Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull vfs updates from Al Viro:
 "The first vfs pile, with deep apologies for being very late in this
  window.

  Assorted cleanups and fixes, plus a large preparatory part of iov_iter
  work.  There's a lot more of that, but it'll probably go into the next
  merge window - it *does* shape up nicely, removes a lot of
  boilerplate, gets rid of locking inconsistencie between aio_write and
  splice_write and I hope to get Kent's direct-io rewrite merged into
  the same queue, but some of the stuff after this point is having
  (mostly trivial) conflicts with the things already merged into
  mainline and with some I want more testing.

  This one passes LTP and xfstests without regressions, in addition to
  usual beating.  BTW, readahead02 in ltp syscalls testsuite has started
  giving failures since "mm/readahead.c: fix readahead failure for
  memoryless NUMA nodes and limit readahead pages" - might be a false
  positive, might be a real regression..."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (63 commits)
  missing bits of "splice: fix racy pipe->buffers uses"
  cifs: fix the race in cifs_writev()
  ceph_sync_{,direct_}write: fix an oops on ceph_osdc_new_request() failure
  kill generic_file_buffered_write()
  ocfs2_file_aio_write(): switch to generic_perform_write()
  ceph_aio_write(): switch to generic_perform_write()
  xfs_file_buffered_aio_write(): switch to generic_perform_write()
  export generic_perform_write(), start getting rid of generic_file_buffer_write()
  generic_file_direct_write(): get rid of ppos argument
  btrfs_file_aio_write(): get rid of ppos
  kill the 5th argument of generic_file_buffered_write()
  kill the 4th argument of __generic_file_aio_write()
  lustre: don't open-code kernel_recvmsg()
  ocfs2: don't open-code kernel_recvmsg()
  drbd: don't open-code kernel_recvmsg()
  constify blk_rq_map_user_iov() and friends
  lustre: switch to kernel_sendmsg()
  ocfs2: don't open-code kernel_sendmsg()
  take iov_iter stuff to mm/iov_iter.c
  process_vm_access: tidy up a bit
  ...

5 files changed, 389 insertions, 511 deletions

diff --git a/mm/Makefile b/mm/Makefile
index 9e5aaf92197d..b484452dac57 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -17,7 +17,8 @@ obj-y			:= filemap.o mempool.o oom_kill.o fadvise.o \
                            util.o mmzone.o vmstat.o backing-dev.o \
                            mm_init.o mmu_context.o percpu.o slab_common.o \
                            compaction.o balloon_compaction.o vmacache.o \
-                           interval_tree.o list_lru.o workingset.o $(mmu-y)
+                           interval_tree.o list_lru.o workingset.o \
+                           iov_iter.o $(mmu-y)
 
 obj-y += init-mm.o
 
diff --git a/mm/filemap.c b/mm/filemap.c
index 27ebc0c9571b..a82fbe4c9e8e 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -77,7 +77,7 @@
  *  ->mmap_sem
  *    ->lock_page               (access_process_vm)
  *
- *  ->i_mutex                   (generic_file_buffered_write)
+ *  ->i_mutex                   (generic_perform_write)
  *    ->mmap_sem                (fault_in_pages_readable->do_page_fault)
  *
  *  bdi->wb.list_lock
@@ -1428,7 +1428,8 @@ static void shrink_readahead_size_eio(struct file *filp,
  * do_generic_file_read - generic file read routine
  * @filp:       the file to read
  * @ppos:       current file position
- * @desc:       read_descriptor
+ * @iter:       data destination
+ * @written:    already copied
  *
  * This is a generic file read routine, and uses the
  * mapping->a_ops->readpage() function for the actual low-level stuff.
@@ -1436,8 +1437,8 @@ static void shrink_readahead_size_eio(struct file *filp,
  * This is really ugly. But the goto's actually try to clarify some
  * of the logic when it comes to error handling etc.
  */
-static void do_generic_file_read(struct file *filp, loff_t *ppos,
-                read_descriptor_t *desc)
+static ssize_t do_generic_file_read(struct file *filp, loff_t *ppos,
+                struct iov_iter *iter, ssize_t written)
 {
         struct address_space *mapping = filp->f_mapping;
         struct inode *inode = mapping->host;
@@ -1447,12 +1448,12 @@ static void do_generic_file_read(struct file *filp, loff_t *ppos,
         pgoff_t prev_index;
         unsigned long offset;      /* offset into pagecache page */
         unsigned int prev_offset;
-        int error;
+        int error = 0;
 
         index = *ppos >> PAGE_CACHE_SHIFT;
         prev_index = ra->prev_pos >> PAGE_CACHE_SHIFT;
         prev_offset = ra->prev_pos & (PAGE_CACHE_SIZE-1);
-        last_index = (*ppos + desc->count + PAGE_CACHE_SIZE-1) >> PAGE_CACHE_SHIFT;
+        last_index = (*ppos + iter->count + PAGE_CACHE_SIZE-1) >> PAGE_CACHE_SHIFT;
         offset = *ppos & ~PAGE_CACHE_MASK;
 
         for (;;) {
@@ -1487,7 +1488,7 @@ find_page:
                         if (!page->mapping)
                                 goto page_not_up_to_date_locked;
                         if (!mapping->a_ops->is_partially_uptodate(page,
-                                                                desc, offset))
+                                                        offset, iter->count))
                                 goto page_not_up_to_date_locked;
                         unlock_page(page);
                 }
@@ -1537,24 +1538,23 @@ page_ok:
                 /*
                  * Ok, we have the page, and it's up-to-date, so
                  * now we can copy it to user space...
-                 *
-                 * The file_read_actor routine returns how many bytes were
-                 * actually used..
-                 * NOTE! This may not be the same as how much of a user buffer
-                 * we filled up (we may be padding etc), so we can only update
-                 * "pos" here (the actor routine has to update the user buffer
-                 * pointers and the remaining count).
                  */
-                ret = file_read_actor(desc, page, offset, nr);
+
+                ret = copy_page_to_iter(page, offset, nr, iter);
                 offset += ret;
                 index += offset >> PAGE_CACHE_SHIFT;
                 offset &= ~PAGE_CACHE_MASK;
                 prev_offset = offset;
 
                 page_cache_release(page);
-                if (ret == nr && desc->count)
-                        continue;
-                goto out;
+                written += ret;
+                if (!iov_iter_count(iter))
+                        goto out;
+                if (ret < nr) {
+                        error = -EFAULT;
+                        goto out;
+                }
+                continue;
 
 page_not_up_to_date:
                 /* Get exclusive access to the page ... */
@@ -1589,6 +1589,7 @@ readpage:
                 if (unlikely(error)) {
                         if (error == AOP_TRUNCATED_PAGE) {
                                 page_cache_release(page);
+                                error = 0;
                                 goto find_page;
                         }
                         goto readpage_error;
@@ -1619,7 +1620,6 @@ readpage:
 
 readpage_error:
                 /* UHHUH! A synchronous read error occurred. Report it */
-                desc->error = error;
                 page_cache_release(page);
                 goto out;
 
