fix ITER_PIPE interaction with direct_IO
[cascardo/linux.git] / fs / splice.c
index dd9bf7e..153d4f3 100644 (file)
@@ -183,82 +183,39 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
                       struct splice_pipe_desc *spd)
 {
        unsigned int spd_pages = spd->nr_pages;
-       int ret, do_wakeup, page_nr;
+       int ret = 0, page_nr = 0;
 
        if (!spd_pages)
                return 0;
 
-       ret = 0;
-       do_wakeup = 0;
-       page_nr = 0;
-
-       pipe_lock(pipe);
-
-       for (;;) {
-               if (!pipe->readers) {
-                       send_sig(SIGPIPE, current, 0);
-                       if (!ret)
-                               ret = -EPIPE;
-                       break;
-               }
-
-               if (pipe->nrbufs < pipe->buffers) {
-                       int newbuf = (pipe->curbuf + pipe->nrbufs) & (pipe->buffers - 1);
-                       struct pipe_buffer *buf = pipe->bufs + newbuf;
-
-                       buf->page = spd->pages[page_nr];
-                       buf->offset = spd->partial[page_nr].offset;
-                       buf->len = spd->partial[page_nr].len;
-                       buf->private = spd->partial[page_nr].private;
-                       buf->ops = spd->ops;
-                       if (spd->flags & SPLICE_F_GIFT)
-                               buf->flags |= PIPE_BUF_FLAG_GIFT;
-
-                       pipe->nrbufs++;
-                       page_nr++;
-                       ret += buf->len;
-
-                       if (pipe->files)
-                               do_wakeup = 1;
+       if (unlikely(!pipe->readers)) {
+               send_sig(SIGPIPE, current, 0);
+               ret = -EPIPE;
+               goto out;
+       }
 
-                       if (!--spd->nr_pages)
-                               break;
-                       if (pipe->nrbufs < pipe->buffers)
-                               continue;
+       while (pipe->nrbufs < pipe->buffers) {
+               int newbuf = (pipe->curbuf + pipe->nrbufs) & (pipe->buffers - 1);
+               struct pipe_buffer *buf = pipe->bufs + newbuf;
 
-                       break;
-               }
+               buf->page = spd->pages[page_nr];
+               buf->offset = spd->partial[page_nr].offset;
+               buf->len = spd->partial[page_nr].len;
+               buf->private = spd->partial[page_nr].private;
+               buf->ops = spd->ops;
 
-               if (spd->flags & SPLICE_F_NONBLOCK) {
-                       if (!ret)
-                               ret = -EAGAIN;
-                       break;
-               }
+               pipe->nrbufs++;
+               page_nr++;
+               ret += buf->len;
 
-               if (signal_pending(current)) {
-                       if (!ret)
-                               ret = -ERESTARTSYS;
+               if (!--spd->nr_pages)
                        break;
-               }
-
-               if (do_wakeup) {
-                       smp_mb();
-                       if (waitqueue_active(&pipe->wait))
-                               wake_up_interruptible_sync(&pipe->wait);
-                       kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
-                       do_wakeup = 0;
-               }
-
-               pipe->waiting_writers++;
-               pipe_wait(pipe);
-               pipe->waiting_writers--;
        }
 
-       pipe_unlock(pipe);
-
-       if (do_wakeup)
-               wakeup_pipe_readers(pipe);
+       if (!ret)
+               ret = -EAGAIN;
 
+out:
        while (page_nr < spd_pages)
                spd->spd_release(spd, page_nr++);
 
@@ -266,6 +223,26 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
 }
 EXPORT_SYMBOL_GPL(splice_to_pipe);
 
+ssize_t add_to_pipe(struct pipe_inode_info *pipe, struct pipe_buffer *buf)
+{
+       int ret;
+
+       if (unlikely(!pipe->readers)) {
+               send_sig(SIGPIPE, current, 0);
+               ret = -EPIPE;
+       } else if (pipe->nrbufs == pipe->buffers) {
+               ret = -EAGAIN;
+       } else {
+               int newbuf = (pipe->curbuf + pipe->nrbufs) & (pipe->buffers - 1);
+               pipe->bufs[newbuf] = *buf;
+               pipe->nrbufs++;
+               return buf->len;
+       }
+       pipe_buf_release(pipe, buf);
+       return ret;
+}
+EXPORT_SYMBOL(add_to_pipe);
+
 void spd_release_page(struct splice_pipe_desc *spd, unsigned int i)
 {
        put_page(spd->pages[i]);
@@ -303,207 +280,6 @@ void splice_shrink_spd(struct splice_pipe_desc *spd)
        kfree(spd->partial);
 }
 
