[PATCH] 9p: fix marshalling bug in tcreate with empty extension field
[safe/jmp/linux-2.6] / fs / 9p / mux.c
index 62b6ad0..90a79c7 100644 (file)
@@ -7,9 +7,8 @@
  *  Copyright (C) 2004-2005 by Latchesar Ionkov <lucho@ionkov.net>
  *
  *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
+ *  it under the terms of the GNU General Public License version 2
+ *  as published by the Free Software Foundation.
  *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *
  */
 
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/fs.h>
 #include <linux/poll.h>
 #include <linux/kthread.h>
 #include <linux/idr.h>
+#include <linux/mutex.h>
 
 #include "debug.h"
 #include "v9fs.h"
 #include "9p.h"
-#include "transport.h"
 #include "conv.h"
+#include "transport.h"
 #include "mux.h"
 
 #define ERREQFLUSH     1
@@ -50,15 +49,23 @@ enum {
        Wpending = 8,           /* can write */
 };
 
+enum {
+       None,
+       Flushing,
+       Flushed,
+};
+
 struct v9fs_mux_poll_task;
 
 struct v9fs_req {
+       spinlock_t lock;
        int tag;
        struct v9fs_fcall *tcall;
        struct v9fs_fcall *rcall;
        int err;
        v9fs_mux_req_callback cb;
        void *cba;
+       int flush;
        struct list_head req_list;
 };
 
@@ -69,11 +76,12 @@ struct v9fs_mux_data {
        int msize;
        unsigned char *extended;
        struct v9fs_transport *trans;
-       struct v9fs_idpool tidpool;
+       struct v9fs_idpool tagpool;
        int err;
        wait_queue_head_t equeue;
        struct list_head req_list;
        struct list_head unsent_req_list;
+       struct v9fs_fcall *rcall;
        int rpos;
        char *rbuf;
        int wpos;
@@ -95,8 +103,8 @@ struct v9fs_mux_poll_task {
 
 struct v9fs_mux_rpc {
        struct v9fs_mux_data *m;
-       struct v9fs_req *req;
        int err;
+       struct v9fs_fcall *tcall;
        struct v9fs_fcall *rcall;
        wait_queue_head_t wqueue;
 };
@@ -106,15 +114,17 @@ static void v9fs_read_work(void *);
 static void v9fs_write_work(void *);
 static void v9fs_pollwait(struct file *filp, wait_queue_head_t * wait_address,
                          poll_table * p);
+static u16 v9fs_mux_get_tag(struct v9fs_mux_data *);
+static void v9fs_mux_put_tag(struct v9fs_mux_data *, u16);
 
-static DECLARE_MUTEX(v9fs_mux_task_lock);
+static DEFINE_MUTEX(v9fs_mux_task_lock);
 static struct workqueue_struct *v9fs_mux_wq;
 
 static int v9fs_mux_num;
 static int v9fs_mux_poll_task_num;
 static struct v9fs_mux_poll_task v9fs_mux_poll_tasks[100];
 
-void v9fs_mux_global_init(void)
+int v9fs_mux_global_init(void)
 {
        int i;
 
@@ -122,6 +132,10 @@ void v9fs_mux_global_init(void)
                v9fs_mux_poll_tasks[i].task = NULL;
 
        v9fs_mux_wq = create_workqueue("v9fs");
+       if (!v9fs_mux_wq)
+               return -ENOMEM;
+
+       return 0;
 }
 
 void v9fs_mux_global_exit(void)
@@ -135,7 +149,7 @@ void v9fs_mux_global_exit(void)
  *
  * The current implementation returns sqrt of the number of mounts.
  */
-inline int v9fs_mux_calc_poll_procs(int muxnum)
+static int v9fs_mux_calc_poll_procs(int muxnum)
 {
        int n;
 
@@ -151,14 +165,15 @@ inline int v9fs_mux_calc_poll_procs(int muxnum)
        return n;
 }
 
