26 files changed, 2845 insertions, 1606 deletions

diff --git a/net/sunrpc/Makefile b/net/sunrpc/Makefile
index 46a2ce00a29b..cdcab9ca4c60 100644
--- a/net/sunrpc/Makefile
+++ b/net/sunrpc/Makefile
@@ -6,7 +6,7 @@
 obj-$(CONFIG_SUNRPC) += sunrpc.o
 obj-$(CONFIG_SUNRPC_GSS) += auth_gss/
 
-sunrpc-y := clnt.o xprt.o sched.o \
+sunrpc-y := clnt.o xprt.o socklib.o xprtsock.o sched.o \
             auth.o auth_null.o auth_unix.o \
             svc.o svcsock.o svcauth.o svcauth_unix.o \
             pmap_clnt.o timer.o xdr.o \
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 505e2d4b3d62..a415d99c394d 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -11,7 +11,6 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/errno.h>
-#include <linux/socket.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/spinlock.h>
 
diff --git a/net/sunrpc/auth_gss/Makefile b/net/sunrpc/auth_gss/Makefile
index fe1b874084bc..f3431a7e33da 100644
--- a/net/sunrpc/auth_gss/Makefile
+++ b/net/sunrpc/auth_gss/Makefile
@@ -10,7 +10,7 @@ auth_rpcgss-objs := auth_gss.o gss_generic_token.o \
 obj-$(CONFIG_RPCSEC_GSS_KRB5) += rpcsec_gss_krb5.o
 
 rpcsec_gss_krb5-objs := gss_krb5_mech.o gss_krb5_seal.o gss_krb5_unseal.o \
-        gss_krb5_seqnum.o
+        gss_krb5_seqnum.o gss_krb5_wrap.o
 
 obj-$(CONFIG_RPCSEC_GSS_SPKM3) += rpcsec_gss_spkm3.o
 
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 2f7b867161d2..f44f46f1d8e0 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -42,9 +42,8 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/slab.h>
-#include <linux/socket.h>
-#include <linux/in.h>
 #include <linux/sched.h>
+#include <linux/pagemap.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/auth.h>
 #include <linux/sunrpc/auth_gss.h>
@@ -846,10 +845,8 @@ gss_marshal(struct rpc_task *task, u32 *p)
 
         /* We compute the checksum for the verifier over the xdr-encoded bytes
          * starting with the xid and ending at the end of the credential: */
-        iov.iov_base = req->rq_snd_buf.head[0].iov_base;
-        if (task->tk_client->cl_xprt->stream)
-                /* See clnt.c:call_header() */
-                iov.iov_base += 4;
+        iov.iov_base = xprt_skip_transport_header(task->tk_xprt,
+                                        req->rq_snd_buf.head[0].iov_base);
         iov.iov_len = (u8 *)p - (u8 *)iov.iov_base;
         xdr_buf_from_iov(&iov, &verf_buf);
 
@@ -857,9 +854,7 @@ gss_marshal(struct rpc_task *task, u32 *p)
         *p++ = htonl(RPC_AUTH_GSS);
 
         mic.data = (u8 *)(p + 1);
-        maj_stat = gss_get_mic(ctx->gc_gss_ctx,
-                               GSS_C_QOP_DEFAULT, 
-                               &verf_buf, &mic);
+        maj_stat = gss_get_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
         if (maj_stat == GSS_S_CONTEXT_EXPIRED) {
                 cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
         } else if (maj_stat != 0) {
@@ -890,10 +885,8 @@ static u32 *
 gss_validate(struct rpc_task *task, u32 *p)
 {
         struct rpc_cred *cred = task->tk_msg.rpc_cred;
-        struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
-                                                gc_base);
         struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
-        u32             seq, qop_state;
+        u32             seq;
         struct kvec     iov;
         struct xdr_buf  verf_buf;
         struct xdr_netobj mic;
@@ -914,23 +907,14 @@ gss_validate(struct rpc_task *task, u32 *p)
         mic.data = (u8 *)p;
         mic.len = len;
 
-        maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &verf_buf, &mic, &qop_state);
+        maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
                 cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
         if (maj_stat)
                 goto out_bad;
-       switch (gss_cred->gc_service) {
-       case RPC_GSS_SVC_NONE:
-               /* verifier data, flavor, length: */
-               task->tk_auth->au_rslack = XDR_QUADLEN(len) + 2;
-               break;
-       case RPC_GSS_SVC_INTEGRITY:
-               /* verifier data, flavor, length, length, sequence number: */
-               task->tk_auth->au_rslack = XDR_QUADLEN(len) + 4;
-               break;
-       case RPC_GSS_SVC_PRIVACY:
-               goto out_bad;
-       }
+        /* We leave it to unwrap to calculate au_rslack. For now we just
+         * calculate the length of the verifier: */
+        task->tk_auth->au_verfsize = XDR_QUADLEN(len) + 2;
         gss_put_ctx(ctx);
         dprintk("RPC: %4u GSS gss_validate: gss_verify_mic succeeded.\n",
                         task->tk_pid);
@@ -975,8 +959,7 @@ gss_wrap_req_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
         p = iov->iov_base + iov->iov_len;
         mic.data = (u8 *)(p + 1);
 
-        maj_stat = gss_get_mic(ctx->gc_gss_ctx,
-                        GSS_C_QOP_DEFAULT, &integ_buf, &mic);
+        maj_stat = gss_get_mic(ctx->gc_gss_ctx, &integ_buf, &mic);
         status = -EIO; /* XXX? */
         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
                 cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
@@ -990,6 +973,113 @@ gss_wrap_req_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
         return 0;
 }
 
+static void
+priv_release_snd_buf(struct rpc_rqst *rqstp)
+{
+        int i;
+
+        for (i=0; i < rqstp->rq_enc_pages_num; i++)
+                __free_page(rqstp->rq_enc_pages[i]);
+        kfree(rqstp->rq_enc_pages);
+}
+
+static int
+alloc_enc_pages(struct rpc_rqst *rqstp)
+{
+        struct xdr_buf *snd_buf = &rqstp->rq_snd_buf;
+        int first, last, i;
+
+        if (snd_buf->page_len == 0) {
+                rqstp->rq_enc_pages_num = 0;
+                return 0;
+        }
+
+        first = snd_buf->page_base >> PAGE_CACHE_SHIFT;
+        last = (snd_buf->page_base + snd_buf->page_len - 1) >> PAGE_CACHE_SHIFT;
+        rqstp->rq_enc_pages_num = last - first + 1 + 1;
+        rqstp->rq_enc_pages
+                = kmalloc(rqstp->rq_enc_pages_num * sizeof(struct page *),
+                                GFP_NOFS);
+        if (!rqstp->rq_enc_pages)
+                goto out;
+        for (i=0; i < rqstp->rq_enc_pages_num; i++) {
+                rqstp->rq_enc_pages[i] = alloc_page(GFP_NOFS);
+                if (rqstp->rq_enc_pages[i] == NULL)
+                        goto out_free;
+        }
+        rqstp->rq_release_snd_buf = priv_release_snd_buf;
+        return 0;
+out_free:
+        for (i--; i >= 0; i--) {
+                __free_page(rqstp->rq_enc_pages[i]);
+        }
+out:
+        return -EAGAIN;
+}
+
+static inline int
+gss_wrap_req_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
+                kxdrproc_t encode, struct rpc_rqst *rqstp, u32 *p, void *obj)
+{
+        struct xdr_buf  *snd_buf = &rqstp->rq_snd_buf;
+        u32             offset;
+        u32             maj_stat;
+        int             status;
+        u32             *opaque_len;
+        struct page     **inpages;
+        int             first;
+        int             pad;
+        struct kvec     *iov;
+        char            *tmp;
+
+        opaque_len = p++;
+        offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
+        *p++ = htonl(rqstp->rq_seqno);
+
+        status = encode(rqstp, p, obj);
+        if (status)
+                return status;
+
+        status = alloc_enc_pages(rqstp);
+        if (status)
+                return status;
+        first = snd_buf->page_base >> PAGE_CACHE_SHIFT;
+        inpages = snd_buf->pages + first;
+        snd_buf->pages = rqstp->rq_enc_pages;
+        snd_buf->page_base -= first << PAGE_CACHE_SHIFT;
+        /* Give the tail its own page, in case we need extra space in the
+         * head when wrapping: */
+        if (snd_buf->page_len || snd_buf->tail[0].iov_len) {
+                tmp = page_address(rqstp->rq_enc_pages[rqstp->rq_enc_pages_num - 1]);
+                memcpy(tmp, snd_buf->tail[0].iov_base, snd_buf->tail[0].iov_len);
+                snd_buf->tail[0].iov_base = tmp;
+        }
+        maj_stat = gss_wrap(ctx->gc_gss_ctx, offset, snd_buf, inpages);
+        /* RPC_SLACK_SPACE should prevent this ever happening: */
+        BUG_ON(snd_buf->len > snd_buf->buflen);
+        status = -EIO;
+        /* We're assuming that when GSS_S_CONTEXT_EXPIRED, the encryption was
+         * done anyway, so it's safe to put the request on the wire: */
+        if (maj_stat == GSS_S_CONTEXT_EXPIRED)
+                cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
+        else if (maj_stat)
+                return status;
+
+        *opaque_len = htonl(snd_buf->len - offset);
+        /* guess whether we're in the head or the tail: */
+        if (snd_buf->page_len || snd_buf->tail[0].iov_len)
+                iov = snd_buf->tail;
+        else
+                iov = snd_buf->head;
+        p = iov->iov_base + iov->iov_len;
+        pad = 3 - ((snd_buf->len - offset - 1) & 3);
+        memset(p, 0, pad);
+        iov->iov_len += pad;
+        snd_buf->len += pad;
+
+        return 0;
+}
+
 static int
 gss_wrap_req(struct rpc_task *task,
              kxdrproc_t encode, void *rqstp, u32 *p, void *obj)
@@ -1017,6 +1107,8 @@ gss_wrap_req(struct rpc_task *task,
                                                                 rqstp, p, obj);
                         break;
                 case RPC_GSS_SVC_PRIVACY:
+                        status = gss_wrap_req_priv(cred, ctx, encode,
+                                        rqstp, p, obj);
                         break;
         }
 out:
@@ -1054,8 +1146,7 @@ gss_unwrap_resp_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
         if (xdr_buf_read_netobj(rcv_buf, &mic, mic_offset))
                 return status;
 
-        maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &integ_buf,
-                        &mic, NULL);
+        maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &integ_buf, &mic);
         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
                 cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
         if (maj_stat != GSS_S_COMPLETE)
@@ -1063,6 +1154,35 @@ gss_unwrap_resp_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
         return 0;
 }
 
+static inline int
+gss_unwrap_resp_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
+                struct rpc_rqst *rqstp, u32 **p)
+{
+        struct xdr_buf  *rcv_buf = &rqstp->rq_rcv_buf;
+        u32 offset;
+        u32 opaque_len;
+        u32 maj_stat;
+        int status = -EIO;
+
+        opaque_len = ntohl(*(*p)++);
+        offset = (u8 *)(*p) - (u8 *)rcv_buf->head[0].iov_base;
+        if (offset + opaque_len > rcv_buf->len)
+                return status;
+        /* remove padding: */
+        rcv_buf->len = offset + opaque_len;
+
+        maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset, rcv_buf);
+        if (maj_stat == GSS_S_CONTEXT_EXPIRED)
+                cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
+        if (maj_stat != GSS_S_COMPLETE)
+                return status;
+        if (ntohl(*(*p)++) != rqstp->rq_seqno)
+                return status;
+
+        return 0;
+}
+
+
 static int
 gss_unwrap_resp(struct rpc_task *task,
                 kxdrproc_t decode, void *rqstp, u32 *p, void *obj)
@@ -1071,6 +1191,9 @@ gss_unwrap_resp(struct rpc_task *task,
         struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
                         gc_base);
         struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
+        u32             *savedp = p;
+        struct kvec     *head = ((struct rpc_rqst *)rqstp)->rq_rcv_buf.head;
+        int             savedlen = head->iov_len;
         int             status = -EIO;
 
         if (ctx->gc_proc != RPC_GSS_PROC_DATA)
@@ -1084,8 +1207,14 @@ gss_unwrap_resp(struct rpc_task *task,
                                 goto out;
                         break;
                 case RPC_GSS_SVC_PRIVACY:
+                        status = gss_unwrap_resp_priv(cred, ctx, rqstp, &p);
+                        if (status)
+                                goto out;
                         break;
         }
+        /* take into account extra slack for integrity and privacy cases: */
+        task->tk_auth->au_rslack = task->tk_auth->au_verfsize + (p - savedp)
+                                                + (savedlen - head->iov_len);
 out_decode:
         status = decode(rqstp, p, obj);
 out:
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index ee6ae74cd1b2..3f3d5437f02d 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -139,17 +139,91 @@ buf_to_sg(struct scatterlist *sg, char *ptr, int len) {
         sg->length = len;
 }
 
+static int
+process_xdr_buf(struct xdr_buf *buf, int offset, int len,
+                int (*actor)(struct scatterlist *, void *), void *data)
+{
+        int i, page_len, thislen, page_offset, ret = 0;
+        struct scatterlist      sg[1];
+
+        if (offset >= buf->head[0].iov_len) {
+                offset -= buf->head[0].iov_len;
+        } else {
+                thislen = buf->head[0].iov_len - offset;
+                if (thislen > len)
+                        thislen = len;
+                buf_to_sg(sg, buf->head[0].iov_base + offset, thislen);
+                ret = actor(sg, data);
+                if (ret)
+                        goto out;
+                offset = 0;
+                len -= thislen;
+        }
+        if (len == 0)
+                goto out;
+
+        if (offset >= buf->page_len) {
+                offset -= buf->page_len;
+        } else {
+                page_len = buf->page_len - offset;
+                if (page_len > len)
+                        page_len = len;
+                len -= page_len;
+                page_offset = (offset + buf->page_base) & (PAGE_CACHE_SIZE - 1);
+                i = (offset + buf->page_base) >> PAGE_CACHE_SHIFT;
+                thislen = PAGE_CACHE_SIZE - page_offset;
+                do {
+                        if (thislen > page_len)
+                                thislen = page_len;
+                        sg->page = buf->pages[i];
+                        sg->offset = page_offset;
+                        sg->length = thislen;
+                        ret = actor(sg, data);
+                        if (ret)
+                                goto out;
+                        page_len -= thislen;
+                        i++;
+                        page_offset = 0;
+                        thislen = PAGE_CACHE_SIZE;
+                } while (page_len != 0);
+                offset = 0;
+        }
+        if (len == 0)
+                goto out;
+
+        if (offset < buf->tail[0].iov_len) {
+                thislen = buf->tail[0].iov_len - offset;
+                if (thislen > len)
+                        thislen = len;
+                buf_to_sg(sg, buf->tail[0].iov_base + offset, thislen);
+                ret = actor(sg, data);
+                len -= thislen;
+        }
+        if (len != 0)
+                ret = -EINVAL;
+out:
+        return ret;
+}
+
+static int
+checksummer(struct scatterlist *sg, void *data)
+{
+        struct crypto_tfm *tfm = (struct crypto_tfm *)data;
+
+        crypto_digest_update(tfm, sg, 1);
+
+        return 0;
+}
+
 /* checksum the plaintext data and hdrlen bytes of the token header */
 s32
 make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
-                   struct xdr_netobj *cksum)
+                   int body_offset, struct xdr_netobj *cksum)
 {
         char                            *cksumname;
         struct crypto_tfm               *tfm = NULL; /* XXX add to ctx? */
         struct scatterlist              sg[1];
         u32                             code = GSS_S_FAILURE;
-        int                             len, thislen, offset;
-        int                             i;
 
         switch (cksumtype) {
                 case CKSUMTYPE_RSA_MD5:
@@ -169,33 +243,8 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
         crypto_digest_init(tfm);
         buf_to_sg(sg, header, hdrlen);
         crypto_digest_update(tfm, sg, 1);
-        if (body->head[0].iov_len) {
-                buf_to_sg(sg, body->head[0].iov_base, body->head[0].iov_len);
-                crypto_digest_update(tfm, sg, 1);
-        }
-
-        len = body->page_len;
-        if (len != 0) {
-                offset = body->page_base & (PAGE_CACHE_SIZE - 1);
-                i = body->page_base >> PAGE_CACHE_SHIFT;
-                thislen = PAGE_CACHE_SIZE - offset;
-                do {
-                        if (thislen > len)
-                                thislen = len;
-                        sg->page = body->pages[i];
-                        sg->offset = offset;
-                        sg->length = thislen;
-                        crypto_digest_update(tfm, sg, 1);
-                        len -= thislen;
-                        i++;
-                        offset = 0;
-                        thislen = PAGE_CACHE_SIZE;
-                } while(len != 0);
-        }
-        if (body->tail[0].iov_len) {
-                buf_to_sg(sg, body->tail[0].iov_base, body->tail[0].iov_len);
-                crypto_digest_update(tfm, sg, 1);
-        }
+        process_xdr_buf(body, body_offset, body->len - body_offset,
+                        checksummer, tfm);
         crypto_digest_final(tfm, cksum->data);
         code = 0;
 out:
@@ -204,3 +253,154 @@ out:
 }
 
 EXPORT_SYMBOL(make_checksum);
+
+struct encryptor_desc {
+        u8 iv[8]; /* XXX hard-coded blocksize */
+        struct crypto_tfm *tfm;
+        int pos;
+        struct xdr_buf *outbuf;
+        struct page **pages;
+        struct scatterlist infrags[4];
+        struct scatterlist outfrags[4];
+        int fragno;
+        int fraglen;
+};
+
+static int
+encryptor(struct scatterlist *sg, void *data)
+{
+        struct encryptor_desc *desc = data;
+        struct xdr_buf *outbuf = desc->outbuf;
+        struct page *in_page;
+        int thislen = desc->fraglen + sg->length;
+        int fraglen, ret;
+        int page_pos;
+
+        /* Worst case is 4 fragments: head, end of page 1, start
+         * of page 2, tail.  Anything more is a bug. */
+        BUG_ON(desc->fragno > 3);
+        desc->infrags[desc->fragno] = *sg;
+        desc->outfrags[desc->fragno] = *sg;
+
+        page_pos = desc->pos - outbuf->head[0].iov_len;
+        if (page_pos >= 0 && page_pos < outbuf->page_len) {
+                /* pages are not in place: */
+                int i = (page_pos + outbuf->page_base) >> PAGE_CACHE_SHIFT;
+                in_page = desc->pages[i];
+        } else {
+                in_page = sg->page;
+        }
+        desc->infrags[desc->fragno].page = in_page;
+        desc->fragno++;
+        desc->fraglen += sg->length;
+        desc->pos += sg->length;
+
+        fraglen = thislen & 7; /* XXX hardcoded blocksize */
+        thislen -= fraglen;
+
+        if (thislen == 0)
+                return 0;
+
+        ret = crypto_cipher_encrypt_iv(desc->tfm, desc->outfrags, desc->infrags,
+                                        thislen, desc->iv);
+        if (ret)
+                return ret;
+        if (fraglen) {
+                desc->outfrags[0].page = sg->page;
+                desc->outfrags[0].offset = sg->offset + sg->length - fraglen;
+                desc->outfrags[0].length = fraglen;
+                desc->infrags[0] = desc->outfrags[0];
+                desc->infrags[0].page = in_page;
+                desc->fragno = 1;
+                desc->fraglen = fraglen;
+        } else {
+                desc->fragno = 0;
+                desc->fraglen = 0;
+        }
+        return 0;
+}
+
+int
+gss_encrypt_xdr_buf(struct crypto_tfm *tfm, struct xdr_buf *buf, int offset,
+                struct page **pages)
+{
+        int ret;
+        struct encryptor_desc desc;
+
+        BUG_ON((buf->len - offset) % crypto_tfm_alg_blocksize(tfm) != 0);
+
+        memset(desc.iv, 0, sizeof(desc.iv));
+        desc.tfm = tfm;
+        desc.pos = offset;
+        desc.outbuf = buf;
+        desc.pages = pages;
+        desc.fragno = 0;
+        desc.fraglen = 0;
+
+        ret = process_xdr_buf(buf, offset, buf->len - offset, encryptor, &desc);
+        return ret;
+}
+
+EXPORT_SYMBOL(gss_encrypt_xdr_buf);
+
+struct decryptor_desc {
+        u8 iv[8]; /* XXX hard-coded blocksize */
+        struct crypto_tfm *tfm;
+        struct scatterlist frags[4];
+        int fragno;
+        int fraglen;
+};
+
+static int
+decryptor(struct scatterlist *sg, void *data)
+{
+        struct decryptor_desc *desc = data;
+        int thislen = desc->fraglen + sg->length;
+        int fraglen, ret;
+
+        /* Worst case is 4 fragments: head, end of page 1, start
+         * of page 2, tail.  Anything more is a bug. */
+        BUG_ON(desc->fragno > 3);
+        desc->frags[desc->fragno] = *sg;
+        desc->fragno++;
+        desc->fraglen += sg->length;
+
+        fraglen = thislen & 7; /* XXX hardcoded blocksize */
+        thislen -= fraglen;
+
+        if (thislen == 0)
+                return 0;
+
+        ret = crypto_cipher_decrypt_iv(desc->tfm, desc->frags, desc->frags,
+                                        thislen, desc->iv);
+        if (ret)
+                return ret;
+        if (fraglen) {
+                desc->frags[0].page = sg->page;
+                desc->frags[0].offset = sg->offset + sg->length - fraglen;
+                desc->frags[0].length = fraglen;
+                desc->fragno = 1;
+                desc->fraglen = fraglen;
+        } else {
+                desc->fragno = 0;
+                desc->fraglen = 0;
+        }
+        return 0;
+}
+
+int
+gss_decrypt_xdr_buf(struct crypto_tfm *tfm, struct xdr_buf *buf, int offset)
+{
+        struct decryptor_desc desc;
+
+        /* XXXJBF: */
+        BUG_ON((buf->len - offset) % crypto_tfm_alg_blocksize(tfm) != 0);
+
+        memset(desc.iv, 0, sizeof(desc.iv));
+        desc.tfm = tfm;
+        desc.fragno = 0;
+        desc.fraglen = 0;
+        return process_xdr_buf(buf, offset, buf->len - offset, decryptor, &desc);
+}
+
+EXPORT_SYMBOL(gss_decrypt_xdr_buf);
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index 606a8a82cafb..5f1f806a0b11 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -39,7 +39,6 @@
 #include <linux/types.h>
 #include <linux/slab.h>
 #include <linux/sunrpc/auth.h>
-#include <linux/in.h>
 #include <linux/sunrpc/gss_krb5.h>
 #include <linux/sunrpc/xdr.h>
 #include <linux/crypto.h>
@@ -191,43 +190,12 @@ gss_delete_sec_context_kerberos(void *internal_ctx) {
         kfree(kctx);
 }
 
-static u32
-gss_verify_mic_kerberos(struct gss_ctx          *ctx,
-                        struct xdr_buf          *message,
-                        struct xdr_netobj       *mic_token,
-                        u32                     *qstate) {
-        u32 maj_stat = 0;
-        int qop_state;
-        struct krb5_ctx *kctx = ctx->internal_ctx_id;
-
-        maj_stat = krb5_read_token(kctx, mic_token, message, &qop_state,
-                                   KG_TOK_MIC_MSG);
-        if (!maj_stat && qop_state)
-            *qstate = qop_state;
-
-        dprintk("RPC:      gss_verify_mic_kerberos returning %d\n", maj_stat);
-        return maj_stat;
-}
-
-static u32
-gss_get_mic_kerberos(struct gss_ctx     *ctx,
-                     u32                qop,
-                     struct xdr_buf     *message,
-                     struct xdr_netobj  *mic_token) {
-        u32 err = 0;
-        struct krb5_ctx *kctx = ctx->internal_ctx_id;
-
-        err = krb5_make_token(kctx, qop, message, mic_token, KG_TOK_MIC_MSG);
-
-        dprintk("RPC:      gss_get_mic_kerberos returning %d\n",err);
-
-        return err;
-}
-
 static struct gss_api_ops gss_kerberos_ops = {
         .gss_import_sec_context = gss_import_sec_context_kerberos,
         .gss_get_mic            = gss_get_mic_kerberos,
         .gss_verify_mic         = gss_verify_mic_kerberos,
+        .gss_wrap               = gss_wrap_kerberos,
+        .gss_unwrap             = gss_unwrap_kerberos,
         .gss_delete_sec_context = gss_delete_sec_context_kerberos,
 };
 
@@ -242,6 +210,11 @@ static struct pf_desc gss_kerberos_pfs[] = {
                 .service = RPC_GSS_SVC_INTEGRITY,
                 .name = "krb5i",
         },
+        [2] = {
+                .pseudoflavor = RPC_AUTH_GSS_KRB5P,
+                .service = RPC_GSS_SVC_PRIVACY,
+                .name = "krb5p",
+        },
 };
 
 static struct gss_api_mech gss_kerberos_mech = {
diff --git a/net/sunrpc/auth_gss/gss_krb5_seal.c b/net/sunrpc/auth_gss/gss_krb5_seal.c
index afeeb8715a77..13f8ae979454 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seal.c
@@ -70,22 +70,13 @@
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
-static inline int
-gss_krb5_padding(int blocksize, int length) {
-        /* Most of the code is block-size independent but in practice we
-         * use only 8: */
-        BUG_ON(blocksize != 8);
-        return 8 - (length & 7);
-}
-
 u32
-krb5_make_token(struct krb5_ctx *ctx, int qop_req,
-                   struct xdr_buf *text, struct xdr_netobj *token,
-                   int toktype)
+gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text,
+                struct xdr_netobj *token)
 {
+        struct krb5_ctx         *ctx = gss_ctx->internal_ctx_id;
         s32                     checksum_type;
         struct xdr_netobj       md5cksum = {.len = 0, .data = NULL};
-        int                     blocksize = 0, tmsglen;
         unsigned char           *ptr, *krb5_hdr, *msg_start;
         s32                     now;
 
