cfg80211: fix crash in cfg80211_set_freq()
[safe/jmp/linux-2.6] / net / 9p / trans_fd.c
index cc9bc73..98ce9bc 100644 (file)
 #include <linux/idr.h>
 #include <linux/file.h>
 #include <linux/parser.h>
+#include <linux/slab.h>
 #include <net/9p/9p.h>
 #include <net/9p/client.h>
 #include <net/9p/transport.h>
 
+#include <linux/syscalls.h> /* killme */
+
 #define P9_PORT 564
 #define MAX_SOCK_BUF (64*1024)
 #define MAXPOLLWADDR   2
@@ -111,14 +114,16 @@ struct p9_poll_wait {
  * @err: error state
  * @req_list: accounting for requests which have been sent
  * @unsent_req_list: accounting for requests that haven't been sent
- * @rcall: current response &p9_fcall structure
+ * @req: current request being processed (if any)
+ * @tmp_buf: temporary buffer to read in header
+ * @rsize: amount to read for current frame
  * @rpos: read position in current frame
  * @rbuf: current read buffer
  * @wpos: write position for current frame
  * @wsize: amount of data to write for current frame
  * @wbuf: current write buffer
+ * @poll_pending_link: pending links to be polled per conn
  * @poll_wait: array of wait_q's for various worker threads
- * @poll_waddr: ????
  * @pt: poll state
  * @rq: current read work
  * @wq: current write work
@@ -132,7 +137,9 @@ struct p9_conn {
        int err;
        struct list_head req_list;
        struct list_head unsent_req_list;
-       struct p9_fcall *rcall;
+       struct p9_req_t *req;
+       char tmp_buf[7];
+       int rsize;
        int rpos;
        char *rbuf;
        int wpos;
@@ -170,44 +177,6 @@ static void p9_mux_poll_stop(struct p9_conn *m)
        spin_unlock_irqrestore(&p9_poll_lock, flags);
 }
 
-static void p9_conn_rpc_cb(struct p9_client *, struct p9_req_t *);
-
-static void p9_mux_flush_cb(struct p9_client *client, struct p9_req_t *freq)
-{
-       struct p9_conn *m = client->trans;
-       struct p9_req_t *req;
-
-       P9_DPRINTK(P9_DEBUG_MUX, "mux %p tc %p rc %p err %d oldtag %d\n", m,
-               freq->tc, freq->rc, freq->t_err,
-               freq->tc->params.tflush.oldtag);
-
-       req = p9_tag_lookup(client, freq->tc->params.tflush.oldtag);
-       if (req) {
-               req->status = REQ_STATUS_FLSHD;
-               list_del(&req->req_list);
-               p9_conn_rpc_cb(client, req);
-       }
-
-       p9_free_req(client, freq);
-}
-
-static void p9_conn_rpc_cb(struct p9_client *client, struct p9_req_t *req)
-{
-       P9_DPRINTK(P9_DEBUG_MUX, "req %p\n", req);
-
-       if (req->tc->id == P9_TFLUSH) { /* flush callback */
-               P9_DPRINTK(P9_DEBUG_MUX, "flush req %p\n", req);
-               p9_mux_flush_cb(client, req);
-       } else {                        /* normal wakeup path */
-               P9_DPRINTK(P9_DEBUG_MUX, "normal req %p\n", req);
-               if (!req->t_err && (req->status == REQ_STATUS_FLSHD ||
-                                req->status == REQ_STATUS_FLSH))
-                       req->t_err = -ERESTARTSYS;
-
-               wake_up(req->wq);
-       }
-}
-
 /**
  * p9_conn_cancel - cancel all pending requests with error
  * @m: mux data
@@ -215,14 +184,23 @@ static void p9_conn_rpc_cb(struct p9_client *client, struct p9_req_t *req)
  *
  */
 
-void p9_conn_cancel(struct p9_conn *m, int err)
+static void p9_conn_cancel(struct p9_conn *m, int err)
 {
        struct p9_req_t *req, *rtmp;
+       unsigned long flags;
        LIST_HEAD(cancel_list);
 
        P9_DPRINTK(P9_DEBUG_ERROR, "mux %p err %d\n", m, err);
+
+       spin_lock_irqsave(&m->client->lock, flags);
+
+       if (m->err) {
+               spin_unlock_irqrestore(&m->client->lock, flags);
+               return;
+       }
+
        m->err = err;
-       spin_lock(&m->client->lock);
+
        list_for_each_entry_safe(req, rtmp, &m->req_list, req_list) {
                req->status = REQ_STATUS_ERROR;
                if (!req->t_err)
@@ -235,44 +213,12 @@ void p9_conn_cancel(struct p9_conn *m, int err)
                        req->t_err = err;
                list_move(&req->req_list, &cancel_list);
        }
-       spin_unlock(&m->client->lock);
+       spin_unlock_irqrestore(&m->client->lock, flags);
 
