clr_base +
                 (priv->eq_table.inta_pin < 32 ? 4 : 0);
 
-        priv->eq_table.irq_names = kmalloc(16 * dev->caps.num_comp_vectors, GFP_KERNEL);
+        priv->eq_table.irq_names =
+                kmalloc(MLX4_IRQNAME_SIZE * (dev->caps.num_comp_vectors + 1),
+                        GFP_KERNEL);
         if (!priv->eq_table.irq_names) {
                 err = -ENOMEM;
                 goto err_out_bitmap;
@@ -638,17 +601,25 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
                 goto err_out_comp;
 
         if (dev->flags & MLX4_FLAG_MSI_X) {
-                static const char async_eq_name[] = "mlx4-async";
                 const char *eq_name;
 
                 for (i = 0; i < dev->caps.num_comp_vectors + 1; ++i) {
                         if (i < dev->caps.num_comp_vectors) {
-                                snprintf(priv->eq_table.irq_names + i * 16, 16,
-                                         "mlx4-comp-%d", i);
-                                eq_name = priv->eq_table.irq_names + i * 16;
-                        } else
-                                eq_name = async_eq_name;
+                                snprintf(priv->eq_table.irq_names +
+                                         i * MLX4_IRQNAME_SIZE,
+                                         MLX4_IRQNAME_SIZE,
+                                         "mlx4-comp-%d@pci:%s", i,
+                                         pci_name(dev->pdev));
+                        } else {
+                                snprintf(priv->eq_table.irq_names +
+                                         i * MLX4_IRQNAME_SIZE,
+                                         MLX4_IRQNAME_SIZE,
+                                         "mlx4-async@pci:%s",
+                                         pci_name(dev->pdev));
+                        }
 
+                        eq_name = priv->eq_table.irq_names +
+                                  i * MLX4_IRQNAME_SIZE;
                         err = request_irq(priv->eq_table.eq[i].irq,
                                           mlx4_msi_x_interrupt, 0, eq_name,
                                           priv->eq_table.eq + i);
@@ -658,8 +629,12 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
                         priv->eq_table.eq[i].have_irq = 1;
                 }
         } else {
+                snprintf(priv->eq_table.irq_names,
+                         MLX4_IRQNAME_SIZE,
+                         DRV_NAME "@pci:%s",
+                         pci_name(dev->pdev));
                 err = request_irq(dev->pdev->irq, mlx4_interrupt,
-                                  IRQF_SHARED, DRV_NAME, dev);
+                                  IRQF_SHARED, priv->eq_table.irq_names, dev);
                 if (err)
                         goto err_out_async;
 
diff --git a/drivers/net/mlx4/icm.c b/drivers/net/mlx4/icm.c
index baf4bf66062c..04b382fcb8c8 100644
--- a/drivers/net/mlx4/icm.c
+++ b/drivers/net/mlx4/icm.c
@@ -31,7 +31,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/mm.h>
 #include <linux/scatterlist.h>
diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
index dac621b1e9fc..3dd481e77f92 100644
--- a/drivers/net/mlx4/main.c
+++ b/drivers/net/mlx4/main.c
@@ -525,7 +525,10 @@ static int mlx4_init_icm(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap,
                 goto err_unmap_aux;
         }
 
-        err = mlx4_map_eq_icm(dev, init_hca->eqc_base);
+        err = mlx4_init_icm_table(dev, &priv->eq_table.table,
+                                  init_hca->eqc_base, dev_cap->eqc_entry_sz,
+                                  dev->caps.num_eqs, dev->caps.num_eqs,
+                                  0, 0);
         if (err) {
                 mlx4_err(dev, "Failed to map EQ context memory, aborting.\n");
                 goto err_unmap_cmpt;
@@ -668,7 +671,7 @@ err_unmap_mtt:
         mlx4_cleanup_icm_table(dev, &priv->mr_table.mtt_table);
 
 err_unmap_eq:
-        mlx4_unmap_eq_icm(dev);
+        mlx4_cleanup_icm_table(dev, &priv->eq_table.table);
 
 err_unmap_cmpt:
         mlx4_cleanup_icm_table(dev, &priv->eq_table.cmpt_table);
@@ -698,11 +701,11 @@ static void mlx4_free_icms(struct mlx4_dev *dev)
         mlx4_cleanup_icm_table(dev, &priv->qp_table.qp_table);
         mlx4_cleanup_icm_table(dev, &priv->mr_table.dmpt_table);
         mlx4_cleanup_icm_table(dev, &priv->mr_table.mtt_table);
+        mlx4_cleanup_icm_table(dev, &priv->eq_table.table);
         mlx4_cleanup_icm_table(dev, &priv->eq_table.cmpt_table);
         mlx4_cleanup_icm_table(dev, &priv->cq_table.cmpt_table);
         mlx4_cleanup_icm_table(dev, &priv->srq_table.cmpt_table);
         mlx4_cleanup_icm_table(dev, &priv->qp_table.cmpt_table);
-        mlx4_unmap_eq_icm(dev);
 
