1ed29b0b4SJens Axboe // SPDX-License-Identifier: GPL-2.0 2ed29b0b4SJens Axboe /* 3ed29b0b4SJens Axboe * Shared application/kernel submission and completion ring pairs, for 4ed29b0b4SJens Axboe * supporting fast/efficient IO. 5ed29b0b4SJens Axboe * 6ed29b0b4SJens Axboe * A note on the read/write ordering memory barriers that are matched between 7ed29b0b4SJens Axboe * the application and kernel side. 8ed29b0b4SJens Axboe * 9ed29b0b4SJens Axboe * After the application reads the CQ ring tail, it must use an 10ed29b0b4SJens Axboe * appropriate smp_rmb() to pair with the smp_wmb() the kernel uses 11ed29b0b4SJens Axboe * before writing the tail (using smp_load_acquire to read the tail will 12ed29b0b4SJens Axboe * do). It also needs a smp_mb() before updating CQ head (ordering the 13ed29b0b4SJens Axboe * entry load(s) with the head store), pairing with an implicit barrier 14ed29b0b4SJens Axboe * through a control-dependency in io_get_cqe (smp_store_release to 15ed29b0b4SJens Axboe * store head will do). Failure to do so could lead to reading invalid 16ed29b0b4SJens Axboe * CQ entries. 17ed29b0b4SJens Axboe * 18ed29b0b4SJens Axboe * Likewise, the application must use an appropriate smp_wmb() before 19ed29b0b4SJens Axboe * writing the SQ tail (ordering SQ entry stores with the tail store), 20ed29b0b4SJens Axboe * which pairs with smp_load_acquire in io_get_sqring (smp_store_release 21ed29b0b4SJens Axboe * to store the tail will do). And it needs a barrier ordering the SQ 22ed29b0b4SJens Axboe * head load before writing new SQ entries (smp_load_acquire to read 23ed29b0b4SJens Axboe * head will do). 24ed29b0b4SJens Axboe * 25ed29b0b4SJens Axboe * When using the SQ poll thread (IORING_SETUP_SQPOLL), the application 26ed29b0b4SJens Axboe * needs to check the SQ flags for IORING_SQ_NEED_WAKEUP *after* 27ed29b0b4SJens Axboe * updating the SQ tail; a full memory barrier smp_mb() is needed 28ed29b0b4SJens Axboe * between. 29ed29b0b4SJens Axboe * 30ed29b0b4SJens Axboe * Also see the examples in the liburing library: 31ed29b0b4SJens Axboe * 32ed29b0b4SJens Axboe * git://git.kernel.dk/liburing 33ed29b0b4SJens Axboe * 34ed29b0b4SJens Axboe * io_uring also uses READ/WRITE_ONCE() for _any_ store or load that happens 35ed29b0b4SJens Axboe * from data shared between the kernel and application. This is done both 36ed29b0b4SJens Axboe * for ordering purposes, but also to ensure that once a value is loaded from 37ed29b0b4SJens Axboe * data that the application could potentially modify, it remains stable. 38ed29b0b4SJens Axboe * 39ed29b0b4SJens Axboe * Copyright (C) 2018-2019 Jens Axboe 40ed29b0b4SJens Axboe * Copyright (c) 2018-2019 Christoph Hellwig 41ed29b0b4SJens Axboe */ 42ed29b0b4SJens Axboe #include <linux/kernel.h> 43ed29b0b4SJens Axboe #include <linux/init.h> 44ed29b0b4SJens Axboe #include <linux/errno.h> 45ed29b0b4SJens Axboe #include <linux/syscalls.h> 46ed29b0b4SJens Axboe #include <net/compat.h> 47ed29b0b4SJens Axboe #include <linux/refcount.h> 48ed29b0b4SJens Axboe #include <linux/uio.h> 49ed29b0b4SJens Axboe #include <linux/bits.h> 50ed29b0b4SJens Axboe 51ed29b0b4SJens Axboe #include <linux/sched/signal.h> 52ed29b0b4SJens Axboe #include <linux/fs.h> 53ed29b0b4SJens Axboe #include <linux/file.h> 54ed29b0b4SJens Axboe #include <linux/fdtable.h> 55ed29b0b4SJens Axboe #include <linux/mm.h> 56ed29b0b4SJens Axboe #include <linux/mman.h> 57ed29b0b4SJens Axboe #include <linux/percpu.h> 58ed29b0b4SJens Axboe #include <linux/slab.h> 59ed29b0b4SJens Axboe #include <linux/bvec.h> 60ed29b0b4SJens Axboe #include <linux/net.h> 61ed29b0b4SJens Axboe #include <net/sock.h> 62ed29b0b4SJens Axboe #include <net/af_unix.h> 63ed29b0b4SJens Axboe #include <net/scm.h> 64ed29b0b4SJens Axboe #include <linux/anon_inodes.h> 65ed29b0b4SJens Axboe #include <linux/sched/mm.h> 66ed29b0b4SJens Axboe #include <linux/uaccess.h> 67ed29b0b4SJens Axboe #include <linux/nospec.h> 68ed29b0b4SJens Axboe #include <linux/highmem.h> 69ed29b0b4SJens Axboe #include <linux/fsnotify.h> 70ed29b0b4SJens Axboe #include <linux/fadvise.h> 71ed29b0b4SJens Axboe #include <linux/task_work.h> 72ed29b0b4SJens Axboe #include <linux/io_uring.h> 73ed29b0b4SJens Axboe #include <linux/audit.h> 74ed29b0b4SJens Axboe #include <linux/security.h> 75d808459bSHelge Deller #include <asm/shmparam.h> 76ed29b0b4SJens Axboe 77ed29b0b4SJens Axboe #define CREATE_TRACE_POINTS 78ed29b0b4SJens Axboe #include <trace/events/io_uring.h> 79ed29b0b4SJens Axboe 80ed29b0b4SJens Axboe #include <uapi/linux/io_uring.h> 81ed29b0b4SJens Axboe 82ed29b0b4SJens Axboe #include "io-wq.h" 83ed29b0b4SJens Axboe 84de23077eSJens Axboe #include "io_uring.h" 85329061d3SJens Axboe #include "opdef.h" 86e418bbc9SJens Axboe #include "refs.h" 87c9f06aa7SJens Axboe #include "tctx.h" 8817437f31SJens Axboe #include "sqpoll.h" 89a4ad4f74SJens Axboe #include "fdinfo.h" 903b77495aSJens Axboe #include "kbuf.h" 9173572984SJens Axboe #include "rsrc.h" 9238513c46SHao Xu #include "cancel.h" 9343e0bbbdSJens Axboe #include "net.h" 94eb42cebbSPavel Begunkov #include "notif.h" 95e27f928eSJens Axboe 9659915143SJens Axboe #include "timeout.h" 97329061d3SJens Axboe #include "poll.h" 98c92fcfc2SJens Axboe #include "rw.h" 999b797a37SJens Axboe #include "alloc_cache.h" 1005e2a18d9SJens Axboe 101ed29b0b4SJens Axboe #define IORING_MAX_ENTRIES 32768 102ed29b0b4SJens Axboe #define IORING_MAX_CQ_ENTRIES (2 * IORING_MAX_ENTRIES) 103ed29b0b4SJens Axboe 104ed29b0b4SJens Axboe #define IORING_MAX_RESTRICTIONS (IORING_RESTRICTION_LAST + \ 105ed29b0b4SJens Axboe IORING_REGISTER_LAST + IORING_OP_LAST) 106ed29b0b4SJens Axboe 107ed29b0b4SJens Axboe #define SQE_COMMON_FLAGS (IOSQE_FIXED_FILE | IOSQE_IO_LINK | \ 108ed29b0b4SJens Axboe IOSQE_IO_HARDLINK | IOSQE_ASYNC) 109ed29b0b4SJens Axboe 110ed29b0b4SJens Axboe #define SQE_VALID_FLAGS (SQE_COMMON_FLAGS | IOSQE_BUFFER_SELECT | \ 111ed29b0b4SJens Axboe IOSQE_IO_DRAIN | IOSQE_CQE_SKIP_SUCCESS) 112ed29b0b4SJens Axboe 113ed29b0b4SJens Axboe #define IO_REQ_CLEAN_FLAGS (REQ_F_BUFFER_SELECTED | REQ_F_NEED_CLEANUP | \ 114ed29b0b4SJens Axboe REQ_F_POLLED | REQ_F_INFLIGHT | REQ_F_CREDS | \ 115ed29b0b4SJens Axboe REQ_F_ASYNC_DATA) 116ed29b0b4SJens Axboe 117ed29b0b4SJens Axboe #define IO_REQ_CLEAN_SLOW_FLAGS (REQ_F_REFCOUNT | REQ_F_LINK | REQ_F_HARDLINK |\ 118ed29b0b4SJens Axboe IO_REQ_CLEAN_FLAGS) 119ed29b0b4SJens Axboe 120ed29b0b4SJens Axboe #define IO_TCTX_REFS_CACHE_NR (1U << 10) 121ed29b0b4SJens Axboe 122ed29b0b4SJens Axboe #define IO_COMPL_BATCH 32 123ed29b0b4SJens Axboe #define IO_REQ_ALLOC_BATCH 8 124ed29b0b4SJens Axboe 125ed29b0b4SJens Axboe enum { 126ed29b0b4SJens Axboe IO_CHECK_CQ_OVERFLOW_BIT, 127ed29b0b4SJens Axboe IO_CHECK_CQ_DROPPED_BIT, 128ed29b0b4SJens Axboe }; 129ed29b0b4SJens Axboe 13021a091b9SDylan Yudaken enum { 13121a091b9SDylan Yudaken IO_EVENTFD_OP_SIGNAL_BIT, 13221a091b9SDylan Yudaken IO_EVENTFD_OP_FREE_BIT, 13321a091b9SDylan Yudaken }; 13421a091b9SDylan Yudaken 135ed29b0b4SJens Axboe struct io_defer_entry { 136ed29b0b4SJens Axboe struct list_head list; 137ed29b0b4SJens Axboe struct io_kiocb *req; 138ed29b0b4SJens Axboe u32 seq; 139ed29b0b4SJens Axboe }; 140ed29b0b4SJens Axboe 141ed29b0b4SJens Axboe /* requests with any of those set should undergo io_disarm_next() */ 142ed29b0b4SJens Axboe #define IO_DISARM_MASK (REQ_F_ARM_LTIMEOUT | REQ_F_LINK_TIMEOUT | REQ_F_FAIL) 143ed29b0b4SJens Axboe #define IO_REQ_LINK_FLAGS (REQ_F_LINK | REQ_F_HARDLINK) 144ed29b0b4SJens Axboe 145affa87dbSPavel Begunkov static bool io_uring_try_cancel_requests(struct io_ring_ctx *ctx, 146ed29b0b4SJens Axboe struct task_struct *task, 147ed29b0b4SJens Axboe bool cancel_all); 148ed29b0b4SJens Axboe 149ed29b0b4SJens Axboe static void io_dismantle_req(struct io_kiocb *req); 150ed29b0b4SJens Axboe static void io_clean_op(struct io_kiocb *req); 151ed29b0b4SJens Axboe static void io_queue_sqe(struct io_kiocb *req); 152c0e0d6baSDylan Yudaken static void io_move_task_work_from_local(struct io_ring_ctx *ctx); 153ed29b0b4SJens Axboe static void __io_submit_flush_completions(struct io_ring_ctx *ctx); 15477e443abSPavel Begunkov static __cold void io_fallback_tw(struct io_uring_task *tctx); 155ed29b0b4SJens Axboe 156c1755c25SBreno Leitao struct kmem_cache *req_cachep; 157ed29b0b4SJens Axboe 158ed29b0b4SJens Axboe struct sock *io_uring_get_socket(struct file *file) 159ed29b0b4SJens Axboe { 160ed29b0b4SJens Axboe #if defined(CONFIG_UNIX) 161cd40cae2SJens Axboe if (io_is_uring_fops(file)) { 162ed29b0b4SJens Axboe struct io_ring_ctx *ctx = file->private_data; 163ed29b0b4SJens Axboe 164ed29b0b4SJens Axboe return ctx->ring_sock->sk; 165ed29b0b4SJens Axboe } 166ed29b0b4SJens Axboe #endif 167ed29b0b4SJens Axboe return NULL; 168ed29b0b4SJens Axboe } 169ed29b0b4SJens Axboe EXPORT_SYMBOL(io_uring_get_socket); 170ed29b0b4SJens Axboe 171ed29b0b4SJens Axboe static inline void io_submit_flush_completions(struct io_ring_ctx *ctx) 172ed29b0b4SJens Axboe { 173931147ddSDylan Yudaken if (!wq_list_empty(&ctx->submit_state.compl_reqs) || 174931147ddSDylan Yudaken ctx->submit_state.cqes_count) 175ed29b0b4SJens Axboe __io_submit_flush_completions(ctx); 176ed29b0b4SJens Axboe } 177ed29b0b4SJens Axboe 178faf88ddeSPavel Begunkov static inline unsigned int __io_cqring_events(struct io_ring_ctx *ctx) 179faf88ddeSPavel Begunkov { 180faf88ddeSPavel Begunkov return ctx->cached_cq_tail - READ_ONCE(ctx->rings->cq.head); 181faf88ddeSPavel Begunkov } 182faf88ddeSPavel Begunkov 1830fc8c2acSDylan Yudaken static inline unsigned int __io_cqring_events_user(struct io_ring_ctx *ctx) 1840fc8c2acSDylan Yudaken { 1850fc8c2acSDylan Yudaken return READ_ONCE(ctx->rings->cq.tail) - READ_ONCE(ctx->rings->cq.head); 1860fc8c2acSDylan Yudaken } 1870fc8c2acSDylan Yudaken 188ed29b0b4SJens Axboe static bool io_match_linked(struct io_kiocb *head) 189ed29b0b4SJens Axboe { 190ed29b0b4SJens Axboe struct io_kiocb *req; 191ed29b0b4SJens Axboe 192ed29b0b4SJens Axboe io_for_each_link(req, head) { 193ed29b0b4SJens Axboe if (req->flags & REQ_F_INFLIGHT) 194ed29b0b4SJens Axboe return true; 195ed29b0b4SJens Axboe } 196ed29b0b4SJens Axboe return false; 197ed29b0b4SJens Axboe } 198ed29b0b4SJens Axboe 199ed29b0b4SJens Axboe /* 200ed29b0b4SJens Axboe * As io_match_task() but protected against racing with linked timeouts. 201ed29b0b4SJens Axboe * User must not hold timeout_lock. 202ed29b0b4SJens Axboe */ 203329061d3SJens Axboe bool io_match_task_safe(struct io_kiocb *head, struct task_struct *task, 204ed29b0b4SJens Axboe bool cancel_all) 205ed29b0b4SJens Axboe { 206ed29b0b4SJens Axboe bool matched; 207ed29b0b4SJens Axboe 208ed29b0b4SJens Axboe if (task && head->task != task) 209ed29b0b4SJens Axboe return false; 210ed29b0b4SJens Axboe if (cancel_all) 211ed29b0b4SJens Axboe return true; 212ed29b0b4SJens Axboe 213ed29b0b4SJens Axboe if (head->flags & REQ_F_LINK_TIMEOUT) { 214ed29b0b4SJens Axboe struct io_ring_ctx *ctx = head->ctx; 215ed29b0b4SJens Axboe 216ed29b0b4SJens Axboe /* protect against races with linked timeouts */ 217ed29b0b4SJens Axboe spin_lock_irq(&ctx->timeout_lock); 218ed29b0b4SJens Axboe matched = io_match_linked(head); 219ed29b0b4SJens Axboe spin_unlock_irq(&ctx->timeout_lock); 220ed29b0b4SJens Axboe } else { 221ed29b0b4SJens Axboe matched = io_match_linked(head); 222ed29b0b4SJens Axboe } 223ed29b0b4SJens Axboe return matched; 224ed29b0b4SJens Axboe } 225ed29b0b4SJens Axboe 226ed29b0b4SJens Axboe static inline void req_fail_link_node(struct io_kiocb *req, int res) 227ed29b0b4SJens Axboe { 228ed29b0b4SJens Axboe req_set_fail(req); 22997b388d7SJens Axboe io_req_set_res(req, res, 0); 230ed29b0b4SJens Axboe } 231ed29b0b4SJens Axboe 232ed29b0b4SJens Axboe static inline void io_req_add_to_cache(struct io_kiocb *req, struct io_ring_ctx *ctx) 233ed29b0b4SJens Axboe { 234ed29b0b4SJens Axboe wq_stack_add_head(&req->comp_list, &ctx->submit_state.free_list); 235c1755c25SBreno Leitao kasan_poison_object_data(req_cachep, req); 236ed29b0b4SJens Axboe } 237ed29b0b4SJens Axboe 238ed29b0b4SJens Axboe static __cold void io_ring_ctx_ref_free(struct percpu_ref *ref) 239ed29b0b4SJens Axboe { 240ed29b0b4SJens Axboe struct io_ring_ctx *ctx = container_of(ref, struct io_ring_ctx, refs); 241ed29b0b4SJens Axboe 242ed29b0b4SJens Axboe complete(&ctx->ref_comp); 243ed29b0b4SJens Axboe } 244ed29b0b4SJens Axboe 245ed29b0b4SJens Axboe static __cold void io_fallback_req_func(struct work_struct *work) 246ed29b0b4SJens Axboe { 247ed29b0b4SJens Axboe struct io_ring_ctx *ctx = container_of(work, struct io_ring_ctx, 248ed29b0b4SJens Axboe fallback_work.work); 249ed29b0b4SJens Axboe struct llist_node *node = llist_del_all(&ctx->fallback_llist); 250ed29b0b4SJens Axboe struct io_kiocb *req, *tmp; 251a282967cSPavel Begunkov struct io_tw_state ts = { .locked = true, }; 252ed29b0b4SJens Axboe 25331f084b7SPavel Begunkov mutex_lock(&ctx->uring_lock); 2543218e5d3SPavel Begunkov llist_for_each_entry_safe(req, tmp, node, io_task_work.node) 255a282967cSPavel Begunkov req->io_task_work.func(req, &ts); 256a282967cSPavel Begunkov if (WARN_ON_ONCE(!ts.locked)) 25731f084b7SPavel Begunkov return; 258ed29b0b4SJens Axboe io_submit_flush_completions(ctx); 259ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 260ed29b0b4SJens Axboe } 261ed29b0b4SJens Axboe 262e6f89be6SPavel Begunkov static int io_alloc_hash_table(struct io_hash_table *table, unsigned bits) 263e6f89be6SPavel Begunkov { 264e6f89be6SPavel Begunkov unsigned hash_buckets = 1U << bits; 265e6f89be6SPavel Begunkov size_t hash_size = hash_buckets * sizeof(table->hbs[0]); 266e6f89be6SPavel Begunkov 267e6f89be6SPavel Begunkov table->hbs = kmalloc(hash_size, GFP_KERNEL); 268e6f89be6SPavel Begunkov if (!table->hbs) 269e6f89be6SPavel Begunkov return -ENOMEM; 270e6f89be6SPavel Begunkov 271e6f89be6SPavel Begunkov table->hash_bits = bits; 272e6f89be6SPavel Begunkov init_hash_table(table, hash_buckets); 273e6f89be6SPavel Begunkov return 0; 274e6f89be6SPavel Begunkov } 275e6f89be6SPavel Begunkov 276ed29b0b4SJens Axboe static __cold struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p) 277ed29b0b4SJens Axboe { 278ed29b0b4SJens Axboe struct io_ring_ctx *ctx; 279ed29b0b4SJens Axboe int hash_bits; 280ed29b0b4SJens Axboe 281ed29b0b4SJens Axboe ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); 282ed29b0b4SJens Axboe if (!ctx) 283ed29b0b4SJens Axboe return NULL; 284ed29b0b4SJens Axboe 285ed29b0b4SJens Axboe xa_init(&ctx->io_bl_xa); 286ed29b0b4SJens Axboe 287ed29b0b4SJens Axboe /* 288ed29b0b4SJens Axboe * Use 5 bits less than the max cq entries, that should give us around 2894a07723fSPavel Begunkov * 32 entries per hash list if totally full and uniformly spread, but 2904a07723fSPavel Begunkov * don't keep too many buckets to not overconsume memory. 