diff --git a/include/net/9p/transport.h b/include/net/9p/transport.h
index adbcafe99177..f9f362e934c9 100644
--- a/include/net/9p/transport.h
+++ b/include/net/9p/transport.h
@@ -40,7 +40,7 @@ struct p9_trans {
 	void (*close) (struct p9_trans *);
 	unsigned int (*poll)(struct p9_trans *, struct poll_table_struct *);
 	int (*rpc) (struct p9_trans *t, struct p9_fcall *tc,
-							struct p9_fcall **rc);
+				struct p9_fcall **rc, int msize, int dotu);
 };
 
 struct p9_trans_module {
diff --git a/net/9p/client.c b/net/9p/client.c
index b0d08c2375d0..433b30713ef6 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -51,7 +51,7 @@ p9_client_rpc(struct p9_client *c, struct p9_fcall *tc,
 	struct p9_fcall **rc)
 {
 	if (c->trans->rpc)
-		return c->trans->rpc(c->trans, tc, rc);
+		return c->trans->rpc(c->trans, tc, rc, c->msize, c->dotu);
 	else
 		return p9_conn_rpc(c->conn, tc, rc);
 }
@@ -99,7 +99,7 @@ struct p9_client *p9_client_create(struct p9_trans *trans, int msize,
 		goto error;
 	}
 
-	err = p9_client_rpc(clnt->conn, tc, &rc);
+	err = p9_client_rpc(clnt, tc, &rc);
 	if (err)
 		goto error;
 
@@ -191,7 +191,7 @@ struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
 		goto error;
 	}
 
-	err = p9_client_rpc(clnt->conn, tc, &rc);
+	err = p9_client_rpc(clnt, tc, &rc);
 	if (err)
 		goto error;
 
@@ -236,7 +236,7 @@ struct p9_fid *p9_client_auth(struct p9_client *clnt, char *uname,
 		goto error;
 	}
 
-	err = p9_client_rpc(clnt->conn, tc, &rc);
+	err = p9_client_rpc(clnt, tc, &rc);
 	if (err)
 		goto error;
 
@@ -287,7 +287,7 @@ struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
 		goto error;
 	}
 
-	err = p9_client_rpc(clnt->conn, tc, &rc);
+	err = p9_client_rpc(clnt, tc, &rc);
 	if (err) {
 		if (rc && rc->id == P9_RWALK)
 			goto clunk_fid;
@@ -322,7 +322,7 @@ clunk_fid:
 		goto error;
 	}
 
-	p9_client_rpc(clnt->conn, tc, &rc);
+	p9_client_rpc(clnt, tc, &rc);
 
 error:
 	kfree(tc);
@@ -356,7 +356,7 @@ int p9_client_open(struct p9_fid *fid, int mode)
 		goto done;
 	}
 
-	err = p9_client_rpc(clnt->conn, tc, &rc);
+	err = p9_client_rpc(clnt, tc, &rc);
 	if (err)
 		goto done;
 
@@ -395,7 +395,7 @@ int p9_client_fcreate(struct p9_fid *fid, char *name, u32 perm, int mode,
 		goto done;
 	}
 
-	err = p9_client_rpc(clnt->conn, tc, &rc);
+	err = p9_client_rpc(clnt, tc, &rc);
 	if (err)
 		goto done;
 
@@ -428,7 +428,7 @@ int p9_client_clunk(struct p9_fid *fid)
 		goto done;
 	}
 
-	err = p9_client_rpc(clnt->conn, tc, &rc);
+	err = p9_client_rpc(clnt, tc, &rc);
 	if (err)
 		goto done;
 
@@ -460,7 +460,7 @@ int p9_client_remove(struct p9_fid *fid)
 		goto done;
 	}
 
-	err = p9_client_rpc(clnt->conn, tc, &rc);
+	err = p9_client_rpc(clnt, tc, &rc);
 	if (err)
 		goto done;
 
