UBUNTU: Ubuntu-2.6.38-12.51
[linux-flexiantxendom0-natty.git] / fs / splice.c
index eefd96b..9a77a3e 100644 (file)
@@ -30,6 +30,7 @@
 #include <linux/syscalls.h>
 #include <linux/uio.h>
 #include <linux/security.h>
+#include <linux/gfp.h>
 
 /*
  * Attempt to steal a page from a pipe buffer. This should perhaps go into
@@ -192,8 +193,8 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
                        break;
                }
 
-               if (pipe->nrbufs < PIPE_BUFFERS) {
-                       int newbuf = (pipe->curbuf + pipe->nrbufs) & (PIPE_BUFFERS - 1);
+               if (pipe->nrbufs < pipe->buffers) {
+                       int newbuf = (pipe->curbuf + pipe->nrbufs) & (pipe->buffers - 1);
                        struct pipe_buffer *buf = pipe->bufs + newbuf;
 
                        buf->page = spd->pages[page_nr];
@@ -213,7 +214,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
 
                        if (!--spd->nr_pages)
                                break;
-                       if (pipe->nrbufs < PIPE_BUFFERS)
+                       if (pipe->nrbufs < pipe->buffers)
                                continue;
 
                        break;
@@ -264,6 +265,36 @@ static void spd_release_page(struct splice_pipe_desc *spd, unsigned int i)
        page_cache_release(spd->pages[i]);
 }
 
+/*
+ * Check if we need to grow the arrays holding pages and partial page
+ * descriptions.
+ */
+int splice_grow_spd(struct pipe_inode_info *pipe, struct splice_pipe_desc *spd)
+{
+       if (pipe->buffers <= PIPE_DEF_BUFFERS)
+               return 0;
+
+       spd->pages = kmalloc(pipe->buffers * sizeof(struct page *), GFP_KERNEL);
+       spd->partial = kmalloc(pipe->buffers * sizeof(struct partial_page), GFP_KERNEL);
+
+       if (spd->pages && spd->partial)
+               return 0;
+
+       kfree(spd->pages);
+       kfree(spd->partial);
+       return -ENOMEM;
+}
+
+void splice_shrink_spd(struct pipe_inode_info *pipe,
+                      struct splice_pipe_desc *spd)
+{
+       if (pipe->buffers <= PIPE_DEF_BUFFERS)
+               return;
+
+       kfree(spd->pages);
+       kfree(spd->partial);
+}
+
 static int
 __generic_file_splice_read(struct file *in, loff_t *ppos,
                           struct pipe_inode_info *pipe, size_t len,
@@ -271,8 +302,8 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
 {
        struct address_space *mapping = in->f_mapping;
        unsigned int loff, nr_pages, req_pages;
-       struct page *pages[PIPE_BUFFERS];
-       struct partial_page partial[PIPE_BUFFERS];
+       struct page *pages[PIPE_DEF_BUFFERS];
+       struct partial_page partial[PIPE_DEF_BUFFERS];
        struct page *page;
        pgoff_t index, end_index;
        loff_t isize;
@@ -285,15 +316,18 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
                .spd_release = spd_release_page,
        };
 
+       if (splice_grow_spd(pipe, &spd))
+               return -ENOMEM;
+
        index = *ppos >> PAGE_CACHE_SHIFT;
        loff = *ppos & ~PAGE_CACHE_MASK;
        req_pages = (len + loff + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-       nr_pages = min(req_pages, (unsigned)PIPE_BUFFERS);
+       nr_pages = min(req_pages, pipe->buffers);
 
        /*
         * Lookup the (hopefully) full range of pages we need.
         */
-       spd.nr_pages = find_get_pages_contig(mapping, index, nr_pages, pages);
+       spd.nr_pages = find_get_pages_contig(mapping, index, nr_pages, spd.pages);
        index += spd.nr_pages;
 
        /*
@@ -320,7 +354,7 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
                                break;
 
                        error = add_to_page_cache_lru(page, mapping, index,
-                                               mapping_gfp_mask(mapping));
+                                               GFP_KERNEL);
                        if (unlikely(error)) {
                                page_cache_release(page);
                                if (error == -EEXIST)
@@ -334,7 +368,7 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
                        unlock_page(page);
                }
 
-               pages[spd.nr_pages++] = page;
+               spd.pages[spd.nr_pages++] = page;
                index++;
        }
 
