]> err.no Git - linux-2.6/blobdiff - fs/nfs/direct.c
NFS: Eliminate nfs_get_user_pages()
[linux-2.6] / fs / nfs / direct.c
index bcbc213b4033575bfbe3b617ad71dfd3626263f2..b1630d53fbb1fa4484ddd16c160c4cdadb210631 100644 (file)
@@ -58,9 +58,7 @@
 #include "iostat.h"
 
 #define NFSDBG_FACILITY                NFSDBG_VFS
-#define MAX_DIRECTIO_SIZE      (4096UL << PAGE_SHIFT)
 
-static void nfs_free_user_pages(struct page **pages, int npages, int do_dirty);
 static kmem_cache_t *nfs_direct_cachep;
 
 /*
@@ -68,18 +66,55 @@ static kmem_cache_t *nfs_direct_cachep;
  */
 struct nfs_direct_req {
        struct kref             kref;           /* release manager */
-       struct list_head        list;           /* nfs_read/write_data structs */
-       struct file *           filp;           /* file descriptor */
+
+       /* I/O parameters */
+       struct list_head        list,           /* nfs_read/write_data structs */
+                               rewrite_list;   /* saved nfs_write_data structs */
+       struct nfs_open_context *ctx;           /* file open context info */
        struct kiocb *          iocb;           /* controlling i/o request */
-       wait_queue_head_t       wait;           /* wait for i/o completion */
        struct inode *          inode;          /* target file of i/o */
-       struct page **          pages;          /* pages in our buffer */
-       unsigned int            npages;         /* count of pages */
-       atomic_t                complete,       /* i/os we're waiting for */
-                               count,          /* bytes actually processed */
+
+       /* completion state */
+       atomic_t                io_count;       /* i/os we're waiting for */
+       spinlock_t              lock;           /* protect completion state */
+       ssize_t                 count,          /* bytes actually processed */
                                error;          /* any reported error */
+       struct completion       completion;     /* wait for i/o completion */
+
+       /* commit state */
+       struct nfs_write_data * commit_data;    /* special write_data for commits */
+       int                     flags;
+#define NFS_ODIRECT_DO_COMMIT          (1)     /* an unstable reply was received */
+#define NFS_ODIRECT_RESCHED_WRITES     (2)     /* write verification failed */
+       struct nfs_writeverf    verf;           /* unstable write verifier */
 };
 
+static void nfs_direct_write_complete(struct nfs_direct_req *dreq, struct inode *inode);
+static const struct rpc_call_ops nfs_write_direct_ops;
+
+static inline void get_dreq(struct nfs_direct_req *dreq)
+{
+       atomic_inc(&dreq->io_count);
+}
+
+static inline int put_dreq(struct nfs_direct_req *dreq)
+{
+       return atomic_dec_and_test(&dreq->io_count);
+}
+
+/*
+ * "size" is never larger than rsize or wsize.
+ */
+static inline int nfs_direct_count_pages(unsigned long user_addr, size_t size)
+{
+       int page_count;
+
+       page_count = (user_addr + size + PAGE_SIZE - 1) >> PAGE_SHIFT;
+       page_count -= user_addr >> PAGE_SHIFT;
+       BUG_ON(page_count < 0);
+
+       return page_count;
+}
 
 /**
  * nfs_direct_IO - NFS address space operation for direct I/O
@@ -96,60 +131,28 @@ struct nfs_direct_req {
  */
 ssize_t nfs_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov, loff_t pos, unsigned long nr_segs)
 {
-       struct dentry *dentry = iocb->ki_filp->f_dentry;
-
        dprintk("NFS: nfs_direct_IO (%s) off/no(%Ld/%lu) EINVAL\n",
-                       dentry->d_name.name, (long long) pos, nr_segs);
+                       iocb->ki_filp->f_dentry->d_name.name,
+                       (long long) pos, nr_segs);
 