-static int
-__generic_file_splice_read(struct file *in, loff_t *ppos,
-                          struct pipe_inode_info *pipe, size_t len,
-                          unsigned int flags)
-{
-       struct address_space *mapping = in->f_mapping;
-       unsigned int loff, nr_pages, req_pages;
-       struct page *pages[PIPE_DEF_BUFFERS];
-       struct partial_page partial[PIPE_DEF_BUFFERS];
-       struct page *page;
-       pgoff_t index, end_index;
-       loff_t isize;
-       int error, page_nr;
-       struct splice_pipe_desc spd = {
-               .pages = pages,
-               .partial = partial,
-               .nr_pages_max = PIPE_DEF_BUFFERS,
-               .flags = flags,
-               .ops = &page_cache_pipe_buf_ops,
-               .spd_release = spd_release_page,
-       };
-
-       if (splice_grow_spd(pipe, &spd))
-               return -ENOMEM;
-
-       index = *ppos >> PAGE_SHIFT;
-       loff = *ppos & ~PAGE_MASK;
-       req_pages = (len + loff + PAGE_SIZE - 1) >> PAGE_SHIFT;
-       nr_pages = min(req_pages, spd.nr_pages_max);
-
-       /*
-        * Lookup the (hopefully) full range of pages we need.
-        */
-       spd.nr_pages = find_get_pages_contig(mapping, index, nr_pages, spd.pages);
-       index += spd.nr_pages;
-
-       /*
-        * If find_get_pages_contig() returned fewer pages than we needed,
-        * readahead/allocate the rest and fill in the holes.
-        */
-       if (spd.nr_pages < nr_pages)
-               page_cache_sync_readahead(mapping, &in->f_ra, in,
-                               index, req_pages - spd.nr_pages);
-
-       error = 0;
-       while (spd.nr_pages < nr_pages) {
-               /*
-                * Page could be there, find_get_pages_contig() breaks on
-                * the first hole.
-                */
-               page = find_get_page(mapping, index);
-               if (!page) {
-                       /*
-                        * page didn't exist, allocate one.
-                        */
-                       page = page_cache_alloc_cold(mapping);
-                       if (!page)
-                               break;
-
-                       error = add_to_page_cache_lru(page, mapping, index,
-                                  mapping_gfp_constraint(mapping, GFP_KERNEL));
-                       if (unlikely(error)) {
-                               put_page(page);
-                               if (error == -EEXIST)
-                                       continue;
-                               break;
-                       }
-                       /*
-                        * add_to_page_cache() locks the page, unlock it
-                        * to avoid convoluting the logic below even more.
-                        */
-                       unlock_page(page);
-               }
-
-               spd.pages[spd.nr_pages++] = page;
-               index++;
-       }
-
-       /*
-        * Now loop over the map and see if we need to start IO on any
-        * pages, fill in the partial map, etc.
-        */
-       index = *ppos >> PAGE_SHIFT;
-       nr_pages = spd.nr_pages;
-       spd.nr_pages = 0;
-       for (page_nr = 0; page_nr < nr_pages; page_nr++) {
-               unsigned int this_len;
-
-               if (!len)
-                       break;
-
-               /*
-                * this_len is the max we'll use from this page
-                */
-               this_len = min_t(unsigned long, len, PAGE_SIZE - loff);
-               page = spd.pages[page_nr];
-
-               if (PageReadahead(page))
-                       page_cache_async_readahead(mapping, &in->f_ra, in,
-                                       page, index, req_pages - page_nr);
-
-               /*
-                * If the page isn't uptodate, we may need to start io on it
-                */
-               if (!PageUptodate(page)) {
-                       lock_page(page);
-
-                       /*
-                        * Page was truncated, or invalidated by the
-                        * filesystem.  Redo the find/create, but this time the
-                        * page is kept locked, so there's no chance of another