-static void v9fs_mux_poll_start(struct v9fs_mux_data *m)
+static int v9fs_mux_poll_start(struct v9fs_mux_data *m)
 {
        int i, n;
        struct v9fs_mux_poll_task *vpt, *vptlast;
+       struct task_struct *pproc;
 
        dprintk(DEBUG_MUX, "mux %p muxnum %d procnum %d\n", m, v9fs_mux_num,
                v9fs_mux_poll_task_num);
-       up(&v9fs_mux_task_lock);
+       mutex_lock(&v9fs_mux_task_lock);
 
        n = v9fs_mux_calc_poll_procs(v9fs_mux_num + 1);
        if (n > v9fs_mux_poll_task_num) {
@@ -166,12 +181,16 @@ static void v9fs_mux_poll_start(struct v9fs_mux_data *m)
                        if (v9fs_mux_poll_tasks[i].task == NULL) {
                                vpt = &v9fs_mux_poll_tasks[i];
                                dprintk(DEBUG_MUX, "create proc %p\n", vpt);
-                               vpt->task = kthread_create(v9fs_poll_proc,
-                                       vpt, "v9fs-poll");
-                               INIT_LIST_HEAD(&vpt->mux_list);
-                               vpt->muxnum = 0;
-                               v9fs_mux_poll_task_num++;
-                               wake_up_process(vpt->task);
+                               pproc = kthread_create(v9fs_poll_proc, vpt,
+                                                  "v9fs-poll");
+
+                               if (!IS_ERR(pproc)) {
+                                       vpt->task = pproc;
+                                       INIT_LIST_HEAD(&vpt->mux_list);
+                                       vpt->muxnum = 0;
+                                       v9fs_mux_poll_task_num++;
+                                       wake_up_process(vpt->task);
+                               }
                                break;
                        }
                }
@@ -201,16 +220,21 @@ static void v9fs_mux_poll_start(struct v9fs_mux_data *m)
        }
 
        if (i >= ARRAY_SIZE(v9fs_mux_poll_tasks)) {
+               if (vptlast == NULL)
+                       return -ENOMEM;
+
                dprintk(DEBUG_MUX, "put in proc %d\n", i);
                list_add(&m->mux_list, &vptlast->mux_list);
                vptlast->muxnum++;
-               m->poll_task = vpt;
+               m->poll_task = vptlast;
                memset(&m->poll_waddr, 0, sizeof(m->poll_waddr));
                init_poll_funcptr(&m->pt, v9fs_pollwait);
        }
 
        v9fs_mux_num++;
-       down(&v9fs_mux_task_lock);
+       mutex_unlock(&v9fs_mux_task_lock);
+
+       return 0;
 }
 
 static void v9fs_mux_poll_stop(struct v9fs_mux_data *m)
@@ -218,7 +242,7 @@ static void v9fs_mux_poll_stop(struct v9fs_mux_data *m)
        int i;
        struct v9fs_mux_poll_task *vpt;
 
-       up(&v9fs_mux_task_lock);
+       mutex_lock(&v9fs_mux_task_lock);
        vpt = m->poll_task;
        list_del(&m->mux_list);
        for(i = 0; i < ARRAY_SIZE(m->poll_waddr); i++) {
@@ -235,7 +259,7 @@ static void v9fs_mux_poll_stop(struct v9fs_mux_data *m)
                v9fs_mux_poll_task_num--;
        }
        v9fs_mux_num--;
-       down(&v9fs_mux_task_lock);
+       mutex_unlock(&v9fs_mux_task_lock);
 }
 
 /**
@@ -253,7 +277,7 @@ struct v9fs_mux_data *v9fs_mux_init(struct v9fs_transport *trans, int msize,
        struct v9fs_mux_data *m, *mtmp;
 
        dprintk(DEBUG_MUX, "transport %p msize %d\n", trans, msize);
-       m = kmalloc(sizeof(struct v9fs_mux_data) + 2 * msize, GFP_KERNEL);
+       m = kmalloc(sizeof(struct v9fs_mux_data), GFP_KERNEL);
        if (!m)
                return ERR_PTR(-ENOMEM);
 