@@ -502,7 +502,7 @@ int p9_client_read(struct p9_fid *fid, char *data, u64 offset, u32 count)
 			goto error;
 		}
 
-		err = p9_client_rpc(clnt->conn, tc, &rc);
+		err = p9_client_rpc(clnt, tc, &rc);
 		if (err)
 			goto error;
 
@@ -559,7 +559,7 @@ int p9_client_write(struct p9_fid *fid, char *data, u64 offset, u32 count)
 			goto error;
 		}
 
-		err = p9_client_rpc(clnt->conn, tc, &rc);
+		err = p9_client_rpc(clnt, tc, &rc);
 		if (err)
 			goto error;
 
@@ -613,7 +613,7 @@ p9_client_uread(struct p9_fid *fid, char __user *data, u64 offset, u32 count)
 			goto error;
 		}
 
-		err = p9_client_rpc(clnt->conn, tc, &rc);
+		err = p9_client_rpc(clnt, tc, &rc);
 		if (err)
 			goto error;
 
@@ -677,7 +677,7 @@ p9_client_uwrite(struct p9_fid *fid, const char __user *data, u64 offset,
 			goto error;
 		}
 
-		err = p9_client_rpc(clnt->conn, tc, &rc);
+		err = p9_client_rpc(clnt, tc, &rc);
 		if (err)
 			goto error;
 
@@ -748,7 +748,7 @@ struct p9_stat *p9_client_stat(struct p9_fid *fid)
 		goto error;
 	}
 
-	err = p9_client_rpc(clnt->conn, tc, &rc);
+	err = p9_client_rpc(clnt, tc, &rc);
 	if (err)
 		goto error;
 
@@ -790,7 +790,7 @@ int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
 		goto done;
 	}
 
-	err = p9_client_rpc(clnt->conn, tc, &rc);
+	err = p9_client_rpc(clnt, tc, &rc);
 
 done:
 	kfree(tc);
@@ -847,7 +847,7 @@ struct p9_stat *p9_client_dirread(struct p9_fid *fid, u64 offset)
 				goto error;
 			}
 
-			err = p9_client_rpc(clnt->conn, tc, &rc);
+			err = p9_client_rpc(clnt, tc, &rc);
 			if (err)
 				goto error;
 
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 42eea5fe2628..0f590227943b 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -1,17 +1,8 @@
 /*
  * The Guest 9p transport driver
  *
- * This is a trivial pipe-based transport driver based on the lguest console
- * code: we use lguest's DMA mechanism to send bytes out, and register a
- * DMA buffer to receive bytes in.  It is assumed to be present and available
- * from the very beginning of boot.
- *
- * This may be have been done by just instaniating another HVC console,
- * but HVC's blocksize of 16 bytes is annoying and painful to performance.
- *
- * A more efficient transport could be built based on the virtio block driver
- * but it requires some changes in the 9p transport model (which are in
- * progress)
+ * This is a block based transport driver based on the lguest block driver
+ * code.
  *
  */
 /*
@@ -55,11 +46,25 @@
 #include <linux/virtio.h>
 #include <linux/virtio_9p.h>
 
+#define VIRTQUEUE_NUM	128
+
 /* a single mutex to manage channel initialization and attachment */
 static DECLARE_MUTEX(virtio_9p_lock);
 /* global which tracks highest initialized channel */
 static int chan_index;
 
+#define P9_INIT_MAXTAG	16
+
+#define REQ_STATUS_IDLE	0
+#define REQ_STATUS_SENT 1
+#define REQ_STATUS_RCVD 2
+#define REQ_STATUS_FLSH 3
+
+struct p9_req_t {
+	int status;
+	wait_queue_head_t *wq;
+};
+
 /* We keep all per-channel information in a structure.
  * This structure is allocated within the devices dev->mem space.
  * A pointer to the structure will get put in the transport private.
@@ -68,16 +73,57 @@ static struct virtio_chan {
 	bool initialized;		/* channel is initialized */
 	bool inuse;			/* channel is in use */
 