-                        * race with truncate/invalidate.
-                        */
-                       if (!page->mapping) {
-                               unlock_page(page);
-retry_lookup:
-                               page = find_or_create_page(mapping, index,
-                                               mapping_gfp_mask(mapping));
-
-                               if (!page) {
-                                       error = -ENOMEM;
-                                       break;
-                               }
-                               put_page(spd.pages[page_nr]);
-                               spd.pages[page_nr] = page;
-                       }
-                       /*
-                        * page was already under io and is now done, great
-                        */
-                       if (PageUptodate(page)) {
-                               unlock_page(page);
-                               goto fill_it;
-                       }
-
-                       /*
-                        * need to read in the page
-                        */
-                       error = mapping->a_ops->readpage(in, page);
-                       if (unlikely(error)) {
-                               /*
-                                * Re-lookup the page
-                                */
-                               if (error == AOP_TRUNCATED_PAGE)
-                                       goto retry_lookup;
-
-                               break;
-                       }
-               }
-fill_it:
-               /*
-                * i_size must be checked after PageUptodate.
-                */
-               isize = i_size_read(mapping->host);
-               end_index = (isize - 1) >> PAGE_SHIFT;
-               if (unlikely(!isize || index > end_index))
-                       break;
-
-               /*
-                * if this is the last page, see if we need to shrink
-                * the length and stop
-                */
-               if (end_index == index) {
-                       unsigned int plen;
-
-                       /*
-                        * max good bytes in this page
-                        */
-                       plen = ((isize - 1) & ~PAGE_MASK) + 1;
-                       if (plen <= loff)
-                               break;
-
-                       /*
-                        * force quit after adding this page
-                        */
-                       this_len = min(this_len, plen - loff);
-                       len = this_len;
-               }
-
-               spd.partial[page_nr].offset = loff;
-               spd.partial[page_nr].len = this_len;
-               len -= this_len;
-               loff = 0;
-               spd.nr_pages++;
-               index++;
-       }
-
-       /*
-        * Release any pages at the end, if we quit early. 'page_nr' is how far
-        * we got, 'nr_pages' is how many pages are in the map.
-        */
-       while (page_nr < nr_pages)
-               put_page(spd.pages[page_nr++]);
-       in->f_ra.prev_pos = (loff_t)index << PAGE_SHIFT;
-
-       if (spd.nr_pages)
-               error = splice_to_pipe(pipe, &spd);
-
-       splice_shrink_spd(&spd);
-       return error;
-}
-
 /**
  * generic_file_splice_read - splice data from file to a pipe
  * @in:                file to splice from
@@ -514,39 +290,47 @@ fill_it:
  *
  * Description:
  *    Will read pages from given file and fill them into a pipe. Can be
- *    used as long as the address_space operations for the source implements
- *    a readpage() hook.
+ *    used as long as it has more or less sane ->read_iter().
  *
  */
 ssize_t generic_file_splice_read(struct file *in, loff_t *ppos,
                                 struct pipe_inode_info *pipe, size_t len,
                                 unsigned int flags)
 {
-       loff_t isize, left;
-       int ret;
-
-       if (IS_DAX(in->f_mapping->host))
-               return default_file_splice_read(in, ppos, pipe, len, flags);
+       struct iov_iter to;
+       struct kiocb kiocb;
+       loff_t isize;
+       int idx, ret;
 