@@ -93,9 +84,6 @@ krb5_make_token(struct krb5_ctx *ctx, int qop_req,
 
         now = get_seconds();
 
-        if (qop_req != 0)
-                goto out_err;
-
         switch (ctx->signalg) {
                 case SGN_ALG_DES_MAC_MD5:
                         checksum_type = CKSUMTYPE_RSA_MD5;
@@ -111,21 +99,13 @@ krb5_make_token(struct krb5_ctx *ctx, int qop_req,
                 goto out_err;
         }
 
-        if (toktype == KG_TOK_WRAP_MSG) {
-                blocksize = crypto_tfm_alg_blocksize(ctx->enc);
-                tmsglen = blocksize + text->len
-                        + gss_krb5_padding(blocksize, blocksize + text->len);
-        } else {
-                tmsglen = 0;
-        }
-
-        token->len = g_token_size(&ctx->mech_used, 22 + tmsglen);
+        token->len = g_token_size(&ctx->mech_used, 22);
 
         ptr = token->data;
-        g_make_token_header(&ctx->mech_used, 22 + tmsglen, &ptr);
+        g_make_token_header(&ctx->mech_used, 22, &ptr);
 
-        *ptr++ = (unsigned char) ((toktype>>8)&0xff);
-        *ptr++ = (unsigned char) (toktype&0xff);
+        *ptr++ = (unsigned char) ((KG_TOK_MIC_MSG>>8)&0xff);
+        *ptr++ = (unsigned char) (KG_TOK_MIC_MSG&0xff);
 
         /* ptr now at byte 2 of header described in rfc 1964, section 1.2.1: */
         krb5_hdr = ptr - 2;
@@ -133,17 +113,9 @@ krb5_make_token(struct krb5_ctx *ctx, int qop_req,
 
         *(u16 *)(krb5_hdr + 2) = htons(ctx->signalg);
         memset(krb5_hdr + 4, 0xff, 4);
-        if (toktype == KG_TOK_WRAP_MSG)
-                *(u16 *)(krb5_hdr + 4) = htons(ctx->sealalg);
 
-        if (toktype == KG_TOK_WRAP_MSG) {
-                /* XXX removing support for now */
-                goto out_err;
-        } else { /* Sign only.  */
-                if (make_checksum(checksum_type, krb5_hdr, 8, text,
-                                       &md5cksum))
+        if (make_checksum(checksum_type, krb5_hdr, 8, text, 0, &md5cksum))
                         goto out_err;
-        }
 
         switch (ctx->signalg) {
         case SGN_ALG_DES_MAC_MD5:
diff --git a/net/sunrpc/auth_gss/gss_krb5_unseal.c b/net/sunrpc/auth_gss/gss_krb5_unseal.c
index 8767fc53183d..2030475d98ed 100644
--- a/net/sunrpc/auth_gss/gss_krb5_unseal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_unseal.c
@@ -68,21 +68,14 @@
 #endif
 
 
-/* message_buffer is an input if toktype is MIC and an output if it is WRAP:
- * If toktype is MIC: read_token is a mic token, and message_buffer is the
- *   data that the mic was supposedly taken over.
- * If toktype is WRAP: read_token is a wrap token, and message_buffer is used
- *   to return the decrypted data.
- */
+/* read_token is a mic token, and message_buffer is the data that the mic was
+ * supposedly taken over. */
 
-/* XXX will need to change prototype and/or just split into a separate function
- * when we add privacy (because read_token will be in pages too). */
 u32
-krb5_read_token(struct krb5_ctx *ctx,
-                struct xdr_netobj *read_token,
-                struct xdr_buf *message_buffer,
-                int *qop_state, int toktype)
+gss_verify_mic_kerberos(struct gss_ctx *gss_ctx,
+                struct xdr_buf *message_buffer, struct xdr_netobj *read_token)
 {
+        struct krb5_ctx         *ctx = gss_ctx->internal_ctx_id;
         int                     signalg;
         int                     sealalg;
         s32                     checksum_type;
@@ -100,16 +93,12 @@ krb5_read_token(struct krb5_ctx *ctx,
                                         read_token->len))
                 goto out;
 
-        if ((*ptr++ != ((toktype>>8)&0xff)) || (*ptr++ != (toktype&0xff)))
+        if ((*ptr++ != ((KG_TOK_MIC_MSG>>8)&0xff)) ||
+            (*ptr++ != ( KG_TOK_MIC_MSG    &0xff))   )
                 goto out;
 
         /* XXX sanity-check bodysize?? */
 
-        if (toktype == KG_TOK_WRAP_MSG) {
-                /* XXX gone */
-                goto out;
-        }
-
         /* get the sign and seal algorithms */
 
         signalg = ptr[0] + (ptr[1] << 8);
@@ -120,14 +109,7 @@ krb5_read_token(struct krb5_ctx *ctx,
         if ((ptr[4] != 0xff) || (ptr[5] != 0xff))
                 goto out;
 
-        if (((toktype != KG_TOK_WRAP_MSG) && (sealalg != 0xffff)) ||
-            ((toktype == KG_TOK_WRAP_MSG) && (sealalg == 0xffff)))
-                goto out;
-
-        /* in the current spec, there is only one valid seal algorithm per
-           key type, so a simple comparison is ok */
-
-        if ((toktype == KG_TOK_WRAP_MSG) && !(sealalg == ctx->sealalg))
+        if (sealalg != 0xffff)
                 goto out;
 
         /* there are several mappings of seal algorithms to sign algorithms,
@@ -154,7 +136,7 @@ krb5_read_token(struct krb5_ctx *ctx,
         switch (signalg) {
         case SGN_ALG_DES_MAC_MD5:
                 ret = make_checksum(checksum_type, ptr - 2, 8,
-                                         message_buffer, &md5cksum);
+                                         message_buffer, 0, &md5cksum);
                 if (ret)
                         goto out;
 
@@ -175,9 +157,6 @@ krb5_read_token(struct krb5_ctx *ctx,
 
         /* it got through unscathed.  Make sure the context is unexpired */
 
-        if (qop_state)
-                *qop_state = GSS_C_QOP_DEFAULT;
-
         now = get_seconds();
 
         ret = GSS_S_CONTEXT_EXPIRED;
diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c
new file mode 100644
index 000000000000..af777cf9f251
--- /dev/null
+++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
@@ -0,0 +1,363 @@
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/jiffies.h>
+#include <linux/sunrpc/gss_krb5.h>
+#include <linux/random.h>
+#include <linux/pagemap.h>
+#include <asm/scatterlist.h>
+#include <linux/crypto.h>
+
+#ifdef RPC_DEBUG
+# define RPCDBG_FACILITY        RPCDBG_AUTH
+#endif
+
+static inline int
+gss_krb5_padding(int blocksize, int length)
+{
+        /* Most of the code is block-size independent but currently we
+         * use only 8: */
+        BUG_ON(blocksize != 8);
+        return 8 - (length & 7);
+}
+
+static inline void
+gss_krb5_add_padding(struct xdr_buf *buf, int offset, int blocksize)
+{
+        int padding = gss_krb5_padding(blocksize, buf->len - offset);
+        char *p;
+        struct kvec *iov;
+
+        if (buf->page_len || buf->tail[0].iov_len)
+                iov = &buf->tail[0];
+        else
+                iov = &buf->head[0];
+        p = iov->iov_base + iov->iov_len;
+        iov->iov_len += padding;
+        buf->len += padding;
+        memset(p, padding, padding);
+}
+
+static inline int
+gss_krb5_remove_padding(struct xdr_buf *buf, int blocksize)
+{
+        u8 *ptr;
+        u8 pad;
+        int len = buf->len;
+
+        if (len <= buf->head[0].iov_len) {
+                pad = *(u8 *)(buf->head[0].iov_base + len - 1);
+                if (pad > buf->head[0].iov_len)
+                        return -EINVAL;
+                buf->head[0].iov_len -= pad;
+                goto out;
+        } else
+                len -= buf->head[0].iov_len;
+        if (len <= buf->page_len) {
+                int last = (buf->page_base + len - 1)
+                                        >>PAGE_CACHE_SHIFT;
+                int offset = (buf->page_base + len - 1)
+                                        & (PAGE_CACHE_SIZE - 1);
+                ptr = kmap_atomic(buf->pages[last], KM_SKB_SUNRPC_DATA);
+                pad = *(ptr + offset);
+                kunmap_atomic(ptr, KM_SKB_SUNRPC_DATA);
+                goto out;
+        } else
+                len -= buf->page_len;
+        BUG_ON(len > buf->tail[0].iov_len);
+        pad = *(u8 *)(buf->tail[0].iov_base + len - 1);
+out:
+        /* XXX: NOTE: we do not adjust the page lengths--they represent
+         * a range of data in the real filesystem page cache, and we need
+         * to know that range so the xdr code can properly place read data.
+         * However adjusting the head length, as we do above, is harmless.
+         * In the case of a request that fits into a single page, the server
+         * also uses length and head length together to determine the original
+         * start of the request to copy the request for deferal; so it's
+         * easier on the server if we adjust head and tail length in tandem.
+         * It's not really a problem that we don't fool with the page and
+         * tail lengths, though--at worst badly formed xdr might lead the
+         * server to attempt to parse the padding.
+         * XXX: Document all these weird requirements for gss mechanism
+         * wrap/unwrap functions. */
+        if (pad > blocksize)
+                return -EINVAL;
+        if (buf->len > pad)
+                buf->len -= pad;
+        else
+                return -EINVAL;
+        return 0;
+}
+
+static inline void
+make_confounder(char *p, int blocksize)
+{
+        static u64 i = 0;
+        u64 *q = (u64 *)p;
+
+        /* rfc1964 claims this should be "random".  But all that's really
+         * necessary is that it be unique.  And not even that is necessary in
+         * our case since our "gssapi" implementation exists only to support
+         * rpcsec_gss, so we know that the only buffers we will ever encrypt
+         * already begin with a unique sequence number.  Just to hedge my bets
+         * I'll make a half-hearted attempt at something unique, but ensuring
+         * uniqueness would mean worrying about atomicity and rollover, and I
+         * don't care enough. */
+
+        BUG_ON(blocksize != 8);
+        *q = i++;
+}
+
+/* Assumptions: the head and tail of inbuf are ours to play with.
+ * The pages, however, may be real pages in the page cache and we replace
+ * them with scratch pages from **pages before writing to them. */
+/* XXX: obviously the above should be documentation of wrap interface,
+ * and shouldn't be in this kerberos-specific file. */
+
+/* XXX factor out common code with seal/unseal. */
+
+u32
+gss_wrap_kerberos(struct gss_ctx *ctx, int offset,
+                struct xdr_buf *buf, struct page **pages)
+{
+        struct krb5_ctx         *kctx = ctx->internal_ctx_id;
+        s32                     checksum_type;
+        struct xdr_netobj       md5cksum = {.len = 0, .data = NULL};
+        int                     blocksize = 0, plainlen;
+        unsigned char           *ptr, *krb5_hdr, *msg_start;
+        s32                     now;
+        int                     headlen;
+        struct page             **tmp_pages;
+
+        dprintk("RPC:     gss_wrap_kerberos\n");
+
+        now = get_seconds();
+
+        switch (kctx->signalg) {
+                case SGN_ALG_DES_MAC_MD5:
+                        checksum_type = CKSUMTYPE_RSA_MD5;
+                        break;
+                default:
+                        dprintk("RPC:      gss_krb5_seal: kctx->signalg %d not"
+                                " supported\n", kctx->signalg);
+                        goto out_err;
+        }
+        if (kctx->sealalg != SEAL_ALG_NONE && kctx->sealalg != SEAL_ALG_DES) {
+                dprintk("RPC:      gss_krb5_seal: kctx->sealalg %d not supported\n",
+                        kctx->sealalg);
+                goto out_err;
+        }
+
+        blocksize = crypto_tfm_alg_blocksize(kctx->enc);
+        gss_krb5_add_padding(buf, offset, blocksize);
+        BUG_ON((buf->len - offset) % blocksize);
+        plainlen = blocksize + buf->len - offset;
+
+        headlen = g_token_size(&kctx->mech_used, 22 + plainlen) -
+                                                (buf->len - offset);
+
+        ptr = buf->head[0].iov_base + offset;
+        /* shift data to make room for header. */
+        /* XXX Would be cleverer to encrypt while copying. */
+        /* XXX bounds checking, slack, etc. */
+        memmove(ptr + headlen, ptr, buf->head[0].iov_len - offset);
+        buf->head[0].iov_len += headlen;
+        buf->len += headlen;
+        BUG_ON((buf->len - offset - headlen) % blocksize);
+
+        g_make_token_header(&kctx->mech_used, 22 + plainlen, &ptr);
+
+
+        *ptr++ = (unsigned char) ((KG_TOK_WRAP_MSG>>8)&0xff);
+        *ptr++ = (unsigned char) (KG_TOK_WRAP_MSG&0xff);
+
+        /* ptr now at byte 2 of header described in rfc 1964, section 1.2.1: */
+        krb5_hdr = ptr - 2;
+        msg_start = krb5_hdr + 24;
+        /* XXXJBF: */ BUG_ON(buf->head[0].iov_base + offset + headlen != msg_start + blocksize);
+
+        *(u16 *)(krb5_hdr + 2) = htons(kctx->signalg);
+        memset(krb5_hdr + 4, 0xff, 4);
+        *(u16 *)(krb5_hdr + 4) = htons(kctx->sealalg);
+
+        make_confounder(msg_start, blocksize);
+
+        /* XXXJBF: UGH!: */
+        tmp_pages = buf->pages;
+        buf->pages = pages;
+        if (make_checksum(checksum_type, krb5_hdr, 8, buf,
+                                offset + headlen - blocksize, &md5cksum))
+                goto out_err;
+        buf->pages = tmp_pages;
+
+        switch (kctx->signalg) {
+        case SGN_ALG_DES_MAC_MD5:
+                if (krb5_encrypt(kctx->seq, NULL, md5cksum.data,
+                                  md5cksum.data, md5cksum.len))
+                        goto out_err;
+                memcpy(krb5_hdr + 16,
+                       md5cksum.data + md5cksum.len - KRB5_CKSUM_LENGTH,
+                       KRB5_CKSUM_LENGTH);
+
+                dprintk("RPC:      make_seal_token: cksum data: \n");
+                print_hexl((u32 *) (krb5_hdr + 16), KRB5_CKSUM_LENGTH, 0);
+                break;
+        default:
+                BUG();
+        }
+
+        kfree(md5cksum.data);
+
+        /* XXX would probably be more efficient to compute checksum
+         * and encrypt at the same time: */
+        if ((krb5_make_seq_num(kctx->seq, kctx->initiate ? 0 : 0xff,
+                               kctx->seq_send, krb5_hdr + 16, krb5_hdr + 8)))
+                goto out_err;
+
+        if (gss_encrypt_xdr_buf(kctx->enc, buf, offset + headlen - blocksize,
+                                                                        pages))
+                goto out_err;
+
+        kctx->seq_send++;
+
+        return ((kctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE);
+out_err:
+        if (md5cksum.data) kfree(md5cksum.data);
+        return GSS_S_FAILURE;
+}
+
+u32
+gss_unwrap_kerberos(struct gss_ctx *ctx, int offset, struct xdr_buf *buf)
+{
+        struct krb5_ctx         *kctx = ctx->internal_ctx_id;
+        int                     signalg;
+        int                     sealalg;
+        s32                     checksum_type;
+        struct xdr_netobj       md5cksum = {.len = 0, .data = NULL};
+        s32                     now;
+        int                     direction;
+        s32                     seqnum;
+        unsigned char           *ptr;
+        int                     bodysize;
+        u32                     ret = GSS_S_DEFECTIVE_TOKEN;
+        void                    *data_start, *orig_start;
+        int                     data_len;
+        int                     blocksize;
+
+        dprintk("RPC:      gss_unwrap_kerberos\n");
+
+        ptr = (u8 *)buf->head[0].iov_base + offset;
+        if (g_verify_token_header(&kctx->mech_used, &bodysize, &ptr,
+                                        buf->len - offset))
+                goto out;
+
+        if ((*ptr++ != ((KG_TOK_WRAP_MSG>>8)&0xff)) ||
+            (*ptr++ !=  (KG_TOK_WRAP_MSG    &0xff))   )
+                goto out;
+
+        /* XXX sanity-check bodysize?? */
+
+        /* get the sign and seal algorithms */
+
+        signalg = ptr[0] + (ptr[1] << 8);
+        sealalg = ptr[2] + (ptr[3] << 8);
+
+        /* Sanity checks */
+
+        if ((ptr[4] != 0xff) || (ptr[5] != 0xff))
+                goto out;
+
+        if (sealalg == 0xffff)
+                goto out;
+
+        /* in the current spec, there is only one valid seal algorithm per
+           key type, so a simple comparison is ok */
+
+        if (sealalg != kctx->sealalg)
+                goto out;
+
+        /* there are several mappings of seal algorithms to sign algorithms,
+           but few enough that we can try them all. */
+
+        if ((kctx->sealalg == SEAL_ALG_NONE && signalg > 1) ||
+            (kctx->sealalg == SEAL_ALG_1 && signalg != SGN_ALG_3) ||
+            (kctx->sealalg == SEAL_ALG_DES3KD &&
+             signalg != SGN_ALG_HMAC_SHA1_DES3_KD))
+                goto out;
+
+        if (gss_decrypt_xdr_buf(kctx->enc, buf,
+                        ptr + 22 - (unsigned char *)buf->head[0].iov_base))
+                goto out;
+
+        /* compute the checksum of the message */
+
+        /* initialize the the cksum */
+        switch (signalg) {
+        case SGN_ALG_DES_MAC_MD5:
+                checksum_type = CKSUMTYPE_RSA_MD5;
+                break;
+        default:
+                ret = GSS_S_DEFECTIVE_TOKEN;
+                goto out;
+        }
+
+        switch (signalg) {
+        case SGN_ALG_DES_MAC_MD5:
+                ret = make_checksum(checksum_type, ptr - 2, 8, buf,
+                         ptr + 22 - (unsigned char *)buf->head[0].iov_base, &md5cksum);
+                if (ret)
+                        goto out;
+
+                ret = krb5_encrypt(kctx->seq, NULL, md5cksum.data,
+                                   md5cksum.data, md5cksum.len);
+                if (ret)
+                        goto out;
+
+                if (memcmp(md5cksum.data + 8, ptr + 14, 8)) {
+                        ret = GSS_S_BAD_SIG;
+                        goto out;
+                }
+                break;
+        default:
+                ret = GSS_S_DEFECTIVE_TOKEN;
+                goto out;
+        }
+
+        /* it got through unscathed.  Make sure the context is unexpired */
+
+        now = get_seconds();
+
+        ret = GSS_S_CONTEXT_EXPIRED;
+        if (now > kctx->endtime)
+                goto out;
+
+        /* do sequencing checks */
+
+        ret = GSS_S_BAD_SIG;
+        if ((ret = krb5_get_seq_num(kctx->seq, ptr + 14, ptr + 6, &direction,
+                                    &seqnum)))
+                goto out;
+
+        if ((kctx->initiate && direction != 0xff) ||
+            (!kctx->initiate && direction != 0))
+                goto out;
+
+        /* Copy the data back to the right position.  XXX: Would probably be
+         * better to copy and encrypt at the same time. */
+
+        blocksize = crypto_tfm_alg_blocksize(kctx->enc);
+        data_start = ptr + 22 + blocksize;
+        orig_start = buf->head[0].iov_base + offset;
+        data_len = (buf->head[0].iov_base + buf->head[0].iov_len) - data_start;
+        memmove(orig_start, data_start, data_len);
+        buf->head[0].iov_len -= (data_start - orig_start);
+        buf->len -= (data_start - orig_start);
+
+        ret = GSS_S_DEFECTIVE_TOKEN;
+        if (gss_krb5_remove_padding(buf, blocksize))
+                goto out;
+
+        ret = GSS_S_COMPLETE;
+out:
+        if (md5cksum.data) kfree(md5cksum.data);
+        return ret;
+}
diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c
index 9dfb68377d69..b048bf672da2 100644
--- a/net/sunrpc/auth_gss/gss_mech_switch.c
+++ b/net/sunrpc/auth_gss/gss_mech_switch.c
@@ -35,7 +35,6 @@
 
 #include <linux/types.h>
 #include <linux/slab.h>
-#include <linux/socket.h>
 #include <linux/module.h>
 #include <linux/sunrpc/msg_prot.h>
 #include <linux/sunrpc/gss_asn1.h>
@@ -251,13 +250,11 @@ gss_import_sec_context(const void *input_token, size_t bufsize,
 
 u32
 gss_get_mic(struct gss_ctx      *context_handle,
-            u32                 qop,
             struct xdr_buf      *message,
             struct xdr_netobj   *mic_token)
 {
          return context_handle->mech_type->gm_ops
                 ->gss_get_mic(context_handle,
-                              qop,
                               message,
                               mic_token);
 }
@@ -267,16 +264,34 @@ gss_get_mic(struct gss_ctx	*context_handle,
 u32
 gss_verify_mic(struct gss_ctx           *context_handle,
                struct xdr_buf           *message,
-               struct xdr_netobj        *mic_token,
-               u32                      *qstate)
+               struct xdr_netobj        *mic_token)
 {
         return context_handle->mech_type->gm_ops
                 ->gss_verify_mic(context_handle,
                                  message,
-                                 mic_token,
-                                 qstate);
+                                 mic_token);
 }
 
+u32
+gss_wrap(struct gss_ctx *ctx_id,
+         int            offset,
+         struct xdr_buf *buf,
+         struct page    **inpages)
+{
+        return ctx_id->mech_type->gm_ops
+                ->gss_wrap(ctx_id, offset, buf, inpages);
+}
+
+u32
+gss_unwrap(struct gss_ctx       *ctx_id,
+           int                  offset,
+           struct xdr_buf       *buf)
+{
+        return ctx_id->mech_type->gm_ops
+                ->gss_unwrap(ctx_id, offset, buf);
+}
+
+
 /* gss_delete_sec_context: free all resources associated with context_handle.
  * Note this differs from the RFC 2744-specified prototype in that we don't
  * bother returning an output token, since it would never be used anyway. */
diff --git a/net/sunrpc/auth_gss/gss_spkm3_mech.c b/net/sunrpc/auth_gss/gss_spkm3_mech.c
index 6c97d61baa9b..39b3edc14694 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_mech.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_mech.c
@@ -224,18 +224,13 @@ gss_delete_sec_context_spkm3(void *internal_ctx) {
 static u32
 gss_verify_mic_spkm3(struct gss_ctx             *ctx,
                         struct xdr_buf          *signbuf,
-                        struct xdr_netobj       *checksum,
-                        u32             *qstate) {
+                        struct xdr_netobj       *checksum)
+{
         u32 maj_stat = 0;
-        int qop_state = 0;
         struct spkm3_ctx *sctx = ctx->internal_ctx_id;
 
         dprintk("RPC: gss_verify_mic_spkm3 calling spkm3_read_token\n");
-        maj_stat = spkm3_read_token(sctx, checksum, signbuf, &qop_state,
-                                   SPKM_MIC_TOK);
-
-        if (!maj_stat && qop_state)
-            *qstate = qop_state;
+        maj_stat = spkm3_read_token(sctx, checksum, signbuf, SPKM_MIC_TOK);
 
         dprintk("RPC: gss_verify_mic_spkm3 returning %d\n", maj_stat);
         return maj_stat;
@@ -243,15 +238,15 @@ gss_verify_mic_spkm3(struct gss_ctx		*ctx,
 
 static u32
 gss_get_mic_spkm3(struct gss_ctx        *ctx,
-                     u32                qop,
                      struct xdr_buf     *message_buffer,
-                     struct xdr_netobj  *message_token) {
+                     struct xdr_netobj  *message_token)
+{
         u32 err = 0;
         struct spkm3_ctx *sctx = ctx->internal_ctx_id;
 
         dprintk("RPC: gss_get_mic_spkm3\n");
 