-	struct virtqueue *in_vq, *out_vq;
+	spinlock_t lock;
+
 	struct virtio_device *vdev;
+	struct virtqueue *vq;
 
-	/* This is our input buffer, and how much data is left in it. */
-	unsigned int in_len;
-	char *in, *inbuf;
+	struct p9_idpool *tagpool;
+	struct p9_req_t *reqs;
+	int max_tag;
 
-	wait_queue_head_t wq;		/* waitq for buffer */
+	/* Scatterlist: can be too big for stack. */
+	struct scatterlist sg[VIRTQUEUE_NUM];
 } channels[MAX_9P_CHAN];
 
+/* Lookup requests by tag */
+static struct p9_req_t *p9_lookup_tag(struct virtio_chan *c, u16 tag)
+{
+	/* This looks up the original request by tag so we know which
+	 * buffer to read the data into */
+	tag++;
+
+	while (tag >= c->max_tag) {
+		int old_max = c->max_tag;
+		int count;
+
+		if (c->max_tag)
+			c->max_tag *= 2;
+		else
+			c->max_tag = P9_INIT_MAXTAG;
+
+		c->reqs = krealloc(c->reqs, sizeof(struct p9_req_t)*c->max_tag,
+								GFP_ATOMIC);
+		if (!c->reqs) {
+			printk(KERN_ERR "Couldn't grow tag array\n");
+			BUG();
+		}
+		for (count = old_max; count < c->max_tag; count++) {
+			c->reqs[count].status = REQ_STATUS_IDLE;
+			c->reqs[count].wq = kmalloc(sizeof(wait_queue_t),
+								GFP_ATOMIC);
+			if (!c->reqs[count].wq) {
+				printk(KERN_ERR "Couldn't grow tag array\n");
+				BUG();
+			}
+			init_waitqueue_head(c->reqs[count].wq);
+		}
+	}
+
+	return &c->reqs[tag];
+}
+
+
 /* How many bytes left in this page. */
 static unsigned int rest_of_page(void *data)
 {
@@ -86,83 +132,14 @@ static unsigned int rest_of_page(void *data)
 
 static int p9_virtio_write(struct p9_trans *trans, void *buf, int count)
 {
-	struct virtio_chan *chan = (struct virtio_chan *) trans->priv;
-	struct virtqueue *out_vq = chan->out_vq;
-	struct scatterlist sg[1];
-	unsigned int len;
-
-	P9_DPRINTK(P9_DEBUG_TRANS, "9p debug: virtio write (%d)\n", count);
-
-	/* keep it simple - make sure we don't overflow a page */
-	if (rest_of_page(buf) < count)
-		count = rest_of_page(buf);
-
-	sg_init_one(sg, buf, count);
-
-	/* add_buf wants a token to identify this buffer: we hand it any
-	 * non-NULL pointer, since there's only ever one buffer. */
-	if (out_vq->vq_ops->add_buf(out_vq, sg, 1, 0, (void *)1) == 0) {
-		/* Tell Host to go! */
-		out_vq->vq_ops->kick(out_vq);
-		/* Chill out until it's done with the buffer. */
-		while (!out_vq->vq_ops->get_buf(out_vq, &len))
-			cpu_relax();
-	}
-
-	P9_DPRINTK(P9_DEBUG_TRANS, "9p debug: virtio wrote (%d)\n", count);
-
-	/* We're expected to return the amount of data we wrote: all of it. */
+	/* Only use the rpc mechanism for now */
 	return count;
 }
 