        isize = i_size_read(in->f_mapping->host);
        if (unlikely(*ppos >= isize))
                return 0;
 
-       left = isize - *ppos;
-       if (unlikely(left < len))
-               len = left;
-
-       ret = __generic_file_splice_read(in, ppos, pipe, len, flags);
+       iov_iter_pipe(&to, ITER_PIPE | READ, pipe, len);
+       idx = to.idx;
+       init_sync_kiocb(&kiocb, in);
+       kiocb.ki_pos = *ppos;
+       ret = in->f_op->read_iter(&kiocb, &to);
        if (ret > 0) {
-               *ppos += ret;
+               *ppos = kiocb.ki_pos;
                file_accessed(in);
+       } else if (ret < 0) {
+               to.idx = idx;
+               to.iov_offset = 0;
+               iov_iter_advance(&to, 0); /* to free what was emitted */
+               /*
+                * callers of ->splice_read() expect -EAGAIN on
+                * "can't put anything in there", rather than -EFAULT.
+                */
+               if (ret == -EFAULT)
+                       ret = -EAGAIN;
        }
 
        return ret;
 }
 EXPORT_SYMBOL(generic_file_splice_read);
 
-static const struct pipe_buf_operations default_pipe_buf_ops = {
+const struct pipe_buf_operations default_pipe_buf_ops = {
        .can_merge = 0,
        .confirm = generic_pipe_buf_confirm,
        .release = generic_pipe_buf_release,
@@ -570,7 +354,7 @@ const struct pipe_buf_operations nosteal_pipe_buf_ops = {
 };
 EXPORT_SYMBOL(nosteal_pipe_buf_ops);
 
-static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
+static ssize_t kernel_readv(struct file *file, const struct kvec *vec,
                            unsigned long vlen, loff_t offset)
 {
        mm_segment_t old_fs;
@@ -602,102 +386,70 @@ ssize_t kernel_write(struct file *file, const char *buf, size_t count,
 }
 EXPORT_SYMBOL(kernel_write);
 
-ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
+static ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
                                 struct pipe_inode_info *pipe, size_t len,
                                 unsigned int flags)
 {
+       struct kvec *vec, __vec[PIPE_DEF_BUFFERS];
+       struct iov_iter to;
+       struct page **pages;
        unsigned int nr_pages;
-       unsigned int nr_freed;
-       size_t offset;
-       struct page *pages[PIPE_DEF_BUFFERS];
-       struct partial_page partial[PIPE_DEF_BUFFERS];
-       struct iovec *vec, __vec[PIPE_DEF_BUFFERS];
+       size_t offset, dummy, copied = 0;
        ssize_t res;
-       size_t this_len;
-       int error;
        int i;
-       struct splice_pipe_desc spd = {
-               .pages = pages,
-               .partial = partial,
-               .nr_pages_max = PIPE_DEF_BUFFERS,
-               .flags = flags,
-               .ops = &default_pipe_buf_ops,
-               .spd_release = spd_release_page,
-       };
 
-       if (splice_grow_spd(pipe, &spd))
+       if (pipe->nrbufs == pipe->buffers)
+               return -EAGAIN;
+
+       /*
+        * Try to keep page boundaries matching to source pagecache ones -
+        * it probably won't be much help, but...
+        */
+       offset = *ppos & ~PAGE_MASK;
+
+       iov_iter_pipe(&to, ITER_PIPE | READ, pipe, len + offset);
+
+       res = iov_iter_get_pages_alloc(&to, &pages, len + offset, &dummy);
+       if (res <= 0)
                return -ENOMEM;
 
-       res = -ENOMEM;
+       nr_pages = res / PAGE_SIZE;
+
        vec = __vec;
-       if (spd.nr_pages_max > PIPE_DEF_BUFFERS) {
-               vec = kmalloc(spd.nr_pages_max * sizeof(struct iovec), GFP_KERNEL);
-               if (!vec)
-                       goto shrink_ret;
+       if (nr_pages > PIPE_DEF_BUFFERS) {
+               vec = kmalloc(nr_pages * sizeof(struct kvec), GFP_KERNEL);
+               if (unlikely(!vec)) {
+                       res = -ENOMEM;
+                       goto out;
+               }
        }
 
-       offset = *ppos & ~PAGE_MASK;
-       nr_pages = (len + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
-
-       for (i = 0; i < nr_pages && i < spd.nr_pages_max && len; i++) {
-               struct page *page;
+       pipe->bufs[to.idx].offset = offset;
+       pipe->bufs[to.idx].len -= offset;
 
-               page = alloc_page(GFP_USER);
-               error = -ENOMEM;
-               if (!page)
-                       goto err;
-
-               this_len = min_t(size_t, len, PAGE_SIZE - offset);
-               vec[i].iov_base = (void __user *) page_address(page);
+       for (i = 0; i < nr_pages; i++) {
+               size_t this_len = min_t(size_t, len, PAGE_SIZE - offset);
+               vec[i].iov_base = page_address(pages[i]) + offset;
                vec[i].iov_len = this_len;
-               spd.pages[i] = page;
-               spd.nr_pages++;
                len -= this_len;
                offset = 0;
        }
 