-        err = spkm3_make_token(sctx, qop, message_buffer,
+        err = spkm3_make_token(sctx, message_buffer,
                               message_token, SPKM_MIC_TOK);
         return err;
 }
@@ -264,8 +259,8 @@ static struct gss_api_ops gss_spkm3_ops = {
 };
 
 static struct pf_desc gss_spkm3_pfs[] = {
-        {RPC_AUTH_GSS_SPKM, 0, RPC_GSS_SVC_NONE, "spkm3"},
-        {RPC_AUTH_GSS_SPKMI, 0, RPC_GSS_SVC_INTEGRITY, "spkm3i"},
+        {RPC_AUTH_GSS_SPKM, RPC_GSS_SVC_NONE, "spkm3"},
+        {RPC_AUTH_GSS_SPKMI, RPC_GSS_SVC_INTEGRITY, "spkm3i"},
 };
 
 static struct gss_api_mech gss_spkm3_mech = {
diff --git a/net/sunrpc/auth_gss/gss_spkm3_seal.c b/net/sunrpc/auth_gss/gss_spkm3_seal.c
index 25339868d462..148201e929d0 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_seal.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_seal.c
@@ -51,7 +51,7 @@
  */
 
 u32
-spkm3_make_token(struct spkm3_ctx *ctx, int qop_req,
+spkm3_make_token(struct spkm3_ctx *ctx,
                    struct xdr_buf * text, struct xdr_netobj * token,
                    int toktype)
 {
@@ -68,8 +68,6 @@ spkm3_make_token(struct spkm3_ctx *ctx, int qop_req,
         dprintk("RPC: spkm3_make_token\n");
 
         now = jiffies;
-        if (qop_req != 0)
-                goto out_err;
 
         if (ctx->ctx_id.len != 16) {
                 dprintk("RPC: spkm3_make_token BAD ctx_id.len %d\n",
diff --git a/net/sunrpc/auth_gss/gss_spkm3_unseal.c b/net/sunrpc/auth_gss/gss_spkm3_unseal.c
index 65ce81bf0bc4..c3c0d9586103 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_unseal.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_unseal.c
@@ -52,7 +52,7 @@ u32
 spkm3_read_token(struct spkm3_ctx *ctx,
                 struct xdr_netobj *read_token,    /* checksum */
                 struct xdr_buf *message_buffer, /* signbuf */
-                int *qop_state, int toktype)
+                int toktype)
 {
         s32                     code;
         struct xdr_netobj       wire_cksum = {.len =0, .data = NULL};
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index e3308195374e..e4ada15ed856 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -566,8 +566,7 @@ gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci,
 
         if (rqstp->rq_deferred) /* skip verification of revisited request */
                 return SVC_OK;
-        if (gss_verify_mic(ctx_id, &rpchdr, &checksum, NULL)
-                                                        != GSS_S_COMPLETE) {
+        if (gss_verify_mic(ctx_id, &rpchdr, &checksum) != GSS_S_COMPLETE) {
                 *authp = rpcsec_gsserr_credproblem;
                 return SVC_DENIED;
         }
@@ -604,7 +603,7 @@ gss_write_verf(struct svc_rqst *rqstp, struct gss_ctx *ctx_id, u32 seq)
         xdr_buf_from_iov(&iov, &verf_data);
         p = rqstp->rq_res.head->iov_base + rqstp->rq_res.head->iov_len;
         mic.data = (u8 *)(p + 1);
-        maj_stat = gss_get_mic(ctx_id, 0, &verf_data, &mic);
+        maj_stat = gss_get_mic(ctx_id, &verf_data, &mic);
         if (maj_stat != GSS_S_COMPLETE)
                 return -1;
         *p++ = htonl(mic.len);
@@ -710,7 +709,7 @@ unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
                 goto out;
         if (read_bytes_from_xdr_buf(buf, integ_len + 4, mic.data, mic.len))
                 goto out;
-        maj_stat = gss_verify_mic(ctx, &integ_buf, &mic, NULL);
+        maj_stat = gss_verify_mic(ctx, &integ_buf, &mic);
         if (maj_stat != GSS_S_COMPLETE)
                 goto out;
         if (ntohl(svc_getu32(&buf->head[0])) != seq)
@@ -1012,7 +1011,7 @@ svcauth_gss_release(struct svc_rqst *rqstp)
                         resv = &resbuf->tail[0];
                 }
                 mic.data = (u8 *)resv->iov_base + resv->iov_len + 4;
-                if (gss_get_mic(gsd->rsci->mechctx, 0, &integ_buf, &mic))
+                if (gss_get_mic(gsd->rsci->mechctx, &integ_buf, &mic))
                         goto out_err;
                 svc_putu32(resv, htonl(mic.len));
                 memset(mic.data + mic.len, 0,
diff --git a/net/sunrpc/auth_null.c b/net/sunrpc/auth_null.c
index 9b72d3abf823..f56767aaa927 100644
--- a/net/sunrpc/auth_null.c
+++ b/net/sunrpc/auth_null.c
@@ -7,9 +7,7 @@
  */
 
 #include <linux/types.h>
-#include <linux/socket.h>
 #include <linux/module.h>
-#include <linux/in.h>
 #include <linux/utsname.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/sched.h>
diff --git a/net/sunrpc/auth_unix.c b/net/sunrpc/auth_unix.c
index 4ff297a9b15b..890fb5ea0dcb 100644
--- a/net/sunrpc/auth_unix.c
+++ b/net/sunrpc/auth_unix.c
@@ -9,8 +9,6 @@
 #include <linux/types.h>
 #include <linux/sched.h>
 #include <linux/module.h>
-#include <linux/socket.h>
-#include <linux/in.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/auth.h>
 
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index f17e6153b688..702ede309b06 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1,5 +1,5 @@
 /*
- *  linux/net/sunrpc/rpcclnt.c
+ *  linux/net/sunrpc/clnt.c
  *
  *  This file contains the high-level RPC interface.
  *  It is modeled as a finite state machine to support both synchronous
@@ -27,7 +27,6 @@
 #include <linux/types.h>
 #include <linux/mm.h>
 #include <linux/slab.h>
-#include <linux/in.h>
 #include <linux/utsname.h>
 
 #include <linux/sunrpc/clnt.h>
@@ -53,6 +52,7 @@ static void	call_allocate(struct rpc_task *task);
 static void     call_encode(struct rpc_task *task);
 static void     call_decode(struct rpc_task *task);
 static void     call_bind(struct rpc_task *task);
+static void     call_bind_status(struct rpc_task *task);
 static void     call_transmit(struct rpc_task *task);
 static void     call_status(struct rpc_task *task);
 static void     call_refresh(struct rpc_task *task);
@@ -517,15 +517,8 @@ void
 rpc_setbufsize(struct rpc_clnt *clnt, unsigned int sndsize, unsigned int rcvsize)
 {
         struct rpc_xprt *xprt = clnt->cl_xprt;
-
-        xprt->sndsize = 0;
-        if (sndsize)
-                xprt->sndsize = sndsize + RPC_SLACK_SPACE;
-        xprt->rcvsize = 0;
-        if (rcvsize)
-                xprt->rcvsize = rcvsize + RPC_SLACK_SPACE;
-        if (xprt_connected(xprt))
-                xprt_sock_setbufsize(xprt);
+        if (xprt->ops->set_buffer_size)
+                xprt->ops->set_buffer_size(xprt, sndsize, rcvsize);
 }
 
 /*
@@ -685,13 +678,11 @@ call_allocate(struct rpc_task *task)
 static void
 call_encode(struct rpc_task *task)
 {
-        struct rpc_clnt *clnt = task->tk_client;
         struct rpc_rqst *req = task->tk_rqstp;
         struct xdr_buf *sndbuf = &req->rq_snd_buf;
         struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
         unsigned int    bufsiz;
         kxdrproc_t      encode;
-        int             status;
         u32             *p;
 
         dprintk("RPC: %4d call_encode (status %d)\n", 
@@ -719,11 +710,15 @@ call_encode(struct rpc_task *task)
                 rpc_exit(task, -EIO);
                 return;
         }
-        if (encode && (status = rpcauth_wrap_req(task, encode, req, p,
-                                                 task->tk_msg.rpc_argp)) < 0) {
-                printk(KERN_WARNING "%s: can't encode arguments: %d\n",
-                                clnt->cl_protname, -status);
-                rpc_exit(task, status);
+        if (encode == NULL)
+                return;
+
+        task->tk_status = rpcauth_wrap_req(task, encode, req, p,
+                        task->tk_msg.rpc_argp);
+        if (task->tk_status == -ENOMEM) {
+                /* XXX: Is this sane? */
+                rpc_delay(task, 3*HZ);
+                task->tk_status = -EAGAIN;
         }
 }
 
@@ -734,43 +729,95 @@ static void
 call_bind(struct rpc_task *task)
 {
         struct rpc_clnt *clnt = task->tk_client;
-        struct rpc_xprt *xprt = clnt->cl_xprt;
-
-        dprintk("RPC: %4d call_bind xprt %p %s connected\n", task->tk_pid,
-                        xprt, (xprt_connected(xprt) ? "is" : "is not"));
 
-        task->tk_action = (xprt_connected(xprt)) ? call_transmit : call_connect;
+        dprintk("RPC: %4d call_bind (status %d)\n",
+                                task->tk_pid, task->tk_status);
 
+        task->tk_action = call_connect;
         if (!clnt->cl_port) {
-                task->tk_action = call_connect;
-                task->tk_timeout = RPC_CONNECT_TIMEOUT;
+                task->tk_action = call_bind_status;
+                task->tk_timeout = task->tk_xprt->bind_timeout;
                 rpc_getport(task, clnt);
         }
 }
 
 /*
- * 4a.  Connect to the RPC server (TCP case)
+ * 4a.  Sort out bind result
+ */
+static void
+call_bind_status(struct rpc_task *task)
+{
+        int status = -EACCES;
+
+        if (task->tk_status >= 0) {
+                dprintk("RPC: %4d call_bind_status (status %d)\n",
+                                        task->tk_pid, task->tk_status);
+                task->tk_status = 0;
+                task->tk_action = call_connect;
+                return;
+        }
+
+        switch (task->tk_status) {
+        case -EACCES:
+                dprintk("RPC: %4d remote rpcbind: RPC program/version unavailable\n",
+                                task->tk_pid);
+                rpc_delay(task, 3*HZ);
+                goto retry_bind;
+        case -ETIMEDOUT:
+                dprintk("RPC: %4d rpcbind request timed out\n",
+                                task->tk_pid);
+                if (RPC_IS_SOFT(task)) {
+                        status = -EIO;
+                        break;
+                }
+                goto retry_bind;
+        case -EPFNOSUPPORT:
+                dprintk("RPC: %4d remote rpcbind service unavailable\n",
+                                task->tk_pid);
+                break;
+        case -EPROTONOSUPPORT:
+                dprintk("RPC: %4d remote rpcbind version 2 unavailable\n",
+                                task->tk_pid);
+                break;
+        default:
+                dprintk("RPC: %4d unrecognized rpcbind error (%d)\n",
+                                task->tk_pid, -task->tk_status);
+                status = -EIO;
+                break;
+        }
+
+        rpc_exit(task, status);
+        return;
+
+retry_bind:
+        task->tk_status = 0;
+        task->tk_action = call_bind;
+        return;
+}
+
+/*
+ * 4b.  Connect to the RPC server
  */
 static void
 call_connect(struct rpc_task *task)
 {
-        struct rpc_clnt *clnt = task->tk_client;
+        struct rpc_xprt *xprt = task->tk_xprt;
 
-        dprintk("RPC: %4d call_connect status %d\n",
-                                task->tk_pid, task->tk_status);
+        dprintk("RPC: %4d call_connect xprt %p %s connected\n",
+                        task->tk_pid, xprt,
+                        (xprt_connected(xprt) ? "is" : "is not"));
 
-        if (xprt_connected(clnt->cl_xprt)) {
-                task->tk_action = call_transmit;
-                return;
+        task->tk_action = call_transmit;
+        if (!xprt_connected(xprt)) {
+                task->tk_action = call_connect_status;
+                if (task->tk_status < 0)
+                        return;
+                xprt_connect(task);
         }
-        task->tk_action = call_connect_status;
-        if (task->tk_status < 0)
-                return;
-        xprt_connect(task);
 }
 
 /*
- * 4b. Sort out connect result
+ * 4c.  Sort out connect result
  */
 static void
 call_connect_status(struct rpc_task *task)
@@ -778,6 +825,9 @@ call_connect_status(struct rpc_task *task)
         struct rpc_clnt *clnt = task->tk_client;
         int status = task->tk_status;
 
+        dprintk("RPC: %5u call_connect_status (status %d)\n", 
+                                task->tk_pid, task->tk_status);
+
         task->tk_status = 0;
         if (status >= 0) {
                 clnt->cl_stats->netreconn++;
@@ -785,17 +835,19 @@ call_connect_status(struct rpc_task *task)
                 return;
         }
 
-        /* Something failed: we may have to rebind */
+        /* Something failed: remote service port may have changed */
         if (clnt->cl_autobind)
                 clnt->cl_port = 0;
+
         switch (status) {
         case -ENOTCONN:
         case -ETIMEDOUT:
         case -EAGAIN:
-                task->tk_action = (clnt->cl_port == 0) ? call_bind : call_connect;
+                task->tk_action = call_bind;
                 break;
         default:
                 rpc_exit(task, -EIO);
+                break;
         }
 }
 
@@ -815,10 +867,12 @@ call_transmit(struct rpc_task *task)
         if (task->tk_status != 0)
                 return;
         /* Encode here so that rpcsec_gss can use correct sequence number. */
-        if (!task->tk_rqstp->rq_bytes_sent)
+        if (task->tk_rqstp->rq_bytes_sent == 0) {
                 call_encode(task);
-        if (task->tk_status < 0)
-                return;
+                /* Did the encode result in an error condition? */
+                if (task->tk_status != 0)
+                        goto out_nosend;
+        }
         xprt_transmit(task);
         if (task->tk_status < 0)
                 return;
@@ -826,6 +880,10 @@ call_transmit(struct rpc_task *task)
                 task->tk_action = NULL;
                 rpc_wake_up_task(task);
         }
+        return;
+out_nosend:
+        /* release socket write lock before attempting to handle error */
+        xprt_abort_transmit(task);
 }
 
 /*
@@ -1020,13 +1078,12 @@ static u32 *
 call_header(struct rpc_task *task)
 {
         struct rpc_clnt *clnt = task->tk_client;
-        struct rpc_xprt *xprt = clnt->cl_xprt;
         struct rpc_rqst *req = task->tk_rqstp;
         u32             *p = req->rq_svec[0].iov_base;
 
         /* FIXME: check buffer size? */
-        if (xprt->stream)
-                *p++ = 0;               /* fill in later */
+
+        p = xprt_skip_transport_header(task->tk_xprt, p);
         *p++ = req->rq_xid;             /* XID */
         *p++ = htonl(RPC_CALL);         /* CALL */
         *p++ = htonl(RPC_VERSION);      /* RPC version */
diff --git a/net/sunrpc/pmap_clnt.c b/net/sunrpc/pmap_clnt.c
index 4e81f2766923..a398575f94b8 100644
--- a/net/sunrpc/pmap_clnt.c
+++ b/net/sunrpc/pmap_clnt.c
@@ -26,7 +26,7 @@
 #define PMAP_GETPORT            3
 
 static struct rpc_procinfo      pmap_procedures[];
-static struct rpc_clnt *        pmap_create(char *, struct sockaddr_in *, int);
+static struct rpc_clnt *        pmap_create(char *, struct sockaddr_in *, int, int);
 static void                     pmap_getport_done(struct rpc_task *);
 static struct rpc_program       pmap_program;
 static DEFINE_SPINLOCK(pmap_lock);
@@ -65,7 +65,7 @@ rpc_getport(struct rpc_task *task, struct rpc_clnt *clnt)
         map->pm_binding = 1;
         spin_unlock(&pmap_lock);
 
-        pmap_clnt = pmap_create(clnt->cl_server, sap, map->pm_prot);
+        pmap_clnt = pmap_create(clnt->cl_server, sap, map->pm_prot, 0);
         if (IS_ERR(pmap_clnt)) {
                 task->tk_status = PTR_ERR(pmap_clnt);
                 goto bailout;
@@ -112,7 +112,7 @@ rpc_getport_external(struct sockaddr_in *sin, __u32 prog, __u32 vers, int prot)
                         NIPQUAD(sin->sin_addr.s_addr), prog, vers, prot);
 
         sprintf(hostname, "%u.%u.%u.%u", NIPQUAD(sin->sin_addr.s_addr));
-        pmap_clnt = pmap_create(hostname, sin, prot);
+        pmap_clnt = pmap_create(hostname, sin, prot, 0);
         if (IS_ERR(pmap_clnt))
                 return PTR_ERR(pmap_clnt);
 
@@ -171,7 +171,7 @@ rpc_register(u32 prog, u32 vers, int prot, unsigned short port, int *okay)
 
         sin.sin_family = AF_INET;
         sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
-        pmap_clnt = pmap_create("localhost", &sin, IPPROTO_UDP);
+        pmap_clnt = pmap_create("localhost", &sin, IPPROTO_UDP, 1);
         if (IS_ERR(pmap_clnt)) {
                 error = PTR_ERR(pmap_clnt);
                 dprintk("RPC: couldn't create pmap client. Error = %d\n", error);
@@ -198,7 +198,7 @@ rpc_register(u32 prog, u32 vers, int prot, unsigned short port, int *okay)
 }
 
 static struct rpc_clnt *
-pmap_create(char *hostname, struct sockaddr_in *srvaddr, int proto)
+pmap_create(char *hostname, struct sockaddr_in *srvaddr, int proto, int privileged)
 {
         struct rpc_xprt *xprt;
         struct rpc_clnt *clnt;
@@ -208,6 +208,8 @@ pmap_create(char *hostname, struct sockaddr_in *srvaddr, int proto)
         if (IS_ERR(xprt))
                 return (struct rpc_clnt *)xprt;
         xprt->addr.sin_port = htons(RPC_PMAP_PORT);
+        if (!privileged)
+                xprt->resvport = 0;
 
         /* printk("pmap: create clnt\n"); */
         clnt = rpc_new_client(xprt, hostname,
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index ded6c63f11ec..4f188d0a5d11 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -76,25 +76,35 @@ int
 rpc_queue_upcall(struct inode *inode, struct rpc_pipe_msg *msg)
 {
         struct rpc_inode *rpci = RPC_I(inode);
-        int res = 0;
+        int res = -EPIPE;
 
         down(&inode->i_sem);
+        if (rpci->ops == NULL)
+                goto out;
         if (rpci->nreaders) {
                 list_add_tail(&msg->list, &rpci->pipe);
                 rpci->pipelen += msg->len;
+                res = 0;
         } else if (rpci->flags & RPC_PIPE_WAIT_FOR_OPEN) {
                 if (list_empty(&rpci->pipe))
                         schedule_delayed_work(&rpci->queue_timeout,
                                         RPC_UPCALL_TIMEOUT);
                 list_add_tail(&msg->list, &rpci->pipe);
                 rpci->pipelen += msg->len;
-        } else
-                res = -EPIPE;
+                res = 0;
+        }
+out:
         up(&inode->i_sem);
         wake_up(&rpci->waitq);
         return res;
 }
 
+static inline void
+rpc_inode_setowner(struct inode *inode, void *private)
+{
+        RPC_I(inode)->private = private;
+}
+
 static void
 rpc_close_pipes(struct inode *inode)
 {
@@ -111,15 +121,10 @@ rpc_close_pipes(struct inode *inode)
                         rpci->ops->release_pipe(inode);
                 rpci->ops = NULL;
         }
+        rpc_inode_setowner(inode, NULL);
         up(&inode->i_sem);
 }
 
-static inline void
-rpc_inode_setowner(struct inode *inode, void *private)
-{
-        RPC_I(inode)->private = private;
-}
-
 static struct inode *
 rpc_alloc_inode(struct super_block *sb)
 {
@@ -501,7 +506,6 @@ repeat:
                         dentry = dvec[--n];
                         if (dentry->d_inode) {
                                 rpc_close_pipes(dentry->d_inode);
-                                rpc_inode_setowner(dentry->d_inode, NULL);
                                 simple_unlink(dir, dentry);
                         }
                         dput(dentry);
@@ -576,10 +580,8 @@ __rpc_rmdir(struct inode *dir, struct dentry *dentry)
         int error;
 
         shrink_dcache_parent(dentry);
-        if (dentry->d_inode) {
+        if (dentry->d_inode)
                 rpc_close_pipes(dentry->d_inode);
-                rpc_inode_setowner(dentry->d_inode, NULL);
-        }
         if ((error = simple_rmdir(dir, dentry)) != 0)
                 return error;
         if (!error) {
@@ -732,7 +734,6 @@ rpc_unlink(char *path)
         d_drop(dentry);
         if (dentry->d_inode) {
                 rpc_close_pipes(dentry->d_inode);
-                rpc_inode_setowner(dentry->d_inode, NULL);
                 error = simple_unlink(dir, dentry);
         }
         dput(dentry);
diff --git a/net/sunrpc/socklib.c b/net/sunrpc/socklib.c
new file mode 100644
index 000000000000..8f97e90f36c8
--- /dev/null
+++ b/net/sunrpc/socklib.c
@@ -0,0 +1,175 @@
+/*
+ * linux/net/sunrpc/socklib.c
+ *
+ * Common socket helper routines for RPC client and server
+ *
+ * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
+ */
+
+#include <linux/types.h>
+#include <linux/pagemap.h>
+#include <linux/udp.h>
+#include <linux/sunrpc/xdr.h>
+
+
+/**
+ * skb_read_bits - copy some data bits from skb to internal buffer
+ * @desc: sk_buff copy helper
+ * @to: copy destination
+ * @len: number of bytes to copy
+ *
+ * Possibly called several times to iterate over an sk_buff and copy
+ * data out of it.
+ */
+static size_t skb_read_bits(skb_reader_t *desc, void *to, size_t len)
+{
+        if (len > desc->count)
+                len = desc->count;
+        if (skb_copy_bits(desc->skb, desc->offset, to, len))
+                return 0;
+        desc->count -= len;
+        desc->offset += len;
+        return len;
+}
+
+/**
+ * skb_read_and_csum_bits - copy and checksum from skb to buffer
+ * @desc: sk_buff copy helper
+ * @to: copy destination
+ * @len: number of bytes to copy
+ *
+ * Same as skb_read_bits, but calculate a checksum at the same time.
+ */
+static size_t skb_read_and_csum_bits(skb_reader_t *desc, void *to, size_t len)
+{
+        unsigned int    csum2, pos;
+
+        if (len > desc->count)
+                len = desc->count;
+        pos = desc->offset;
+        csum2 = skb_copy_and_csum_bits(desc->skb, pos, to, len, 0);
+        desc->csum = csum_block_add(desc->csum, csum2, pos);
+        desc->count -= len;
+        desc->offset += len;
+        return len;
+}
+
+/**
+ * xdr_partial_copy_from_skb - copy data out of an skb
+ * @xdr: target XDR buffer
+ * @base: starting offset
+ * @desc: sk_buff copy helper
+ * @copy_actor: virtual method for copying data
+ *
+ */
+ssize_t xdr_partial_copy_from_skb(struct xdr_buf *xdr, unsigned int base, skb_reader_t *desc, skb_read_actor_t copy_actor)
+{
+        struct page     **ppage = xdr->pages;
+        unsigned int    len, pglen = xdr->page_len;
+        ssize_t         copied = 0;
+        int             ret;
+
+        len = xdr->head[0].iov_len;
+        if (base < len) {
+                len -= base;
+                ret = copy_actor(desc, (char *)xdr->head[0].iov_base + base, len);
+                copied += ret;
+                if (ret != len || !desc->count)
+                        goto out;
+                base = 0;
+        } else
+                base -= len;
+
+        if (unlikely(pglen == 0))
+                goto copy_tail;
+        if (unlikely(base >= pglen)) {
+                base -= pglen;
+                goto copy_tail;
+        }
+        if (base || xdr->page_base) {
+                pglen -= base;
+                base += xdr->page_base;
+                ppage += base >> PAGE_CACHE_SHIFT;
+                base &= ~PAGE_CACHE_MASK;
+        }
+        do {
+                char *kaddr;
+
+                /* ACL likes to be lazy in allocating pages - ACLs
+                 * are small by default but can get huge. */
+                if (unlikely(*ppage == NULL)) {
+                        *ppage = alloc_page(GFP_ATOMIC);
+                        if (unlikely(*ppage == NULL)) {
+                                if (copied == 0)
+                                        copied = -ENOMEM;
+                                goto out;
+                        }
+                }
+
+                len = PAGE_CACHE_SIZE;
+                kaddr = kmap_atomic(*ppage, KM_SKB_SUNRPC_DATA);
+                if (base) {
+                        len -= base;
+                        if (pglen < len)
+                                len = pglen;
+                        ret = copy_actor(desc, kaddr + base, len);
+                        base = 0;
+                } else {
+                        if (pglen < len)
+                                len = pglen;
+                        ret = copy_actor(desc, kaddr, len);
+                }
+                flush_dcache_page(*ppage);
+                kunmap_atomic(kaddr, KM_SKB_SUNRPC_DATA);
+                copied += ret;
+                if (ret != len || !desc->count)
+                        goto out;
+                ppage++;
+        } while ((pglen -= len) != 0);
+copy_tail:
+        len = xdr->tail[0].iov_len;
+        if (base < len)
+                copied += copy_actor(desc, (char *)xdr->tail[0].iov_base + base, len - base);
+out:
+        return copied;
+}
+
+/**
+ * csum_partial_copy_to_xdr - checksum and copy data
+ * @xdr: target XDR buffer
+ * @skb: source skb
+ *
+ * We have set things up such that we perform the checksum of the UDP
+ * packet in parallel with the copies into the RPC client iovec.  -DaveM
+ */
+int csum_partial_copy_to_xdr(struct xdr_buf *xdr, struct sk_buff *skb)
+{
+        skb_reader_t    desc;
+
+        desc.skb = skb;
+        desc.offset = sizeof(struct udphdr);
+        desc.count = skb->len - desc.offset;
+
+        if (skb->ip_summed == CHECKSUM_UNNECESSARY)
+                goto no_checksum;
+
+        desc.csum = csum_partial(skb->data, desc.offset, skb->csum);
+        if (xdr_partial_copy_from_skb(xdr, 0, &desc, skb_read_and_csum_bits) < 0)
+                return -1;
+        if (desc.offset != skb->len) {
+                unsigned int csum2;
+                csum2 = skb_checksum(skb, desc.offset, skb->len - desc.offset, 0);
+                desc.csum = csum_block_add(desc.csum, csum2, desc.offset);
+        }
+        if (desc.count)
+                return -1;
+        if ((unsigned short)csum_fold(desc.csum))
+                return -1;
+        return 0;
+no_checksum:
+        if (xdr_partial_copy_from_skb(xdr, 0, &desc, skb_read_bits) < 0)
+                return -1;
+        if (desc.count)
+                return -1;
+        return 0;
+}
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index ed48ff022d35..2387e7b823ff 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -10,7 +10,6 @@
 #include <linux/module.h>
 