        return -EINVAL;
 }
 
-static inline int nfs_get_user_pages(int rw, unsigned long user_addr, size_t size, struct page ***pages)
-{
-       int result = -ENOMEM;
-       unsigned long page_count;
-       size_t array_size;
-
-       /* set an arbitrary limit to prevent type overflow */
-       if (size > MAX_DIRECTIO_SIZE) {
-               *pages = NULL;
-               return -EFBIG;
-       }
-
-       page_count = (user_addr + size + PAGE_SIZE - 1) >> PAGE_SHIFT;
-       page_count -= user_addr >> PAGE_SHIFT;
-
-       array_size = (page_count * sizeof(struct page *));
-       *pages = kmalloc(array_size, GFP_KERNEL);
-       if (*pages) {
-               down_read(&current->mm->mmap_sem);
-               result = get_user_pages(current, current->mm, user_addr,
-                                       page_count, (rw == READ), 0,
-                                       *pages, NULL);
-               up_read(&current->mm->mmap_sem);
-               /*
-                * If we got fewer pages than expected from get_user_pages(),
-                * the user buffer runs off the end of a mapping; return EFAULT.
-                */
-               if (result >= 0 && result < page_count) {
-                       nfs_free_user_pages(*pages, result, 0);
-                       *pages = NULL;
-                       result = -EFAULT;
-               }
-       }
-       return result;
-}
-
-static void nfs_free_user_pages(struct page **pages, int npages, int do_dirty)
+static void nfs_direct_dirty_pages(struct page **pages, int npages)
 {
        int i;
        for (i = 0; i < npages; i++) {
                struct page *page = pages[i];
-               if (do_dirty && !PageCompound(page))
+               if (!PageCompound(page))
                        set_page_dirty_lock(page);
-               page_cache_release(page);
        }
-       kfree(pages);
+}
+
+static void nfs_direct_release_pages(struct page **pages, int npages)
+{
+       int i;
+       for (i = 0; i < npages; i++)
+               page_cache_release(pages[i]);
 }
 
 static inline struct nfs_direct_req *nfs_direct_req_alloc(void)
@@ -161,11 +164,16 @@ static inline struct nfs_direct_req *nfs_direct_req_alloc(void)
                return NULL;
 
        kref_init(&dreq->kref);
-       init_waitqueue_head(&dreq->wait);
+       init_completion(&dreq->completion);
        INIT_LIST_HEAD(&dreq->list);
+       INIT_LIST_HEAD(&dreq->rewrite_list);
        dreq->iocb = NULL;
-       atomic_set(&dreq->count, 0);
-       atomic_set(&dreq->error, 0);
+       dreq->ctx = NULL;
+       spin_lock_init(&dreq->lock);
+       atomic_set(&dreq->io_count, 0);
+       dreq->count = 0;
+       dreq->error = 0;
+       dreq->flags = 0;
 
        return dreq;
 }
@@ -173,6 +181,9 @@ static inline struct nfs_direct_req *nfs_direct_req_alloc(void)
 static void nfs_direct_req_release(struct kref *kref)
 {
        struct nfs_direct_req *dreq = container_of(kref, struct nfs_direct_req, kref);
+
+       if (dreq->ctx != NULL)
+               put_nfs_open_context(dreq->ctx);
        kmem_cache_free(nfs_direct_cachep, dreq);
 }
 
@@ -181,19 +192,18 @@ static void nfs_direct_req_release(struct kref *kref)
  */
 static ssize_t nfs_direct_wait(struct nfs_direct_req *dreq)
 {
-       int result = -EIOCBQUEUED;
+       ssize_t result = -EIOCBQUEUED;
 
        /* Async requests don't wait here */
        if (dreq->iocb)
                goto out;
 
-       result = wait_event_interruptible(dreq->wait,
-                                       (atomic_read(&dreq->complete) == 0));
+       result = wait_for_completion_interruptible(&dreq->completion);
 
        if (!result)
-               result = atomic_read(&dreq->error);
+               result = dreq->error;
        if (!result)
-               result = atomic_read(&dreq->count);
+               result = dreq->count;
 
 out:
        kref_put(&dreq->kref, nfs_direct_req_release);
@@ -201,25 +211,18 @@ out:
 }
 
 /*
- * We must hold a reference to all the pages in this direct read request
- * until the RPCs complete.  This could be long *after* we are woken up in
- * nfs_direct_wait (for instance, if someone hits ^C on a slow server).
- *
- * In addition, synchronous I/O uses a stack-allocated iocb.  Thus we
- * can't trust the iocb is still valid here if this is a synchronous
- * request.  If the waiter is woken prematurely, the iocb is long gone.
+ * Synchronous I/O uses a stack-allocated iocb.  Thus we can't trust
+ * the iocb is still valid here if this is a synchronous request.
  */
 static void nfs_direct_complete(struct nfs_direct_req *dreq)
 {
-       nfs_free_user_pages(dreq->pages, dreq->npages, 1);
-
        if (dreq->iocb) {
-               long res = atomic_read(&dreq->error);
+               long res = (long) dreq->error;
                if (!res)
-                       res = atomic_read(&dreq->count);
+                       res = (long) dreq->count;
                aio_complete(dreq->iocb, res, 0);
-       } else
-               wake_up(&dreq->wait);
+       }
+       complete_all(&dreq->completion);
 