-/* Create a scatter-gather list representing our input buffer and put it in the
- * queue. */
-static void add_inbuf(struct virtio_chan *chan)
-{
-	struct scatterlist sg[1];
-
-	sg_init_one(sg, chan->inbuf, PAGE_SIZE);
-
-	/* We should always be able to add one buffer to an empty queue. */
-	if (chan->in_vq->vq_ops->add_buf(chan->in_vq, sg, 0, 1, chan->inbuf))
-		BUG();
-	chan->in_vq->vq_ops->kick(chan->in_vq);
-}
-
 static int p9_virtio_read(struct p9_trans *trans, void *buf, int count)
 {
-	struct virtio_chan *chan = (struct virtio_chan *) trans->priv;
-	struct virtqueue *in_vq = chan->in_vq;
-
-	P9_DPRINTK(P9_DEBUG_TRANS, "9p debug: virtio read (%d)\n", count);
-
-	/* If we don't have an input queue yet, we can't get input. */
-	BUG_ON(!in_vq);
-
-	/* No buffer?  Try to get one. */
-	if (!chan->in_len) {
-		chan->in = in_vq->vq_ops->get_buf(in_vq, &chan->in_len);
-		if (!chan->in)
-			return 0;
-	}
-
-	/* You want more than we have to give?  Well, try wanting less! */
-	if (chan->in_len < count)
-		count = chan->in_len;
-
-	/* Copy across to their buffer and increment offset. */
-	memcpy(buf, chan->in, count);
-	chan->in += count;
-	chan->in_len -= count;
-
-	/* Finished?  Re-register buffer so Host will use it again. */
-	if (chan->in_len == 0)
-		add_inbuf(chan);
-
-	P9_DPRINTK(P9_DEBUG_TRANS, "9p debug: virtio finished read (%d)\n",
-									count);
-
-	return count;
+	/* Only use the rpc mechanism for now */
+	return 0;
 }
 
 /* The poll function is used by 9p transports to determine if there
@@ -172,25 +149,23 @@ static int p9_virtio_read(struct p9_trans *trans, void *buf, int count)
 static unsigned int
 p9_virtio_poll(struct p9_trans *trans, struct poll_table_struct *pt)
 {
-	struct virtio_chan *chan = (struct virtio_chan *)trans->priv;
-	struct virtqueue *in_vq = chan->in_vq;
-	int ret = POLLOUT; /* we can always handle more output */
-
-	poll_wait(NULL, &chan->wq, pt);
-
-	/* No buffer?  Try to get one. */
-	if (!chan->in_len)
-		chan->in = in_vq->vq_ops->get_buf(in_vq, &chan->in_len);
-
-	if (chan->in_len)
-		ret |= POLLIN;
-
-	return ret;
+	/* Only use the rpc mechanism for now */
+	return 0;
 }
 
 static void p9_virtio_close(struct p9_trans *trans)
 {
 	struct virtio_chan *chan = trans->priv;
+	int count;
+	unsigned int flags;
+
+	spin_lock_irqsave(&chan->lock, flags);
+	p9_idpool_destroy(chan->tagpool);
+	for (count = 0; count < chan->max_tag; count++)
+		kfree(chan->reqs[count].wq);
+	kfree(chan->reqs);
+	chan->max_tag = 0;
+	spin_unlock_irqrestore(&chan->lock, flags);
 
 	down(&virtio_9p_lock);
 	chan->inuse = false;
@@ -199,15 +174,121 @@ static void p9_virtio_close(struct p9_trans *trans)
 	kfree(trans);
 }
 
-static void p9_virtio_intr(struct virtqueue *q)
+static void req_done(struct virtqueue *vq)
 {
-	struct virtio_chan *chan = q->vdev->priv;
+	struct virtio_chan *chan = vq->vdev->priv;
+	struct p9_fcall *rc;
+	unsigned int len;
+	unsigned long flags;
+	struct p9_req_t *req;
 