         mlx4_UNMAP_ICM_AUX(dev);
         mlx4_free_icm(dev, priv->fw.aux_icm, 0);
@@ -786,7 +789,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
         return 0;
 
 err_close:
-        mlx4_close_hca(dev);
+        mlx4_CLOSE_HCA(dev, 0);
 
 err_free_icm:
         mlx4_free_icms(dev);
@@ -1070,18 +1073,12 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 goto err_disable_pdev;
         }
 
-        err = pci_request_region(pdev, 0, DRV_NAME);
+        err = pci_request_regions(pdev, DRV_NAME);
         if (err) {
-                dev_err(&pdev->dev, "Cannot request control region, aborting.\n");
+                dev_err(&pdev->dev, "Couldn't get PCI resources, aborting\n");
                 goto err_disable_pdev;
         }
 
-        err = pci_request_region(pdev, 2, DRV_NAME);
-        if (err) {
-                dev_err(&pdev->dev, "Cannot request UAR region, aborting.\n");
-                goto err_release_bar0;
-        }
-
         pci_set_master(pdev);
 
         err = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
@@ -1090,7 +1087,7 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
                 if (err) {
                         dev_err(&pdev->dev, "Can't set PCI DMA mask, aborting.\n");
-                        goto err_release_bar2;
+                        goto err_release_regions;
                 }
         }
         err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
@@ -1101,7 +1098,7 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 if (err) {
                         dev_err(&pdev->dev, "Can't set consistent PCI DMA mask, "
                                 "aborting.\n");
-                        goto err_release_bar2;
+                        goto err_release_regions;
                 }
         }
 
@@ -1110,7 +1107,7 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 dev_err(&pdev->dev, "Device struct alloc failed, "
                         "aborting.\n");
                 err = -ENOMEM;
-                goto err_release_bar2;
+                goto err_release_regions;
         }
 
         dev       = &priv->dev;
@@ -1205,11 +1202,8 @@ err_cmd:
 err_free_dev:
         kfree(priv);
 
-err_release_bar2:
-        pci_release_region(pdev, 2);
-
-err_release_bar0:
-        pci_release_region(pdev, 0);
+err_release_regions:
+        pci_release_regions(pdev);
 
 err_disable_pdev:
         pci_disable_device(pdev);
@@ -1265,8 +1259,7 @@ static void mlx4_remove_one(struct pci_dev *pdev)
                         pci_disable_msix(pdev);
 
                 kfree(priv);
-                pci_release_region(pdev, 2);
-                pci_release_region(pdev, 0);
+                pci_release_regions(pdev);
                 pci_disable_device(pdev);
                 pci_set_drvdata(pdev, NULL);
         }
diff --git a/drivers/net/mlx4/mcg.c b/drivers/net/mlx4/mcg.c
index 6053c357a470..5ccbce9866fe 100644
--- a/drivers/net/mlx4/mcg.c
+++ b/drivers/net/mlx4/mcg.c
@@ -31,7 +31,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/string.h>
 #include <linux/slab.h>
 
diff --git a/drivers/net/mlx4/mlx4.h b/drivers/net/mlx4/mlx4.h
index 5bd79c2b184f..bc72d6e4919b 100644
--- a/drivers/net/mlx4/mlx4.h
+++ b/drivers/net/mlx4/mlx4.h
@@ -205,9 +205,7 @@ struct mlx4_eq_table {
         void __iomem          **uar_map;
         u32                     clr_mask;
         struct mlx4_eq         *eq;
-        u64                     icm_virt;
-        struct page            *icm_page;
-        dma_addr_t              icm_dma;
+        struct mlx4_icm_table   table;
         struct mlx4_icm_table   cmpt_table;
         int                     have_irq;
         u8                      inta_pin;
@@ -373,9 +371,6 @@ u64 mlx4_make_profile(struct mlx4_dev *dev,
                       struct mlx4_dev_cap *dev_cap,
                       struct mlx4_init_hca_param *init_hca);
 
-int mlx4_map_eq_icm(struct mlx4_dev *dev, u64 icm_virt);
-void mlx4_unmap_eq_icm(struct mlx4_dev *dev);
-
 int mlx4_cmd_init(struct mlx4_dev *dev);
 void mlx4_cmd_cleanup(struct mlx4_dev *dev);
 void mlx4_cmd_event(struct mlx4_dev *dev, u16 token, u8 status, u64 out_param);
diff --git a/drivers/net/mlx4/mr.c b/drivers/net/mlx4/mr.c
index f96948be0a44..ca7ab8e7b4cc 100644
--- a/drivers/net/mlx4/mr.c
+++ b/drivers/net/mlx4/mr.c
@@ -32,7 +32,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/errno.h>
 
