Merge branch 'wip-2.6.34' into old-private-masterarchived-private-master

1 files changed, 278 insertions, 215 deletions

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index b9e002fccbca..b0577dd1a42d 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -25,6 +25,7 @@
 #include <linux/virtio_net.h>
 #include <linux/scatterlist.h>
 #include <linux/if_vlan.h>
+#include <linux/slab.h>
 
 static int napi_weight = 128;
 module_param(napi_weight, int, 0444);
@@ -56,10 +57,6 @@ struct virtnet_info
         /* Host will merge rx buffers for big packets (shake it! shake it!) */
         bool mergeable_rx_bufs;
 
-        /* Receive & send queues. */
-        struct sk_buff_head recv;
-        struct sk_buff_head send;
-
         /* Work struct for refilling if we run low on memory. */
         struct delayed_work refill;
 
@@ -75,34 +72,44 @@ struct skb_vnet_hdr {
         unsigned int num_sg;
 };
 
+struct padded_vnet_hdr {
+        struct virtio_net_hdr hdr;
+        /*
+         * virtio_net_hdr should be in a separated sg buffer because of a
+         * QEMU bug, and data sg buffer shares same page with this header sg.
+         * This padding makes next sg 16 byte aligned after virtio_net_hdr.
+         */
+        char padding[6];
+};
+
 static inline struct skb_vnet_hdr *skb_vnet_hdr(struct sk_buff *skb)
 {
         return (struct skb_vnet_hdr *)skb->cb;
 }
 
-static void give_a_page(struct virtnet_info *vi, struct page *page)
-{
-        page->private = (unsigned long)vi->pages;
-        vi->pages = page;
-}
-
-static void trim_pages(struct virtnet_info *vi, struct sk_buff *skb)
+/*
+ * private is used to chain pages for big packets, put the whole
+ * most recent used list in the beginning for reuse
+ */
+static void give_pages(struct virtnet_info *vi, struct page *page)
 {
-        unsigned int i;
+        struct page *end;
 
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
-                give_a_page(vi, skb_shinfo(skb)->frags[i].page);
-        skb_shinfo(skb)->nr_frags = 0;
-        skb->data_len = 0;
+        /* Find end of list, sew whole thing into vi->pages. */
+        for (end = page; end->private; end = (struct page *)end->private);
+        end->private = (unsigned long)vi->pages;
+        vi->pages = page;
 }
 
 static struct page *get_a_page(struct virtnet_info *vi, gfp_t gfp_mask)
 {
         struct page *p = vi->pages;
 
-        if (p)
+        if (p) {
                 vi->pages = (struct page *)p->private;
-        else
+                /* clear private here, it is used to chain pages */
+                p->private = 0;
+        } else
                 p = alloc_page(gfp_mask);
         return p;
 }
@@ -118,99 +125,142 @@ static void skb_xmit_done(struct virtqueue *svq)
         netif_wake_queue(vi->dev);
 }
 
-static void receive_skb(struct net_device *dev, struct sk_buff *skb,
-                        unsigned len)
+static void set_skb_frag(struct sk_buff *skb, struct page *page,
+                         unsigned int offset, unsigned int *len)
 {
-        struct virtnet_info *vi = netdev_priv(dev);
-        struct skb_vnet_hdr *hdr = skb_vnet_hdr(skb);
-        int err;
-        int i;
-
-        if (unlikely(len < sizeof(struct virtio_net_hdr) + ETH_HLEN)) {
-                pr_debug("%s: short packet %i\n", dev->name, len);
-                dev->stats.rx_length_errors++;
-                goto drop;
-        }
+        int i = skb_shinfo(skb)->nr_frags;
+        skb_frag_t *f;
+
+        f = &skb_shinfo(skb)->frags[i];
+        f->size = min((unsigned)PAGE_SIZE - offset, *len);
+        f->page_offset = offset;
+        f->page = page;
+
+        skb->data_len += f->size;
+        skb->len += f->size;
+        skb_shinfo(skb)->nr_frags++;
+        *len -= f->size;
+}
 