-	P9_DPRINTK(P9_DEBUG_TRANS, "9p poll_wakeup: %p\n", &chan->wq);
-	wake_up_interruptible(&chan->wq);
+	spin_lock_irqsave(&chan->lock, flags);
+	while ((rc = chan->vq->vq_ops->get_buf(chan->vq, &len)) != NULL) {
+		req = p9_lookup_tag(chan, rc->tag);
+		req->status = REQ_STATUS_RCVD;
+		wake_up(req->wq);
+	}
+	/* In case queue is stopped waiting for more buffers. */
+	spin_unlock_irqrestore(&chan->lock, flags);
 }
 
-static int p9_virtio_probe(struct virtio_device *dev)
+static int
+pack_sg_list(struct scatterlist *sg, int start, int limit, char *data,
+								int count)
+{
+	int s;
+	int index = start;
+
+	while (count) {
+		s = rest_of_page(data);
+		if (s > count)
+			s = count;
+		sg_set_buf(&sg[index++], data, s);
+		count -= s;
+		data += s;
+		if (index > limit)
+			BUG();
+	}
+
+	return index-start;
+}
+
+static int
+p9_virtio_rpc(struct p9_trans *t, struct p9_fcall *tc, struct p9_fcall **rc,
+		int msize, int dotu)
+{
+	int in, out;
+	int n, err, size;
+	struct virtio_chan *chan = t->priv;
+	char *rdata;
+	struct p9_req_t *req;
+	unsigned long flags;
+
+	if (*rc == NULL) {
+		*rc = kmalloc(sizeof(struct p9_fcall) + msize, GFP_KERNEL);
+		if (!*rc)
+			return -ENOMEM;
+	}
+
+	rdata = (char *)*rc+sizeof(struct p9_fcall);
+
+	spin_lock_irqsave(&chan->lock, flags);
+	n = P9_NOTAG;
+	if (tc->id != P9_TVERSION) {
+		n = p9_idpool_get(chan->tagpool);
+		if (n < 0)
+			return -ENOMEM;
+	}
+
+	req = p9_lookup_tag(chan, n);
+	spin_unlock_irqrestore(&chan->lock, flags);
+
+	p9_set_tag(tc, n);
+
+	P9_DPRINTK(P9_DEBUG_TRANS, "9p debug: virtio rpc tag %d\n", n);
+
+	out = pack_sg_list(chan->sg, 0, VIRTQUEUE_NUM, tc->sdata, tc->size);
+	in = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM-out, rdata, msize);
+
+	req->status = REQ_STATUS_SENT;
+
+	if (chan->vq->vq_ops->add_buf(chan->vq, chan->sg, out, in, tc)) {
+		P9_DPRINTK(P9_DEBUG_TRANS,
+			"9p debug: virtio rpc add_buf returned failure");
+		return -EIO;
+	}
+
+	chan->vq->vq_ops->kick(chan->vq);
+
+	wait_event(*req->wq, req->status == REQ_STATUS_RCVD);
+
+	size = le32_to_cpu(*(__le32 *) rdata);
+
+	err = p9_deserialize_fcall(rdata, size, *rc, dotu);
+	if (err < 0) {
+		P9_DPRINTK(P9_DEBUG_TRANS,
+			"9p debug: virtio rpc deserialize returned %d\n", err);
+		return err;
+	}
+
+#ifdef CONFIG_NET_9P_DEBUG
+	if ((p9_debug_level&P9_DEBUG_FCALL) == P9_DEBUG_FCALL) {
+		char buf[150];
+
+		p9_printfcall(buf, sizeof(buf), *rc, dotu);
+		printk(KERN_NOTICE ">>> %p %s\n", t, buf);
+	}
+#endif
+
+	if (n != P9_NOTAG && p9_idpool_check(n, chan->tagpool))
+		p9_idpool_put(n, chan->tagpool);
+
+	req->status = REQ_STATUS_IDLE;
+
+	return 0;
+}
+
+static int p9_virtio_probe(struct virtio_device *vdev)
 {
 	int err;
 	struct virtio_chan *chan;
@@ -221,44 +302,29 @@ static int p9_virtio_probe(struct virtio_device *dev)
 	if (chan_index > MAX_9P_CHAN) {
 		printk(KERN_ERR "9p: virtio: Maximum channels exceeded\n");
 		BUG();
-	}
-
-	chan->vdev = dev;
-
-	/* This is the scratch page we use to receive console input */
-	chan->inbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
-	if (!chan->inbuf) {
 		err = -ENOMEM;
 		goto fail;
 	}
 