@@ -355,7 +389,7 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
                 * this_len is the max we'll use from this page
                 */
                this_len = min_t(unsigned long, len, PAGE_CACHE_SIZE - loff);
-               page = pages[page_nr];
+               page = spd.pages[page_nr];
 
                if (PageReadahead(page))
                        page_cache_async_readahead(mapping, &in->f_ra, in,
@@ -365,17 +399,7 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
                 * If the page isn't uptodate, we may need to start io on it
                 */
                if (!PageUptodate(page)) {
-                       /*
-                        * If in nonblock mode then dont block on waiting
-                        * for an in-flight io page
-                        */
-                       if (flags & SPLICE_F_NONBLOCK) {
-                               if (!trylock_page(page)) {
-                                       error = -EAGAIN;
-                                       break;
-                               }
-                       } else
-                               lock_page(page);
+                       lock_page(page);
 
                        /*
                         * Page was truncated, or invalidated by the
@@ -392,8 +416,8 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
                                        error = -ENOMEM;
                                        break;
                                }
-                               page_cache_release(pages[page_nr]);
-                               pages[page_nr] = page;
+                               page_cache_release(spd.pages[page_nr]);
+                               spd.pages[page_nr] = page;
                        }
                        /*
                         * page was already under io and is now done, great
@@ -450,8 +474,8 @@ fill_it:
                        len = this_len;
                }
 
-               partial[page_nr].offset = loff;
-               partial[page_nr].len = this_len;
+               spd.partial[page_nr].offset = loff;
+               spd.partial[page_nr].len = this_len;
                len -= this_len;
                loff = 0;
                spd.nr_pages++;
@@ -463,12 +487,13 @@ fill_it:
         * we got, 'nr_pages' is how many pages are in the map.
         */
        while (page_nr < nr_pages)
-               page_cache_release(pages[page_nr++]);
+               page_cache_release(spd.pages[page_nr++]);
        in->f_ra.prev_pos = (loff_t)index << PAGE_CACHE_SHIFT;
 
        if (spd.nr_pages)
-               return splice_to_pipe(pipe, &spd);
+               error = splice_to_pipe(pipe, &spd);
 
+       splice_shrink_spd(pipe, &spd);
        return error;
 }
 
@@ -502,8 +527,10 @@ ssize_t generic_file_splice_read(struct file *in, loff_t *ppos,
                len = left;
 
        ret = __generic_file_splice_read(in, ppos, pipe, len, flags);
-       if (ret > 0)
+       if (ret > 0) {
                *ppos += ret;
+               file_accessed(in);
+       }
 
        return ret;
 }
@@ -535,8 +562,8 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
        return res;
 }
 
-static ssize_t kernel_writev(struct file *file, const struct iovec *vec,
-                           unsigned long vlen, loff_t *ppos)
+static ssize_t kernel_write(struct file *file, const char *buf, size_t count,
+                           loff_t pos)
 {
        mm_segment_t old_fs;
        ssize_t res;
@@ -544,7 +571,7 @@ static ssize_t kernel_writev(struct file *file, const struct iovec *vec,
        old_fs = get_fs();
        set_fs(get_ds());
        /* The cast to a user pointer is valid due to the set_fs() */
-       res = vfs_writev(file, (const struct iovec __user *)vec, vlen, ppos);
+       res = vfs_write(file, (const char __user *)buf, count, &pos);
        set_fs(old_fs);
 
        return res;
@@ -557,10 +584,9 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
        unsigned int nr_pages;
        unsigned int nr_freed;
        size_t offset;
-       struct page *pages[PIPE_BUFFERS];
-       struct partial_page partial[PIPE_BUFFERS];
-       struct iovec vec[PIPE_BUFFERS];
-       pgoff_t index;
+       struct page *pages[PIPE_DEF_BUFFERS];
+       struct partial_page partial[PIPE_DEF_BUFFERS];
+       struct iovec *vec, __vec[PIPE_DEF_BUFFERS];
        ssize_t res;
        size_t this_len;
        int error;
@@ -573,30 +599,42 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
                .spd_release = spd_release_page,
        };
 