@@ -262,21 +286,25 @@ struct v9fs_mux_data *v9fs_mux_init(struct v9fs_transport *trans, int msize,
        m->msize = msize;
        m->extended = extended;
        m->trans = trans;
-       idr_init(&m->tidpool.pool);
-       init_MUTEX(&m->tidpool.lock);
+       idr_init(&m->tagpool.pool);
+       init_MUTEX(&m->tagpool.lock);
        m->err = 0;
        init_waitqueue_head(&m->equeue);
        INIT_LIST_HEAD(&m->req_list);
        INIT_LIST_HEAD(&m->unsent_req_list);
+       m->rcall = NULL;
        m->rpos = 0;
-       m->rbuf = (char *)m + sizeof(struct v9fs_mux_data);
+       m->rbuf = NULL;
        m->wpos = m->wsize = 0;
-       m->wbuf = m->rbuf + msize;
+       m->wbuf = NULL;
        INIT_WORK(&m->rq, v9fs_read_work, m);
        INIT_WORK(&m->wq, v9fs_write_work, m);
        m->wsched = 0;
        memset(&m->poll_waddr, 0, sizeof(m->poll_waddr));
-       v9fs_mux_poll_start(m);
+       m->poll_task = NULL;
+       n = v9fs_mux_poll_start(m);
+       if (n)
+               return ERR_PTR(n);
 
        n = trans->poll(trans, &m->pt);
        if (n & POLLIN) {
@@ -362,7 +390,7 @@ v9fs_pollwait(struct file *filp, wait_queue_head_t * wait_address,
 /**
  * v9fs_poll_mux - polls a mux and schedules read or write works if necessary
  */
-static inline void v9fs_poll_mux(struct v9fs_mux_data *m)
+static void v9fs_poll_mux(struct v9fs_mux_data *m)
 {
        int n;
 
@@ -427,29 +455,6 @@ static int v9fs_poll_proc(void *a)
        return 0;
 }
 
-static inline int v9fs_write_req(struct v9fs_mux_data *m, struct v9fs_req *req)
-{
-       int n;
-
-       list_move_tail(&req->req_list, &m->req_list);
-       n = v9fs_serialize_fcall(req->tcall, m->wbuf, m->msize, *m->extended);
-       if (n < 0) {
-               req->err = n;
-               list_del(&req->req_list);
-               if (req->cb) {
-                       spin_unlock(&m->lock);
-                       (*req->cb) (req->cba, req->tcall, req->rcall, req->err);
-                       req->cb = NULL;
-                       spin_lock(&m->lock);
-               } else
-                       kfree(req->rcall);
-
-               kfree(req);
-       }
-
-       return n;
-}
-
 /**
  * v9fs_write_work - called when a transport can send some data
  */
@@ -457,7 +462,7 @@ static void v9fs_write_work(void *a)
 {
        int n, err;
        struct v9fs_mux_data *m;
-       struct v9fs_req *req, *rtmp;
+       struct v9fs_req *req;
 
        m = a;
 
@@ -472,17 +477,18 @@ static void v9fs_write_work(void *a)
                        return;
                }
 
-               err = 0;
                spin_lock(&m->lock);
-               list_for_each_entry_safe(req, rtmp, &m->unsent_req_list,
-                                        req_list) {
-                       err = v9fs_write_req(m, req);
-                       if (err > 0)
-                               break;
-               }
-
-               m->wsize = err;
+again:
+               req = list_entry(m->unsent_req_list.next, struct v9fs_req,
+                              req_list);
+               list_move_tail(&req->req_list, &m->req_list);
+               if (req->err == ERREQFLUSH)
+                       goto again;
+
+               m->wbuf = req->tcall->sdata;
+               m->wsize = req->tcall->size;
                m->wpos = 0;
+               dump_data(m->wbuf, m->wsize);
                spin_unlock(&m->lock);
        }
 