        kref_put(&dreq->kref, nfs_direct_req_release);
 }
@@ -233,7 +236,6 @@ static struct nfs_direct_req *nfs_direct_read_alloc(size_t nbytes, size_t rsize)
 {
        struct list_head *list;
        struct nfs_direct_req *dreq;
-       unsigned int reads = 0;
        unsigned int rpages = (rsize + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
 
        dreq = nfs_direct_req_alloc();
@@ -259,16 +261,20 @@ static struct nfs_direct_req *nfs_direct_read_alloc(size_t nbytes, size_t rsize)
                list_add(&data->pages, list);
 
                data->req = (struct nfs_page *) dreq;
-               reads++;
+               get_dreq(dreq);
                if (nbytes <= rsize)
                        break;
                nbytes -= rsize;
        }
        kref_get(&dreq->kref);
-       atomic_set(&dreq->complete, reads);
        return dreq;
 }
 
+/*
+ * We must hold a reference to all the pages in this direct read request
+ * until the RPCs complete.  This could be long *after* we are woken up in
+ * nfs_direct_wait (for instance, if someone hits ^C on a slow server).
+ */
 static void nfs_direct_read_result(struct rpc_task *task, void *calldata)
 {
        struct nfs_read_data *data = calldata;
@@ -276,12 +282,20 @@ static void nfs_direct_read_result(struct rpc_task *task, void *calldata)
 
        if (nfs_readpage_result(task, data) != 0)
                return;
+
+       nfs_direct_dirty_pages(data->pagevec, data->npages);
+       nfs_direct_release_pages(data->pagevec, data->npages);
+
+       spin_lock(&dreq->lock);
+
        if (likely(task->tk_status >= 0))
-               atomic_add(data->res.count, &dreq->count);
+               dreq->count += data->res.count;
        else
-               atomic_set(&dreq->error, task->tk_status);
+               dreq->error = task->tk_status;
+
+       spin_unlock(&dreq->lock);
 
-       if (unlikely(atomic_dec_and_test(&dreq->complete)))
+       if (put_dreq(dreq))
                nfs_direct_complete(dreq);
 }
 
@@ -292,39 +306,48 @@ static const struct rpc_call_ops nfs_read_direct_ops = {
 
 /*
  * For each nfs_read_data struct that was allocated on the list, dispatch
- * an NFS READ operation
+ * an NFS READ operation.  If get_user_pages() fails, we stop sending reads.
+ * Read length accounting is handled by nfs_direct_read_result().
+ * Otherwise, if no requests have been sent, just return an error.
  */
-static void nfs_direct_read_schedule(struct nfs_direct_req *dreq, unsigned long user_addr, size_t count, loff_t pos)
+static ssize_t nfs_direct_read_schedule(struct nfs_direct_req *dreq, unsigned long user_addr, size_t count, loff_t pos)
 {
-       struct file *file = dreq->filp;
-       struct inode *inode = file->f_mapping->host;
-       struct nfs_open_context *ctx = (struct nfs_open_context *)
-                                                       file->private_data;
+       struct nfs_open_context *ctx = dreq->ctx;
+       struct inode *inode = ctx->dentry->d_inode;
        struct list_head *list = &dreq->list;
-       struct page **pages = dreq->pages;
        size_t rsize = NFS_SERVER(inode)->rsize;
-       unsigned int curpage, pgbase;
+       unsigned int pgbase;
+       int result;
+       ssize_t started = 0;
+       struct nfs_read_data *data;
 
-       curpage = 0;
        pgbase = user_addr & ~PAGE_MASK;
        do {
-               struct nfs_read_data *data;
                size_t bytes;
 
                bytes = rsize;
                if (count < rsize)
                        bytes = count;
 
+               BUG_ON(list_empty(list));
                data = list_entry(list->next, struct nfs_read_data, pages);
                list_del_init(&data->pages);
 