        list_for_each_entry_safe(req, rtmp, &cancel_list, req_list) {
+               P9_DPRINTK(P9_DEBUG_ERROR, "call back req %p\n", req);
                list_del(&req->req_list);
-               p9_conn_rpc_cb(m->client, req);
-       }
-}
-
-static void process_request(struct p9_conn *m, struct p9_req_t *req)
-{
-       int ecode;
-       struct p9_str *ename;
-
-       if (!req->t_err && req->rc->id == P9_RERROR) {
-               ecode = req->rc->params.rerror.errno;
-               ename = &req->rc->params.rerror.error;
-
-               P9_DPRINTK(P9_DEBUG_MUX, "Rerror %.*s\n", ename->len,
-                                                               ename->str);
-
-               if (m->client->dotu)
-                       req->t_err = -ecode;
-
-               if (!req->t_err) {
-                       req->t_err = p9_errstr2errno(ename->str, ename->len);
-
-                       /* string match failed */
-                       if (!req->t_err) {
-                               PRINT_FCALL_ERROR("unknown error", req->rc);
-                               req->t_err = -ESERVERFAULT;
-                       }
-               }
-       } else if (req->tc && req->rc->id != req->tc->id + 1) {
-               P9_DPRINTK(P9_DEBUG_ERROR,
-                               "fcall mismatch: expected %d, got %d\n",
-                               req->tc->id + 1, req->rc->id);
-               if (!req->t_err)
-                       req->t_err = -EIO;
+               p9_client_cb(m->client, req);
        }
 }
 
@@ -346,35 +292,26 @@ static void p9_read_work(struct work_struct *work)
 {
        int n, err;
        struct p9_conn *m;
-       struct p9_req_t *req;
-       struct p9_fcall *rcall;
-       char *rbuf;
 
        m = container_of(work, struct p9_conn, rq);
 
        if (m->err < 0)
                return;
 
-       rcall = NULL;
-       P9_DPRINTK(P9_DEBUG_MUX, "start mux %p pos %d\n", m, m->rpos);
+       P9_DPRINTK(P9_DEBUG_TRANS, "start mux %p pos %d\n", m, m->rpos);
 
-       if (!m->rcall) {
-               m->rcall =
-                   kmalloc(sizeof(struct p9_fcall) + m->client->msize,
-                                                               GFP_KERNEL);
-               if (!m->rcall) {
-                       err = -ENOMEM;
-                       goto error;
-               }
-
-               m->rbuf = (char *)m->rcall + sizeof(struct p9_fcall);
+       if (!m->rbuf) {
+               m->rbuf = m->tmp_buf;
                m->rpos = 0;
+               m->rsize = 7; /* start by reading header */
        }
 
        clear_bit(Rpending, &m->wsched);
+       P9_DPRINTK(P9_DEBUG_TRANS, "read mux %p pos %d size: %d = %d\n", m,
+                                       m->rpos, m->rsize, m->rsize-m->rpos);
        err = p9_fd_read(m->client, m->rbuf + m->rpos,
-                                               m->client->msize - m->rpos);
-       P9_DPRINTK(P9_DEBUG_MUX, "mux %p got %d bytes\n", m, err);
+                                               m->rsize - m->rpos);
+       P9_DPRINTK(P9_DEBUG_TRANS, "mux %p got %d bytes\n", m, err);
        if (err == -EAGAIN) {
                clear_bit(Rworksched, &m->wsched);
                return;
@@ -384,8 +321,12 @@ static void p9_read_work(struct work_struct *work)
                goto error;
 
        m->rpos += err;
-       while (m->rpos > 4) {
-               n = le32_to_cpu(*(__le32 *) m->rbuf);
+
+       if ((!m->req) && (m->rpos == m->rsize)) { /* header read in */
+               u16 tag;
+               P9_DPRINTK(P9_DEBUG_TRANS, "got new header\n");
+
+               n = le32_to_cpu(*(__le32 *) m->rbuf); /* read packet size */
                if (n >= m->client->msize) {
                        P9_DPRINTK(P9_DEBUG_ERROR,
                                "requested packet size too big: %d\n", n);
@@ -393,66 +334,46 @@ static void p9_read_work(struct work_struct *work)
                        goto error;
                }
 
-               if (m->rpos < n)
-                       break;
+               tag = le16_to_cpu(*(__le16 *) (m->rbuf+5)); /* read tag */
+               P9_DPRINTK(P9_DEBUG_TRANS,
+                       "mux %p pkt: size: %d bytes tag: %d\n", m, n, tag);
 