@@ -525,25 +531,23 @@ static void v9fs_write_work(void *a)
 
 static void process_request(struct v9fs_mux_data *m, struct v9fs_req *req)
 {
-       int ecode, tag;
-       char *ename;
+       int ecode;
+       struct v9fs_str *ename;
 
-       tag = req->tag;
-       if (req->rcall->id == RERROR && !req->err) {
+       if (!req->err && req->rcall->id == RERROR) {
                ecode = req->rcall->params.rerror.errno;
-               ename = req->rcall->params.rerror.error;
+               ename = &req->rcall->params.rerror.error;
 
-               dprintk(DEBUG_MUX, "Rerror %s\n", ename);
+               dprintk(DEBUG_MUX, "Rerror %.*s\n", ename->len, ename->str);
 
                if (*m->extended)
                        req->err = -ecode;
 
                if (!req->err) {
-                       req->err = v9fs_errstr2errno(ename);
+                       req->err = v9fs_errstr2errno(ename->str, ename->len);
 
                        if (!req->err) {        /* string match failed */
-                               dprintk(DEBUG_ERROR, "unknown error: %s\n",
-                                       ename);
+                               PRINT_FCALL_ERROR("unknown error", req->rcall);
                        }
 
                        if (!req->err)
@@ -555,21 +559,6 @@ static void process_request(struct v9fs_mux_data *m, struct v9fs_req *req)
                if (!req->err)
                        req->err = -EIO;
        }
-
-       if (req->cb && req->err != ERREQFLUSH) {
-               dprintk(DEBUG_MUX, "calling callback tcall %p rcall %p\n",
-                       req->tcall, req->rcall);
-
-               (*req->cb) (req->cba, req->tcall, req->rcall, req->err);
-               req->cb = NULL;
-       } else
-               kfree(req->rcall);
-
-       if (tag != V9FS_NOTAG)
-               v9fs_put_idpool(tag, &m->tidpool);
-
-       wake_up(&m->equeue);
-       kfree(req);
 }
 
 /**
@@ -577,10 +566,11 @@ static void process_request(struct v9fs_mux_data *m, struct v9fs_req *req)
  */
 static void v9fs_read_work(void *a)
 {
-       int n, err, rcallen;
+       int n, err;
        struct v9fs_mux_data *m;
        struct v9fs_req *req, *rptr, *rreq;
        struct v9fs_fcall *rcall;
+       char *rbuf;
 
        m = a;
 
@@ -589,6 +579,19 @@ static void v9fs_read_work(void *a)
 
        rcall = NULL;
        dprintk(DEBUG_MUX, "start mux %p pos %d\n", m, m->rpos);
+
+       if (!m->rcall) {
+               m->rcall =
+                   kmalloc(sizeof(struct v9fs_fcall) + m->msize, GFP_KERNEL);
+               if (!m->rcall) {
+                       err = -ENOMEM;
+                       goto error;
+               }
+
+               m->rbuf = (char *)m->rcall + sizeof(struct v9fs_fcall);
+               m->rpos = 0;
+       }
+
        clear_bit(Rpending, &m->wsched);
        err = m->trans->read(m->trans, m->rbuf + m->rpos, m->msize - m->rpos);
        dprintk(DEBUG_MUX, "mux %p got %d bytes\n", m, err);
@@ -613,21 +616,40 @@ static void v9fs_read_work(void *a)
                if (m->rpos < n)
                        break;
 
