drbd: fix potential data corruption and protocol error
[cascardo/linux.git] / drivers / block / drbd / drbd_worker.c
index 9a9a00e..3adbc5a 100644 (file)
 #include "drbd_req.h"
 
 static int w_make_ov_request(struct drbd_work *w, int cancel);
-static int w_make_resync_request(struct drbd_work *w, int cancel);
-
 
 
 /* endio handlers:
  *   drbd_md_io_complete (defined here)
- *   drbd_endio_pri (defined here)
- *   drbd_endio_sec (defined here)
+ *   drbd_request_endio (defined here)
+ *   drbd_peer_request_endio (defined here)
  *   bm_async_io_complete (defined in drbd_bitmap.c)
  *
  * For all these callbacks, note the following:
@@ -59,7 +57,7 @@ static int w_make_resync_request(struct drbd_work *w, int cancel);
 
 /* About the global_state_lock
    Each state transition on an device holds a read lock. In case we have
-   to evaluate the sync after dependencies, we grab a write lock, because
+   to evaluate the resync after dependencies, we grab a write lock, because
    we need stable states on all devices for that.  */
 rwlock_t global_state_lock;
 
@@ -69,11 +67,29 @@ rwlock_t global_state_lock;
 void drbd_md_io_complete(struct bio *bio, int error)
 {
        struct drbd_md_io *md_io;
+       struct drbd_conf *mdev;
 
        md_io = (struct drbd_md_io *)bio->bi_private;
+       mdev = container_of(md_io, struct drbd_conf, md_io);
+
        md_io->error = error;
 
-       complete(&md_io->event);
+       /* We grabbed an extra reference in _drbd_md_sync_page_io() to be able
+        * to timeout on the lower level device, and eventually detach from it.
+        * If this io completion runs after that timeout expired, this
+        * drbd_md_put_buffer() may allow us to finally try and re-attach.
+        * During normal operation, this only puts that extra reference
+        * down to 1 again.
+        * Make sure we first drop the reference, and only then signal
+        * completion, or we may (in drbd_al_read_log()) cycle so fast into the
+        * next drbd_md_sync_page_io(), that we trigger the
+        * ASSERT(atomic_read(&mdev->md_io_in_use) == 1) there.
+        */
+       drbd_md_put_buffer(mdev);
+       md_io->done = 1;
+       wake_up(&mdev->misc_wait);
+       bio_put(bio);
+       put_ldev(mdev);
 }
 
 /* reads on behalf of the partner,
@@ -103,7 +119,7 @@ static void drbd_endio_write_sec_final(struct drbd_peer_request *peer_req) __rel
 {
        unsigned long flags = 0;
        struct drbd_conf *mdev = peer_req->w.mdev;
-       sector_t e_sector;
+       struct drbd_interval i;
        int do_wake;
        u64 block_id;
        int do_al_complete_io;
@@ -112,7 +128,7 @@ static void drbd_endio_write_sec_final(struct drbd_peer_request *peer_req) __rel
         * we may no longer access it,
         * it may be freed/reused already!
         * (as soon as we release the req_lock) */
-       e_sector = peer_req->i.sector;
+       i = peer_req->i;
        do_al_complete_io = peer_req->flags & EE_CALL_AL_COMPLETE_IO;
        block_id = peer_req->block_id;
 
@@ -136,13 +152,13 @@ static void drbd_endio_write_sec_final(struct drbd_peer_request *peer_req) __rel
        spin_unlock_irqrestore(&mdev->tconn->req_lock, flags);
 
        if (block_id == ID_SYNCER)
-               drbd_rs_complete_io(mdev, e_sector);
+               drbd_rs_complete_io(mdev, i.sector);
 
        if (do_wake)
                wake_up(&mdev->ee_wait);
 
        if (do_al_complete_io)
-               drbd_al_complete_io(mdev, e_sector);
+               drbd_al_complete_io(mdev, &i);
 
        wake_asender(mdev->tconn);
        put_ldev(mdev);
@@ -151,7 +167,7 @@ static void drbd_endio_write_sec_final(struct drbd_peer_request *peer_req) __rel
 /* writes on behalf of the partner, or resync writes,
  * "submitted" by the receiver.
  */
-void drbd_endio_sec(struct bio *bio, int error)
+void drbd_peer_request_endio(struct bio *bio, int error)
 {
        struct drbd_peer_request *peer_req = bio->bi_private;
        struct drbd_conf *mdev = peer_req->w.mdev;
@@ -187,7 +203,7 @@ void drbd_endio_sec(struct bio *bio, int error)
 
 /* read, readA or write requests on R_PRIMARY coming from drbd_make_request
  */
-void drbd_endio_pri(struct bio *bio, int error)
+void drbd_request_endio(struct bio *bio, int error)
 {
        unsigned long flags;
        struct drbd_request *req = bio->bi_private;
@@ -240,7 +256,7 @@ int w_read_retry_remote(struct drbd_work *w, int cancel)
        if (cancel || mdev->state.pdsk != D_UP_TO_DATE) {
                _req_mod(req, READ_RETRY_REMOTE_CANCELED);
                spin_unlock_irq(&mdev->tconn->req_lock);
-               return 1;
+               return 0;
        }
        spin_unlock_irq(&mdev->tconn->req_lock);
 
@@ -288,57 +304,58 @@ void drbd_csum_bio(struct drbd_conf *mdev, struct crypto_hash *tfm, struct bio *
        sg_init_table(&sg, 1);
        crypto_hash_init(&desc);
 
-       __bio_for_each_segment(bvec, bio, i, 0) {
+       bio_for_each_segment(bvec, bio, i) {
                sg_set_page(&sg, bvec->bv_page, bvec->bv_len, bvec->bv_offset);
                crypto_hash_update(&desc, &sg, sg.length);
        }
        crypto_hash_final(&desc, digest);
 }
 
+/* MAYBE merge common code with w_e_end_ov_req */
 static int w_e_send_csum(struct drbd_work *w, int cancel)
 {
        struct drbd_peer_request *peer_req = container_of(w, struct drbd_peer_request, w);
        struct drbd_conf *mdev = w->mdev;
        int digest_size;
        void *digest;
-       int ok = 1;
+       int err = 0;
 
        if (unlikely(cancel))
                goto out;
 
-       if (likely((peer_req->flags & EE_WAS_ERROR) != 0))
+       if (unlikely((peer_req->flags & EE_WAS_ERROR) != 0))
                goto out;
 
