8 files changed, 65 insertions, 30 deletions

diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
index 1d0ce3c57d93..2dd95ebf4935 100644
--- a/fs/nfsd/nfs3proc.c
+++ b/fs/nfsd/nfs3proc.c
@@ -192,6 +192,7 @@ nfsd3_proc_write(struct svc_rqst *rqstp)
         struct nfsd3_writeres *resp = rqstp->rq_resp;
         __be32  nfserr;
         unsigned long cnt = argp->len;
+        unsigned int nvecs;
 
         dprintk("nfsd: WRITE(3)    %s %d bytes at %Lu%s\n",
                                 SVCFH_fmt(&argp->fh),
@@ -201,9 +202,12 @@ nfsd3_proc_write(struct svc_rqst *rqstp)
 
         fh_copy(&resp->fh, &argp->fh);
         resp->committed = argp->stable;
+        nvecs = svc_fill_write_vector(rqstp, &argp->first, cnt);
+        if (!nvecs)
+                RETURN_STATUS(nfserr_io);
         nfserr = nfsd_write(rqstp, &resp->fh, argp->offset,
-                                rqstp->rq_vec, argp->vlen,
-                                &cnt, resp->committed);
+                            rqstp->rq_vec, nvecs, &cnt,
+                            resp->committed);
         resp->count = cnt;
         RETURN_STATUS(nfserr);
 }
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 1a70581e1cb2..e19fc5d8bcb5 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -391,7 +391,7 @@ int
 nfs3svc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p)
 {
         struct nfsd3_writeargs *args = rqstp->rq_argp;
-        unsigned int len, v, hdr, dlen;
+        unsigned int len, hdr, dlen;
         u32 max_blocksize = svc_max_payload(rqstp);
         struct kvec *head = rqstp->rq_arg.head;
         struct kvec *tail = rqstp->rq_arg.tail;
@@ -433,17 +433,9 @@ nfs3svc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p)
                 args->count = max_blocksize;
                 len = args->len = max_blocksize;
         }
-        rqstp->rq_vec[0].iov_base = (void*)p;
-        rqstp->rq_vec[0].iov_len = head->iov_len - hdr;
-        v = 0;
-        while (len > rqstp->rq_vec[v].iov_len) {
-                len -= rqstp->rq_vec[v].iov_len;
-                v++;
-                rqstp->rq_vec[v].iov_base = page_address(rqstp->rq_pages[v]);
-                rqstp->rq_vec[v].iov_len = PAGE_SIZE;
-        }
-        rqstp->rq_vec[v].iov_len = len;
-        args->vlen = v + 1;
+
+        args->first.iov_base = (void *)p;
+        args->first.iov_len = head->iov_len - hdr;
         return 1;
 }
 
diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
index 43c0419b8ddb..1995ea6bfd2b 100644
--- a/fs/nfsd/nfsproc.c
+++ b/fs/nfsd/nfsproc.c
@@ -212,13 +212,18 @@ nfsd_proc_write(struct svc_rqst *rqstp)
         struct nfsd_attrstat *resp = rqstp->rq_resp;
         __be32  nfserr;
         unsigned long cnt = argp->len;
+        unsigned int nvecs;
 
         dprintk("nfsd: WRITE    %s %d bytes at %d\n",
                 SVCFH_fmt(&argp->fh),
                 argp->len, argp->offset);
 
-        nfserr = nfsd_write(rqstp, fh_copy(&resp->fh, &argp->fh), argp->offset,
-                                rqstp->rq_vec, argp->vlen, &cnt, NFS_DATA_SYNC);
+        nvecs = svc_fill_write_vector(rqstp, &argp->first, cnt);
+        if (!nvecs)
+                return nfserr_io;
+        nfserr = nfsd_write(rqstp, fh_copy(&resp->fh, &argp->fh),
+                            argp->offset, rqstp->rq_vec, nvecs,
+                            &cnt, NFS_DATA_SYNC);
         return nfsd_return_attrs(nfserr, resp);
 }
 
diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c
index 79b6064f8977..db24ae8b67e0 100644
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -287,7 +287,6 @@ nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p)
         struct nfsd_writeargs *args = rqstp->rq_argp;
         unsigned int len, hdr, dlen;
         struct kvec *head = rqstp->rq_arg.head;
-        int v;
 
         p = decode_fh(p, &args->fh);
         if (!p)
@@ -323,17 +322,8 @@ nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p)
         if (dlen < XDR_QUADLEN(len)*4)
                 return 0;
 