-               rcallen = n + V9FS_FCALLHDRSZ;
-               rcall = kmalloc(rcallen, GFP_KERNEL);
-               if (!rcall) {
-                       err = -ENOMEM;
-                       goto error;
-               }
-
                dump_data(m->rbuf, n);
-               err = v9fs_deserialize_fcall(m->rbuf, n, rcall, rcallen,
-                                            *m->extended);
+               err =
+                   v9fs_deserialize_fcall(m->rbuf, n, m->rcall, *m->extended);
                if (err < 0) {
-                       kfree(rcall);
                        goto error;
                }
 
+               if ((v9fs_debug_level&DEBUG_FCALL) == DEBUG_FCALL) {
+                       char buf[150];
+
+                       v9fs_printfcall(buf, sizeof(buf), m->rcall,
+                               *m->extended);
+                       printk(KERN_NOTICE ">>> %p %s\n", m, buf);
+               }
+
+               rcall = m->rcall;
+               rbuf = m->rbuf;
+               if (m->rpos > n) {
+                       m->rcall = kmalloc(sizeof(struct v9fs_fcall) + m->msize,
+                                          GFP_KERNEL);
+                       if (!m->rcall) {
+                               err = -ENOMEM;
+                               goto error;
+                       }
+
+                       m->rbuf = (char *)m->rcall + sizeof(struct v9fs_fcall);
+                       memmove(m->rbuf, rbuf + n, m->rpos - n);
+                       m->rpos -= n;
+               } else {
+                       m->rcall = NULL;
+                       m->rbuf = NULL;
+                       m->rpos = 0;
+               }
+
                dprintk(DEBUG_MUX, "mux %p fcall id %d tag %d\n", m, rcall->id,
                        rcall->tag);
 
@@ -636,26 +658,32 @@ static void v9fs_read_work(void *a)
                list_for_each_entry_safe(rreq, rptr, &m->req_list, req_list) {
                        if (rreq->tag == rcall->tag) {
                                req = rreq;
-                               req->rcall = rcall;
-                               list_del(&req->req_list);
-                               spin_unlock(&m->lock);
-                               process_request(m, req);
+                               if (req->flush != Flushing)
+                                       list_del(&req->req_list);
                                break;
                        }
                }
+               spin_unlock(&m->lock);
 
-               if (!req) {
-                       spin_unlock(&m->lock);
+               if (req) {
+                       req->rcall = rcall;
+                       process_request(m, req);
+
+                       if (req->flush != Flushing) {
+                               if (req->cb)
+                                       (*req->cb) (req, req->cba);
+                               else
+                                       kfree(req->rcall);
+
+                               wake_up(&m->equeue);
+                       }
+               } else {
                        if (err >= 0 && rcall->id != RFLUSH)
                                dprintk(DEBUG_ERROR,
                                        "unexpected response mux %p id %d tag %d\n",
                                        m, rcall->id, rcall->tag);
                        kfree(rcall);
                }
-
-               if (m->rpos > n)
-                       memmove(m->rbuf, m->rbuf + n, m->rpos - n);
-               m->rpos -= n;
        }
 
        if (!list_empty(&m->req_list)) {
@@ -683,7 +711,7 @@ static void v9fs_read_work(void *a)
  * v9fs_send_request - send 9P request
  * The function can sleep until the request is scheduled for sending.
  * The function can be interrupted. Return from the function is not
- * a guarantee that the request is sent succesfully. Can return errors
+ * a guarantee that the request is sent successfully. Can return errors
  * that can be retrieved by PTR_ERR macros.
  *
  * @m: mux data
@@ -710,18 +738,27 @@ static struct v9fs_req *v9fs_send_request(struct v9fs_mux_data *m,
        if (tc->id == TVERSION)
                n = V9FS_NOTAG;
        else
-               n = v9fs_get_idpool(&m->tidpool);
+               n = v9fs_mux_get_tag(m);
 
        if (n < 0)
                return ERR_PTR(-ENOMEM);
 