-       res = kernel_readv(in, vec, spd.nr_pages, *ppos);
-       if (res < 0) {
-               error = res;
-               goto err;
-       }
-
-       error = 0;
-       if (!res)
-               goto err;
-
-       nr_freed = 0;
-       for (i = 0; i < spd.nr_pages; i++) {
-               this_len = min_t(size_t, vec[i].iov_len, res);
-               spd.partial[i].offset = 0;
-               spd.partial[i].len = this_len;
-               if (!this_len) {
-                       __free_page(spd.pages[i]);
-                       spd.pages[i] = NULL;
-                       nr_freed++;
-               }
-               res -= this_len;
-       }
-       spd.nr_pages -= nr_freed;
-
-       res = splice_to_pipe(pipe, &spd);
-       if (res > 0)
+       res = kernel_readv(in, vec, nr_pages, *ppos);
+       if (res > 0) {
+               copied = res;
                *ppos += res;
+       }
 
-shrink_ret:
        if (vec != __vec)
                kfree(vec);
-       splice_shrink_spd(&spd);
+out:
+       for (i = 0; i < nr_pages; i++)
+               put_page(pages[i]);
+       kvfree(pages);
+       iov_iter_advance(&to, copied);  /* truncates and discards */
        return res;
-
-err:
-       for (i = 0; i < spd.nr_pages; i++)
-               __free_page(spd.pages[i]);
-
-       res = error;
-       goto shrink_ret;
 }
-EXPORT_SYMBOL(default_file_splice_read);
 
 /*
  * Send 'sd->len' bytes to socket from 'sd->file' at position 'sd->pos'
@@ -757,13 +509,12 @@ static int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_des
 
        while (pipe->nrbufs) {
                struct pipe_buffer *buf = pipe->bufs + pipe->curbuf;
-               const struct pipe_buf_operations *ops = buf->ops;
 
                sd->len = buf->len;
                if (sd->len > sd->total_len)
                        sd->len = sd->total_len;
 
-               ret = buf->ops->confirm(pipe, buf);
+               ret = pipe_buf_confirm(pipe, buf);
                if (unlikely(ret)) {
                        if (ret == -ENODATA)
                                ret = 0;
@@ -783,8 +534,7 @@ static int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_des
                sd->total_len -= ret;
 
                if (!buf->len) {
-                       buf->ops = NULL;
-                       ops->release(pipe, buf);
+                       pipe_buf_release(pipe, buf);
                        pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
                        pipe->nrbufs--;
                        if (pipe->files)
@@ -1003,7 +753,7 @@ iter_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
                        if (idx == pipe->buffers - 1)
                                idx = -1;
 
-                       ret = buf->ops->confirm(pipe, buf);
+                       ret = pipe_buf_confirm(pipe, buf);
                        if (unlikely(ret)) {
                                if (ret == -ENODATA)
                                        ret = 0;
@@ -1030,11 +780,9 @@ iter_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
                while (ret) {
                        struct pipe_buffer *buf = pipe->bufs + pipe->curbuf;
                        if (ret >= buf->len) {
-                               const struct pipe_buf_operations *ops = buf->ops;
                                ret -= buf->len;
                                buf->len = 0;
-                               buf->ops = NULL;
-                               ops->release(pipe, buf);
+                               pipe_buf_release(pipe, buf);
                                pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
                                pipe->nrbufs--;
                                if (pipe->files)
@@ -1273,10 +1021,8 @@ out_release:
        for (i = 0; i < pipe->buffers; i++) {
                struct pipe_buffer *buf = pipe->bufs + i;
 
-               if (buf->ops) {
-                       buf->ops->release(pipe, buf);
-                       buf->ops = NULL;
-               }
+               if (buf->ops)
+                       pipe_buf_release(pipe, buf);
        }
 
        if (!bytes)
@@ -1342,6 +1088,20 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
 }
 EXPORT_SYMBOL(do_splice_direct);
 