@@ -1630,16 +1630,17 @@ no_cached_page:
                  */
                 page = page_cache_alloc_cold(mapping);
                 if (!page) {
-                        desc->error = -ENOMEM;
+                        error = -ENOMEM;
                         goto out;
                 }
                 error = add_to_page_cache_lru(page, mapping,
                                                 index, GFP_KERNEL);
                 if (error) {
                         page_cache_release(page);
-                        if (error == -EEXIST)
+                        if (error == -EEXIST) {
+                                error = 0;
                                 goto find_page;
-                        desc->error = error;
+                        }
                         goto out;
                 }
                 goto readpage;
@@ -1652,44 +1653,7 @@ out:
 
         *ppos = ((loff_t)index << PAGE_CACHE_SHIFT) + offset;
         file_accessed(filp);
-}
-
-int file_read_actor(read_descriptor_t *desc, struct page *page,
-                        unsigned long offset, unsigned long size)
-{
-        char *kaddr;
-        unsigned long left, count = desc->count;
-
-        if (size > count)
-                size = count;
-
-        /*
-         * Faults on the destination of a read are common, so do it before
-         * taking the kmap.
-         */
-        if (!fault_in_pages_writeable(desc->arg.buf, size)) {
-                kaddr = kmap_atomic(page);
-                left = __copy_to_user_inatomic(desc->arg.buf,
-                                                kaddr + offset, size);
-                kunmap_atomic(kaddr);
-                if (left == 0)
-                        goto success;
-        }
-
-        /* Do it the slow way */
-        kaddr = kmap(page);
-        left = __copy_to_user(desc->arg.buf, kaddr + offset, size);
-        kunmap(page);
-
-        if (left) {
-                size -= left;
-                desc->error = -EFAULT;
-        }
-success:
-        desc->count = count - size;
-        desc->written += size;
-        desc->arg.buf += size;
-        return size;
+        return written ? written : error;
 }
 
 /*
@@ -1747,14 +1711,15 @@ generic_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
 {
         struct file *filp = iocb->ki_filp;
         ssize_t retval;
-        unsigned long seg = 0;
         size_t count;
         loff_t *ppos = &iocb->ki_pos;
+        struct iov_iter i;
 
         count = 0;
         retval = generic_segment_checks(iov, &nr_segs, &count, VERIFY_WRITE);
         if (retval)
                 return retval;
+        iov_iter_init(&i, iov, nr_segs, count, 0);
 
         /* coalesce the iovecs and go direct-to-BIO for O_DIRECT */
         if (filp->f_flags & O_DIRECT) {
@@ -1776,6 +1741,11 @@ generic_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
                 if (retval > 0) {
                         *ppos = pos + retval;
                         count -= retval;
+                        /*
+                         * If we did a short DIO read we need to skip the
+                         * section of the iov that we've already read data into.
+                         */
+                        iov_iter_advance(&i, retval);
                 }
 
                 /*
@@ -1792,39 +1762,7 @@ generic_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
                 }
         }
 
-        count = retval;
-        for (seg = 0; seg < nr_segs; seg++) {
-                read_descriptor_t desc;
-                loff_t offset = 0;
-
-                /*
-                 * If we did a short DIO read we need to skip the section of the
-                 * iov that we've already read data into.
-                 */
-                if (count) {
-                        if (count > iov[seg].iov_len) {
-                                count -= iov[seg].iov_len;
-                                continue;
-                        }
-                        offset = count;
-                        count = 0;
-                }
-
-                desc.written = 0;
-                desc.arg.buf = iov[seg].iov_base + offset;
-                desc.count = iov[seg].iov_len - offset;
-                if (desc.count == 0)
-                        continue;
-                desc.error = 0;
-                do_generic_file_read(filp, ppos, &desc);
-                retval += desc.written;
-                if (desc.error) {
-                        retval = retval ?: desc.error;
-                        break;
-                }
-                if (desc.count > 0)
-                        break;
-        }
+        retval = do_generic_file_read(filp, ppos, &i, retval);
 out:
         return retval;
 }
@@ -2335,150 +2273,6 @@ struct page *read_cache_page_gfp(struct address_space *mapping,
 }
 EXPORT_SYMBOL(read_cache_page_gfp);
 
