5 files changed, 34 insertions, 20 deletions

diff --git a/Documentation/lguest/lguest.c b/Documentation/lguest/lguest.c
index f2668390e8f7..42008395534d 100644
--- a/Documentation/lguest/lguest.c
+++ b/Documentation/lguest/lguest.c
@@ -62,8 +62,8 @@ typedef uint8_t u8;
 #endif
 /* We can have up to 256 pages for devices. */
 #define DEVICE_PAGES 256
-/* This fits nicely in a single 4096-byte page. */
-#define VIRTQUEUE_NUM 127
+/* This will occupy 2 pages: it must be a power of 2. */
+#define VIRTQUEUE_NUM 128
 
 /*L:120 verbose is both a global flag and a macro.  The C preprocessor allows
  * this, and although I wouldn't recommend it, it works quite nicely here. */
@@ -1036,7 +1036,8 @@ static void add_virtqueue(struct device *dev, unsigned int num_descs,
         void *p;
 
         /* First we need some pages for this virtqueue. */
-        pages = (vring_size(num_descs) + getpagesize() - 1) / getpagesize();
+        pages = (vring_size(num_descs, getpagesize()) + getpagesize() - 1)
+                / getpagesize();
         p = get_pages(pages);
 
         /* Initialize the configuration. */
@@ -1045,7 +1046,7 @@ static void add_virtqueue(struct device *dev, unsigned int num_descs,
         vq->config.pfn = to_guest_phys(p) / getpagesize();
 
         /* Initialize the vring. */
-        vring_init(&vq->vring, num_descs, p);
+        vring_init(&vq->vring, num_descs, p, getpagesize());
 
         /* Add the configuration information to this device's descriptor. */
         add_desc_field(dev, VIRTIO_CONFIG_F_VIRTQUEUE,
@@ -1342,7 +1343,7 @@ static bool service_io(struct device *dev)
         if (out->type & VIRTIO_BLK_T_SCSI_CMD) {
                 fprintf(stderr, "Scsi commands unsupported\n");
                 in->status = VIRTIO_BLK_S_UNSUPP;
-                wlen = sizeof(in);
+                wlen = sizeof(*in);
         } else if (out->type & VIRTIO_BLK_T_OUT) {
                 /* Write */
 
@@ -1363,7 +1364,7 @@ static bool service_io(struct device *dev)
                         /* Die, bad Guest, die. */
                         errx(1, "Write past end %llu+%u", off, ret);
                 }
-                wlen = sizeof(in);
+                wlen = sizeof(*in);
                 in->status = (ret >= 0 ? VIRTIO_BLK_S_OK : VIRTIO_BLK_S_IOERR);
         } else {
                 /* Read */
@@ -1376,10 +1377,10 @@ static bool service_io(struct device *dev)
                 ret = readv(vblk->fd, iov+1, in_num-1);
                 verbose("READ from sector %llu: %i\n", out->sector, ret);
                 if (ret >= 0) {
-                        wlen = sizeof(in) + ret;
+                        wlen = sizeof(*in) + ret;
                         in->status = VIRTIO_BLK_S_OK;
                 } else {
-                        wlen = sizeof(in);
+                        wlen = sizeof(*in);
                         in->status = VIRTIO_BLK_S_IOERR;
                 }
         }
diff --git a/drivers/lguest/lguest_device.c b/drivers/lguest/lguest_device.c
index 8904f72f97c6..66f38722253a 100644
--- a/drivers/lguest/lguest_device.c
+++ b/drivers/lguest/lguest_device.c
@@ -200,7 +200,8 @@ static struct virtqueue *lg_find_vq(struct virtio_device *vdev,
 
         /* Figure out how many pages the ring will take, and map that memory */
         lvq->pages = lguest_map((unsigned long)lvq->config.pfn << PAGE_SHIFT,
-                                DIV_ROUND_UP(vring_size(lvq->config.num),
+                                DIV_ROUND_UP(vring_size(lvq->config.num,
+                                                        PAGE_SIZE),
                                              PAGE_SIZE));
         if (!lvq->pages) {
                 err = -ENOMEM;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index e396c9d2af8d..a75be57fb209 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -146,6 +146,7 @@ static void try_fill_recv(struct virtnet_info *vi)
         struct scatterlist sg[1+MAX_SKB_FRAGS];
         int num, err;
 