-       tc->tag = n;
+       v9fs_set_tag(tc, n);
+       if ((v9fs_debug_level&DEBUG_FCALL) == DEBUG_FCALL) {
+               char buf[150];
+
+               v9fs_printfcall(buf, sizeof(buf), tc, *m->extended);
+               printk(KERN_NOTICE "<<< %p %s\n", m, buf);
+       }
+
+       spin_lock_init(&req->lock);
        req->tag = n;
        req->tcall = tc;
        req->rcall = NULL;
        req->err = 0;
        req->cb = cb;
        req->cba = cba;
+       req->flush = None;
 
        spin_lock(&m->lock);
        list_add_tail(&req->req_list, &m->unsent_req_list);
@@ -738,77 +775,108 @@ static struct v9fs_req *v9fs_send_request(struct v9fs_mux_data *m,
        return req;
 }
 
-static inline void
-v9fs_mux_flush_cb(void *a, struct v9fs_fcall *tc, struct v9fs_fcall *rc,
-                 int err)
+static void v9fs_mux_free_request(struct v9fs_mux_data *m, struct v9fs_req *req)
+{
+       v9fs_mux_put_tag(m, req->tag);
+       kfree(req);
+}
+
+static void v9fs_mux_flush_cb(struct v9fs_req *freq, void *a)
 {
        v9fs_mux_req_callback cb;
        int tag;
        struct v9fs_mux_data *m;
-       struct v9fs_req *req, *rptr;
+       struct v9fs_req *req, *rreq, *rptr;
 
        m = a;
-       dprintk(DEBUG_MUX, "mux %p tc %p rc %p err %d oldtag %d\n", m, tc,
-               rc, err, tc->params.tflush.oldtag);
+       dprintk(DEBUG_MUX, "mux %p tc %p rc %p err %d oldtag %d\n", m,
+               freq->tcall, freq->rcall, freq->err,
+               freq->tcall->params.tflush.oldtag);
 
        spin_lock(&m->lock);
        cb = NULL;
-       tag = tc->params.tflush.oldtag;
-       list_for_each_entry_safe(req, rptr, &m->req_list, req_list) {
-               if (req->tag == tag) {
+       tag = freq->tcall->params.tflush.oldtag;
+       req = NULL;
+       list_for_each_entry_safe(rreq, rptr, &m->req_list, req_list) {
+               if (rreq->tag == tag) {
+                       req = rreq;
                        list_del(&req->req_list);
-                       if (req->cb) {
-                               cb = req->cb;
-                               req->cb = NULL;
-                               spin_unlock(&m->lock);
-                               (*cb) (req->cba, req->tcall, req->rcall,
-                                      req->err);
-                       }
-                       kfree(req);
-                       wake_up(&m->equeue);
                        break;
                }
        }
+       spin_unlock(&m->lock);
 
-       if (!cb)
-               spin_unlock(&m->lock);
+       if (req) {
+               spin_lock(&req->lock);
+               req->flush = Flushed;
+               spin_unlock(&req->lock);
 
-       if (v9fs_check_idpool(tag, &m->tidpool))
-               v9fs_put_idpool(tag, &m->tidpool);
+               if (req->cb)
+                       (*req->cb) (req, req->cba);
+               else
+                       kfree(req->rcall);
+
+               wake_up(&m->equeue);
+       }
 
-       kfree(tc);
-       kfree(rc);
+       kfree(freq->tcall);
+       kfree(freq->rcall);
+       v9fs_mux_free_request(m, freq);
 }
 
-static void
+static int
 v9fs_mux_flush_request(struct v9fs_mux_data *m, struct v9fs_req *req)
 {
        struct v9fs_fcall *fc;
+       struct v9fs_req *rreq, *rptr;
 
        dprintk(DEBUG_MUX, "mux %p req %p tag %d\n", m, req, req->tag);
 