-        if (vi->mergeable_rx_bufs) {
-                unsigned int copy;
-                char *p = page_address(skb_shinfo(skb)->frags[0].page);
+static struct sk_buff *page_to_skb(struct virtnet_info *vi,
+                                   struct page *page, unsigned int len)
+{
+        struct sk_buff *skb;
+        struct skb_vnet_hdr *hdr;
+        unsigned int copy, hdr_len, offset;
+        char *p;
 
-                if (len > PAGE_SIZE)
-                        len = PAGE_SIZE;
-                len -= sizeof(struct virtio_net_hdr_mrg_rxbuf);
+        p = page_address(page);
 
-                memcpy(&hdr->mhdr, p, sizeof(hdr->mhdr));
-                p += sizeof(hdr->mhdr);
+        /* copy small packet so we can reuse these pages for small data */
+        skb = netdev_alloc_skb_ip_align(vi->dev, GOOD_COPY_LEN);
+        if (unlikely(!skb))
+                return NULL;
 
-                copy = len;
-                if (copy > skb_tailroom(skb))
-                        copy = skb_tailroom(skb);
+        hdr = skb_vnet_hdr(skb);
 
-                memcpy(skb_put(skb, copy), p, copy);
+        if (vi->mergeable_rx_bufs) {
+                hdr_len = sizeof hdr->mhdr;
+                offset = hdr_len;
+        } else {
+                hdr_len = sizeof hdr->hdr;
+                offset = sizeof(struct padded_vnet_hdr);
+        }
 
-                len -= copy;
+        memcpy(hdr, p, hdr_len);
 
-                if (!len) {
-                        give_a_page(vi, skb_shinfo(skb)->frags[0].page);
-                        skb_shinfo(skb)->nr_frags--;
-                } else {
-                        skb_shinfo(skb)->frags[0].page_offset +=
-                                sizeof(hdr->mhdr) + copy;
-                        skb_shinfo(skb)->frags[0].size = len;
-                        skb->data_len += len;
-                        skb->len += len;
-                }
+        len -= hdr_len;
+        p += offset;
 
-                while (--hdr->mhdr.num_buffers) {
-                        struct sk_buff *nskb;
+        copy = len;
+        if (copy > skb_tailroom(skb))
+                copy = skb_tailroom(skb);
+        memcpy(skb_put(skb, copy), p, copy);
 
-                        i = skb_shinfo(skb)->nr_frags;
-                        if (i >= MAX_SKB_FRAGS) {
-                                pr_debug("%s: packet too long %d\n", dev->name,
-                                         len);
-                                dev->stats.rx_length_errors++;
-                                goto drop;
-                        }
+        len -= copy;
+        offset += copy;
 
-                        nskb = vi->rvq->vq_ops->get_buf(vi->rvq, &len);
-                        if (!nskb) {
-                                pr_debug("%s: rx error: %d buffers missing\n",
-                                         dev->name, hdr->mhdr.num_buffers);
-                                dev->stats.rx_length_errors++;
-                                goto drop;
-                        }
+        while (len) {
+                set_skb_frag(skb, page, offset, &len);
+                page = (struct page *)page->private;
+                offset = 0;
+        }
 
-                        __skb_unlink(nskb, &vi->recv);
-                        vi->num--;
+        if (page)
+                give_pages(vi, page);
 
-                        skb_shinfo(skb)->frags[i] = skb_shinfo(nskb)->frags[0];
-                        skb_shinfo(nskb)->nr_frags = 0;
-                        kfree_skb(nskb);
+        return skb;
+}
 