-static size_t __iovec_copy_from_user_inatomic(char *vaddr,
-                        const struct iovec *iov, size_t base, size_t bytes)
-{
-        size_t copied = 0, left = 0;
-
-        while (bytes) {
-                char __user *buf = iov->iov_base + base;
-                int copy = min(bytes, iov->iov_len - base);
-
-                base = 0;
-                left = __copy_from_user_inatomic(vaddr, buf, copy);
-                copied += copy;
-                bytes -= copy;
-                vaddr += copy;
-                iov++;
-
-                if (unlikely(left))
-                        break;
-        }
-        return copied - left;
-}
-
-/*
- * Copy as much as we can into the page and return the number of bytes which
- * were successfully copied.  If a fault is encountered then return the number of
- * bytes which were copied.
- */
-size_t iov_iter_copy_from_user_atomic(struct page *page,
-                struct iov_iter *i, unsigned long offset, size_t bytes)
-{
-        char *kaddr;
-        size_t copied;
-
-        BUG_ON(!in_atomic());
-        kaddr = kmap_atomic(page);
-        if (likely(i->nr_segs == 1)) {
-                int left;
-                char __user *buf = i->iov->iov_base + i->iov_offset;
-                left = __copy_from_user_inatomic(kaddr + offset, buf, bytes);
-                copied = bytes - left;
-        } else {
-                copied = __iovec_copy_from_user_inatomic(kaddr + offset,
-                                                i->iov, i->iov_offset, bytes);
-        }
-        kunmap_atomic(kaddr);
-
-        return copied;
-}
-EXPORT_SYMBOL(iov_iter_copy_from_user_atomic);
-
-/*
- * This has the same sideeffects and return value as
- * iov_iter_copy_from_user_atomic().
- * The difference is that it attempts to resolve faults.
- * Page must not be locked.
- */
-size_t iov_iter_copy_from_user(struct page *page,
-                struct iov_iter *i, unsigned long offset, size_t bytes)
-{
-        char *kaddr;
-        size_t copied;
-
-        kaddr = kmap(page);
-        if (likely(i->nr_segs == 1)) {
-                int left;
-                char __user *buf = i->iov->iov_base + i->iov_offset;
-                left = __copy_from_user(kaddr + offset, buf, bytes);
-                copied = bytes - left;
-        } else {
-                copied = __iovec_copy_from_user_inatomic(kaddr + offset,
-                                                i->iov, i->iov_offset, bytes);
-        }
-        kunmap(page);
-        return copied;
-}
-EXPORT_SYMBOL(iov_iter_copy_from_user);
-
-void iov_iter_advance(struct iov_iter *i, size_t bytes)
-{
-        BUG_ON(i->count < bytes);
-
-        if (likely(i->nr_segs == 1)) {
-                i->iov_offset += bytes;
-                i->count -= bytes;
-        } else {
-                const struct iovec *iov = i->iov;
-                size_t base = i->iov_offset;
-                unsigned long nr_segs = i->nr_segs;
-
-                /*
-                 * The !iov->iov_len check ensures we skip over unlikely
-                 * zero-length segments (without overruning the iovec).
-                 */
-                while (bytes || unlikely(i->count && !iov->iov_len)) {
-                        int copy;
-
-                        copy = min(bytes, iov->iov_len - base);
-                        BUG_ON(!i->count || i->count < copy);
-                        i->count -= copy;
-                        bytes -= copy;
-                        base += copy;
-                        if (iov->iov_len == base) {
-                                iov++;
-                                nr_segs--;
-                                base = 0;
-                        }
-                }
-                i->iov = iov;
-                i->iov_offset = base;
-                i->nr_segs = nr_segs;
-        }
-}
-EXPORT_SYMBOL(iov_iter_advance);
-
-/*
- * Fault in the first iovec of the given iov_iter, to a maximum length
- * of bytes. Returns 0 on success, or non-zero if the memory could not be
- * accessed (ie. because it is an invalid address).
- *
- * writev-intensive code may want this to prefault several iovecs -- that
- * would be possible (callers must not rely on the fact that _only_ the
- * first iovec will be faulted with the current implementation).
- */
-int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
-{
-        char __user *buf = i->iov->iov_base + i->iov_offset;
-        bytes = min(bytes, i->iov->iov_len - i->iov_offset);
-        return fault_in_pages_readable(buf, bytes);
-}
-EXPORT_SYMBOL(iov_iter_fault_in_readable);
-
-/*
- * Return the count of just the current iov_iter segment.
- */
-size_t iov_iter_single_seg_count(const struct iov_iter *i)
-{
-        const struct iovec *iov = i->iov;
-        if (i->nr_segs == 1)
-                return i->count;
-        else
-                return min(i->count, iov->iov_len - i->iov_offset);
-}
-EXPORT_SYMBOL(iov_iter_single_seg_count);
-
 /*
  * Performs necessary checks before doing a write
  *
@@ -2585,7 +2379,7 @@ EXPORT_SYMBOL(pagecache_write_end);
 
 ssize_t
 generic_file_direct_write(struct kiocb *iocb, const struct iovec *iov,
-                unsigned long *nr_segs, loff_t pos, loff_t *ppos,
+                unsigned long *nr_segs, loff_t pos,
                 size_t count, size_t ocount)
 {
         struct file     *file = iocb->ki_filp;
@@ -2646,7 +2440,7 @@ generic_file_direct_write(struct kiocb *iocb, const struct iovec *iov,
                         i_size_write(inode, pos);
                         mark_inode_dirty(inode);
                 }
-                *ppos = pos;
+                iocb->ki_pos = pos;
         }
 out:
         return written;
@@ -2692,7 +2486,7 @@ found:
 }
 EXPORT_SYMBOL(grab_cache_page_write_begin);
 
-static ssize_t generic_perform_write(struct file *file,
+ssize_t generic_perform_write(struct file *file,
                                 struct iov_iter *i, loff_t pos)
 {
         struct address_space *mapping = file->f_mapping;
@@ -2742,9 +2536,7 @@ again:
                 if (mapping_writably_mapped(mapping))
                         flush_dcache_page(page);
 
-                pagefault_disable();
                 copied = iov_iter_copy_from_user_atomic(page, i, offset, bytes);
-                pagefault_enable();
                 flush_dcache_page(page);
 
                 mark_page_accessed(page);
@@ -2782,27 +2574,7 @@ again:
 
         return written ? written : status;
 }
-
-ssize_t
-generic_file_buffered_write(struct kiocb *iocb, const struct iovec *iov,
-                unsigned long nr_segs, loff_t pos, loff_t *ppos,
-                size_t count, ssize_t written)
-{
-        struct file *file = iocb->ki_filp;
-        ssize_t status;
-        struct iov_iter i;
-
-        iov_iter_init(&i, iov, nr_segs, count, written);
-        status = generic_perform_write(file, &i, pos);
-
-        if (likely(status >= 0)) {
-                written += status;
-                *ppos = pos + status;
-        }
-        
-        return written ? written : status;
-}
-EXPORT_SYMBOL(generic_file_buffered_write);
+EXPORT_SYMBOL(generic_perform_write);
 