+               data->npages = nfs_direct_count_pages(user_addr, bytes);
+               down_read(&current->mm->mmap_sem);
+               result = get_user_pages(current, current->mm, user_addr,
+                                       data->npages, 1, 0, data->pagevec, NULL);
+               up_read(&current->mm->mmap_sem);
+               if (unlikely(result < data->npages))
+                       goto out_err;
+
                data->inode = inode;
                data->cred = ctx->cred;
                data->args.fh = NFS_FH(inode);
                data->args.context = ctx;
                data->args.offset = pos;
                data->args.pgbase = pgbase;
-               data->args.pages = &pages[curpage];
+               data->args.pages = data->pagevec;
                data->args.count = bytes;
                data->res.fattr = &data->fattr;
                data->res.eof = 0;
@@ -340,23 +363,43 @@ static void nfs_direct_read_schedule(struct nfs_direct_req *dreq, unsigned long
                rpc_execute(&data->task);
                unlock_kernel();
 
-               dfprintk(VFS, "NFS: %4d initiated direct read call (req %s/%Ld, %u bytes @ offset %Lu)\n",
+               dfprintk(VFS, "NFS: %5u initiated direct read call (req %s/%Ld, %zu bytes @ offset %Lu)\n",
                                data->task.tk_pid,
                                inode->i_sb->s_id,
                                (long long)NFS_FILEID(inode),
                                bytes,
                                (unsigned long long)data->args.offset);
 
+               started += bytes;
+               user_addr += bytes;
                pos += bytes;
                pgbase += bytes;
-               curpage += pgbase >> PAGE_SHIFT;
                pgbase &= ~PAGE_MASK;
 
                count -= bytes;
        } while (count != 0);
+       BUG_ON(!list_empty(list));
+       return 0;
+
+out_err:
+       if (result > 0)
+               nfs_direct_release_pages(data->pagevec, result);
+
+       list_add(&data->pages, list);
+       while (!list_empty(list)) {
+               data = list_entry(list->next, struct nfs_read_data, pages);
+               list_del(&data->pages);
+               nfs_readdata_free(data);
+               if (put_dreq(dreq))
+                       nfs_direct_complete(dreq);
+       }
+
+       if (started)
+               return 0;
+       return result < 0 ? (ssize_t) result : -EFAULT;
 }
 
-static ssize_t nfs_direct_read(struct kiocb *iocb, unsigned long user_addr, size_t count, loff_t pos, struct page **pages, unsigned int nr_pages)
+static ssize_t nfs_direct_read(struct kiocb *iocb, unsigned long user_addr, size_t count, loff_t pos)
 {
        ssize_t result;
        sigset_t oldset;
@@ -368,27 +411,183 @@ static ssize_t nfs_direct_read(struct kiocb *iocb, unsigned long user_addr, size
        if (!dreq)
                return -ENOMEM;
 
-       dreq->pages = pages;
-       dreq->npages = nr_pages;
        dreq->inode = inode;
-       dreq->filp = iocb->ki_filp;
+       dreq->ctx = get_nfs_open_context((struct nfs_open_context *)iocb->ki_filp->private_data);
        if (!is_sync_kiocb(iocb))
                dreq->iocb = iocb;
 
        nfs_add_stats(inode, NFSIOS_DIRECTREADBYTES, count);
        rpc_clnt_sigmask(clnt, &oldset);
-       nfs_direct_read_schedule(dreq, user_addr, count, pos);
-       result = nfs_direct_wait(dreq);
+       result = nfs_direct_read_schedule(dreq, user_addr, count, pos);
+       if (!result)
+               result = nfs_direct_wait(dreq);
        rpc_clnt_sigunmask(clnt, &oldset);
 