 #include <linux/mlx4/cmd.h>
diff --git a/drivers/net/mlx4/pd.c b/drivers/net/mlx4/pd.c
index 26d1a7a9e375..c4988d6bd5b2 100644
--- a/drivers/net/mlx4/pd.c
+++ b/drivers/net/mlx4/pd.c
@@ -31,7 +31,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/errno.h>
 
 #include <asm/page.h>
diff --git a/drivers/net/mlx4/profile.c b/drivers/net/mlx4/profile.c
index bd22df95adf9..ca25b9dc8378 100644
--- a/drivers/net/mlx4/profile.c
+++ b/drivers/net/mlx4/profile.c
@@ -32,8 +32,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
-
 #include "mlx4.h"
 #include "fw.h"
 
diff --git a/drivers/net/mlx4/qp.c b/drivers/net/mlx4/qp.c
index 1c565ef8d179..42ab9fc01d3e 100644
--- a/drivers/net/mlx4/qp.c
+++ b/drivers/net/mlx4/qp.c
@@ -33,8 +33,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
-
 #include <linux/mlx4/cmd.h>
 #include <linux/mlx4/qp.h>
 
diff --git a/drivers/net/mlx4/reset.c b/drivers/net/mlx4/reset.c
index 3951b884c0fb..e5741dab3825 100644
--- a/drivers/net/mlx4/reset.c
+++ b/drivers/net/mlx4/reset.c
@@ -31,7 +31,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
diff --git a/drivers/net/mlx4/srq.c b/drivers/net/mlx4/srq.c
index fe9f218691f5..1377d0dc8f1f 100644
--- a/drivers/net/mlx4/srq.c
+++ b/drivers/net/mlx4/srq.c
@@ -31,8 +31,6 @@
  * SOFTWARE.
  */
 
-#include <linux/init.h>
-
 #include <linux/mlx4/cmd.h>
 
 #include "mlx4.h"
diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c
index 1c70e999cc50..7567f510eff5 100644
--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -196,21 +196,23 @@ static void PRINT_PKT(u_char *buf, int length)
 /* this enables an interrupt in the interrupt mask register */
 #define SMC_ENABLE_INT(lp, x) do {                                      \
         unsigned char mask;                                             \
-        spin_lock_irq(&lp->lock);                                       \
+        unsigned long smc_enable_flags;                                 \
+        spin_lock_irqsave(&lp->lock, smc_enable_flags);                 \
         mask = SMC_GET_INT_MASK(lp);                                    \
         mask |= (x);                                                    \
         SMC_SET_INT_MASK(lp, mask);                                     \
-        spin_unlock_irq(&lp->lock);                                     \
+        spin_unlock_irqrestore(&lp->lock, smc_enable_flags);            \
 } while (0)
 
 /* this disables an interrupt from the interrupt mask register */
 #define SMC_DISABLE_INT(lp, x) do {                                     \
         unsigned char mask;                                             \
-        spin_lock_irq(&lp->lock);                                       \
+        unsigned long smc_disable_flags;                                \
+        spin_lock_irqsave(&lp->lock, smc_disable_flags);                \
         mask = SMC_GET_INT_MASK(lp);                                    \
         mask &= ~(x);                                                   \
         SMC_SET_INT_MASK(lp, mask);                                     \
-        spin_unlock_irq(&lp->lock);                                     \
+        spin_unlock_irqrestore(&lp->lock, smc_disable_flags);           \
 } while (0)
 
 /*
@@ -520,21 +522,21 @@ static inline void  smc_rcv(struct net_device *dev)
  * any other concurrent access and C would always interrupt B. But life
  * isn't that easy in a SMP world...
  */
-#define smc_special_trylock(lock)                                       \
+#define smc_special_trylock(lock, flags)                                \
 ({                                                                      \
         int __ret;                                                      \
-        local_irq_disable();                                            \
+        local_irq_save(flags);                                          \
         __ret = spin_trylock(lock);                                     \
         if (!__ret)                                                     \
-                local_irq_enable();                                     \
+                local_irq_restore(flags);                               \
         __ret;                                                          \
 })
-#define smc_special_lock(lock)          spin_lock_irq(lock)
-#define smc_special_unlock(lock)        spin_unlock_irq(lock)
+#define smc_special_lock(lock, flags)           spin_lock_irqsave(lock, flags)
+#define smc_special_unlock(lock, flags)         spin_unlock_irqrestore(lock, flags)
 #else
-#define smc_special_trylock(lock)       (1)
-#define smc_special_lock(lock)          do { } while (0)
-#define smc_special_unlock(lock)        do { } while (0)
+#define smc_special_trylock(lock, flags)        (1)
+#define smc_special_lock(lock, flags)           do { } while (0)
+#define smc_special_unlock(lock, flags) do { } while (0)
 #endif
 