 /**
  * __generic_file_aio_write - write data to a file
@@ -2824,16 +2596,18 @@ EXPORT_SYMBOL(generic_file_buffered_write);
  * avoid syncing under i_mutex.
  */
 ssize_t __generic_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
-                                 unsigned long nr_segs, loff_t *ppos)
+                                 unsigned long nr_segs)
 {
         struct file *file = iocb->ki_filp;
         struct address_space * mapping = file->f_mapping;
         size_t ocount;          /* original count */
         size_t count;           /* after file limit checks */
         struct inode    *inode = mapping->host;
-        loff_t          pos;
-        ssize_t         written;
+        loff_t          pos = iocb->ki_pos;
+        ssize_t         written = 0;
         ssize_t         err;
+        ssize_t         status;
+        struct iov_iter from;
 
         ocount = 0;
         err = generic_segment_checks(iov, &nr_segs, &ocount, VERIFY_READ);
@@ -2841,12 +2615,9 @@ ssize_t __generic_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
                 return err;
 
         count = ocount;
-        pos = *ppos;
 
         /* We can write back this queue in page reclaim */
         current->backing_dev_info = mapping->backing_dev_info;
-        written = 0;
-
         err = generic_write_checks(file, &pos, &count, S_ISBLK(inode->i_mode));
         if (err)
                 goto out;
@@ -2862,45 +2633,47 @@ ssize_t __generic_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
         if (err)
                 goto out;
 
+        iov_iter_init(&from, iov, nr_segs, count, 0);
+
         /* coalesce the iovecs and go direct-to-BIO for O_DIRECT */
         if (unlikely(file->f_flags & O_DIRECT)) {
                 loff_t endbyte;
-                ssize_t written_buffered;
 
-                written = generic_file_direct_write(iocb, iov, &nr_segs, pos,
-                                                        ppos, count, ocount);
+                written = generic_file_direct_write(iocb, iov, &from.nr_segs, pos,
+                                                        count, ocount);
                 if (written < 0 || written == count)
                         goto out;
+                iov_iter_advance(&from, written);
+
                 /*
                  * direct-io write to a hole: fall through to buffered I/O
                  * for completing the rest of the request.
                  */
                 pos += written;
                 count -= written;
-                written_buffered = generic_file_buffered_write(iocb, iov,
-                                                nr_segs, pos, ppos, count,
-                                                written);
+
+                status = generic_perform_write(file, &from, pos);
                 /*
-                 * If generic_file_buffered_write() retuned a synchronous error
+                 * If generic_perform_write() returned a synchronous error
                  * then we want to return the number of bytes which were
                  * direct-written, or the error code if that was zero.  Note
                  * that this differs from normal direct-io semantics, which
                  * will return -EFOO even if some bytes were written.
                  */
-                if (written_buffered < 0) {
-                        err = written_buffered;
+                if (unlikely(status < 0) && !written) {
+                        err = status;
                         goto out;
                 }
-
+                iocb->ki_pos = pos + status;
                 /*
                  * We need to ensure that the page cache pages are written to
                  * disk and invalidated to preserve the expected O_DIRECT
                  * semantics.
                  */
-                endbyte = pos + written_buffered - written - 1;
+                endbyte = pos + status - 1;
                 err = filemap_write_and_wait_range(file->f_mapping, pos, endbyte);
                 if (err == 0) {
-                        written = written_buffered;
+                        written += status;
                         invalidate_mapping_pages(mapping,
                                                  pos >> PAGE_CACHE_SHIFT,
                                                  endbyte >> PAGE_CACHE_SHIFT);
@@ -2911,8 +2684,9 @@ ssize_t __generic_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
                          */
                 }
         } else {
-                written = generic_file_buffered_write(iocb, iov, nr_segs,
-                                pos, ppos, count, written);
+                written = generic_perform_write(file, &from, pos);
+                if (likely(written >= 0))
+                        iocb->ki_pos = pos + written;
         }
 out:
         current->backing_dev_info = NULL;
@@ -2941,7 +2715,7 @@ ssize_t generic_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
         BUG_ON(iocb->ki_pos != pos);
 
         mutex_lock(&inode->i_mutex);
-        ret = __generic_file_aio_write(iocb, iov, nr_segs, &iocb->ki_pos);
+        ret = __generic_file_aio_write(iocb, iov, nr_segs);
         mutex_unlock(&inode->i_mutex);
 