+static int wait_for_space(struct pipe_inode_info *pipe, unsigned flags)
+{
+       while (pipe->nrbufs == pipe->buffers) {
+               if (flags & SPLICE_F_NONBLOCK)
+                       return -EAGAIN;
+               if (signal_pending(current))
+                       return -ERESTARTSYS;
+               pipe->waiting_writers++;
+               pipe_wait(pipe);
+               pipe->waiting_writers--;
+       }
+       return 0;
+}
+
 static int splice_pipe_to_pipe(struct pipe_inode_info *ipipe,
                               struct pipe_inode_info *opipe,
                               size_t len, unsigned int flags);
@@ -1424,8 +1184,13 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                        offset = in->f_pos;
                }
 
-               ret = do_splice_to(in, &offset, opipe, len, flags);
-
+               pipe_lock(opipe);
+               ret = wait_for_space(opipe, flags);
+               if (!ret)
+                       ret = do_splice_to(in, &offset, opipe, len, flags);
+               pipe_unlock(opipe);
+               if (ret > 0)
+                       wakeup_pipe_readers(opipe);
                if (!off_in)
                        in->f_pos = offset;
                else if (copy_to_user(off_in, &offset, sizeof(loff_t)))
@@ -1437,106 +1202,50 @@ static long do_splice(struct file *in, loff_t __user *off_in,
        return -EINVAL;
 }
 
-/*
- * Map an iov into an array of pages and offset/length tupples. With the
- * partial_page structure, we can map several non-contiguous ranges into
- * our ones pages[] map instead of splitting that operation into pieces.
- * Could easily be exported as a generic helper for other users, in which
- * case one would probably want to add a 'max_nr_pages' parameter as well.
- */
-static int get_iovec_page_array(const struct iovec __user *iov,
-                               unsigned int nr_vecs, struct page **pages,
-                               struct partial_page *partial, bool aligned,
-                               unsigned int pipe_buffers)
+static int iter_to_pipe(struct iov_iter *from,
+                       struct pipe_inode_info *pipe,
+                       unsigned flags)
 {
-       int buffers = 0, error = 0;
-
-       while (nr_vecs) {
-               unsigned long off, npages;
-               struct iovec entry;
-               void __user *base;
-               size_t len;
-               int i;
-
-               error = -EFAULT;
-               if (copy_from_user(&entry, iov, sizeof(entry)))
-                       break;
-
-               base = entry.iov_base;
-               len = entry.iov_len;
-
-               /*
-                * Sanity check this iovec. 0 read succeeds.
-                */
-               error = 0;
-               if (unlikely(!len))
-                       break;
-               error = -EFAULT;
-               if (!access_ok(VERIFY_READ, base, len))
-                       break;
-
-               /*
-                * Get this base offset and number of pages, then map
-                * in the user pages.
-                */
-               off = (unsigned long) base & ~PAGE_MASK;
-
-               /*
-                * If asked for alignment, the offset must be zero and the
-                * length a multiple of the PAGE_SIZE.
-                */
-               error = -EINVAL;
-               if (aligned && (off || len & ~PAGE_MASK))
-                       break;
-
-               npages = (off + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
-               if (npages > pipe_buffers - buffers)
-                       npages = pipe_buffers - buffers;
-
-               error = get_user_pages_fast((unsigned long)base, npages,
-                                       0, &pages[buffers]);
-
-               if (unlikely(error <= 0))
+       struct pipe_buffer buf = {
+               .ops = &user_page_pipe_buf_ops,
+               .flags = flags
+       };
+       size_t total = 0;
+       int ret = 0;
+       bool failed = false;
+
+       while (iov_iter_count(from) && !failed) {
+               struct page *pages[16];
+               ssize_t copied;
+               size_t start;
+               int n;
+
+               copied = iov_iter_get_pages(from, pages, ~0UL, 16, &start);
+               if (copied <= 0) {
+                       ret = copied;
                        break;
-
-               /*
-                * Fill this contiguous range into the partial page map.
-                */
-               for (i = 0; i < error; i++) {
-                       const int plen = min_t(size_t, len, PAGE_SIZE - off);
-
-                       partial[buffers].offset = off;
-                       partial[buffers].len = plen;
-
-                       off = 0;
-                       len -= plen;
-                       buffers++;
                }
 