-       index = *ppos >> PAGE_CACHE_SHIFT;
+       if (splice_grow_spd(pipe, &spd))
+               return -ENOMEM;
+
+       res = -ENOMEM;
+       vec = __vec;
+       if (pipe->buffers > PIPE_DEF_BUFFERS) {
+               vec = kmalloc(pipe->buffers * sizeof(struct iovec), GFP_KERNEL);
+               if (!vec)
+                       goto shrink_ret;
+       }
+
        offset = *ppos & ~PAGE_CACHE_MASK;
        nr_pages = (len + offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
 
-       for (i = 0; i < nr_pages && i < PIPE_BUFFERS && len; i++) {
+       for (i = 0; i < nr_pages && i < pipe->buffers && len; i++) {
                struct page *page;
 
-               page = alloc_page(GFP_HIGHUSER);
+               page = alloc_page(GFP_USER);
                error = -ENOMEM;
                if (!page)
                        goto err;
 
                this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
-               vec[i].iov_base = (void __user *) kmap(page);
+               vec[i].iov_base = (void __user *) page_address(page);
                vec[i].iov_len = this_len;
-               pages[i] = page;
+               spd.pages[i] = page;
                spd.nr_pages++;
                len -= this_len;
                offset = 0;
        }
 
        res = kernel_readv(in, vec, spd.nr_pages, *ppos);
-       if (res < 0)
+       if (res < 0) {
+               error = res;
                goto err;
+       }
 
        error = 0;
        if (!res)
@@ -604,13 +642,12 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
 
        nr_freed = 0;
        for (i = 0; i < spd.nr_pages; i++) {
-               kunmap(pages[i]);
                this_len = min_t(size_t, vec[i].iov_len, res);
-               partial[i].offset = 0;
-               partial[i].len = this_len;
+               spd.partial[i].offset = 0;
+               spd.partial[i].len = this_len;
                if (!this_len) {
-                       __free_page(pages[i]);
-                       pages[i] = NULL;
+                       __free_page(spd.pages[i]);
+                       spd.pages[i] = NULL;
                        nr_freed++;
                }
                res -= this_len;
@@ -621,14 +658,18 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
        if (res > 0)
                *ppos += res;
 
+shrink_ret:
+       if (vec != __vec)
+               kfree(vec);
+       splice_shrink_spd(pipe, &spd);
        return res;
 
 err:
-       for (i = 0; i < spd.nr_pages; i++) {
-               kunmap(pages[i]);
-               __free_page(pages[i]);
-       }
-       return error;
+       for (i = 0; i < spd.nr_pages; i++)
+               __free_page(spd.pages[i]);
+
+       res = error;
+       goto shrink_ret;
 }
 EXPORT_SYMBOL(default_file_splice_read);
 
@@ -641,17 +682,14 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe,
 {
        struct file *file = sd->u.file;
        loff_t pos = sd->pos;
-       int ret, more;
-
-       ret = buf->ops->confirm(pipe, buf);
-       if (!ret) {
-               more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len;
+       int more;
 
-               ret = file->f_op->sendpage(file, buf->page, buf->offset,
-                                          sd->len, &pos, more);
-       }
+       if (!likely(file->f_op && file->f_op->sendpage))
+               return -EINVAL;
 
-       return ret;
+       more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len;
+       return file->f_op->sendpage(file, buf->page, buf->offset,
+                                   sd->len, &pos, more);
 }
 
 /*
@@ -684,13 +722,6 @@ int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
        void *fsdata;
        int ret;
 
-       /*
-        * make sure the data in this buffer is uptodate
-        */
-       ret = buf->ops->confirm(pipe, buf);
-       if (unlikely(ret))
-               return ret;
-
        offset = sd->pos & ~PAGE_CACHE_MASK;
 
        this_len = sd->len;
@@ -762,12 +793,17 @@ int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_desc *sd,
                if (sd->len > sd->total_len)
                        sd->len = sd->total_len;
 
-               ret = actor(pipe, buf, sd);
-               if (ret <= 0) {
+               ret = buf->ops->confirm(pipe, buf);
+               if (unlikely(ret)) {
                        if (ret == -ENODATA)
                                ret = 0;
                        return ret;
                }
+
+               ret = actor(pipe, buf, sd);
+               if (ret <= 0)
+                       return ret;
+
                buf->offset += ret;
                buf->len -= ret;
 
