5 files changed, 101 insertions, 87 deletions

diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index be414d2b2b22..971a760af4a1 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -17,6 +17,7 @@
 #include <linux/workqueue.h>
 #include <linux/file.h>
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
 
 #include <linux/net.h>
 #include <linux/if_packet.h>
@@ -373,7 +374,7 @@ static void handle_tx(struct vhost_net *net)
                               % UIO_MAXIOV == nvq->done_idx))
                         break;
 
-                head = vhost_get_vq_desc(&net->dev, vq, vq->iov,
+                head = vhost_get_vq_desc(vq, vq->iov,
                                          ARRAY_SIZE(vq->iov),
                                          &out, &in,
                                          NULL, NULL);
@@ -505,7 +506,7 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
                         r = -ENOBUFS;
                         goto err;
                 }
-                r = vhost_get_vq_desc(vq->dev, vq, vq->iov + seg,
+                r = vhost_get_vq_desc(vq, vq->iov + seg,
                                       ARRAY_SIZE(vq->iov) - seg, &out,
                                       &in, log, log_num);
                 if (unlikely(r < 0))
@@ -584,9 +585,9 @@ static void handle_rx(struct vhost_net *net)
         vhost_hlen = nvq->vhost_hlen;
         sock_hlen = nvq->sock_hlen;
 
-        vq_log = unlikely(vhost_has_feature(&net->dev, VHOST_F_LOG_ALL)) ?
+        vq_log = unlikely(vhost_has_feature(vq, VHOST_F_LOG_ALL)) ?
                 vq->log : NULL;
-        mergeable = vhost_has_feature(&net->dev, VIRTIO_NET_F_MRG_RXBUF);
+        mergeable = vhost_has_feature(vq, VIRTIO_NET_F_MRG_RXBUF);
 
         while ((sock_len = peek_head_len(sock->sk))) {
                 sock_len += sock_hlen;
@@ -699,18 +700,30 @@ static void handle_rx_net(struct vhost_work *work)
         handle_rx(net);
 }
 
+static void vhost_net_free(void *addr)
+{
+        if (is_vmalloc_addr(addr))
+                vfree(addr);
+        else
+                kfree(addr);
+}
+
 static int vhost_net_open(struct inode *inode, struct file *f)
 {
-        struct vhost_net *n = kmalloc(sizeof *n, GFP_KERNEL);
+        struct vhost_net *n;
         struct vhost_dev *dev;
         struct vhost_virtqueue **vqs;
         int i;
 
-        if (!n)
-                return -ENOMEM;
+        n = kmalloc(sizeof *n, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
+        if (!n) {
+                n = vmalloc(sizeof *n);
+                if (!n)
+                        return -ENOMEM;
+        }
         vqs = kmalloc(VHOST_NET_VQ_MAX * sizeof(*vqs), GFP_KERNEL);
         if (!vqs) {
-                kfree(n);
+                vhost_net_free(n);
                 return -ENOMEM;
         }
 
@@ -827,7 +840,7 @@ static int vhost_net_release(struct inode *inode, struct file *f)
          * since jobs can re-queue themselves. */
         vhost_net_flush(n);
         kfree(n->dev.vqs);
-        kfree(n);
+        vhost_net_free(n);
         return 0;
 }
 
@@ -1038,15 +1051,13 @@ static int vhost_net_set_features(struct vhost_net *n, u64 features)
                 mutex_unlock(&n->dev.mutex);
                 return -EFAULT;
         }
-        n->dev.acked_features = features;
-        smp_wmb();
         for (i = 0; i < VHOST_NET_VQ_MAX; ++i) {
                 mutex_lock(&n->vqs[i].vq.mutex);
+                n->vqs[i].vq.acked_features = features;
                 n->vqs[i].vhost_hlen = vhost_hlen;
                 n->vqs[i].sock_hlen = sock_hlen;
                 mutex_unlock(&n->vqs[i].vq.mutex);
         }
-        vhost_net_flush(n);
         mutex_unlock(&n->dev.mutex);
         return 0;
 }
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index aeb513108448..e9c280f55819 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -606,7 +606,7 @@ tcm_vhost_do_evt_work(struct vhost_scsi *vs, struct tcm_vhost_evt *evt)
 
 again:
         vhost_disable_notify(&vs->dev, vq);
-        head = vhost_get_vq_desc(&vs->dev, vq, vq->iov,
+        head = vhost_get_vq_desc(vq, vq->iov,
                         ARRAY_SIZE(vq->iov), &out, &in,
                         NULL, NULL);
         if (head < 0) {
@@ -945,7 +945,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
         vhost_disable_notify(&vs->dev, vq);
 
         for (;;) {
-                head = vhost_get_vq_desc(&vs->dev, vq, vq->iov,
+                head = vhost_get_vq_desc(vq, vq->iov,
                                         ARRAY_SIZE(vq->iov), &out, &in,
                                         NULL, NULL);
                 pr_debug("vhost_get_vq_desc: head: %d, out: %u in: %u\n",
@@ -1373,6 +1373,9 @@ err_dev:
 
 static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
 {
+        struct vhost_virtqueue *vq;
+        int i;
+
         if (features & ~VHOST_SCSI_FEATURES)
                 return -EOPNOTSUPP;
 
@@ -1382,9 +1385,13 @@ static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
                 mutex_unlock(&vs->dev.mutex);
                 return -EFAULT;
         }
-        vs->dev.acked_features = features;
-        smp_wmb();
-        vhost_scsi_flush(vs);
+
+        for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
+                vq = &vs->vqs[i].vq;
+                mutex_lock(&vq->mutex);
+                vq->acked_features = features;
+                mutex_unlock(&vq->mutex);
+        }
         mutex_unlock(&vs->dev.mutex);
         return 0;
 }
@@ -1591,10 +1598,6 @@ tcm_vhost_do_plug(struct tcm_vhost_tpg *tpg,
                 return;
 
         mutex_lock(&vs->dev.mutex);
-        if (!vhost_has_feature(&vs->dev, VIRTIO_SCSI_F_HOTPLUG)) {
-                mutex_unlock(&vs->dev.mutex);
-                return;
-        }
 
         if (plug)
                 reason = VIRTIO_SCSI_EVT_RESET_RESCAN;
@@ -1603,8 +1606,9 @@ tcm_vhost_do_plug(struct tcm_vhost_tpg *tpg,
 
         vq = &vs->vqs[VHOST_SCSI_VQ_EVT].vq;
         mutex_lock(&vq->mutex);