-               /*
-                * We didn't complete this iov, stop here since it probably
-                * means we have to move some of this into a pipe to
-                * be able to continue.
-                */
-               if (len)
-                       break;
-
-               /*
-                * Don't continue if we mapped fewer pages than we asked for,
-                * or if we mapped the max number of pages that we have
-                * room for.
-                */
-               if (error < npages || buffers == pipe_buffers)
-                       break;
-
-               nr_vecs--;
-               iov++;
+               for (n = 0; copied; n++, start = 0) {
+                       int size = min_t(int, copied, PAGE_SIZE - start);
+                       if (!failed) {
+                               buf.page = pages[n];
+                               buf.offset = start;
+                               buf.len = size;
+                               ret = add_to_pipe(pipe, &buf);
+                               if (unlikely(ret < 0)) {
+                                       failed = true;
+                               } else {
+                                       iov_iter_advance(from, ret);
+                                       total += ret;
+                               }
+                       } else {
+                               put_page(pages[n]);
+                       }
+                       copied -= size;
+               }
        }
-
-       if (buffers)
-               return buffers;
-
-       return error;
+       return total ? total : ret;
 }
 
 static int pipe_to_user(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
@@ -1590,38 +1299,36 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *uiov,
  * as splice-from-memory, where the regular splice is splice-from-file (or
  * to file). In both cases the output is a pipe, naturally.
  */
-static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
+static long vmsplice_to_pipe(struct file *file, const struct iovec __user *uiov,
                             unsigned long nr_segs, unsigned int flags)
 {
        struct pipe_inode_info *pipe;
-       struct page *pages[PIPE_DEF_BUFFERS];
-       struct partial_page partial[PIPE_DEF_BUFFERS];
-       struct splice_pipe_desc spd = {
-               .pages = pages,
-               .partial = partial,
-               .nr_pages_max = PIPE_DEF_BUFFERS,
-               .flags = flags,
-               .ops = &user_page_pipe_buf_ops,
-               .spd_release = spd_release_page,
-       };
+       struct iovec iovstack[UIO_FASTIOV];
+       struct iovec *iov = iovstack;
+       struct iov_iter from;
        long ret;
+       unsigned buf_flag = 0;
+
+       if (flags & SPLICE_F_GIFT)
+               buf_flag = PIPE_BUF_FLAG_GIFT;
 
        pipe = get_pipe_info(file);
        if (!pipe)
                return -EBADF;
 
-       if (splice_grow_spd(pipe, &spd))
-               return -ENOMEM;
-
-       spd.nr_pages = get_iovec_page_array(iov, nr_segs, spd.pages,
-                                           spd.partial, false,
-                                           spd.nr_pages_max);
-       if (spd.nr_pages <= 0)
-               ret = spd.nr_pages;
-       else
-               ret = splice_to_pipe(pipe, &spd);
+       ret = import_iovec(WRITE, uiov, nr_segs,
+                          ARRAY_SIZE(iovstack), &iov, &from);
+       if (ret < 0)
+               return ret;
 
-       splice_shrink_spd(&spd);
+       pipe_lock(pipe);
+       ret = wait_for_space(pipe, flags);
+       if (!ret)
+               ret = iter_to_pipe(&from, pipe, buf_flag);
+       pipe_unlock(pipe);
+       if (ret > 0)
+               wakeup_pipe_readers(pipe);
+       kfree(iov);
        return ret;
 }
 
@@ -1876,7 +1583,7 @@ retry:
                         * Get a reference to this pipe buffer,
                         * so we can copy the contents over.
                         */
-                       ibuf->ops->get(ipipe, ibuf);
+                       pipe_buf_get(ipipe, ibuf);
                        *obuf = *ibuf;
 
                        /*
@@ -1948,7 +1655,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
                 * Get a reference to this pipe buffer,
                 * so we can copy the contents over.
                 */
-               ibuf->ops->get(ipipe, ibuf);
+               pipe_buf_get(ipipe, ibuf);
 
                obuf = opipe->bufs + nbuf;
                *obuf = *ibuf;