-       digest_size = crypto_hash_digestsize(mdev->csums_tfm);
+       digest_size = crypto_hash_digestsize(mdev->tconn->csums_tfm);
        digest = kmalloc(digest_size, GFP_NOIO);
        if (digest) {
                sector_t sector = peer_req->i.sector;
                unsigned int size = peer_req->i.size;
-               drbd_csum_ee(mdev, mdev->csums_tfm, peer_req, digest);
-               /* Free e and pages before send.
+               drbd_csum_ee(mdev, mdev->tconn->csums_tfm, peer_req, digest);
+               /* Free peer_req and pages before send.
                 * In case we block on congestion, we could otherwise run into
                 * some distributed deadlock, if the other side blocks on
                 * congestion as well, because our receiver blocks in
-                * drbd_pp_alloc due to pp_in_use > max_buffers. */
-               drbd_free_ee(mdev, peer_req);
+                * drbd_alloc_pages due to pp_in_use > max_buffers. */
+               drbd_free_peer_req(mdev, peer_req);
                peer_req = NULL;
                inc_rs_pending(mdev);
-               ok = drbd_send_drequest_csum(mdev, sector, size,
-                                            digest, digest_size,
-                                            P_CSUM_RS_REQUEST);
+               err = drbd_send_drequest_csum(mdev, sector, size,
+                                             digest, digest_size,
+                                             P_CSUM_RS_REQUEST);
                kfree(digest);
        } else {
                dev_err(DEV, "kmalloc() of digest failed.\n");
-               ok = 0;
+               err = -ENOMEM;
        }
 
 out:
        if (peer_req)
-               drbd_free_ee(mdev, peer_req);
+               drbd_free_peer_req(mdev, peer_req);
 
-       if (unlikely(!ok))
+       if (unlikely(err))
                dev_err(DEV, "drbd_send_drequest(..., csum) failed\n");
-       return ok;
+       return err;
 }
 
 #define GFP_TRY        (__GFP_HIGHMEM | __GFP_NOWARN)
@@ -355,7 +372,8 @@ static int read_for_csum(struct drbd_conf *mdev, sector_t sector, int size)
 
        /* GFP_TRY, because if there is no memory available right now, this may
         * be rescheduled for later. It is "only" background resync, after all. */
-       peer_req = drbd_alloc_ee(mdev, ID_SYNCER /* unused */, sector, size, GFP_TRY);
+       peer_req = drbd_alloc_peer_req(mdev, ID_SYNCER /* unused */, sector,
+                                      size, GFP_TRY);
        if (!peer_req)
                goto defer;
 
@@ -365,7 +383,7 @@ static int read_for_csum(struct drbd_conf *mdev, sector_t sector, int size)
        spin_unlock_irq(&mdev->tconn->req_lock);
 
        atomic_add(size >> 9, &mdev->rs_sect_ev);
-       if (drbd_submit_ee(mdev, peer_req, READ, DRBD_FAULT_RS_RD) == 0)
+       if (drbd_submit_peer_request(mdev, peer_req, READ, DRBD_FAULT_RS_RD) == 0)
                return 0;
 
        /* If it failed because of ENOMEM, retry should help.  If it failed
@@ -376,7 +394,7 @@ static int read_for_csum(struct drbd_conf *mdev, sector_t sector, int size)
        list_del(&peer_req->w.list);
        spin_unlock_irq(&mdev->tconn->req_lock);
 
-       drbd_free_ee(mdev, peer_req);
+       drbd_free_peer_req(mdev, peer_req);
 defer:
        put_ldev(mdev);
        return -EAGAIN;
@@ -394,7 +412,7 @@ int w_resync_timer(struct drbd_work *w, int cancel)
                break;
        }
 
-       return 1;
+       return 0;
 }
 
 void resync_timer_fn(unsigned long data)
@@ -434,8 +452,24 @@ static void fifo_add_val(struct fifo_buffer *fb, int value)
                fb->values[i] += value;
 }
 
+struct fifo_buffer *fifo_alloc(int fifo_size)
+{
+       struct fifo_buffer *fb;
+
+       fb = kzalloc(sizeof(struct fifo_buffer) + sizeof(int) * fifo_size, GFP_KERNEL);
+       if (!fb)
+               return NULL;
+
+       fb->head_index = 0;
+       fb->size = fifo_size;
+       fb->total = 0;
+
+       return fb;
+}
+
 static int drbd_rs_controller(struct drbd_conf *mdev)
 {
+       struct disk_conf *dc;
        unsigned int sect_in;  /* Number of sectors that came in since the last turn */
        unsigned int want;     /* The number of sectors we want in the proxy */
        int req_sect; /* Number of sectors to request in this turn */
@@ -444,38 +478,39 @@ static int drbd_rs_controller(struct drbd_conf *mdev)
        int steps; /* Number of time steps to plan ahead */
        int curr_corr;
        int max_sect;
+       struct fifo_buffer *plan;
 
        sect_in = atomic_xchg(&mdev->rs_sect_in, 0); /* Number of sectors that came in */
        mdev->rs_in_flight -= sect_in;
 
-       spin_lock(&mdev->peer_seq_lock); /* get an atomic view on mdev->rs_plan_s */
+       dc = rcu_dereference(mdev->ldev->disk_conf);
+       plan = rcu_dereference(mdev->rs_plan_s);
 
-       steps = mdev->rs_plan_s.size; /* (mdev->sync_conf.c_plan_ahead * 10 * SLEEP_TIME) / HZ; */
+       steps = plan->size; /* (dc->c_plan_ahead * 10 * SLEEP_TIME) / HZ; */
 
        if (mdev->rs_in_flight + sect_in == 0) { /* At start of resync */
-               want = ((mdev->sync_conf.rate * 2 * SLEEP_TIME) / HZ) * steps;
+               want = ((dc->resync_rate * 2 * SLEEP_TIME) / HZ) * steps;
        } else { /* normal path */
-               want = mdev->sync_conf.c_fill_target ? mdev->sync_conf.c_fill_target :
-                       sect_in * mdev->sync_conf.c_delay_target * HZ / (SLEEP_TIME * 10);
+               want = dc->c_fill_target ? dc->c_fill_target :
+                       sect_in * dc->c_delay_target * HZ / (SLEEP_TIME * 10);
        }
 
-       correction = want - mdev->rs_in_flight - mdev->rs_planed;
+       correction = want - mdev->rs_in_flight - plan->total;
 
        /* Plan ahead */
        cps = correction / steps;
-       fifo_add_val(&mdev->rs_plan_s, cps);
-       mdev->rs_planed += cps * steps;
+       fifo_add_val(plan, cps);
+       plan->total += cps * steps;
 
        /* What we do in this step */
-       curr_corr = fifo_push(&mdev->rs_plan_s, 0);
-       spin_unlock(&mdev->peer_seq_lock);
-       mdev->rs_planed -= curr_corr;
+       curr_corr = fifo_push(plan, 0);
+       plan->total -= curr_corr;
 
        req_sect = sect_in + curr_corr;
        if (req_sect < 0)
                req_sect = 0;
 