@@ -779,7 +815,7 @@ int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_desc *sd,
                if (!buf->len) {
                        buf->ops = NULL;
                        ops->release(pipe, buf);
-                       pipe->curbuf = (pipe->curbuf + 1) & (PIPE_BUFFERS - 1);
+                       pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
                        pipe->nrbufs--;
                        if (pipe->inode)
                                sd->need_wakeup = true;
@@ -963,8 +999,10 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
 
                mutex_lock_nested(&inode->i_mutex, I_MUTEX_CHILD);
                ret = file_remove_suid(out);
-               if (!ret)
+               if (!ret) {
+                       file_update_time(out);
                        ret = splice_from_pipe_feed(pipe, &sd, pipe_to_file);
+               }
                mutex_unlock(&inode->i_mutex);
        } while (ret > 0);
        splice_from_pipe_end(pipe, &sd);
@@ -976,25 +1014,15 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
 
        if (ret > 0) {
                unsigned long nr_pages;
+               int err;
 
-               *ppos += ret;
                nr_pages = (ret + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
 
-               /*
-                * If file or inode is SYNC and we actually wrote some data,
-                * sync it.
-                */
-               if (unlikely((out->f_flags & O_SYNC) || IS_SYNC(inode))) {
-                       int err;
-
-                       mutex_lock(&inode->i_mutex);
-                       err = generic_osync_inode(inode, mapping,
-                                                 OSYNC_METADATA|OSYNC_DATA);
-                       mutex_unlock(&inode->i_mutex);
-
-                       if (err)
-                               ret = err;
-               }
+               err = generic_write_sync(out, *ppos, ret);
+               if (err)
+                       ret = err;
+               else
+                       *ppos += ret;
                balance_dirty_pages_ratelimited_nr(mapping, nr_pages);
        }
 
@@ -1003,120 +1031,30 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
 
 EXPORT_SYMBOL(generic_file_splice_write);
 
-static struct pipe_buffer *nth_pipe_buf(struct pipe_inode_info *pipe, int n)
+static int write_pipe_buf(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
+                         struct splice_desc *sd)
 {
-       return &pipe->bufs[(pipe->curbuf + n) % PIPE_BUFFERS];
+       int ret;
+       void *data;
+
+       data = buf->ops->map(pipe, buf, 0);
+       ret = kernel_write(sd->u.file, data + buf->offset, sd->len, sd->pos);
+       buf->ops->unmap(pipe, buf, data);
+
+       return ret;
 }
 
 static ssize_t default_file_splice_write(struct pipe_inode_info *pipe,
                                         struct file *out, loff_t *ppos,
                                         size_t len, unsigned int flags)
 {
-       ssize_t ret = 0;
-       ssize_t total_len = 0;
-       int do_wakeup = 0;
-
-       pipe_lock(pipe);
-       while (len) {
-               struct pipe_buffer *buf;
-               void *data[PIPE_BUFFERS];
-               struct iovec vec[PIPE_BUFFERS];
-               unsigned int nr_pages = 0;
-               unsigned int write_len = 0;
-               unsigned int now_len = len;
-               unsigned int this_len;
-               int i;
-
-               BUG_ON(pipe->nrbufs > PIPE_BUFFERS);
-               for (i = 0; i < pipe->nrbufs && now_len; i++) {
-                       buf = nth_pipe_buf(pipe, i);
-
-                       ret = buf->ops->confirm(pipe, buf);
-                       if (ret)
-                               break;
-
-                       data[i] = buf->ops->map(pipe, buf, 0);
-                       this_len = min(buf->len, now_len);
-                       vec[i].iov_base = (void __user *) data[i] + buf->offset;
-                       vec[i].iov_len = this_len;
-                       now_len -= this_len;
-                       write_len += this_len;
-                       nr_pages++;
-               }
-
-               if (nr_pages) {
-                       ret = kernel_writev(out, vec, nr_pages, ppos);
-                       if (ret == 0)
-                               ret = -EIO;
-                       if (ret > 0) {
-                               len -= ret;
-                               total_len += ret;
-                       }
-               }
-
-               for (i = 0; i < nr_pages; i++) {
-                       buf = nth_pipe_buf(pipe, i);
-                       buf->ops->unmap(pipe, buf, data[i]);
-
-                       if (ret > 0) {
-                               this_len = min_t(unsigned, vec[i].iov_len, ret);
-                               buf->offset += this_len;
-                               buf->len -= this_len;
-                               ret -= this_len;
-                       }
-               }
-
-               if (ret < 0)
-                       break;
-
-               while (pipe->nrbufs) {
-                       const struct pipe_buf_operations *ops;
-
-                       buf = nth_pipe_buf(pipe, 0);
-                       if (buf->len)
-                               break;
-
-                       ops = buf->ops;
-                       buf->ops = NULL;
-                       ops->release(pipe, buf);
-                       pipe->curbuf = (pipe->curbuf + 1) % PIPE_BUFFERS;
-                       pipe->nrbufs--;
-                       if (pipe->inode)
-                               do_wakeup = 1;
-               }
-
-               if (pipe->nrbufs)
-                       continue;
-               if (!pipe->writers)
-                       break;
-               if (!pipe->waiting_writers) {
-                       if (total_len)
-                               break;
-               }
-
-               if (flags & SPLICE_F_NONBLOCK) {
-                       ret = -EAGAIN;
-                       break;
-               }
-
-               if (signal_pending(current)) {
-                       ret = -ERESTARTSYS;
-                       break;
-               }
-
-               if (do_wakeup) {
-                       wakeup_pipe_writers(pipe);
-                       do_wakeup = 0;
-               }
-
-               pipe_wait(pipe);
-       }
-       pipe_unlock(pipe);
+       ssize_t ret;
 