        return result;
 }
 
+static void nfs_direct_free_writedata(struct nfs_direct_req *dreq)
+{
+       list_splice_init(&dreq->rewrite_list, &dreq->list);
+       while (!list_empty(&dreq->list)) {
+               struct nfs_write_data *data = list_entry(dreq->list.next, struct nfs_write_data, pages);
+               list_del(&data->pages);
+               nfs_direct_release_pages(data->pagevec, data->npages);
+               nfs_writedata_release(data);
+       }
+}
+
+#if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
+static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
+{
+       struct inode *inode = dreq->inode;
+       struct list_head *p;
+       struct nfs_write_data *data;
+
+       dreq->count = 0;
+       get_dreq(dreq);
+
+       list_for_each(p, &dreq->rewrite_list) {
+               data = list_entry(p, struct nfs_write_data, pages);
+
+               get_dreq(dreq);
+
+               /*
+                * Reset data->res.
+                */
+               nfs_fattr_init(&data->fattr);
+               data->res.count = data->args.count;
+               memset(&data->verf, 0, sizeof(data->verf));
+
+               /*
+                * Reuse data->task; data->args should not have changed
+                * since the original request was sent.
+                */
+               rpc_init_task(&data->task, NFS_CLIENT(inode), RPC_TASK_ASYNC,
+                               &nfs_write_direct_ops, data);
+               NFS_PROTO(inode)->write_setup(data, FLUSH_STABLE);
+
+               data->task.tk_priority = RPC_PRIORITY_NORMAL;
+               data->task.tk_cookie = (unsigned long) inode;
+
+               /*
+                * We're called via an RPC callback, so BKL is already held.
+                */
+               rpc_execute(&data->task);
+
+               dprintk("NFS: %5u rescheduled direct write call (req %s/%Ld, %u bytes @ offset %Lu)\n",
+                               data->task.tk_pid,
+                               inode->i_sb->s_id,
+                               (long long)NFS_FILEID(inode),
+                               data->args.count,
+                               (unsigned long long)data->args.offset);
+       }
+
+       if (put_dreq(dreq))
+               nfs_direct_write_complete(dreq, inode);
+}
+
+static void nfs_direct_commit_result(struct rpc_task *task, void *calldata)
+{
+       struct nfs_write_data *data = calldata;
+       struct nfs_direct_req *dreq = (struct nfs_direct_req *) data->req;
+
+       /* Call the NFS version-specific code */
+       if (NFS_PROTO(data->inode)->commit_done(task, data) != 0)
+               return;
+       if (unlikely(task->tk_status < 0)) {
+               dreq->error = task->tk_status;
+               dreq->flags = NFS_ODIRECT_RESCHED_WRITES;
+       }
+       if (memcmp(&dreq->verf, &data->verf, sizeof(data->verf))) {
+               dprintk("NFS: %5u commit verify failed\n", task->tk_pid);
+               dreq->flags = NFS_ODIRECT_RESCHED_WRITES;
+       }
+
+       dprintk("NFS: %5u commit returned %d\n", task->tk_pid, task->tk_status);
+       nfs_direct_write_complete(dreq, data->inode);
+}
+
+static const struct rpc_call_ops nfs_commit_direct_ops = {
+       .rpc_call_done = nfs_direct_commit_result,
+       .rpc_release = nfs_commit_release,
+};
+
+static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq)
+{
+       struct nfs_write_data *data = dreq->commit_data;
+
+       data->inode = dreq->inode;
+       data->cred = dreq->ctx->cred;
+
+       data->args.fh = NFS_FH(data->inode);
+       data->args.offset = 0;
+       data->args.count = 0;
+       data->res.count = 0;
+       data->res.fattr = &data->fattr;
+       data->res.verf = &data->verf;
+
+       rpc_init_task(&data->task, NFS_CLIENT(dreq->inode), RPC_TASK_ASYNC,
+                               &nfs_commit_direct_ops, data);
+       NFS_PROTO(data->inode)->commit_setup(data, 0);
+
+       data->task.tk_priority = RPC_PRIORITY_NORMAL;
+       data->task.tk_cookie = (unsigned long)data->inode;
+       /* Note: task.tk_ops->rpc_release will free dreq->commit_data */
+       dreq->commit_data = NULL;
+
+       dprintk("NFS: %5u initiated commit call\n", data->task.tk_pid);
+
+       lock_kernel();
+       rpc_execute(&data->task);
+       unlock_kernel();
+}
+
+static void nfs_direct_write_complete(struct nfs_direct_req *dreq, struct inode *inode)
+{
+       int flags = dreq->flags;
+
+       dreq->flags = 0;
+       switch (flags) {
+               case NFS_ODIRECT_DO_COMMIT:
+                       nfs_direct_commit_schedule(dreq);
+                       break;
+               case NFS_ODIRECT_RESCHED_WRITES:
+                       nfs_direct_write_reschedule(dreq);
+                       break;
+               default:
+                       nfs_end_data_update(inode);
+                       if (dreq->commit_data != NULL)
+                               nfs_commit_free(dreq->commit_data);
+                       nfs_direct_free_writedata(dreq);
+                       nfs_direct_complete(dreq);
+       }
+}
+
+static void nfs_alloc_commit_data(struct nfs_direct_req *dreq)
+{
+       dreq->commit_data = nfs_commit_alloc(0);
+       if (dreq->commit_data != NULL)
+               dreq->commit_data->req = (struct nfs_page *) dreq;
+}
+#else
+static inline void nfs_alloc_commit_data(struct nfs_direct_req *dreq)
+{
+       dreq->commit_data = NULL;
+}
+
+static void nfs_direct_write_complete(struct nfs_direct_req *dreq, struct inode *inode)
+{
+       nfs_end_data_update(inode);
+       nfs_direct_free_writedata(dreq);
+       nfs_direct_complete(dreq);
+}
+#endif
+
 static struct nfs_direct_req *nfs_direct_write_alloc(size_t nbytes, size_t wsize)
 {
        struct list_head *list;
        struct nfs_direct_req *dreq;
-       unsigned int writes = 0;
        unsigned int wpages = (wsize + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
 