291ed29b0b4SJens Axboe */ 2924a07723fSPavel Begunkov hash_bits = ilog2(p->cq_entries) - 5; 2934a07723fSPavel Begunkov hash_bits = clamp(hash_bits, 1, 8); 294e6f89be6SPavel Begunkov if (io_alloc_hash_table(&ctx->cancel_table, hash_bits)) 295ed29b0b4SJens Axboe goto err; 2969ca9fb24SPavel Begunkov if (io_alloc_hash_table(&ctx->cancel_table_locked, hash_bits)) 2979ca9fb24SPavel Begunkov goto err; 29838513c46SHao Xu 299ed29b0b4SJens Axboe ctx->dummy_ubuf = kzalloc(sizeof(*ctx->dummy_ubuf), GFP_KERNEL); 300ed29b0b4SJens Axboe if (!ctx->dummy_ubuf) 301ed29b0b4SJens Axboe goto err; 302ed29b0b4SJens Axboe /* set invalid range, so io_import_fixed() fails meeting it */ 303ed29b0b4SJens Axboe ctx->dummy_ubuf->ubuf = -1UL; 304ed29b0b4SJens Axboe 305ed29b0b4SJens Axboe if (percpu_ref_init(&ctx->refs, io_ring_ctx_ref_free, 30648904229SMichal Koutný 0, GFP_KERNEL)) 307ed29b0b4SJens Axboe goto err; 308ed29b0b4SJens Axboe 309ed29b0b4SJens Axboe ctx->flags = p->flags; 310ed29b0b4SJens Axboe init_waitqueue_head(&ctx->sqo_sq_wait); 311ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->sqd_list); 312ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->cq_overflow_list); 313ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->io_buffers_cache); 31469bbc6adSPavel Begunkov io_alloc_cache_init(&ctx->rsrc_node_cache, IO_NODE_ALLOC_CACHE_MAX, 31569bbc6adSPavel Begunkov sizeof(struct io_rsrc_node)); 31669bbc6adSPavel Begunkov io_alloc_cache_init(&ctx->apoll_cache, IO_ALLOC_CACHE_MAX, 31769bbc6adSPavel Begunkov sizeof(struct async_poll)); 31869bbc6adSPavel Begunkov io_alloc_cache_init(&ctx->netmsg_cache, IO_ALLOC_CACHE_MAX, 31969bbc6adSPavel Begunkov sizeof(struct io_async_msghdr)); 320ed29b0b4SJens Axboe init_completion(&ctx->ref_comp); 321ed29b0b4SJens Axboe xa_init_flags(&ctx->personalities, XA_FLAGS_ALLOC1); 322ed29b0b4SJens Axboe mutex_init(&ctx->uring_lock); 323ed29b0b4SJens Axboe init_waitqueue_head(&ctx->cq_wait); 3247b235dd8SPavel Begunkov init_waitqueue_head(&ctx->poll_wq); 3254ea15b56SPavel Begunkov init_waitqueue_head(&ctx->rsrc_quiesce_wq); 326ed29b0b4SJens Axboe spin_lock_init(&ctx->completion_lock); 327ed29b0b4SJens Axboe spin_lock_init(&ctx->timeout_lock); 328ed29b0b4SJens Axboe INIT_WQ_LIST(&ctx->iopoll_list); 329ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->io_buffers_pages); 330ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->io_buffers_comp); 331ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->defer_list); 332ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->timeout_list); 333ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->ltimeout_list); 334ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->rsrc_ref_list); 335c0e0d6baSDylan Yudaken init_llist_head(&ctx->work_llist); 336ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->tctx_list); 337ed29b0b4SJens Axboe ctx->submit_state.free_list.next = NULL; 338ed29b0b4SJens Axboe INIT_WQ_LIST(&ctx->locked_free_list); 339ed29b0b4SJens Axboe INIT_DELAYED_WORK(&ctx->fallback_work, io_fallback_req_func); 340ed29b0b4SJens Axboe INIT_WQ_LIST(&ctx->submit_state.compl_reqs); 341ed29b0b4SJens Axboe return ctx; 342ed29b0b4SJens Axboe err: 343ed29b0b4SJens Axboe kfree(ctx->dummy_ubuf); 344e6f89be6SPavel Begunkov kfree(ctx->cancel_table.hbs); 3459ca9fb24SPavel Begunkov kfree(ctx->cancel_table_locked.hbs); 346ed29b0b4SJens Axboe kfree(ctx->io_bl); 347ed29b0b4SJens Axboe xa_destroy(&ctx->io_bl_xa); 348ed29b0b4SJens Axboe kfree(ctx); 349ed29b0b4SJens Axboe return NULL; 350ed29b0b4SJens Axboe } 351ed29b0b4SJens Axboe 352ed29b0b4SJens Axboe static void io_account_cq_overflow(struct io_ring_ctx *ctx) 353ed29b0b4SJens Axboe { 354ed29b0b4SJens Axboe struct io_rings *r = ctx->rings; 355ed29b0b4SJens Axboe 356ed29b0b4SJens Axboe WRITE_ONCE(r->cq_overflow, READ_ONCE(r->cq_overflow) + 1); 357ed29b0b4SJens Axboe ctx->cq_extra--; 358ed29b0b4SJens Axboe } 359ed29b0b4SJens Axboe 360ed29b0b4SJens Axboe static bool req_need_defer(struct io_kiocb *req, u32 seq) 361ed29b0b4SJens Axboe { 362ed29b0b4SJens Axboe if (unlikely(req->flags & REQ_F_IO_DRAIN)) { 363ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 364ed29b0b4SJens Axboe 365ed29b0b4SJens Axboe return seq + READ_ONCE(ctx->cq_extra) != ctx->cached_cq_tail; 366ed29b0b4SJens Axboe } 367ed29b0b4SJens Axboe 368ed29b0b4SJens Axboe return false; 369ed29b0b4SJens Axboe } 370ed29b0b4SJens Axboe 371ed29b0b4SJens Axboe static inline void io_req_track_inflight(struct io_kiocb *req) 372ed29b0b4SJens Axboe { 373ed29b0b4SJens Axboe if (!(req->flags & REQ_F_INFLIGHT)) { 374ed29b0b4SJens Axboe req->flags |= REQ_F_INFLIGHT; 375ed29b0b4SJens Axboe atomic_inc(&req->task->io_uring->inflight_tracked); 376ed29b0b4SJens Axboe } 377ed29b0b4SJens Axboe } 378ed29b0b4SJens Axboe 379ed29b0b4SJens Axboe static struct io_kiocb *__io_prep_linked_timeout(struct io_kiocb *req) 380ed29b0b4SJens Axboe { 381ed29b0b4SJens Axboe if (WARN_ON_ONCE(!req->link)) 382ed29b0b4SJens Axboe return NULL; 383ed29b0b4SJens Axboe 384ed29b0b4SJens Axboe req->flags &= ~REQ_F_ARM_LTIMEOUT; 385ed29b0b4SJens Axboe req->flags |= REQ_F_LINK_TIMEOUT; 386ed29b0b4SJens Axboe 387ed29b0b4SJens Axboe /* linked timeouts should have two refs once prep'ed */ 388ed29b0b4SJens Axboe io_req_set_refcount(req); 389ed29b0b4SJens Axboe __io_req_set_refcount(req->link, 2); 390ed29b0b4SJens Axboe return req->link; 391ed29b0b4SJens Axboe } 392ed29b0b4SJens Axboe 393ed29b0b4SJens Axboe static inline struct io_kiocb *io_prep_linked_timeout(struct io_kiocb *req) 394ed29b0b4SJens Axboe { 395ed29b0b4SJens Axboe if (likely(!(req->flags & REQ_F_ARM_LTIMEOUT))) 396ed29b0b4SJens Axboe return NULL; 397ed29b0b4SJens Axboe return __io_prep_linked_timeout(req); 398ed29b0b4SJens Axboe } 399ed29b0b4SJens Axboe 400ed29b0b4SJens Axboe static noinline void __io_arm_ltimeout(struct io_kiocb *req) 401ed29b0b4SJens Axboe { 402ed29b0b4SJens Axboe io_queue_linked_timeout(__io_prep_linked_timeout(req)); 403ed29b0b4SJens Axboe } 404ed29b0b4SJens Axboe 405ed29b0b4SJens Axboe static inline void io_arm_ltimeout(struct io_kiocb *req) 406ed29b0b4SJens Axboe { 407ed29b0b4SJens Axboe if (unlikely(req->flags & REQ_F_ARM_LTIMEOUT)) 408ed29b0b4SJens Axboe __io_arm_ltimeout(req); 409ed29b0b4SJens Axboe } 410ed29b0b4SJens Axboe 411ed29b0b4SJens Axboe static void io_prep_async_work(struct io_kiocb *req) 412ed29b0b4SJens Axboe { 413a7dd2782SBreno Leitao const struct io_issue_def *def = &io_issue_defs[req->opcode]; 414ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 415ed29b0b4SJens Axboe 416ed29b0b4SJens Axboe if (!(req->flags & REQ_F_CREDS)) { 417ed29b0b4SJens Axboe req->flags |= REQ_F_CREDS; 418ed29b0b4SJens Axboe req->creds = get_current_cred(); 419ed29b0b4SJens Axboe } 420ed29b0b4SJens Axboe 421ed29b0b4SJens Axboe req->work.list.next = NULL; 422ed29b0b4SJens Axboe req->work.flags = 0; 423ed29b0b4SJens Axboe req->work.cancel_seq = atomic_read(&ctx->cancel_seq); 424ed29b0b4SJens Axboe if (req->flags & REQ_F_FORCE_ASYNC) 425ed29b0b4SJens Axboe req->work.flags |= IO_WQ_WORK_CONCURRENT; 426ed29b0b4SJens Axboe 427*3beed235SChristoph Hellwig if (req->file && !(req->flags & REQ_F_FIXED_FILE)) 428f6b543fdSJens Axboe req->flags |= io_file_get_flags(req->file) << REQ_F_SUPPORT_NOWAIT_BIT; 429f6b543fdSJens Axboe 4308b1df11fSPavel Begunkov if (req->file && (req->flags & REQ_F_ISREG)) { 431d4755e15SJens Axboe bool should_hash = def->hash_reg_file; 432d4755e15SJens Axboe 433d4755e15SJens Axboe /* don't serialize this request if the fs doesn't need it */ 434d4755e15SJens Axboe if (should_hash && (req->file->f_flags & O_DIRECT) && 435d4755e15SJens Axboe (req->file->f_mode & FMODE_DIO_PARALLEL_WRITE)) 436d4755e15SJens Axboe should_hash = false; 437d4755e15SJens Axboe if (should_hash || (ctx->flags & IORING_SETUP_IOPOLL)) 438ed29b0b4SJens Axboe io_wq_hash_work(&req->work, file_inode(req->file)); 439ed29b0b4SJens Axboe } else if (!req->file || !S_ISBLK(file_inode(req->file)->i_mode)) { 440ed29b0b4SJens Axboe if (def->unbound_nonreg_file) 441ed29b0b4SJens Axboe req->work.flags |= IO_WQ_WORK_UNBOUND; 442ed29b0b4SJens Axboe } 443ed29b0b4SJens Axboe } 444ed29b0b4SJens Axboe 445ed29b0b4SJens Axboe static void io_prep_async_link(struct io_kiocb *req) 446ed29b0b4SJens Axboe { 447ed29b0b4SJens Axboe struct io_kiocb *cur; 448ed29b0b4SJens Axboe 449ed29b0b4SJens Axboe if (req->flags & REQ_F_LINK_TIMEOUT) { 450ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 451ed29b0b4SJens Axboe 452ed29b0b4SJens Axboe spin_lock_irq(&ctx->timeout_lock); 453ed29b0b4SJens Axboe io_for_each_link(cur, req) 454ed29b0b4SJens Axboe io_prep_async_work(cur); 455ed29b0b4SJens Axboe spin_unlock_irq(&ctx->timeout_lock); 456ed29b0b4SJens Axboe } else { 457ed29b0b4SJens Axboe io_for_each_link(cur, req) 458ed29b0b4SJens Axboe io_prep_async_work(cur); 459ed29b0b4SJens Axboe } 460ed29b0b4SJens Axboe } 461ed29b0b4SJens Axboe 462a282967cSPavel Begunkov void io_queue_iowq(struct io_kiocb *req, struct io_tw_state *ts_dont_use) 463ed29b0b4SJens Axboe { 464ed29b0b4SJens Axboe struct io_kiocb *link = io_prep_linked_timeout(req); 465ed29b0b4SJens Axboe struct io_uring_task *tctx = req->task->io_uring; 466ed29b0b4SJens Axboe 467ed29b0b4SJens Axboe BUG_ON(!tctx); 468ed29b0b4SJens Axboe BUG_ON(!tctx->io_wq); 469ed29b0b4SJens Axboe 470ed29b0b4SJens Axboe /* init ->work of the whole link before punting */ 471ed29b0b4SJens Axboe io_prep_async_link(req); 472ed29b0b4SJens Axboe 473ed29b0b4SJens Axboe /* 474ed29b0b4SJens Axboe * Not expected to happen, but if we do have a bug where this _can_ 475ed29b0b4SJens Axboe * happen, catch it here and ensure the request is marked as 476ed29b0b4SJens Axboe * canceled. That will make io-wq go through the usual work cancel 477ed29b0b4SJens Axboe * procedure rather than attempt to run this request (or create a new 478ed29b0b4SJens Axboe * worker for it). 479ed29b0b4SJens Axboe */ 480ed29b0b4SJens Axboe if (WARN_ON_ONCE(!same_thread_group(req->task, current))) 481ed29b0b4SJens Axboe req->work.flags |= IO_WQ_WORK_CANCEL; 482ed29b0b4SJens Axboe 48348863ffdSPavel Begunkov trace_io_uring_queue_async_work(req, io_wq_is_hashed(&req->work)); 484ed29b0b4SJens Axboe io_wq_enqueue(tctx->io_wq, &req->work); 485ed29b0b4SJens Axboe if (link) 486ed29b0b4SJens Axboe io_queue_linked_timeout(link); 487ed29b0b4SJens Axboe } 488ed29b0b4SJens Axboe 489ed29b0b4SJens Axboe static __cold void io_queue_deferred(struct io_ring_ctx *ctx) 490ed29b0b4SJens Axboe { 491ed29b0b4SJens Axboe while (!list_empty(&ctx->defer_list)) { 492ed29b0b4SJens Axboe struct io_defer_entry *de = list_first_entry(&ctx->defer_list, 493ed29b0b4SJens Axboe struct io_defer_entry, list); 494ed29b0b4SJens Axboe 495ed29b0b4SJens Axboe if (req_need_defer(de->req, de->seq)) 496ed29b0b4SJens Axboe break; 497ed29b0b4SJens Axboe list_del_init(&de->list); 498ed29b0b4SJens Axboe io_req_task_queue(de->req); 499ed29b0b4SJens Axboe kfree(de); 500ed29b0b4SJens Axboe } 501ed29b0b4SJens Axboe } 502ed29b0b4SJens Axboe 50321a091b9SDylan Yudaken 50421a091b9SDylan Yudaken static void io_eventfd_ops(struct rcu_head *rcu) 505d8e9214fSDylan Yudaken { 506d8e9214fSDylan Yudaken struct io_ev_fd *ev_fd = container_of(rcu, struct io_ev_fd, rcu); 50721a091b9SDylan Yudaken int ops = atomic_xchg(&ev_fd->ops, 0); 508d8e9214fSDylan Yudaken 50921a091b9SDylan Yudaken if (ops & BIT(IO_EVENTFD_OP_SIGNAL_BIT)) 51044648532SJens Axboe eventfd_signal_mask(ev_fd->cq_ev_fd, 1, EPOLL_URING_WAKE); 51121a091b9SDylan Yudaken 51221a091b9SDylan Yudaken /* IO_EVENTFD_OP_FREE_BIT may not be set here depending on callback 51321a091b9SDylan Yudaken * ordering in a race but if references are 0 we know we have to free 51421a091b9SDylan Yudaken * it regardless. 51521a091b9SDylan Yudaken */ 51621a091b9SDylan Yudaken if (atomic_dec_and_test(&ev_fd->refs)) { 517d8e9214fSDylan Yudaken eventfd_ctx_put(ev_fd->cq_ev_fd); 518d8e9214fSDylan Yudaken kfree(ev_fd); 519d8e9214fSDylan Yudaken } 52021a091b9SDylan Yudaken } 521d8e9214fSDylan Yudaken 522ed29b0b4SJens Axboe static void io_eventfd_signal(struct io_ring_ctx *ctx) 523ed29b0b4SJens Axboe { 52421a091b9SDylan Yudaken struct io_ev_fd *ev_fd = NULL; 525ed29b0b4SJens Axboe 526ed29b0b4SJens Axboe rcu_read_lock(); 527ed29b0b4SJens Axboe /* 528ed29b0b4SJens Axboe * rcu_dereference ctx->io_ev_fd once and use it for both for checking 529ed29b0b4SJens Axboe * and eventfd_signal 530ed29b0b4SJens Axboe */ 531ed29b0b4SJens Axboe ev_fd = rcu_dereference(ctx->io_ev_fd); 532ed29b0b4SJens Axboe 533ed29b0b4SJens Axboe /* 534ed29b0b4SJens Axboe * Check again if ev_fd exists incase an io_eventfd_unregister call 535ed29b0b4SJens Axboe * completed between the NULL check of ctx->io_ev_fd at the start of 536ed29b0b4SJens Axboe * the function and rcu_read_lock. 537ed29b0b4SJens Axboe */ 538ed29b0b4SJens Axboe if (unlikely(!ev_fd)) 539ed29b0b4SJens Axboe goto out; 540ed29b0b4SJens Axboe if (READ_ONCE(ctx->rings->cq_flags) & IORING_CQ_EVENTFD_DISABLED) 541ed29b0b4SJens Axboe goto out; 54221a091b9SDylan Yudaken if (ev_fd->eventfd_async && !io_wq_current_is_worker()) 54321a091b9SDylan Yudaken goto out; 544ed29b0b4SJens Axboe 54521a091b9SDylan Yudaken if (likely(eventfd_signal_allowed())) { 54644648532SJens Axboe eventfd_signal_mask(ev_fd->cq_ev_fd, 1, EPOLL_URING_WAKE); 54721a091b9SDylan Yudaken } else { 54821a091b9SDylan Yudaken atomic_inc(&ev_fd->refs); 54921a091b9SDylan Yudaken if (!atomic_fetch_or(BIT(IO_EVENTFD_OP_SIGNAL_BIT), &ev_fd->ops)) 55044a84da4SDylan Yudaken call_rcu_hurry(&ev_fd->rcu, io_eventfd_ops); 55121a091b9SDylan Yudaken else 55221a091b9SDylan Yudaken atomic_dec(&ev_fd->refs); 55321a091b9SDylan Yudaken } 55421a091b9SDylan Yudaken 555ed29b0b4SJens Axboe out: 556ed29b0b4SJens Axboe rcu_read_unlock(); 557ed29b0b4SJens Axboe } 558ed29b0b4SJens Axboe 55921a091b9SDylan Yudaken static void io_eventfd_flush_signal(struct io_ring_ctx *ctx) 56021a091b9SDylan Yudaken { 56121a091b9SDylan Yudaken bool skip; 56221a091b9SDylan Yudaken 56321a091b9SDylan Yudaken spin_lock(&ctx->completion_lock); 56421a091b9SDylan Yudaken 56521a091b9SDylan Yudaken /* 56621a091b9SDylan Yudaken * Eventfd should only get triggered when at least one event has been 56721a091b9SDylan Yudaken * posted. Some applications rely on the eventfd notification count 56821a091b9SDylan Yudaken * only changing IFF a new CQE has been added to the CQ ring. There's 56921a091b9SDylan Yudaken * no depedency on 1:1 relationship between how many times this 57021a091b9SDylan Yudaken * function is called (and hence the eventfd count) and number of CQEs 57121a091b9SDylan Yudaken * posted to the CQ ring. 57221a091b9SDylan Yudaken */ 57321a091b9SDylan Yudaken skip = ctx->cached_cq_tail == ctx->evfd_last_cq_tail; 57421a091b9SDylan Yudaken ctx->evfd_last_cq_tail = ctx->cached_cq_tail; 57521a091b9SDylan Yudaken spin_unlock(&ctx->completion_lock); 57621a091b9SDylan Yudaken if (skip) 57721a091b9SDylan Yudaken return; 57821a091b9SDylan Yudaken 57921a091b9SDylan Yudaken io_eventfd_signal(ctx); 58021a091b9SDylan Yudaken } 58121a091b9SDylan Yudaken 582a830ffd2SPavel Begunkov