-               err =
-                   p9_deserialize_fcall(m->rbuf, n, m->rcall, m->client->dotu);
-               if (err < 0)
+               m->req = p9_tag_lookup(m->client, tag);
+               if (!m->req || (m->req->status != REQ_STATUS_SENT &&
+                                       m->req->status != REQ_STATUS_FLSH)) {
+                       P9_DPRINTK(P9_DEBUG_ERROR, "Unexpected packet tag %d\n",
+                                                                tag);
+                       err = -EIO;
                        goto error;
-
-#ifdef CONFIG_NET_9P_DEBUG
-               if ((p9_debug_level&P9_DEBUG_FCALL) == P9_DEBUG_FCALL) {
-                       char buf[150];
-
-                       p9_printfcall(buf, sizeof(buf), m->rcall,
-                               m->client->dotu);
-                       printk(KERN_NOTICE ">>> %p %s\n", m, buf);
                }
-#endif
 
-               rcall = m->rcall;
-               rbuf = m->rbuf;
-               if (m->rpos > n) {
-                       m->rcall = kmalloc(sizeof(struct p9_fcall) +
+               if (m->req->rc == NULL) {
+                       m->req->rc = kmalloc(sizeof(struct p9_fcall) +
                                                m->client->msize, GFP_KERNEL);
-                       if (!m->rcall) {
+                       if (!m->req->rc) {
+                               m->req = NULL;
                                err = -ENOMEM;
                                goto error;
                        }
-
-                       m->rbuf = (char *)m->rcall + sizeof(struct p9_fcall);
-                       memmove(m->rbuf, rbuf + n, m->rpos - n);
-                       m->rpos -= n;
-               } else {
-                       m->rcall = NULL;
-                       m->rbuf = NULL;
-                       m->rpos = 0;
                }
+               m->rbuf = (char *)m->req->rc + sizeof(struct p9_fcall);
+               memcpy(m->rbuf, m->tmp_buf, m->rsize);
+               m->rsize = n;
+       }
 
-               P9_DPRINTK(P9_DEBUG_MUX, "mux %p fcall id %d tag %d\n", m,
-                                                       rcall->id, rcall->tag);
-
-               req = p9_tag_lookup(m->client, rcall->tag);
-
-               if (req) {
-                       if (req->status != REQ_STATUS_FLSH) {
-                               list_del(&req->req_list);
-                               req->status = REQ_STATUS_RCVD;
-                       }
-
-                       req->rc = rcall;
-                       process_request(m, req);
-
-                       if (req->status != REQ_STATUS_FLSH)
-                               p9_conn_rpc_cb(m->client, req);
-               } else {
-                       if (err >= 0 && rcall->id != P9_RFLUSH)
-                               P9_DPRINTK(P9_DEBUG_ERROR,
-                                 "unexpected response mux %p id %d tag %d\n",
-                                 m, rcall->id, rcall->tag);
-                       kfree(rcall);
-               }
+       /* not an else because some packets (like clunk) have no payload */
+       if ((m->req) && (m->rpos == m->rsize)) { /* packet is read in */
+               P9_DPRINTK(P9_DEBUG_TRANS, "got new packet\n");
+               spin_lock(&m->client->lock);
+               if (m->req->status != REQ_STATUS_ERROR)
+                       m->req->status = REQ_STATUS_RCVD;
+               list_del(&m->req->req_list);
+               spin_unlock(&m->client->lock);
+               p9_client_cb(m->client, m->req);
+               m->rbuf = NULL;
+               m->rpos = 0;
+               m->rsize = 0;
+               m->req = NULL;
        }
 
        if (!list_empty(&m->req_list)) {
@@ -462,7 +383,7 @@ static void p9_read_work(struct work_struct *work)
                        n = p9_fd_poll(m->client, NULL);
 
                if (n & POLLIN) {
-                       P9_DPRINTK(P9_DEBUG_MUX, "schedule read work %p\n", m);
+                       P9_DPRINTK(P9_DEBUG_TRANS, "sched read work %p\n", m);
                        queue_work(p9_mux_wq, &m->rq);
                } else
                        clear_bit(Rworksched, &m->wsched);
@@ -470,7 +391,6 @@ static void p9_read_work(struct work_struct *work)
                clear_bit(Rworksched, &m->wsched);
 
        return;
-
 error:
        p9_conn_cancel(m, err);
        clear_bit(Rworksched, &m->wsched);
@@ -502,7 +422,7 @@ static int p9_fd_write(struct p9_client *client, void *v, int len)
        oldfs = get_fs();
        set_fs(get_ds());
        /* The cast to a user pointer is valid due to the set_fs() */
-       ret = vfs_write(ts->wr, (void __user *)v, len, &ts->wr->f_pos);
+       ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos);
        set_fs(oldfs);
 
        if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
@@ -539,6 +459,7 @@ static void p9_write_work(struct work_struct *work)
                req = list_entry(m->unsent_req_list.next, struct p9_req_t,
                               req_list);
                req->status = REQ_STATUS_SENT;
+               P9_DPRINTK(P9_DEBUG_TRANS, "move req %p\n", req);
                list_move_tail(&req->req_list, &m->req_list);
 
                m->wbuf = req->tc->sdata;
@@ -547,11 +468,11 @@ static void p9_write_work(struct work_struct *work)
                spin_unlock(&m->client->lock);
        }
 