-        rqstp->rq_vec[0].iov_base = (void*)p;
-        rqstp->rq_vec[0].iov_len = head->iov_len - hdr;
-        v = 0;
-        while (len > rqstp->rq_vec[v].iov_len) {
-                len -= rqstp->rq_vec[v].iov_len;
-                v++;
-                rqstp->rq_vec[v].iov_base = page_address(rqstp->rq_pages[v]);
-                rqstp->rq_vec[v].iov_len = PAGE_SIZE;
-        }
-        rqstp->rq_vec[v].iov_len = len;
-        args->vlen = v + 1;
+        args->first.iov_base = (void *)p;
+        args->first.iov_len = head->iov_len - hdr;
         return 1;
 }
 
diff --git a/fs/nfsd/xdr.h b/fs/nfsd/xdr.h
index 2f4f22e6b8cb..a765c414015e 100644
--- a/fs/nfsd/xdr.h
+++ b/fs/nfsd/xdr.h
@@ -34,7 +34,7 @@ struct nfsd_writeargs {
         svc_fh                  fh;
         __u32                   offset;
         int                     len;
-        int                     vlen;
+        struct kvec             first;
 };
 
 struct nfsd_createargs {
diff --git a/fs/nfsd/xdr3.h b/fs/nfsd/xdr3.h
index 056bf8a7364e..deccf7f691e9 100644
--- a/fs/nfsd/xdr3.h
+++ b/fs/nfsd/xdr3.h
@@ -41,7 +41,7 @@ struct nfsd3_writeargs {
         __u32                   count;
         int                     stable;
         __u32                   len;
-        int                     vlen;
+        struct kvec             first;
 };
 
 struct nfsd3_createargs {
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index dc4c009deec1..fb3fcacc1e98 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -495,6 +495,8 @@ void		   svc_wake_up(struct svc_serv *);
 void               svc_reserve(struct svc_rqst *rqstp, int space);
 struct svc_pool *  svc_pool_for_cpu(struct svc_serv *serv, int cpu);
 char *             svc_print_addr(struct svc_rqst *, char *, size_t);
+unsigned int       svc_fill_write_vector(struct svc_rqst *rqstp,
+                                         struct kvec *first, size_t total);
 
 #define RPC_MAX_ADDRBUFLEN      (63U)
 
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index f19987f5d3b5..a155e2de19aa 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1533,3 +1533,45 @@ u32 svc_max_payload(const struct svc_rqst *rqstp)
         return max;
 }
 EXPORT_SYMBOL_GPL(svc_max_payload);
+
+/**
+ * svc_fill_write_vector - Construct data argument for VFS write call
+ * @rqstp: svc_rqst to operate on
+ * @first: buffer containing first section of write payload
+ * @total: total number of bytes of write payload
+ *
+ * Returns the number of elements populated in the data argument array.
+ */
+unsigned int svc_fill_write_vector(struct svc_rqst *rqstp, struct kvec *first,
+                                   size_t total)
+{
+        struct kvec *vec = rqstp->rq_vec;
+        struct page **pages;
+        unsigned int i;
+
+        /* Some types of transport can present the write payload
+         * entirely in rq_arg.pages. In this case, @first is empty.
+         */
+        i = 0;
+        if (first->iov_len) {
+                vec[i].iov_base = first->iov_base;
+                vec[i].iov_len = min_t(size_t, total, first->iov_len);
+                total -= vec[i].iov_len;
+                ++i;
+        }
+
+        WARN_ON_ONCE(rqstp->rq_arg.page_base != 0);
+        pages = rqstp->rq_arg.pages;
+        while (total) {
+                vec[i].iov_base = page_address(*pages);
+                vec[i].iov_len = min_t(size_t, total, PAGE_SIZE);
+                total -= vec[i].iov_len;
+                ++i;
+
+                ++pages;
+        }
+
+        WARN_ON_ONCE(i > ARRAY_SIZE(rqstp->rq_vec));
+        return i;
+}
+EXPORT_SYMBOL_GPL(svc_fill_write_vector);