void __io_commit_cqring_flush(struct io_ring_ctx *ctx) 583a830ffd2SPavel Begunkov { 584bca39f39SPavel Begunkov if (ctx->poll_activated) 585bca39f39SPavel Begunkov io_poll_wq_wake(ctx); 586a830ffd2SPavel Begunkov if (ctx->off_timeout_used) 587a830ffd2SPavel Begunkov io_flush_timeouts(ctx); 588e5f30f6fSPavel Begunkov if (ctx->drain_active) { 589e5f30f6fSPavel Begunkov spin_lock(&ctx->completion_lock); 590a830ffd2SPavel Begunkov io_queue_deferred(ctx); 591a830ffd2SPavel Begunkov spin_unlock(&ctx->completion_lock); 592a830ffd2SPavel Begunkov } 593a830ffd2SPavel Begunkov if (ctx->has_evfd) 59421a091b9SDylan Yudaken io_eventfd_flush_signal(ctx); 595a830ffd2SPavel Begunkov } 596a830ffd2SPavel Begunkov 597f66f7342SPavel Begunkov static inline void __io_cq_lock(struct io_ring_ctx *ctx) 598f66f7342SPavel Begunkov __acquires(ctx->completion_lock) 599f66f7342SPavel Begunkov { 600f66f7342SPavel Begunkov if (!ctx->task_complete) 601f66f7342SPavel Begunkov spin_lock(&ctx->completion_lock); 602f66f7342SPavel Begunkov } 603f66f7342SPavel Begunkov 604f66f7342SPavel Begunkov static inline void __io_cq_unlock(struct io_ring_ctx *ctx) 605f66f7342SPavel Begunkov { 606f66f7342SPavel Begunkov if (!ctx->task_complete) 607f66f7342SPavel Begunkov spin_unlock(&ctx->completion_lock); 608f66f7342SPavel Begunkov } 609f66f7342SPavel Begunkov 6106971253fSPavel Begunkov static inline void io_cq_lock(struct io_ring_ctx *ctx) 6116971253fSPavel Begunkov __acquires(ctx->completion_lock) 6126971253fSPavel Begunkov { 6136971253fSPavel Begunkov spin_lock(&ctx->completion_lock); 6146971253fSPavel Begunkov } 6156971253fSPavel Begunkov 6166971253fSPavel Begunkov static inline void io_cq_unlock(struct io_ring_ctx *ctx) 6176971253fSPavel Begunkov __releases(ctx->completion_lock) 6186971253fSPavel Begunkov { 6196971253fSPavel Begunkov spin_unlock(&ctx->completion_lock); 6206971253fSPavel Begunkov } 6216971253fSPavel Begunkov 6225d772916SPavel Begunkov /* keep it inlined for io_submit_flush_completions() */ 623f66f7342SPavel Begunkov static inline void __io_cq_unlock_post(struct io_ring_ctx *ctx) 62425399321SPavel Begunkov __releases(ctx->completion_lock) 62525399321SPavel Begunkov { 62625399321SPavel Begunkov io_commit_cqring(ctx); 627f66f7342SPavel Begunkov __io_cq_unlock(ctx); 6286c16fe3cSJens Axboe io_commit_cqring_flush(ctx); 6296c16fe3cSJens Axboe io_cqring_wake(ctx); 63025399321SPavel Begunkov } 63125399321SPavel Begunkov 632c66ae3ecSPavel Begunkov static void __io_cq_unlock_post_flush(struct io_ring_ctx *ctx) 6333181e22fSPavel Begunkov __releases(ctx->completion_lock) 6343181e22fSPavel Begunkov { 6353181e22fSPavel Begunkov io_commit_cqring(ctx); 636c66ae3ecSPavel Begunkov 637c66ae3ecSPavel Begunkov if (ctx->task_complete) { 638c66ae3ecSPavel Begunkov /* 639c66ae3ecSPavel Begunkov * ->task_complete implies that only current might be waiting 640c66ae3ecSPavel Begunkov * for CQEs, and obviously, we currently don't. No one is 641c66ae3ecSPavel Begunkov * waiting, wakeups are futile, skip them. 642c66ae3ecSPavel Begunkov */ 643c66ae3ecSPavel Begunkov io_commit_cqring_flush(ctx); 644c66ae3ecSPavel Begunkov } else { 6453181e22fSPavel Begunkov __io_cq_unlock(ctx); 6463181e22fSPavel Begunkov io_commit_cqring_flush(ctx); 6476e7248adSPavel Begunkov io_cqring_wake(ctx); 6483181e22fSPavel Begunkov } 6493181e22fSPavel Begunkov } 6503181e22fSPavel Begunkov 65125399321SPavel Begunkov void io_cq_unlock_post(struct io_ring_ctx *ctx) 6525d772916SPavel Begunkov __releases(ctx->completion_lock) 65325399321SPavel Begunkov { 654f66f7342SPavel Begunkov io_commit_cqring(ctx); 655f66f7342SPavel Begunkov spin_unlock(&ctx->completion_lock); 656f66f7342SPavel Begunkov io_commit_cqring_flush(ctx); 657f66f7342SPavel Begunkov io_cqring_wake(ctx); 65825399321SPavel Begunkov } 65925399321SPavel Begunkov 660ed29b0b4SJens Axboe /* Returns true if there are no backlogged entries after the flush */ 661a85381d8SPavel Begunkov static void io_cqring_overflow_kill(struct io_ring_ctx *ctx) 662ed29b0b4SJens Axboe { 663a85381d8SPavel Begunkov struct io_overflow_cqe *ocqe; 664a85381d8SPavel Begunkov LIST_HEAD(list); 665a85381d8SPavel Begunkov 666a85381d8SPavel Begunkov io_cq_lock(ctx); 667a85381d8SPavel Begunkov list_splice_init(&ctx->cq_overflow_list, &list); 668a85381d8SPavel Begunkov clear_bit(IO_CHECK_CQ_OVERFLOW_BIT, &ctx->check_cq); 669a85381d8SPavel Begunkov io_cq_unlock(ctx); 670a85381d8SPavel Begunkov 671a85381d8SPavel Begunkov while (!list_empty(&list)) { 672a85381d8SPavel Begunkov ocqe = list_first_entry(&list, struct io_overflow_cqe, list); 673a85381d8SPavel Begunkov list_del(&ocqe->list); 674a85381d8SPavel Begunkov kfree(ocqe); 675a85381d8SPavel Begunkov } 676a85381d8SPavel Begunkov } 677a85381d8SPavel Begunkov 6781b346e4aSPavel Begunkov static void __io_cqring_overflow_flush(struct io_ring_ctx *ctx) 679ed29b0b4SJens Axboe { 680ed29b0b4SJens Axboe size_t cqe_size = sizeof(struct io_uring_cqe); 681ed29b0b4SJens Axboe 682a85381d8SPavel Begunkov if (__io_cqring_events(ctx) == ctx->cq_entries) 6831b346e4aSPavel Begunkov return; 684ed29b0b4SJens Axboe 685ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_CQE32) 686ed29b0b4SJens Axboe cqe_size <<= 1; 687ed29b0b4SJens Axboe 68825399321SPavel Begunkov io_cq_lock(ctx); 689ed29b0b4SJens Axboe while (!list_empty(&ctx->cq_overflow_list)) { 690aa1df3a3SPavel Begunkov struct io_uring_cqe *cqe = io_get_cqe_overflow(ctx, true); 691ed29b0b4SJens Axboe struct io_overflow_cqe *ocqe; 692ed29b0b4SJens Axboe 693a85381d8SPavel Begunkov if (!cqe) 694ed29b0b4SJens Axboe break; 695ed29b0b4SJens Axboe ocqe = list_first_entry(&ctx->cq_overflow_list, 696ed29b0b4SJens Axboe struct io_overflow_cqe, list); 697ed29b0b4SJens Axboe memcpy(cqe, &ocqe->cqe, cqe_size); 698ed29b0b4SJens Axboe list_del(&ocqe->list); 699ed29b0b4SJens Axboe kfree(ocqe); 700ed29b0b4SJens Axboe } 701ed29b0b4SJens Axboe 7021b346e4aSPavel Begunkov if (list_empty(&ctx->cq_overflow_list)) { 703ed29b0b4SJens Axboe clear_bit(IO_CHECK_CQ_OVERFLOW_BIT, &ctx->check_cq); 704ed29b0b4SJens Axboe atomic_andnot(IORING_SQ_CQ_OVERFLOW, &ctx->rings->sq_flags); 705ed29b0b4SJens Axboe } 70625399321SPavel Begunkov io_cq_unlock_post(ctx); 707ed29b0b4SJens Axboe } 708ed29b0b4SJens Axboe 70952ea806aSJens Axboe static void io_cqring_do_overflow_flush(struct io_ring_ctx *ctx) 710ed29b0b4SJens Axboe { 711ed29b0b4SJens Axboe /* iopoll syncs against uring_lock, not completion_lock */ 712ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_IOPOLL) 713ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 7141b346e4aSPavel Begunkov __io_cqring_overflow_flush(ctx); 715ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_IOPOLL) 716ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 717ed29b0b4SJens Axboe } 71852ea806aSJens Axboe 71952ea806aSJens Axboe static void io_cqring_overflow_flush(struct io_ring_ctx *ctx) 72052ea806aSJens Axboe { 72152ea806aSJens Axboe if (test_bit(IO_CHECK_CQ_OVERFLOW_BIT, &ctx->check_cq)) 72252ea806aSJens Axboe io_cqring_do_overflow_flush(ctx); 723ed29b0b4SJens Axboe } 724ed29b0b4SJens Axboe 7255afa4650SPavel Begunkov /* can be called by any task */ 7265afa4650SPavel Begunkov static void io_put_task_remote(struct task_struct *task, int nr) 727ed29b0b4SJens Axboe { 728ed29b0b4SJens Axboe struct io_uring_task *tctx = task->io_uring; 729ed29b0b4SJens Axboe 730ed29b0b4SJens Axboe percpu_counter_sub(&tctx->inflight, nr); 7318d664282SJens Axboe if (unlikely(atomic_read(&tctx->in_cancel))) 732ed29b0b4SJens Axboe wake_up(&tctx->wait); 733ed29b0b4SJens Axboe put_task_struct_many(task, nr); 734ed29b0b4SJens Axboe } 735ed29b0b4SJens Axboe 7365afa4650SPavel Begunkov /* used by a task to put its own references */ 7375afa4650SPavel Begunkov static void io_put_task_local(struct task_struct *task, int nr) 7385afa4650SPavel Begunkov { 7395afa4650SPavel Begunkov task->io_uring->cached_refs += nr; 7405afa4650SPavel Begunkov } 7415afa4650SPavel Begunkov 74289800a2dSPavel Begunkov /* must to be called somewhat shortly after putting a request */ 74389800a2dSPavel Begunkov static inline void io_put_task(struct task_struct *task, int nr) 74489800a2dSPavel Begunkov { 74589800a2dSPavel Begunkov if (likely(task == current)) 7465afa4650SPavel Begunkov io_put_task_local(task, nr); 74789800a2dSPavel Begunkov else 7485afa4650SPavel Begunkov io_put_task_remote(task, nr); 74989800a2dSPavel Begunkov } 75089800a2dSPavel Begunkov 75163809137SPavel Begunkov void io_task_refs_refill(struct io_uring_task *tctx) 752ed29b0b4SJens Axboe { 753ed29b0b4SJens Axboe unsigned int refill = -tctx->cached_refs + IO_TCTX_REFS_CACHE_NR; 754ed29b0b4SJens Axboe 755ed29b0b4SJens Axboe percpu_counter_add(&tctx->inflight, refill); 756ed29b0b4SJens Axboe refcount_add(refill, ¤t->usage); 757ed29b0b4SJens Axboe tctx->cached_refs += refill; 758ed29b0b4SJens Axboe } 759ed29b0b4SJens Axboe 760ed29b0b4SJens Axboe static __cold void io_uring_drop_tctx_refs(struct task_struct *task) 761ed29b0b4SJens Axboe { 762ed29b0b4SJens Axboe struct io_uring_task *tctx = task->io_uring; 763ed29b0b4SJens Axboe unsigned int refs = tctx->cached_refs; 764ed29b0b4SJens Axboe 765ed29b0b4SJens Axboe if (refs) { 766ed29b0b4SJens Axboe tctx->cached_refs = 0; 767ed29b0b4SJens Axboe percpu_counter_sub(&tctx->inflight, refs); 768ed29b0b4SJens Axboe put_task_struct_many(task, refs); 769ed29b0b4SJens Axboe } 770ed29b0b4SJens Axboe } 771ed29b0b4SJens Axboe 77268494a65SPavel Begunkov static bool io_cqring_event_overflow(struct io_ring_ctx *ctx, u64 user_data, 77368494a65SPavel Begunkov s32 res, u32 cflags, u64 extra1, u64 extra2) 774ed29b0b4SJens Axboe { 775ed29b0b4SJens Axboe struct io_overflow_cqe *ocqe; 776ed29b0b4SJens Axboe size_t ocq_size = sizeof(struct io_overflow_cqe); 777ed29b0b4SJens Axboe bool is_cqe32 = (ctx->flags & IORING_SETUP_CQE32); 778ed29b0b4SJens Axboe 779f26cc959SPavel Begunkov lockdep_assert_held(&ctx->completion_lock); 780f26cc959SPavel Begunkov 781ed29b0b4SJens Axboe if (is_cqe32) 782ed29b0b4SJens Axboe ocq_size += sizeof(struct io_uring_cqe); 783ed29b0b4SJens Axboe 784ed29b0b4SJens Axboe ocqe = kmalloc(ocq_size, GFP_ATOMIC | __GFP_ACCOUNT); 785ed29b0b4SJens Axboe trace_io_uring_cqe_overflow(ctx, user_data, res, cflags, ocqe); 786ed29b0b4SJens Axboe if (!ocqe) { 787ed29b0b4SJens Axboe /* 788ed29b0b4SJens Axboe * If we're in ring overflow flush mode, or in task cancel mode, 789ed29b0b4SJens Axboe * or cannot allocate an overflow entry, then we need to drop it 790ed29b0b4SJens Axboe * on the floor. 791ed29b0b4SJens Axboe */ 792ed29b0b4SJens Axboe io_account_cq_overflow(ctx); 793ed29b0b4SJens Axboe set_bit(IO_CHECK_CQ_DROPPED_BIT, &ctx->check_cq); 794ed29b0b4SJens Axboe return false; 795ed29b0b4SJens Axboe } 796ed29b0b4SJens Axboe if (list_empty(&ctx->cq_overflow_list)) { 797ed29b0b4SJens Axboe set_bit(IO_CHECK_CQ_OVERFLOW_BIT, &ctx->check_cq); 798ed29b0b4SJens Axboe atomic_or(IORING_SQ_CQ_OVERFLOW, &ctx->rings->sq_flags); 799ed29b0b4SJens Axboe 800ed29b0b4SJens Axboe } 801ed29b0b4SJens Axboe ocqe->cqe.user_data = user_data; 802ed29b0b4SJens Axboe ocqe->cqe.res = res; 803ed29b0b4SJens Axboe ocqe->cqe.flags = cflags; 804ed29b0b4SJens Axboe if (is_cqe32) { 805ed29b0b4SJens Axboe ocqe->cqe.big_cqe[0] = extra1; 806ed29b0b4SJens Axboe ocqe->cqe.big_cqe[1] = extra2; 807ed29b0b4SJens Axboe } 808ed29b0b4SJens Axboe list_add_tail(&ocqe->list, &ctx->cq_overflow_list); 809ed29b0b4SJens Axboe return true; 810ed29b0b4SJens Axboe } 811ed29b0b4SJens Axboe 81268494a65SPavel Begunkov bool io_req_cqe_overflow(struct io_kiocb *req) 81368494a65SPavel Begunkov { 81468494a65SPavel Begunkov if (!(req->flags & REQ_F_CQE32_INIT)) { 81568494a65SPavel Begunkov req->extra1 = 0; 81668494a65SPavel Begunkov req->extra2 = 0; 81768494a65SPavel Begunkov } 81868494a65SPavel Begunkov return io_cqring_event_overflow(req->ctx, req->cqe.user_data, 81968494a65SPavel Begunkov req->cqe.res, req->cqe.flags, 82068494a65SPavel Begunkov req->extra1, req->extra2); 82168494a65SPavel Begunkov } 82268494a65SPavel Begunkov 823faf88ddeSPavel Begunkov /* 824faf88ddeSPavel Begunkov * writes to the cq entry need to come after reading head; the 825faf88ddeSPavel Begunkov * control dependency is enough as we're using WRITE_ONCE to 826faf88ddeSPavel Begunkov * fill the cq entry 827faf88ddeSPavel Begunkov */ 828aa1df3a3SPavel Begunkov struct io_uring_cqe *__io_get_cqe(struct io_ring_ctx *ctx, bool overflow) 829faf88ddeSPavel Begunkov { 830faf88ddeSPavel Begunkov struct io_rings *rings = ctx->rings; 831faf88ddeSPavel Begunkov unsigned int off = ctx->cached_cq_tail & (ctx->cq_entries - 1); 832faf88ddeSPavel Begunkov unsigned int free, queued, len; 833faf88ddeSPavel Begunkov 834aa1df3a3SPavel Begunkov /* 835aa1df3a3SPavel Begunkov * Posting into the CQ when there are pending overflowed CQEs may break 836aa1df3a3SPavel Begunkov * ordering guarantees, which will affect links, F_MORE users and more. 837aa1df3a3SPavel Begunkov * Force overflow the completion. 