-       fc = kmalloc(sizeof(struct v9fs_fcall), GFP_KERNEL);
-       fc->id = TFLUSH;
-       fc->params.tflush.oldtag = req->tag;
+       /* if a response was received for a request, do nothing */
+       spin_lock(&req->lock);
+       if (req->rcall || req->err) {
+               spin_unlock(&req->lock);
+               dprintk(DEBUG_MUX, "mux %p req %p response already received\n", m, req);
+               return 0;
+       }
+
+       req->flush = Flushing;
+       spin_unlock(&req->lock);
 
+       spin_lock(&m->lock);
+       /* if the request is not sent yet, just remove it from the list */
+       list_for_each_entry_safe(rreq, rptr, &m->unsent_req_list, req_list) {
+               if (rreq->tag == req->tag) {
+                       dprintk(DEBUG_MUX, "mux %p req %p request is not sent yet\n", m, req);
+                       list_del(&rreq->req_list);
+                       req->flush = Flushed;
+                       spin_unlock(&m->lock);
+                       if (req->cb)
+                               (*req->cb) (req, req->cba);
+                       return 0;
+               }
+       }
+       spin_unlock(&m->lock);
+
+       clear_thread_flag(TIF_SIGPENDING);
+       fc = v9fs_create_tflush(req->tag);
        v9fs_send_request(m, fc, v9fs_mux_flush_cb, m);
+       return 1;
 }
 
 static void
-v9fs_mux_rpc_cb(void *a, struct v9fs_fcall *tc, struct v9fs_fcall *rc, int err)
+v9fs_mux_rpc_cb(struct v9fs_req *req, void *a)
 {
        struct v9fs_mux_rpc *r;
 
-       if (err == ERREQFLUSH) {
-               dprintk(DEBUG_MUX, "err req flush\n");
-               return;
-       }
-
+       dprintk(DEBUG_MUX, "req %p r %p\n", req, a);
        r = a;
-       dprintk(DEBUG_MUX, "mux %p req %p tc %p rc %p err %d\n", r->m, r->req,
-               tc, rc, err);
-       r->rcall = rc;
-       r->err = err;
+       r->rcall = req->rcall;
+       r->err = req->err;
+
+       if (req->flush!=None && !req->err)
+               r->err = -ERESTARTSYS;
+
        wake_up(&r->wqueue);
 }
 
@@ -823,12 +891,13 @@ int
 v9fs_mux_rpc(struct v9fs_mux_data *m, struct v9fs_fcall *tc,
             struct v9fs_fcall **rc)
 {
-       int err;
+       int err, sigpending;
        unsigned long flags;
        struct v9fs_req *req;
        struct v9fs_mux_rpc r;
 
        r.err = 0;
+       r.tcall = tc;
        r.rcall = NULL;
        r.m = m;
        init_waitqueue_head(&r.wqueue);
@@ -836,52 +905,57 @@ v9fs_mux_rpc(struct v9fs_mux_data *m, struct v9fs_fcall *tc,
        if (rc)
                *rc = NULL;
 
+       sigpending = 0;
+       if (signal_pending(current)) {
+               sigpending = 1;
+               clear_thread_flag(TIF_SIGPENDING);
+       }
+
        req = v9fs_send_request(m, tc, v9fs_mux_rpc_cb, &r);
        if (IS_ERR(req)) {
                err = PTR_ERR(req);
                dprintk(DEBUG_MUX, "error %d\n", err);
-               return PTR_ERR(req);
+               return err;
        }
 
-       r.req = req;
-       dprintk(DEBUG_MUX, "mux %p tc %p tag %d rpc %p req %p\n", m, tc,
-               req->tag, &r, req);
        err = wait_event_interruptible(r.wqueue, r.rcall != NULL || r.err < 0);
        if (r.err < 0)
                err = r.err;
 
        if (err == -ERESTARTSYS && m->trans->status == Connected && m->err == 0) {
-               spin_lock(&m->lock);
-               req->tcall = NULL;
-               req->err = ERREQFLUSH;
-               spin_unlock(&m->lock);
+               if (v9fs_mux_flush_request(m, req)) {
+                       /* wait until we get response of the flush message */
+                       do {
+                               clear_thread_flag(TIF_SIGPENDING);
+                               err = wait_event_interruptible(r.wqueue,
+                                       r.rcall || r.err);
+                       } while (!r.rcall && !r.err && err==-ERESTARTSYS &&
+                               m->trans->status==Connected && !m->err);
+
+                       err = -ERESTARTSYS;
+               }
+               sigpending = 1;
+       }
 