 /*
@@ -548,10 +550,11 @@ static void smc_hardware_send_pkt(unsigned long data)
         struct sk_buff *skb;
         unsigned int packet_no, len;
         unsigned char *buf;
+        unsigned long flags;
 
         DBG(3, "%s: %s\n", dev->name, __func__);
 
-        if (!smc_special_trylock(&lp->lock)) {
+        if (!smc_special_trylock(&lp->lock, flags)) {
                 netif_stop_queue(dev);
                 tasklet_schedule(&lp->tx_task);
                 return;
@@ -559,7 +562,7 @@ static void smc_hardware_send_pkt(unsigned long data)
 
         skb = lp->pending_tx_skb;
         if (unlikely(!skb)) {
-                smc_special_unlock(&lp->lock);
+                smc_special_unlock(&lp->lock, flags);
                 return;
         }
         lp->pending_tx_skb = NULL;
@@ -569,7 +572,7 @@ static void smc_hardware_send_pkt(unsigned long data)
                 printk("%s: Memory allocation failed.\n", dev->name);
                 dev->stats.tx_errors++;
                 dev->stats.tx_fifo_errors++;
-                smc_special_unlock(&lp->lock);
+                smc_special_unlock(&lp->lock, flags);
                 goto done;
         }
 
@@ -608,7 +611,7 @@ static void smc_hardware_send_pkt(unsigned long data)
 
         /* queue the packet for TX */
         SMC_SET_MMU_CMD(lp, MC_ENQUEUE);
-        smc_special_unlock(&lp->lock);
+        smc_special_unlock(&lp->lock, flags);
 
         dev->trans_start = jiffies;
         dev->stats.tx_packets++;
@@ -633,6 +636,7 @@ static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
         struct smc_local *lp = netdev_priv(dev);
         void __iomem *ioaddr = lp->base;
         unsigned int numPages, poll_count, status;
+        unsigned long flags;
 
         DBG(3, "%s: %s\n", dev->name, __func__);
 
@@ -658,7 +662,7 @@ static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 return 0;
         }
 
-        smc_special_lock(&lp->lock);
+        smc_special_lock(&lp->lock, flags);
 
         /* now, try to allocate the memory */
         SMC_SET_MMU_CMD(lp, MC_ALLOC | numPages);
@@ -676,7 +680,7 @@ static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
         } while (--poll_count);
 
-        smc_special_unlock(&lp->lock);
+        smc_special_unlock(&lp->lock, flags);
 
         lp->pending_tx_skb = skb;
         if (!poll_count) {
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 42b6c6319bc2..87214a257d2a 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -130,17 +130,10 @@ static inline struct tun_sock *tun_sk(struct sock *sk)
 static int tun_attach(struct tun_struct *tun, struct file *file)
 {
         struct tun_file *tfile = file->private_data;
-        const struct cred *cred = current_cred();
         int err;
 
         ASSERT_RTNL();
 
-        /* Check permissions */
-        if (((tun->owner != -1 && cred->euid != tun->owner) ||
-             (tun->group != -1 && !in_egroup_p(tun->group))) &&
-                !capable(CAP_NET_ADMIN))
-                return -EPERM;
-
         netif_tx_lock_bh(tun->dev);
 
         err = -EINVAL;
@@ -926,6 +919,8 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
         dev = __dev_get_by_name(net, ifr->ifr_name);
         if (dev) {
+                const struct cred *cred = current_cred();
+
                 if (ifr->ifr_flags & IFF_TUN_EXCL)
                         return -EBUSY;
                 if ((ifr->ifr_flags & IFF_TUN) && dev->netdev_ops == &tun_netdev_ops)
@@ -935,6 +930,14 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                 else
                         return -EINVAL;
 
+                if (((tun->owner != -1 && cred->euid != tun->owner) ||
+                     (tun->group != -1 && !in_egroup_p(tun->group))) &&
+                    !capable(CAP_NET_ADMIN))
+                        return -EPERM;
+                err = security_tun_dev_attach(tun->sk);
+                if (err < 0)
+                        return err;
+
                 err = tun_attach(tun, file);
                 if (err < 0)
                         return err;
@@ -947,6 +950,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
+                err = security_tun_dev_create();
+                if (err < 0)
+                        return err;
 
                 /* Set dev type */
                 if (ifr->ifr_flags & IFF_TUN) {
@@ -989,6 +995,8 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                 tun->sk = sk;
                 container_of(sk, struct tun_sock, sk)->tun = tun;
 