 #include <linux/types.h>
-#include <linux/socket.h>
 #include <linux/sched.h>
 #include <linux/uio.h>
 #include <linux/unistd.h>
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 30ec3efc48a6..f16e7cdd6150 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -548,9 +548,6 @@ svc_write_space(struct sock *sk)
 /*
  * Receive a datagram from a UDP socket.
  */
-extern int
-csum_partial_copy_to_xdr(struct xdr_buf *xdr, struct sk_buff *skb);
-
 static int
 svc_udp_recvfrom(struct svc_rqst *rqstp)
 {
@@ -587,7 +584,7 @@ svc_udp_recvfrom(struct svc_rqst *rqstp)
                 struct timeval tv;
 
                 tv.tv_sec = xtime.tv_sec;
-                tv.tv_usec = xtime.tv_nsec * 1000;
+                tv.tv_usec = xtime.tv_nsec / NSEC_PER_USEC;
                 skb_set_timestamp(skb, &tv);
                 /* Don't enable netstamp, sunrpc doesn't 
                    need that much accuracy */
diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
index 1b9616a12e24..d0c9f460e411 100644
--- a/net/sunrpc/sysctl.c
+++ b/net/sunrpc/sysctl.c
@@ -119,8 +119,18 @@ done:
         return 0;
 }
 
+unsigned int xprt_udp_slot_table_entries = RPC_DEF_SLOT_TABLE;
+unsigned int xprt_tcp_slot_table_entries = RPC_DEF_SLOT_TABLE;
+unsigned int xprt_min_resvport = RPC_DEF_MIN_RESVPORT;
+EXPORT_SYMBOL(xprt_min_resvport);
+unsigned int xprt_max_resvport = RPC_DEF_MAX_RESVPORT;
+EXPORT_SYMBOL(xprt_max_resvport);
+
+
 static unsigned int min_slot_table_size = RPC_MIN_SLOT_TABLE;
 static unsigned int max_slot_table_size = RPC_MAX_SLOT_TABLE;
+static unsigned int xprt_min_resvport_limit = RPC_MIN_RESVPORT;
+static unsigned int xprt_max_resvport_limit = RPC_MAX_RESVPORT;
 
 static ctl_table debug_table[] = {
         {
@@ -177,6 +187,28 @@ static ctl_table debug_table[] = {
                 .extra1         = &min_slot_table_size,
                 .extra2         = &max_slot_table_size
         },
+        {
+                .ctl_name       = CTL_MIN_RESVPORT,
+                .procname       = "min_resvport",
+                .data           = &xprt_min_resvport,
+                .maxlen         = sizeof(unsigned int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_minmax,
+                .strategy       = &sysctl_intvec,
+                .extra1         = &xprt_min_resvport_limit,
+                .extra2         = &xprt_max_resvport_limit
+        },
+        {
+                .ctl_name       = CTL_MAX_RESVPORT,
+                .procname       = "max_resvport",
+                .data           = &xprt_max_resvport,
+                .maxlen         = sizeof(unsigned int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_minmax,
+                .strategy       = &sysctl_intvec,
+                .extra1         = &xprt_min_resvport_limit,
+                .extra2         = &xprt_max_resvport_limit
+        },
         { .ctl_name = 0 }
 };
 
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index fde16f40a581..32df43372ee9 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -6,15 +6,12 @@
  * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
  */
 
+#include <linux/module.h>
 #include <linux/types.h>
-#include <linux/socket.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
 #include <linux/pagemap.h>
 #include <linux/errno.h>
-#include <linux/in.h>
-#include <linux/net.h>
-#include <net/sock.h>
 #include <linux/sunrpc/xdr.h>
 #include <linux/sunrpc/msg_prot.h>
 
@@ -176,178 +173,6 @@ xdr_inline_pages(struct xdr_buf *xdr, unsigned int offset,
         xdr->buflen += len;
 }
 
-ssize_t
-xdr_partial_copy_from_skb(struct xdr_buf *xdr, unsigned int base,
-                          skb_reader_t *desc,
-                          skb_read_actor_t copy_actor)
-{
-        struct page     **ppage = xdr->pages;
-        unsigned int    len, pglen = xdr->page_len;
-        ssize_t         copied = 0;
-        int             ret;
-
-        len = xdr->head[0].iov_len;
-        if (base < len) {
-                len -= base;
-                ret = copy_actor(desc, (char *)xdr->head[0].iov_base + base, len);
-                copied += ret;
-                if (ret != len || !desc->count)
-                        goto out;
-                base = 0;
-        } else
-                base -= len;
-
-        if (pglen == 0)
-                goto copy_tail;
-        if (base >= pglen) {
-                base -= pglen;
-                goto copy_tail;
-        }
-        if (base || xdr->page_base) {
-                pglen -= base;
-                base  += xdr->page_base;
-                ppage += base >> PAGE_CACHE_SHIFT;
-                base &= ~PAGE_CACHE_MASK;
-        }
-        do {
-                char *kaddr;
-
-                /* ACL likes to be lazy in allocating pages - ACLs
-                 * are small by default but can get huge. */
-                if (unlikely(*ppage == NULL)) {
-                        *ppage = alloc_page(GFP_ATOMIC);
-                        if (unlikely(*ppage == NULL)) {
-                                if (copied == 0)
-                                        copied = -ENOMEM;
-                                goto out;
-                        }
-                }
-
-                len = PAGE_CACHE_SIZE;
-                kaddr = kmap_atomic(*ppage, KM_SKB_SUNRPC_DATA);
-                if (base) {
-                        len -= base;
-                        if (pglen < len)
-                                len = pglen;
-                        ret = copy_actor(desc, kaddr + base, len);
-                        base = 0;
-                } else {
-                        if (pglen < len)
-                                len = pglen;
-                        ret = copy_actor(desc, kaddr, len);
-                }
-                flush_dcache_page(*ppage);
-                kunmap_atomic(kaddr, KM_SKB_SUNRPC_DATA);
-                copied += ret;
-                if (ret != len || !desc->count)
-                        goto out;
-                ppage++;
-        } while ((pglen -= len) != 0);
-copy_tail:
-        len = xdr->tail[0].iov_len;
-        if (base < len)
-                copied += copy_actor(desc, (char *)xdr->tail[0].iov_base + base, len - base);
-out:
-        return copied;
-}
-
-
-int
-xdr_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen,
-                struct xdr_buf *xdr, unsigned int base, int msgflags)
-{
-        struct page **ppage = xdr->pages;
-        unsigned int len, pglen = xdr->page_len;
-        int err, ret = 0;
-        ssize_t (*sendpage)(struct socket *, struct page *, int, size_t, int);
-
-        len = xdr->head[0].iov_len;
-        if (base < len || (addr != NULL && base == 0)) {
-                struct kvec iov = {
-                        .iov_base = xdr->head[0].iov_base + base,
-                        .iov_len  = len - base,
-                };
-                struct msghdr msg = {
-                        .msg_name    = addr,
-                        .msg_namelen = addrlen,
-                        .msg_flags   = msgflags,
-                };
-                if (xdr->len > len)
-                        msg.msg_flags |= MSG_MORE;
-
-                if (iov.iov_len != 0)
-                        err = kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len);
-                else
-                        err = kernel_sendmsg(sock, &msg, NULL, 0, 0);
-                if (ret == 0)
-                        ret = err;
-                else if (err > 0)
-                        ret += err;
-                if (err != iov.iov_len)
-                        goto out;
-                base = 0;
-        } else
-                base -= len;
-
-        if (pglen == 0)
-                goto copy_tail;
-        if (base >= pglen) {
-                base -= pglen;
-                goto copy_tail;
-        }
-        if (base || xdr->page_base) {
-                pglen -= base;
-                base  += xdr->page_base;
-                ppage += base >> PAGE_CACHE_SHIFT;
-                base &= ~PAGE_CACHE_MASK;
-        }
-
-        sendpage = sock->ops->sendpage ? : sock_no_sendpage;
-        do {
-                int flags = msgflags;
-
-                len = PAGE_CACHE_SIZE;
-                if (base)
-                        len -= base;
-                if (pglen < len)
-                        len = pglen;
-
-                if (pglen != len || xdr->tail[0].iov_len != 0)
-                        flags |= MSG_MORE;
-
-                /* Hmm... We might be dealing with highmem pages */
-                if (PageHighMem(*ppage))
-                        sendpage = sock_no_sendpage;
-                err = sendpage(sock, *ppage, base, len, flags);
-                if (ret == 0)
-                        ret = err;
-                else if (err > 0)
-                        ret += err;
-                if (err != len)
-                        goto out;
-                base = 0;
-                ppage++;
-        } while ((pglen -= len) != 0);
-copy_tail:
-        len = xdr->tail[0].iov_len;
-        if (base < len) {
-                struct kvec iov = {
-                        .iov_base = xdr->tail[0].iov_base + base,
-                        .iov_len  = len - base,
-                };
-                struct msghdr msg = {
-                        .msg_flags   = msgflags,
-                };
-                err = kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len);
-                if (ret == 0)
-                        ret = err;
-                else if (err > 0)
-                        ret += err;
-        }
-out:
-        return ret;
-}
-
 
 /*
  * Helper routines for doing 'memmove' like operations on a struct xdr_buf
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 3c654e06b084..6dda3860351f 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -10,12 +10,12 @@
  *      one is available. Otherwise, it sleeps on the backlog queue
  *      (xprt_reserve).
  *  -   Next, the caller puts together the RPC message, stuffs it into
- *      the request struct, and calls xprt_call().
- *  -   xprt_call transmits the message and installs the caller on the
- *      socket's wait list. At the same time, it installs a timer that
+ *      the request struct, and calls xprt_transmit().
+ *  -   xprt_transmit sends the message and installs the caller on the
+ *      transport's wait list. At the same time, it installs a timer that
  *      is run after the packet's timeout has expired.
  *  -   When a packet arrives, the data_ready handler walks the list of
- *      pending requests for that socket. If a matching XID is found, the
+ *      pending requests for that transport. If a matching XID is found, the
  *      caller is woken up, and the timer removed.
  *  -   When no reply arrives within the timeout interval, the timer is
  *      fired by the kernel and runs xprt_timer(). It either adjusts the
@@ -33,36 +33,17 @@
  *
  *  Copyright (C) 1995-1997, Olaf Kirch <okir@monad.swb.de>
  *
- *  TCP callback races fixes (C) 1998 Red Hat Software <alan@redhat.com>
- *  TCP send fixes (C) 1998 Red Hat Software <alan@redhat.com>
- *  TCP NFS related read + write fixes
- *   (C) 1999 Dave Airlie, University of Limerick, Ireland <airlied@linux.ie>
- *
- *  Rewrite of larges part of the code in order to stabilize TCP stuff.
- *  Fix behaviour when socket buffer is full.
- *   (C) 1999 Trond Myklebust <trond.myklebust@fys.uio.no>
+ *  Transport switch API copyright (C) 2005, Chuck Lever <cel@netapp.com>
  */
 
+#include <linux/module.h>
+
 #include <linux/types.h>
-#include <linux/slab.h>
-#include <linux/capability.h>
-#include <linux/sched.h>
-#include <linux/errno.h>
-#include <linux/socket.h>
-#include <linux/in.h>
-#include <linux/net.h>
-#include <linux/mm.h>
-#include <linux/udp.h>
-#include <linux/tcp.h>
-#include <linux/sunrpc/clnt.h>
-#include <linux/file.h>
+#include <linux/interrupt.h>
 #include <linux/workqueue.h>
 #include <linux/random.h>
 
-#include <net/sock.h>
-#include <net/checksum.h>
-#include <net/udp.h>
-#include <net/tcp.h>
+#include <linux/sunrpc/clnt.h>
 
 /*
  * Local variables
@@ -73,81 +54,90 @@
 # define RPCDBG_FACILITY        RPCDBG_XPRT
 #endif
 
-#define XPRT_MAX_BACKOFF        (8)
-#define XPRT_IDLE_TIMEOUT       (5*60*HZ)
-#define XPRT_MAX_RESVPORT       (800)
-
 /*
  * Local functions
  */
 static void     xprt_request_init(struct rpc_task *, struct rpc_xprt *);
 static inline void      do_xprt_reserve(struct rpc_task *);
-static void     xprt_disconnect(struct rpc_xprt *);
 static void     xprt_connect_status(struct rpc_task *task);
-static struct rpc_xprt * xprt_setup(int proto, struct sockaddr_in *ap,
-                                                struct rpc_timeout *to);
-static struct socket *xprt_create_socket(struct rpc_xprt *, int, int);
-static void     xprt_bind_socket(struct rpc_xprt *, struct socket *);
 static int      __xprt_get_cong(struct rpc_xprt *, struct rpc_task *);
 
-static int      xprt_clear_backlog(struct rpc_xprt *xprt);
-
-#ifdef RPC_DEBUG_DATA
 /*
- * Print the buffer contents (first 128 bytes only--just enough for
- * diropres return).
+ * The transport code maintains an estimate on the maximum number of out-
+ * standing RPC requests, using a smoothed version of the congestion
+ * avoidance implemented in 44BSD. This is basically the Van Jacobson
+ * congestion algorithm: If a retransmit occurs, the congestion window is
+ * halved; otherwise, it is incremented by 1/cwnd when
+ *
+ *      -       a reply is received and
+ *      -       a full number of requests are outstanding and
+ *      -       the congestion window hasn't been updated recently.
  */
-static void
-xprt_pktdump(char *msg, u32 *packet, unsigned int count)
-{
-        u8      *buf = (u8 *) packet;
-        int     j;
-
-        dprintk("RPC:      %s\n", msg);
-        for (j = 0; j < count && j < 128; j += 4) {
-                if (!(j & 31)) {
-                        if (j)
-                                dprintk("\n");
-                        dprintk("0x%04x ", j);
-                }
-                dprintk("%02x%02x%02x%02x ",
-                        buf[j], buf[j+1], buf[j+2], buf[j+3]);
-        }
-        dprintk("\n");
-}
-#else
-static inline void
-xprt_pktdump(char *msg, u32 *packet, unsigned int count)
-{
-        /* NOP */
-}
-#endif
+#define RPC_CWNDSHIFT           (8U)
+#define RPC_CWNDSCALE           (1U << RPC_CWNDSHIFT)
+#define RPC_INITCWND            RPC_CWNDSCALE
+#define RPC_MAXCWND(xprt)       ((xprt)->max_reqs << RPC_CWNDSHIFT)
 
-/*
- * Look up RPC transport given an INET socket
+#define RPCXPRT_CONGESTED(xprt) ((xprt)->cong >= (xprt)->cwnd)
+
+/**
+ * xprt_reserve_xprt - serialize write access to transports
+ * @task: task that is requesting access to the transport
+ *
+ * This prevents mixing the payload of separate requests, and prevents
+ * transport connects from colliding with writes.  No congestion control
+ * is provided.
  */
-static inline struct rpc_xprt *
-xprt_from_sock(struct sock *sk)
+int xprt_reserve_xprt(struct rpc_task *task)
 {
-        return (struct rpc_xprt *) sk->sk_user_data;
+        struct rpc_xprt *xprt = task->tk_xprt;
+        struct rpc_rqst *req = task->tk_rqstp;
+
+        if (test_and_set_bit(XPRT_LOCKED, &xprt->state)) {
+                if (task == xprt->snd_task)
+                        return 1;
+                if (task == NULL)
+                        return 0;
+                goto out_sleep;
+        }
+        xprt->snd_task = task;
+        if (req) {
+                req->rq_bytes_sent = 0;
+                req->rq_ntrans++;
+        }
+        return 1;
+
+out_sleep:
+        dprintk("RPC: %4d failed to lock transport %p\n",
+                        task->tk_pid, xprt);
+        task->tk_timeout = 0;
+        task->tk_status = -EAGAIN;
+        if (req && req->rq_ntrans)
+                rpc_sleep_on(&xprt->resend, task, NULL, NULL);
+        else
+                rpc_sleep_on(&xprt->sending, task, NULL, NULL);
+        return 0;
 }
 
 /*
- * Serialize write access to sockets, in order to prevent different
- * requests from interfering with each other.
- * Also prevents TCP socket connects from colliding with writes.
+ * xprt_reserve_xprt_cong - serialize write access to transports
+ * @task: task that is requesting access to the transport
+ *
+ * Same as xprt_reserve_xprt, but Van Jacobson congestion control is
+ * integrated into the decision of whether a request is allowed to be
+ * woken up and given access to the transport.
  */
-static int
-__xprt_lock_write(struct rpc_xprt *xprt, struct rpc_task *task)
+int xprt_reserve_xprt_cong(struct rpc_task *task)
 {
+        struct rpc_xprt *xprt = task->tk_xprt;
         struct rpc_rqst *req = task->tk_rqstp;
 
-        if (test_and_set_bit(XPRT_LOCKED, &xprt->sockstate)) {
+        if (test_and_set_bit(XPRT_LOCKED, &xprt->state)) {
                 if (task == xprt->snd_task)
                         return 1;
                 goto out_sleep;
         }
-        if (xprt->nocong || __xprt_get_cong(xprt, task)) {
+        if (__xprt_get_cong(xprt, task)) {
                 xprt->snd_task = task;
                 if (req) {
                         req->rq_bytes_sent = 0;
@@ -156,10 +146,10 @@ __xprt_lock_write(struct rpc_xprt *xprt, struct rpc_task *task)
                 return 1;
         }
         smp_mb__before_clear_bit();
-        clear_bit(XPRT_LOCKED, &xprt->sockstate);
+        clear_bit(XPRT_LOCKED, &xprt->state);
         smp_mb__after_clear_bit();
 out_sleep:
-        dprintk("RPC: %4d failed to lock socket %p\n", task->tk_pid, xprt);
+        dprintk("RPC: %4d failed to lock transport %p\n", task->tk_pid, xprt);
         task->tk_timeout = 0;
         task->tk_status = -EAGAIN;
         if (req && req->rq_ntrans)
@@ -169,26 +159,52 @@ out_sleep:
         return 0;
 }
 
-static inline int
-xprt_lock_write(struct rpc_xprt *xprt, struct rpc_task *task)
+static inline int xprt_lock_write(struct rpc_xprt *xprt, struct rpc_task *task)
 {
         int retval;
 
-        spin_lock_bh(&xprt->sock_lock);
-        retval = __xprt_lock_write(xprt, task);
-        spin_unlock_bh(&xprt->sock_lock);
+        spin_lock_bh(&xprt->transport_lock);
+        retval = xprt->ops->reserve_xprt(task);
+        spin_unlock_bh(&xprt->transport_lock);
         return retval;
 }
 
+static void __xprt_lock_write_next(struct rpc_xprt *xprt)
+{
+        struct rpc_task *task;
+        struct rpc_rqst *req;
 
-static void
-__xprt_lock_write_next(struct rpc_xprt *xprt)
+        if (test_and_set_bit(XPRT_LOCKED, &xprt->state))
+                return;
+
+        task = rpc_wake_up_next(&xprt->resend);
+        if (!task) {
+                task = rpc_wake_up_next(&xprt->sending);
+                if (!task)
+                        goto out_unlock;
+        }
+
+        req = task->tk_rqstp;
+        xprt->snd_task = task;
+        if (req) {
+                req->rq_bytes_sent = 0;
+                req->rq_ntrans++;
+        }
+        return;
+
+out_unlock:
+        smp_mb__before_clear_bit();
+        clear_bit(XPRT_LOCKED, &xprt->state);
+        smp_mb__after_clear_bit();
+}
+
+static void __xprt_lock_write_next_cong(struct rpc_xprt *xprt)
 {
         struct rpc_task *task;
 
-        if (test_and_set_bit(XPRT_LOCKED, &xprt->sockstate))
+        if (test_and_set_bit(XPRT_LOCKED, &xprt->state))
                 return;
-        if (!xprt->nocong && RPCXPRT_CONGESTED(xprt))
+        if (RPCXPRT_CONGESTED(xprt))
                 goto out_unlock;
         task = rpc_wake_up_next(&xprt->resend);
         if (!task) {
@@ -196,7 +212,7 @@ __xprt_lock_write_next(struct rpc_xprt *xprt)
                 if (!task)
                         goto out_unlock;
         }
-        if (xprt->nocong || __xprt_get_cong(xprt, task)) {
+        if (__xprt_get_cong(xprt, task)) {
                 struct rpc_rqst *req = task->tk_rqstp;
                 xprt->snd_task = task;
                 if (req) {
@@ -207,87 +223,52 @@ __xprt_lock_write_next(struct rpc_xprt *xprt)
         }
 out_unlock:
         smp_mb__before_clear_bit();
-        clear_bit(XPRT_LOCKED, &xprt->sockstate);
+        clear_bit(XPRT_LOCKED, &xprt->state);
         smp_mb__after_clear_bit();
 }
 
-/*
- * Releases the socket for use by other requests.
+/**
+ * xprt_release_xprt - allow other requests to use a transport
+ * @xprt: transport with other tasks potentially waiting
+ * @task: task that is releasing access to the transport
+ *
+ * Note that "task" can be NULL.  No congestion control is provided.
  */
-static void
-__xprt_release_write(struct rpc_xprt *xprt, struct rpc_task *task)
+void xprt_release_xprt(struct rpc_xprt *xprt, struct rpc_task *task)
 {
         if (xprt->snd_task == task) {
                 xprt->snd_task = NULL;
                 smp_mb__before_clear_bit();
-                clear_bit(XPRT_LOCKED, &xprt->sockstate);
+                clear_bit(XPRT_LOCKED, &xprt->state);
                 smp_mb__after_clear_bit();
                 __xprt_lock_write_next(xprt);
         }
 }
 
-static inline void
-xprt_release_write(struct rpc_xprt *xprt, struct rpc_task *task)
-{
-        spin_lock_bh(&xprt->sock_lock);
-        __xprt_release_write(xprt, task);
-        spin_unlock_bh(&xprt->sock_lock);
-}
-
-/*
- * Write data to socket.
+/**
+ * xprt_release_xprt_cong - allow other requests to use a transport
+ * @xprt: transport with other tasks potentially waiting
+ * @task: task that is releasing access to the transport
+ *
+ * Note that "task" can be NULL.  Another task is awoken to use the
+ * transport if the transport's congestion window allows it.
  */
-static inline int
-xprt_sendmsg(struct rpc_xprt *xprt, struct rpc_rqst *req)
+void xprt_release_xprt_cong(struct rpc_xprt *xprt, struct rpc_task *task)
 {
-        struct socket   *sock = xprt->sock;
-        struct xdr_buf  *xdr = &req->rq_snd_buf;
-        struct sockaddr *addr = NULL;
-        int addrlen = 0;
-        unsigned int    skip;
-        int             result;
-
-        if (!sock)
-                return -ENOTCONN;
-
-        xprt_pktdump("packet data:",
-                                req->rq_svec->iov_base,
-                                req->rq_svec->iov_len);
-
-        /* For UDP, we need to provide an address */
-        if (!xprt->stream) {
-                addr = (struct sockaddr *) &xprt->addr;
-                addrlen = sizeof(xprt->addr);
+        if (xprt->snd_task == task) {
+                xprt->snd_task = NULL;
+                smp_mb__before_clear_bit();
+                clear_bit(XPRT_LOCKED, &xprt->state);
+                smp_mb__after_clear_bit();
+                __xprt_lock_write_next_cong(xprt);
         }
-        /* Dont repeat bytes */
-        skip = req->rq_bytes_sent;
-
-        clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags);
-        result = xdr_sendpages(sock, addr, addrlen, xdr, skip, MSG_DONTWAIT);
-
-        dprintk("RPC:      xprt_sendmsg(%d) = %d\n", xdr->len - skip, result);
-
-        if (result >= 0)
-                return result;
+}
 
-        switch (result) {
-        case -ECONNREFUSED:
-                /* When the server has died, an ICMP port unreachable message
-                 * prompts ECONNREFUSED.
-                 */
-        case -EAGAIN:
-                break;
-        case -ECONNRESET:
-        case -ENOTCONN:
-        case -EPIPE:
-                /* connection broken */
-                if (xprt->stream)
-                        result = -ENOTCONN;
-                break;
-        default:
-                printk(KERN_NOTICE "RPC: sendmsg returned error %d\n", -result);
-        }
-        return result;
+static inline void xprt_release_write(struct rpc_xprt *xprt, struct rpc_task *task)
+{
+        spin_lock_bh(&xprt->transport_lock);
+        xprt->ops->release_xprt(xprt, task);
+        spin_unlock_bh(&xprt->transport_lock);
 }
 
 /*
@@ -321,26 +302,40 @@ __xprt_put_cong(struct rpc_xprt *xprt, struct rpc_rqst *req)
                 return;
         req->rq_cong = 0;
         xprt->cong -= RPC_CWNDSCALE;
-        __xprt_lock_write_next(xprt);
+        __xprt_lock_write_next_cong(xprt);
 }
 
-/*
- * Adjust RPC congestion window
+/**
+ * xprt_release_rqst_cong - housekeeping when request is complete
+ * @task: RPC request that recently completed
+ *
+ * Useful for transports that require congestion control.
+ */
+void xprt_release_rqst_cong(struct rpc_task *task)
+{
+        __xprt_put_cong(task->tk_xprt, task->tk_rqstp);
+}
+
+/**
+ * xprt_adjust_cwnd - adjust transport congestion window
+ * @task: recently completed RPC request used to adjust window
+ * @result: result code of completed RPC request
+ *
  * We use a time-smoothed congestion estimator to avoid heavy oscillation.
  */
-static void
-xprt_adjust_cwnd(struct rpc_xprt *xprt, int result)
+void xprt_adjust_cwnd(struct rpc_task *task, int result)
 {
-        unsigned long   cwnd;
+        struct rpc_rqst *req = task->tk_rqstp;
+        struct rpc_xprt *xprt = task->tk_xprt;
+        unsigned long cwnd = xprt->cwnd;
 