-                        if (len > PAGE_SIZE)
-                                len = PAGE_SIZE;
+static int receive_mergeable(struct virtnet_info *vi, struct sk_buff *skb)
+{
+        struct skb_vnet_hdr *hdr = skb_vnet_hdr(skb);
+        struct page *page;
+        int num_buf, i, len;
+
+        num_buf = hdr->mhdr.num_buffers;
+        while (--num_buf) {
+                i = skb_shinfo(skb)->nr_frags;
+                if (i >= MAX_SKB_FRAGS) {
+                        pr_debug("%s: packet too long\n", skb->dev->name);
+                        skb->dev->stats.rx_length_errors++;
+                        return -EINVAL;
+                }
 
-                        skb_shinfo(skb)->frags[i].size = len;
-                        skb_shinfo(skb)->nr_frags++;
-                        skb->data_len += len;
-                        skb->len += len;
+                page = vi->rvq->vq_ops->get_buf(vi->rvq, &len);
+                if (!page) {
+                        pr_debug("%s: rx error: %d buffers missing\n",
+                                 skb->dev->name, hdr->mhdr.num_buffers);
+                        skb->dev->stats.rx_length_errors++;
+                        return -EINVAL;
                 }
-        } else {
-                len -= sizeof(hdr->hdr);
+                if (len > PAGE_SIZE)
+                        len = PAGE_SIZE;
+
+                set_skb_frag(skb, page, 0, &len);
+
+                --vi->num;
+        }
+        return 0;
+}
 
-                if (len <= MAX_PACKET_LEN)
-                        trim_pages(vi, skb);
+static void receive_buf(struct net_device *dev, void *buf, unsigned int len)
+{
+        struct virtnet_info *vi = netdev_priv(dev);
+        struct sk_buff *skb;
+        struct page *page;
+        struct skb_vnet_hdr *hdr;
 
-                err = pskb_trim(skb, len);
-                if (err) {
-                        pr_debug("%s: pskb_trim failed %i %d\n", dev->name,
-                                 len, err);
+        if (unlikely(len < sizeof(struct virtio_net_hdr) + ETH_HLEN)) {
+                pr_debug("%s: short packet %i\n", dev->name, len);
+                dev->stats.rx_length_errors++;
+                if (vi->mergeable_rx_bufs || vi->big_packets)
+                        give_pages(vi, buf);
+                else
+                        dev_kfree_skb(buf);
+                return;
+        }
+
+        if (!vi->mergeable_rx_bufs && !vi->big_packets) {
+                skb = buf;
+                len -= sizeof(struct virtio_net_hdr);
+                skb_trim(skb, len);
+        } else {
+                page = buf;
+                skb = page_to_skb(vi, page, len);
+                if (unlikely(!skb)) {
                         dev->stats.rx_dropped++;
-                        goto drop;
+                        give_pages(vi, page);
+                        return;
                 }
+                if (vi->mergeable_rx_bufs)
+                        if (receive_mergeable(vi, skb)) {
+                                dev_kfree_skb(skb);
+                                return;
+                        }
         }
 
+        hdr = skb_vnet_hdr(skb);
         skb->truesize += skb->data_len;
         dev->stats.rx_bytes += skb->len;
         dev->stats.rx_packets++;
@@ -267,113 +317,121 @@ static void receive_skb(struct net_device *dev, struct sk_buff *skb,
 
 frame_err:
         dev->stats.rx_frame_errors++;
-drop:
         dev_kfree_skb(skb);
 }
 
-static bool try_fill_recv_maxbufs(struct virtnet_info *vi, gfp_t gfp)
+static int add_recvbuf_small(struct virtnet_info *vi, gfp_t gfp)
 {
         struct sk_buff *skb;
-        struct scatterlist sg[2+MAX_SKB_FRAGS];
-        int num, err, i;
-        bool oom = false;
-
-        sg_init_table(sg, 2+MAX_SKB_FRAGS);
-        do {
-                struct skb_vnet_hdr *hdr;
+        struct skb_vnet_hdr *hdr;
+        struct scatterlist sg[2];
+        int err;
 