-       P9_DPRINTK(P9_DEBUG_MUX, "mux %p pos %d size %d\n", m, m->wpos,
+       P9_DPRINTK(P9_DEBUG_TRANS, "mux %p pos %d size %d\n", m, m->wpos,
                                                                m->wsize);
        clear_bit(Wpending, &m->wsched);
        err = p9_fd_write(m->client, m->wbuf + m->wpos, m->wsize - m->wpos);
-       P9_DPRINTK(P9_DEBUG_MUX, "mux %p sent %d bytes\n", m, err);
+       P9_DPRINTK(P9_DEBUG_TRANS, "mux %p sent %d bytes\n", m, err);
        if (err == -EAGAIN) {
                clear_bit(Wworksched, &m->wsched);
                return;
@@ -575,7 +496,7 @@ static void p9_write_work(struct work_struct *work)
                        n = p9_fd_poll(m->client, NULL);
 
                if (n & POLLOUT) {
-                       P9_DPRINTK(P9_DEBUG_MUX, "schedule write work %p\n", m);
+                       P9_DPRINTK(P9_DEBUG_TRANS, "sched write work %p\n", m);
                        queue_work(p9_mux_wq, &m->wq);
                } else
                        clear_bit(Wworksched, &m->wsched);
@@ -634,12 +555,6 @@ p9_pollwait(struct file *filp, wait_queue_head_t *wait_address, poll_table *p)
                return;
        }
 
-       if (!wait_address) {
-               P9_DPRINTK(P9_DEBUG_ERROR, "no wait_address\n");
-               pwait->wait_addr = ERR_PTR(-EIO);
-               return;
-       }
-
        pwait->conn = m;
        pwait->wait_addr = wait_address;
        init_waitqueue_func_entry(&pwait->wait, p9_pollwake);
@@ -655,10 +570,11 @@ p9_pollwait(struct file *filp, wait_queue_head_t *wait_address, poll_table *p)
 
 static struct p9_conn *p9_conn_create(struct p9_client *client)
 {
-       int i, n;
+       int n;
        struct p9_conn *m;
 
-       P9_DPRINTK(P9_DEBUG_MUX, "client %p msize %d\n", client, client->msize);
+       P9_DPRINTK(P9_DEBUG_TRANS, "client %p msize %d\n", client,
+                                                               client->msize);
        m = kzalloc(sizeof(struct p9_conn), GFP_KERNEL);
        if (!m)
                return ERR_PTR(-ENOMEM);
@@ -675,24 +591,15 @@ static struct p9_conn *p9_conn_create(struct p9_client *client)
 
        n = p9_fd_poll(client, &m->pt);
        if (n & POLLIN) {
-               P9_DPRINTK(P9_DEBUG_MUX, "mux %p can read\n", m);
+               P9_DPRINTK(P9_DEBUG_TRANS, "mux %p can read\n", m);
                set_bit(Rpending, &m->wsched);
        }
 
        if (n & POLLOUT) {
-               P9_DPRINTK(P9_DEBUG_MUX, "mux %p can write\n", m);
+               P9_DPRINTK(P9_DEBUG_TRANS, "mux %p can write\n", m);
                set_bit(Wpending, &m->wsched);
        }
 
-       for (i = 0; i < ARRAY_SIZE(m->poll_wait); i++) {
-               if (IS_ERR(m->poll_wait[i].wait_addr)) {
-                       p9_mux_poll_stop(m);
-                       kfree(m);
-                       /* return the error code */
-                       return (void *)m->poll_wait[i].wait_addr;
-               }
-       }
-
        return m;
 }
 
@@ -711,7 +618,7 @@ static void p9_poll_mux(struct p9_conn *m)
 
        n = p9_fd_poll(m->client, NULL);
        if (n < 0 || n & (POLLERR | POLLHUP | POLLNVAL)) {
-               P9_DPRINTK(P9_DEBUG_MUX, "error mux %p err %d\n", m, n);
+               P9_DPRINTK(P9_DEBUG_TRANS, "error mux %p err %d\n", m, n);
                if (n >= 0)
                        n = -ECONNRESET;
                p9_conn_cancel(m, n);
@@ -719,76 +626,50 @@ static void p9_poll_mux(struct p9_conn *m)
 