-        cwnd = xprt->cwnd;
         if (result >= 0 && cwnd <= xprt->cong) {
                 /* The (cwnd >> 1) term makes sure
                  * the result gets rounded properly. */
                 cwnd += (RPC_CWNDSCALE * RPC_CWNDSCALE + (cwnd >> 1)) / cwnd;
                 if (cwnd > RPC_MAXCWND(xprt))
                         cwnd = RPC_MAXCWND(xprt);
-                __xprt_lock_write_next(xprt);
+                __xprt_lock_write_next_cong(xprt);
         } else if (result == -ETIMEDOUT) {
                 cwnd >>= 1;
                 if (cwnd < RPC_CWNDSCALE)
@@ -349,11 +344,89 @@ xprt_adjust_cwnd(struct rpc_xprt *xprt, int result)
         dprintk("RPC:      cong %ld, cwnd was %ld, now %ld\n",
                         xprt->cong, xprt->cwnd, cwnd);
         xprt->cwnd = cwnd;
+        __xprt_put_cong(xprt, req);
+}
+
+/**
+ * xprt_wake_pending_tasks - wake all tasks on a transport's pending queue
+ * @xprt: transport with waiting tasks
+ * @status: result code to plant in each task before waking it
+ *
+ */
+void xprt_wake_pending_tasks(struct rpc_xprt *xprt, int status)
+{
+        if (status < 0)
+                rpc_wake_up_status(&xprt->pending, status);
+        else
+                rpc_wake_up(&xprt->pending);
+}
+
+/**
+ * xprt_wait_for_buffer_space - wait for transport output buffer to clear
+ * @task: task to be put to sleep
+ *
+ */
+void xprt_wait_for_buffer_space(struct rpc_task *task)
+{
+        struct rpc_rqst *req = task->tk_rqstp;
+        struct rpc_xprt *xprt = req->rq_xprt;
+
+        task->tk_timeout = req->rq_timeout;
+        rpc_sleep_on(&xprt->pending, task, NULL, NULL);
+}
+
+/**
+ * xprt_write_space - wake the task waiting for transport output buffer space
+ * @xprt: transport with waiting tasks
+ *
+ * Can be called in a soft IRQ context, so xprt_write_space never sleeps.
+ */
+void xprt_write_space(struct rpc_xprt *xprt)
+{
+        if (unlikely(xprt->shutdown))
+                return;
+
+        spin_lock_bh(&xprt->transport_lock);
+        if (xprt->snd_task) {
+                dprintk("RPC:      write space: waking waiting task on xprt %p\n",
+                                xprt);
+                rpc_wake_up_task(xprt->snd_task);
+        }
+        spin_unlock_bh(&xprt->transport_lock);
+}
+
+/**
+ * xprt_set_retrans_timeout_def - set a request's retransmit timeout
+ * @task: task whose timeout is to be set
+ *
+ * Set a request's retransmit timeout based on the transport's
+ * default timeout parameters.  Used by transports that don't adjust
+ * the retransmit timeout based on round-trip time estimation.
+ */
+void xprt_set_retrans_timeout_def(struct rpc_task *task)
+{
+        task->tk_timeout = task->tk_rqstp->rq_timeout;
 }
 
 /*
- * Reset the major timeout value
+ * xprt_set_retrans_timeout_rtt - set a request's retransmit timeout
+ * @task: task whose timeout is to be set
+ * 
+ * Set a request's retransmit timeout using the RTT estimator.
  */
+void xprt_set_retrans_timeout_rtt(struct rpc_task *task)
+{
+        int timer = task->tk_msg.rpc_proc->p_timer;
+        struct rpc_rtt *rtt = task->tk_client->cl_rtt;
+        struct rpc_rqst *req = task->tk_rqstp;
+        unsigned long max_timeout = req->rq_xprt->timeout.to_maxval;
+
+        task->tk_timeout = rpc_calc_rto(rtt, timer);
+        task->tk_timeout <<= rpc_ntimeo(rtt, timer) + req->rq_retries;
+        if (task->tk_timeout > max_timeout || task->tk_timeout == 0)
+                task->tk_timeout = max_timeout;
+}
+
 static void xprt_reset_majortimeo(struct rpc_rqst *req)
 {
         struct rpc_timeout *to = &req->rq_xprt->timeout;
@@ -368,8 +441,10 @@ static void xprt_reset_majortimeo(struct rpc_rqst *req)
         req->rq_majortimeo += jiffies;
 }
 
-/*
- * Adjust timeout values etc for next retransmit
+/**
+ * xprt_adjust_timeout - adjust timeout values for next retransmit
+ * @req: RPC request containing parameters to use for the adjustment
+ *
  */
 int xprt_adjust_timeout(struct rpc_rqst *req)
 {
@@ -391,9 +466,9 @@ int xprt_adjust_timeout(struct rpc_rqst *req)
                 req->rq_retries = 0;
                 xprt_reset_majortimeo(req);
                 /* Reset the RTT counters == "slow start" */
-                spin_lock_bh(&xprt->sock_lock);
+                spin_lock_bh(&xprt->transport_lock);
                 rpc_init_rtt(req->rq_task->tk_client->cl_rtt, to->to_initval);
-                spin_unlock_bh(&xprt->sock_lock);
+                spin_unlock_bh(&xprt->transport_lock);
                 pprintk("RPC: %lu timeout\n", jiffies);
                 status = -ETIMEDOUT;
         }
@@ -405,133 +480,52 @@ int xprt_adjust_timeout(struct rpc_rqst *req)
         return status;
 }
 
-/*
- * Close down a transport socket
- */
-static void
-xprt_close(struct rpc_xprt *xprt)
-{
-        struct socket   *sock = xprt->sock;
-        struct sock     *sk = xprt->inet;
-
-        if (!sk)
-                return;
-
-        write_lock_bh(&sk->sk_callback_lock);
-        xprt->inet = NULL;
-        xprt->sock = NULL;
-
-        sk->sk_user_data    = NULL;
-        sk->sk_data_ready   = xprt->old_data_ready;
-        sk->sk_state_change = xprt->old_state_change;
-        sk->sk_write_space  = xprt->old_write_space;
-        write_unlock_bh(&sk->sk_callback_lock);
-
-        sk->sk_no_check  = 0;
-
-        sock_release(sock);
-}
-
-static void
-xprt_socket_autoclose(void *args)
+static void xprt_autoclose(void *args)
 {
         struct rpc_xprt *xprt = (struct rpc_xprt *)args;
 
         xprt_disconnect(xprt);
-        xprt_close(xprt);
+        xprt->ops->close(xprt);
         xprt_release_write(xprt, NULL);
 }
 
-/*
- * Mark a transport as disconnected
+/**
+ * xprt_disconnect - mark a transport as disconnected
+ * @xprt: transport to flag for disconnect
+ *
  */
-static void
-xprt_disconnect(struct rpc_xprt *xprt)
+void xprt_disconnect(struct rpc_xprt *xprt)
 {
         dprintk("RPC:      disconnected transport %p\n", xprt);
-        spin_lock_bh(&xprt->sock_lock);
+        spin_lock_bh(&xprt->transport_lock);
         xprt_clear_connected(xprt);
-        rpc_wake_up_status(&xprt->pending, -ENOTCONN);
-        spin_unlock_bh(&xprt->sock_lock);
+        xprt_wake_pending_tasks(xprt, -ENOTCONN);
+        spin_unlock_bh(&xprt->transport_lock);
 }
 
-/*
- * Used to allow disconnection when we've been idle
- */
 static void
 xprt_init_autodisconnect(unsigned long data)
 {
         struct rpc_xprt *xprt = (struct rpc_xprt *)data;
 
-        spin_lock(&xprt->sock_lock);
+        spin_lock(&xprt->transport_lock);
         if (!list_empty(&xprt->recv) || xprt->shutdown)
                 goto out_abort;
-        if (test_and_set_bit(XPRT_LOCKED, &xprt->sockstate))
+        if (test_and_set_bit(XPRT_LOCKED, &xprt->state))
                 goto out_abort;
-        spin_unlock(&xprt->sock_lock);
-        /* Let keventd close the socket */
-        if (test_bit(XPRT_CONNECTING, &xprt->sockstate) != 0)
+        spin_unlock(&xprt->transport_lock);
+        if (xprt_connecting(xprt))
                 xprt_release_write(xprt, NULL);
         else
                 schedule_work(&xprt->task_cleanup);
         return;
 out_abort:
-        spin_unlock(&xprt->sock_lock);
-}
-
-static void xprt_socket_connect(void *args)
-{
-        struct rpc_xprt *xprt = (struct rpc_xprt *)args;
-        struct socket *sock = xprt->sock;
-        int status = -EIO;
-
-        if (xprt->shutdown || xprt->addr.sin_port == 0)
-                goto out;
-
-        /*
-         * Start by resetting any existing state
-         */
-        xprt_close(xprt);
-        sock = xprt_create_socket(xprt, xprt->prot, xprt->resvport);
-        if (sock == NULL) {
-                /* couldn't create socket or bind to reserved port;
-                 * this is likely a permanent error, so cause an abort */
-                goto out;
-        }
-        xprt_bind_socket(xprt, sock);
-        xprt_sock_setbufsize(xprt);
-
-        status = 0;
-        if (!xprt->stream)
-                goto out;
-
-        /*
-         * Tell the socket layer to start connecting...
-         */
-        status = sock->ops->connect(sock, (struct sockaddr *) &xprt->addr,
-                        sizeof(xprt->addr), O_NONBLOCK);
-        dprintk("RPC: %p  connect status %d connected %d sock state %d\n",
-                        xprt, -status, xprt_connected(xprt), sock->sk->sk_state);
-        if (status < 0) {
-                switch (status) {
-                        case -EINPROGRESS:
-                        case -EALREADY:
-                                goto out_clear;
-                }
-        }
-out:
-        if (status < 0)
-                rpc_wake_up_status(&xprt->pending, status);
-        else
-                rpc_wake_up(&xprt->pending);
-out_clear:
-        smp_mb__before_clear_bit();
-        clear_bit(XPRT_CONNECTING, &xprt->sockstate);
-        smp_mb__after_clear_bit();
+        spin_unlock(&xprt->transport_lock);
 }
 
-/*
- * Attempt to connect a TCP socket.
+/**
+ * xprt_connect - schedule a transport connect operation
+ * @task: RPC task that is requesting the connect
  *
  */
 void xprt_connect(struct rpc_task *task)
@@ -552,37 +546,19 @@ void xprt_connect(struct rpc_task *task)
         if (!xprt_lock_write(xprt, task))
                 return;
         if (xprt_connected(xprt))
-                goto out_write;
+                xprt_release_write(xprt, task);
+        else {
+                if (task->tk_rqstp)
+                        task->tk_rqstp->rq_bytes_sent = 0;
 
-        if (task->tk_rqstp)
-                task->tk_rqstp->rq_bytes_sent = 0;
-
-        task->tk_timeout = RPC_CONNECT_TIMEOUT;
-        rpc_sleep_on(&xprt->pending, task, xprt_connect_status, NULL);
-        if (!test_and_set_bit(XPRT_CONNECTING, &xprt->sockstate)) {
-                /* Note: if we are here due to a dropped connection
-                 *       we delay reconnecting by RPC_REESTABLISH_TIMEOUT/HZ
-                 *       seconds
-                 */
-                if (xprt->sock != NULL)
-                        schedule_delayed_work(&xprt->sock_connect,
-                                        RPC_REESTABLISH_TIMEOUT);
-                else {
-                        schedule_work(&xprt->sock_connect);
-                        if (!RPC_IS_ASYNC(task))
-                                flush_scheduled_work();
-                }
+                task->tk_timeout = xprt->connect_timeout;
+                rpc_sleep_on(&xprt->pending, task, xprt_connect_status, NULL);
+                xprt->ops->connect(task);
         }
         return;
- out_write:
-        xprt_release_write(xprt, task);
 }
 
-/*
- * We arrive here when awoken from waiting on connection establishment.
- */
-static void
-xprt_connect_status(struct rpc_task *task)
+static void xprt_connect_status(struct rpc_task *task)
 {
         struct rpc_xprt *xprt = task->tk_xprt;
 
@@ -592,31 +568,42 @@ xprt_connect_status(struct rpc_task *task)
                 return;
         }
 
-        /* if soft mounted, just cause this RPC to fail */
-        if (RPC_IS_SOFT(task))
-                task->tk_status = -EIO;
-
         switch (task->tk_status) {
         case -ECONNREFUSED:
         case -ECONNRESET:
+                dprintk("RPC: %4d xprt_connect_status: server %s refused connection\n",
+                                task->tk_pid, task->tk_client->cl_server);
+                break;
         case -ENOTCONN:
-                return;
+                dprintk("RPC: %4d xprt_connect_status: connection broken\n",
+                                task->tk_pid);
+                break;
         case -ETIMEDOUT:
-                dprintk("RPC: %4d xprt_connect_status: timed out\n",
+                dprintk("RPC: %4d xprt_connect_status: connect attempt timed out\n",
                                 task->tk_pid);
                 break;
         default:
-                printk(KERN_ERR "RPC: error %d connecting to server %s\n",
-                                -task->tk_status, task->tk_client->cl_server);
+                dprintk("RPC: %4d xprt_connect_status: error %d connecting to server %s\n",
+                                task->tk_pid, -task->tk_status, task->tk_client->cl_server);
+                xprt_release_write(xprt, task);
+                task->tk_status = -EIO;
+                return;
+        }
+
+        /* if soft mounted, just cause this RPC to fail */
+        if (RPC_IS_SOFT(task)) {
+                xprt_release_write(xprt, task);
+                task->tk_status = -EIO;
         }
-        xprt_release_write(xprt, task);
 }
 
-/*
- * Look up the RPC request corresponding to a reply, and then lock it.
+/**
+ * xprt_lookup_rqst - find an RPC request corresponding to an XID
+ * @xprt: transport on which the original request was transmitted
+ * @xid: RPC XID of incoming reply
+ *
  */
-static inline struct rpc_rqst *
-xprt_lookup_rqst(struct rpc_xprt *xprt, u32 xid)
+struct rpc_rqst *xprt_lookup_rqst(struct rpc_xprt *xprt, u32 xid)
 {
         struct list_head *pos;
         struct rpc_rqst *req = NULL;
@@ -631,556 +618,68 @@ xprt_lookup_rqst(struct rpc_xprt *xprt, u32 xid)
         return req;
 }
 
-/*
- * Complete reply received.
- * The TCP code relies on us to remove the request from xprt->pending.
- */
-static void
-xprt_complete_rqst(struct rpc_xprt *xprt, struct rpc_rqst *req, int copied)
-{
-        struct rpc_task *task = req->rq_task;
-        struct rpc_clnt *clnt = task->tk_client;
-
-        /* Adjust congestion window */
-        if (!xprt->nocong) {
-                unsigned timer = task->tk_msg.rpc_proc->p_timer;
-                xprt_adjust_cwnd(xprt, copied);
-                __xprt_put_cong(xprt, req);
-                if (timer) {
-                        if (req->rq_ntrans == 1)
-                                rpc_update_rtt(clnt->cl_rtt, timer,
-                                                (long)jiffies - req->rq_xtime);
-                        rpc_set_timeo(clnt->cl_rtt, timer, req->rq_ntrans - 1);
-                }
-        }
-
-#ifdef RPC_PROFILE
-        /* Profile only reads for now */
-        if (copied > 1024) {
-                static unsigned long    nextstat;
-                static unsigned long    pkt_rtt, pkt_len, pkt_cnt;
-
-                pkt_cnt++;
-                pkt_len += req->rq_slen + copied;
-                pkt_rtt += jiffies - req->rq_xtime;
-                if (time_before(nextstat, jiffies)) {
-                        printk("RPC: %lu %ld cwnd\n", jiffies, xprt->cwnd);
-                        printk("RPC: %ld %ld %ld %ld stat\n",
-                                        jiffies, pkt_cnt, pkt_len, pkt_rtt);
-                        pkt_rtt = pkt_len = pkt_cnt = 0;
-                        nextstat = jiffies + 5 * HZ;
-                }
-        }
-#endif
-
-        dprintk("RPC: %4d has input (%d bytes)\n", task->tk_pid, copied);
-        list_del_init(&req->rq_list);
-        req->rq_received = req->rq_private_buf.len = copied;
-
-        /* ... and wake up the process. */
-        rpc_wake_up_task(task);
-        return;
-}
-
-static size_t
-skb_read_bits(skb_reader_t *desc, void *to, size_t len)
-{
-        if (len > desc->count)
-                len = desc->count;
-        if (skb_copy_bits(desc->skb, desc->offset, to, len))
-                return 0;
-        desc->count -= len;
-        desc->offset += len;
-        return len;
-}
-
-static size_t
-skb_read_and_csum_bits(skb_reader_t *desc, void *to, size_t len)
-{
-        unsigned int csum2, pos;
-
-        if (len > desc->count)
-                len = desc->count;
-        pos = desc->offset;
-        csum2 = skb_copy_and_csum_bits(desc->skb, pos, to, len, 0);
-        desc->csum = csum_block_add(desc->csum, csum2, pos);
-        desc->count -= len;
-        desc->offset += len;
-        return len;
-}
-
-/*
- * We have set things up such that we perform the checksum of the UDP
- * packet in parallel with the copies into the RPC client iovec.  -DaveM
- */
-int
-csum_partial_copy_to_xdr(struct xdr_buf *xdr, struct sk_buff *skb)
-{
-        skb_reader_t desc;
-
-        desc.skb = skb;
-        desc.offset = sizeof(struct udphdr);
-        desc.count = skb->len - desc.offset;
-
-        if (skb->ip_summed == CHECKSUM_UNNECESSARY)
-                goto no_checksum;
-
-        desc.csum = csum_partial(skb->data, desc.offset, skb->csum);
-        if (xdr_partial_copy_from_skb(xdr, 0, &desc, skb_read_and_csum_bits) < 0)
-                return -1;
-        if (desc.offset != skb->len) {
-                unsigned int csum2;
-                csum2 = skb_checksum(skb, desc.offset, skb->len - desc.offset, 0);
-                desc.csum = csum_block_add(desc.csum, csum2, desc.offset);
-        }
-        if (desc.count)
-                return -1;
-        if ((unsigned short)csum_fold(desc.csum))
-                return -1;
-        return 0;
-no_checksum:
-        if (xdr_partial_copy_from_skb(xdr, 0, &desc, skb_read_bits) < 0)
-                return -1;
-        if (desc.count)
-                return -1;
-        return 0;
-}
-
-/*
- * Input handler for RPC replies. Called from a bottom half and hence
- * atomic.
- */
-static void
-udp_data_ready(struct sock *sk, int len)
-{
-        struct rpc_task *task;
-        struct rpc_xprt *xprt;
-        struct rpc_rqst *rovr;
-        struct sk_buff  *skb;
-        int err, repsize, copied;
-        u32 _xid, *xp;
-
-        read_lock(&sk->sk_callback_lock);
-        dprintk("RPC:      udp_data_ready...\n");
-        if (!(xprt = xprt_from_sock(sk))) {
-                printk("RPC:      udp_data_ready request not found!\n");
-                goto out;
-        }
-
-        dprintk("RPC:      udp_data_ready client %p\n", xprt);
-
-        if ((skb = skb_recv_datagram(sk, 0, 1, &err)) == NULL)
-                goto out;
-
-        if (xprt->shutdown)
-                goto dropit;
-
-        repsize = skb->len - sizeof(struct udphdr);
-        if (repsize < 4) {
-                printk("RPC: impossible RPC reply size %d!\n", repsize);
-                goto dropit;
-        }
-
-        /* Copy the XID from the skb... */
-        xp = skb_header_pointer(skb, sizeof(struct udphdr),
-                                sizeof(_xid), &_xid);
-        if (xp == NULL)
-                goto dropit;
-
-        /* Look up and lock the request corresponding to the given XID */
-        spin_lock(&xprt->sock_lock);
-        rovr = xprt_lookup_rqst(xprt, *xp);
-        if (!rovr)
-                goto out_unlock;
-        task = rovr->rq_task;
-
-        dprintk("RPC: %4d received reply\n", task->tk_pid);
-
-        if ((copied = rovr->rq_private_buf.buflen) > repsize)
-                copied = repsize;
-
-        /* Suck it into the iovec, verify checksum if not done by hw. */
-        if (csum_partial_copy_to_xdr(&rovr->rq_private_buf, skb))
-                goto out_unlock;
-
-        /* Something worked... */
-        dst_confirm(skb->dst);
-
-        xprt_complete_rqst(xprt, rovr, copied);
-
- out_unlock:
-        spin_unlock(&xprt->sock_lock);
- dropit:
-        skb_free_datagram(sk, skb);
- out:
-        read_unlock(&sk->sk_callback_lock);
-}
-
-/*
- * Copy from an skb into memory and shrink the skb.
- */
-static inline size_t
-tcp_copy_data(skb_reader_t *desc, void *p, size_t len)
-{
-        if (len > desc->count)
-                len = desc->count;
-        if (skb_copy_bits(desc->skb, desc->offset, p, len)) {
-                dprintk("RPC:      failed to copy %zu bytes from skb. %zu bytes remain\n",
-                                len, desc->count);
-                return 0;
-        }
-        desc->offset += len;
-        desc->count -= len;
-        dprintk("RPC:      copied %zu bytes from skb. %zu bytes remain\n",
-                        len, desc->count);
-        return len;
-}
-
-/*
- * TCP read fragment marker
- */
-static inline void
-tcp_read_fraghdr(struct rpc_xprt *xprt, skb_reader_t *desc)
-{
-        size_t len, used;
-        char *p;
-
-        p = ((char *) &xprt->tcp_recm) + xprt->tcp_offset;
-        len = sizeof(xprt->tcp_recm) - xprt->tcp_offset;
-        used = tcp_copy_data(desc, p, len);
-        xprt->tcp_offset += used;
-        if (used != len)
-                return;
-        xprt->tcp_reclen = ntohl(xprt->tcp_recm);
-        if (xprt->tcp_reclen & 0x80000000)
-                xprt->tcp_flags |= XPRT_LAST_FRAG;
-        else
-                xprt->tcp_flags &= ~XPRT_LAST_FRAG;
-        xprt->tcp_reclen &= 0x7fffffff;
-        xprt->tcp_flags &= ~XPRT_COPY_RECM;
-        xprt->tcp_offset = 0;
-        /* Sanity check of the record length */
-        if (xprt->tcp_reclen < 4) {
-                printk(KERN_ERR "RPC: Invalid TCP record fragment length\n");
-                xprt_disconnect(xprt);
-        }
-        dprintk("RPC:      reading TCP record fragment of length %d\n",
-                        xprt->tcp_reclen);
-}
-
-static void
-tcp_check_recm(struct rpc_xprt *xprt)
-{
-        dprintk("RPC:      xprt = %p, tcp_copied = %lu, tcp_offset = %u, tcp_reclen = %u, tcp_flags = %lx\n",
-                        xprt, xprt->tcp_copied, xprt->tcp_offset, xprt->tcp_reclen, xprt->tcp_flags);
-        if (xprt->tcp_offset == xprt->tcp_reclen) {
-                xprt->tcp_flags |= XPRT_COPY_RECM;
-                xprt->tcp_offset = 0;
-                if (xprt->tcp_flags & XPRT_LAST_FRAG) {
-                        xprt->tcp_flags &= ~XPRT_COPY_DATA;
-                        xprt->tcp_flags |= XPRT_COPY_XID;
-                        xprt->tcp_copied = 0;
-                }
-        }
-}
-
-/*
- * TCP read xid
- */
-static inline void
-tcp_read_xid(struct rpc_xprt *xprt, skb_reader_t *desc)
-{
-        size_t len, used;
-        char *p;
-
-        len = sizeof(xprt->tcp_xid) - xprt->tcp_offset;
-        dprintk("RPC:      reading XID (%Zu bytes)\n", len);
-        p = ((char *) &xprt->tcp_xid) + xprt->tcp_offset;
-        used = tcp_copy_data(desc, p, len);
-        xprt->tcp_offset += used;
-        if (used != len)
-                return;
-        xprt->tcp_flags &= ~XPRT_COPY_XID;
-        xprt->tcp_flags |= XPRT_COPY_DATA;
-        xprt->tcp_copied = 4;
-        dprintk("RPC:      reading reply for XID %08x\n",
-                                                ntohl(xprt->tcp_xid));
-        tcp_check_recm(xprt);
-}
-
-/*
- * TCP read and complete request
- */
-static inline void
-tcp_read_request(struct rpc_xprt *xprt, skb_reader_t *desc)
-{
-        struct rpc_rqst *req;
-        struct xdr_buf *rcvbuf;
-        size_t len;
-        ssize_t r;
-
-        /* Find and lock the request corresponding to this xid */
-        spin_lock(&xprt->sock_lock);
-        req = xprt_lookup_rqst(xprt, xprt->tcp_xid);
-        if (!req) {
-                xprt->tcp_flags &= ~XPRT_COPY_DATA;
-                dprintk("RPC:      XID %08x request not found!\n",
-                                ntohl(xprt->tcp_xid));
-                spin_unlock(&xprt->sock_lock);
-                return;
-        }
-
-        rcvbuf = &req->rq_private_buf;
-        len = desc->count;
-        if (len > xprt->tcp_reclen - xprt->tcp_offset) {
-                skb_reader_t my_desc;
-
-                len = xprt->tcp_reclen - xprt->tcp_offset;
-                memcpy(&my_desc, desc, sizeof(my_desc));
-                my_desc.count = len;
-                r = xdr_partial_copy_from_skb(rcvbuf, xprt->tcp_copied,
-                                          &my_desc, tcp_copy_data);
-                desc->count -= r;
-                desc->offset += r;
-        } else
-                r = xdr_partial_copy_from_skb(rcvbuf, xprt->tcp_copied,
-                                          desc, tcp_copy_data);
-
-        if (r > 0) {
-                xprt->tcp_copied += r;
-                xprt->tcp_offset += r;
-        }
-        if (r != len) {
-                /* Error when copying to the receive buffer,
-                 * usually because we weren't able to allocate
-                 * additional buffer pages. All we can do now
-                 * is turn off XPRT_COPY_DATA, so the request
-                 * will not receive any additional updates,
-                 * and time out.
-                 * Any remaining data from this record will
-                 * be discarded.
-                 */
-                xprt->tcp_flags &= ~XPRT_COPY_DATA;
-                dprintk("RPC:      XID %08x truncated request\n",
-                                ntohl(xprt->tcp_xid));
-                dprintk("RPC:      xprt = %p, tcp_copied = %lu, tcp_offset = %u, tcp_reclen = %u\n",
-                                xprt, xprt->tcp_copied, xprt->tcp_offset, xprt->tcp_reclen);
-                goto out;
-        }
-
-        dprintk("RPC:      XID %08x read %Zd bytes\n",
-                        ntohl(xprt->tcp_xid), r);
-        dprintk("RPC:      xprt = %p, tcp_copied = %lu, tcp_offset = %u, tcp_reclen = %u\n",
-                        xprt, xprt->tcp_copied, xprt->tcp_offset, xprt->tcp_reclen);
-
-        if (xprt->tcp_copied == req->rq_private_buf.buflen)
-                xprt->tcp_flags &= ~XPRT_COPY_DATA;
-        else if (xprt->tcp_offset == xprt->tcp_reclen) {
-                if (xprt->tcp_flags & XPRT_LAST_FRAG)
-                        xprt->tcp_flags &= ~XPRT_COPY_DATA;
-        }
-
-out:
-        if (!(xprt->tcp_flags & XPRT_COPY_DATA)) {
-                dprintk("RPC: %4d received reply complete\n",
-                                req->rq_task->tk_pid);
-                xprt_complete_rqst(xprt, req, xprt->tcp_copied);
-        }
-        spin_unlock(&xprt->sock_lock);
-        tcp_check_recm(xprt);
-}
-
-/*
- * TCP discard extra bytes from a short read
- */
-static inline void
-tcp_read_discard(struct rpc_xprt *xprt, skb_reader_t *desc)
-{
-        size_t len;
-
-        len = xprt->tcp_reclen - xprt->tcp_offset;
-        if (len > desc->count)
-                len = desc->count;
-        desc->count -= len;
-        desc->offset += len;
-        xprt->tcp_offset += len;
-        dprintk("RPC:      discarded %Zu bytes\n", len);
-        tcp_check_recm(xprt);
-}
-
-/*
- * TCP record receive routine
- * We first have to grab the record marker, then the XID, then the data.
+/**
+ * xprt_update_rtt - update an RPC client's RTT state after receiving a reply
+ * @task: RPC request that recently completed
+ *
  */
-static int
-tcp_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb,
-                unsigned int offset, size_t len)
-{
-        struct rpc_xprt *xprt = rd_desc->arg.data;
-        skb_reader_t desc = {
-                .skb    = skb,
-                .offset = offset,
-                .count  = len,
-                .csum   = 0
-        };
-
-        dprintk("RPC:      tcp_data_recv\n");
-        do {
-                /* Read in a new fragment marker if necessary */
-                /* Can we ever really expect to get completely empty fragments? */
-                if (xprt->tcp_flags & XPRT_COPY_RECM) {
-                        tcp_read_fraghdr(xprt, &desc);
-                        continue;
-                }
-                /* Read in the xid if necessary */
-                if (xprt->tcp_flags & XPRT_COPY_XID) {
-                        tcp_read_xid(xprt, &desc);
-                        continue;
-                }
-                /* Read in the request data */
-                if (xprt->tcp_flags & XPRT_COPY_DATA) {
-                        tcp_read_request(xprt, &desc);
-                        continue;
-                }
-                /* Skip over any trailing bytes on short reads */
-                tcp_read_discard(xprt, &desc);
-        } while (desc.count);
-        dprintk("RPC:      tcp_data_recv done\n");
-        return len - desc.count;
-}
-
-static void tcp_data_ready(struct sock *sk, int bytes)
+void xprt_update_rtt(struct rpc_task *task)
 {
-        struct rpc_xprt *xprt;
-        read_descriptor_t rd_desc;
-
-        read_lock(&sk->sk_callback_lock);
-        dprintk("RPC:      tcp_data_ready...\n");
-        if (!(xprt = xprt_from_sock(sk))) {
-                printk("RPC:      tcp_data_ready socket info not found!\n");
-                goto out;
-        }
-        if (xprt->shutdown)
-                goto out;
-
-        /* We use rd_desc to pass struct xprt to tcp_data_recv */
-        rd_desc.arg.data = xprt;
-        rd_desc.count = 65536;
-        tcp_read_sock(sk, &rd_desc, tcp_data_recv);
-out:
-        read_unlock(&sk->sk_callback_lock);
-}
-
-static void
-tcp_state_change(struct sock *sk)
-{
-        struct rpc_xprt *xprt;
+        struct rpc_rqst *req = task->tk_rqstp;
+        struct rpc_rtt *rtt = task->tk_client->cl_rtt;
+        unsigned timer = task->tk_msg.rpc_proc->p_timer;
 