838aa1df3a3SPavel Begunkov */ 839aa1df3a3SPavel Begunkov if (!overflow && (ctx->check_cq & BIT(IO_CHECK_CQ_OVERFLOW_BIT))) 840aa1df3a3SPavel Begunkov return NULL; 841faf88ddeSPavel Begunkov 842faf88ddeSPavel Begunkov /* userspace may cheat modifying the tail, be safe and do min */ 843faf88ddeSPavel Begunkov queued = min(__io_cqring_events(ctx), ctx->cq_entries); 844faf88ddeSPavel Begunkov free = ctx->cq_entries - queued; 845faf88ddeSPavel Begunkov /* we need a contiguous range, limit based on the current array offset */ 846faf88ddeSPavel Begunkov len = min(free, ctx->cq_entries - off); 847faf88ddeSPavel Begunkov if (!len) 848faf88ddeSPavel Begunkov return NULL; 849faf88ddeSPavel Begunkov 850b3659a65SPavel Begunkov if (ctx->flags & IORING_SETUP_CQE32) { 851b3659a65SPavel Begunkov off <<= 1; 852b3659a65SPavel Begunkov len <<= 1; 853b3659a65SPavel Begunkov } 854b3659a65SPavel Begunkov 855faf88ddeSPavel Begunkov ctx->cqe_cached = &rings->cqes[off]; 856faf88ddeSPavel Begunkov ctx->cqe_sentinel = ctx->cqe_cached + len; 857b3659a65SPavel Begunkov 858b3659a65SPavel Begunkov ctx->cached_cq_tail++; 859faf88ddeSPavel Begunkov ctx->cqe_cached++; 860b3659a65SPavel Begunkov if (ctx->flags & IORING_SETUP_CQE32) 861b3659a65SPavel Begunkov ctx->cqe_cached++; 862b3659a65SPavel Begunkov return &rings->cqes[off]; 863faf88ddeSPavel Begunkov } 864faf88ddeSPavel Begunkov 865f66f7342SPavel Begunkov static bool io_fill_cqe_aux(struct io_ring_ctx *ctx, u64 user_data, s32 res, 866f66f7342SPavel Begunkov u32 cflags) 867ed29b0b4SJens Axboe { 868ed29b0b4SJens Axboe struct io_uring_cqe *cqe; 869ed29b0b4SJens Axboe 870ed29b0b4SJens Axboe ctx->cq_extra++; 871ed29b0b4SJens Axboe 872ed29b0b4SJens Axboe /* 873ed29b0b4SJens Axboe * If we can't get a cq entry, userspace overflowed the 874ed29b0b4SJens Axboe * submission (by quite a lot). Increment the overflow count in 875ed29b0b4SJens Axboe * the ring. 876ed29b0b4SJens Axboe */ 877ed29b0b4SJens Axboe cqe = io_get_cqe(ctx); 878ed29b0b4SJens Axboe if (likely(cqe)) { 879e0486f3fSDylan Yudaken trace_io_uring_complete(ctx, NULL, user_data, res, cflags, 0, 0); 880e0486f3fSDylan Yudaken 881ed29b0b4SJens Axboe WRITE_ONCE(cqe->user_data, user_data); 882ed29b0b4SJens Axboe WRITE_ONCE(cqe->res, res); 883ed29b0b4SJens Axboe WRITE_ONCE(cqe->flags, cflags); 884ed29b0b4SJens Axboe 885ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_CQE32) { 886ed29b0b4SJens Axboe WRITE_ONCE(cqe->big_cqe[0], 0); 887ed29b0b4SJens Axboe WRITE_ONCE(cqe->big_cqe[1], 0); 888ed29b0b4SJens Axboe } 889ed29b0b4SJens Axboe return true; 890ed29b0b4SJens Axboe } 89152120f0fSDylan Yudaken return false; 892ed29b0b4SJens Axboe } 893ed29b0b4SJens Axboe 894931147ddSDylan Yudaken static void __io_flush_post_cqes(struct io_ring_ctx *ctx) 895931147ddSDylan Yudaken __must_hold(&ctx->uring_lock) 896931147ddSDylan Yudaken { 897931147ddSDylan Yudaken struct io_submit_state *state = &ctx->submit_state; 898931147ddSDylan Yudaken unsigned int i; 899931147ddSDylan Yudaken 900931147ddSDylan Yudaken lockdep_assert_held(&ctx->uring_lock); 901931147ddSDylan Yudaken for (i = 0; i < state->cqes_count; i++) { 902931147ddSDylan Yudaken struct io_uring_cqe *cqe = &state->cqes[i]; 903931147ddSDylan Yudaken 904f66f7342SPavel Begunkov if (!io_fill_cqe_aux(ctx, cqe->user_data, cqe->res, cqe->flags)) { 905f66f7342SPavel Begunkov if (ctx->task_complete) { 906f66f7342SPavel Begunkov spin_lock(&ctx->completion_lock); 907f66f7342SPavel Begunkov io_cqring_event_overflow(ctx, cqe->user_data, 908f66f7342SPavel Begunkov cqe->res, cqe->flags, 0, 0); 909f66f7342SPavel Begunkov spin_unlock(&ctx->completion_lock); 910f66f7342SPavel Begunkov } else { 911f66f7342SPavel Begunkov io_cqring_event_overflow(ctx, cqe->user_data, 912f66f7342SPavel Begunkov cqe->res, cqe->flags, 0, 0); 913f66f7342SPavel Begunkov } 914f66f7342SPavel Begunkov } 915931147ddSDylan Yudaken } 916931147ddSDylan Yudaken state->cqes_count = 0; 917931147ddSDylan Yudaken } 918931147ddSDylan Yudaken 919b529c96aSDylan Yudaken static bool __io_post_aux_cqe(struct io_ring_ctx *ctx, u64 user_data, s32 res, u32 cflags, 92052120f0fSDylan Yudaken bool allow_overflow) 921d245bca6SPavel Begunkov { 922d245bca6SPavel Begunkov bool filled; 923d245bca6SPavel Begunkov 92425399321SPavel Begunkov io_cq_lock(ctx); 925f66f7342SPavel Begunkov filled = io_fill_cqe_aux(ctx, user_data, res, cflags); 926f66f7342SPavel Begunkov if (!filled && allow_overflow) 927f66f7342SPavel Begunkov filled = io_cqring_event_overflow(ctx, user_data, res, cflags, 0, 0); 928f66f7342SPavel Begunkov 92925399321SPavel Begunkov io_cq_unlock_post(ctx); 930d245bca6SPavel Begunkov return filled; 931d245bca6SPavel Begunkov } 932d245bca6SPavel Begunkov 933b529c96aSDylan Yudaken bool io_post_aux_cqe(struct io_ring_ctx *ctx, u64 user_data, s32 res, u32 cflags) 934ed29b0b4SJens Axboe { 935b529c96aSDylan Yudaken return __io_post_aux_cqe(ctx, user_data, res, cflags, true); 936b529c96aSDylan Yudaken } 937b529c96aSDylan Yudaken 938d86eaed1SJens Axboe bool io_aux_cqe(const struct io_kiocb *req, bool defer, s32 res, u32 cflags, 9399b8c5475SDylan Yudaken bool allow_overflow) 9409b8c5475SDylan Yudaken { 941d86eaed1SJens Axboe struct io_ring_ctx *ctx = req->ctx; 942d86eaed1SJens Axboe u64 user_data = req->cqe.user_data; 9439b8c5475SDylan Yudaken struct io_uring_cqe *cqe; 9449b8c5475SDylan Yudaken 9459b8c5475SDylan Yudaken if (!defer) 946b529c96aSDylan Yudaken return __io_post_aux_cqe(ctx, user_data, res, cflags, allow_overflow); 9479b8c5475SDylan Yudaken 9489b8c5475SDylan Yudaken lockdep_assert_held(&ctx->uring_lock); 9499b8c5475SDylan Yudaken 950003f242bSJens Axboe if (ctx->submit_state.cqes_count == ARRAY_SIZE(ctx->submit_state.cqes)) { 951f66f7342SPavel Begunkov __io_cq_lock(ctx); 9529b8c5475SDylan Yudaken __io_flush_post_cqes(ctx); 9539b8c5475SDylan Yudaken /* no need to flush - flush is deferred */ 954f66f7342SPavel Begunkov __io_cq_unlock_post(ctx); 9559b8c5475SDylan Yudaken } 9569b8c5475SDylan Yudaken 9579b8c5475SDylan Yudaken /* For defered completions this is not as strict as it is otherwise, 9589b8c5475SDylan Yudaken * however it's main job is to prevent unbounded posted completions, 9599b8c5475SDylan Yudaken * and in that it works just as well. 9609b8c5475SDylan Yudaken */ 9619b8c5475SDylan Yudaken if (!allow_overflow && test_bit(IO_CHECK_CQ_OVERFLOW_BIT, &ctx->check_cq)) 9629b8c5475SDylan Yudaken return false; 9639b8c5475SDylan Yudaken 9649b8c5475SDylan Yudaken cqe = &ctx->submit_state.cqes[ctx->submit_state.cqes_count++]; 9659b8c5475SDylan Yudaken cqe->user_data = user_data; 9669b8c5475SDylan Yudaken cqe->res = res; 9679b8c5475SDylan Yudaken cqe->flags = cflags; 9689b8c5475SDylan Yudaken return true; 9699b8c5475SDylan Yudaken } 9709b8c5475SDylan Yudaken 971ef8ae64fSPavel Begunkov static void __io_req_complete_post(struct io_kiocb *req, unsigned issue_flags) 972ed29b0b4SJens Axboe { 973fa18fa22SPavel Begunkov struct io_ring_ctx *ctx = req->ctx; 9742ad4c6d0SPavel Begunkov struct io_rsrc_node *rsrc_node = NULL; 975fa18fa22SPavel Begunkov 976fa18fa22SPavel Begunkov io_cq_lock(ctx); 977fa18fa22SPavel Begunkov if (!(req->flags & REQ_F_CQE_SKIP)) 978a8cf95f9SPavel Begunkov io_fill_cqe_req(ctx, req); 979fa18fa22SPavel Begunkov 980ed29b0b4SJens Axboe /* 981ed29b0b4SJens Axboe * If we're the last reference to this request, add to our locked 982ed29b0b4SJens Axboe * free_list cache. 983ed29b0b4SJens Axboe */ 984ed29b0b4SJens Axboe if (req_ref_put_and_test(req)) { 985ed29b0b4SJens Axboe if (req->flags & IO_REQ_LINK_FLAGS) { 986ed29b0b4SJens Axboe if (req->flags & IO_DISARM_MASK) 987ed29b0b4SJens Axboe io_disarm_next(req); 988ed29b0b4SJens Axboe if (req->link) { 989ed29b0b4SJens Axboe io_req_task_queue(req->link); 990ed29b0b4SJens Axboe req->link = NULL; 991ed29b0b4SJens Axboe } 992ed29b0b4SJens Axboe } 99368a2cc1bSPavel Begunkov io_put_kbuf_comp(req); 99468a2cc1bSPavel Begunkov io_dismantle_req(req); 9952ad4c6d0SPavel Begunkov rsrc_node = req->rsrc_node; 996ed29b0b4SJens Axboe /* 997ed29b0b4SJens Axboe * Selected buffer deallocation in io_clean_op() assumes that 998ed29b0b4SJens Axboe * we don't hold ->completion_lock. Clean them here to avoid 999ed29b0b4SJens Axboe * deadlocks. 1000ed29b0b4SJens Axboe */ 10015afa4650SPavel Begunkov io_put_task_remote(req->task, 1); 1002ed29b0b4SJens Axboe wq_list_add_head(&req->comp_list, &ctx->locked_free_list); 1003ed29b0b4SJens Axboe ctx->locked_free_nr++; 1004ed29b0b4SJens Axboe } 100525399321SPavel Begunkov io_cq_unlock_post(ctx); 10062ad4c6d0SPavel Begunkov 1007ef8ae64fSPavel Begunkov if (rsrc_node) { 1008ef8ae64fSPavel Begunkov io_ring_submit_lock(ctx, issue_flags); 10091f2c8f61SPavel Begunkov io_put_rsrc_node(ctx, rsrc_node); 1010ef8ae64fSPavel Begunkov io_ring_submit_unlock(ctx, issue_flags); 1011ef8ae64fSPavel Begunkov } 1012ed29b0b4SJens Axboe } 1013ed29b0b4SJens Axboe 10141bec951cSPavel Begunkov void io_req_complete_post(struct io_kiocb *req, unsigned issue_flags) 1015ed29b0b4SJens Axboe { 1016860e1c7fSMing Lei if (req->ctx->task_complete && req->ctx->submitter_task != current) { 1017e6aeb272SPavel Begunkov req->io_task_work.func = io_req_task_complete; 1018e6aeb272SPavel Begunkov io_req_task_work_add(req); 1019e6aeb272SPavel Begunkov } else if (!(issue_flags & IO_URING_F_UNLOCKED) || 10201bec951cSPavel Begunkov !(req->ctx->flags & IORING_SETUP_IOPOLL)) { 1021ef8ae64fSPavel Begunkov __io_req_complete_post(req, issue_flags); 10221bec951cSPavel Begunkov } else { 10231bec951cSPavel Begunkov struct io_ring_ctx *ctx = req->ctx; 10241bec951cSPavel Begunkov 10251bec951cSPavel Begunkov mutex_lock(&ctx->uring_lock); 1026ef8ae64fSPavel Begunkov __io_req_complete_post(req, issue_flags & ~IO_URING_F_UNLOCKED); 10271bec951cSPavel Begunkov mutex_unlock(&ctx->uring_lock); 10281bec951cSPavel Begunkov } 1029ed29b0b4SJens Axboe } 1030ed29b0b4SJens Axboe 1031973fc83fSDylan Yudaken void io_req_defer_failed(struct io_kiocb *req, s32 res) 1032e276ae34SPavel Begunkov __must_hold(&ctx->uring_lock) 1033ed29b0b4SJens Axboe { 1034f30bd4d0SBreno Leitao const struct io_cold_def *def = &io_cold_defs[req->opcode]; 1035a47b255eSPavel Begunkov 1036e276ae34SPavel Begunkov lockdep_assert_held(&req->ctx->uring_lock); 1037e276ae34SPavel Begunkov 1038ed29b0b4SJens Axboe req_set_fail(req); 103997b388d7SJens Axboe io_req_set_res(req, res, io_put_kbuf(req, IO_URING_F_UNLOCKED)); 1040a47b255eSPavel Begunkov if (def->fail) 1041a47b255eSPavel Begunkov def->fail(req); 1042973fc83fSDylan Yudaken io_req_complete_defer(req); 1043ed29b0b4SJens Axboe } 1044ed29b0b4SJens Axboe 1045ed29b0b4SJens Axboe /* 1046ed29b0b4SJens Axboe * Don't initialise the fields below on every allocation, but do that in 1047ed29b0b4SJens Axboe * advance and keep them valid across allocations. 1048ed29b0b4SJens Axboe */ 1049ed29b0b4SJens Axboe static void io_preinit_req(struct io_kiocb *req, struct io_ring_ctx *ctx) 1050ed29b0b4SJens Axboe { 1051ed29b0b4SJens Axboe req->ctx = ctx; 1052ed29b0b4SJens Axboe req->link = NULL; 1053ed29b0b4SJens Axboe req->async_data = NULL; 1054ed29b0b4SJens Axboe /* not necessary, but safer to zero */ 1055ed29b0b4SJens Axboe req->cqe.res = 0; 1056ed29b0b4SJens Axboe } 1057ed29b0b4SJens Axboe 1058ed29b0b4SJens Axboe static void io_flush_cached_locked_reqs(struct io_ring_ctx *ctx, 1059ed29b0b4SJens Axboe struct io_submit_state *state) 1060ed29b0b4SJens Axboe { 1061ed29b0b4SJens Axboe spin_lock(&ctx->completion_lock); 1062ed29b0b4SJens Axboe wq_list_splice(&ctx->locked_free_list, &state->free_list); 1063ed29b0b4SJens Axboe ctx->locked_free_nr = 0; 1064ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 1065ed29b0b4SJens Axboe } 1066ed29b0b4SJens Axboe 1067ed29b0b4SJens Axboe /* 1068ed29b0b4SJens Axboe * A request might get retired back into the request caches even before opcode 1069ed29b0b4SJens Axboe * handlers and io_issue_sqe() are done with it, e.g. inline completion path. 1070ed29b0b4SJens Axboe * Because of that, io_alloc_req() should be called only under ->uring_lock 1071ed29b0b4SJens Axboe * and with extra caution to not get a request that is still worked on. 1072ed29b0b4SJens Axboe */ 1073bd1a3783SPavel Begunkov __cold bool __io_alloc_req_refill(struct io_ring_ctx *ctx) 1074ed29b0b4SJens Axboe __must_hold(&ctx->uring_lock) 1075ed29b0b4SJens Axboe { 1076ed29b0b4SJens Axboe gfp_t gfp = GFP_KERNEL | __GFP_NOWARN; 1077ed29b0b4SJens Axboe void *reqs[IO_REQ_ALLOC_BATCH]; 1078ed29b0b4SJens Axboe int ret, i; 1079ed29b0b4SJens Axboe 1080ed29b0b4SJens Axboe /* 1081ed29b0b4SJens Axboe * If we have more than a batch's worth of requests in our IRQ side 1082ed29b0b4SJens Axboe * locked cache, grab the lock and move them over to our submission 1083ed29b0b4SJens Axboe * side cache. 1084ed29b0b4SJens Axboe */ 1085ed29b0b4SJens Axboe if (data_race(ctx->locked_free_nr) > IO_COMPL_BATCH) { 1086ed29b0b4SJens Axboe io_flush_cached_locked_reqs(ctx, &ctx->submit_state); 1087ed29b0b4SJens Axboe if (!io_req_cache_empty(ctx)) 1088ed29b0b4SJens Axboe return true; 1089ed29b0b4SJens Axboe } 1090ed29b0b4SJens Axboe 1091ed29b0b4SJens Axboe ret = kmem_cache_alloc_bulk(req_cachep, gfp, ARRAY_SIZE(reqs), reqs); 1092ed29b0b4SJens Axboe 1093ed29b0b4SJens Axboe /* 1094ed29b0b4SJens Axboe * Bulk alloc is all-or-nothing. If we fail to get a batch, 1095ed29b0b4SJens Axboe * retry single alloc to be on the safe side. 1096ed29b0b4SJens Axboe */ 1097ed29b0b4SJens Axboe if (unlikely(ret <= 0)) { 1098ed29b0b4SJens Axboe reqs[0] = kmem_cache_alloc(req_cachep, gfp); 1099ed29b0b4SJens Axboe if (!reqs[0]) 1100ed29b0b4SJens Axboe return false; 1101ed29b0b4SJens Axboe ret = 1; 1102ed29b0b4SJens Axboe } 1103ed29b0b4SJens Axboe 1104ed29b0b4SJens Axboe percpu_ref_get_many(&ctx->refs, ret); 1105ed29b0b4SJens Axboe for (i = 0; i < ret; i++) { 1106ed29b0b4SJens Axboe struct io_kiocb *req = reqs[i]; 1107ed29b0b4SJens Axboe 1108ed29b0b4SJens Axboe io_preinit_req(req, ctx); 1109ed29b0b4SJens Axboe io_req_add_to_cache(req, ctx); 1110ed29b0b4SJens Axboe } 1111ed29b0b4SJens Axboe return true; 1112ed29b0b4SJens Axboe } 1113ed29b0b4SJens Axboe 1114ed29b0b4SJens Axboe static inline void io_dismantle_req(struct io_kiocb *req) 1115ed29b0b4SJens Axboe { 1116ed29b0b4SJens Axboe unsigned int flags = req->flags; 1117ed29b0b4SJens Axboe 1118ed29b0b4SJens Axboe if (unlikely(flags & IO_REQ_CLEAN_FLAGS)) 1119ed29b0b4SJens Axboe io_clean_op(req); 1120ed29b0b4SJens Axboe if (!(flags & REQ_F_FIXED_FILE)) 1121ed29b0b4SJens Axboe io_put_file(req->file); 1122ed29b0b4SJens Axboe } 1123ed29b0b4SJens Axboe 112403adabe8SPavel Begunkov static __cold void io_free_req_tw(struct io_kiocb *req, struct io_tw_state *ts) 1125ed29b0b4SJens Axboe { 1126ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 1127ed29b0b4SJens Axboe 1128ef8ae64fSPavel Begunkov if (req->rsrc_node) { 1129ef8ae64fSPavel Begunkov io_tw_lock(ctx, ts); 11301f2c8f61SPavel Begunkov io_put_rsrc_node(ctx, req->rsrc_node); 1131ef8ae64fSPavel Begunkov } 1132ed29b0b4SJens Axboe io_dismantle_req(req); 11335afa4650SPavel Begunkov io_put_task_remote(req->task, 1); 1134ed29b0b4SJens Axboe 1135ed29b0b4SJens Axboe spin_lock(&ctx->completion_lock); 1136ed29b0b4SJens Axboe wq_list_add_head(&req->comp_list, &ctx->locked_free_list); 1137ed29b0b4SJens Axboe ctx->locked_free_nr++; 1138ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 1139ed29b0b4SJens Axboe } 1140ed29b0b4SJens Axboe 114103adabe8SPavel Begunkov __cold void io_free_req(struct io_kiocb *req) 114203adabe8SPavel Begunkov { 114303adabe8SPavel Begunkov req->io_task_work.func = io_free_req_tw; 114403adabe8SPavel Begunkov io_req_task_work_add(req); 114503adabe8SPavel Begunkov } 114603adabe8SPavel Begunkov 1147ed29b0b4SJens Axboe static void __io_req_find_next_prep(struct io_kiocb *req) 1148ed29b0b4SJens Axboe { 1149ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 1150ed29b0b4SJens Axboe 11516971253fSPavel Begunkov spin_lock(&ctx->completion_lock); 1152305bef98SPavel Begunkov io_disarm_next(req); 11536971253fSPavel Begunkov spin_unlock(&ctx->completion_lock); 1154ed29b0b4SJens Axboe } 1155ed29b0b4SJens Axboe 1156ed29b0b4SJens Axboe static inline struct io_kiocb *io_req_find_next(struct io_kiocb *req) 1157ed29b0b4SJens Axboe { 1158ed29b0b4SJens Axboe struct io_kiocb *nxt; 1159ed29b0b4SJens Axboe 1160ed29b0b4SJens Axboe /* 1161ed29b0b4SJens Axboe * If LINK is set, we have dependent requests in this chain. If we 1162ed29b0b4SJens Axboe * didn't fail this request, queue the first one up, moving any other 1163ed29b0b4SJens Axboe * dependencies to the next request. In case of failure, fail the rest 1164ed29b0b4SJens Axboe * of the chain. 