        dreq = nfs_direct_req_alloc();
@@ -414,13 +613,15 @@ static struct nfs_direct_req *nfs_direct_write_alloc(size_t nbytes, size_t wsize
                list_add(&data->pages, list);
 
                data->req = (struct nfs_page *) dreq;
-               writes++;
+               get_dreq(dreq);
                if (nbytes <= wsize)
                        break;
                nbytes -= wsize;
        }
+
+       nfs_alloc_commit_data(dreq);
+
        kref_get(&dreq->kref);
-       atomic_set(&dreq->complete, writes);
        return dreq;
 }
 
@@ -432,56 +633,86 @@ static void nfs_direct_write_result(struct rpc_task *task, void *calldata)
 
        if (nfs_writeback_done(task, data) != 0)
                return;
-       /* If the server fell back to an UNSTABLE write, it's an error. */
-       if (unlikely(data->res.verf->committed != NFS_FILE_SYNC))
-               status = -EIO;
+
+       spin_lock(&dreq->lock);
 
        if (likely(status >= 0))
-               atomic_add(data->res.count, &dreq->count);
+               dreq->count += data->res.count;
        else
-               atomic_set(&dreq->error, status);
-
-       if (unlikely(atomic_dec_and_test(&dreq->complete))) {
-               nfs_end_data_update(data->inode);
-               nfs_direct_complete(dreq);
+               dreq->error = task->tk_status;
+
+       if (data->res.verf->committed != NFS_FILE_SYNC) {
+               switch (dreq->flags) {
+                       case 0:
+                               memcpy(&dreq->verf, &data->verf, sizeof(dreq->verf));
+                               dreq->flags = NFS_ODIRECT_DO_COMMIT;
+                               break;
+                       case NFS_ODIRECT_DO_COMMIT:
+                               if (memcmp(&dreq->verf, &data->verf, sizeof(dreq->verf))) {
+                                       dprintk("NFS: %5u write verify failed\n", task->tk_pid);
+                                       dreq->flags = NFS_ODIRECT_RESCHED_WRITES;
+                               }
+               }
        }
+
+       spin_unlock(&dreq->lock);
+}
+
+/*
+ * NB: Return the value of the first error return code.  Subsequent
+ *     errors after the first one are ignored.
+ */
+static void nfs_direct_write_release(void *calldata)
+{
+       struct nfs_write_data *data = calldata;
+       struct nfs_direct_req *dreq = (struct nfs_direct_req *) data->req;
+
+       if (put_dreq(dreq))
+               nfs_direct_write_complete(dreq, data->inode);
 }
 
 static const struct rpc_call_ops nfs_write_direct_ops = {
        .rpc_call_done = nfs_direct_write_result,
-       .rpc_release = nfs_writedata_release,
+       .rpc_release = nfs_direct_write_release,
 };
 
 /*
  * For each nfs_write_data struct that was allocated on the list, dispatch
- * an NFS WRITE operation
- *
- * XXX: For now, support only FILE_SYNC writes.  Later we may add
- *      support for UNSTABLE + COMMIT.
+ * an NFS WRITE operation.  If get_user_pages() fails, we stop sending writes.
+ * Write length accounting is handled by nfs_direct_write_result().
+ * Otherwise, if no requests have been sent, just return an error.
  */
-static void nfs_direct_write_schedule(struct nfs_direct_req *dreq, unsigned long user_addr, size_t count, loff_t pos)
+static ssize_t nfs_direct_write_schedule(struct nfs_direct_req *dreq, unsigned long user_addr, size_t count, loff_t pos, int sync)
 {
-       struct file *file = dreq->filp;
-       struct inode *inode = file->f_mapping->host;
-       struct nfs_open_context *ctx = (struct nfs_open_context *)
-                                                       file->private_data;
+       struct nfs_open_context *ctx = dreq->ctx;
+       struct inode *inode = ctx->dentry->d_inode;
        struct list_head *list = &dreq->list;
-       struct page **pages = dreq->pages;
        size_t wsize = NFS_SERVER(inode)->wsize;
-       unsigned int curpage, pgbase;
+       unsigned int pgbase;
+       int result;
+       ssize_t started = 0;
+       struct nfs_write_data *data;
 