-       max_sect = (mdev->sync_conf.c_max_rate * 2 * SLEEP_TIME) / HZ;
+       max_sect = (dc->c_max_rate * 2 * SLEEP_TIME) / HZ;
        if (req_sect > max_sect)
                req_sect = max_sect;
 
@@ -491,20 +526,23 @@ static int drbd_rs_controller(struct drbd_conf *mdev)
 static int drbd_rs_number_requests(struct drbd_conf *mdev)
 {
        int number;
-       if (mdev->rs_plan_s.size) { /* mdev->sync_conf.c_plan_ahead */
+
+       rcu_read_lock();
+       if (rcu_dereference(mdev->rs_plan_s)->size) {
                number = drbd_rs_controller(mdev) >> (BM_BLOCK_SHIFT - 9);
                mdev->c_sync_rate = number * HZ * (BM_BLOCK_SIZE / 1024) / SLEEP_TIME;
        } else {
-               mdev->c_sync_rate = mdev->sync_conf.rate;
+               mdev->c_sync_rate = rcu_dereference(mdev->ldev->disk_conf)->resync_rate;
                number = SLEEP_TIME * mdev->c_sync_rate  / ((BM_BLOCK_SIZE / 1024) * HZ);
        }
+       rcu_read_unlock();
 
        /* ignore the amount of pending requests, the resync controller should
         * throttle down to incoming reply rate soon enough anyways. */
        return number;
 }
 
-static int w_make_resync_request(struct drbd_work *w, int cancel)
+int w_make_resync_request(struct drbd_work *w, int cancel)
 {
        struct drbd_conf *mdev = w->mdev;
        unsigned long bit;
@@ -516,12 +554,12 @@ static int w_make_resync_request(struct drbd_work *w, int cancel)
        int i = 0;
 
        if (unlikely(cancel))
-               return 1;
+               return 0;
 
        if (mdev->rs_total == 0) {
                /* empty resync? */
                drbd_resync_finished(mdev);
-               return 1;
+               return 0;
        }
 
        if (!get_ldev(mdev)) {
@@ -530,7 +568,7 @@ static int w_make_resync_request(struct drbd_work *w, int cancel)
                   to continue resync with a broken disk makes no sense at
                   all */
                dev_err(DEV, "Disk broke down during resync!\n");
-               return 1;
+               return 0;
        }
 
        max_bio_size = queue_max_hw_sectors(mdev->rq_queue) << 9;
@@ -559,7 +597,7 @@ next_sector:
                if (bit == DRBD_END_OF_BITMAP) {
                        mdev->bm_resync_fo = drbd_bm_bits(mdev);
                        put_ldev(mdev);
-                       return 1;
+                       return 0;
                }
 
                sector = BM_BIT_TO_SECT(bit);
@@ -618,11 +656,11 @@ next_sector:
                /* adjust very last sectors, in case we are oddly sized */
                if (sector + (size>>9) > capacity)
                        size = (capacity-sector)<<9;
-               if (mdev->tconn->agreed_pro_version >= 89 && mdev->csums_tfm) {
+               if (mdev->tconn->agreed_pro_version >= 89 && mdev->tconn->csums_tfm) {
                        switch (read_for_csum(mdev, sector, size)) {
                        case -EIO: /* Disk failure */
                                put_ldev(mdev);
-                               return 0;
+                               return -EIO;
                        case -EAGAIN: /* allocation failed, or ldev busy */
                                drbd_rs_complete_io(mdev, sector);
                                mdev->bm_resync_fo = BM_SECT_TO_BIT(sector);
@@ -635,13 +673,16 @@ next_sector:
                                BUG();
                        }
                } else {
+                       int err;
+
                        inc_rs_pending(mdev);
-                       if (!drbd_send_drequest(mdev, P_RS_DATA_REQUEST,
-                                              sector, size, ID_SYNCER)) {
+                       err = drbd_send_drequest(mdev, P_RS_DATA_REQUEST,
+                                                sector, size, ID_SYNCER);
+                       if (err) {
                                dev_err(DEV, "drbd_send_drequest() failed, aborting...\n");
                                dec_rs_pending(mdev);
                                put_ldev(mdev);
-                               return 0;
+                               return err;
                        }
                }
        }
@@ -654,14 +695,14 @@ next_sector:
                 * until then resync "work" is "inactive" ...
                 */
                put_ldev(mdev);
-               return 1;
+               return 0;
        }
 
  requeue:
        mdev->rs_in_flight += (i << (BM_BLOCK_SHIFT - 9));
        mod_timer(&mdev->resync_timer, jiffies + SLEEP_TIME);
        put_ldev(mdev);
-       return 1;
+       return 0;
 }
 
 static int w_make_ov_request(struct drbd_work *w, int cancel)
@@ -694,7 +735,7 @@ static int w_make_ov_request(struct drbd_work *w, int cancel)
                        size = (capacity-sector)<<9;
 
                inc_rs_pending(mdev);
-               if (!drbd_send_ov_request(mdev, sector, size)) {
+               if (drbd_send_ov_request(mdev, sector, size)) {
                        dec_rs_pending(mdev);
                        return 0;
                }
@@ -712,10 +753,10 @@ int w_ov_finished(struct drbd_work *w, int cancel)
 {
        struct drbd_conf *mdev = w->mdev;
        kfree(w);
-       ov_oos_print(mdev);
+       ov_out_of_sync_print(mdev);
        drbd_resync_finished(mdev);
 
-       return 1;
+       return 0;
 }
 
 static int w_resync_finished(struct drbd_work *w, int cancel)
@@ -725,7 +766,7 @@ static int w_resync_finished(struct drbd_work *w, int cancel)
 
        drbd_resync_finished(mdev);
 
-       return 1;
+       return 0;
 }
 
 static void ping_peer(struct drbd_conf *mdev)
@@ -760,6 +801,7 @@ int drbd_resync_finished(struct drbd_conf *mdev)
                w = kmalloc(sizeof(struct drbd_work), GFP_ATOMIC);
                if (w) {
                        w->cb = w_resync_finished;
+                       w->mdev = mdev;
                        drbd_queue_work(&mdev->tconn->data.work, w);
                        return 1;
                }
@@ -779,7 +821,7 @@ int drbd_resync_finished(struct drbd_conf *mdev)
        ping_peer(mdev);
 
        spin_lock_irq(&mdev->tconn->req_lock);
-       os = mdev->state;
+       os = drbd_read_state(mdev);
 
        verify_done = (os.conn == C_VERIFY_S || os.conn == C_VERIFY_T);
 
@@ -809,7 +851,7 @@ int drbd_resync_finished(struct drbd_conf *mdev)
                if (os.conn == C_SYNC_TARGET || os.conn == C_PAUSED_SYNC_T)
                        khelper_cmd = "after-resync-target";
 