-       if (do_wakeup)
-               wakeup_pipe_writers(pipe);
+       ret = splice_from_pipe(pipe, out, ppos, len, flags, write_pipe_buf);
+       if (ret > 0)
+               *ppos += ret;
 
-       return total_len ? total_len : ret;
+       return ret;
 }
 
 /**
@@ -1143,8 +1081,8 @@ EXPORT_SYMBOL(generic_splice_sendpage);
 /*
  * Attempt to initiate a splice from pipe to file.
  */
-static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
-                          loff_t *ppos, size_t len, unsigned int flags)
+long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
+                   loff_t *ppos, size_t len, unsigned int flags)
 {
        ssize_t (*splice_write)(struct pipe_inode_info *, struct file *,
                                loff_t *, size_t, unsigned int);
@@ -1160,19 +1098,21 @@ static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
        if (unlikely(ret < 0))
                return ret;
 
-       splice_write = out->f_op->splice_write;
-       if (!splice_write)
+       if (out->f_op && out->f_op->splice_write)
+               splice_write = out->f_op->splice_write;
+       else
                splice_write = default_file_splice_write;
 
        return splice_write(pipe, out, ppos, len, flags);
 }
+EXPORT_SYMBOL(do_splice_from);
 
 /*
  * Attempt to initiate a splice from a file to a pipe.
  */
-static long do_splice_to(struct file *in, loff_t *ppos,
-                        struct pipe_inode_info *pipe, size_t len,
-                        unsigned int flags)
+long do_splice_to(struct file *in, loff_t *ppos,
+                 struct pipe_inode_info *pipe, size_t len,
+                 unsigned int flags)
 {
        ssize_t (*splice_read)(struct file *, loff_t *,
                               struct pipe_inode_info *, size_t, unsigned int);
@@ -1185,12 +1125,14 @@ static long do_splice_to(struct file *in, loff_t *ppos,
        if (unlikely(ret < 0))
                return ret;
 
-       splice_read = in->f_op->splice_read;
-       if (!splice_read)
+       if (in->f_op && in->f_op->splice_read)
+               splice_read = in->f_op->splice_read;
+       else
                splice_read = default_file_splice_read;
 
        return splice_read(in, ppos, pipe, len, flags);
 }
+EXPORT_SYMBOL(do_splice_to);
 
 /**
  * splice_direct_to_actor - splices data directly between two non-pipes
@@ -1298,7 +1240,7 @@ out_release:
         * If we did an incomplete transfer we must release
         * the pipe buffers in question:
         */
-       for (i = 0; i < PIPE_BUFFERS; i++) {
+       for (i = 0; i < pipe->buffers; i++) {
                struct pipe_buffer *buf = pipe->bufs + i;
 
                if (buf->ops) {
@@ -1319,7 +1261,8 @@ static int direct_splice_actor(struct pipe_inode_info *pipe,
 {
        struct file *file = sd->u.file;
 
-       return do_splice_from(pipe, file, &sd->pos, sd->total_len, sd->flags);
+       return do_splice_from(pipe, file, &file->f_pos, sd->total_len,
+                             sd->flags);
 }
 