1165ed29b0b4SJens Axboe */ 1166ed29b0b4SJens Axboe if (unlikely(req->flags & IO_DISARM_MASK)) 1167ed29b0b4SJens Axboe __io_req_find_next_prep(req); 1168ed29b0b4SJens Axboe nxt = req->link; 1169ed29b0b4SJens Axboe req->link = NULL; 1170ed29b0b4SJens Axboe return nxt; 1171ed29b0b4SJens Axboe } 1172ed29b0b4SJens Axboe 1173a282967cSPavel Begunkov static void ctx_flush_and_put(struct io_ring_ctx *ctx, struct io_tw_state *ts) 1174ed29b0b4SJens Axboe { 1175ed29b0b4SJens Axboe if (!ctx) 1176ed29b0b4SJens Axboe return; 1177ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_TASKRUN_FLAG) 1178ed29b0b4SJens Axboe atomic_andnot(IORING_SQ_TASKRUN, &ctx->rings->sq_flags); 1179a282967cSPavel Begunkov if (ts->locked) { 1180ed29b0b4SJens Axboe io_submit_flush_completions(ctx); 1181ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 1182a282967cSPavel Begunkov ts->locked = false; 1183ed29b0b4SJens Axboe } 1184ed29b0b4SJens Axboe percpu_ref_put(&ctx->refs); 1185ed29b0b4SJens Axboe } 1186ed29b0b4SJens Axboe 1187c6dd763cSDylan Yudaken static unsigned int handle_tw_list(struct llist_node *node, 1188a282967cSPavel Begunkov struct io_ring_ctx **ctx, 1189a282967cSPavel Begunkov struct io_tw_state *ts, 11903a0c037bSDylan Yudaken struct llist_node *last) 1191ed29b0b4SJens Axboe { 1192c6dd763cSDylan Yudaken unsigned int count = 0; 1193c6dd763cSDylan Yudaken 1194cb6bf7f2SPavel Begunkov while (node && node != last) { 1195f88262e6SDylan Yudaken struct llist_node *next = node->next; 1196ed29b0b4SJens Axboe struct io_kiocb *req = container_of(node, struct io_kiocb, 1197ed29b0b4SJens Axboe io_task_work.node); 1198ed29b0b4SJens Axboe 1199ed29b0b4SJens Axboe prefetch(container_of(next, struct io_kiocb, io_task_work.node)); 1200ed29b0b4SJens Axboe 1201ed29b0b4SJens Axboe if (req->ctx != *ctx) { 1202a282967cSPavel Begunkov ctx_flush_and_put(*ctx, ts); 1203ed29b0b4SJens Axboe *ctx = req->ctx; 1204ed29b0b4SJens Axboe /* if not contended, grab and improve batching */ 1205a282967cSPavel Begunkov ts->locked = mutex_trylock(&(*ctx)->uring_lock); 1206ed29b0b4SJens Axboe percpu_ref_get(&(*ctx)->refs); 120713bfa6f1SPavel Begunkov } 1208c92fcfc2SJens Axboe INDIRECT_CALL_2(req->io_task_work.func, 1209c92fcfc2SJens Axboe io_poll_task_func, io_req_rw_complete, 1210c92fcfc2SJens Axboe req, ts); 1211ed29b0b4SJens Axboe node = next; 1212c6dd763cSDylan Yudaken count++; 1213f5868008SJens Axboe if (unlikely(need_resched())) { 1214a282967cSPavel Begunkov ctx_flush_and_put(*ctx, ts); 1215f5868008SJens Axboe *ctx = NULL; 1216f5868008SJens Axboe cond_resched(); 1217f5868008SJens Axboe } 12183a0c037bSDylan Yudaken } 1219c6dd763cSDylan Yudaken 1220c6dd763cSDylan Yudaken return count; 1221ed29b0b4SJens Axboe } 1222ed29b0b4SJens Axboe 1223923d1592SDylan Yudaken /** 1224923d1592SDylan Yudaken * io_llist_xchg - swap all entries in a lock-less list 1225923d1592SDylan Yudaken * @head: the head of lock-less list to delete all entries 1226923d1592SDylan Yudaken * @new: new entry as the head of the list 1227923d1592SDylan Yudaken * 1228923d1592SDylan Yudaken * If list is empty, return NULL, otherwise, return the pointer to the first entry. 1229923d1592SDylan Yudaken * The order of entries returned is from the newest to the oldest added one. 1230923d1592SDylan Yudaken */ 1231923d1592SDylan Yudaken static inline struct llist_node *io_llist_xchg(struct llist_head *head, 1232923d1592SDylan Yudaken struct llist_node *new) 1233923d1592SDylan Yudaken { 1234923d1592SDylan Yudaken return xchg(&head->first, new); 1235923d1592SDylan Yudaken } 1236923d1592SDylan Yudaken 1237923d1592SDylan Yudaken /** 1238923d1592SDylan Yudaken * io_llist_cmpxchg - possibly swap all entries in a lock-less list 1239923d1592SDylan Yudaken * @head: the head of lock-less list to delete all entries 1240923d1592SDylan Yudaken * @old: expected old value of the first entry of the list 1241923d1592SDylan Yudaken * @new: new entry as the head of the list 1242923d1592SDylan Yudaken * 1243923d1592SDylan Yudaken * perform a cmpxchg on the first entry of the list. 1244923d1592SDylan Yudaken */ 1245923d1592SDylan Yudaken 1246923d1592SDylan Yudaken static inline struct llist_node *io_llist_cmpxchg(struct llist_head *head, 1247923d1592SDylan Yudaken struct llist_node *old, 1248923d1592SDylan Yudaken struct llist_node *new) 1249923d1592SDylan Yudaken { 1250923d1592SDylan Yudaken return cmpxchg(&head->first, old, new); 1251923d1592SDylan Yudaken } 1252923d1592SDylan Yudaken 1253c9f06aa7SJens Axboe void tctx_task_work(struct callback_head *cb) 1254ed29b0b4SJens Axboe { 1255a282967cSPavel Begunkov struct io_tw_state ts = {}; 1256ed29b0b4SJens Axboe struct io_ring_ctx *ctx = NULL; 1257ed29b0b4SJens Axboe struct io_uring_task *tctx = container_of(cb, struct io_uring_task, 1258ed29b0b4SJens Axboe task_work); 12593a0c037bSDylan Yudaken struct llist_node fake = {}; 126077e443abSPavel Begunkov struct llist_node *node; 1261cb6bf7f2SPavel Begunkov unsigned int loops = 0; 1262cb6bf7f2SPavel Begunkov unsigned int count = 0; 1263ed29b0b4SJens Axboe 126477e443abSPavel Begunkov if (unlikely(current->flags & PF_EXITING)) { 126577e443abSPavel Begunkov io_fallback_tw(tctx); 126677e443abSPavel Begunkov return; 126777e443abSPavel Begunkov } 126877e443abSPavel Begunkov 1269cb6bf7f2SPavel Begunkov do { 1270c6dd763cSDylan Yudaken loops++; 12713a0c037bSDylan Yudaken node = io_llist_xchg(&tctx->task_list, &fake); 1272a282967cSPavel Begunkov count += handle_tw_list(node, &ctx, &ts, &fake); 127350470fc5SPavel Begunkov 127450470fc5SPavel Begunkov /* skip expensive cmpxchg if there are items in the list */ 127550470fc5SPavel Begunkov if (READ_ONCE(tctx->task_list.first) != &fake) 127650470fc5SPavel Begunkov continue; 1277a282967cSPavel Begunkov if (ts.locked && !wq_list_empty(&ctx->submit_state.compl_reqs)) { 127850470fc5SPavel Begunkov io_submit_flush_completions(ctx); 127950470fc5SPavel Begunkov if (READ_ONCE(tctx->task_list.first) != &fake) 128050470fc5SPavel Begunkov continue; 128150470fc5SPavel Begunkov } 12823a0c037bSDylan Yudaken node = io_llist_cmpxchg(&tctx->task_list, &fake, NULL); 1283cb6bf7f2SPavel Begunkov } while (node != &fake); 1284ed29b0b4SJens Axboe 1285a282967cSPavel Begunkov ctx_flush_and_put(ctx, &ts); 1286ed29b0b4SJens Axboe 12878d664282SJens Axboe /* relaxed read is enough as only the task itself sets ->in_cancel */ 12888d664282SJens Axboe if (unlikely(atomic_read(&tctx->in_cancel))) 1289ed29b0b4SJens Axboe io_uring_drop_tctx_refs(current); 1290c6dd763cSDylan Yudaken 1291c6dd763cSDylan Yudaken trace_io_uring_task_work_run(tctx, count, loops); 1292ed29b0b4SJens Axboe } 1293ed29b0b4SJens Axboe 1294d7593606SPavel Begunkov static __cold void io_fallback_tw(struct io_uring_task *tctx) 1295d7593606SPavel Begunkov { 1296d7593606SPavel Begunkov struct llist_node *node = llist_del_all(&tctx->task_list); 1297d7593606SPavel Begunkov struct io_kiocb *req; 1298d7593606SPavel Begunkov 1299d7593606SPavel Begunkov while (node) { 1300d7593606SPavel Begunkov req = container_of(node, struct io_kiocb, io_task_work.node); 1301d7593606SPavel Begunkov node = node->next; 1302d7593606SPavel Begunkov if (llist_add(&req->io_task_work.node, 1303d7593606SPavel Begunkov &req->ctx->fallback_llist)) 1304d7593606SPavel Begunkov schedule_delayed_work(&req->ctx->fallback_work, 1); 1305d7593606SPavel Begunkov } 1306d7593606SPavel Begunkov } 1307d7593606SPavel Begunkov 13088751d154SPavel Begunkov static void io_req_local_work_add(struct io_kiocb *req, unsigned flags) 1309c0e0d6baSDylan Yudaken { 1310c0e0d6baSDylan Yudaken struct io_ring_ctx *ctx = req->ctx; 13118751d154SPavel Begunkov unsigned nr_wait, nr_tw, nr_tw_prev; 131251509400SPavel Begunkov struct llist_node *first; 1313c0e0d6baSDylan Yudaken 13148751d154SPavel Begunkov if (req->flags & (REQ_F_LINK | REQ_F_HARDLINK)) 13158751d154SPavel Begunkov flags &= ~IOU_F_TWQ_LAZY_WAKE; 13169ffa13ffSPavel Begunkov 131751509400SPavel Begunkov first = READ_ONCE(ctx->work_llist.first); 131851509400SPavel Begunkov do { 13198751d154SPavel Begunkov nr_tw_prev = 0; 13208751d154SPavel Begunkov if (first) { 13218751d154SPavel Begunkov struct io_kiocb *first_req = container_of(first, 13228751d154SPavel Begunkov struct io_kiocb, 13238751d154SPavel Begunkov io_task_work.node); 13248751d154SPavel Begunkov /* 13258751d154SPavel Begunkov * Might be executed at any moment, rely on 13268751d154SPavel Begunkov * SLAB_TYPESAFE_BY_RCU to keep it alive. 13278751d154SPavel Begunkov */ 13288751d154SPavel Begunkov nr_tw_prev = READ_ONCE(first_req->nr_tw); 1329c0e0d6baSDylan Yudaken } 13308751d154SPavel Begunkov nr_tw = nr_tw_prev + 1; 13318751d154SPavel Begunkov /* Large enough to fail the nr_wait comparison below */ 13328751d154SPavel Begunkov if (!(flags & IOU_F_TWQ_LAZY_WAKE)) 13338751d154SPavel Begunkov nr_tw = -1U; 1334c0e0d6baSDylan Yudaken 13358751d154SPavel Begunkov req->nr_tw = nr_tw; 133651509400SPavel Begunkov req->io_task_work.node.next = first; 133751509400SPavel Begunkov } while (!try_cmpxchg(&ctx->work_llist.first, &first, 133851509400SPavel Begunkov &req->io_task_work.node)); 133951509400SPavel Begunkov 13408751d154SPavel Begunkov if (!first) { 1341c0e0d6baSDylan Yudaken if (ctx->flags & IORING_SETUP_TASKRUN_FLAG) 1342c0e0d6baSDylan Yudaken atomic_or(IORING_SQ_TASKRUN, &ctx->rings->sq_flags); 134321a091b9SDylan Yudaken if (ctx->has_evfd) 134421a091b9SDylan Yudaken io_eventfd_signal(ctx); 1345c0e0d6baSDylan Yudaken } 1346c0e0d6baSDylan Yudaken 13478751d154SPavel Begunkov nr_wait = atomic_read(&ctx->cq_wait_nr); 13488751d154SPavel Begunkov /* no one is waiting */ 13498751d154SPavel Begunkov if (!nr_wait) 13508751d154SPavel Begunkov return; 13518751d154SPavel Begunkov /* either not enough or the previous add has already woken it up */ 13528751d154SPavel Begunkov if (nr_wait > nr_tw || nr_tw_prev >= nr_wait) 13538751d154SPavel Begunkov return; 13548751d154SPavel Begunkov /* pairs with set_current_state() in io_cqring_wait() */ 13558751d154SPavel Begunkov smp_mb__after_atomic(); 1356e52d2e58SPavel Begunkov wake_up_state(ctx->submitter_task, TASK_INTERRUPTIBLE); 1357c0e0d6baSDylan Yudaken } 1358c0e0d6baSDylan Yudaken 13598501fe70SPavel Begunkov void __io_req_task_work_add(struct io_kiocb *req, unsigned flags) 1360ed29b0b4SJens Axboe { 1361c34398a8SDylan Yudaken struct io_uring_task *tctx = req->task->io_uring; 1362ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 1363ed29b0b4SJens Axboe 13648501fe70SPavel Begunkov if (!(flags & IOU_F_TWQ_FORCE_NORMAL) && 13658501fe70SPavel Begunkov (ctx->flags & IORING_SETUP_DEFER_TASKRUN)) { 1366d73a572dSPavel Begunkov rcu_read_lock(); 13678751d154SPavel Begunkov io_req_local_work_add(req, flags); 1368d73a572dSPavel Begunkov rcu_read_unlock(); 1369c0e0d6baSDylan Yudaken return; 1370c0e0d6baSDylan Yudaken } 1371ed29b0b4SJens Axboe 1372ed29b0b4SJens Axboe /* task_work already pending, we're done */ 137332d91f05SDylan Yudaken if (!llist_add(&req->io_task_work.node, &tctx->task_list)) 1374ed29b0b4SJens Axboe return; 1375ed29b0b4SJens Axboe 1376ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_TASKRUN_FLAG) 1377ed29b0b4SJens Axboe atomic_or(IORING_SQ_TASKRUN, &ctx->rings->sq_flags); 1378ed29b0b4SJens Axboe 1379ed29b0b4SJens Axboe if (likely(!task_work_add(req->task, &tctx->task_work, ctx->notify_method))) 1380ed29b0b4SJens Axboe return; 1381ed29b0b4SJens Axboe 1382d7593606SPavel Begunkov io_fallback_tw(tctx); 1383c0e0d6baSDylan Yudaken } 1384c0e0d6baSDylan Yudaken 1385c0e0d6baSDylan Yudaken static void __cold io_move_task_work_from_local(struct io_ring_ctx *ctx) 1386c0e0d6baSDylan Yudaken { 1387c0e0d6baSDylan Yudaken struct llist_node *node; 1388c0e0d6baSDylan Yudaken 1389c0e0d6baSDylan Yudaken node = llist_del_all(&ctx->work_llist); 1390c0e0d6baSDylan Yudaken while (node) { 1391c0e0d6baSDylan Yudaken struct io_kiocb *req = container_of(node, struct io_kiocb, 1392c0e0d6baSDylan Yudaken io_task_work.node); 1393c0e0d6baSDylan Yudaken 1394c0e0d6baSDylan Yudaken node = node->next; 13958501fe70SPavel Begunkov __io_req_task_work_add(req, IOU_F_TWQ_FORCE_NORMAL); 1396c0e0d6baSDylan Yudaken } 1397c0e0d6baSDylan Yudaken } 1398c0e0d6baSDylan Yudaken 1399a282967cSPavel Begunkov static int __io_run_local_work(struct io_ring_ctx *ctx, struct io_tw_state *ts) 1400c0e0d6baSDylan Yudaken { 1401c0e0d6baSDylan Yudaken struct llist_node *node; 1402c3f4d39eSPavel Begunkov unsigned int loops = 0; 1403140102aeSPavel Begunkov int ret = 0; 1404c0e0d6baSDylan Yudaken 1405140102aeSPavel Begunkov if (WARN_ON_ONCE(ctx->submitter_task != current)) 1406c0e0d6baSDylan Yudaken return -EEXIST; 1407c3f4d39eSPavel Begunkov if (ctx->flags & IORING_SETUP_TASKRUN_FLAG) 1408c3f4d39eSPavel Begunkov atomic_andnot(IORING_SQ_TASKRUN, &ctx->rings->sq_flags); 1409c0e0d6baSDylan Yudaken again: 14103af0356cSJens Axboe /* 14113af0356cSJens Axboe * llists are in reverse order, flip it back the right way before 14123af0356cSJens Axboe * running the pending items. 