-       curpage = 0;
        pgbase = user_addr & ~PAGE_MASK;
        do {
-               struct nfs_write_data *data;
                size_t bytes;
 
                bytes = wsize;
                if (count < wsize)
                        bytes = count;
 
+               BUG_ON(list_empty(list));
                data = list_entry(list->next, struct nfs_write_data, pages);
-               list_del_init(&data->pages);
+
+               data->npages = nfs_direct_count_pages(user_addr, bytes);
+               down_read(&current->mm->mmap_sem);
+               result = get_user_pages(current, current->mm, user_addr,
+                                       data->npages, 0, 0, data->pagevec, NULL);
+               up_read(&current->mm->mmap_sem);
+               if (unlikely(result < data->npages))
+                       goto out_err;
+
+               list_move_tail(&data->pages, &dreq->rewrite_list);
 
                data->inode = inode;
                data->cred = ctx->cred;
@@ -489,7 +720,7 @@ static void nfs_direct_write_schedule(struct nfs_direct_req *dreq, unsigned long
                data->args.context = ctx;
                data->args.offset = pos;
                data->args.pgbase = pgbase;
-               data->args.pages = &pages[curpage];
+               data->args.pages = data->pagevec;
                data->args.count = bytes;
                data->res.fattr = &data->fattr;
                data->res.count = bytes;
@@ -497,7 +728,7 @@ static void nfs_direct_write_schedule(struct nfs_direct_req *dreq, unsigned long
 
                rpc_init_task(&data->task, NFS_CLIENT(inode), RPC_TASK_ASYNC,
                                &nfs_write_direct_ops, data);
-               NFS_PROTO(inode)->write_setup(data, FLUSH_STABLE);
+               NFS_PROTO(inode)->write_setup(data, sync);
 
                data->task.tk_priority = RPC_PRIORITY_NORMAL;
                data->task.tk_cookie = (unsigned long) inode;
@@ -506,38 +737,60 @@ static void nfs_direct_write_schedule(struct nfs_direct_req *dreq, unsigned long
                rpc_execute(&data->task);
                unlock_kernel();
 
-               dfprintk(VFS, "NFS: %4d initiated direct write call (req %s/%Ld, %u bytes @ offset %Lu)\n",
+               dfprintk(VFS, "NFS: %5u initiated direct write call (req %s/%Ld, %zu bytes @ offset %Lu)\n",
                                data->task.tk_pid,
                                inode->i_sb->s_id,
                                (long long)NFS_FILEID(inode),
                                bytes,
                                (unsigned long long)data->args.offset);
 
+               started += bytes;
+               user_addr += bytes;
                pos += bytes;
                pgbase += bytes;
-               curpage += pgbase >> PAGE_SHIFT;
                pgbase &= ~PAGE_MASK;
 
                count -= bytes;
        } while (count != 0);
+       BUG_ON(!list_empty(list));
+       return 0;
+
+out_err:
+       if (result > 0)
+               nfs_direct_release_pages(data->pagevec, result);
+
+       list_add(&data->pages, list);
+       while (!list_empty(list)) {
+               data = list_entry(list->next, struct nfs_write_data, pages);
+               list_del(&data->pages);
+               nfs_writedata_free(data);
+               if (put_dreq(dreq))
+                       nfs_direct_write_complete(dreq, inode);
+       }
+
+       if (started)
+               return 0;
+       return result < 0 ? (ssize_t) result : -EFAULT;
 }
 
-static ssize_t nfs_direct_write(struct kiocb *iocb, unsigned long user_addr, size_t count, loff_t pos, struct page **pages, int nr_pages)
+static ssize_t nfs_direct_write(struct kiocb *iocb, unsigned long user_addr, size_t count, loff_t pos)
 {
        ssize_t result;
        sigset_t oldset;
        struct inode *inode = iocb->ki_filp->f_mapping->host;
        struct rpc_clnt *clnt = NFS_CLIENT(inode);
        struct nfs_direct_req *dreq;
+       size_t wsize = NFS_SERVER(inode)->wsize;
+       int sync = 0;
 