 /**
@@ -1359,18 +1302,6 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
 static int splice_pipe_to_pipe(struct pipe_inode_info *ipipe,
                               struct pipe_inode_info *opipe,
                               size_t len, unsigned int flags);
-/*
- * After the inode slimming patch, i_pipe/i_bdev/i_cdev share the same
- * location, so checking ->i_pipe is not enough to verify that this is a
- * pipe.
- */
-static inline struct pipe_inode_info *pipe_info(struct inode *inode)
-{
-       if (S_ISFIFO(inode->i_mode))
-               return inode->i_pipe;
-
-       return NULL;
-}
 
 /*
  * Determine where to splice to/from.
@@ -1384,8 +1315,8 @@ static long do_splice(struct file *in, loff_t __user *off_in,
        loff_t offset, *off;
        long ret;
 
-       ipipe = pipe_info(in->f_path.dentry->d_inode);
-       opipe = pipe_info(out->f_path.dentry->d_inode);
+       ipipe = get_pipe_info(in);
+       opipe = get_pipe_info(out);
 
        if (ipipe && opipe) {
                if (off_in || off_out)
@@ -1408,7 +1339,7 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                if (off_in)
                        return -ESPIPE;
                if (off_out) {
-                       if (out->f_op->llseek == no_llseek)
+                       if (!(out->f_mode & FMODE_PWRITE))
                                return -EINVAL;
                        if (copy_from_user(&offset, off_out, sizeof(loff_t)))
                                return -EFAULT;
@@ -1428,7 +1359,7 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                if (off_out)
                        return -ESPIPE;
                if (off_in) {
-                       if (in->f_op->llseek == no_llseek)
+                       if (!(in->f_mode & FMODE_PREAD))
                                return -EINVAL;
                        if (copy_from_user(&offset, off_in, sizeof(loff_t)))
                                return -EFAULT;
@@ -1456,7 +1387,8 @@ static long do_splice(struct file *in, loff_t __user *off_in,
  */
 static int get_iovec_page_array(const struct iovec __user *iov,
                                unsigned int nr_vecs, struct page **pages,
-                               struct partial_page *partial, int aligned)
+                               struct partial_page *partial, int aligned,
+                               unsigned int pipe_buffers)
 {
        int buffers = 0, error = 0;
 
@@ -1499,8 +1431,8 @@ static int get_iovec_page_array(const struct iovec __user *iov,
                        break;
 
                npages = (off + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
-               if (npages > PIPE_BUFFERS - buffers)
-                       npages = PIPE_BUFFERS - buffers;
+               if (npages > pipe_buffers - buffers)
+                       npages = pipe_buffers - buffers;
 
                error = get_user_pages_fast((unsigned long)base, npages,
                                        0, &pages[buffers]);
@@ -1535,7 +1467,7 @@ static int get_iovec_page_array(const struct iovec __user *iov,
                 * or if we mapped the max number of pages that we have
                 * room for.
                 */
-               if (error < npages || buffers == PIPE_BUFFERS)
+               if (error < npages || buffers == pipe_buffers)
                        break;
 
                nr_vecs--;
@@ -1554,10 +1486,6 @@ static int pipe_to_user(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
        char *src;
        int ret;
 
-       ret = buf->ops->confirm(pipe, buf);
-       if (unlikely(ret))
-               return ret;
-
        /*
         * See if we can use the atomic maps, by prefaulting in the
         * pages and doing an atomic copy
@@ -1602,7 +1530,7 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
        int error;
        long ret;
 
-       pipe = pipe_info(file->f_path.dentry->d_inode);
+       pipe = get_pipe_info(file);
        if (!pipe)
                return -EBADF;
 
@@ -1678,8 +1606,8 @@ static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
                             unsigned long nr_segs, unsigned int flags)
 {
        struct pipe_inode_info *pipe;
-       struct page *pages[PIPE_BUFFERS];
-       struct partial_page partial[PIPE_BUFFERS];
+       struct page *pages[PIPE_DEF_BUFFERS];
+       struct partial_page partial[PIPE_DEF_BUFFERS];
        struct splice_pipe_desc spd = {
                .pages = pages,
                .partial = partial,
@@ -1687,17 +1615,25 @@ static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
                .ops = &user_page_pipe_buf_ops,
                .spd_release = spd_release_page,
        };
+       long ret;
 