-                skb = netdev_alloc_skb(vi->dev, MAX_PACKET_LEN + NET_IP_ALIGN);
-                if (unlikely(!skb)) {
-                        oom = true;
-                        break;
-                }
+        sg_init_table(sg, 2);
+        skb = netdev_alloc_skb_ip_align(vi->dev, MAX_PACKET_LEN);
+        if (unlikely(!skb))
+                return -ENOMEM;
 
-                skb_reserve(skb, NET_IP_ALIGN);
-                skb_put(skb, MAX_PACKET_LEN);
+        skb_put(skb, MAX_PACKET_LEN);
 
-                hdr = skb_vnet_hdr(skb);
-                sg_set_buf(sg, &hdr->hdr, sizeof(hdr->hdr));
+        hdr = skb_vnet_hdr(skb);
+        sg_set_buf(sg, &hdr->hdr, sizeof hdr->hdr);
 
-                if (vi->big_packets) {
-                        for (i = 0; i < MAX_SKB_FRAGS; i++) {
-                                skb_frag_t *f = &skb_shinfo(skb)->frags[i];
-                                f->page = get_a_page(vi, gfp);
-                                if (!f->page)
-                                        break;
+        skb_to_sgvec(skb, sg + 1, 0, skb->len);
 
-                                f->page_offset = 0;
-                                f->size = PAGE_SIZE;
+        err = vi->rvq->vq_ops->add_buf(vi->rvq, sg, 0, 2, skb);
+        if (err < 0)
+                dev_kfree_skb(skb);
 
-                                skb->data_len += PAGE_SIZE;
-                                skb->len += PAGE_SIZE;
+        return err;
+}
 
-                                skb_shinfo(skb)->nr_frags++;
-                        }
+static int add_recvbuf_big(struct virtnet_info *vi, gfp_t gfp)
+{
+        struct scatterlist sg[MAX_SKB_FRAGS + 2];
+        struct page *first, *list = NULL;
+        char *p;
+        int i, err, offset;
+
+        sg_init_table(sg, MAX_SKB_FRAGS + 2);
+        /* page in sg[MAX_SKB_FRAGS + 1] is list tail */
+        for (i = MAX_SKB_FRAGS + 1; i > 1; --i) {
+                first = get_a_page(vi, gfp);
+                if (!first) {
+                        if (list)
+                                give_pages(vi, list);
+                        return -ENOMEM;
                 }
+                sg_set_buf(&sg[i], page_address(first), PAGE_SIZE);
 
-                num = skb_to_sgvec(skb, sg+1, 0, skb->len) + 1;
-                skb_queue_head(&vi->recv, skb);
+                /* chain new page in list head to match sg */
+                first->private = (unsigned long)list;
+                list = first;
+        }
 
-                err = vi->rvq->vq_ops->add_buf(vi->rvq, sg, 0, num, skb);
-                if (err < 0) {
-                        skb_unlink(skb, &vi->recv);
-                        trim_pages(vi, skb);
-                        kfree_skb(skb);
-                        break;
-                }
-                vi->num++;
-        } while (err >= num);
-        if (unlikely(vi->num > vi->max))
-                vi->max = vi->num;
-        vi->rvq->vq_ops->kick(vi->rvq);
-        return !oom;
+        first = get_a_page(vi, gfp);
+        if (!first) {
+                give_pages(vi, list);
+                return -ENOMEM;
+        }
+        p = page_address(first);
+
+        /* sg[0], sg[1] share the same page */
+        /* a separated sg[0] for  virtio_net_hdr only during to QEMU bug*/
+        sg_set_buf(&sg[0], p, sizeof(struct virtio_net_hdr));
+
+        /* sg[1] for data packet, from offset */
+        offset = sizeof(struct padded_vnet_hdr);
+        sg_set_buf(&sg[1], p + offset, PAGE_SIZE - offset);
+
+        /* chain first in list head */
+        first->private = (unsigned long)list;
+        err = vi->rvq->vq_ops->add_buf(vi->rvq, sg, 0, MAX_SKB_FRAGS + 2,
+                                       first);
+        if (err < 0)
+                give_pages(vi, first);
+
+        return err;
 }
 