+        sg_init_table(sg, 1+MAX_SKB_FRAGS);
         for (;;) {
                 skb = netdev_alloc_skb(vi->dev, MAX_PACKET_LEN);
                 if (unlikely(!skb))
@@ -231,6 +232,8 @@ static int start_xmit(struct sk_buff *skb, struct net_device *dev)
         const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest;
         DECLARE_MAC_BUF(mac);
 
+        sg_init_table(sg, 1+MAX_SKB_FRAGS);
+
         pr_debug("%s: xmit %p %s\n", dev->name, skb, print_mac(mac, dest));
 
         free_old_xmit_skbs(vi);
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 0e4baca21b8f..1dc04b6684e6 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -53,7 +53,7 @@ struct vring_virtqueue
         unsigned int num_added;
 
         /* Last used index we've seen. */
-        unsigned int last_used_idx;
+        u16 last_used_idx;
 
         /* How to notify other side. FIXME: commonalize hcalls! */
         void (*notify)(struct virtqueue *vq);
@@ -277,11 +277,17 @@ struct virtqueue *vring_new_virtqueue(unsigned int num,
         struct vring_virtqueue *vq;
         unsigned int i;
 
+        /* We assume num is a power of 2. */
+        if (num & (num - 1)) {
+                dev_warn(&vdev->dev, "Bad virtqueue length %u\n", num);
+                return NULL;
+        }
+
         vq = kmalloc(sizeof(*vq) + sizeof(void *)*num, GFP_KERNEL);
         if (!vq)
                 return NULL;
 
-        vring_init(&vq->vring, num, pages);
+        vring_init(&vq->vring, num, pages, PAGE_SIZE);
         vq->vq.callback = callback;
         vq->vq.vdev = vdev;
         vq->vq.vq_ops = &vring_vq_ops;
diff --git a/include/linux/virtio_ring.h b/include/linux/virtio_ring.h
index ac69e7bb5a14..1a4ed49f6478 100644
--- a/include/linux/virtio_ring.h
+++ b/include/linux/virtio_ring.h
@@ -67,7 +67,7 @@ struct vring {
 };
 
 /* The standard layout for the ring is a continuous chunk of memory which looks
- * like this.  The used fields will be aligned to a "num+1" boundary.
+ * like this.  We assume num is a power of 2.
  *
  * struct vring
  * {
@@ -79,8 +79,8 @@ struct vring {
  *      __u16 avail_idx;
  *      __u16 available[num];
  *
- *      // Padding so a correctly-chosen num value will cache-align used_idx.
- *      char pad[sizeof(struct vring_desc) - sizeof(avail_flags)];
+ *      // Padding to the next page boundary.
+ *      char pad[];
  *
  *      // A ring of used descriptor heads with free-running index.
  *      __u16 used_flags;
@@ -88,18 +88,21 @@ struct vring {
  *      struct vring_used_elem used[num];
  * };
  */
-static inline void vring_init(struct vring *vr, unsigned int num, void *p)
+static inline void vring_init(struct vring *vr, unsigned int num, void *p,
+                              unsigned int pagesize)
 {
         vr->num = num;
         vr->desc = p;
-        vr->avail = p + num*sizeof(struct vring);
-        vr->used = p + (num+1)*(sizeof(struct vring) + sizeof(__u16));
+        vr->avail = p + num*sizeof(struct vring_desc);
+        vr->used = (void *)(((unsigned long)&vr->avail->ring[num] + pagesize-1)
+                            & ~(pagesize - 1));
 }
 
-static inline unsigned vring_size(unsigned int num)
+static inline unsigned vring_size(unsigned int num, unsigned int pagesize)
 {
-        return (num + 1) * (sizeof(struct vring_desc) + sizeof(__u16))
-                + sizeof(__u32) + num * sizeof(struct vring_used_elem);
+        return ((sizeof(struct vring_desc) * num + sizeof(__u16) * (2 + num)
+                 + pagesize - 1) & ~(pagesize - 1))
+                + sizeof(__u16) * 2 + sizeof(struct vring_used_elem) * num;
 }
 
 #ifdef __KERNEL__