14133af0356cSJens Axboe */ 14143af0356cSJens Axboe node = llist_reverse_order(io_llist_xchg(&ctx->work_llist, NULL)); 1415c3f4d39eSPavel Begunkov while (node) { 1416c0e0d6baSDylan Yudaken struct llist_node *next = node->next; 1417c0e0d6baSDylan Yudaken struct io_kiocb *req = container_of(node, struct io_kiocb, 1418c0e0d6baSDylan Yudaken io_task_work.node); 1419c0e0d6baSDylan Yudaken prefetch(container_of(next, struct io_kiocb, io_task_work.node)); 1420c92fcfc2SJens Axboe INDIRECT_CALL_2(req->io_task_work.func, 1421c92fcfc2SJens Axboe io_poll_task_func, io_req_rw_complete, 1422c92fcfc2SJens Axboe req, ts); 1423c0e0d6baSDylan Yudaken ret++; 1424c0e0d6baSDylan Yudaken node = next; 1425c0e0d6baSDylan Yudaken } 1426f75d5036SDylan Yudaken loops++; 1427c0e0d6baSDylan Yudaken 1428c3f4d39eSPavel Begunkov if (!llist_empty(&ctx->work_llist)) 1429c3f4d39eSPavel Begunkov goto again; 1430a282967cSPavel Begunkov if (ts->locked) { 1431c0e0d6baSDylan Yudaken io_submit_flush_completions(ctx); 1432b0b7a7d2SPavel Begunkov if (!llist_empty(&ctx->work_llist)) 1433b0b7a7d2SPavel Begunkov goto again; 1434b0b7a7d2SPavel Begunkov } 1435f75d5036SDylan Yudaken trace_io_uring_local_work_run(ctx, ret, loops); 1436c0e0d6baSDylan Yudaken return ret; 14378ac5d85aSJens Axboe } 14388ac5d85aSJens Axboe 1439360173abSPavel Begunkov static inline int io_run_local_work_locked(struct io_ring_ctx *ctx) 1440360173abSPavel Begunkov { 1441a282967cSPavel Begunkov struct io_tw_state ts = { .locked = true, }; 1442360173abSPavel Begunkov int ret; 1443360173abSPavel Begunkov 1444360173abSPavel Begunkov if (llist_empty(&ctx->work_llist)) 1445360173abSPavel Begunkov return 0; 1446360173abSPavel Begunkov 1447a282967cSPavel Begunkov ret = __io_run_local_work(ctx, &ts); 1448360173abSPavel Begunkov /* shouldn't happen! */ 1449a282967cSPavel Begunkov if (WARN_ON_ONCE(!ts.locked)) 1450360173abSPavel Begunkov mutex_lock(&ctx->uring_lock); 1451360173abSPavel Begunkov return ret; 1452360173abSPavel Begunkov } 1453360173abSPavel Begunkov 14543e565555SPavel Begunkov static int io_run_local_work(struct io_ring_ctx *ctx) 14558ac5d85aSJens Axboe { 1456a282967cSPavel Begunkov struct io_tw_state ts = {}; 14578ac5d85aSJens Axboe int ret; 14588ac5d85aSJens Axboe 1459a282967cSPavel Begunkov ts.locked = mutex_trylock(&ctx->uring_lock); 1460a282967cSPavel Begunkov ret = __io_run_local_work(ctx, &ts); 1461a282967cSPavel Begunkov if (ts.locked) 14628ac5d85aSJens Axboe mutex_unlock(&ctx->uring_lock); 14638ac5d85aSJens Axboe 14648ac5d85aSJens Axboe return ret; 1465c0e0d6baSDylan Yudaken } 1466c0e0d6baSDylan Yudaken 1467a282967cSPavel Begunkov static void io_req_task_cancel(struct io_kiocb *req, struct io_tw_state *ts) 1468ed29b0b4SJens Axboe { 1469a282967cSPavel Begunkov io_tw_lock(req->ctx, ts); 1470973fc83fSDylan Yudaken io_req_defer_failed(req, req->cqe.res); 1471ed29b0b4SJens Axboe } 1472ed29b0b4SJens Axboe 1473a282967cSPavel Begunkov void io_req_task_submit(struct io_kiocb *req, struct io_tw_state *ts) 1474ed29b0b4SJens Axboe { 1475a282967cSPavel Begunkov io_tw_lock(req->ctx, ts); 1476ed29b0b4SJens Axboe /* req->task == current here, checking PF_EXITING is safe */ 14776bb30855SDylan Yudaken if (unlikely(req->task->flags & PF_EXITING)) 1478973fc83fSDylan Yudaken io_req_defer_failed(req, -EFAULT); 14796bb30855SDylan Yudaken else if (req->flags & REQ_F_FORCE_ASYNC) 1480a282967cSPavel Begunkov io_queue_iowq(req, ts); 14816bb30855SDylan Yudaken else 14826bb30855SDylan Yudaken io_queue_sqe(req); 1483ed29b0b4SJens Axboe } 1484ed29b0b4SJens Axboe 148559915143SJens Axboe void io_req_task_queue_fail(struct io_kiocb *req, int ret) 1486ed29b0b4SJens Axboe { 148797b388d7SJens Axboe io_req_set_res(req, ret, 0); 1488ed29b0b4SJens Axboe req->io_task_work.func = io_req_task_cancel; 1489ed29b0b4SJens Axboe io_req_task_work_add(req); 1490ed29b0b4SJens Axboe } 1491ed29b0b4SJens Axboe 1492f3b44f92SJens Axboe void io_req_task_queue(struct io_kiocb *req) 1493ed29b0b4SJens Axboe { 1494ed29b0b4SJens Axboe req->io_task_work.func = io_req_task_submit; 1495ed29b0b4SJens Axboe io_req_task_work_add(req); 1496ed29b0b4SJens Axboe } 1497ed29b0b4SJens Axboe 149859915143SJens Axboe void io_queue_next(struct io_kiocb *req) 1499ed29b0b4SJens Axboe { 1500ed29b0b4SJens Axboe struct io_kiocb *nxt = io_req_find_next(req); 1501ed29b0b4SJens Axboe 1502ed29b0b4SJens Axboe if (nxt) 1503ed29b0b4SJens Axboe io_req_task_queue(nxt); 1504ed29b0b4SJens Axboe } 1505ed29b0b4SJens Axboe 1506f3b44f92SJens Axboe void io_free_batch_list(struct io_ring_ctx *ctx, struct io_wq_work_node *node) 1507ed29b0b4SJens Axboe __must_hold(&ctx->uring_lock) 1508ed29b0b4SJens Axboe { 1509ed29b0b4SJens Axboe struct task_struct *task = NULL; 1510ed29b0b4SJens Axboe int task_refs = 0; 1511ed29b0b4SJens Axboe 1512ed29b0b4SJens Axboe do { 1513ed29b0b4SJens Axboe struct io_kiocb *req = container_of(node, struct io_kiocb, 1514ed29b0b4SJens Axboe comp_list); 1515ed29b0b4SJens Axboe 1516ed29b0b4SJens Axboe if (unlikely(req->flags & IO_REQ_CLEAN_SLOW_FLAGS)) { 1517ed29b0b4SJens Axboe if (req->flags & REQ_F_REFCOUNT) { 1518ed29b0b4SJens Axboe node = req->comp_list.next; 1519ed29b0b4SJens Axboe if (!req_ref_put_and_test(req)) 1520ed29b0b4SJens Axboe continue; 1521ed29b0b4SJens Axboe } 1522ed29b0b4SJens Axboe if ((req->flags & REQ_F_POLLED) && req->apoll) { 1523ed29b0b4SJens Axboe struct async_poll *apoll = req->apoll; 1524ed29b0b4SJens Axboe 1525ed29b0b4SJens Axboe if (apoll->double_poll) 1526ed29b0b4SJens Axboe kfree(apoll->double_poll); 15279731bc98SJens Axboe if (!io_alloc_cache_put(&ctx->apoll_cache, &apoll->cache)) 15289731bc98SJens Axboe kfree(apoll); 1529ed29b0b4SJens Axboe req->flags &= ~REQ_F_POLLED; 1530ed29b0b4SJens Axboe } 1531ed29b0b4SJens Axboe if (req->flags & IO_REQ_LINK_FLAGS) 1532ed29b0b4SJens Axboe io_queue_next(req); 1533ed29b0b4SJens Axboe if (unlikely(req->flags & IO_REQ_CLEAN_FLAGS)) 1534ed29b0b4SJens Axboe io_clean_op(req); 1535ed29b0b4SJens Axboe } 1536ed29b0b4SJens Axboe if (!(req->flags & REQ_F_FIXED_FILE)) 1537ed29b0b4SJens Axboe io_put_file(req->file); 1538ed29b0b4SJens Axboe 1539ed29b0b4SJens Axboe io_req_put_rsrc_locked(req, ctx); 1540ed29b0b4SJens Axboe 1541ed29b0b4SJens Axboe if (req->task != task) { 1542ed29b0b4SJens Axboe if (task) 1543ed29b0b4SJens Axboe io_put_task(task, task_refs); 1544ed29b0b4SJens Axboe task = req->task; 1545ed29b0b4SJens Axboe task_refs = 0; 1546ed29b0b4SJens Axboe } 1547ed29b0b4SJens Axboe task_refs++; 1548ed29b0b4SJens Axboe node = req->comp_list.next; 1549ed29b0b4SJens Axboe io_req_add_to_cache(req, ctx); 1550ed29b0b4SJens Axboe } while (node); 1551ed29b0b4SJens Axboe 1552ed29b0b4SJens Axboe if (task) 1553ed29b0b4SJens Axboe io_put_task(task, task_refs); 1554ed29b0b4SJens Axboe } 1555ed29b0b4SJens Axboe 1556ed29b0b4SJens Axboe static void __io_submit_flush_completions(struct io_ring_ctx *ctx) 1557ed29b0b4SJens Axboe __must_hold(&ctx->uring_lock) 1558ed29b0b4SJens Axboe { 1559ed29b0b4SJens Axboe struct io_submit_state *state = &ctx->submit_state; 1560fa780334SJens Axboe struct io_wq_work_node *node; 1561ed29b0b4SJens Axboe 1562f66f7342SPavel Begunkov __io_cq_lock(ctx); 1563931147ddSDylan Yudaken /* must come first to preserve CQE ordering in failure cases */ 1564931147ddSDylan Yudaken if (state->cqes_count) 1565931147ddSDylan Yudaken __io_flush_post_cqes(ctx); 1566fa780334SJens Axboe __wq_list_for_each(node, &state->compl_reqs) { 1567ed29b0b4SJens Axboe struct io_kiocb *req = container_of(node, struct io_kiocb, 1568ed29b0b4SJens Axboe comp_list); 1569ed29b0b4SJens Axboe 1570f66f7342SPavel Begunkov if (!(req->flags & REQ_F_CQE_SKIP) && 1571f66f7342SPavel Begunkov unlikely(!__io_fill_cqe_req(ctx, req))) { 1572f66f7342SPavel Begunkov if (ctx->task_complete) { 1573f66f7342SPavel Begunkov spin_lock(&ctx->completion_lock); 1574f66f7342SPavel Begunkov io_req_cqe_overflow(req); 1575f66f7342SPavel Begunkov spin_unlock(&ctx->completion_lock); 1576f66f7342SPavel Begunkov } else { 1577f66f7342SPavel Begunkov io_req_cqe_overflow(req); 1578ed29b0b4SJens Axboe } 1579f66f7342SPavel Begunkov } 1580f66f7342SPavel Begunkov } 15813181e22fSPavel Begunkov __io_cq_unlock_post_flush(ctx); 1582ed29b0b4SJens Axboe 1583931147ddSDylan Yudaken if (!wq_list_empty(&ctx->submit_state.compl_reqs)) { 1584ed29b0b4SJens Axboe io_free_batch_list(ctx, state->compl_reqs.first); 1585ed29b0b4SJens Axboe INIT_WQ_LIST(&state->compl_reqs); 1586ed29b0b4SJens Axboe } 1587931147ddSDylan Yudaken } 1588ed29b0b4SJens Axboe 1589ed29b0b4SJens Axboe /* 1590ed29b0b4SJens Axboe * Drop reference to request, return next in chain (if there is one) if this 1591ed29b0b4SJens Axboe * was the last reference to this request. 1592ed29b0b4SJens Axboe */ 1593ed29b0b4SJens Axboe static inline struct io_kiocb *io_put_req_find_next(struct io_kiocb *req) 1594ed29b0b4SJens Axboe { 1595ed29b0b4SJens Axboe struct io_kiocb *nxt = NULL; 1596ed29b0b4SJens Axboe 1597ed29b0b4SJens Axboe if (req_ref_put_and_test(req)) { 1598ed29b0b4SJens Axboe if (unlikely(req->flags & IO_REQ_LINK_FLAGS)) 1599ed29b0b4SJens Axboe nxt = io_req_find_next(req); 1600ed29b0b4SJens Axboe io_free_req(req); 1601ed29b0b4SJens Axboe } 1602ed29b0b4SJens Axboe return nxt; 1603ed29b0b4SJens Axboe } 1604ed29b0b4SJens Axboe 1605ed29b0b4SJens Axboe static unsigned io_cqring_events(struct io_ring_ctx *ctx) 1606ed29b0b4SJens Axboe { 1607ed29b0b4SJens Axboe /* See comment at the top of this file */ 1608ed29b0b4SJens Axboe smp_rmb(); 1609ed29b0b4SJens Axboe return __io_cqring_events(ctx); 1610ed29b0b4SJens Axboe } 1611ed29b0b4SJens Axboe 1612ed29b0b4SJens Axboe /* 1613ed29b0b4SJens Axboe * We can't just wait for polled events to come to us, we have to actively 1614ed29b0b4SJens Axboe * find and complete them. 1615ed29b0b4SJens Axboe */ 1616ed29b0b4SJens Axboe static __cold void io_iopoll_try_reap_events(struct io_ring_ctx *ctx) 1617ed29b0b4SJens Axboe { 1618ed29b0b4SJens Axboe if (!(ctx->flags & IORING_SETUP_IOPOLL)) 1619ed29b0b4SJens Axboe return; 1620ed29b0b4SJens Axboe 1621ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 1622ed29b0b4SJens Axboe while (!wq_list_empty(&ctx->iopoll_list)) { 1623ed29b0b4SJens Axboe /* let it sleep and repeat later if can't complete a request */ 1624ed29b0b4SJens Axboe if (io_do_iopoll(ctx, true) == 0) 1625ed29b0b4SJens Axboe break; 1626ed29b0b4SJens Axboe /* 1627ed29b0b4SJens Axboe * Ensure we allow local-to-the-cpu processing to take place, 1628ed29b0b4SJens Axboe * in this case we need to ensure that we reap all events. 1629ed29b0b4SJens Axboe * Also let task_work, etc. to progress by releasing the mutex 1630ed29b0b4SJens Axboe */ 1631ed29b0b4SJens Axboe if (need_resched()) { 1632ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 1633ed29b0b4SJens Axboe cond_resched(); 1634ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 1635ed29b0b4SJens Axboe } 1636ed29b0b4SJens Axboe } 1637ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 1638ed29b0b4SJens Axboe } 1639ed29b0b4SJens Axboe 1640ed29b0b4SJens Axboe static int io_iopoll_check(struct io_ring_ctx *ctx, long min) 1641ed29b0b4SJens Axboe { 1642ed29b0b4SJens Axboe unsigned int nr_events = 0; 1643ed29b0b4SJens Axboe int ret = 0; 1644ed29b0b4SJens Axboe unsigned long check_cq; 1645ed29b0b4SJens Axboe 164676de6749SPavel Begunkov if (!io_allowed_run_tw(ctx)) 164776de6749SPavel Begunkov return -EEXIST; 164876de6749SPavel Begunkov 16493a08576bSPavel Begunkov check_cq = READ_ONCE(ctx->check_cq); 16503a08576bSPavel Begunkov if (unlikely(check_cq)) { 16513a08576bSPavel Begunkov if (check_cq & BIT(IO_CHECK_CQ_OVERFLOW_BIT)) 1652a85381d8SPavel Begunkov __io_cqring_overflow_flush(ctx); 16533a08576bSPavel Begunkov /* 16543a08576bSPavel Begunkov * Similarly do not spin if we have not informed the user of any 16553a08576bSPavel Begunkov * dropped CQE. 16563a08576bSPavel Begunkov */ 16573a08576bSPavel Begunkov if (check_cq & BIT(IO_CHECK_CQ_DROPPED_BIT)) 16583a08576bSPavel Begunkov return -EBADR; 16593a08576bSPavel Begunkov } 1660ed29b0b4SJens Axboe /* 1661ed29b0b4SJens Axboe * Don't enter poll loop if we already have events pending. 1662ed29b0b4SJens Axboe * If we do, we can potentially be spinning for commands that 1663ed29b0b4SJens Axboe * already triggered a CQE (eg in error). 1664ed29b0b4SJens Axboe */ 1665ed29b0b4SJens Axboe if (io_cqring_events(ctx)) 1666ed29b0b4SJens Axboe return 0; 1667ed29b0b4SJens Axboe 1668ed29b0b4SJens Axboe do { 1669ed29b0b4SJens Axboe /* 1670ed29b0b4SJens Axboe * If a submit got punted to a workqueue, we can have the 1671ed29b0b4SJens Axboe * application entering polling for a command before it gets 1672ed29b0b4SJens Axboe * issued. That app will hold the uring_lock for the duration 1673ed29b0b4SJens Axboe * of the poll right here, so we need to take a breather every 1674ed29b0b4SJens Axboe * now and then to ensure that the issue has a chance to add 1675ed29b0b4SJens Axboe * the poll to the issued list. Otherwise we can spin here 1676ed29b0b4SJens Axboe * forever, while the workqueue is stuck trying to acquire the 1677ed29b0b4SJens Axboe * very same mutex. 1678ed29b0b4SJens Axboe */ 1679dac6a0eaSJens Axboe if (wq_list_empty(&ctx->iopoll_list) || 1680dac6a0eaSJens Axboe io_task_work_pending(ctx)) { 1681ed29b0b4SJens Axboe u32 tail = ctx->cached_cq_tail; 1682ed29b0b4SJens Axboe 16838de11cdcSDylan Yudaken (void) io_run_local_work_locked(ctx); 16841f8d5bbeSPavel Begunkov 16851f8d5bbeSPavel Begunkov if (task_work_pending(current) || 16861f8d5bbeSPavel Begunkov wq_list_empty(&ctx->iopoll_list)) { 1687ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 1688ed29b0b4SJens Axboe io_run_task_work(); 1689ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 16901f8d5bbeSPavel Begunkov } 1691ed29b0b4SJens Axboe /* some requests don't go through iopoll_list */ 1692ed29b0b4SJens Axboe if (tail != ctx->cached_cq_tail || 1693ed29b0b4SJens Axboe wq_list_empty(&ctx->iopoll_list)) 1694ed29b0b4SJens Axboe break; 1695ed29b0b4SJens Axboe } 1696ed29b0b4SJens Axboe ret = io_do_iopoll(ctx, !min); 1697ed29b0b4SJens Axboe if (ret < 0) 1698ed29b0b4SJens Axboe break; 1699ed29b0b4SJens Axboe nr_events += ret; 1700ed29b0b4SJens Axboe ret = 0; 1701ed29b0b4SJens Axboe } while (nr_events < min && !need_resched()); 1702ed29b0b4SJens Axboe 1703ed29b0b4SJens Axboe return ret; 1704ed29b0b4SJens Axboe } 17057012c815SPavel Begunkov 1706a282967cSPavel Begunkov void io_req_task_complete(struct io_kiocb *req, struct io_tw_state *ts) 1707ed29b0b4SJens Axboe { 1708a282967cSPavel Begunkov if (ts->locked) 17099da070b1SPavel Begunkov io_req_complete_defer(req); 17107012c815SPavel Begunkov else 171127f35fe9SDylan Yudaken io_req_complete_post(req, IO_URING_F_UNLOCKED); 1712ed29b0b4SJens Axboe } 1713ed29b0b4SJens Axboe 1714ed29b0b4SJens Axboe /* 1715ed29b0b4SJens Axboe * After the iocb has been issued, it's safe to be found on the poll list. 1716ed29b0b4SJens Axboe * Adding the kiocb to the list AFTER submission ensures that we don't 1717ed29b0b4SJens Axboe * find it from a io_do_iopoll() thread before the issuer is done 1718ed29b0b4SJens Axboe * accessing the kiocb cookie. 1719ed29b0b4SJens Axboe */ 1720ed29b0b4SJens Axboe static void io_iopoll_req_issued(struct io_kiocb *req, unsigned int issue_flags) 1721ed29b0b4SJens Axboe { 1722ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 1723ed29b0b4SJens Axboe const bool needs_lock = issue_flags & IO_URING_F_UNLOCKED; 1724ed29b0b4SJens Axboe 1725ed29b0b4SJens Axboe /* workqueue context doesn't hold uring_lock, grab it now */ 1726ed29b0b4SJens Axboe if (unlikely(needs_lock)) 1727ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 1728ed29b0b4SJens Axboe 1729ed29b0b4SJens Axboe /* 1730ed29b0b4SJens Axboe * Track whether we have multiple files in our lists. This will impact 1731ed29b0b4SJens Axboe * how we do polling eventually, not spinning if we're on potentially 1732ed29b0b4SJens Axboe * different devices. 1733ed29b0b4SJens Axboe */ 1734ed29b0b4SJens Axboe if (wq_list_empty(&ctx->iopoll_list)) { 1735ed29b0b4SJens Axboe ctx->poll_multi_queue = false; 1736ed29b0b4SJens Axboe } else if (!ctx->poll_multi_queue) { 1737ed29b0b4SJens Axboe struct io_kiocb *list_req; 1738ed29b0b4SJens Axboe 1739ed29b0b4SJens Axboe list_req = container_of(ctx->iopoll_list.first, struct io_kiocb, 1740ed29b0b4SJens Axboe comp_list); 1741ed29b0b4SJens Axboe if (list_req->file != req->file) 1742ed29b0b4SJens Axboe ctx->poll_multi_queue = true; 1743ed29b0b4SJens Axboe } 1744ed29b0b4SJens Axboe 1745ed29b0b4SJens Axboe /* 1746ed29b0b4SJens Axboe * For fast devices, IO may have already completed. If it has, add 1747ed29b0b4SJens Axboe * it to the front so we find it first. 1748ed29b0b4SJens Axboe */ 1749ed29b0b4SJens Axboe if (READ_ONCE(req->iopoll_completed)) 1750ed29b0b4SJens Axboe wq_list_add_head(&req->comp_list, &ctx->iopoll_list); 1751ed29b0b4SJens Axboe else 1752ed29b0b4SJens Axboe wq_list_add_tail(&req->comp_list, &ctx->iopoll_list); 1753ed29b0b4SJens Axboe 1754ed29b0b4SJens Axboe if (unlikely(needs_lock)) { 1755ed29b0b4SJens Axboe /* 1756ed29b0b4SJens Axboe * If IORING_SETUP_SQPOLL is enabled, sqes are either handle 1757ed29b0b4SJens Axboe * in sq thread task context or in io worker task context. If 1758ed29b0b4SJens Axboe * current task context is sq thread, we don't need to check 1759ed29b0b4SJens Axboe * whether should wake up sq thread. 