-/* Returns false if we couldn't fill entirely (OOM). */
-static bool try_fill_recv(struct virtnet_info *vi, gfp_t gfp)
+static int add_recvbuf_mergeable(struct virtnet_info *vi, gfp_t gfp)
 {
-        struct sk_buff *skb;
-        struct scatterlist sg[1];
+        struct page *page;
+        struct scatterlist sg;
         int err;
-        bool oom = false;
 
-        if (!vi->mergeable_rx_bufs)
-                return try_fill_recv_maxbufs(vi, gfp);
-
-        do {
-                skb_frag_t *f;
-
-                skb = netdev_alloc_skb(vi->dev, GOOD_COPY_LEN + NET_IP_ALIGN);
-                if (unlikely(!skb)) {
-                        oom = true;
-                        break;
-                }
+        page = get_a_page(vi, gfp);
+        if (!page)
+                return -ENOMEM;
 
-                skb_reserve(skb, NET_IP_ALIGN);
+        sg_init_one(&sg, page_address(page), PAGE_SIZE);
 
-                f = &skb_shinfo(skb)->frags[0];
-                f->page = get_a_page(vi, gfp);
-                if (!f->page) {
-                        oom = true;
-                        kfree_skb(skb);
-                        break;
-                }
+        err = vi->rvq->vq_ops->add_buf(vi->rvq, &sg, 0, 1, page);
+        if (err < 0)
+                give_pages(vi, page);
 
-                f->page_offset = 0;
-                f->size = PAGE_SIZE;
+        return err;
+}
 
-                skb_shinfo(skb)->nr_frags++;
+/* Returns false if we couldn't fill entirely (OOM). */
+static bool try_fill_recv(struct virtnet_info *vi, gfp_t gfp)
+{
+        int err;
+        bool oom = false;
 
-                sg_init_one(sg, page_address(f->page), PAGE_SIZE);
-                skb_queue_head(&vi->recv, skb);
+        do {
+                if (vi->mergeable_rx_bufs)
+                        err = add_recvbuf_mergeable(vi, gfp);
+                else if (vi->big_packets)
+                        err = add_recvbuf_big(vi, gfp);
+                else
+                        err = add_recvbuf_small(vi, gfp);
 
-                err = vi->rvq->vq_ops->add_buf(vi->rvq, sg, 0, 1, skb);
                 if (err < 0) {
-                        skb_unlink(skb, &vi->recv);
-                        kfree_skb(skb);
+                        oom = true;
                         break;
                 }
-                vi->num++;
+                ++vi->num;
         } while (err > 0);
         if (unlikely(vi->num > vi->max))
                 vi->max = vi->num;
@@ -398,8 +456,7 @@ static void refill_work(struct work_struct *work)
 
         vi = container_of(work, struct virtnet_info, refill.work);
         napi_disable(&vi->napi);
-        try_fill_recv(vi, GFP_KERNEL);
-        still_empty = (vi->num == 0);
+        still_empty = !try_fill_recv(vi, GFP_KERNEL);
         napi_enable(&vi->napi);
 
         /* In theory, this can happen: if we don't get any buffers in
@@ -411,15 +468,14 @@ static void refill_work(struct work_struct *work)
 static int virtnet_poll(struct napi_struct *napi, int budget)
 {
         struct virtnet_info *vi = container_of(napi, struct virtnet_info, napi);
-        struct sk_buff *skb = NULL;
+        void *buf;
         unsigned int len, received = 0;
 
 again:
         while (received < budget &&
-               (skb = vi->rvq->vq_ops->get_buf(vi->rvq, &len)) != NULL) {
-                __skb_unlink(skb, &vi->recv);
-                receive_skb(vi->dev, skb, len);
-                vi->num--;
+               (buf = vi->rvq->vq_ops->get_buf(vi->rvq, &len)) != NULL) {
+                receive_buf(vi->dev, buf, len);
+                --vi->num;
                 received++;
         }
 