         if (ret > 0) {
diff --git a/mm/iov_iter.c b/mm/iov_iter.c
new file mode 100644
index 000000000000..10e46cd721de
--- /dev/null
+++ b/mm/iov_iter.c
@@ -0,0 +1,224 @@
+#include <linux/export.h>
+#include <linux/uio.h>
+#include <linux/pagemap.h>
+
+size_t copy_page_to_iter(struct page *page, size_t offset, size_t bytes,
+                         struct iov_iter *i)
+{
+        size_t skip, copy, left, wanted;
+        const struct iovec *iov;
+        char __user *buf;
+        void *kaddr, *from;
+
+        if (unlikely(bytes > i->count))
+                bytes = i->count;
+
+        if (unlikely(!bytes))
+                return 0;
+
+        wanted = bytes;
+        iov = i->iov;
+        skip = i->iov_offset;
+        buf = iov->iov_base + skip;
+        copy = min(bytes, iov->iov_len - skip);
+
+        if (!fault_in_pages_writeable(buf, copy)) {
+                kaddr = kmap_atomic(page);
+                from = kaddr + offset;
+
+                /* first chunk, usually the only one */
+                left = __copy_to_user_inatomic(buf, from, copy);
+                copy -= left;
+                skip += copy;
+                from += copy;
+                bytes -= copy;
+
+                while (unlikely(!left && bytes)) {
+                        iov++;
+                        buf = iov->iov_base;
+                        copy = min(bytes, iov->iov_len);
+                        left = __copy_to_user_inatomic(buf, from, copy);
+                        copy -= left;
+                        skip = copy;
+                        from += copy;
+                        bytes -= copy;
+                }
+                if (likely(!bytes)) {
+                        kunmap_atomic(kaddr);
+                        goto done;
+                }
+                offset = from - kaddr;
+                buf += copy;
+                kunmap_atomic(kaddr);
+                copy = min(bytes, iov->iov_len - skip);
+        }
+        /* Too bad - revert to non-atomic kmap */
+        kaddr = kmap(page);
+        from = kaddr + offset;
+        left = __copy_to_user(buf, from, copy);
+        copy -= left;
+        skip += copy;
+        from += copy;
+        bytes -= copy;
+        while (unlikely(!left && bytes)) {
+                iov++;
+                buf = iov->iov_base;
+                copy = min(bytes, iov->iov_len);
+                left = __copy_to_user(buf, from, copy);
+                copy -= left;
+                skip = copy;
+                from += copy;
+                bytes -= copy;
+        }
+        kunmap(page);
+done:
+        i->count -= wanted - bytes;
+        i->nr_segs -= iov - i->iov;
+        i->iov = iov;
+        i->iov_offset = skip;
+        return wanted - bytes;
+}
+EXPORT_SYMBOL(copy_page_to_iter);
+
+static size_t __iovec_copy_from_user_inatomic(char *vaddr,
+                        const struct iovec *iov, size_t base, size_t bytes)
+{
+        size_t copied = 0, left = 0;
+
+        while (bytes) {
+                char __user *buf = iov->iov_base + base;
+                int copy = min(bytes, iov->iov_len - base);
+
+                base = 0;
+                left = __copy_from_user_inatomic(vaddr, buf, copy);
+                copied += copy;
+                bytes -= copy;
+                vaddr += copy;
+                iov++;
+
+                if (unlikely(left))
+                        break;
+        }
+        return copied - left;
+}
+
+/*
+ * Copy as much as we can into the page and return the number of bytes which
+ * were successfully copied.  If a fault is encountered then return the number of
+ * bytes which were copied.
+ */
+size_t iov_iter_copy_from_user_atomic(struct page *page,
+                struct iov_iter *i, unsigned long offset, size_t bytes)
+{
+        char *kaddr;
+        size_t copied;
+
+        kaddr = kmap_atomic(page);
+        if (likely(i->nr_segs == 1)) {
+                int left;
+                char __user *buf = i->iov->iov_base + i->iov_offset;
+                left = __copy_from_user_inatomic(kaddr + offset, buf, bytes);
+                copied = bytes - left;
+        } else {
+                copied = __iovec_copy_from_user_inatomic(kaddr + offset,
+                                                i->iov, i->iov_offset, bytes);
+        }
+        kunmap_atomic(kaddr);
+
+        return copied;
+}
+EXPORT_SYMBOL(iov_iter_copy_from_user_atomic);
+
+/*
+ * This has the same sideeffects and return value as
+ * iov_iter_copy_from_user_atomic().
+ * The difference is that it attempts to resolve faults.
+ * Page must not be locked.
+ */
+size_t iov_iter_copy_from_user(struct page *page,
+                struct iov_iter *i, unsigned long offset, size_t bytes)
+{
+        char *kaddr;
+        size_t copied;
+
+        kaddr = kmap(page);
+        if (likely(i->nr_segs == 1)) {
+                int left;
+                char __user *buf = i->iov->iov_base + i->iov_offset;
+                left = __copy_from_user(kaddr + offset, buf, bytes);
+                copied = bytes - left;
+        } else {
+                copied = __iovec_copy_from_user_inatomic(kaddr + offset,
+                                                i->iov, i->iov_offset, bytes);
+        }
+        kunmap(page);
+        return copied;
+}
+EXPORT_SYMBOL(iov_iter_copy_from_user);
+
+void iov_iter_advance(struct iov_iter *i, size_t bytes)
+{
+        BUG_ON(i->count < bytes);
+
+        if (likely(i->nr_segs == 1)) {
+                i->iov_offset += bytes;
+                i->count -= bytes;
+        } else {
+                const struct iovec *iov = i->iov;
+                size_t base = i->iov_offset;
+                unsigned long nr_segs = i->nr_segs;
+
+                /*
+                 * The !iov->iov_len check ensures we skip over unlikely
+                 * zero-length segments (without overruning the iovec).
+                 */
+                while (bytes || unlikely(i->count && !iov->iov_len)) {
+                        int copy;
+
+                        copy = min(bytes, iov->iov_len - base);
+                        BUG_ON(!i->count || i->count < copy);
+                        i->count -= copy;
+                        bytes -= copy;
+                        base += copy;
+                        if (iov->iov_len == base) {
+                                iov++;
+                                nr_segs--;
+                                base = 0;
+                        }
+                }
+                i->iov = iov;
+                i->iov_offset = base;
+                i->nr_segs = nr_segs;
+        }
+}
+EXPORT_SYMBOL(iov_iter_advance);
+
+/*
+ * Fault in the first iovec of the given iov_iter, to a maximum length
+ * of bytes. Returns 0 on success, or non-zero if the memory could not be
+ * accessed (ie. because it is an invalid address).
+ *
+ * writev-intensive code may want this to prefault several iovecs -- that
+ * would be possible (callers must not rely on the fact that _only_ the
+ * first iovec will be faulted with the current implementation).
+ */
+int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
+{
+        char __user *buf = i->iov->iov_base + i->iov_offset;
+        bytes = min(bytes, i->iov->iov_len - i->iov_offset);
+        return fault_in_pages_readable(buf, bytes);
+}
+EXPORT_SYMBOL(iov_iter_fault_in_readable);
+
+/*
+ * Return the count of just the current iov_iter segment.
+ */
+size_t iov_iter_single_seg_count(const struct iov_iter *i)
+{
+        const struct iovec *iov = i->iov;
+        if (i->nr_segs == 1)
+                return i->count;
+        else
+                return min(i->count, iov->iov_len - i->iov_offset);
+}
+EXPORT_SYMBOL(iov_iter_single_seg_count);
diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
index cb79065c19e5..8505c9262b35 100644
--- a/mm/process_vm_access.c
+++ b/mm/process_vm_access.c
@@ -23,129 +23,44 @@
 