-        read_lock(&sk->sk_callback_lock);
-        if (!(xprt = xprt_from_sock(sk)))
-                goto out;
-        dprintk("RPC:      tcp_state_change client %p...\n", xprt);
-        dprintk("RPC:      state %x conn %d dead %d zapped %d\n",
-                                sk->sk_state, xprt_connected(xprt),
-                                sock_flag(sk, SOCK_DEAD),
-                                sock_flag(sk, SOCK_ZAPPED));
-
-        switch (sk->sk_state) {
-        case TCP_ESTABLISHED:
-                spin_lock_bh(&xprt->sock_lock);
-                if (!xprt_test_and_set_connected(xprt)) {
-                        /* Reset TCP record info */
-                        xprt->tcp_offset = 0;
-                        xprt->tcp_reclen = 0;
-                        xprt->tcp_copied = 0;
-                        xprt->tcp_flags = XPRT_COPY_RECM | XPRT_COPY_XID;
-                        rpc_wake_up(&xprt->pending);
-                }
-                spin_unlock_bh(&xprt->sock_lock);
-                break;
-        case TCP_SYN_SENT:
-        case TCP_SYN_RECV:
-                break;
-        default:
-                xprt_disconnect(xprt);
-                break;
+        if (timer) {
+                if (req->rq_ntrans == 1)
+                        rpc_update_rtt(rtt, timer,
+                                        (long)jiffies - req->rq_xtime);
+                rpc_set_timeo(rtt, timer, req->rq_ntrans - 1);
         }
- out:
-        read_unlock(&sk->sk_callback_lock);
 }
 
-/*
- * Called when more output buffer space is available for this socket.
- * We try not to wake our writers until they can make "significant"
- * progress, otherwise we'll waste resources thrashing sock_sendmsg
- * with a bunch of small requests.
+/**
+ * xprt_complete_rqst - called when reply processing is complete
+ * @task: RPC request that recently completed
+ * @copied: actual number of bytes received from the transport
+ *
+ * Caller holds transport lock.
  */
-static void
-xprt_write_space(struct sock *sk)
+void xprt_complete_rqst(struct rpc_task *task, int copied)
 {
-        struct rpc_xprt *xprt;
-        struct socket   *sock;
-
-        read_lock(&sk->sk_callback_lock);
-        if (!(xprt = xprt_from_sock(sk)) || !(sock = sk->sk_socket))
-                goto out;
-        if (xprt->shutdown)
-                goto out;
-
-        /* Wait until we have enough socket memory */
-        if (xprt->stream) {
-                /* from net/core/stream.c:sk_stream_write_space */
-                if (sk_stream_wspace(sk) < sk_stream_min_wspace(sk))
-                        goto out;
-        } else {
-                /* from net/core/sock.c:sock_def_write_space */
-                if (!sock_writeable(sk))
-                        goto out;
-        }
+        struct rpc_rqst *req = task->tk_rqstp;
 
-        if (!test_and_clear_bit(SOCK_NOSPACE, &sock->flags))
-                goto out;
+        dprintk("RPC: %5u xid %08x complete (%d bytes received)\n",
+                        task->tk_pid, ntohl(req->rq_xid), copied);
 
-        spin_lock_bh(&xprt->sock_lock);
-        if (xprt->snd_task)
-                rpc_wake_up_task(xprt->snd_task);
-        spin_unlock_bh(&xprt->sock_lock);
-out:
-        read_unlock(&sk->sk_callback_lock);
+        list_del_init(&req->rq_list);
+        req->rq_received = req->rq_private_buf.len = copied;
+        rpc_wake_up_task(task);
 }
 
-/*
- * RPC receive timeout handler.
- */
-static void
-xprt_timer(struct rpc_task *task)
+static void xprt_timer(struct rpc_task *task)
 {
-        struct rpc_rqst *req = task->tk_rqstp;
+        struct rpc_rqst *req = task->tk_rqstp;
         struct rpc_xprt *xprt = req->rq_xprt;
 
-        spin_lock(&xprt->sock_lock);
-        if (req->rq_received)
-                goto out;
-
-        xprt_adjust_cwnd(req->rq_xprt, -ETIMEDOUT);
-        __xprt_put_cong(xprt, req);
+        dprintk("RPC: %4d xprt_timer\n", task->tk_pid);
 
-        dprintk("RPC: %4d xprt_timer (%s request)\n",
-                task->tk_pid, req ? "pending" : "backlogged");
-
-        task->tk_status  = -ETIMEDOUT;
-out:
+        spin_lock(&xprt->transport_lock);
+        if (!req->rq_received) {
+                if (xprt->ops->timer)
+                        xprt->ops->timer(task);
+                task->tk_status = -ETIMEDOUT;
+        }
         task->tk_timeout = 0;
         rpc_wake_up_task(task);
-        spin_unlock(&xprt->sock_lock);
+        spin_unlock(&xprt->transport_lock);
 }
 
-/*
- * Place the actual RPC call.
- * We have to copy the iovec because sendmsg fiddles with its contents.
+/**
+ * xprt_prepare_transmit - reserve the transport before sending a request
+ * @task: RPC task about to send a request
+ *
  */
-int
-xprt_prepare_transmit(struct rpc_task *task)
+int xprt_prepare_transmit(struct rpc_task *task)
 {
         struct rpc_rqst *req = task->tk_rqstp;
         struct rpc_xprt *xprt = req->rq_xprt;
@@ -1191,12 +690,12 @@ xprt_prepare_transmit(struct rpc_task *task)
         if (xprt->shutdown)
                 return -EIO;
 
-        spin_lock_bh(&xprt->sock_lock);
+        spin_lock_bh(&xprt->transport_lock);
         if (req->rq_received && !req->rq_bytes_sent) {
                 err = req->rq_received;
                 goto out_unlock;
         }
-        if (!__xprt_lock_write(xprt, task)) {
+        if (!xprt->ops->reserve_xprt(task)) {
                 err = -EAGAIN;
                 goto out_unlock;
         }
@@ -1206,39 +705,42 @@ xprt_prepare_transmit(struct rpc_task *task)
                 goto out_unlock;
         }
 out_unlock:
-        spin_unlock_bh(&xprt->sock_lock);
+        spin_unlock_bh(&xprt->transport_lock);
         return err;
 }
 
 void
-xprt_transmit(struct rpc_task *task)
+xprt_abort_transmit(struct rpc_task *task)
+{
+        struct rpc_xprt *xprt = task->tk_xprt;
+
+        xprt_release_write(xprt, task);
+}
+
+/**
+ * xprt_transmit - send an RPC request on a transport
+ * @task: controlling RPC task
+ *
+ * We have to copy the iovec because sendmsg fiddles with its contents.
+ */
+void xprt_transmit(struct rpc_task *task)
 {
-        struct rpc_clnt *clnt = task->tk_client;
         struct rpc_rqst *req = task->tk_rqstp;
         struct rpc_xprt *xprt = req->rq_xprt;
-        int status, retry = 0;
-
+        int status;
 
         dprintk("RPC: %4d xprt_transmit(%u)\n", task->tk_pid, req->rq_slen);
 
-        /* set up everything as needed. */
-        /* Write the record marker */
-        if (xprt->stream) {
-                u32     *marker = req->rq_svec[0].iov_base;
-
-                *marker = htonl(0x80000000|(req->rq_slen-sizeof(*marker)));
-        }
-
         smp_rmb();
         if (!req->rq_received) {
                 if (list_empty(&req->rq_list)) {
-                        spin_lock_bh(&xprt->sock_lock);
+                        spin_lock_bh(&xprt->transport_lock);
                         /* Update the softirq receive buffer */
                         memcpy(&req->rq_private_buf, &req->rq_rcv_buf,
                                         sizeof(req->rq_private_buf));
                         /* Add request to the receive list */
                         list_add_tail(&req->rq_list, &xprt->recv);
-                        spin_unlock_bh(&xprt->sock_lock);
+                        spin_unlock_bh(&xprt->transport_lock);
                         xprt_reset_majortimeo(req);
                         /* Turn off autodisconnect */
                         del_singleshot_timer_sync(&xprt->timer);
@@ -1246,40 +748,19 @@ xprt_transmit(struct rpc_task *task)
         } else if (!req->rq_bytes_sent)
                 return;
 
-        /* Continue transmitting the packet/record. We must be careful
-         * to cope with writespace callbacks arriving _after_ we have
-         * called xprt_sendmsg().
-         */
-        while (1) {
-                req->rq_xtime = jiffies;
-                status = xprt_sendmsg(xprt, req);
-
-                if (status < 0)
-                        break;
-
-                if (xprt->stream) {
-                        req->rq_bytes_sent += status;
-
-                        /* If we've sent the entire packet, immediately
-                         * reset the count of bytes sent. */
-                        if (req->rq_bytes_sent >= req->rq_slen) {
-                                req->rq_bytes_sent = 0;
-                                goto out_receive;
-                        }
-                } else {
-                        if (status >= req->rq_slen)
-                                goto out_receive;
-                        status = -EAGAIN;
-                        break;
-                }
-
-                dprintk("RPC: %4d xmit incomplete (%d left of %d)\n",
-                                task->tk_pid, req->rq_slen - req->rq_bytes_sent,
-                                req->rq_slen);
-
-                status = -EAGAIN;
-                if (retry++ > 50)
-                        break;
+        status = xprt->ops->send_request(task);
+        if (status == 0) {
+                dprintk("RPC: %4d xmit complete\n", task->tk_pid);
+                spin_lock_bh(&xprt->transport_lock);
+                xprt->ops->set_retrans_timeout(task);
+                /* Don't race with disconnect */
+                if (!xprt_connected(xprt))
+                        task->tk_status = -ENOTCONN;
+                else if (!req->rq_received)
+                        rpc_sleep_on(&xprt->pending, task, NULL, xprt_timer);
+                xprt->ops->release_xprt(xprt, task);
+                spin_unlock_bh(&xprt->transport_lock);
+                return;
         }
 
         /* Note: at this point, task->tk_sleeping has not yet been set,
@@ -1289,60 +770,19 @@ xprt_transmit(struct rpc_task *task)
         task->tk_status = status;
 
         switch (status) {
-        case -EAGAIN:
-                if (test_bit(SOCK_ASYNC_NOSPACE, &xprt->sock->flags)) {
-                        /* Protect against races with xprt_write_space */
-                        spin_lock_bh(&xprt->sock_lock);
-                        /* Don't race with disconnect */
-                        if (!xprt_connected(xprt))
-                                task->tk_status = -ENOTCONN;
-                        else if (test_bit(SOCK_NOSPACE, &xprt->sock->flags)) {
-                                task->tk_timeout = req->rq_timeout;
-                                rpc_sleep_on(&xprt->pending, task, NULL, NULL);
-                        }
-                        spin_unlock_bh(&xprt->sock_lock);
-                        return;
-                }
-                /* Keep holding the socket if it is blocked */
-                rpc_delay(task, HZ>>4);
-                return;
         case -ECONNREFUSED:
-                task->tk_timeout = RPC_REESTABLISH_TIMEOUT;
                 rpc_sleep_on(&xprt->sending, task, NULL, NULL);
+        case -EAGAIN:
         case -ENOTCONN:
                 return;
         default:
-                if (xprt->stream)
-                        xprt_disconnect(xprt);
+                break;
         }
         xprt_release_write(xprt, task);
         return;
- out_receive:
-        dprintk("RPC: %4d xmit complete\n", task->tk_pid);
-        /* Set the task's receive timeout value */
-        spin_lock_bh(&xprt->sock_lock);
-        if (!xprt->nocong) {
-                int timer = task->tk_msg.rpc_proc->p_timer;
-                task->tk_timeout = rpc_calc_rto(clnt->cl_rtt, timer);
-                task->tk_timeout <<= rpc_ntimeo(clnt->cl_rtt, timer) + req->rq_retries;
-                if (task->tk_timeout > xprt->timeout.to_maxval || task->tk_timeout == 0)
-                        task->tk_timeout = xprt->timeout.to_maxval;
-        } else
-                task->tk_timeout = req->rq_timeout;
-        /* Don't race with disconnect */
-        if (!xprt_connected(xprt))
-                task->tk_status = -ENOTCONN;
-        else if (!req->rq_received)
-                rpc_sleep_on(&xprt->pending, task, NULL, xprt_timer);
-        __xprt_release_write(xprt, task);
-        spin_unlock_bh(&xprt->sock_lock);
 }
 
-/*
- * Reserve an RPC call slot.
- */
-static inline void
-do_xprt_reserve(struct rpc_task *task)
+static inline void do_xprt_reserve(struct rpc_task *task)
 {
         struct rpc_xprt *xprt = task->tk_xprt;
 
@@ -1362,22 +802,25 @@ do_xprt_reserve(struct rpc_task *task)
         rpc_sleep_on(&xprt->backlog, task, NULL, NULL);
 }
 
-void
-xprt_reserve(struct rpc_task *task)
+/**
+ * xprt_reserve - allocate an RPC request slot
+ * @task: RPC task requesting a slot allocation
+ *
+ * If no more slots are available, place the task on the transport's
+ * backlog queue.
+ */
+void xprt_reserve(struct rpc_task *task)
 {
         struct rpc_xprt *xprt = task->tk_xprt;
 
         task->tk_status = -EIO;
         if (!xprt->shutdown) {
-                spin_lock(&xprt->xprt_lock);
+                spin_lock(&xprt->reserve_lock);
                 do_xprt_reserve(task);
-                spin_unlock(&xprt->xprt_lock);
+                spin_unlock(&xprt->reserve_lock);
         }
 }
 
-/*
- * Allocate a 'unique' XID
- */
 static inline u32 xprt_alloc_xid(struct rpc_xprt *xprt)
 {
         return xprt->xid++;
@@ -1388,11 +831,7 @@ static inline void xprt_init_xid(struct rpc_xprt *xprt)
         get_random_bytes(&xprt->xid, sizeof(xprt->xid));
 }
 
-/*
- * Initialize RPC request
- */
-static void
-xprt_request_init(struct rpc_task *task, struct rpc_xprt *xprt)
+static void xprt_request_init(struct rpc_task *task, struct rpc_xprt *xprt)
 {
         struct rpc_rqst *req = task->tk_rqstp;
 
@@ -1400,128 +839,104 @@ xprt_request_init(struct rpc_task *task, struct rpc_xprt *xprt)
         req->rq_task    = task;
         req->rq_xprt    = xprt;
         req->rq_xid     = xprt_alloc_xid(xprt);
+        req->rq_release_snd_buf = NULL;
         dprintk("RPC: %4d reserved req %p xid %08x\n", task->tk_pid,
                         req, ntohl(req->rq_xid));
 }
 
-/*
- * Release an RPC call slot
+/**
+ * xprt_release - release an RPC request slot
+ * @task: task which is finished with the slot
+ *
  */
-void
-xprt_release(struct rpc_task *task)
+void xprt_release(struct rpc_task *task)
 {
         struct rpc_xprt *xprt = task->tk_xprt;
         struct rpc_rqst *req;
 
         if (!(req = task->tk_rqstp))
                 return;
-        spin_lock_bh(&xprt->sock_lock);
-        __xprt_release_write(xprt, task);
-        __xprt_put_cong(xprt, req);
+        spin_lock_bh(&xprt->transport_lock);
+        xprt->ops->release_xprt(xprt, task);
+        if (xprt->ops->release_request)
+                xprt->ops->release_request(task);
         if (!list_empty(&req->rq_list))
                 list_del(&req->rq_list);
         xprt->last_used = jiffies;
         if (list_empty(&xprt->recv) && !xprt->shutdown)
-                mod_timer(&xprt->timer, xprt->last_used + XPRT_IDLE_TIMEOUT);
-        spin_unlock_bh(&xprt->sock_lock);
+                mod_timer(&xprt->timer,
+                                xprt->last_used + xprt->idle_timeout);
+        spin_unlock_bh(&xprt->transport_lock);
         task->tk_rqstp = NULL;
+        if (req->rq_release_snd_buf)
+                req->rq_release_snd_buf(req);
         memset(req, 0, sizeof(*req));   /* mark unused */
 
         dprintk("RPC: %4d release request %p\n", task->tk_pid, req);
 
-        spin_lock(&xprt->xprt_lock);
+        spin_lock(&xprt->reserve_lock);
         list_add(&req->rq_list, &xprt->free);
-        xprt_clear_backlog(xprt);
-        spin_unlock(&xprt->xprt_lock);
-}
-
-/*
- * Set default timeout parameters
- */
-static void
-xprt_default_timeout(struct rpc_timeout *to, int proto)
-{
-        if (proto == IPPROTO_UDP)
-                xprt_set_timeout(to, 5,  5 * HZ);
-        else
-                xprt_set_timeout(to, 5, 60 * HZ);
+        rpc_wake_up_next(&xprt->backlog);
+        spin_unlock(&xprt->reserve_lock);
 }
 
-/*
- * Set constant timeout
+/**
+ * xprt_set_timeout - set constant RPC timeout
+ * @to: RPC timeout parameters to set up
+ * @retr: number of retries
+ * @incr: amount of increase after each retry
+ *
  */
-void
-xprt_set_timeout(struct rpc_timeout *to, unsigned int retr, unsigned long incr)
+void xprt_set_timeout(struct rpc_timeout *to, unsigned int retr, unsigned long incr)
 {
         to->to_initval   = 
         to->to_increment = incr;
-        to->to_maxval    = incr * retr;
+        to->to_maxval    = to->to_initval + (incr * retr);
         to->to_retries   = retr;
         to->to_exponential = 0;
 }
 
-unsigned int xprt_udp_slot_table_entries = RPC_DEF_SLOT_TABLE;
-unsigned int xprt_tcp_slot_table_entries = RPC_DEF_SLOT_TABLE;
-
-/*
- * Initialize an RPC client
- */
-static struct rpc_xprt *
-xprt_setup(int proto, struct sockaddr_in *ap, struct rpc_timeout *to)
+static struct rpc_xprt *xprt_setup(int proto, struct sockaddr_in *ap, struct rpc_timeout *to)
 {
+        int result;
         struct rpc_xprt *xprt;
-        unsigned int entries;
-        size_t slot_table_size;
         struct rpc_rqst *req;
 
-        dprintk("RPC:      setting up %s transport...\n",
-                                proto == IPPROTO_UDP? "UDP" : "TCP");
-
-        entries = (proto == IPPROTO_TCP)?
-                xprt_tcp_slot_table_entries : xprt_udp_slot_table_entries;
-
         if ((xprt = kmalloc(sizeof(struct rpc_xprt), GFP_KERNEL)) == NULL)
                 return ERR_PTR(-ENOMEM);
         memset(xprt, 0, sizeof(*xprt)); /* Nnnngh! */
-        xprt->max_reqs = entries;
-        slot_table_size = entries * sizeof(xprt->slot[0]);
-        xprt->slot = kmalloc(slot_table_size, GFP_KERNEL);
-        if (xprt->slot == NULL) {
-                kfree(xprt);
-                return ERR_PTR(-ENOMEM);
-        }
-        memset(xprt->slot, 0, slot_table_size);
 
         xprt->addr = *ap;
-        xprt->prot = proto;
-        xprt->stream = (proto == IPPROTO_TCP)? 1 : 0;
-        if (xprt->stream) {
-                xprt->cwnd = RPC_MAXCWND(xprt);
-                xprt->nocong = 1;
-                xprt->max_payload = (1U << 31) - 1;
-        } else {
-                xprt->cwnd = RPC_INITCWND;
-                xprt->max_payload = (1U << 16) - (MAX_HEADER << 3);
+
+        switch (proto) {
+        case IPPROTO_UDP:
+                result = xs_setup_udp(xprt, to);
+                break;
+        case IPPROTO_TCP:
+                result = xs_setup_tcp(xprt, to);
+                break;
+        default:
+                printk(KERN_ERR "RPC: unrecognized transport protocol: %d\n",
+                                proto);
+                result = -EIO;
+                break;
+        }
+        if (result) {
+                kfree(xprt);
+                return ERR_PTR(result);
         }
-        spin_lock_init(&xprt->sock_lock);
-        spin_lock_init(&xprt->xprt_lock);
-        init_waitqueue_head(&xprt->cong_wait);
+
+        spin_lock_init(&xprt->transport_lock);
+        spin_lock_init(&xprt->reserve_lock);
 
         INIT_LIST_HEAD(&xprt->free);
         INIT_LIST_HEAD(&xprt->recv);
-        INIT_WORK(&xprt->sock_connect, xprt_socket_connect, xprt);
-        INIT_WORK(&xprt->task_cleanup, xprt_socket_autoclose, xprt);
+        INIT_WORK(&xprt->task_cleanup, xprt_autoclose, xprt);
         init_timer(&xprt->timer);
         xprt->timer.function = xprt_init_autodisconnect;
         xprt->timer.data = (unsigned long) xprt;
         xprt->last_used = jiffies;
-        xprt->port = XPRT_MAX_RESVPORT;
-
-        /* Set timeout parameters */
-        if (to) {
-                xprt->timeout = *to;
-        } else
-                xprt_default_timeout(&xprt->timeout, xprt->prot);
+        xprt->cwnd = RPC_INITCWND;
 
         rpc_init_wait_queue(&xprt->pending, "xprt_pending");
         rpc_init_wait_queue(&xprt->sending, "xprt_sending");
@@ -1529,139 +944,25 @@ xprt_setup(int proto, struct sockaddr_in *ap, struct rpc_timeout *to)
         rpc_init_priority_wait_queue(&xprt->backlog, "xprt_backlog");
 