+                security_tun_dev_post_create(sk);
+
                 tun_net_init(dev);
 
                 if (strchr(dev->name, '%')) {
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 2a6e81d5b579..bbedf03a2124 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -70,6 +70,9 @@ struct virtnet_info
         struct sk_buff_head recv;
         struct sk_buff_head send;
 
+        /* Work struct for refilling if we run low on memory. */
+        struct delayed_work refill;
+
         /* Chain pages by the private ptr. */
         struct page *pages;
 };
@@ -273,19 +276,22 @@ drop:
         dev_kfree_skb(skb);
 }
 
-static void try_fill_recv_maxbufs(struct virtnet_info *vi)
+static bool try_fill_recv_maxbufs(struct virtnet_info *vi, gfp_t gfp)
 {
         struct sk_buff *skb;
         struct scatterlist sg[2+MAX_SKB_FRAGS];
         int num, err, i;
+        bool oom = false;
 
         sg_init_table(sg, 2+MAX_SKB_FRAGS);
         for (;;) {
                 struct virtio_net_hdr *hdr;
 
                 skb = netdev_alloc_skb(vi->dev, MAX_PACKET_LEN + NET_IP_ALIGN);
-                if (unlikely(!skb))
+                if (unlikely(!skb)) {
+                        oom = true;
                         break;
+                }
 
                 skb_reserve(skb, NET_IP_ALIGN);
                 skb_put(skb, MAX_PACKET_LEN);
@@ -296,7 +302,7 @@ static void try_fill_recv_maxbufs(struct virtnet_info *vi)
                 if (vi->big_packets) {
                         for (i = 0; i < MAX_SKB_FRAGS; i++) {
                                 skb_frag_t *f = &skb_shinfo(skb)->frags[i];
-                                f->page = get_a_page(vi, GFP_ATOMIC);
+                                f->page = get_a_page(vi, gfp);
                                 if (!f->page)
                                         break;
 
@@ -325,31 +331,35 @@ static void try_fill_recv_maxbufs(struct virtnet_info *vi)
         if (unlikely(vi->num > vi->max))
                 vi->max = vi->num;
         vi->rvq->vq_ops->kick(vi->rvq);
+        return !oom;
 }
 
-static void try_fill_recv(struct virtnet_info *vi)
+/* Returns false if we couldn't fill entirely (OOM). */
+static bool try_fill_recv(struct virtnet_info *vi, gfp_t gfp)
 {
         struct sk_buff *skb;
         struct scatterlist sg[1];
         int err;
+        bool oom = false;
 
-        if (!vi->mergeable_rx_bufs) {
-                try_fill_recv_maxbufs(vi);
-                return;
-        }
+        if (!vi->mergeable_rx_bufs)
+                return try_fill_recv_maxbufs(vi, gfp);
 
         for (;;) {
                 skb_frag_t *f;
 
                 skb = netdev_alloc_skb(vi->dev, GOOD_COPY_LEN + NET_IP_ALIGN);
-                if (unlikely(!skb))
+                if (unlikely(!skb)) {
+                        oom = true;
                         break;
+                }
 
                 skb_reserve(skb, NET_IP_ALIGN);
 
                 f = &skb_shinfo(skb)->frags[0];
-                f->page = get_a_page(vi, GFP_ATOMIC);
+                f->page = get_a_page(vi, gfp);
                 if (!f->page) {
+                        oom = true;
                         kfree_skb(skb);
                         break;
                 }
@@ -373,6 +383,7 @@ static void try_fill_recv(struct virtnet_info *vi)
         if (unlikely(vi->num > vi->max))
                 vi->max = vi->num;
         vi->rvq->vq_ops->kick(vi->rvq);
+        return !oom;
 }
 
 static void skb_recv_done(struct virtqueue *rvq)
@@ -385,6 +396,23 @@ static void skb_recv_done(struct virtqueue *rvq)
         }
 }
 
+static void refill_work(struct work_struct *work)
+{
+        struct virtnet_info *vi;
+        bool still_empty;
+
+        vi = container_of(work, struct virtnet_info, refill.work);
+        napi_disable(&vi->napi);
+        try_fill_recv(vi, GFP_KERNEL);
+        still_empty = (vi->num == 0);
+        napi_enable(&vi->napi);
+
+        /* In theory, this can happen: if we don't get any buffers in
+         * we will *never* try to fill again. */
+        if (still_empty)
+                schedule_delayed_work(&vi->refill, HZ/2);
+}
+
 static int virtnet_poll(struct napi_struct *napi, int budget)
 {
         struct virtnet_info *vi = container_of(napi, struct virtnet_info, napi);
@@ -400,10 +428,10 @@ again:
                 received++;
         }
 