        if (n & POLLIN) {
                set_bit(Rpending, &m->wsched);
-               P9_DPRINTK(P9_DEBUG_MUX, "mux %p can read\n", m);
+               P9_DPRINTK(P9_DEBUG_TRANS, "mux %p can read\n", m);
                if (!test_and_set_bit(Rworksched, &m->wsched)) {
-                       P9_DPRINTK(P9_DEBUG_MUX, "schedule read work %p\n", m);
+                       P9_DPRINTK(P9_DEBUG_TRANS, "sched read work %p\n", m);
                        queue_work(p9_mux_wq, &m->rq);
                }
        }
 
        if (n & POLLOUT) {
                set_bit(Wpending, &m->wsched);
-               P9_DPRINTK(P9_DEBUG_MUX, "mux %p can write\n", m);
-               if ((m->wsize || !list_empty(&m->unsent_req_list))
-                   && !test_and_set_bit(Wworksched, &m->wsched)) {
-                       P9_DPRINTK(P9_DEBUG_MUX, "schedule write work %p\n", m);
+               P9_DPRINTK(P9_DEBUG_TRANS, "mux %p can write\n", m);
+               if ((m->wsize || !list_empty(&m->unsent_req_list)) &&
+                   !test_and_set_bit(Wworksched, &m->wsched)) {
+                       P9_DPRINTK(P9_DEBUG_TRANS, "sched write work %p\n", m);
                        queue_work(p9_mux_wq, &m->wq);
                }
        }
 }
 
 /**
- * p9_send_request - send 9P request
+ * p9_fd_request - send 9P request
  * The function can sleep until the request is scheduled for sending.
  * The function can be interrupted. Return from the function is not
- * a guarantee that the request is sent successfully. Can return errors
- * that can be retrieved by PTR_ERR macros.
+ * a guarantee that the request is sent successfully.
  *
- * @m: mux data
- * @tc: request to be sent
+ * @client: client instance
+ * @req: request to be sent
  *
  */
 
-static struct p9_req_t *p9_send_request(struct p9_conn *m, struct p9_fcall *tc)
+static int p9_fd_request(struct p9_client *client, struct p9_req_t *req)
 {
-       int tag;
        int n;
-       struct p9_req_t *req;
+       struct p9_trans_fd *ts = client->trans;
+       struct p9_conn *m = ts->conn;
 
-       P9_DPRINTK(P9_DEBUG_MUX, "mux %p task %p tcall %p id %d\n", m, current,
-               tc, tc->id);
+       P9_DPRINTK(P9_DEBUG_TRANS, "mux %p task %p tcall %p id %d\n", m,
+                                               current, req->tc, req->tc->id);
        if (m->err < 0)
-               return ERR_PTR(m->err);
-
-       tag = P9_NOTAG;
-       if (tc->id != P9_TVERSION) {
-               tag = p9_idpool_get(m->client->tagpool);
-               if (tag < 0)
-                       return ERR_PTR(-ENOMEM);
-       }
-
-       p9_set_tag(tc, tag);
+               return m->err;
 
-       req = p9_tag_alloc(m->client, tag);
-
-#ifdef CONFIG_NET_9P_DEBUG
-       if ((p9_debug_level&P9_DEBUG_FCALL) == P9_DEBUG_FCALL) {
-               char buf[150];
-
-               p9_printfcall(buf, sizeof(buf), tc, m->client->dotu);
-               printk(KERN_NOTICE "<<< %p %s\n", m, buf);
-       }
-#endif
-
-       req->tag = tag;
-       req->tc = tc;
-       req->rc = NULL;
-       req->t_err = 0;
+       spin_lock(&client->lock);
        req->status = REQ_STATUS_UNSENT;
-
-       spin_lock(&m->client->lock);
        list_add_tail(&req->req_list, &m->unsent_req_list);
-       spin_unlock(&m->client->lock);
+       spin_unlock(&client->lock);
 
        if (test_and_clear_bit(Wpending, &m->wsched))
                n = POLLOUT;
@@ -798,125 +679,33 @@ static struct p9_req_t *p9_send_request(struct p9_conn *m, struct p9_fcall *tc)
        if (n & POLLOUT && !test_and_set_bit(Wworksched, &m->wsched))
                queue_work(p9_mux_wq, &m->wq);
 
-       return req;
-}
-
-static int
-p9_mux_flush_request(struct p9_conn *m, struct p9_req_t *req)
-{
-       struct p9_fcall *fc;
-       struct p9_req_t *rreq, *rptr;
-
-       P9_DPRINTK(P9_DEBUG_MUX, "mux %p req %p tag %d\n", m, req, req->tag);
-
-       /* if a response was received for a request, do nothing */
-       if (req->rc || req->t_err) {
-               P9_DPRINTK(P9_DEBUG_MUX,
-                       "mux %p req %p response already received\n", m, req);
-               return 0;
-       }
-
-       req->status = REQ_STATUS_FLSH;
-
-       spin_lock(&m->client->lock);
-       /* if the request is not sent yet, just remove it from the list */
-       list_for_each_entry_safe(rreq, rptr, &m->unsent_req_list, req_list) {
-               if (rreq->tag == req->tag) {
-                       P9_DPRINTK(P9_DEBUG_MUX,
-                          "mux %p req %p request is not sent yet\n", m, req);
-                       list_del(&rreq->req_list);
-                       req->status = REQ_STATUS_FLSHD;
-                       spin_unlock(&m->client->lock);
-                       p9_conn_rpc_cb(m->client, req);
-                       return 0;
-               }
-       }
-       spin_unlock(&m->client->lock);
-
-       clear_thread_flag(TIF_SIGPENDING);
-       fc = p9_create_tflush(req->tag);
-       p9_send_request(m, fc);
-       return 1;
+       return 0;
 }
 