         /* initialize free list */
-        for (req = &xprt->slot[entries-1]; req >= &xprt->slot[0]; req--)
+        for (req = &xprt->slot[xprt->max_reqs-1]; req >= &xprt->slot[0]; req--)
                 list_add(&req->rq_list, &xprt->free);
 
         xprt_init_xid(xprt);
 
-        /* Check whether we want to use a reserved port */
-        xprt->resvport = capable(CAP_NET_BIND_SERVICE) ? 1 : 0;
-
         dprintk("RPC:      created transport %p with %u slots\n", xprt,
                         xprt->max_reqs);
         
         return xprt;
 }
 
-/*
- * Bind to a reserved port
- */
-static inline int xprt_bindresvport(struct rpc_xprt *xprt, struct socket *sock)
-{
-        struct sockaddr_in myaddr = {
-                .sin_family = AF_INET,
-        };
-        int             err, port;
-
-        /* Were we already bound to a given port? Try to reuse it */
-        port = xprt->port;
-        do {
-                myaddr.sin_port = htons(port);
-                err = sock->ops->bind(sock, (struct sockaddr *) &myaddr,
-                                                sizeof(myaddr));
-                if (err == 0) {
-                        xprt->port = port;
-                        return 0;
-                }
-                if (--port == 0)
-                        port = XPRT_MAX_RESVPORT;
-        } while (err == -EADDRINUSE && port != xprt->port);
-
-        printk("RPC: Can't bind to reserved port (%d).\n", -err);
-        return err;
-}
-
-static void
-xprt_bind_socket(struct rpc_xprt *xprt, struct socket *sock)
-{
-        struct sock     *sk = sock->sk;
-
-        if (xprt->inet)
-                return;
-
-        write_lock_bh(&sk->sk_callback_lock);
-        sk->sk_user_data = xprt;
-        xprt->old_data_ready = sk->sk_data_ready;
-        xprt->old_state_change = sk->sk_state_change;
-        xprt->old_write_space = sk->sk_write_space;
-        if (xprt->prot == IPPROTO_UDP) {
-                sk->sk_data_ready = udp_data_ready;
-                sk->sk_no_check = UDP_CSUM_NORCV;
-                xprt_set_connected(xprt);
-        } else {
-                tcp_sk(sk)->nonagle = 1;        /* disable Nagle's algorithm */
-                sk->sk_data_ready = tcp_data_ready;
-                sk->sk_state_change = tcp_state_change;
-                xprt_clear_connected(xprt);
-        }
-        sk->sk_write_space = xprt_write_space;
-
-        /* Reset to new socket */
-        xprt->sock = sock;
-        xprt->inet = sk;
-        write_unlock_bh(&sk->sk_callback_lock);
-
-        return;
-}
-
-/*
- * Set socket buffer length
- */
-void
-xprt_sock_setbufsize(struct rpc_xprt *xprt)
-{
-        struct sock *sk = xprt->inet;
-
-        if (xprt->stream)
-                return;
-        if (xprt->rcvsize) {
-                sk->sk_userlocks |= SOCK_RCVBUF_LOCK;
-                sk->sk_rcvbuf = xprt->rcvsize * xprt->max_reqs *  2;
-        }
-        if (xprt->sndsize) {
-                sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
-                sk->sk_sndbuf = xprt->sndsize * xprt->max_reqs * 2;
-                sk->sk_write_space(sk);
-        }
-}
-
-/*
- * Datastream sockets are created here, but xprt_connect will create
- * and connect stream sockets.
- */
-static struct socket * xprt_create_socket(struct rpc_xprt *xprt, int proto, int resvport)
-{
-        struct socket   *sock;
-        int             type, err;
-
-        dprintk("RPC:      xprt_create_socket(%s %d)\n",
-                           (proto == IPPROTO_UDP)? "udp" : "tcp", proto);
-
-        type = (proto == IPPROTO_UDP)? SOCK_DGRAM : SOCK_STREAM;
-
-        if ((err = sock_create_kern(PF_INET, type, proto, &sock)) < 0) {
-                printk("RPC: can't create socket (%d).\n", -err);
-                return NULL;
-        }
-
-        /* If the caller has the capability, bind to a reserved port */
-        if (resvport && xprt_bindresvport(xprt, sock) < 0) {
-                printk("RPC: can't bind to reserved port.\n");
-                goto failed;
-        }
-
-        return sock;
-
-failed:
-        sock_release(sock);
-        return NULL;
-}
-
-/*
- * Create an RPC client transport given the protocol and peer address.
+/**
+ * xprt_create_proto - create an RPC client transport
+ * @proto: requested transport protocol
+ * @sap: remote peer's address
+ * @to: timeout parameters for new transport
+ *
  */
-struct rpc_xprt *
-xprt_create_proto(int proto, struct sockaddr_in *sap, struct rpc_timeout *to)
+struct rpc_xprt *xprt_create_proto(int proto, struct sockaddr_in *sap, struct rpc_timeout *to)
 {
         struct rpc_xprt *xprt;
 
@@ -1673,46 +974,26 @@ xprt_create_proto(int proto, struct sockaddr_in *sap, struct rpc_timeout *to)
         return xprt;
 }
 
-/*
- * Prepare for transport shutdown.
- */
-static void
-xprt_shutdown(struct rpc_xprt *xprt)
+static void xprt_shutdown(struct rpc_xprt *xprt)
 {
         xprt->shutdown = 1;
         rpc_wake_up(&xprt->sending);
         rpc_wake_up(&xprt->resend);
-        rpc_wake_up(&xprt->pending);
+        xprt_wake_pending_tasks(xprt, -EIO);
         rpc_wake_up(&xprt->backlog);
-        wake_up(&xprt->cong_wait);
         del_timer_sync(&xprt->timer);
-
-        /* synchronously wait for connect worker to finish */
-        cancel_delayed_work(&xprt->sock_connect);
-        flush_scheduled_work();
 }
 
-/*
- * Clear the xprt backlog queue
- */
-static int
-xprt_clear_backlog(struct rpc_xprt *xprt) {
-        rpc_wake_up_next(&xprt->backlog);
-        wake_up(&xprt->cong_wait);
-        return 1;
-}
-
-/*
- * Destroy an RPC transport, killing off all requests.
+/**
+ * xprt_destroy - destroy an RPC transport, killing off all requests.
+ * @xprt: transport to destroy
+ *
  */
-int
-xprt_destroy(struct rpc_xprt *xprt)
+int xprt_destroy(struct rpc_xprt *xprt)
 {
         dprintk("RPC:      destroying transport %p\n", xprt);
         xprt_shutdown(xprt);
-        xprt_disconnect(xprt);
-        xprt_close(xprt);
-        kfree(xprt->slot);
+        xprt->ops->destroy(xprt);
         kfree(xprt);
 