1760ed29b0b4SJens Axboe */ 1761ed29b0b4SJens Axboe if ((ctx->flags & IORING_SETUP_SQPOLL) && 1762ed29b0b4SJens Axboe wq_has_sleeper(&ctx->sq_data->wait)) 1763ed29b0b4SJens Axboe wake_up(&ctx->sq_data->wait); 1764ed29b0b4SJens Axboe 1765ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 1766ed29b0b4SJens Axboe } 1767ed29b0b4SJens Axboe } 1768ed29b0b4SJens Axboe 1769a4ad4f74SJens Axboe unsigned int io_file_get_flags(struct file *file) 1770ed29b0b4SJens Axboe { 1771ed29b0b4SJens Axboe unsigned int res = 0; 1772ed29b0b4SJens Axboe 177353cfd5ceSChristoph Hellwig if (S_ISREG(file_inode(file)->i_mode)) 1774ed29b0b4SJens Axboe res |= FFS_ISREG; 1775b9a6c945SChristoph Hellwig if ((file->f_flags & O_NONBLOCK) || (file->f_mode & FMODE_NOWAIT)) 1776ed29b0b4SJens Axboe res |= FFS_NOWAIT; 1777ed29b0b4SJens Axboe return res; 1778ed29b0b4SJens Axboe } 1779ed29b0b4SJens Axboe 178099f15d8dSJens Axboe bool io_alloc_async_data(struct io_kiocb *req) 1781ed29b0b4SJens Axboe { 1782f30bd4d0SBreno Leitao WARN_ON_ONCE(!io_cold_defs[req->opcode].async_size); 1783f30bd4d0SBreno Leitao req->async_data = kmalloc(io_cold_defs[req->opcode].async_size, GFP_KERNEL); 1784ed29b0b4SJens Axboe if (req->async_data) { 1785ed29b0b4SJens Axboe req->flags |= REQ_F_ASYNC_DATA; 1786ed29b0b4SJens Axboe return false; 1787ed29b0b4SJens Axboe } 1788ed29b0b4SJens Axboe return true; 1789ed29b0b4SJens Axboe } 1790ed29b0b4SJens Axboe 1791f3b44f92SJens Axboe int io_req_prep_async(struct io_kiocb *req) 1792ed29b0b4SJens Axboe { 1793f30bd4d0SBreno Leitao const struct io_cold_def *cdef = &io_cold_defs[req->opcode]; 1794a7dd2782SBreno Leitao const struct io_issue_def *def = &io_issue_defs[req->opcode]; 1795ed29b0b4SJens Axboe 1796ed29b0b4SJens Axboe /* assign early for deferred execution for non-fixed file */ 179754aa7f23SJoseph Qi if (def->needs_file && !(req->flags & REQ_F_FIXED_FILE) && !req->file) 1798ed29b0b4SJens Axboe req->file = io_file_get_normal(req, req->cqe.fd); 1799f30bd4d0SBreno Leitao if (!cdef->prep_async) 1800ed29b0b4SJens Axboe return 0; 1801ed29b0b4SJens Axboe if (WARN_ON_ONCE(req_has_async_data(req))) 1802ed29b0b4SJens Axboe return -EFAULT; 1803f30bd4d0SBreno Leitao if (!def->manual_alloc) { 1804ed29b0b4SJens Axboe if (io_alloc_async_data(req)) 1805ed29b0b4SJens Axboe return -EAGAIN; 180659169439SPavel Begunkov } 1807f30bd4d0SBreno Leitao return cdef->prep_async(req); 1808ed29b0b4SJens Axboe } 1809ed29b0b4SJens Axboe 1810ed29b0b4SJens Axboe static u32 io_get_sequence(struct io_kiocb *req) 1811ed29b0b4SJens Axboe { 1812ed29b0b4SJens Axboe u32 seq = req->ctx->cached_sq_head; 1813ed29b0b4SJens Axboe struct io_kiocb *cur; 1814ed29b0b4SJens Axboe 1815ed29b0b4SJens Axboe /* need original cached_sq_head, but it was increased for each req */ 1816ed29b0b4SJens Axboe io_for_each_link(cur, req) 1817ed29b0b4SJens Axboe seq--; 1818ed29b0b4SJens Axboe return seq; 1819ed29b0b4SJens Axboe } 1820ed29b0b4SJens Axboe 1821ed29b0b4SJens Axboe static __cold void io_drain_req(struct io_kiocb *req) 1822e276ae34SPavel Begunkov __must_hold(&ctx->uring_lock) 1823ed29b0b4SJens Axboe { 1824ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 1825ed29b0b4SJens Axboe struct io_defer_entry *de; 1826ed29b0b4SJens Axboe int ret; 1827ed29b0b4SJens Axboe u32 seq = io_get_sequence(req); 1828ed29b0b4SJens Axboe 1829ed29b0b4SJens Axboe /* Still need defer if there is pending req in defer list. */ 1830ed29b0b4SJens Axboe spin_lock(&ctx->completion_lock); 1831ed29b0b4SJens Axboe if (!req_need_defer(req, seq) && list_empty_careful(&ctx->defer_list)) { 1832ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 1833ed29b0b4SJens Axboe queue: 1834ed29b0b4SJens Axboe ctx->drain_active = false; 1835ed29b0b4SJens Axboe io_req_task_queue(req); 1836ed29b0b4SJens Axboe return; 1837ed29b0b4SJens Axboe } 1838ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 1839ed29b0b4SJens Axboe 1840ed29b0b4SJens Axboe io_prep_async_link(req); 1841ed29b0b4SJens Axboe de = kmalloc(sizeof(*de), GFP_KERNEL); 1842ed29b0b4SJens Axboe if (!de) { 1843ed29b0b4SJens Axboe ret = -ENOMEM; 1844ef5c600aSDylan Yudaken io_req_defer_failed(req, ret); 1845ef5c600aSDylan Yudaken return; 1846ed29b0b4SJens Axboe } 1847ed29b0b4SJens Axboe 1848ed29b0b4SJens Axboe spin_lock(&ctx->completion_lock); 1849ed29b0b4SJens Axboe if (!req_need_defer(req, seq) && list_empty(&ctx->defer_list)) { 1850ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 1851ed29b0b4SJens Axboe kfree(de); 1852ed29b0b4SJens Axboe goto queue; 1853ed29b0b4SJens Axboe } 1854ed29b0b4SJens Axboe 185548863ffdSPavel Begunkov trace_io_uring_defer(req); 1856ed29b0b4SJens Axboe de->req = req; 1857ed29b0b4SJens Axboe de->seq = seq; 1858ed29b0b4SJens Axboe list_add_tail(&de->list, &ctx->defer_list); 1859ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 1860ed29b0b4SJens Axboe } 1861ed29b0b4SJens Axboe 1862ed29b0b4SJens Axboe static void io_clean_op(struct io_kiocb *req) 1863ed29b0b4SJens Axboe { 1864ed29b0b4SJens Axboe if (req->flags & REQ_F_BUFFER_SELECTED) { 1865ed29b0b4SJens Axboe spin_lock(&req->ctx->completion_lock); 1866ed29b0b4SJens Axboe io_put_kbuf_comp(req); 1867ed29b0b4SJens Axboe spin_unlock(&req->ctx->completion_lock); 1868ed29b0b4SJens Axboe } 1869ed29b0b4SJens Axboe 1870ed29b0b4SJens Axboe if (req->flags & REQ_F_NEED_CLEANUP) { 1871f30bd4d0SBreno Leitao const struct io_cold_def *def = &io_cold_defs[req->opcode]; 1872ed29b0b4SJens Axboe 18734d4c9cffSJens Axboe if (def->cleanup) 18744d4c9cffSJens Axboe def->cleanup(req); 1875ed29b0b4SJens Axboe } 1876ed29b0b4SJens Axboe if ((req->flags & REQ_F_POLLED) && req->apoll) { 1877ed29b0b4SJens Axboe kfree(req->apoll->double_poll); 1878ed29b0b4SJens Axboe kfree(req->apoll); 1879ed29b0b4SJens Axboe req->apoll = NULL; 1880ed29b0b4SJens Axboe } 1881ed29b0b4SJens Axboe if (req->flags & REQ_F_INFLIGHT) { 1882ed29b0b4SJens Axboe struct io_uring_task *tctx = req->task->io_uring; 1883ed29b0b4SJens Axboe 1884ed29b0b4SJens Axboe atomic_dec(&tctx->inflight_tracked); 1885ed29b0b4SJens Axboe } 1886ed29b0b4SJens Axboe if (req->flags & REQ_F_CREDS) 1887ed29b0b4SJens Axboe put_cred(req->creds); 1888ed29b0b4SJens Axboe if (req->flags & REQ_F_ASYNC_DATA) { 1889ed29b0b4SJens Axboe kfree(req->async_data); 1890ed29b0b4SJens Axboe req->async_data = NULL; 1891ed29b0b4SJens Axboe } 1892ed29b0b4SJens Axboe req->flags &= ~IO_REQ_CLEAN_FLAGS; 1893ed29b0b4SJens Axboe } 1894ed29b0b4SJens Axboe 1895f4992544SJens Axboe static bool io_assign_file(struct io_kiocb *req, const struct io_issue_def *def, 1896f4992544SJens Axboe unsigned int issue_flags) 1897ed29b0b4SJens Axboe { 1898f4992544SJens Axboe if (req->file || !def->needs_file) 1899ed29b0b4SJens Axboe return true; 1900ed29b0b4SJens Axboe 1901ed29b0b4SJens Axboe if (req->flags & REQ_F_FIXED_FILE) 1902ed29b0b4SJens Axboe req->file = io_file_get_fixed(req, req->cqe.fd, issue_flags); 1903ed29b0b4SJens Axboe else 1904ed29b0b4SJens Axboe req->file = io_file_get_normal(req, req->cqe.fd); 1905ed29b0b4SJens Axboe 1906ed29b0b4SJens Axboe return !!req->file; 1907ed29b0b4SJens Axboe } 1908ed29b0b4SJens Axboe 1909ed29b0b4SJens Axboe static int io_issue_sqe(struct io_kiocb *req, unsigned int issue_flags) 1910ed29b0b4SJens Axboe { 1911a7dd2782SBreno Leitao const struct io_issue_def *def = &io_issue_defs[req->opcode]; 1912ed29b0b4SJens Axboe const struct cred *creds = NULL; 1913ed29b0b4SJens Axboe int ret; 1914ed29b0b4SJens Axboe 1915f4992544SJens Axboe if (unlikely(!io_assign_file(req, def, issue_flags))) 1916ed29b0b4SJens Axboe return -EBADF; 1917ed29b0b4SJens Axboe 1918ed29b0b4SJens Axboe if (unlikely((req->flags & REQ_F_CREDS) && req->creds != current_cred())) 1919ed29b0b4SJens Axboe creds = override_creds(req->creds); 1920ed29b0b4SJens Axboe 1921ed29b0b4SJens Axboe if (!def->audit_skip) 1922ed29b0b4SJens Axboe audit_uring_entry(req->opcode); 1923ed29b0b4SJens Axboe 1924ed29b0b4SJens Axboe ret = def->issue(req, issue_flags); 1925ed29b0b4SJens Axboe 1926ed29b0b4SJens Axboe if (!def->audit_skip) 1927ed29b0b4SJens Axboe audit_uring_exit(!ret, ret); 1928ed29b0b4SJens Axboe 1929ed29b0b4SJens Axboe if (creds) 1930ed29b0b4SJens Axboe revert_creds(creds); 193197b388d7SJens Axboe 193275d7b3aeSPavel Begunkov if (ret == IOU_OK) { 193375d7b3aeSPavel Begunkov if (issue_flags & IO_URING_F_COMPLETE_DEFER) 19349da070b1SPavel Begunkov io_req_complete_defer(req); 193575d7b3aeSPavel Begunkov else 19361bec951cSPavel Begunkov io_req_complete_post(req, issue_flags); 193775d7b3aeSPavel Begunkov } else if (ret != IOU_ISSUE_SKIP_COMPLETE) 1938ed29b0b4SJens Axboe return ret; 193997b388d7SJens Axboe 1940ed29b0b4SJens Axboe /* If the op doesn't have a file, we're not polling for it */ 1941ef0ec1adSPavel Begunkov if ((req->ctx->flags & IORING_SETUP_IOPOLL) && def->iopoll_queue) 1942ed29b0b4SJens Axboe io_iopoll_req_issued(req, issue_flags); 1943ed29b0b4SJens Axboe 1944ed29b0b4SJens Axboe return 0; 1945ed29b0b4SJens Axboe } 1946ed29b0b4SJens Axboe 1947a282967cSPavel Begunkov int io_poll_issue(struct io_kiocb *req, struct io_tw_state *ts) 1948329061d3SJens Axboe { 1949a282967cSPavel Begunkov io_tw_lock(req->ctx, ts); 19509a692451SDylan Yudaken return io_issue_sqe(req, IO_URING_F_NONBLOCK|IO_URING_F_MULTISHOT| 19519a692451SDylan Yudaken IO_URING_F_COMPLETE_DEFER); 1952329061d3SJens Axboe } 1953329061d3SJens Axboe 1954c9f06aa7SJens Axboe struct io_wq_work *io_wq_free_work(struct io_wq_work *work) 1955ed29b0b4SJens Axboe { 1956ed29b0b4SJens Axboe struct io_kiocb *req = container_of(work, struct io_kiocb, work); 1957ed29b0b4SJens Axboe 1958ed29b0b4SJens Axboe req = io_put_req_find_next(req); 1959ed29b0b4SJens Axboe return req ? &req->work : NULL; 1960ed29b0b4SJens Axboe } 1961ed29b0b4SJens Axboe 1962c9f06aa7SJens Axboe void io_wq_submit_work(struct io_wq_work *work) 1963ed29b0b4SJens Axboe { 1964ed29b0b4SJens Axboe struct io_kiocb *req = container_of(work, struct io_kiocb, work); 1965a7dd2782SBreno Leitao const struct io_issue_def *def = &io_issue_defs[req->opcode]; 1966e6aeb272SPavel Begunkov unsigned int issue_flags = IO_URING_F_UNLOCKED | IO_URING_F_IOWQ; 1967ed29b0b4SJens Axboe bool needs_poll = false; 1968ed29b0b4SJens Axboe int ret = 0, err = -ECANCELED; 1969ed29b0b4SJens Axboe 197023a6c9acSLin Ma /* one will be dropped by ->io_wq_free_work() after returning to io-wq */ 1971ed29b0b4SJens Axboe if (!(req->flags & REQ_F_REFCOUNT)) 1972ed29b0b4SJens Axboe __io_req_set_refcount(req, 2); 1973ed29b0b4SJens Axboe else 1974ed29b0b4SJens Axboe req_ref_get(req); 1975ed29b0b4SJens Axboe 1976ed29b0b4SJens Axboe io_arm_ltimeout(req); 1977ed29b0b4SJens Axboe 1978ed29b0b4SJens Axboe /* either cancelled or io-wq is dying, so don't touch tctx->iowq */ 1979ed29b0b4SJens Axboe if (work->flags & IO_WQ_WORK_CANCEL) { 1980ed29b0b4SJens Axboe fail: 1981ed29b0b4SJens Axboe io_req_task_queue_fail(req, err); 1982ed29b0b4SJens Axboe return; 1983ed29b0b4SJens Axboe } 1984f4992544SJens Axboe if (!io_assign_file(req, def, issue_flags)) { 1985ed29b0b4SJens Axboe err = -EBADF; 1986ed29b0b4SJens Axboe work->flags |= IO_WQ_WORK_CANCEL; 1987ed29b0b4SJens Axboe goto fail; 1988ed29b0b4SJens Axboe } 1989ed29b0b4SJens Axboe 1990ed29b0b4SJens Axboe if (req->flags & REQ_F_FORCE_ASYNC) { 1991ed29b0b4SJens Axboe bool opcode_poll = def->pollin || def->pollout; 1992ed29b0b4SJens Axboe 1993ed29b0b4SJens Axboe if (opcode_poll && file_can_poll(req->file)) { 1994ed29b0b4SJens Axboe needs_poll = true; 1995ed29b0b4SJens Axboe issue_flags |= IO_URING_F_NONBLOCK; 1996ed29b0b4SJens Axboe } 1997ed29b0b4SJens Axboe } 1998ed29b0b4SJens Axboe 1999ed29b0b4SJens Axboe do { 2000ed29b0b4SJens Axboe ret = io_issue_sqe(req, issue_flags); 2001ed29b0b4SJens Axboe if (ret != -EAGAIN) 2002ed29b0b4SJens Axboe break; 2003ed29b0b4SJens Axboe /* 2004ed29b0b4SJens Axboe * We can get EAGAIN for iopolled IO even though we're 2005ed29b0b4SJens Axboe * forcing a sync submission from here, since we can't 2006ed29b0b4SJens Axboe * wait for request slots on the block side. 2007ed29b0b4SJens Axboe */ 2008ed29b0b4SJens Axboe if (!needs_poll) { 2009ed29b0b4SJens Axboe if (!(req->ctx->flags & IORING_SETUP_IOPOLL)) 2010ed29b0b4SJens Axboe break; 2011ed29b0b4SJens Axboe cond_resched(); 2012ed29b0b4SJens Axboe continue; 2013ed29b0b4SJens Axboe } 2014ed29b0b4SJens Axboe 2015ed29b0b4SJens Axboe if (io_arm_poll_handler(req, issue_flags) == IO_APOLL_OK) 2016ed29b0b4SJens Axboe return; 2017ed29b0b4SJens Axboe /* aborted or ready, in either case retry blocking */ 2018ed29b0b4SJens Axboe needs_poll = false; 2019ed29b0b4SJens Axboe issue_flags &= ~IO_URING_F_NONBLOCK; 2020ed29b0b4SJens Axboe } while (1); 2021ed29b0b4SJens Axboe 2022ed29b0b4SJens Axboe /* avoid locking problems by failing it from a clean context */ 202397b388d7SJens Axboe if (ret < 0) 2024ed29b0b4SJens Axboe io_req_task_queue_fail(req, ret); 2025ed29b0b4SJens Axboe } 2026ed29b0b4SJens Axboe 2027531113bbSJens Axboe inline struct file *io_file_get_fixed(struct io_kiocb *req, int fd, 2028ed29b0b4SJens Axboe unsigned int issue_flags) 2029ed29b0b4SJens Axboe { 2030ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 2031ed29b0b4SJens Axboe struct file *file = NULL; 2032ed29b0b4SJens Axboe unsigned long file_ptr; 2033ed29b0b4SJens Axboe 2034ed29b0b4SJens Axboe io_ring_submit_lock(ctx, issue_flags); 2035ed29b0b4SJens Axboe 2036ed29b0b4SJens Axboe if (unlikely((unsigned int)fd >= ctx->nr_user_files)) 2037ed29b0b4SJens Axboe goto out; 2038ed29b0b4SJens Axboe fd = array_index_nospec(fd, ctx->nr_user_files); 2039ed29b0b4SJens Axboe file_ptr = io_fixed_file_slot(&ctx->file_table, fd)->file_ptr; 2040ed29b0b4SJens Axboe file = (struct file *) (file_ptr & FFS_MASK); 2041ed29b0b4SJens Axboe file_ptr &= ~FFS_MASK; 2042ed29b0b4SJens Axboe /* mask in overlapping REQ_F and FFS bits */ 2043ed29b0b4SJens Axboe req->flags |= (file_ptr << REQ_F_SUPPORT_NOWAIT_BIT); 2044ed29b0b4SJens Axboe io_req_set_rsrc_node(req, ctx, 0); 2045ed29b0b4SJens Axboe out: 2046ed29b0b4SJens Axboe io_ring_submit_unlock(ctx, issue_flags); 2047ed29b0b4SJens Axboe return file; 2048ed29b0b4SJens Axboe } 2049ed29b0b4SJens Axboe 2050531113bbSJens Axboe struct file *io_file_get_normal(struct io_kiocb *req, int fd) 2051ed29b0b4SJens Axboe { 2052ed29b0b4SJens Axboe struct file *file = fget(fd); 2053ed29b0b4SJens Axboe 205448863ffdSPavel Begunkov trace_io_uring_file_get(req, fd); 2055ed29b0b4SJens Axboe 2056ed29b0b4SJens Axboe /* we don't allow fixed io_uring files */ 2057e5550a14SJens Axboe if (file && io_is_uring_fops(file)) 2058ed29b0b4SJens Axboe io_req_track_inflight(req); 2059ed29b0b4SJens Axboe return file; 