-/**
- * p9_fd_rpc- sends 9P request and waits until a response is available.
- *     The function can be interrupted.
- * @client: client instance
- * @tc: request to be sent
- * @rc: pointer where a pointer to the response is stored
- *
- */
-
-int
-p9_fd_rpc(struct p9_client *client, struct p9_fcall *tc, struct p9_fcall **rc)
+static int p9_fd_cancel(struct p9_client *client, struct p9_req_t *req)
 {
-       struct p9_trans_fd *p = client->trans;
-       struct p9_conn *m = p->conn;
-       int err, sigpending;
-       unsigned long flags;
-       struct p9_req_t *req;
+       int ret = 1;
 
-       if (rc)
-               *rc = NULL;
+       P9_DPRINTK(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
 
-       sigpending = 0;
-       if (signal_pending(current)) {
-               sigpending = 1;
-               clear_thread_flag(TIF_SIGPENDING);
-       }
+       spin_lock(&client->lock);
 
-       req = p9_send_request(m, tc);
-       if (IS_ERR(req)) {
-               err = PTR_ERR(req);
-               P9_DPRINTK(P9_DEBUG_MUX, "error %d\n", err);
-               return err;
-       }
-
-       err = wait_event_interruptible(*req->wq, req->rc != NULL ||
-                                                               req->t_err < 0);
-       if (req->t_err < 0)
-               err = req->t_err;
-
-       if (err == -ERESTARTSYS && client->status == Connected
-                                                       && m->err == 0) {
-               if (p9_mux_flush_request(m, req)) {
-                       /* wait until we get response of the flush message */
-                       do {
-                               clear_thread_flag(TIF_SIGPENDING);
-                               err = wait_event_interruptible(*req->wq,
-                                       req->rc || req->t_err);
-                       } while (!req->rc && !req->t_err &&
-                                       err == -ERESTARTSYS &&
-                                       client->status == Connected && !m->err);
-
-                       err = -ERESTARTSYS;
-               }
-               sigpending = 1;
-       }
-
-       if (sigpending) {
-               spin_lock_irqsave(&current->sighand->siglock, flags);
-               recalc_sigpending();
-               spin_unlock_irqrestore(&current->sighand->siglock, flags);
-       }
-
-       if (rc)
-               *rc = req->rc;
-       else
-               kfree(req->rc);
+       if (req->status == REQ_STATUS_UNSENT) {
+               list_del(&req->req_list);
+               req->status = REQ_STATUS_FLSHD;
+               ret = 0;
+       } else if (req->status == REQ_STATUS_SENT)
+               req->status = REQ_STATUS_FLSH;
 
-       p9_free_req(client, req);
-       if (err > 0)
-               err = -EIO;
+       spin_unlock(&client->lock);
 
-       return err;
+       return ret;
 }
 
 /**
- * parse_options - parse mount options into session structure
- * @options: options string passed from mount
- * @opts: transport-specific structure to parse options into
+ * parse_opts - parse mount options into p9_fd_opts structure
+ * @params: options string passed from mount
+ * @opts: fd transport-specific structure to parse options into
  *
  * Returns 0 upon success, -ERRNO upon failure
  */
@@ -926,7 +715,7 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
        char *p;
        substring_t args[MAX_OPT_ARGS];
        int option;
-       char *options;
+       char *options, *tmp_options;
        int ret;
 
        opts->port = P9_PORT;
@@ -936,12 +725,13 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
        if (!params)
                return 0;
 