-               if (mdev->csums_tfm && mdev->rs_total) {
+               if (mdev->tconn->csums_tfm && mdev->rs_total) {
                        const unsigned long s = mdev->rs_same_csum;
                        const unsigned long t = mdev->rs_total;
                        const int ratio =
@@ -887,7 +929,7 @@ out:
 /* helper */
 static void move_to_net_ee_or_free(struct drbd_conf *mdev, struct drbd_peer_request *peer_req)
 {
-       if (drbd_ee_has_active_page(peer_req)) {
+       if (drbd_peer_req_has_active_page(peer_req)) {
                /* This might happen if sendpage() has not finished */
                int i = (peer_req->i.size + PAGE_SIZE -1) >> PAGE_SHIFT;
                atomic_add(i, &mdev->pp_in_use_by_net);
@@ -897,7 +939,7 @@ static void move_to_net_ee_or_free(struct drbd_conf *mdev, struct drbd_peer_requ
                spin_unlock_irq(&mdev->tconn->req_lock);
                wake_up(&drbd_pp_wait);
        } else
-               drbd_free_ee(mdev, peer_req);
+               drbd_free_peer_req(mdev, peer_req);
 }
 
 /**
@@ -910,35 +952,35 @@ int w_e_end_data_req(struct drbd_work *w, int cancel)
 {
        struct drbd_peer_request *peer_req = container_of(w, struct drbd_peer_request, w);
        struct drbd_conf *mdev = w->mdev;
-       int ok;
+       int err;
 
        if (unlikely(cancel)) {
-               drbd_free_ee(mdev, peer_req);
+               drbd_free_peer_req(mdev, peer_req);
                dec_unacked(mdev);
-               return 1;
+               return 0;
        }
 
        if (likely((peer_req->flags & EE_WAS_ERROR) == 0)) {
-               ok = drbd_send_block(mdev, P_DATA_REPLY, peer_req);
+               err = drbd_send_block(mdev, P_DATA_REPLY, peer_req);
        } else {
                if (__ratelimit(&drbd_ratelimit_state))
                        dev_err(DEV, "Sending NegDReply. sector=%llus.\n",
                            (unsigned long long)peer_req->i.sector);
 
-               ok = drbd_send_ack(mdev, P_NEG_DREPLY, peer_req);
+               err = drbd_send_ack(mdev, P_NEG_DREPLY, peer_req);
        }
 
        dec_unacked(mdev);
 
        move_to_net_ee_or_free(mdev, peer_req);
 
-       if (unlikely(!ok))
+       if (unlikely(err))
                dev_err(DEV, "drbd_send_block() failed\n");
-       return ok;
+       return err;
 }
 
 /**
- * w_e_end_rsdata_req() - Worker callback to send a P_RS_DATA_REPLY packet in response to a P_RS_DATA_REQUESTRS
+ * w_e_end_rsdata_req() - Worker callback to send a P_RS_DATA_REPLY packet in response to a P_RS_DATA_REQUEST
  * @mdev:      DRBD device.
  * @w:         work object.
  * @cancel:    The connection will be closed anyways
@@ -947,12 +989,12 @@ int w_e_end_rsdata_req(struct drbd_work *w, int cancel)
 {
        struct drbd_peer_request *peer_req = container_of(w, struct drbd_peer_request, w);
        struct drbd_conf *mdev = w->mdev;
-       int ok;
+       int err;
 
        if (unlikely(cancel)) {
-               drbd_free_ee(mdev, peer_req);
+               drbd_free_peer_req(mdev, peer_req);
                dec_unacked(mdev);
-               return 1;
+               return 0;
        }
 
        if (get_ldev_if_state(mdev, D_FAILED)) {
@@ -961,23 +1003,23 @@ int w_e_end_rsdata_req(struct drbd_work *w, int cancel)
        }
 
        if (mdev->state.conn == C_AHEAD) {
-               ok = drbd_send_ack(mdev, P_RS_CANCEL, peer_req);
+               err = drbd_send_ack(mdev, P_RS_CANCEL, peer_req);
        } else if (likely((peer_req->flags & EE_WAS_ERROR) == 0)) {
                if (likely(mdev->state.pdsk >= D_INCONSISTENT)) {
                        inc_rs_pending(mdev);
-                       ok = drbd_send_block(mdev, P_RS_DATA_REPLY, peer_req);
+                       err = drbd_send_block(mdev, P_RS_DATA_REPLY, peer_req);
                } else {
                        if (__ratelimit(&drbd_ratelimit_state))
                                dev_err(DEV, "Not sending RSDataReply, "
                                    "partner DISKLESS!\n");
-                       ok = 1;
+                       err = 0;
                }
        } else {
                if (__ratelimit(&drbd_ratelimit_state))
                        dev_err(DEV, "Sending NegRSDReply. sector %llus.\n",
                            (unsigned long long)peer_req->i.sector);
 
-               ok = drbd_send_ack(mdev, P_NEG_RS_DREPLY, peer_req);
+               err = drbd_send_ack(mdev, P_NEG_RS_DREPLY, peer_req);
 
                /* update resync data with failure */
                drbd_rs_failed_io(mdev, peer_req->i.sector, peer_req->i.size);
@@ -987,9 +1029,9 @@ int w_e_end_rsdata_req(struct drbd_work *w, int cancel)
 
        move_to_net_ee_or_free(mdev, peer_req);
 
-       if (unlikely(!ok))
+       if (unlikely(err))
                dev_err(DEV, "drbd_send_block() failed\n");
-       return ok;
+       return err;
 }
 
 int w_e_end_csum_rs_req(struct drbd_work *w, int cancel)
@@ -999,12 +1041,12 @@ int w_e_end_csum_rs_req(struct drbd_work *w, int cancel)
        struct digest_info *di;
        int digest_size;
        void *digest = NULL;
-       int ok, eq = 0;
+       int err, eq = 0;
 
        if (unlikely(cancel)) {
-               drbd_free_ee(mdev, peer_req);
+               drbd_free_peer_req(mdev, peer_req);
                dec_unacked(mdev);
-               return 1;
+               return 0;
        }
 