 /**
  * process_vm_rw_pages - read/write pages from task specified
- * @task: task to read/write from
- * @mm: mm for task
- * @process_pages: struct pages area that can store at least
- *  nr_pages_to_copy struct page pointers
- * @pa: address of page in task to start copying from/to
+ * @pages: array of pointers to pages we want to copy
  * @start_offset: offset in page to start copying from/to
  * @len: number of bytes to copy
- * @lvec: iovec array specifying where to copy to/from
- * @lvec_cnt: number of elements in iovec array
- * @lvec_current: index in iovec array we are up to
- * @lvec_offset: offset in bytes from current iovec iov_base we are up to
+ * @iter: where to copy to/from locally
  * @vm_write: 0 means copy from, 1 means copy to
- * @nr_pages_to_copy: number of pages to copy
- * @bytes_copied: returns number of bytes successfully copied
  * Returns 0 on success, error code otherwise
  */
-static int process_vm_rw_pages(struct task_struct *task,
-                               struct mm_struct *mm,
-                               struct page **process_pages,
-                               unsigned long pa,
-                               unsigned long start_offset,
-                               unsigned long len,
-                               const struct iovec *lvec,
-                               unsigned long lvec_cnt,
-                               unsigned long *lvec_current,
-                               size_t *lvec_offset,
-                               int vm_write,
-                               unsigned int nr_pages_to_copy,
-                               ssize_t *bytes_copied)
+static int process_vm_rw_pages(struct page **pages,
+                               unsigned offset,
+                               size_t len,
+                               struct iov_iter *iter,
+                               int vm_write)
 {
-        int pages_pinned;
-        void *target_kaddr;
-        int pgs_copied = 0;
-        int j;
-        int ret;
-        ssize_t bytes_to_copy;
-        ssize_t rc = 0;
-
-        *bytes_copied = 0;
-
-        /* Get the pages we're interested in */
-        down_read(&mm->mmap_sem);
-        pages_pinned = get_user_pages(task, mm, pa,
-                                      nr_pages_to_copy,
-                                      vm_write, 0, process_pages, NULL);
-        up_read(&mm->mmap_sem);
-
-        if (pages_pinned != nr_pages_to_copy) {
-                rc = -EFAULT;
-                goto end;
-        }
-
         /* Do the copy for each page */
-        for (pgs_copied = 0;
-             (pgs_copied < nr_pages_to_copy) && (*lvec_current < lvec_cnt);
-             pgs_copied++) {
-                /* Make sure we have a non zero length iovec */
-                while (*lvec_current < lvec_cnt
-                       && lvec[*lvec_current].iov_len == 0)
-                        (*lvec_current)++;
-                if (*lvec_current == lvec_cnt)
-                        break;
-
-                /*
-                 * Will copy smallest of:
-                 * - bytes remaining in page
-                 * - bytes remaining in destination iovec
-                 */
-                bytes_to_copy = min_t(ssize_t, PAGE_SIZE - start_offset,
-                                      len - *bytes_copied);
-                bytes_to_copy = min_t(ssize_t, bytes_to_copy,
-                                      lvec[*lvec_current].iov_len
-                                      - *lvec_offset);
-
-                target_kaddr = kmap(process_pages[pgs_copied]) + start_offset;
-
-                if (vm_write)
-                        ret = copy_from_user(target_kaddr,
-                                             lvec[*lvec_current].iov_base
-                                             + *lvec_offset,
-                                             bytes_to_copy);
-                else
-                        ret = copy_to_user(lvec[*lvec_current].iov_base
-                                           + *lvec_offset,
-                                           target_kaddr, bytes_to_copy);
-                kunmap(process_pages[pgs_copied]);
-                if (ret) {
-                        *bytes_copied += bytes_to_copy - ret;
-                        pgs_copied++;
-                        rc = -EFAULT;
-                        goto end;
-                }
-                *bytes_copied += bytes_to_copy;
-                *lvec_offset += bytes_to_copy;
-                if (*lvec_offset == lvec[*lvec_current].iov_len) {
-                        /*
-                         * Need to copy remaining part of page into the
-                         * next iovec if there are any bytes left in page
-                         */
-                        (*lvec_current)++;
-                        *lvec_offset = 0;
-                        start_offset = (start_offset + bytes_to_copy)
-                                % PAGE_SIZE;
-                        if (start_offset)
-                                pgs_copied--;
+        while (len && iov_iter_count(iter)) {
+                struct page *page = *pages++;
+                size_t copy = PAGE_SIZE - offset;
+                size_t copied;
+
+                if (copy > len)
+                        copy = len;
+
+                if (vm_write) {
+                        if (copy > iov_iter_count(iter))
+                                copy = iov_iter_count(iter);
+                        copied = iov_iter_copy_from_user(page, iter,
+                                        offset, copy);
+                        iov_iter_advance(iter, copied);
+                        set_page_dirty_lock(page);
                 } else {
-                        start_offset = 0;
-                }
-        }
-
-end:
-        if (vm_write) {
-                for (j = 0; j < pages_pinned; j++) {
-                        if (j < pgs_copied)
-                                set_page_dirty_lock(process_pages[j]);
-                        put_page(process_pages[j]);
+                        copied = copy_page_to_iter(page, offset, copy, iter);
                 }
-        } else {
-                for (j = 0; j < pages_pinned; j++)
-                        put_page(process_pages[j]);
+                len -= copied;
+                if (copied < copy && iov_iter_count(iter))
+                        return -EFAULT;
+                offset = 0;
         }
-
-        return rc;
+        return 0;
 }
 
 /* Maximum number of pages kmalloc'd to hold struct page's during copy */
@@ -155,67 +70,60 @@ end:
  * process_vm_rw_single_vec - read/write pages from task specified
  * @addr: start memory address of target process
  * @len: size of area to copy to/from
- * @lvec: iovec array specifying where to copy to/from locally
- * @lvec_cnt: number of elements in iovec array
- * @lvec_current: index in iovec array we are up to
- * @lvec_offset: offset in bytes from current iovec iov_base we are up to
+ * @iter: where to copy to/from locally
  * @process_pages: struct pages area that can store at least
  *  nr_pages_to_copy struct page pointers
  * @mm: mm for task
  * @task: task to read/write from
  * @vm_write: 0 means copy from, 1 means copy to
- * @bytes_copied: returns number of bytes successfully copied
  * Returns 0 on success or on failure error code
  */
 static int process_vm_rw_single_vec(unsigned long addr,
                                     unsigned long len,
-                                    const struct iovec *lvec,
-                                    unsigned long lvec_cnt,
-                                    unsigned long *lvec_current,
-                                    size_t *lvec_offset,
+                                    struct iov_iter *iter,
                                     struct page **process_pages,
                                     struct mm_struct *mm,
                                     struct task_struct *task,
-                                    int vm_write,
-                                    ssize_t *bytes_copied)
+                                    int vm_write)
 {
         unsigned long pa = addr & PAGE_MASK;
         unsigned long start_offset = addr - pa;
         unsigned long nr_pages;
-        ssize_t bytes_copied_loop;
         ssize_t rc = 0;
-        unsigned long nr_pages_copied = 0;
-        unsigned long nr_pages_to_copy;
         unsigned long max_pages_per_loop = PVM_MAX_KMALLOC_PAGES
                 / sizeof(struct pages *);
 