-       options = kstrdup(params, GFP_KERNEL);
-       if (!options) {
+       tmp_options = kstrdup(params, GFP_KERNEL);
+       if (!tmp_options) {
                P9_DPRINTK(P9_DEBUG_ERROR,
                                "failed to allocate copy of option string\n");
                return -ENOMEM;
        }
+       options = tmp_options;
 
        while ((p = strsep(&options, ",")) != NULL) {
                int token;
@@ -949,12 +739,14 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
                if (!*p)
                        continue;
                token = match_token(p, tokens, args);
-               r = match_int(&args[0], &option);
-               if (r < 0) {
-                       P9_DPRINTK(P9_DEBUG_ERROR,
-                        "integer field, but no integer?\n");
-                       ret = r;
-                       continue;
+               if (token != Opt_err) {
+                       r = match_int(&args[0], &option);
+                       if (r < 0) {
+                               P9_DPRINTK(P9_DEBUG_ERROR,
+                               "integer field, but no integer?\n");
+                               ret = r;
+                               continue;
+                       }
                }
                switch (token) {
                case Opt_port:
@@ -970,7 +762,8 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
                        continue;
                }
        }
-       kfree(options);
+
+       kfree(tmp_options);
        return 0;
 }
 
@@ -1000,24 +793,41 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd)
 
 static int p9_socket_open(struct p9_client *client, struct socket *csocket)
 {
-       int fd, ret;
+       struct p9_trans_fd *p;
+       int ret, fd;
+
+       p = kmalloc(sizeof(struct p9_trans_fd), GFP_KERNEL);
+       if (!p)
+               return -ENOMEM;
 
        csocket->sk->sk_allocation = GFP_NOIO;
        fd = sock_map_fd(csocket, 0);
        if (fd < 0) {
                P9_EPRINTK(KERN_ERR, "p9_socket_open: failed to map fd\n");
+               sock_release(csocket);
+               kfree(p);
                return fd;
        }
 
-       ret = p9_fd_open(client, fd, fd);
-       if (ret < 0) {
-               P9_EPRINTK(KERN_ERR, "p9_socket_open: failed to open fd\n");
+       get_file(csocket->file);
+       get_file(csocket->file);
+       p->wr = p->rd = csocket->file;
+       client->trans = p;
+       client->status = Connected;
+
+       sys_close(fd);  /* still racy */
+
+       p->rd->f_flags |= O_NONBLOCK;
+
+       p->conn = p9_conn_create(client);
+       if (IS_ERR(p->conn)) {
+               ret = PTR_ERR(p->conn);
+               p->conn = NULL;
+               kfree(p);
+               sockfd_put(csocket);
                sockfd_put(csocket);
                return ret;
        }
-
-       ((struct p9_trans_fd *)client->trans)->rd->f_flags |= O_NONBLOCK;
-
        return 0;
 }
 
@@ -1029,7 +839,7 @@ static int p9_socket_open(struct p9_client *client, struct socket *csocket)
 
 static void p9_conn_destroy(struct p9_conn *m)
 {
-       P9_DPRINTK(P9_DEBUG_MUX, "mux %p prev %p next %p\n", m,
+       P9_DPRINTK(P9_DEBUG_TRANS, "mux %p prev %p next %p\n", m,
                m->mux_list.prev, m->mux_list.next);
 
        p9_mux_poll_stop(m);
@@ -1095,7 +905,6 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
        struct socket *csocket;
        struct sockaddr_in sin_server;
        struct p9_fd_opts opts;
-       struct p9_trans_fd *p = NULL; /* this gets allocated in p9_fd_open */
 
        err = parse_opts(args, &opts);
        if (err < 0)
@@ -1109,12 +918,11 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
        sin_server.sin_family = AF_INET;
        sin_server.sin_addr.s_addr = in_aton(addr);
        sin_server.sin_port = htons(opts.port);
-       sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, &csocket);
+       err = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, &csocket);
 
-       if (!csocket) {
+       if (err) {
                P9_EPRINTK(KERN_ERR, "p9_trans_tcp: problem creating socket\n");
-               err = -EIO;
-               goto error;
+               return err;
        }
 
        err = csocket->ops->connect(csocket,
@@ -1124,30 +932,11 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
                P9_EPRINTK(KERN_ERR,
                        "p9_trans_tcp: problem connecting socket to %s\n",
                        addr);
-               goto error;
-       }
-
-       err = p9_socket_open(client, csocket);
-       if (err < 0)
-               goto error;
-
-       p = (struct p9_trans_fd *) client->trans;
-       p->conn = p9_conn_create(client);
-       if (IS_ERR(p->conn)) {
-               err = PTR_ERR(p->conn);
-               p->conn = NULL;
-               goto error;
-       }
-
-       return 0;
-
-error:
-       if (csocket)
                sock_release(csocket);
+               return err;
+       }
 