-        /* FIXME: If we oom and completely run out of inbufs, we need
-         * to start a timer trying to fill more. */
-        if (vi->num < vi->max / 2)
-                try_fill_recv(vi);
+        if (vi->num < vi->max / 2) {
+                if (!try_fill_recv(vi, GFP_ATOMIC))
+                        schedule_delayed_work(&vi->refill, 0);
+        }
 
         /* Out of packets? */
         if (received < budget) {
@@ -893,6 +921,7 @@ static int virtnet_probe(struct virtio_device *vdev)
         vi->vdev = vdev;
         vdev->priv = vi;
         vi->pages = NULL;
+        INIT_DELAYED_WORK(&vi->refill, refill_work);
 
         /* If they give us a callback when all buffers are done, we don't need
          * the timer. */
@@ -941,7 +970,7 @@ static int virtnet_probe(struct virtio_device *vdev)
         }
 
         /* Last of all, set up some receive buffers. */
-        try_fill_recv(vi);
+        try_fill_recv(vi, GFP_KERNEL);
 
         /* If we didn't even get one input buffer, we're useless. */
         if (vi->num == 0) {
@@ -958,6 +987,7 @@ static int virtnet_probe(struct virtio_device *vdev)
 
 unregister:
         unregister_netdev(dev);
+        cancel_delayed_work_sync(&vi->refill);
 free_vqs:
         vdev->config->del_vqs(vdev);
 free:
@@ -986,6 +1016,7 @@ static void virtnet_remove(struct virtio_device *vdev)
         BUG_ON(vi->num != 0);
 
         unregister_netdev(vi->dev);
+        cancel_delayed_work_sync(&vi->refill);
 
         vdev->config->del_vqs(vi->vdev);
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 6dcac73b4d29..f593fbbb4e52 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -2874,45 +2874,27 @@ static int ipw_fw_dma_add_command_block(struct ipw_priv *priv,
         return 0;
 }
 
-static int ipw_fw_dma_add_buffer(struct ipw_priv *priv,
-                                 u32 src_phys, u32 dest_address, u32 length)
+static int ipw_fw_dma_add_buffer(struct ipw_priv *priv, dma_addr_t *src_address,
+                                 int nr, u32 dest_address, u32 len)
 {
-        u32 bytes_left = length;
-        u32 src_offset = 0;
-        u32 dest_offset = 0;
-        int status = 0;
+        int ret, i;
+        u32 size;
+
         IPW_DEBUG_FW(">> \n");
-        IPW_DEBUG_FW_INFO("src_phys=0x%x dest_address=0x%x length=0x%x\n",
-                          src_phys, dest_address, length);
-        while (bytes_left > CB_MAX_LENGTH) {
-                status = ipw_fw_dma_add_command_block(priv,
-                                                      src_phys + src_offset,
-                                                      dest_address +
-                                                      dest_offset,
-                                                      CB_MAX_LENGTH, 0, 0);
-                if (status) {
+        IPW_DEBUG_FW_INFO("nr=%d dest_address=0x%x len=0x%x\n",
+                          nr, dest_address, len);
+
+        for (i = 0; i < nr; i++) {
+                size = min_t(u32, len - i * CB_MAX_LENGTH, CB_MAX_LENGTH);
+                ret = ipw_fw_dma_add_command_block(priv, src_address[i],
+                                                   dest_address +
+                                                   i * CB_MAX_LENGTH, size,
+                                                   0, 0);
+                if (ret) {
                         IPW_DEBUG_FW_INFO(": Failed\n");
                         return -1;
                 } else
                         IPW_DEBUG_FW_INFO(": Added new cb\n");
-
-                src_offset += CB_MAX_LENGTH;
-                dest_offset += CB_MAX_LENGTH;
-                bytes_left -= CB_MAX_LENGTH;
-        }
-
-        /* add the buffer tail */
-        if (bytes_left > 0) {
-                status =
-                    ipw_fw_dma_add_command_block(priv, src_phys + src_offset,
-                                                 dest_address + dest_offset,
-                                                 bytes_left, 0, 0);
-                if (status) {
-                        IPW_DEBUG_FW_INFO(": Failed on the buffer tail\n");
-                        return -1;
-                } else
-                        IPW_DEBUG_FW_INFO
-                            (": Adding new cb - the buffer tail\n");
         }
 
         IPW_DEBUG_FW("<< \n");
@@ -3160,59 +3142,91 @@ static int ipw_load_ucode(struct ipw_priv *priv, u8 * data, size_t len)
 
 static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
 {
-        int rc = -1;
+        int ret = -1;
         int offset = 0;
         struct fw_chunk *chunk;
-        dma_addr_t shared_phys;
-        u8 *shared_virt;
+        int total_nr = 0;
+        int i;
+        struct pci_pool *pool;
+        u32 *virts[CB_NUMBER_OF_ELEMENTS_SMALL];
+        dma_addr_t phys[CB_NUMBER_OF_ELEMENTS_SMALL];
 