-       dreq = nfs_direct_write_alloc(count, NFS_SERVER(inode)->wsize);
+       dreq = nfs_direct_write_alloc(count, wsize);
        if (!dreq)
                return -ENOMEM;
+       if (dreq->commit_data == NULL || count < wsize)
+               sync = FLUSH_STABLE;
 
-       dreq->pages = pages;
-       dreq->npages = nr_pages;
        dreq->inode = inode;
-       dreq->filp = iocb->ki_filp;
+       dreq->ctx = get_nfs_open_context((struct nfs_open_context *)iocb->ki_filp->private_data);
        if (!is_sync_kiocb(iocb))
                dreq->iocb = iocb;
 
@@ -546,8 +799,9 @@ static ssize_t nfs_direct_write(struct kiocb *iocb, unsigned long user_addr, siz
        nfs_begin_data_update(inode);
 
        rpc_clnt_sigmask(clnt, &oldset);
-       nfs_direct_write_schedule(dreq, user_addr, count, pos);
-       result = nfs_direct_wait(dreq);
+       result = nfs_direct_write_schedule(dreq, user_addr, count, pos, sync);
+       if (!result)
+               result = nfs_direct_wait(dreq);
        rpc_clnt_sigunmask(clnt, &oldset);
 
        return result;
@@ -577,8 +831,6 @@ static ssize_t nfs_direct_write(struct kiocb *iocb, unsigned long user_addr, siz
 ssize_t nfs_file_direct_read(struct kiocb *iocb, char __user *buf, size_t count, loff_t pos)
 {
        ssize_t retval = -EINVAL;
-       int page_count;
-       struct page **pages;
        struct file *file = iocb->ki_filp;
        struct address_space *mapping = file->f_mapping;
 
@@ -600,16 +852,7 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, char __user *buf, size_t count,
        if (retval)
                goto out;
 
-       page_count = nfs_get_user_pages(READ, (unsigned long) buf,
-                                               count, &pages);
-       if (page_count < 0) {
-               nfs_free_user_pages(pages, 0, 0);
-               retval = page_count;
-               goto out;
-       }
-
-       retval = nfs_direct_read(iocb, (unsigned long) buf, count, pos,
-                                               pages, page_count);
+       retval = nfs_direct_read(iocb, (unsigned long) buf, count, pos);
        if (retval > 0)
                iocb->ki_pos = pos + retval;
 
@@ -645,8 +888,6 @@ out:
 ssize_t nfs_file_direct_write(struct kiocb *iocb, const char __user *buf, size_t count, loff_t pos)
 {
        ssize_t retval;
-       int page_count;
-       struct page **pages;
        struct file *file = iocb->ki_filp;
        struct address_space *mapping = file->f_mapping;
 
@@ -674,16 +915,7 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, const char __user *buf, size_t
        if (retval)
                goto out;
 
-       page_count = nfs_get_user_pages(WRITE, (unsigned long) buf,
-                                               count, &pages);
-       if (page_count < 0) {
-               nfs_free_user_pages(pages, 0, 0);
-               retval = page_count;
-               goto out;
-       }
-
-       retval = nfs_direct_write(iocb, (unsigned long) buf, count,
-                                       pos, pages, page_count);
+       retval = nfs_direct_write(iocb, (unsigned long) buf, count, pos);
 
        /*
         * XXX: nfs_end_data_update() already ensures this file's
@@ -707,11 +939,12 @@ out:
  * nfs_init_directcache - create a slab cache for nfs_direct_req structures
  *
  */
-int nfs_init_directcache(void)
+int __init nfs_init_directcache(void)
 {
        nfs_direct_cachep = kmem_cache_create("nfs_direct_cache",
                                                sizeof(struct nfs_direct_req),
-                                               0, SLAB_RECLAIM_ACCOUNT,
+                                               0, (SLAB_RECLAIM_ACCOUNT|
+                                                       SLAB_MEM_SPREAD),
                                                NULL, NULL);
        if (nfs_direct_cachep == NULL)
                return -ENOMEM;
@@ -720,10 +953,10 @@ int nfs_init_directcache(void)
 }
 
 /**
- * nfs_init_directcache - destroy the slab cache for nfs_direct_req structures
+ * nfs_destroy_directcache - destroy the slab cache for nfs_direct_req structures
  *
  */
-void nfs_destroy_directcache(void)
+void __exit nfs_destroy_directcache(void)
 {
        if (kmem_cache_destroy(nfs_direct_cachep))
                printk(KERN_INFO "nfs_direct_cache: not all structures were freed\n");