-       kfree(p);
-
-       return err;
+       return p9_socket_open(client, csocket);
 }
 
 static int
@@ -1156,49 +945,33 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args)
        int err;
        struct socket *csocket;
        struct sockaddr_un sun_server;
-       struct p9_trans_fd *p = NULL; /* this gets allocated in p9_fd_open */
 
        csocket = NULL;
 
        if (strlen(addr) > UNIX_PATH_MAX) {
                P9_EPRINTK(KERN_ERR, "p9_trans_unix: address too long: %s\n",
                        addr);
-               err = -ENAMETOOLONG;
-               goto error;
+               return -ENAMETOOLONG;
        }
 
        sun_server.sun_family = PF_UNIX;
        strcpy(sun_server.sun_path, addr);
-       sock_create_kern(PF_UNIX, SOCK_STREAM, 0, &csocket);
+       err = sock_create_kern(PF_UNIX, SOCK_STREAM, 0, &csocket);
+       if (err < 0) {
+               P9_EPRINTK(KERN_ERR, "p9_trans_unix: problem creating socket\n");
+               return err;
+       }
        err = csocket->ops->connect(csocket, (struct sockaddr *)&sun_server,
                        sizeof(struct sockaddr_un) - 1, 0);
        if (err < 0) {
                P9_EPRINTK(KERN_ERR,
                        "p9_trans_unix: problem connecting socket: %s: %d\n",
                        addr, err);
-               goto error;
-       }
-
-       err = p9_socket_open(client, csocket);
-       if (err < 0)
-               goto error;
-
-       p = (struct p9_trans_fd *) client->trans;
-       p->conn = p9_conn_create(client);
-       if (IS_ERR(p->conn)) {
-               err = PTR_ERR(p->conn);
-               p->conn = NULL;
-               goto error;
-       }
-
-       return 0;
-
-error:
-       if (csocket)
                sock_release(csocket);
+               return err;
+       }
 
-       kfree(p);
-       return err;
+       return p9_socket_open(client, csocket);
 }
 
 static int
@@ -1206,7 +979,7 @@ p9_fd_create(struct p9_client *client, const char *addr, char *args)
 {
        int err;
        struct p9_fd_opts opts;
-       struct p9_trans_fd *p = NULL; /* this get allocated in p9_fd_open */
+       struct p9_trans_fd *p;
 
        parse_opts(args, &opts);
 
@@ -1217,21 +990,19 @@ p9_fd_create(struct p9_client *client, const char *addr, char *args)
 
        err = p9_fd_open(client, opts.rfd, opts.wfd);
        if (err < 0)
-               goto error;
+               return err;
 
        p = (struct p9_trans_fd *) client->trans;
        p->conn = p9_conn_create(client);
        if (IS_ERR(p->conn)) {
                err = PTR_ERR(p->conn);
                p->conn = NULL;
-               goto error;
+               fput(p->rd);
+               fput(p->wr);
+               return err;
        }
 
        return 0;
-
-error:
-       kfree(p);
-       return err;
 }
 
 static struct p9_trans_module p9_tcp_trans = {
@@ -1240,7 +1011,8 @@ static struct p9_trans_module p9_tcp_trans = {
        .def = 1,
        .create = p9_fd_create_tcp,
        .close = p9_fd_close,
-       .rpc = p9_fd_rpc,
+       .request = p9_fd_request,
+       .cancel = p9_fd_cancel,
        .owner = THIS_MODULE,
 };
 
@@ -1250,7 +1022,8 @@ static struct p9_trans_module p9_unix_trans = {
        .def = 0,
        .create = p9_fd_create_unix,
        .close = p9_fd_close,
-       .rpc = p9_fd_rpc,
+       .request = p9_fd_request,
+       .cancel = p9_fd_cancel,
        .owner = THIS_MODULE,
 };
 
@@ -1260,7 +1033,8 @@ static struct p9_trans_module p9_fd_trans = {
        .def = 0,
        .create = p9_fd_create,
        .close = p9_fd_close,
-       .rpc = p9_fd_rpc,
+       .request = p9_fd_request,
+       .cancel = p9_fd_cancel,
        .owner = THIS_MODULE,
 };
 
@@ -1277,7 +1051,7 @@ static int p9_poll_proc(void *a)
 {
        unsigned long flags;
 
-       P9_DPRINTK(P9_DEBUG_MUX, "start %p\n", current);
+       P9_DPRINTK(P9_DEBUG_TRANS, "start %p\n", current);
  repeat:
        spin_lock_irqsave(&p9_poll_lock, flags);
        while (!list_empty(&p9_poll_pending_list)) {
@@ -1295,7 +1069,7 @@ static int p9_poll_proc(void *a)
 
        set_current_state(TASK_INTERRUPTIBLE);
        if (list_empty(&p9_poll_pending_list)) {
-               P9_DPRINTK(P9_DEBUG_MUX, "sleeping...\n");
+               P9_DPRINTK(P9_DEBUG_TRANS, "sleeping...\n");
                schedule();
        }
        __set_current_state(TASK_RUNNING);
@@ -1303,7 +1077,7 @@ static int p9_poll_proc(void *a)
        if (!kthread_should_stop())
                goto repeat;
 
-       P9_DPRINTK(P9_DEBUG_MUX, "finish\n");
+       P9_DPRINTK(P9_DEBUG_TRANS, "finish\n");
        return 0;
 }