         IPW_DEBUG_TRACE("<< : \n");
-        shared_virt = pci_alloc_consistent(priv->pci_dev, len, &shared_phys);
 
-        if (!shared_virt)
+        pool = pci_pool_create("ipw2200", priv->pci_dev, CB_MAX_LENGTH, 0, 0);
+        if (!pool) {
+                IPW_ERROR("pci_pool_create failed\n");
                 return -ENOMEM;
-
-        memmove(shared_virt, data, len);
+        }
 
         /* Start the Dma */
-        rc = ipw_fw_dma_enable(priv);
+        ret = ipw_fw_dma_enable(priv);
 
         /* the DMA is already ready this would be a bug. */
         BUG_ON(priv->sram_desc.last_cb_index > 0);
 
         do {
+                u32 chunk_len;
+                u8 *start;
+                int size;
+                int nr = 0;
+
                 chunk = (struct fw_chunk *)(data + offset);
                 offset += sizeof(struct fw_chunk);
+                chunk_len = le32_to_cpu(chunk->length);
+                start = data + offset;
+
+                nr = (chunk_len + CB_MAX_LENGTH - 1) / CB_MAX_LENGTH;
+                for (i = 0; i < nr; i++) {
+                        virts[total_nr] = pci_pool_alloc(pool, GFP_KERNEL,
+                                                         &phys[total_nr]);
+                        if (!virts[total_nr]) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
+                        size = min_t(u32, chunk_len - i * CB_MAX_LENGTH,
+                                     CB_MAX_LENGTH);
+                        memcpy(virts[total_nr], start, size);
+                        start += size;
+                        total_nr++;
+                        /* We don't support fw chunk larger than 64*8K */
+                        BUG_ON(total_nr > CB_NUMBER_OF_ELEMENTS_SMALL);
+                }
+
                 /* build DMA packet and queue up for sending */
                 /* dma to chunk->address, the chunk->length bytes from data +
                  * offeset*/
                 /* Dma loading */
-                rc = ipw_fw_dma_add_buffer(priv, shared_phys + offset,
-                                           le32_to_cpu(chunk->address),
-                                           le32_to_cpu(chunk->length));
-                if (rc) {
+                ret = ipw_fw_dma_add_buffer(priv, &phys[total_nr - nr],
+                                            nr, le32_to_cpu(chunk->address),
+                                            chunk_len);
+                if (ret) {
                         IPW_DEBUG_INFO("dmaAddBuffer Failed\n");
                         goto out;
                 }
 
-                offset += le32_to_cpu(chunk->length);
+                offset += chunk_len;
         } while (offset < len);
 
         /* Run the DMA and wait for the answer */
-        rc = ipw_fw_dma_kick(priv);
-        if (rc) {
+        ret = ipw_fw_dma_kick(priv);
+        if (ret) {
                 IPW_ERROR("dmaKick Failed\n");
                 goto out;
         }
 
-        rc = ipw_fw_dma_wait(priv);
-        if (rc) {
+        ret = ipw_fw_dma_wait(priv);
+        if (ret) {
                 IPW_ERROR("dmaWaitSync Failed\n");
                 goto out;
         }
-      out:
-        pci_free_consistent(priv->pci_dev, len, shared_virt, shared_phys);
-        return rc;
+ out:
+        for (i = 0; i < total_nr; i++)
+                pci_pool_free(pool, virts[i], phys[i]);
+
+        pci_pool_destroy(pool);
+
+        return ret;
 }
 
 /* stop nic */
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index 632fac86a308..b3946272c72e 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -70,7 +70,7 @@ int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key, u8 *tsc)
         int err = 0;
         u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE];
 
-        if ((key < 0) || (key > 4))
+        if ((key < 0) || (key >= 4))
                 return -EINVAL;
 
         err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV,
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 294250e294dd..87a95588a8e3 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -869,6 +869,9 @@ static int rtl8187b_init_hw(struct ieee80211_hw *dev)
         priv->aifsn[3] = 3; /* AIFSN[AC_BE] */
         rtl818x_iowrite8(priv, &priv->map->ACM_CONTROL, 0);
 
+        /* ENEDCA flag must always be set, transmit issues? */
+        rtl818x_iowrite8(priv, &priv->map->MSR, RTL818X_MSR_ENEDCA);
+
         return 0;
 }
 
@@ -1173,13 +1176,16 @@ static void rtl8187_bss_info_changed(struct ieee80211_hw *dev,
                         rtl818x_iowrite8(priv, &priv->map->BSSID[i],
                                          info->bssid[i]);
 