@@ -431,8 +487,8 @@ again:
         /* Out of packets? */
         if (received < budget) {
                 napi_complete(napi);
-                if (unlikely(!vi->rvq->vq_ops->enable_cb(vi->rvq))
-                    && napi_schedule_prep(napi)) {
+                if (unlikely(!vi->rvq->vq_ops->enable_cb(vi->rvq)) &&
+                    napi_schedule_prep(napi)) {
                         vi->rvq->vq_ops->disable_cb(vi->rvq);
                         __napi_schedule(napi);
                         goto again;
@@ -449,7 +505,6 @@ static unsigned int free_old_xmit_skbs(struct virtnet_info *vi)
 
         while ((skb = vi->svq->vq_ops->get_buf(vi->svq, &len)) != NULL) {
                 pr_debug("Sent skb %p\n", skb);
-                __skb_unlink(skb, &vi->send);
                 vi->dev->stats.tx_bytes += skb->len;
                 vi->dev->stats.tx_packets++;
                 tot_sgs += skb_vnet_hdr(skb)->num_sg;
@@ -499,9 +554,9 @@ static int xmit_skb(struct virtnet_info *vi, struct sk_buff *skb)
 
         /* Encode metadata header at front. */
         if (vi->mergeable_rx_bufs)
-                sg_set_buf(sg, &hdr->mhdr, sizeof(hdr->mhdr));
+                sg_set_buf(sg, &hdr->mhdr, sizeof hdr->mhdr);
         else
-                sg_set_buf(sg, &hdr->hdr, sizeof(hdr->hdr));
+                sg_set_buf(sg, &hdr->hdr, sizeof hdr->hdr);
 
         hdr->num_sg = skb_to_sgvec(skb, sg+1, 0, skb->len) + 1;
         return vi->svq->vq_ops->add_buf(vi->svq, sg, hdr->num_sg, 0, skb);
@@ -532,15 +587,6 @@ again:
         }
         vi->svq->vq_ops->kick(vi->svq);
 
-        /*
-         * Put new one in send queue.  You'd expect we'd need this before
-         * xmit_skb calls add_buf(), since the callback can be triggered
-         * immediately after that.  But since the callback just triggers
-         * another call back here, normal network xmit locking prevents the
-         * race.
-         */
-        __skb_queue_head(&vi->send, skb);
-
         /* Don't wait up for transmitted skbs to be freed. */
         skb_orphan(skb);
         nf_reset(skb);
@@ -678,6 +724,8 @@ static void virtnet_set_rx_mode(struct net_device *dev)
         struct virtio_net_ctrl_mac *mac_data;
         struct dev_addr_list *addr;
         struct netdev_hw_addr *ha;
+        int uc_count;
+        int mc_count;
         void *buf;
         int i;
 
@@ -704,9 +752,12 @@ static void virtnet_set_rx_mode(struct net_device *dev)
                 dev_warn(&dev->dev, "Failed to %sable allmulti mode.\n",
                          allmulti ? "en" : "dis");
 
+        uc_count = netdev_uc_count(dev);
+        mc_count = netdev_mc_count(dev);
         /* MAC filter - use one buffer for both lists */
-        mac_data = buf = kzalloc(((dev->uc.count + dev->mc_count) * ETH_ALEN) +
-                                 (2 * sizeof(mac_data->entries)), GFP_ATOMIC);
+        buf = kzalloc(((uc_count + mc_count) * ETH_ALEN) +
+                      (2 * sizeof(mac_data->entries)), GFP_ATOMIC);
+        mac_data = buf;
         if (!buf) {
                 dev_warn(&dev->dev, "No memory for MAC address buffer\n");
                 return;
@@ -715,24 +766,24 @@ static void virtnet_set_rx_mode(struct net_device *dev)
         sg_init_table(sg, 2);
 