-               clear_thread_flag(TIF_SIGPENDING);
-               v9fs_mux_flush_request(m, req);
+       if (sigpending) {
                spin_lock_irqsave(&current->sighand->siglock, flags);
                recalc_sigpending();
                spin_unlock_irqrestore(&current->sighand->siglock, flags);
        }
 
-       if (!err) {
-               if (r.rcall)
-                       dprintk(DEBUG_MUX, "got response id %d tag %d\n",
-                               r.rcall->id, r.rcall->tag);
-
-               if (rc)
-                       *rc = r.rcall;
-               else
-                       kfree(r.rcall);
-       } else {
+       if (rc)
+               *rc = r.rcall;
+       else
                kfree(r.rcall);
-               dprintk(DEBUG_MUX, "got error %d\n", err);
-               if (err > 0)
-                       err = -EIO;
-       }
+
+       v9fs_mux_free_request(m, req);
+       if (err > 0)
+               err = -EIO;
 
        return err;
 }
 
+#if 0
 /**
  * v9fs_mux_rpcnb - sends 9P request without waiting for response.
  * @m: mux data
@@ -905,6 +979,7 @@ int v9fs_mux_rpcnb(struct v9fs_mux_data *m, struct v9fs_fcall *tc,
        dprintk(DEBUG_MUX, "mux %p tc %p tag %d\n", m, tc, req->tag);
        return 0;
 }
+#endif  /*  0  */
 
 /**
  * v9fs_mux_cancel - cancel all pending requests with error
@@ -916,12 +991,15 @@ void v9fs_mux_cancel(struct v9fs_mux_data *m, int err)
        struct v9fs_req *req, *rtmp;
        LIST_HEAD(cancel_list);
 
-       dprintk(DEBUG_MUX, "mux %p err %d\n", m, err);
+       dprintk(DEBUG_ERROR, "mux %p err %d\n", m, err);
        m->err = err;
        spin_lock(&m->lock);
        list_for_each_entry_safe(req, rtmp, &m->req_list, req_list) {
                list_move(&req->req_list, &cancel_list);
        }
+       list_for_each_entry_safe(req, rtmp, &m->unsent_req_list, req_list) {
+               list_move(&req->req_list, &cancel_list);
+       }
        spin_unlock(&m->lock);
 
        list_for_each_entry_safe(req, rtmp, &cancel_list, req_list) {
@@ -930,12 +1008,27 @@ void v9fs_mux_cancel(struct v9fs_mux_data *m, int err)
                        req->err = err;
 
                if (req->cb)
-                       (*req->cb) (req->cba, req->tcall, req->rcall, req->err);
+                       (*req->cb) (req, req->cba);
                else
                        kfree(req->rcall);
-
-               kfree(req);
        }
 
        wake_up(&m->equeue);
 }
+
+static u16 v9fs_mux_get_tag(struct v9fs_mux_data *m)
+{
+       int tag;
+
+       tag = v9fs_get_idpool(&m->tagpool);
+       if (tag < 0)
+               return V9FS_NOTAG;
+       else
+               return (u16) tag;
+}
+
+static void v9fs_mux_put_tag(struct v9fs_mux_data *m, u16 tag)
+{
+       if (tag != V9FS_NOTAG && v9fs_check_idpool(tag, &m->tagpool))
+               v9fs_put_idpool(tag, &m->tagpool);
+}