-       pipe = pipe_info(file->f_path.dentry->d_inode);
+       pipe = get_pipe_info(file);
        if (!pipe)
                return -EBADF;
 
-       spd.nr_pages = get_iovec_page_array(iov, nr_segs, pages, partial,
-                                           flags & SPLICE_F_GIFT);
+       if (splice_grow_spd(pipe, &spd))
+               return -ENOMEM;
+
+       spd.nr_pages = get_iovec_page_array(iov, nr_segs, spd.pages,
+                                           spd.partial, flags & SPLICE_F_GIFT,
+                                           pipe->buffers);
        if (spd.nr_pages <= 0)
-               return spd.nr_pages;
+               ret = spd.nr_pages;
+       else
+               ret = splice_to_pipe(pipe, &spd);
 
-       return splice_to_pipe(pipe, &spd);
+       splice_shrink_spd(pipe, &spd);
+       return ret;
 }
 
 /*
@@ -1823,13 +1759,13 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
         * Check ->nrbufs without the inode lock first. This function
         * is speculative anyways, so missing one is ok.
         */
-       if (pipe->nrbufs < PIPE_BUFFERS)
+       if (pipe->nrbufs < pipe->buffers)
                return 0;
 
        ret = 0;
        pipe_lock(pipe);
 
-       while (pipe->nrbufs >= PIPE_BUFFERS) {
+       while (pipe->nrbufs >= pipe->buffers) {
                if (!pipe->readers) {
                        send_sig(SIGPIPE, current, 0);
                        ret = -EPIPE;
@@ -1895,7 +1831,7 @@ retry:
                 * Cannot make any progress, because either the input
                 * pipe is empty or the output pipe is full.
                 */
-               if (!ipipe->nrbufs || opipe->nrbufs >= PIPE_BUFFERS) {
+               if (!ipipe->nrbufs || opipe->nrbufs >= opipe->buffers) {
                        /* Already processed some buffers, break */
                        if (ret)
                                break;
@@ -1916,7 +1852,7 @@ retry:
                }
 
                ibuf = ipipe->bufs + ipipe->curbuf;
-               nbuf = (opipe->curbuf + opipe->nrbufs) % PIPE_BUFFERS;
+               nbuf = (opipe->curbuf + opipe->nrbufs) & (opipe->buffers - 1);
                obuf = opipe->bufs + nbuf;
 
                if (len >= ibuf->len) {
@@ -1926,7 +1862,7 @@ retry:
                        *obuf = *ibuf;
                        ibuf->ops = NULL;
                        opipe->nrbufs++;
-                       ipipe->curbuf = (ipipe->curbuf + 1) % PIPE_BUFFERS;
+                       ipipe->curbuf = (ipipe->curbuf + 1) & (ipipe->buffers - 1);
                        ipipe->nrbufs--;
                        input_wakeup = true;
                } else {
@@ -1999,11 +1935,11 @@ static int link_pipe(struct pipe_inode_info *ipipe,
                 * If we have iterated all input buffers or ran out of
                 * output room, break.
                 */
-               if (i >= ipipe->nrbufs || opipe->nrbufs >= PIPE_BUFFERS)
+               if (i >= ipipe->nrbufs || opipe->nrbufs >= opipe->buffers)
                        break;
 
-               ibuf = ipipe->bufs + ((ipipe->curbuf + i) & (PIPE_BUFFERS - 1));
-               nbuf = (opipe->curbuf + opipe->nrbufs) & (PIPE_BUFFERS - 1);
+               ibuf = ipipe->bufs + ((ipipe->curbuf + i) & (ipipe->buffers-1));
+               nbuf = (opipe->curbuf + opipe->nrbufs) & (opipe->buffers - 1);
 
                /*
                 * Get a reference to this pipe buffer,
@@ -2061,8 +1997,8 @@ static int link_pipe(struct pipe_inode_info *ipipe,
 static long do_tee(struct file *in, struct file *out, size_t len,
                   unsigned int flags)
 {
-       struct pipe_inode_info *ipipe = pipe_info(in->f_path.dentry->d_inode);
-       struct pipe_inode_info *opipe = pipe_info(out->f_path.dentry->d_inode);
+       struct pipe_inode_info *ipipe = get_pipe_info(in);
+       struct pipe_inode_info *opipe = get_pipe_info(out);
        int ret = -EINVAL;
 
        /*