        if (get_ldev(mdev)) {
@@ -1018,13 +1060,13 @@ int w_e_end_csum_rs_req(struct drbd_work *w, int cancel)
                /* quick hack to try to avoid a race against reconfiguration.
                 * a real fix would be much more involved,
                 * introducing more locking mechanisms */
-               if (mdev->csums_tfm) {
-                       digest_size = crypto_hash_digestsize(mdev->csums_tfm);
+               if (mdev->tconn->csums_tfm) {
+                       digest_size = crypto_hash_digestsize(mdev->tconn->csums_tfm);
                        D_ASSERT(digest_size == di->digest_size);
                        digest = kmalloc(digest_size, GFP_NOIO);
                }
                if (digest) {
-                       drbd_csum_ee(mdev, mdev->csums_tfm, peer_req, digest);
+                       drbd_csum_ee(mdev, mdev->tconn->csums_tfm, peer_req, digest);
                        eq = !memcmp(digest, di->digest, digest_size);
                        kfree(digest);
                }
@@ -1033,16 +1075,16 @@ int w_e_end_csum_rs_req(struct drbd_work *w, int cancel)
                        drbd_set_in_sync(mdev, peer_req->i.sector, peer_req->i.size);
                        /* rs_same_csums unit is BM_BLOCK_SIZE */
                        mdev->rs_same_csum += peer_req->i.size >> BM_BLOCK_SHIFT;
-                       ok = drbd_send_ack(mdev, P_RS_IS_IN_SYNC, peer_req);
+                       err = drbd_send_ack(mdev, P_RS_IS_IN_SYNC, peer_req);
                } else {
                        inc_rs_pending(mdev);
                        peer_req->block_id = ID_SYNCER; /* By setting block_id, digest pointer becomes invalid! */
                        peer_req->flags &= ~EE_HAS_DIGEST; /* This peer request no longer has a digest pointer */
                        kfree(di);
-                       ok = drbd_send_block(mdev, P_RS_DATA_REPLY, peer_req);
+                       err = drbd_send_block(mdev, P_RS_DATA_REPLY, peer_req);
                }
        } else {
-               ok = drbd_send_ack(mdev, P_NEG_RS_DREPLY, peer_req);
+               err = drbd_send_ack(mdev, P_NEG_RS_DREPLY, peer_req);
                if (__ratelimit(&drbd_ratelimit_state))
                        dev_err(DEV, "Sending NegDReply. I guess it gets messy.\n");
        }
@@ -1050,9 +1092,9 @@ int w_e_end_csum_rs_req(struct drbd_work *w, int cancel)
        dec_unacked(mdev);
        move_to_net_ee_or_free(mdev, peer_req);
 
-       if (unlikely(!ok))
+       if (unlikely(err))
                dev_err(DEV, "drbd_send_block/ack() failed\n");
-       return ok;
+       return err;
 }
 
 int w_e_end_ov_req(struct drbd_work *w, int cancel)
@@ -1063,20 +1105,20 @@ int w_e_end_ov_req(struct drbd_work *w, int cancel)
        unsigned int size = peer_req->i.size;
        int digest_size;
        void *digest;
-       int ok = 1;
+       int err = 0;
 
        if (unlikely(cancel))
                goto out;
 
-       digest_size = crypto_hash_digestsize(mdev->verify_tfm);
+       digest_size = crypto_hash_digestsize(mdev->tconn->verify_tfm);
        digest = kmalloc(digest_size, GFP_NOIO);
        if (!digest) {
-               ok = 0; /* terminate the connection in case the allocation failed */
+               err = 1;        /* terminate the connection in case the allocation failed */
                goto out;
        }
 
        if (likely(!(peer_req->flags & EE_WAS_ERROR)))
-               drbd_csum_ee(mdev, mdev->verify_tfm, peer_req, digest);
+               drbd_csum_ee(mdev, mdev->tconn->verify_tfm, peer_req, digest);
        else
                memset(digest, 0, digest_size);
 
@@ -1084,25 +1126,23 @@ int w_e_end_ov_req(struct drbd_work *w, int cancel)
         * In case we block on congestion, we could otherwise run into
         * some distributed deadlock, if the other side blocks on
         * congestion as well, because our receiver blocks in
-        * drbd_pp_alloc due to pp_in_use > max_buffers. */
-       drbd_free_ee(mdev, peer_req);
+        * drbd_alloc_pages due to pp_in_use > max_buffers. */
+       drbd_free_peer_req(mdev, peer_req);
        peer_req = NULL;
        inc_rs_pending(mdev);
-       ok = drbd_send_drequest_csum(mdev, sector, size,
-                                    digest, digest_size,
-                                    P_OV_REPLY);
-       if (!ok)
+       err = drbd_send_drequest_csum(mdev, sector, size, digest, digest_size, P_OV_REPLY);
+       if (err)
                dec_rs_pending(mdev);
        kfree(digest);
 
 out:
        if (peer_req)
-               drbd_free_ee(mdev, peer_req);
+               drbd_free_peer_req(mdev, peer_req);
        dec_unacked(mdev);
-       return ok;
+       return err;
 }
 
-void drbd_ov_oos_found(struct drbd_conf *mdev, sector_t sector, int size)
+void drbd_ov_out_of_sync_found(struct drbd_conf *mdev, sector_t sector, int size)
 {
        if (mdev->ov_last_oos_start + mdev->ov_last_oos_size == sector) {
                mdev->ov_last_oos_size += size>>9;
@@ -1122,12 +1162,12 @@ int w_e_end_ov_reply(struct drbd_work *w, int cancel)
        sector_t sector = peer_req->i.sector;
        unsigned int size = peer_req->i.size;
        int digest_size;
-       int ok, eq = 0;
+       int err, eq = 0;
 
        if (unlikely(cancel)) {
-               drbd_free_ee(mdev, peer_req);
+               drbd_free_peer_req(mdev, peer_req);
                dec_unacked(mdev);
-               return 1;
+               return 0;
        }
 
        /* after "cancel", because after drbd_disconnect/drbd_rs_cancel_all
@@ -1140,10 +1180,10 @@ int w_e_end_ov_reply(struct drbd_work *w, int cancel)
        di = peer_req->digest;
 
        if (likely((peer_req->flags & EE_WAS_ERROR) == 0)) {
-               digest_size = crypto_hash_digestsize(mdev->verify_tfm);
+               digest_size = crypto_hash_digestsize(mdev->tconn->verify_tfm);
                digest = kmalloc(digest_size, GFP_NOIO);
                if (digest) {
-                       drbd_csum_ee(mdev, mdev->verify_tfm, peer_req, digest);
+                       drbd_csum_ee(mdev, mdev->tconn->verify_tfm, peer_req, digest);
 
                        D_ASSERT(digest_size == di->digest_size);
                        eq = !memcmp(digest, di->digest, digest_size);
@@ -1151,19 +1191,19 @@ int w_e_end_ov_reply(struct drbd_work *w, int cancel)
                }
        }
 