         /* Store the unicast list and count in the front of the buffer */
-        mac_data->entries = dev->uc.count;
+        mac_data->entries = uc_count;
         i = 0;
-        list_for_each_entry(ha, &dev->uc.list, list)
+        netdev_for_each_uc_addr(ha, dev)
                 memcpy(&mac_data->macs[i++][0], ha->addr, ETH_ALEN);
 
         sg_set_buf(&sg[0], mac_data,
-                   sizeof(mac_data->entries) + (dev->uc.count * ETH_ALEN));
+                   sizeof(mac_data->entries) + (uc_count * ETH_ALEN));
 
         /* multicast list and count fill the end */
-        mac_data = (void *)&mac_data->macs[dev->uc.count][0];
+        mac_data = (void *)&mac_data->macs[uc_count][0];
 
-        mac_data->entries = dev->mc_count;
-        addr = dev->mc_list;
-        for (i = 0; i < dev->mc_count; i++, addr = addr->next)
-                memcpy(&mac_data->macs[i][0], addr->da_addr, ETH_ALEN);
+        mac_data->entries = mc_count;
+        i = 0;
+        netdev_for_each_mc_addr(addr, dev)
+                memcpy(&mac_data->macs[i++][0], addr->da_addr, ETH_ALEN);
 
         sg_set_buf(&sg[1], mac_data,
-                   sizeof(mac_data->entries) + (dev->mc_count * ETH_ALEN));
+                   sizeof(mac_data->entries) + (mc_count * ETH_ALEN));
 
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MAC,
                                   VIRTIO_NET_CTRL_MAC_TABLE_SET,
@@ -893,9 +944,9 @@ static int virtnet_probe(struct virtio_device *vdev)
         INIT_DELAYED_WORK(&vi->refill, refill_work);
 
         /* If we can receive ANY GSO packets, we must allocate large ones. */
-        if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4)
-            || virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6)
-            || virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN))
+        if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) ||
+            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) ||
+            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN))
                 vi->big_packets = true;
 
         if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF))
@@ -919,10 +970,6 @@ static int virtnet_probe(struct virtio_device *vdev)
                         dev->features |= NETIF_F_HW_VLAN_FILTER;
         }
 
-        /* Initialize our empty receive and send queues. */
-        skb_queue_head_init(&vi->recv);
-        skb_queue_head_init(&vi->send);
-
         err = register_netdev(dev);
         if (err) {
                 pr_debug("virtio_net: registering device failed\n");
@@ -955,26 +1002,42 @@ free:
         return err;
 }
 
+static void free_unused_bufs(struct virtnet_info *vi)
+{
+        void *buf;
+        while (1) {
+                buf = vi->svq->vq_ops->detach_unused_buf(vi->svq);
+                if (!buf)
+                        break;
+                dev_kfree_skb(buf);
+        }
+        while (1) {
+                buf = vi->rvq->vq_ops->detach_unused_buf(vi->rvq);
+                if (!buf)
+                        break;
+                if (vi->mergeable_rx_bufs || vi->big_packets)
+                        give_pages(vi, buf);
+                else
+                        dev_kfree_skb(buf);
+                --vi->num;
+        }
+        BUG_ON(vi->num != 0);
+}
+
 static void __devexit virtnet_remove(struct virtio_device *vdev)
 {
         struct virtnet_info *vi = vdev->priv;
-        struct sk_buff *skb;
 
         /* Stop all the virtqueues. */
         vdev->config->reset(vdev);
 
-        /* Free our skbs in send and recv queues, if any. */
-        while ((skb = __skb_dequeue(&vi->recv)) != NULL) {
-                kfree_skb(skb);
-                vi->num--;
-        }
-        __skb_queue_purge(&vi->send);
-
-        BUG_ON(vi->num != 0);
 
         unregister_netdev(vi->dev);
         cancel_delayed_work_sync(&vi->refill);
 
+        /* Free unused buffers in both send and recv, if any. */
+        free_unused_bufs(vi);
+
         vdev->config->del_vqs(vi->vdev);
 
         while (vi->pages)