-        *bytes_copied = 0;
-
         /* Work out address and page range required */
         if (len == 0)
                 return 0;
         nr_pages = (addr + len - 1) / PAGE_SIZE - addr / PAGE_SIZE + 1;
 
-        while ((nr_pages_copied < nr_pages) && (*lvec_current < lvec_cnt)) {
-                nr_pages_to_copy = min(nr_pages - nr_pages_copied,
-                                       max_pages_per_loop);
+        while (!rc && nr_pages && iov_iter_count(iter)) {
+                int pages = min(nr_pages, max_pages_per_loop);
+                size_t bytes;
 
-                rc = process_vm_rw_pages(task, mm, process_pages, pa,
-                                         start_offset, len,
-                                         lvec, lvec_cnt,
-                                         lvec_current, lvec_offset,
-                                         vm_write, nr_pages_to_copy,
-                                         &bytes_copied_loop);
-                start_offset = 0;
-                *bytes_copied += bytes_copied_loop;
+                /* Get the pages we're interested in */
+                down_read(&mm->mmap_sem);
+                pages = get_user_pages(task, mm, pa, pages,
+                                      vm_write, 0, process_pages, NULL);
+                up_read(&mm->mmap_sem);
 
-                if (rc < 0) {
-                        return rc;
-                } else {
-                        len -= bytes_copied_loop;
-                        nr_pages_copied += nr_pages_to_copy;
-                        pa += nr_pages_to_copy * PAGE_SIZE;
-                }
+                if (pages <= 0)
+                        return -EFAULT;
+
+                bytes = pages * PAGE_SIZE - start_offset;
+                if (bytes > len)
+                        bytes = len;
+
+                rc = process_vm_rw_pages(process_pages,
+                                         start_offset, bytes, iter,
+                                         vm_write);
+                len -= bytes;
+                start_offset = 0;
+                nr_pages -= pages;
+                pa += pages * PAGE_SIZE;
+                while (pages)
+                        put_page(process_pages[--pages]);
         }
 
         return rc;
@@ -228,8 +136,7 @@ static int process_vm_rw_single_vec(unsigned long addr,
 /**
  * process_vm_rw_core - core of reading/writing pages from task specified
  * @pid: PID of process to read/write from/to
- * @lvec: iovec array specifying where to copy to/from locally
- * @liovcnt: size of lvec array
+ * @iter: where to copy to/from locally
  * @rvec: iovec array specifying where to copy to/from in the other process
  * @riovcnt: size of rvec array
  * @flags: currently unused
@@ -238,8 +145,7 @@ static int process_vm_rw_single_vec(unsigned long addr,
  *  return less bytes than expected if an error occurs during the copying
  *  process.
  */
-static ssize_t process_vm_rw_core(pid_t pid, const struct iovec *lvec,
-                                  unsigned long liovcnt,
+static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter,
                                   const struct iovec *rvec,
                                   unsigned long riovcnt,
                                   unsigned long flags, int vm_write)
@@ -250,13 +156,10 @@ static ssize_t process_vm_rw_core(pid_t pid, const struct iovec *lvec,
         struct mm_struct *mm;
         unsigned long i;
         ssize_t rc = 0;
-        ssize_t bytes_copied_loop;
-        ssize_t bytes_copied = 0;
         unsigned long nr_pages = 0;
         unsigned long nr_pages_iov;
-        unsigned long iov_l_curr_idx = 0;
-        size_t iov_l_curr_offset = 0;
         ssize_t iov_len;
+        size_t total_len = iov_iter_count(iter);
 
         /*
          * Work out how many pages of struct pages we're going to need
@@ -310,24 +213,20 @@ static ssize_t process_vm_rw_core(pid_t pid, const struct iovec *lvec,
                 goto put_task_struct;
         }
 
-        for (i = 0; i < riovcnt && iov_l_curr_idx < liovcnt; i++) {
+        for (i = 0; i < riovcnt && iov_iter_count(iter) && !rc; i++)
                 rc = process_vm_rw_single_vec(
                         (unsigned long)rvec[i].iov_base, rvec[i].iov_len,
-                        lvec, liovcnt, &iov_l_curr_idx, &iov_l_curr_offset,
-                        process_pages, mm, task, vm_write, &bytes_copied_loop);
-                bytes_copied += bytes_copied_loop;
-                if (rc != 0) {
-                        /* If we have managed to copy any data at all then
-                           we return the number of bytes copied. Otherwise
-                           we return the error code */
-                        if (bytes_copied)
-                                rc = bytes_copied;
-                        goto put_mm;
-                }
-        }
+                        iter, process_pages, mm, task, vm_write);
+
+        /* copied = space before - space after */
+        total_len -= iov_iter_count(iter);
+
+        /* If we have managed to copy any data at all then
+           we return the number of bytes copied. Otherwise
+           we return the error code */
+        if (total_len)
+                rc = total_len;
 
-        rc = bytes_copied;
-put_mm:
         mmput(mm);
 
 put_task_struct:
@@ -363,6 +262,7 @@ static ssize_t process_vm_rw(pid_t pid,
         struct iovec iovstack_r[UIO_FASTIOV];
         struct iovec *iov_l = iovstack_l;
         struct iovec *iov_r = iovstack_r;
+        struct iov_iter iter;
         ssize_t rc;
 
         if (flags != 0)
@@ -378,13 +278,14 @@ static ssize_t process_vm_rw(pid_t pid,
         if (rc <= 0)
                 goto free_iovecs;
 