-               /* Free e and pages before send.
-                * In case we block on congestion, we could otherwise run into
-                * some distributed deadlock, if the other side blocks on
-                * congestion as well, because our receiver blocks in
-                * drbd_pp_alloc due to pp_in_use > max_buffers. */
-       drbd_free_ee(mdev, peer_req);
+       /* Free peer_req and pages before send.
+        * In case we block on congestion, we could otherwise run into
+        * some distributed deadlock, if the other side blocks on
+        * congestion as well, because our receiver blocks in
+        * drbd_alloc_pages due to pp_in_use > max_buffers. */
+       drbd_free_peer_req(mdev, peer_req);
        if (!eq)
-               drbd_ov_oos_found(mdev, sector, size);
+               drbd_ov_out_of_sync_found(mdev, sector, size);
        else
-               ov_oos_print(mdev);
+               ov_out_of_sync_print(mdev);
 
-       ok = drbd_send_ack_ex(mdev, P_OV_RESULT, sector, size,
-                             eq ? ID_IN_SYNC : ID_OUT_OF_SYNC);
+       err = drbd_send_ack_ex(mdev, P_OV_RESULT, sector, size,
+                              eq ? ID_IN_SYNC : ID_OUT_OF_SYNC);
 
        dec_unacked(mdev);
 
@@ -1174,11 +1214,11 @@ int w_e_end_ov_reply(struct drbd_work *w, int cancel)
                drbd_advance_rs_marks(mdev, mdev->ov_left);
 
        if (mdev->ov_left == 0) {
-               ov_oos_print(mdev);
+               ov_out_of_sync_print(mdev);
                drbd_resync_finished(mdev);
        }
 
-       return ok;
+       return err;
 }
 
 int w_prev_work_done(struct drbd_work *w, int cancel)
@@ -1186,15 +1226,15 @@ int w_prev_work_done(struct drbd_work *w, int cancel)
        struct drbd_wq_barrier *b = container_of(w, struct drbd_wq_barrier, w);
 
        complete(&b->done);
-       return 1;
+       return 0;
 }
 
 int w_send_barrier(struct drbd_work *w, int cancel)
 {
+       struct drbd_socket *sock;
        struct drbd_tl_epoch *b = container_of(w, struct drbd_tl_epoch, w);
        struct drbd_conf *mdev = w->mdev;
-       struct p_barrier *p = &mdev->tconn->data.sbuf.barrier;
-       int ok = 1;
+       struct p_barrier *p;
 
        /* really avoid racing with tl_clear.  w.cb may have been referenced
         * just before it was reassigned and re-queued, so double check that.
@@ -1206,44 +1246,47 @@ int w_send_barrier(struct drbd_work *w, int cancel)
                cancel = 1;
        spin_unlock_irq(&mdev->tconn->req_lock);
        if (cancel)
-               return 1;
-
-       if (!drbd_get_data_sock(mdev->tconn))
                return 0;
+
+       sock = &mdev->tconn->data;
+       p = drbd_prepare_command(mdev, sock);
+       if (!p)
+               return -EIO;
        p->barrier = b->br_number;
        /* inc_ap_pending was done where this was queued.
         * dec_ap_pending will be done in got_BarrierAck
         * or (on connection loss) in w_clear_epoch.  */
-       ok = _drbd_send_cmd(mdev, mdev->tconn->data.socket, P_BARRIER,
-                           &p->head, sizeof(*p), 0);
-       drbd_put_data_sock(mdev->tconn);
-
-       return ok;
+       return drbd_send_command(mdev, sock, P_BARRIER, sizeof(*p), NULL, 0);
 }
 
 int w_send_write_hint(struct drbd_work *w, int cancel)
 {
        struct drbd_conf *mdev = w->mdev;
+       struct drbd_socket *sock;
+
        if (cancel)
-               return 1;
-       return drbd_send_short_cmd(mdev, P_UNPLUG_REMOTE);
+               return 0;
+       sock = &mdev->tconn->data;
+       if (!drbd_prepare_command(mdev, sock))
+               return -EIO;
+       return drbd_send_command(mdev, sock, P_UNPLUG_REMOTE, 0, NULL, 0);
 }
 
-int w_send_oos(struct drbd_work *w, int cancel)
+int w_send_out_of_sync(struct drbd_work *w, int cancel)
 {
        struct drbd_request *req = container_of(w, struct drbd_request, w);
        struct drbd_conf *mdev = w->mdev;
-       int ok;
+       int err;
 
        if (unlikely(cancel)) {
                req_mod(req, SEND_CANCELED);
-               return 1;
+               return 0;
        }
 
-       ok = drbd_send_oos(mdev, req);
+       err = drbd_send_out_of_sync(mdev, req);
        req_mod(req, OOS_HANDED_TO_NETWORK);
 
-       return ok;
+       return err;
 }
 
 /**
@@ -1256,17 +1299,17 @@ int w_send_dblock(struct drbd_work *w, int cancel)
 {
        struct drbd_request *req = container_of(w, struct drbd_request, w);
        struct drbd_conf *mdev = w->mdev;
-       int ok;
+       int err;
 
        if (unlikely(cancel)) {
                req_mod(req, SEND_CANCELED);
-               return 1;
+               return 0;
        }
 
-       ok = drbd_send_dblock(mdev, req);
-       req_mod(req, ok ? HANDED_OVER_TO_NETWORK : SEND_FAILED);
+       err = drbd_send_dblock(mdev, req);
+       req_mod(req, err ? SEND_FAILED : HANDED_OVER_TO_NETWORK);
 
-       return ok;
+       return err;
 }
 
 /**
@@ -1279,25 +1322,19 @@ int w_send_read_req(struct drbd_work *w, int cancel)
 {
        struct drbd_request *req = container_of(w, struct drbd_request, w);
        struct drbd_conf *mdev = w->mdev;
-       int ok;
+       int err;
 
        if (unlikely(cancel)) {
                req_mod(req, SEND_CANCELED);
-               return 1;
+               return 0;
        }
 
-       ok = drbd_send_drequest(mdev, P_DATA_REQUEST, req->i.sector, req->i.size,
-                               (unsigned long)req);
+       err = drbd_send_drequest(mdev, P_DATA_REQUEST, req->i.sector, req->i.size,
+                                (unsigned long)req);
 
-       if (!ok) {
-               /* ?? we set C_TIMEOUT or C_BROKEN_PIPE in drbd_send();
-                * so this is probably redundant */
-               if (mdev->state.conn >= C_CONNECTED)
-                       drbd_force_state(mdev, NS(conn, C_NETWORK_FAILURE));
-       }
-       req_mod(req, ok ? HANDED_OVER_TO_NETWORK : SEND_FAILED);
+       req_mod(req, err ? SEND_FAILED : HANDED_OVER_TO_NETWORK);
 