         return 0;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
new file mode 100644
index 000000000000..2e1529217e65
--- /dev/null
+++ b/net/sunrpc/xprtsock.c
@@ -0,0 +1,1252 @@
+/*
+ * linux/net/sunrpc/xprtsock.c
+ *
+ * Client-side transport implementation for sockets.
+ *
+ * TCP callback races fixes (C) 1998 Red Hat Software <alan@redhat.com>
+ * TCP send fixes (C) 1998 Red Hat Software <alan@redhat.com>
+ * TCP NFS related read + write fixes
+ *  (C) 1999 Dave Airlie, University of Limerick, Ireland <airlied@linux.ie>
+ *
+ * Rewrite of larges part of the code in order to stabilize TCP stuff.
+ * Fix behaviour when socket buffer is full.
+ *  (C) 1999 Trond Myklebust <trond.myklebust@fys.uio.no>
+ *
+ * IP socket transport implementation, (C) 2005 Chuck Lever <cel@netapp.com>
+ */
+
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/capability.h>
+#include <linux/sched.h>
+#include <linux/pagemap.h>
+#include <linux/errno.h>
+#include <linux/socket.h>
+#include <linux/in.h>
+#include <linux/net.h>
+#include <linux/mm.h>
+#include <linux/udp.h>
+#include <linux/tcp.h>
+#include <linux/sunrpc/clnt.h>
+#include <linux/file.h>
+
+#include <net/sock.h>
+#include <net/checksum.h>
+#include <net/udp.h>
+#include <net/tcp.h>
+
+/*
+ * How many times to try sending a request on a socket before waiting
+ * for the socket buffer to clear.
+ */
+#define XS_SENDMSG_RETRY        (10U)
+
+/*
+ * Time out for an RPC UDP socket connect.  UDP socket connects are
+ * synchronous, but we set a timeout anyway in case of resource
+ * exhaustion on the local host.
+ */
+#define XS_UDP_CONN_TO          (5U * HZ)
+
+/*
+ * Wait duration for an RPC TCP connection to be established.  Solaris
+ * NFS over TCP uses 60 seconds, for example, which is in line with how
+ * long a server takes to reboot.
+ */
+#define XS_TCP_CONN_TO          (60U * HZ)
+
+/*
+ * Wait duration for a reply from the RPC portmapper.
+ */
+#define XS_BIND_TO              (60U * HZ)
+
+/*
+ * Delay if a UDP socket connect error occurs.  This is most likely some
+ * kind of resource problem on the local host.
+ */
+#define XS_UDP_REEST_TO         (2U * HZ)
+
+/*
+ * The reestablish timeout allows clients to delay for a bit before attempting
+ * to reconnect to a server that just dropped our connection.
+ *
+ * We implement an exponential backoff when trying to reestablish a TCP
+ * transport connection with the server.  Some servers like to drop a TCP
+ * connection when they are overworked, so we start with a short timeout and
+ * increase over time if the server is down or not responding.
+ */
+#define XS_TCP_INIT_REEST_TO    (3U * HZ)
+#define XS_TCP_MAX_REEST_TO     (5U * 60 * HZ)
+
+/*
+ * TCP idle timeout; client drops the transport socket if it is idle
+ * for this long.  Note that we also timeout UDP sockets to prevent
+ * holding port numbers when there is no RPC traffic.
+ */
+#define XS_IDLE_DISC_TO         (5U * 60 * HZ)
+
+#ifdef RPC_DEBUG
+# undef  RPC_DEBUG_DATA
+# define RPCDBG_FACILITY        RPCDBG_TRANS
+#endif
+
+#ifdef RPC_DEBUG_DATA
+static void xs_pktdump(char *msg, u32 *packet, unsigned int count)
+{
+        u8 *buf = (u8 *) packet;
+        int j;
+
+        dprintk("RPC:      %s\n", msg);
+        for (j = 0; j < count && j < 128; j += 4) {
+                if (!(j & 31)) {
+                        if (j)
+                                dprintk("\n");
+                        dprintk("0x%04x ", j);
+                }
+                dprintk("%02x%02x%02x%02x ",
+                        buf[j], buf[j+1], buf[j+2], buf[j+3]);
+        }
+        dprintk("\n");
+}
+#else
+static inline void xs_pktdump(char *msg, u32 *packet, unsigned int count)
+{
+        /* NOP */
+}
+#endif
+
+#define XS_SENDMSG_FLAGS        (MSG_DONTWAIT | MSG_NOSIGNAL)
+
+static inline int xs_send_head(struct socket *sock, struct sockaddr *addr, int addrlen, struct xdr_buf *xdr, unsigned int base, unsigned int len)
+{
+        struct kvec iov = {
+                .iov_base       = xdr->head[0].iov_base + base,
+                .iov_len        = len - base,
+        };
+        struct msghdr msg = {
+                .msg_name       = addr,
+                .msg_namelen    = addrlen,
+                .msg_flags      = XS_SENDMSG_FLAGS,
+        };
+
+        if (xdr->len > len)
+                msg.msg_flags |= MSG_MORE;
+
+        if (likely(iov.iov_len))
+                return kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len);
+        return kernel_sendmsg(sock, &msg, NULL, 0, 0);
+}
+
+static int xs_send_tail(struct socket *sock, struct xdr_buf *xdr, unsigned int base, unsigned int len)
+{
+        struct kvec iov = {
+                .iov_base       = xdr->tail[0].iov_base + base,
+                .iov_len        = len - base,
+        };
+        struct msghdr msg = {
+                .msg_flags      = XS_SENDMSG_FLAGS,
+        };
+
+        return kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len);
+}
+
+/**
+ * xs_sendpages - write pages directly to a socket
+ * @sock: socket to send on
+ * @addr: UDP only -- address of destination
+ * @addrlen: UDP only -- length of destination address
+ * @xdr: buffer containing this request
+ * @base: starting position in the buffer
+ *
+ */
+static inline int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen, struct xdr_buf *xdr, unsigned int base)
+{
+        struct page **ppage = xdr->pages;
+        unsigned int len, pglen = xdr->page_len;
+        int err, ret = 0;
+        ssize_t (*sendpage)(struct socket *, struct page *, int, size_t, int);
+
+        if (unlikely(!sock))
+                return -ENOTCONN;
+
+        clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags);
+
+        len = xdr->head[0].iov_len;
+        if (base < len || (addr != NULL && base == 0)) {
+                err = xs_send_head(sock, addr, addrlen, xdr, base, len);
+                if (ret == 0)
+                        ret = err;
+                else if (err > 0)
+                        ret += err;
+                if (err != (len - base))
+                        goto out;
+                base = 0;
+        } else
+                base -= len;
+
+        if (unlikely(pglen == 0))
+                goto copy_tail;
+        if (unlikely(base >= pglen)) {
+                base -= pglen;
+                goto copy_tail;
+        }
+        if (base || xdr->page_base) {
+                pglen -= base;
+                base += xdr->page_base;
+                ppage += base >> PAGE_CACHE_SHIFT;
+                base &= ~PAGE_CACHE_MASK;
+        }
+
+        sendpage = sock->ops->sendpage ? : sock_no_sendpage;
+        do {
+                int flags = XS_SENDMSG_FLAGS;
+
+                len = PAGE_CACHE_SIZE;
+                if (base)
+                        len -= base;
+                if (pglen < len)
+                        len = pglen;
+
+                if (pglen != len || xdr->tail[0].iov_len != 0)
+                        flags |= MSG_MORE;
+
+                /* Hmm... We might be dealing with highmem pages */
+                if (PageHighMem(*ppage))
+                        sendpage = sock_no_sendpage;
+                err = sendpage(sock, *ppage, base, len, flags);
+                if (ret == 0)
+                        ret = err;
+                else if (err > 0)
+                        ret += err;
+                if (err != len)
+                        goto out;
+                base = 0;
+                ppage++;
+        } while ((pglen -= len) != 0);
+copy_tail:
+        len = xdr->tail[0].iov_len;
+        if (base < len) {
+                err = xs_send_tail(sock, xdr, base, len);
+                if (ret == 0)
+                        ret = err;
+                else if (err > 0)
+                        ret += err;
+        }
+out:
+        return ret;
+}
+
+/**
+ * xs_nospace - place task on wait queue if transmit was incomplete
+ * @task: task to put to sleep
+ *
+ */
+static void xs_nospace(struct rpc_task *task)
+{
+        struct rpc_rqst *req = task->tk_rqstp;
+        struct rpc_xprt *xprt = req->rq_xprt;
+
+        dprintk("RPC: %4d xmit incomplete (%u left of %u)\n",
+                        task->tk_pid, req->rq_slen - req->rq_bytes_sent,
+                        req->rq_slen);
+
+        if (test_bit(SOCK_ASYNC_NOSPACE, &xprt->sock->flags)) {
+                /* Protect against races with write_space */
+                spin_lock_bh(&xprt->transport_lock);
+
+                /* Don't race with disconnect */
+                if (!xprt_connected(xprt))
+                        task->tk_status = -ENOTCONN;
+                else if (test_bit(SOCK_NOSPACE, &xprt->sock->flags))
+                        xprt_wait_for_buffer_space(task);
+
+                spin_unlock_bh(&xprt->transport_lock);
+        } else
+                /* Keep holding the socket if it is blocked */
+                rpc_delay(task, HZ>>4);
+}
+
+/**
+ * xs_udp_send_request - write an RPC request to a UDP socket
+ * @task: address of RPC task that manages the state of an RPC request
+ *
+ * Return values:
+ *        0:    The request has been sent
+ *   EAGAIN:    The socket was blocked, please call again later to
+ *              complete the request
+ * ENOTCONN:    Caller needs to invoke connect logic then call again
+ *    other:    Some other error occured, the request was not sent
+ */
+static int xs_udp_send_request(struct rpc_task *task)
+{
+        struct rpc_rqst *req = task->tk_rqstp;
+        struct rpc_xprt *xprt = req->rq_xprt;
+        struct xdr_buf *xdr = &req->rq_snd_buf;
+        int status;
+
+        xs_pktdump("packet data:",
+                                req->rq_svec->iov_base,
+                                req->rq_svec->iov_len);
+
+        req->rq_xtime = jiffies;
+        status = xs_sendpages(xprt->sock, (struct sockaddr *) &xprt->addr,
+                                sizeof(xprt->addr), xdr, req->rq_bytes_sent);
+
+        dprintk("RPC:      xs_udp_send_request(%u) = %d\n",
+                        xdr->len - req->rq_bytes_sent, status);
+
+        if (likely(status >= (int) req->rq_slen))
+                return 0;
+
+        /* Still some bytes left; set up for a retry later. */
+        if (status > 0)
+                status = -EAGAIN;
+
+        switch (status) {
+        case -ENETUNREACH:
+        case -EPIPE:
+        case -ECONNREFUSED:
+                /* When the server has died, an ICMP port unreachable message
+                 * prompts ECONNREFUSED. */
+                break;
+        case -EAGAIN:
+                xs_nospace(task);
+                break;
+        default:
+                dprintk("RPC:      sendmsg returned unrecognized error %d\n",
+                        -status);
+                break;
+        }
+
+        return status;
+}
+
+static inline void xs_encode_tcp_record_marker(struct xdr_buf *buf)
+{
+        u32 reclen = buf->len - sizeof(rpc_fraghdr);
+        rpc_fraghdr *base = buf->head[0].iov_base;
+        *base = htonl(RPC_LAST_STREAM_FRAGMENT | reclen);
+}
+
+/**
+ * xs_tcp_send_request - write an RPC request to a TCP socket
+ * @task: address of RPC task that manages the state of an RPC request
+ *
+ * Return values:
+ *        0:    The request has been sent
+ *   EAGAIN:    The socket was blocked, please call again later to
+ *              complete the request
+ * ENOTCONN:    Caller needs to invoke connect logic then call again
+ *    other:    Some other error occured, the request was not sent
+ *
+ * XXX: In the case of soft timeouts, should we eventually give up
+ *      if sendmsg is not able to make progress?
+ */
+static int xs_tcp_send_request(struct rpc_task *task)
+{
+        struct rpc_rqst *req = task->tk_rqstp;
+        struct rpc_xprt *xprt = req->rq_xprt;
+        struct xdr_buf *xdr = &req->rq_snd_buf;
+        int status, retry = 0;
+
+        xs_encode_tcp_record_marker(&req->rq_snd_buf);
+
+        xs_pktdump("packet data:",
+                                req->rq_svec->iov_base,
+                                req->rq_svec->iov_len);
+
+        /* Continue transmitting the packet/record. We must be careful
+         * to cope with writespace callbacks arriving _after_ we have
+         * called sendmsg(). */
+        while (1) {
+                req->rq_xtime = jiffies;
+                status = xs_sendpages(xprt->sock, NULL, 0, xdr,
+                                                req->rq_bytes_sent);
+
+                dprintk("RPC:      xs_tcp_send_request(%u) = %d\n",
+                                xdr->len - req->rq_bytes_sent, status);
+
+                if (unlikely(status < 0))
+                        break;
+
+                /* If we've sent the entire packet, immediately
+                 * reset the count of bytes sent. */
+                req->rq_bytes_sent += status;
+                if (likely(req->rq_bytes_sent >= req->rq_slen)) {
+                        req->rq_bytes_sent = 0;
+                        return 0;
+                }
+
+                status = -EAGAIN;
+                if (retry++ > XS_SENDMSG_RETRY)
+                        break;
+        }
+
+        switch (status) {
+        case -EAGAIN:
+                xs_nospace(task);
+                break;
+        case -ECONNREFUSED:
+        case -ECONNRESET:
+        case -ENOTCONN:
+        case -EPIPE:
+                status = -ENOTCONN;
+                break;
+        default:
+                dprintk("RPC:      sendmsg returned unrecognized error %d\n",
+                        -status);
+                xprt_disconnect(xprt);
+                break;
+        }
+
+        return status;
+}
+
+/**
+ * xs_close - close a socket
+ * @xprt: transport
+ *
+ * This is used when all requests are complete; ie, no DRC state remains
+ * on the server we want to save.
+ */
+static void xs_close(struct rpc_xprt *xprt)
+{
+        struct socket *sock = xprt->sock;
+        struct sock *sk = xprt->inet;
+
+        if (!sk)
+                return;
+
+        dprintk("RPC:      xs_close xprt %p\n", xprt);
+
+        write_lock_bh(&sk->sk_callback_lock);
+        xprt->inet = NULL;
+        xprt->sock = NULL;
+
+        sk->sk_user_data = NULL;
+        sk->sk_data_ready = xprt->old_data_ready;
+        sk->sk_state_change = xprt->old_state_change;
+        sk->sk_write_space = xprt->old_write_space;
+        write_unlock_bh(&sk->sk_callback_lock);
+
+        sk->sk_no_check = 0;
+
+        sock_release(sock);
+}
+
+/**
+ * xs_destroy - prepare to shutdown a transport
+ * @xprt: doomed transport
+ *
+ */
+static void xs_destroy(struct rpc_xprt *xprt)
+{
+        dprintk("RPC:      xs_destroy xprt %p\n", xprt);
+
+        cancel_delayed_work(&xprt->connect_worker);
+        flush_scheduled_work();
+
+        xprt_disconnect(xprt);
+        xs_close(xprt);
+        kfree(xprt->slot);
+}
+
+static inline struct rpc_xprt *xprt_from_sock(struct sock *sk)
+{
+        return (struct rpc_xprt *) sk->sk_user_data;
+}
+
+/**
+ * xs_udp_data_ready - "data ready" callback for UDP sockets
+ * @sk: socket with data to read
+ * @len: how much data to read
+ *
+ */
+static void xs_udp_data_ready(struct sock *sk, int len)
+{
+        struct rpc_task *task;
+        struct rpc_xprt *xprt;
+        struct rpc_rqst *rovr;
+        struct sk_buff *skb;
+        int err, repsize, copied;
+        u32 _xid, *xp;
+
+        read_lock(&sk->sk_callback_lock);
+        dprintk("RPC:      xs_udp_data_ready...\n");
+        if (!(xprt = xprt_from_sock(sk)))
+                goto out;
+
+        if ((skb = skb_recv_datagram(sk, 0, 1, &err)) == NULL)
+                goto out;
+
+        if (xprt->shutdown)
+                goto dropit;
+
+        repsize = skb->len - sizeof(struct udphdr);
+        if (repsize < 4) {
+                dprintk("RPC:      impossible RPC reply size %d!\n", repsize);
+                goto dropit;
+        }
+
+        /* Copy the XID from the skb... */
+        xp = skb_header_pointer(skb, sizeof(struct udphdr),
+                                sizeof(_xid), &_xid);
+        if (xp == NULL)
+                goto dropit;
+
+        /* Look up and lock the request corresponding to the given XID */
+        spin_lock(&xprt->transport_lock);
+        rovr = xprt_lookup_rqst(xprt, *xp);
+        if (!rovr)
+                goto out_unlock;
+        task = rovr->rq_task;
+
+        if ((copied = rovr->rq_private_buf.buflen) > repsize)
+                copied = repsize;
+
+        /* Suck it into the iovec, verify checksum if not done by hw. */
+        if (csum_partial_copy_to_xdr(&rovr->rq_private_buf, skb))
+                goto out_unlock;
+
+        /* Something worked... */
+        dst_confirm(skb->dst);
+
+        xprt_adjust_cwnd(task, copied);
+        xprt_update_rtt(task);
+        xprt_complete_rqst(task, copied);
+
+ out_unlock:
+        spin_unlock(&xprt->transport_lock);
+ dropit:
+        skb_free_datagram(sk, skb);
+ out:
+        read_unlock(&sk->sk_callback_lock);
+}
+
+static inline size_t xs_tcp_copy_data(skb_reader_t *desc, void *p, size_t len)
+{
+        if (len > desc->count)
+                len = desc->count;
+        if (skb_copy_bits(desc->skb, desc->offset, p, len)) {
+                dprintk("RPC:      failed to copy %zu bytes from skb. %zu bytes remain\n",
+                                len, desc->count);
+                return 0;
+        }
+        desc->offset += len;
+        desc->count -= len;
+        dprintk("RPC:      copied %zu bytes from skb. %zu bytes remain\n",
+                        len, desc->count);
+        return len;
+}
+
+static inline void xs_tcp_read_fraghdr(struct rpc_xprt *xprt, skb_reader_t *desc)
+{
+        size_t len, used;
+        char *p;
+
+        p = ((char *) &xprt->tcp_recm) + xprt->tcp_offset;
+        len = sizeof(xprt->tcp_recm) - xprt->tcp_offset;
+        used = xs_tcp_copy_data(desc, p, len);
+        xprt->tcp_offset += used;
+        if (used != len)
+                return;
+
+        xprt->tcp_reclen = ntohl(xprt->tcp_recm);
+        if (xprt->tcp_reclen & RPC_LAST_STREAM_FRAGMENT)
+                xprt->tcp_flags |= XPRT_LAST_FRAG;
+        else
+                xprt->tcp_flags &= ~XPRT_LAST_FRAG;
+        xprt->tcp_reclen &= RPC_FRAGMENT_SIZE_MASK;
+
+        xprt->tcp_flags &= ~XPRT_COPY_RECM;
+        xprt->tcp_offset = 0;
+
+        /* Sanity check of the record length */
+        if (unlikely(xprt->tcp_reclen < 4)) {
+                dprintk("RPC:      invalid TCP record fragment length\n");
+                xprt_disconnect(xprt);
+                return;
+        }
+        dprintk("RPC:      reading TCP record fragment of length %d\n",
+                        xprt->tcp_reclen);
+}
+
+static void xs_tcp_check_recm(struct rpc_xprt *xprt)
+{
+        dprintk("RPC:      xprt = %p, tcp_copied = %lu, tcp_offset = %u, tcp_reclen = %u, tcp_flags = %lx\n",
+                        xprt, xprt->tcp_copied, xprt->tcp_offset, xprt->tcp_reclen, xprt->tcp_flags);
+        if (xprt->tcp_offset == xprt->tcp_reclen) {
+                xprt->tcp_flags |= XPRT_COPY_RECM;
+                xprt->tcp_offset = 0;
+                if (xprt->tcp_flags & XPRT_LAST_FRAG) {
+                        xprt->tcp_flags &= ~XPRT_COPY_DATA;
+                        xprt->tcp_flags |= XPRT_COPY_XID;
+                        xprt->tcp_copied = 0;
+                }
+        }
+}
+
+static inline void xs_tcp_read_xid(struct rpc_xprt *xprt, skb_reader_t *desc)
+{
+        size_t len, used;
+        char *p;
+
+        len = sizeof(xprt->tcp_xid) - xprt->tcp_offset;
+        dprintk("RPC:      reading XID (%Zu bytes)\n", len);
+        p = ((char *) &xprt->tcp_xid) + xprt->tcp_offset;
+        used = xs_tcp_copy_data(desc, p, len);
+        xprt->tcp_offset += used;
+        if (used != len)
+                return;
+        xprt->tcp_flags &= ~XPRT_COPY_XID;
+        xprt->tcp_flags |= XPRT_COPY_DATA;
+        xprt->tcp_copied = 4;
+        dprintk("RPC:      reading reply for XID %08x\n",
+                                                ntohl(xprt->tcp_xid));
+        xs_tcp_check_recm(xprt);
+}
+
+static inline void xs_tcp_read_request(struct rpc_xprt *xprt, skb_reader_t *desc)
+{
+        struct rpc_rqst *req;
+        struct xdr_buf *rcvbuf;
+        size_t len;
+        ssize_t r;
+
+        /* Find and lock the request corresponding to this xid */
+        spin_lock(&xprt->transport_lock);
+        req = xprt_lookup_rqst(xprt, xprt->tcp_xid);
+        if (!req) {
+                xprt->tcp_flags &= ~XPRT_COPY_DATA;
+                dprintk("RPC:      XID %08x request not found!\n",
+                                ntohl(xprt->tcp_xid));
+                spin_unlock(&xprt->transport_lock);
+                return;
+        }
+
+        rcvbuf = &req->rq_private_buf;
+        len = desc->count;
+        if (len > xprt->tcp_reclen - xprt->tcp_offset) {
+                skb_reader_t my_desc;
+
+                len = xprt->tcp_reclen - xprt->tcp_offset;
+                memcpy(&my_desc, desc, sizeof(my_desc));
+                my_desc.count = len;
+                r = xdr_partial_copy_from_skb(rcvbuf, xprt->tcp_copied,
+                                          &my_desc, xs_tcp_copy_data);
+                desc->count -= r;
+                desc->offset += r;
+        } else
+                r = xdr_partial_copy_from_skb(rcvbuf, xprt->tcp_copied,
+                                          desc, xs_tcp_copy_data);
+
+        if (r > 0) {
+                xprt->tcp_copied += r;
+                xprt->tcp_offset += r;
+        }
+        if (r != len) {
+                /* Error when copying to the receive buffer,
+                 * usually because we weren't able to allocate
+                 * additional buffer pages. All we can do now
+                 * is turn off XPRT_COPY_DATA, so the request
+                 * will not receive any additional updates,
+                 * and time out.
+                 * Any remaining data from this record will
+                 * be discarded.
+                 */
+                xprt->tcp_flags &= ~XPRT_COPY_DATA;
+                dprintk("RPC:      XID %08x truncated request\n",
+                                ntohl(xprt->tcp_xid));
+                dprintk("RPC:      xprt = %p, tcp_copied = %lu, tcp_offset = %u, tcp_reclen = %u\n",
+                                xprt, xprt->tcp_copied, xprt->tcp_offset, xprt->tcp_reclen);
+                goto out;
+        }
+
+        dprintk("RPC:      XID %08x read %Zd bytes\n",
+                        ntohl(xprt->tcp_xid), r);
+        dprintk("RPC:      xprt = %p, tcp_copied = %lu, tcp_offset = %u, tcp_reclen = %u\n",
+                        xprt, xprt->tcp_copied, xprt->tcp_offset, xprt->tcp_reclen);
+
+        if (xprt->tcp_copied == req->rq_private_buf.buflen)
+                xprt->tcp_flags &= ~XPRT_COPY_DATA;
+        else if (xprt->tcp_offset == xprt->tcp_reclen) {
+                if (xprt->tcp_flags & XPRT_LAST_FRAG)
+                        xprt->tcp_flags &= ~XPRT_COPY_DATA;
+        }
+
+out:
+        if (!(xprt->tcp_flags & XPRT_COPY_DATA))
+                xprt_complete_rqst(req->rq_task, xprt->tcp_copied);
+        spin_unlock(&xprt->transport_lock);
+        xs_tcp_check_recm(xprt);
+}
+
+static inline void xs_tcp_read_discard(struct rpc_xprt *xprt, skb_reader_t *desc)
+{
+        size_t len;
+
+        len = xprt->tcp_reclen - xprt->tcp_offset;
+        if (len > desc->count)
+                len = desc->count;
+        desc->count -= len;
+        desc->offset += len;
+        xprt->tcp_offset += len;
+        dprintk("RPC:      discarded %Zu bytes\n", len);
+        xs_tcp_check_recm(xprt);
+}
+
+static int xs_tcp_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb, unsigned int offset, size_t len)
+{
+        struct rpc_xprt *xprt = rd_desc->arg.data;
+        skb_reader_t desc = {
+                .skb    = skb,
+                .offset = offset,
+                .count  = len,
+                .csum   = 0
+        };
+
+        dprintk("RPC:      xs_tcp_data_recv started\n");
+        do {
+                /* Read in a new fragment marker if necessary */
+                /* Can we ever really expect to get completely empty fragments? */
+                if (xprt->tcp_flags & XPRT_COPY_RECM) {
+                        xs_tcp_read_fraghdr(xprt, &desc);
+                        continue;
+                }
+                /* Read in the xid if necessary */
+                if (xprt->tcp_flags & XPRT_COPY_XID) {
+                        xs_tcp_read_xid(xprt, &desc);
+                        continue;
+                }
+                /* Read in the request data */
+                if (xprt->tcp_flags & XPRT_COPY_DATA) {
+                        xs_tcp_read_request(xprt, &desc);
+                        continue;
+                }
+                /* Skip over any trailing bytes on short reads */
+                xs_tcp_read_discard(xprt, &desc);
+        } while (desc.count);
+        dprintk("RPC:      xs_tcp_data_recv done\n");
+        return len - desc.count;
+}
+
+/**
+ * xs_tcp_data_ready - "data ready" callback for TCP sockets
+ * @sk: socket with data to read
+ * @bytes: how much data to read
+ *
+ */
+static void xs_tcp_data_ready(struct sock *sk, int bytes)
+{
+        struct rpc_xprt *xprt;
+        read_descriptor_t rd_desc;
+
+        read_lock(&sk->sk_callback_lock);
+        dprintk("RPC:      xs_tcp_data_ready...\n");
+        if (!(xprt = xprt_from_sock(sk)))
+                goto out;
+        if (xprt->shutdown)
+                goto out;
+
+        /* We use rd_desc to pass struct xprt to xs_tcp_data_recv */
+        rd_desc.arg.data = xprt;
+        rd_desc.count = 65536;
+        tcp_read_sock(sk, &rd_desc, xs_tcp_data_recv);
+out:
+        read_unlock(&sk->sk_callback_lock);
+}
+
+/**
+ * xs_tcp_state_change - callback to handle TCP socket state changes
+ * @sk: socket whose state has changed
+ *
+ */
+static void xs_tcp_state_change(struct sock *sk)
+{
+        struct rpc_xprt *xprt;
+
+        read_lock(&sk->sk_callback_lock);
+        if (!(xprt = xprt_from_sock(sk)))
+                goto out;
+        dprintk("RPC:      xs_tcp_state_change client %p...\n", xprt);
+        dprintk("RPC:      state %x conn %d dead %d zapped %d\n",
+                                sk->sk_state, xprt_connected(xprt),
+                                sock_flag(sk, SOCK_DEAD),
+                                sock_flag(sk, SOCK_ZAPPED));
+
+        switch (sk->sk_state) {
+        case TCP_ESTABLISHED:
+                spin_lock_bh(&xprt->transport_lock);
+                if (!xprt_test_and_set_connected(xprt)) {
+                        /* Reset TCP record info */
+                        xprt->tcp_offset = 0;
+                        xprt->tcp_reclen = 0;
+                        xprt->tcp_copied = 0;
+                        xprt->tcp_flags = XPRT_COPY_RECM | XPRT_COPY_XID;
+                        xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
+                        xprt_wake_pending_tasks(xprt, 0);
+                }
+                spin_unlock_bh(&xprt->transport_lock);
+                break;
+        case TCP_SYN_SENT:
+        case TCP_SYN_RECV:
+                break;
+        default:
+                xprt_disconnect(xprt);
+                break;
+        }
+ out:
+        read_unlock(&sk->sk_callback_lock);
+}
+
+/**
+ * xs_udp_write_space - callback invoked when socket buffer space
+ *                             becomes available
+ * @sk: socket whose state has changed
+ *
+ * Called when more output buffer space is available for this socket.
+ * We try not to wake our writers until they can make "significant"
+ * progress, otherwise we'll waste resources thrashing kernel_sendmsg
+ * with a bunch of small requests.
+ */
+static void xs_udp_write_space(struct sock *sk)
+{
+        read_lock(&sk->sk_callback_lock);
+
+        /* from net/core/sock.c:sock_def_write_space */
+        if (sock_writeable(sk)) {
+                struct socket *sock;
+                struct rpc_xprt *xprt;
+
+                if (unlikely(!(sock = sk->sk_socket)))
+                        goto out;
+                if (unlikely(!(xprt = xprt_from_sock(sk))))
+                        goto out;
+                if (unlikely(!test_and_clear_bit(SOCK_NOSPACE, &sock->flags)))
+                        goto out;
+
+                xprt_write_space(xprt);
+        }
+
+ out:
+        read_unlock(&sk->sk_callback_lock);
+}
+
+/**
+ * xs_tcp_write_space - callback invoked when socket buffer space
+ *                             becomes available
+ * @sk: socket whose state has changed
+ *
+ * Called when more output buffer space is available for this socket.
+ * We try not to wake our writers until they can make "significant"
+ * progress, otherwise we'll waste resources thrashing kernel_sendmsg
+ * with a bunch of small requests.
+ */
+static void xs_tcp_write_space(struct sock *sk)
+{
+        read_lock(&sk->sk_callback_lock);
+
+        /* from net/core/stream.c:sk_stream_write_space */
+        if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk)) {
+                struct socket *sock;
+                struct rpc_xprt *xprt;
+
+                if (unlikely(!(sock = sk->sk_socket)))
+                        goto out;
+                if (unlikely(!(xprt = xprt_from_sock(sk))))
+                        goto out;
+                if (unlikely(!test_and_clear_bit(SOCK_NOSPACE, &sock->flags)))
+                        goto out;
+
+                xprt_write_space(xprt);
+        }
+
+ out:
+        read_unlock(&sk->sk_callback_lock);
+}
+
+static void xs_udp_do_set_buffer_size(struct rpc_xprt *xprt)
+{
+        struct sock *sk = xprt->inet;
+
+        if (xprt->rcvsize) {
+                sk->sk_userlocks |= SOCK_RCVBUF_LOCK;
+                sk->sk_rcvbuf = xprt->rcvsize * xprt->max_reqs *  2;
+        }
+        if (xprt->sndsize) {
+                sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
+                sk->sk_sndbuf = xprt->sndsize * xprt->max_reqs * 2;
+                sk->sk_write_space(sk);
+        }
+}
+
+/**
+ * xs_udp_set_buffer_size - set send and receive limits
+ * @xprt: generic transport
+ * @sndsize: requested size of send buffer, in bytes
+ * @rcvsize: requested size of receive buffer, in bytes
+ *
+ * Set socket send and receive buffer size limits.
+ */
+static void xs_udp_set_buffer_size(struct rpc_xprt *xprt, size_t sndsize, size_t rcvsize)
+{
+        xprt->sndsize = 0;
+        if (sndsize)
+                xprt->sndsize = sndsize + 1024;
+        xprt->rcvsize = 0;
+        if (rcvsize)
+                xprt->rcvsize = rcvsize + 1024;
+
+        xs_udp_do_set_buffer_size(xprt);
+}
+
+/**
+ * xs_udp_timer - called when a retransmit timeout occurs on a UDP transport
+ * @task: task that timed out
+ *
+ * Adjust the congestion window after a retransmit timeout has occurred.
+ */
+static void xs_udp_timer(struct rpc_task *task)
+{
+        xprt_adjust_cwnd(task, -ETIMEDOUT);
+}
+
+static int xs_bindresvport(struct rpc_xprt *xprt, struct socket *sock)
+{
+        struct sockaddr_in myaddr = {
+                .sin_family = AF_INET,
+        };
+        int err;
+        unsigned short port = xprt->port;
+
+        do {
+                myaddr.sin_port = htons(port);
+                err = sock->ops->bind(sock, (struct sockaddr *) &myaddr,
+                                                sizeof(myaddr));
+                if (err == 0) {
+                        xprt->port = port;
+                        dprintk("RPC:      xs_bindresvport bound to port %u\n",
+                                        port);
+                        return 0;
+                }
+                if (port <= xprt_min_resvport)
+                        port = xprt_max_resvport;
+                else
+                        port--;
+        } while (err == -EADDRINUSE && port != xprt->port);
+
+        dprintk("RPC:      can't bind to reserved port (%d).\n", -err);
+        return err;
+}
+
+/**
+ * xs_udp_connect_worker - set up a UDP socket
+ * @args: RPC transport to connect
+ *
+ * Invoked by a work queue tasklet.
+ */
+static void xs_udp_connect_worker(void *args)
+{
+        struct rpc_xprt *xprt = (struct rpc_xprt *) args;
+        struct socket *sock = xprt->sock;
+        int err, status = -EIO;
+
+        if (xprt->shutdown || xprt->addr.sin_port == 0)
+                goto out;
+
+        dprintk("RPC:      xs_udp_connect_worker for xprt %p\n", xprt);
+
+        /* Start by resetting any existing state */
+        xs_close(xprt);
+
+        if ((err = sock_create_kern(PF_INET, SOCK_DGRAM, IPPROTO_UDP, &sock)) < 0) {
+                dprintk("RPC:      can't create UDP transport socket (%d).\n", -err);
+                goto out;
+        }
+
+        if (xprt->resvport && xs_bindresvport(xprt, sock) < 0) {
+                sock_release(sock);
+                goto out;
+        }
+
+        if (!xprt->inet) {
+                struct sock *sk = sock->sk;
+
+                write_lock_bh(&sk->sk_callback_lock);
+
+                sk->sk_user_data = xprt;
+                xprt->old_data_ready = sk->sk_data_ready;
+                xprt->old_state_change = sk->sk_state_change;
+                xprt->old_write_space = sk->sk_write_space;
+                sk->sk_data_ready = xs_udp_data_ready;
+                sk->sk_write_space = xs_udp_write_space;
+                sk->sk_no_check = UDP_CSUM_NORCV;
+
+                xprt_set_connected(xprt);
+
+                /* Reset to new socket */
+                xprt->sock = sock;
+                xprt->inet = sk;
+
+                write_unlock_bh(&sk->sk_callback_lock);
+        }
+        xs_udp_do_set_buffer_size(xprt);
+        status = 0;
+out:
+        xprt_wake_pending_tasks(xprt, status);
+        xprt_clear_connecting(xprt);
+}
+
+/*
+ * We need to preserve the port number so the reply cache on the server can
+ * find our cached RPC replies when we get around to reconnecting.
+ */
+static void xs_tcp_reuse_connection(struct rpc_xprt *xprt)
+{
+        int result;
+        struct socket *sock = xprt->sock;
+        struct sockaddr any;
+
+        dprintk("RPC:      disconnecting xprt %p to reuse port\n", xprt);
+
+        /*
+         * Disconnect the transport socket by doing a connect operation
+         * with AF_UNSPEC.  This should return immediately...
+         */
+        memset(&any, 0, sizeof(any));
+        any.sa_family = AF_UNSPEC;
+        result = sock->ops->connect(sock, &any, sizeof(any), 0);
+        if (result)
+                dprintk("RPC:      AF_UNSPEC connect return code %d\n",
+                                result);
+}
+
+/**
+ * xs_tcp_connect_worker - connect a TCP socket to a remote endpoint
+ * @args: RPC transport to connect
+ *
+ * Invoked by a work queue tasklet.
+ */
+static void xs_tcp_connect_worker(void *args)
+{
+        struct rpc_xprt *xprt = (struct rpc_xprt *)args;
+        struct socket *sock = xprt->sock;
+        int err, status = -EIO;
+
+        if (xprt->shutdown || xprt->addr.sin_port == 0)
+                goto out;
+
+        dprintk("RPC:      xs_tcp_connect_worker for xprt %p\n", xprt);
+
+        if (!xprt->sock) {
+                /* start from scratch */
+                if ((err = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, &sock)) < 0) {
+                        dprintk("RPC:      can't create TCP transport socket (%d).\n", -err);
+                        goto out;
+                }
+
+                if (xprt->resvport && xs_bindresvport(xprt, sock) < 0) {
+                        sock_release(sock);
+                        goto out;
+                }
+        } else
+                /* "close" the socket, preserving the local port */
+                xs_tcp_reuse_connection(xprt);
+
+        if (!xprt->inet) {
+                struct sock *sk = sock->sk;
+
+                write_lock_bh(&sk->sk_callback_lock);
+
+                sk->sk_user_data = xprt;
+                xprt->old_data_ready = sk->sk_data_ready;
+                xprt->old_state_change = sk->sk_state_change;
+                xprt->old_write_space = sk->sk_write_space;
+                sk->sk_data_ready = xs_tcp_data_ready;
+                sk->sk_state_change = xs_tcp_state_change;
+                sk->sk_write_space = xs_tcp_write_space;
+
+                /* socket options */
+                sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
+                sock_reset_flag(sk, SOCK_LINGER);
+                tcp_sk(sk)->linger2 = 0;
+                tcp_sk(sk)->nonagle |= TCP_NAGLE_OFF;
+
+                xprt_clear_connected(xprt);
+
+                /* Reset to new socket */
+                xprt->sock = sock;
+                xprt->inet = sk;
+
+                write_unlock_bh(&sk->sk_callback_lock);
+        }
+
+        /* Tell the socket layer to start connecting... */
+        status = sock->ops->connect(sock, (struct sockaddr *) &xprt->addr,
+                        sizeof(xprt->addr), O_NONBLOCK);
+        dprintk("RPC: %p  connect status %d connected %d sock state %d\n",
+                        xprt, -status, xprt_connected(xprt), sock->sk->sk_state);
+        if (status < 0) {
+                switch (status) {
+                        case -EINPROGRESS:
+                        case -EALREADY:
+                                goto out_clear;
+                        case -ECONNREFUSED:
+                        case -ECONNRESET:
+                                /* retry with existing socket, after a delay */
+                                break;
+                        default:
+                                /* get rid of existing socket, and retry */
+                                xs_close(xprt);
+                                break;
+                }
+        }
+out:
+        xprt_wake_pending_tasks(xprt, status);
+out_clear:
+        xprt_clear_connecting(xprt);
+}
+
+/**
+ * xs_connect - connect a socket to a remote endpoint
+ * @task: address of RPC task that manages state of connect request
+ *
+ * TCP: If the remote end dropped the connection, delay reconnecting.
+ *
+ * UDP socket connects are synchronous, but we use a work queue anyway
+ * to guarantee that even unprivileged user processes can set up a
+ * socket on a privileged port.
+ *
+ * If a UDP socket connect fails, the delay behavior here prevents
+ * retry floods (hard mounts).
+ */
+static void xs_connect(struct rpc_task *task)
+{
+        struct rpc_xprt *xprt = task->tk_xprt;
+
+        if (xprt_test_and_set_connecting(xprt))
+                return;
+
+        if (xprt->sock != NULL) {
+                dprintk("RPC:      xs_connect delayed xprt %p for %lu seconds\n",
+                                xprt, xprt->reestablish_timeout / HZ);
+                schedule_delayed_work(&xprt->connect_worker,
+                                        xprt->reestablish_timeout);
+                xprt->reestablish_timeout <<= 1;
+                if (xprt->reestablish_timeout > XS_TCP_MAX_REEST_TO)
+                        xprt->reestablish_timeout = XS_TCP_MAX_REEST_TO;
+        } else {
+                dprintk("RPC:      xs_connect scheduled xprt %p\n", xprt);
+                schedule_work(&xprt->connect_worker);
+
+                /* flush_scheduled_work can sleep... */
+                if (!RPC_IS_ASYNC(task))
+                        flush_scheduled_work();
+        }
+}
+
+static struct rpc_xprt_ops xs_udp_ops = {
+        .set_buffer_size        = xs_udp_set_buffer_size,
+        .reserve_xprt           = xprt_reserve_xprt_cong,
+        .release_xprt           = xprt_release_xprt_cong,
+        .connect                = xs_connect,
+        .send_request           = xs_udp_send_request,
+        .set_retrans_timeout    = xprt_set_retrans_timeout_rtt,
+        .timer                  = xs_udp_timer,
+        .release_request        = xprt_release_rqst_cong,
+        .close                  = xs_close,
+        .destroy                = xs_destroy,
+};
+
+static struct rpc_xprt_ops xs_tcp_ops = {
+        .reserve_xprt           = xprt_reserve_xprt,
+        .release_xprt           = xprt_release_xprt,
+        .connect                = xs_connect,
+        .send_request           = xs_tcp_send_request,
+        .set_retrans_timeout    = xprt_set_retrans_timeout_def,
+        .close                  = xs_close,
+        .destroy                = xs_destroy,
+};
+
+/**
+ * xs_setup_udp - Set up transport to use a UDP socket
+ * @xprt: transport to set up
+ * @to:   timeout parameters
+ *
+ */
+int xs_setup_udp(struct rpc_xprt *xprt, struct rpc_timeout *to)
+{
+        size_t slot_table_size;
+
+        dprintk("RPC:      setting up udp-ipv4 transport...\n");
+
+        xprt->max_reqs = xprt_udp_slot_table_entries;
+        slot_table_size = xprt->max_reqs * sizeof(xprt->slot[0]);
+        xprt->slot = kmalloc(slot_table_size, GFP_KERNEL);
+        if (xprt->slot == NULL)
+                return -ENOMEM;
+        memset(xprt->slot, 0, slot_table_size);
+
+        xprt->prot = IPPROTO_UDP;
+        xprt->port = xprt_max_resvport;
+        xprt->tsh_size = 0;
+        xprt->resvport = capable(CAP_NET_BIND_SERVICE) ? 1 : 0;
+        /* XXX: header size can vary due to auth type, IPv6, etc. */
+        xprt->max_payload = (1U << 16) - (MAX_HEADER << 3);
+
+        INIT_WORK(&xprt->connect_worker, xs_udp_connect_worker, xprt);
+        xprt->bind_timeout = XS_BIND_TO;
+        xprt->connect_timeout = XS_UDP_CONN_TO;
+        xprt->reestablish_timeout = XS_UDP_REEST_TO;
+        xprt->idle_timeout = XS_IDLE_DISC_TO;
+
+        xprt->ops = &xs_udp_ops;
+
+        if (to)
+                xprt->timeout = *to;
+        else
+                xprt_set_timeout(&xprt->timeout, 5, 5 * HZ);
+
+        return 0;
+}
+
+/**
+ * xs_setup_tcp - Set up transport to use a TCP socket
+ * @xprt: transport to set up
+ * @to: timeout parameters
+ *
+ */
+int xs_setup_tcp(struct rpc_xprt *xprt, struct rpc_timeout *to)
+{
+        size_t slot_table_size;
+
+        dprintk("RPC:      setting up tcp-ipv4 transport...\n");
+
+        xprt->max_reqs = xprt_tcp_slot_table_entries;
+        slot_table_size = xprt->max_reqs * sizeof(xprt->slot[0]);
+        xprt->slot = kmalloc(slot_table_size, GFP_KERNEL);
+        if (xprt->slot == NULL)
+                return -ENOMEM;
+        memset(xprt->slot, 0, slot_table_size);
+
+        xprt->prot = IPPROTO_TCP;
+        xprt->port = xprt_max_resvport;
+        xprt->tsh_size = sizeof(rpc_fraghdr) / sizeof(u32);
+        xprt->resvport = capable(CAP_NET_BIND_SERVICE) ? 1 : 0;
+        xprt->max_payload = RPC_MAX_FRAGMENT_SIZE;
+
+        INIT_WORK(&xprt->connect_worker, xs_tcp_connect_worker, xprt);
+        xprt->bind_timeout = XS_BIND_TO;
+        xprt->connect_timeout = XS_TCP_CONN_TO;
+        xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
+        xprt->idle_timeout = XS_IDLE_DISC_TO;
+
+        xprt->ops = &xs_tcp_ops;
+
+        if (to)
+                xprt->timeout = *to;
+        else
+                xprt_set_timeout(&xprt->timeout, 2, 60 * HZ);
+
+        return 0;
+}