+        iov_iter_init(&iter, iov_l, liovcnt, rc, 0);
+
         rc = rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt, UIO_FASTIOV,
                                    iovstack_r, &iov_r);
         if (rc <= 0)
                 goto free_iovecs;
 
-        rc = process_vm_rw_core(pid, iov_l, liovcnt, iov_r, riovcnt, flags,
-                                vm_write);
+        rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write);
 
 free_iovecs:
         if (iov_r != iovstack_r)
@@ -424,6 +325,7 @@ compat_process_vm_rw(compat_pid_t pid,
         struct iovec iovstack_r[UIO_FASTIOV];
         struct iovec *iov_l = iovstack_l;
         struct iovec *iov_r = iovstack_r;
+        struct iov_iter iter;
         ssize_t rc = -EFAULT;
 
         if (flags != 0)
@@ -439,14 +341,14 @@ compat_process_vm_rw(compat_pid_t pid,
                                                   &iov_l);
         if (rc <= 0)
                 goto free_iovecs;
+        iov_iter_init(&iter, iov_l, liovcnt, rc, 0);
         rc = compat_rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt,
                                           UIO_FASTIOV, iovstack_r,
                                           &iov_r);
         if (rc <= 0)
                 goto free_iovecs;
 
-        rc = process_vm_rw_core(pid, iov_l, liovcnt, iov_r, riovcnt, flags,
-                           vm_write);
+        rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write);
 
 free_iovecs:
         if (iov_r != iovstack_r)
diff --git a/mm/shmem.c b/mm/shmem.c
index 70273f8df586..8f1a95406bae 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1402,13 +1402,25 @@ shmem_write_end(struct file *file, struct address_space *mapping,
         return copied;
 }
 
-static void do_shmem_file_read(struct file *filp, loff_t *ppos, read_descriptor_t *desc, read_actor_t actor)
+static ssize_t shmem_file_aio_read(struct kiocb *iocb,
+                const struct iovec *iov, unsigned long nr_segs, loff_t pos)
 {
-        struct inode *inode = file_inode(filp);
+        struct file *file = iocb->ki_filp;
+        struct inode *inode = file_inode(file);
         struct address_space *mapping = inode->i_mapping;
         pgoff_t index;
         unsigned long offset;
         enum sgp_type sgp = SGP_READ;
+        int error;
+        ssize_t retval;
+        size_t count;
+        loff_t *ppos = &iocb->ki_pos;
+        struct iov_iter iter;
+
+        retval = generic_segment_checks(iov, &nr_segs, &count, VERIFY_WRITE);
+        if (retval)
+                return retval;
+        iov_iter_init(&iter, iov, nr_segs, count, 0);
 
         /*
          * Might this read be for a stacking filesystem?  Then when reading
@@ -1436,10 +1448,10 @@ static void do_shmem_file_read(struct file *filp, loff_t *ppos, read_descriptor_
                                 break;
                 }
 
-                desc->error = shmem_getpage(inode, index, &page, sgp, NULL);
-                if (desc->error) {
-                        if (desc->error == -EINVAL)
-                                desc->error = 0;
+                error = shmem_getpage(inode, index, &page, sgp, NULL);
+                if (error) {
+                        if (error == -EINVAL)
+                                error = 0;
                         break;
                 }
                 if (page)
@@ -1483,61 +1495,26 @@ static void do_shmem_file_read(struct file *filp, loff_t *ppos, read_descriptor_
                 /*
                  * Ok, we have the page, and it's up-to-date, so
                  * now we can copy it to user space...
-                 *
-                 * The actor routine returns how many bytes were actually used..
-                 * NOTE! This may not be the same as how much of a user buffer
-                 * we filled up (we may be padding etc), so we can only update
-                 * "pos" here (the actor routine has to update the user buffer
-                 * pointers and the remaining count).
                  */
-                ret = actor(desc, page, offset, nr);
+                ret = copy_page_to_iter(page, offset, nr, &iter);
+                retval += ret;
                 offset += ret;
                 index += offset >> PAGE_CACHE_SHIFT;
                 offset &= ~PAGE_CACHE_MASK;
 
                 page_cache_release(page);
-                if (ret != nr || !desc->count)
+                if (!iov_iter_count(&iter))
                         break;
-
+                if (ret < nr) {
+                        error = -EFAULT;
+                        break;
+                }
                 cond_resched();
         }
 
         *ppos = ((loff_t) index << PAGE_CACHE_SHIFT) + offset;
-        file_accessed(filp);
-}
-
-static ssize_t shmem_file_aio_read(struct kiocb *iocb,
-                const struct iovec *iov, unsigned long nr_segs, loff_t pos)
-{
-        struct file *filp = iocb->ki_filp;
-        ssize_t retval;
-        unsigned long seg;
-        size_t count;
-        loff_t *ppos = &iocb->ki_pos;
-
-        retval = generic_segment_checks(iov, &nr_segs, &count, VERIFY_WRITE);
-        if (retval)
-                return retval;
-
-        for (seg = 0; seg < nr_segs; seg++) {
-                read_descriptor_t desc;
-
-                desc.written = 0;
-                desc.arg.buf = iov[seg].iov_base;
-                desc.count = iov[seg].iov_len;
-                if (desc.count == 0)
-                        continue;
-                desc.error = 0;
-                do_shmem_file_read(filp, ppos, &desc, file_read_actor);
-                retval += desc.written;
-                if (desc.error) {
-                        retval = retval ?: desc.error;
-                        break;
-                }
-                if (desc.count > 0)
-                        break;
-        }
-        return retval;
+        file_accessed(file);
+        return retval ? retval : error;
 }
 
 static ssize_t shmem_file_splice_read(struct file *in, loff_t *ppos,
@@ -1576,7 +1553,7 @@ static ssize_t shmem_file_splice_read(struct file *in, loff_t *ppos,
         index = *ppos >> PAGE_CACHE_SHIFT;
         loff = *ppos & ~PAGE_CACHE_MASK;
         req_pages = (len + loff + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-        nr_pages = min(req_pages, pipe->buffers);
+        nr_pages = min(req_pages, spd.nr_pages_max);
 
         spd.nr_pages = find_get_pages_contig(mapping, index,
                                                 nr_pages, spd.pages);