+                if (priv->is_rtl8187b)
+                        reg = RTL818X_MSR_ENEDCA;
+                else
+                        reg = 0;
+
                 if (is_valid_ether_addr(info->bssid)) {
-                        reg = RTL818X_MSR_INFRA;
-                        if (priv->is_rtl8187b)
-                                reg |= RTL818X_MSR_ENEDCA;
+                        reg |= RTL818X_MSR_INFRA;
                         rtl818x_iowrite8(priv, &priv->map->MSR, reg);
                 } else {
-                        reg = RTL818X_MSR_NO_LINK;
+                        reg |= RTL818X_MSR_NO_LINK;
                         rtl818x_iowrite8(priv, &priv->map->MSR, reg);
                 }
 
diff --git a/drivers/net/yellowfin.c b/drivers/net/yellowfin.c
index a07580138e81..c2fd6187773f 100644
--- a/drivers/net/yellowfin.c
+++ b/drivers/net/yellowfin.c
@@ -346,7 +346,7 @@ static int netdev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 static int yellowfin_open(struct net_device *dev);
 static void yellowfin_timer(unsigned long data);
 static void yellowfin_tx_timeout(struct net_device *dev);
-static void yellowfin_init_ring(struct net_device *dev);
+static int yellowfin_init_ring(struct net_device *dev);
 static int yellowfin_start_xmit(struct sk_buff *skb, struct net_device *dev);
 static irqreturn_t yellowfin_interrupt(int irq, void *dev_instance);
 static int yellowfin_rx(struct net_device *dev);
@@ -573,19 +573,24 @@ static int yellowfin_open(struct net_device *dev)
 {
         struct yellowfin_private *yp = netdev_priv(dev);
         void __iomem *ioaddr = yp->base;
-        int i;
+        int i, ret;
 
         /* Reset the chip. */
         iowrite32(0x80000000, ioaddr + DMACtrl);
 
-        i = request_irq(dev->irq, &yellowfin_interrupt, IRQF_SHARED, dev->name, dev);
-        if (i) return i;
+        ret = request_irq(dev->irq, &yellowfin_interrupt, IRQF_SHARED, dev->name, dev);
+        if (ret)
+                return ret;
 
         if (yellowfin_debug > 1)
                 printk(KERN_DEBUG "%s: yellowfin_open() irq %d.\n",
                            dev->name, dev->irq);
 
-        yellowfin_init_ring(dev);
+        ret = yellowfin_init_ring(dev);
+        if (ret) {
+                free_irq(dev->irq, dev);
+                return ret;
+        }
 
         iowrite32(yp->rx_ring_dma, ioaddr + RxPtr);
         iowrite32(yp->tx_ring_dma, ioaddr + TxPtr);
@@ -725,10 +730,10 @@ static void yellowfin_tx_timeout(struct net_device *dev)
 }
 
 /* Initialize the Rx and Tx rings, along with various 'dev' bits. */
-static void yellowfin_init_ring(struct net_device *dev)
+static int yellowfin_init_ring(struct net_device *dev)
 {
         struct yellowfin_private *yp = netdev_priv(dev);
-        int i;
+        int i, j;
 
         yp->tx_full = 0;
         yp->cur_rx = yp->cur_tx = 0;
@@ -753,6 +758,11 @@ static void yellowfin_init_ring(struct net_device *dev)
                 yp->rx_ring[i].addr = cpu_to_le32(pci_map_single(yp->pci_dev,
                         skb->data, yp->rx_buf_sz, PCI_DMA_FROMDEVICE));
         }
+        if (i != RX_RING_SIZE) {
+                for (j = 0; j < i; j++)
+                        dev_kfree_skb(yp->rx_skbuff[j]);
+                return -ENOMEM;
+        }
         yp->rx_ring[i-1].dbdma_cmd = cpu_to_le32(CMD_STOP);
         yp->dirty_rx = (unsigned int)(i - RX_RING_SIZE);
 
@@ -769,8 +779,6 @@ static void yellowfin_init_ring(struct net_device *dev)
         yp->tx_ring[--i].dbdma_cmd = cpu_to_le32(CMD_STOP | BRANCH_ALWAYS);
 #else
 {
-        int j;
-
         /* Tx ring needs a pair of descriptors, the second for the status. */
         for (i = 0; i < TX_RING_SIZE; i++) {
                 j = 2*i;
@@ -805,7 +813,7 @@ static void yellowfin_init_ring(struct net_device *dev)
 }
 #endif
         yp->tx_tail_desc = &yp->tx_status[0];
-        return;
+        return 0;
 }
 
 static int yellowfin_start_xmit(struct sk_buff *skb, struct net_device *dev)