-	/* Find the input queue. */
-	dev->priv = chan;
-	chan->in_vq = dev->config->find_vq(dev, 0, p9_virtio_intr);
-	if (IS_ERR(chan->in_vq)) {
-		err = PTR_ERR(chan->in_vq);
-		goto free;
+	chan->vdev = vdev;
+
+	/* We expect one virtqueue, for requests. */
+	chan->vq = vdev->config->find_vq(vdev, 0, req_done);
+	if (IS_ERR(chan->vq)) {
+		err = PTR_ERR(chan->vq);
+		goto out_free_vq;
 	}
+	chan->vq->vdev->priv = chan;
+	spin_lock_init(&chan->lock);
 
-	chan->out_vq = dev->config->find_vq(dev, 1, NULL);
-	if (IS_ERR(chan->out_vq)) {
-		err = PTR_ERR(chan->out_vq);
-		goto free_in_vq;
-	}
+	sg_init_table(chan->sg, VIRTQUEUE_NUM);
 
-	init_waitqueue_head(&chan->wq);
-
-	/* Register the input buffer the first time. */
-	add_inbuf(chan);
 	chan->inuse = false;
 	chan->initialized = true;
-
 	return 0;
 
-free_in_vq:
-	dev->config->del_vq(chan->in_vq);
-free:
-	kfree(chan->inbuf);
+out_free_vq:
+	vdev->config->del_vq(chan->vq);
 fail:
 	down(&virtio_9p_lock);
 	chan_index--;
@@ -274,8 +340,8 @@ fail:
 static struct p9_trans *p9_virtio_create(const char *devname, char *args)
 {
 	struct p9_trans *trans;
-	int index = 0;
 	struct virtio_chan *chan = channels;
+	int index = 0;
 
 	down(&virtio_9p_lock);
 	while (index < MAX_9P_CHAN) {
@@ -290,10 +356,19 @@ static struct p9_trans *p9_virtio_create(const char *devname, char *args)
 	up(&virtio_9p_lock);
 
 	if (index >= MAX_9P_CHAN) {
-		printk(KERN_ERR "9p: virtio: couldn't find a free channel\n");
-		return NULL;
+		printk(KERN_ERR "9p: no channels available\n");
+		return ERR_PTR(-ENODEV);
 	}
 
+	chan->tagpool = p9_idpool_create();
+	if (IS_ERR(chan->tagpool)) {
+		printk(KERN_ERR "9p: couldn't allocate tagpool\n");
+		return ERR_PTR(-ENOMEM);
+	}
+	p9_idpool_get(chan->tagpool); /* reserve tag 0 */
+	chan->max_tag = 0;
+	chan->reqs = NULL;
+
 	trans = kmalloc(sizeof(struct p9_trans), GFP_KERNEL);
 	if (!trans) {
 		printk(KERN_ERR "9p: couldn't allocate transport\n");
@@ -304,6 +379,7 @@ static struct p9_trans *p9_virtio_create(const char *devname, char *args)
 	trans->read = p9_virtio_read;
 	trans->close = p9_virtio_close;
 	trans->poll = p9_virtio_poll;
+	trans->rpc = p9_virtio_rpc;
 	trans->priv = chan;
 
 	return trans;
@@ -327,7 +403,7 @@ static struct virtio_driver p9_virtio_drv = {
 static struct p9_trans_module p9_virtio_trans = {
 	.name = "virtio",
 	.create = p9_virtio_create,
-	.maxsize = PAGE_SIZE,
+	.maxsize = PAGE_SIZE*16,
 	.def = 0,
 };