-       return ok;
+       return err;
 }
 
 int w_restart_disk_io(struct drbd_work *w, int cancel)
@@ -1306,27 +1343,29 @@ int w_restart_disk_io(struct drbd_work *w, int cancel)
        struct drbd_conf *mdev = w->mdev;
 
        if (bio_data_dir(req->master_bio) == WRITE && req->rq_state & RQ_IN_ACT_LOG)
-               drbd_al_begin_io(mdev, req->i.sector);
-       /* Calling drbd_al_begin_io() out of the worker might deadlocks
-          theoretically. Practically it can not deadlock, since this is
-          only used when unfreezing IOs. All the extents of the requests
-          that made it into the TL are already active */
+               drbd_al_begin_io(mdev, &req->i);
 
        drbd_req_make_private_bio(req, req->master_bio);
        req->private_bio->bi_bdev = mdev->ldev->backing_bdev;
        generic_make_request(req->private_bio);
 
-       return 1;
+       return 0;
 }
 
 static int _drbd_may_sync_now(struct drbd_conf *mdev)
 {
        struct drbd_conf *odev = mdev;
+       int resync_after;
 
        while (1) {
-               if (odev->sync_conf.after == -1)
+               if (!odev->ldev)
+                       return 1;
+               rcu_read_lock();
+               resync_after = rcu_dereference(odev->ldev->disk_conf)->resync_after;
+               rcu_read_unlock();
+               if (resync_after == -1)
                        return 1;
-               odev = minor_to_mdev(odev->sync_conf.after);
+               odev = minor_to_mdev(resync_after);
                if (!expect(odev))
                        return 1;
                if ((odev->state.conn >= C_SYNC_SOURCE &&
@@ -1348,16 +1387,15 @@ static int _drbd_pause_after(struct drbd_conf *mdev)
        struct drbd_conf *odev;
        int i, rv = 0;
 
-       for (i = 0; i < minor_count; i++) {
-               odev = minor_to_mdev(i);
-               if (!odev)
-                       continue;
+       rcu_read_lock();
+       idr_for_each_entry(&minors, odev, i) {
                if (odev->state.conn == C_STANDALONE && odev->state.disk == D_DISKLESS)
                        continue;
                if (!_drbd_may_sync_now(odev))
                        rv |= (__drbd_set_state(_NS(odev, aftr_isp, 1), CS_HARD, NULL)
                               != SS_NOTHING_TO_DO);
        }
+       rcu_read_unlock();
 
        return rv;
 }
@@ -1373,10 +1411,8 @@ static int _drbd_resume_next(struct drbd_conf *mdev)
        struct drbd_conf *odev;
        int i, rv = 0;
 
-       for (i = 0; i < minor_count; i++) {
-               odev = minor_to_mdev(i);
-               if (!odev)
-                       continue;
+       rcu_read_lock();
+       idr_for_each_entry(&minors, odev, i) {
                if (odev->state.conn == C_STANDALONE && odev->state.disk == D_DISKLESS)
                        continue;
                if (odev->state.aftr_isp) {
@@ -1386,6 +1422,7 @@ static int _drbd_resume_next(struct drbd_conf *mdev)
                                       != SS_NOTHING_TO_DO) ;
                }
        }
+       rcu_read_unlock();
        return rv;
 }
 
@@ -1403,57 +1440,63 @@ void suspend_other_sg(struct drbd_conf *mdev)
        write_unlock_irq(&global_state_lock);
 }
 
-static int sync_after_error(struct drbd_conf *mdev, int o_minor)
+/* caller must hold global_state_lock */
+enum drbd_ret_code drbd_resync_after_valid(struct drbd_conf *mdev, int o_minor)
 {
        struct drbd_conf *odev;
+       int resync_after;
 
        if (o_minor == -1)
                return NO_ERROR;
        if (o_minor < -1 || minor_to_mdev(o_minor) == NULL)
-               return ERR_SYNC_AFTER;
+               return ERR_RESYNC_AFTER;
 
        /* check for loops */
        odev = minor_to_mdev(o_minor);
        while (1) {
                if (odev == mdev)
-                       return ERR_SYNC_AFTER_CYCLE;
+                       return ERR_RESYNC_AFTER_CYCLE;
 
+               rcu_read_lock();
+               resync_after = rcu_dereference(odev->ldev->disk_conf)->resync_after;
+               rcu_read_unlock();
                /* dependency chain ends here, no cycles. */
-               if (odev->sync_conf.after == -1)
+               if (resync_after == -1)
                        return NO_ERROR;
 
                /* follow the dependency chain */
-               odev = minor_to_mdev(odev->sync_conf.after);
+               odev = minor_to_mdev(resync_after);
        }
 }
 
-int drbd_alter_sa(struct drbd_conf *mdev, int na)
+/* caller must hold global_state_lock */
+void drbd_resync_after_changed(struct drbd_conf *mdev)
 {
        int changes;
-       int retcode;
 
-       write_lock_irq(&global_state_lock);
-       retcode = sync_after_error(mdev, na);
-       if (retcode == NO_ERROR) {
-               mdev->sync_conf.after = na;
-               do {
-                       changes  = _drbd_pause_after(mdev);
-                       changes |= _drbd_resume_next(mdev);
-               } while (changes);
-       }
-       write_unlock_irq(&global_state_lock);
-       return retcode;
+       do {
+               changes  = _drbd_pause_after(mdev);
+               changes |= _drbd_resume_next(mdev);
+       } while (changes);
 }
 
 void drbd_rs_controller_reset(struct drbd_conf *mdev)
 {
+       struct fifo_buffer *plan;
+
        atomic_set(&mdev->rs_sect_in, 0);
        atomic_set(&mdev->rs_sect_ev, 0);
        mdev->rs_in_flight = 0;
-       mdev->rs_planed = 0;
-       spin_lock(&mdev->peer_seq_lock);
-       fifo_set(&mdev->rs_plan_s, 0);
-       spin_unlock(&mdev->peer_seq_lock);
+
+       /* Updating the RCU protected object in place is necessary since
+          this function gets called from atomic context.
+          It is valid since all other updates also lead to an completely
+          empty fifo */
+       rcu_read_lock();
+       plan = rcu_dereference(mdev->rs_plan_s);
+       plan->total = 0;
+       fifo_set(plan, 0);
+       rcu_read_unlock();
 }
 
 void start_resync_timer_fn(unsigned long data)
@@ -1471,12 +1514,12 @@ int w_start_resync(struct drbd_work *w, int cancel)
                dev_warn(DEV, "w_start_resync later...\n");
                mdev->start_resync_timer.expires = jiffies + HZ/10;
                add_timer(&mdev->start_resync_timer);
-               return 1;
+               return 0;
        }
 
        drbd_start_resync(mdev, C_SYNC_SOURCE);
-       clear_bit(AHEAD_TO_SYNC_SOURCE, &mdev->current_epoch->flags);
-       return 1;
+       clear_bit(AHEAD_TO_SYNC_SOURCE, &mdev->flags);
+       return 0;
 }
 
 /**
@@ -1515,7 +1558,7 @@ void drbd_start_resync(struct drbd_conf *mdev, enum drbd_conns side)
                        if (r > 0) {
                                dev_info(DEV, "before-resync-target handler returned %d, "
                                         "dropping connection.\n", r);
-                               drbd_force_state(mdev, NS(conn, C_DISCONNECTING));
+                               conn_request_state(mdev->tconn, NS(conn, C_DISCONNECTING), CS_HARD);
                                return;
                        }
                } else /* C_SYNC_SOURCE */ {
@@ -1528,7 +1571,7 @@ void drbd_start_resync(struct drbd_conf *mdev, enum drbd_conns side)
                                } else {
                                        dev_info(DEV, "before-resync-source handler returned %d, "
                                                 "dropping connection.\n", r);
-                                       drbd_force_state(mdev, NS(conn, C_DISCONNECTING));
+                                       conn_request_state(mdev->tconn, NS(conn, C_DISCONNECTING), CS_HARD);
                                        return;
                                }
                        }
@@ -1549,13 +1592,14 @@ void drbd_start_resync(struct drbd_conf *mdev, enum drbd_conns side)
        }
        clear_bit(B_RS_H_DONE, &mdev->flags);
 
+       write_lock_irq(&global_state_lock);
        if (!get_ldev_if_state(mdev, D_NEGOTIATING)) {
+               write_unlock_irq(&global_state_lock);
                mutex_unlock(mdev->state_mutex);
                return;
        }
 
-       write_lock_irq(&global_state_lock);
-       ns = mdev->state;
+       ns = drbd_read_state(mdev);
 
        ns.aftr_isp = !_drbd_may_sync_now(mdev);
 
@@ -1567,7 +1611,7 @@ void drbd_start_resync(struct drbd_conf *mdev, enum drbd_conns side)
                ns.pdsk = D_INCONSISTENT;
 
        r = __drbd_set_state(mdev, ns, CS_VERBOSE, NULL);
-       ns = mdev->state;
+       ns = drbd_read_state(mdev);
 
        if (ns.conn < C_CONNECTED)
                r = SS_UNKNOWN_ERROR;
@@ -1621,10 +1665,16 @@ void drbd_start_resync(struct drbd_conf *mdev, enum drbd_conns side)
                         * detect connection loss, then waiting for a ping
                         * response (implicit in drbd_resync_finished) reduces
                         * the race considerably, but does not solve it. */
-                       if (side == C_SYNC_SOURCE)
-                               schedule_timeout_interruptible(
-                                       mdev->tconn->net_conf->ping_int * HZ +
-                                       mdev->tconn->net_conf->ping_timeo*HZ/9);
+                       if (side == C_SYNC_SOURCE) {
+                               struct net_conf *nc;
+                               int timeo;
+
+                               rcu_read_lock();
+                               nc = rcu_dereference(mdev->tconn->net_conf);
+                               timeo = nc->ping_int * HZ + nc->ping_timeo * HZ / 9;
+                               rcu_read_unlock();
+                               schedule_timeout_interruptible(timeo);
+                       }
                        drbd_resync_finished(mdev);
                }
 
@@ -1642,43 +1692,35 @@ void drbd_start_resync(struct drbd_conf *mdev, enum drbd_conns side)
        mutex_unlock(mdev->state_mutex);
 }
 
-static int _worker_dying(int vnr, void *p, void *data)
-{
-       struct drbd_conf *mdev = (struct drbd_conf *)p;
-
-       D_ASSERT(mdev->state.disk == D_DISKLESS && mdev->state.conn == C_STANDALONE);
-       /* _drbd_set_state only uses stop_nowait.
-        * wait here for the exiting receiver. */
-       drbd_thread_stop(&mdev->tconn->receiver);
-       drbd_mdev_cleanup(mdev);
-
-       clear_bit(DEVICE_DYING, &mdev->flags);
-       clear_bit(CONFIG_PENDING, &mdev->flags);
-       wake_up(&mdev->state_wait);
-
-       return 0;
-}
-
 int drbd_worker(struct drbd_thread *thi)
 {
        struct drbd_tconn *tconn = thi->tconn;
        struct drbd_work *w = NULL;
+       struct drbd_conf *mdev;
+       struct net_conf *nc;
        LIST_HEAD(work_list);
-       int intr = 0;
+       int vnr, intr = 0;
+       int cork;
 
        while (get_t_state(thi) == RUNNING) {
                drbd_thread_current_set_cpu(thi);
 
                if (down_trylock(&tconn->data.work.s)) {
                        mutex_lock(&tconn->data.mutex);
-                       if (tconn->data.socket && !tconn->net_conf->no_cork)
+
+                       rcu_read_lock();
+                       nc = rcu_dereference(tconn->net_conf);
+                       cork = nc ? nc->tcp_cork : 0;
+                       rcu_read_unlock();
+
+                       if (tconn->data.socket && cork)
                                drbd_tcp_uncork(tconn->data.socket);
                        mutex_unlock(&tconn->data.mutex);
 
                        intr = down_interruptible(&tconn->data.work.s);
 
                        mutex_lock(&tconn->data.mutex);
-                       if (tconn->data.socket  && !tconn->net_conf->no_cork)
+                       if (tconn->data.socket  && cork)
                                drbd_tcp_cork(tconn->data.socket);
                        mutex_unlock(&tconn->data.mutex);
                }
@@ -1720,7 +1762,7 @@ int drbd_worker(struct drbd_thread *thi)
                list_del_init(&w->list);
                spin_unlock_irq(&tconn->data.work.q_lock);
 
-               if (!w->cb(w, tconn->cstate < C_WF_REPORT_PARAMS)) {
+               if (w->cb(w, tconn->cstate < C_WF_REPORT_PARAMS)) {
                        /* dev_warn(DEV, "worker: a callback failed! \n"); */
                        if (tconn->cstate >= C_WF_REPORT_PARAMS)
                                conn_request_state(tconn, NS(conn, C_NETWORK_FAILURE), CS_HARD);
@@ -1748,7 +1790,16 @@ int drbd_worker(struct drbd_thread *thi)
         */
        spin_unlock_irq(&tconn->data.work.q_lock);
 
-       idr_for_each(&tconn->volumes, _worker_dying, NULL);
+       rcu_read_lock();
+       idr_for_each_entry(&tconn->volumes, mdev, vnr) {
+               D_ASSERT(mdev->state.disk == D_DISKLESS && mdev->state.conn == C_STANDALONE);
+               kref_get(&mdev->kref);
+               rcu_read_unlock();
+               drbd_mdev_cleanup(mdev);
+               kref_put(&mdev->kref, &drbd_minor_destroy);
+               rcu_read_lock();
+       }
+       rcu_read_unlock();
 
        return 0;
 }