2060ed29b0b4SJens Axboe } 2061ed29b0b4SJens Axboe 2062ed29b0b4SJens Axboe static void io_queue_async(struct io_kiocb *req, int ret) 2063ed29b0b4SJens Axboe __must_hold(&req->ctx->uring_lock) 2064ed29b0b4SJens Axboe { 2065ed29b0b4SJens Axboe struct io_kiocb *linked_timeout; 2066ed29b0b4SJens Axboe 2067ed29b0b4SJens Axboe if (ret != -EAGAIN || (req->flags & REQ_F_NOWAIT)) { 2068973fc83fSDylan Yudaken io_req_defer_failed(req, ret); 2069ed29b0b4SJens Axboe return; 2070ed29b0b4SJens Axboe } 2071ed29b0b4SJens Axboe 2072ed29b0b4SJens Axboe linked_timeout = io_prep_linked_timeout(req); 2073ed29b0b4SJens Axboe 2074ed29b0b4SJens Axboe switch (io_arm_poll_handler(req, 0)) { 2075ed29b0b4SJens Axboe case IO_APOLL_READY: 2076336d28a8SPavel Begunkov io_kbuf_recycle(req, 0); 2077ed29b0b4SJens Axboe io_req_task_queue(req); 2078ed29b0b4SJens Axboe break; 2079ed29b0b4SJens Axboe case IO_APOLL_ABORTED: 2080ed29b0b4SJens Axboe io_kbuf_recycle(req, 0); 2081ed29b0b4SJens Axboe io_queue_iowq(req, NULL); 2082ed29b0b4SJens Axboe break; 2083ed29b0b4SJens Axboe case IO_APOLL_OK: 2084ed29b0b4SJens Axboe break; 2085ed29b0b4SJens Axboe } 2086ed29b0b4SJens Axboe 2087ed29b0b4SJens Axboe if (linked_timeout) 2088ed29b0b4SJens Axboe io_queue_linked_timeout(linked_timeout); 2089ed29b0b4SJens Axboe } 2090ed29b0b4SJens Axboe 2091ed29b0b4SJens Axboe static inline void io_queue_sqe(struct io_kiocb *req) 2092ed29b0b4SJens Axboe __must_hold(&req->ctx->uring_lock) 2093ed29b0b4SJens Axboe { 2094ed29b0b4SJens Axboe int ret; 2095ed29b0b4SJens Axboe 2096ed29b0b4SJens Axboe ret = io_issue_sqe(req, IO_URING_F_NONBLOCK|IO_URING_F_COMPLETE_DEFER); 2097ed29b0b4SJens Axboe 2098ed29b0b4SJens Axboe /* 2099ed29b0b4SJens Axboe * We async punt it if the file wasn't marked NOWAIT, or if the file 2100ed29b0b4SJens Axboe * doesn't support non-blocking read/write attempts 2101ed29b0b4SJens Axboe */ 2102ed29b0b4SJens Axboe if (likely(!ret)) 2103ed29b0b4SJens Axboe io_arm_ltimeout(req); 2104ed29b0b4SJens Axboe else 2105ed29b0b4SJens Axboe io_queue_async(req, ret); 2106ed29b0b4SJens Axboe } 2107ed29b0b4SJens Axboe 2108ed29b0b4SJens Axboe static void io_queue_sqe_fallback(struct io_kiocb *req) 2109ed29b0b4SJens Axboe __must_hold(&req->ctx->uring_lock) 2110ed29b0b4SJens Axboe { 2111ed29b0b4SJens Axboe if (unlikely(req->flags & REQ_F_FAIL)) { 2112ed29b0b4SJens Axboe /* 2113ed29b0b4SJens Axboe * We don't submit, fail them all, for that replace hardlinks 2114ed29b0b4SJens Axboe * with normal links. Extra REQ_F_LINK is tolerated. 2115ed29b0b4SJens Axboe */ 2116ed29b0b4SJens Axboe req->flags &= ~REQ_F_HARDLINK; 2117ed29b0b4SJens Axboe req->flags |= REQ_F_LINK; 2118973fc83fSDylan Yudaken io_req_defer_failed(req, req->cqe.res); 2119ed29b0b4SJens Axboe } else { 2120ed29b0b4SJens Axboe int ret = io_req_prep_async(req); 2121ed29b0b4SJens Axboe 2122ef5c600aSDylan Yudaken if (unlikely(ret)) { 2123973fc83fSDylan Yudaken io_req_defer_failed(req, ret); 2124ef5c600aSDylan Yudaken return; 2125ef5c600aSDylan Yudaken } 2126ef5c600aSDylan Yudaken 2127ef5c600aSDylan Yudaken if (unlikely(req->ctx->drain_active)) 2128ef5c600aSDylan Yudaken io_drain_req(req); 2129ed29b0b4SJens Axboe else 2130ed29b0b4SJens Axboe io_queue_iowq(req, NULL); 2131ed29b0b4SJens Axboe } 2132ed29b0b4SJens Axboe } 2133ed29b0b4SJens Axboe 2134ed29b0b4SJens Axboe /* 2135ed29b0b4SJens Axboe * Check SQE restrictions (opcode and flags). 2136ed29b0b4SJens Axboe * 2137ed29b0b4SJens Axboe * Returns 'true' if SQE is allowed, 'false' otherwise. 2138ed29b0b4SJens Axboe */ 2139ed29b0b4SJens Axboe static inline bool io_check_restriction(struct io_ring_ctx *ctx, 2140ed29b0b4SJens Axboe struct io_kiocb *req, 2141ed29b0b4SJens Axboe unsigned int sqe_flags) 2142ed29b0b4SJens Axboe { 2143ed29b0b4SJens Axboe if (!test_bit(req->opcode, ctx->restrictions.sqe_op)) 2144ed29b0b4SJens Axboe return false; 2145ed29b0b4SJens Axboe 2146ed29b0b4SJens Axboe if ((sqe_flags & ctx->restrictions.sqe_flags_required) != 2147ed29b0b4SJens Axboe ctx->restrictions.sqe_flags_required) 2148ed29b0b4SJens Axboe return false; 2149ed29b0b4SJens Axboe 2150ed29b0b4SJens Axboe if (sqe_flags & ~(ctx->restrictions.sqe_flags_allowed | 2151ed29b0b4SJens Axboe ctx->restrictions.sqe_flags_required)) 2152ed29b0b4SJens Axboe return false; 2153ed29b0b4SJens Axboe 2154ed29b0b4SJens Axboe return true; 2155ed29b0b4SJens Axboe } 2156ed29b0b4SJens Axboe 2157ed29b0b4SJens Axboe static void io_init_req_drain(struct io_kiocb *req) 2158ed29b0b4SJens Axboe { 2159ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 2160ed29b0b4SJens Axboe struct io_kiocb *head = ctx->submit_state.link.head; 2161ed29b0b4SJens Axboe 2162ed29b0b4SJens Axboe ctx->drain_active = true; 2163ed29b0b4SJens Axboe if (head) { 2164ed29b0b4SJens Axboe /* 2165ed29b0b4SJens Axboe * If we need to drain a request in the middle of a link, drain 2166ed29b0b4SJens Axboe * the head request and the next request/link after the current 2167ed29b0b4SJens Axboe * link. Considering sequential execution of links, 2168ed29b0b4SJens Axboe * REQ_F_IO_DRAIN will be maintained for every request of our 2169ed29b0b4SJens Axboe * link. 2170ed29b0b4SJens Axboe */ 2171ed29b0b4SJens Axboe head->flags |= REQ_F_IO_DRAIN | REQ_F_FORCE_ASYNC; 2172ed29b0b4SJens Axboe ctx->drain_next = true; 2173ed29b0b4SJens Axboe } 2174ed29b0b4SJens Axboe } 2175ed29b0b4SJens Axboe 2176ed29b0b4SJens Axboe static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, 2177ed29b0b4SJens Axboe const struct io_uring_sqe *sqe) 2178ed29b0b4SJens Axboe __must_hold(&ctx->uring_lock) 2179ed29b0b4SJens Axboe { 2180a7dd2782SBreno Leitao const struct io_issue_def *def; 2181ed29b0b4SJens Axboe unsigned int sqe_flags; 2182ed29b0b4SJens Axboe int personality; 2183ed29b0b4SJens Axboe u8 opcode; 2184ed29b0b4SJens Axboe 2185ed29b0b4SJens Axboe /* req is partially pre-initialised, see io_preinit_req() */ 2186ed29b0b4SJens Axboe req->opcode = opcode = READ_ONCE(sqe->opcode); 2187ed29b0b4SJens Axboe /* same numerical values with corresponding REQ_F_*, safe to copy */ 2188ed29b0b4SJens Axboe req->flags = sqe_flags = READ_ONCE(sqe->flags); 2189ed29b0b4SJens Axboe req->cqe.user_data = READ_ONCE(sqe->user_data); 2190ed29b0b4SJens Axboe req->file = NULL; 2191ed29b0b4SJens Axboe req->rsrc_node = NULL; 2192ed29b0b4SJens Axboe req->task = current; 2193ed29b0b4SJens Axboe 2194ed29b0b4SJens Axboe if (unlikely(opcode >= IORING_OP_LAST)) { 2195ed29b0b4SJens Axboe req->opcode = 0; 2196ed29b0b4SJens Axboe return -EINVAL; 2197ed29b0b4SJens Axboe } 2198a7dd2782SBreno Leitao def = &io_issue_defs[opcode]; 2199ed29b0b4SJens Axboe if (unlikely(sqe_flags & ~SQE_COMMON_FLAGS)) { 2200ed29b0b4SJens Axboe /* enforce forwards compatibility on users */ 2201ed29b0b4SJens Axboe if (sqe_flags & ~SQE_VALID_FLAGS) 2202ed29b0b4SJens Axboe return -EINVAL; 2203ed29b0b4SJens Axboe if (sqe_flags & IOSQE_BUFFER_SELECT) { 2204ed29b0b4SJens Axboe if (!def->buffer_select) 2205ed29b0b4SJens Axboe return -EOPNOTSUPP; 2206ed29b0b4SJens Axboe req->buf_index = READ_ONCE(sqe->buf_group); 2207ed29b0b4SJens Axboe } 2208ed29b0b4SJens Axboe if (sqe_flags & IOSQE_CQE_SKIP_SUCCESS) 2209ed29b0b4SJens Axboe ctx->drain_disabled = true; 2210ed29b0b4SJens Axboe if (sqe_flags & IOSQE_IO_DRAIN) { 2211ed29b0b4SJens Axboe if (ctx->drain_disabled) 2212ed29b0b4SJens Axboe return -EOPNOTSUPP; 2213ed29b0b4SJens Axboe io_init_req_drain(req); 2214ed29b0b4SJens Axboe } 2215ed29b0b4SJens Axboe } 2216ed29b0b4SJens Axboe if (unlikely(ctx->restricted || ctx->drain_active || ctx->drain_next)) { 2217ed29b0b4SJens Axboe if (ctx->restricted && !io_check_restriction(ctx, req, sqe_flags)) 2218ed29b0b4SJens Axboe return -EACCES; 2219ed29b0b4SJens Axboe /* knock it to the slow queue path, will be drained there */ 2220ed29b0b4SJens Axboe if (ctx->drain_active) 2221ed29b0b4SJens Axboe req->flags |= REQ_F_FORCE_ASYNC; 2222ed29b0b4SJens Axboe /* if there is no link, we're at "next" request and need to drain */ 2223ed29b0b4SJens Axboe if (unlikely(ctx->drain_next) && !ctx->submit_state.link.head) { 2224ed29b0b4SJens Axboe ctx->drain_next = false; 2225ed29b0b4SJens Axboe ctx->drain_active = true; 2226ed29b0b4SJens Axboe req->flags |= REQ_F_IO_DRAIN | REQ_F_FORCE_ASYNC; 2227ed29b0b4SJens Axboe } 2228ed29b0b4SJens Axboe } 2229ed29b0b4SJens Axboe 2230ed29b0b4SJens Axboe if (!def->ioprio && sqe->ioprio) 2231ed29b0b4SJens Axboe return -EINVAL; 2232ed29b0b4SJens Axboe if (!def->iopoll && (ctx->flags & IORING_SETUP_IOPOLL)) 2233ed29b0b4SJens Axboe return -EINVAL; 2234ed29b0b4SJens Axboe 2235ed29b0b4SJens Axboe if (def->needs_file) { 2236ed29b0b4SJens Axboe struct io_submit_state *state = &ctx->submit_state; 2237ed29b0b4SJens Axboe 2238ed29b0b4SJens Axboe req->cqe.fd = READ_ONCE(sqe->fd); 2239ed29b0b4SJens Axboe 2240ed29b0b4SJens Axboe /* 2241ed29b0b4SJens Axboe * Plug now if we have more than 2 IO left after this, and the 2242ed29b0b4SJens Axboe * target is potentially a read/write to block based storage. 2243ed29b0b4SJens Axboe */ 2244ed29b0b4SJens Axboe if (state->need_plug && def->plug) { 2245ed29b0b4SJens Axboe state->plug_started = true; 2246ed29b0b4SJens Axboe state->need_plug = false; 2247ed29b0b4SJens Axboe blk_start_plug_nr_ios(&state->plug, state->submit_nr); 2248ed29b0b4SJens Axboe } 2249ed29b0b4SJens Axboe } 2250ed29b0b4SJens Axboe 2251ed29b0b4SJens Axboe personality = READ_ONCE(sqe->personality); 2252ed29b0b4SJens Axboe if (personality) { 2253ed29b0b4SJens Axboe int ret; 2254ed29b0b4SJens Axboe 2255ed29b0b4SJens Axboe req->creds = xa_load(&ctx->personalities, personality); 2256ed29b0b4SJens Axboe if (!req->creds) 2257ed29b0b4SJens Axboe return -EINVAL; 2258ed29b0b4SJens Axboe get_cred(req->creds); 2259ed29b0b4SJens Axboe ret = security_uring_override_creds(req->creds); 2260ed29b0b4SJens Axboe if (ret) { 2261ed29b0b4SJens Axboe put_cred(req->creds); 2262ed29b0b4SJens Axboe return ret; 2263ed29b0b4SJens Axboe } 2264ed29b0b4SJens Axboe req->flags |= REQ_F_CREDS; 2265ed29b0b4SJens Axboe } 2266ed29b0b4SJens Axboe 2267ed29b0b4SJens Axboe return def->prep(req, sqe); 2268ed29b0b4SJens Axboe } 2269ed29b0b4SJens Axboe 2270ed29b0b4SJens Axboe static __cold int io_submit_fail_init(const struct io_uring_sqe *sqe, 2271ed29b0b4SJens Axboe struct io_kiocb *req, int ret) 2272ed29b0b4SJens Axboe { 2273ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 2274ed29b0b4SJens Axboe struct io_submit_link *link = &ctx->submit_state.link; 2275ed29b0b4SJens Axboe struct io_kiocb *head = link->head; 2276ed29b0b4SJens Axboe 227748863ffdSPavel Begunkov trace_io_uring_req_failed(sqe, req, ret); 2278ed29b0b4SJens Axboe 2279ed29b0b4SJens Axboe /* 2280ed29b0b4SJens Axboe * Avoid breaking links in the middle as it renders links with SQPOLL 2281ed29b0b4SJens Axboe * unusable. Instead of failing eagerly, continue assembling the link if 2282ed29b0b4SJens Axboe * applicable and mark the head with REQ_F_FAIL. The link flushing code 2283ed29b0b4SJens Axboe * should find the flag and handle the rest. 2284ed29b0b4SJens Axboe */ 2285ed29b0b4SJens Axboe req_fail_link_node(req, ret); 2286ed29b0b4SJens Axboe if (head && !(head->flags & REQ_F_FAIL)) 2287ed29b0b4SJens Axboe req_fail_link_node(head, -ECANCELED); 2288ed29b0b4SJens Axboe 2289ed29b0b4SJens Axboe if (!(req->flags & IO_REQ_LINK_FLAGS)) { 2290ed29b0b4SJens Axboe if (head) { 2291ed29b0b4SJens Axboe link->last->link = req; 2292ed29b0b4SJens Axboe link->head = NULL; 2293ed29b0b4SJens Axboe req = head; 2294ed29b0b4SJens Axboe } 2295ed29b0b4SJens Axboe io_queue_sqe_fallback(req); 2296ed29b0b4SJens Axboe return ret; 2297ed29b0b4SJens Axboe } 2298ed29b0b4SJens Axboe 2299ed29b0b4SJens Axboe if (head) 2300ed29b0b4SJens Axboe link->last->link = req; 2301ed29b0b4SJens Axboe else 2302ed29b0b4SJens Axboe link->head = req; 2303ed29b0b4SJens Axboe link->last = req; 2304ed29b0b4SJens Axboe return 0; 2305ed29b0b4SJens Axboe } 2306ed29b0b4SJens Axboe 2307ed29b0b4SJens Axboe static inline int io_submit_sqe(struct io_ring_ctx *ctx, struct io_kiocb *req, 2308ed29b0b4SJens Axboe const struct io_uring_sqe *sqe) 2309ed29b0b4SJens Axboe __must_hold(&ctx->uring_lock) 2310ed29b0b4SJens Axboe { 2311ed29b0b4SJens Axboe struct io_submit_link *link = &ctx->submit_state.link; 2312ed29b0b4SJens Axboe int ret; 2313ed29b0b4SJens Axboe 2314ed29b0b4SJens Axboe ret = io_init_req(ctx, req, sqe); 2315ed29b0b4SJens Axboe if (unlikely(ret)) 2316ed29b0b4SJens Axboe return io_submit_fail_init(sqe, req, ret); 2317ed29b0b4SJens Axboe 23182ad57931SJens Axboe trace_io_uring_submit_req(req); 2319ed29b0b4SJens Axboe 2320ed29b0b4SJens Axboe /* 2321ed29b0b4SJens Axboe * If we already have a head request, queue this one for async 2322ed29b0b4SJens Axboe * submittal once the head completes. If we don't have a head but 2323ed29b0b4SJens Axboe * IOSQE_IO_LINK is set in the sqe, start a new head. This one will be 2324ed29b0b4SJens Axboe * submitted sync once the chain is complete. If none of those 2325ed29b0b4SJens Axboe * conditions are true (normal request), then just queue it. 2326ed29b0b4SJens Axboe */ 2327ed29b0b4SJens Axboe if (unlikely(link->head)) { 2328ed29b0b4SJens Axboe ret = io_req_prep_async(req); 2329ed29b0b4SJens Axboe if (unlikely(ret)) 2330ed29b0b4SJens Axboe return io_submit_fail_init(sqe, req, ret); 2331ed29b0b4SJens Axboe 233248863ffdSPavel Begunkov trace_io_uring_link(req, link->head); 2333ed29b0b4SJens Axboe link->last->link = req; 2334ed29b0b4SJens Axboe link->last = req; 2335ed29b0b4SJens Axboe 2336ed29b0b4SJens Axboe if (req->flags & IO_REQ_LINK_FLAGS) 2337ed29b0b4SJens Axboe return 0; 2338ed29b0b4SJens Axboe /* last request of the link, flush it */ 2339ed29b0b4SJens Axboe req = link->head; 2340ed29b0b4SJens Axboe link->head = NULL; 2341ed29b0b4SJens Axboe if (req->flags & (REQ_F_FORCE_ASYNC | REQ_F_FAIL)) 2342ed29b0b4SJens Axboe goto fallback; 2343ed29b0b4SJens Axboe 2344ed29b0b4SJens Axboe } else if (unlikely(req->flags & (IO_REQ_LINK_FLAGS | 2345ed29b0b4SJens Axboe REQ_F_FORCE_ASYNC | REQ_F_FAIL))) { 2346ed29b0b4SJens Axboe if (req->flags & IO_REQ_LINK_FLAGS) { 2347ed29b0b4SJens Axboe link->head = req; 2348ed29b0b4SJens Axboe link->last = req; 2349ed29b0b4SJens Axboe } else { 2350ed29b0b4SJens Axboe fallback: 2351ed29b0b4SJens Axboe io_queue_sqe_fallback(req); 2352ed29b0b4SJens Axboe } 2353ed29b0b4SJens Axboe return 0; 2354ed29b0b4SJens Axboe } 2355ed29b0b4SJens Axboe 2356ed29b0b4SJens Axboe io_queue_sqe(req); 2357ed29b0b4SJens Axboe return 0; 2358ed29b0b4SJens Axboe } 2359ed29b0b4SJens Axboe 2360ed29b0b4SJens Axboe /* 2361ed29b0b4SJens Axboe * Batched submission is done, ensure local IO is flushed out. 2362ed29b0b4SJens Axboe */ 2363ed29b0b4SJens Axboe static void io_submit_state_end(struct io_ring_ctx *ctx) 2364ed29b0b4SJens Axboe { 2365ed29b0b4SJens Axboe struct io_submit_state *state = &ctx->submit_state; 2366ed29b0b4SJens Axboe 2367ed29b0b4SJens Axboe if (unlikely(state->link.head)) 2368ed29b0b4SJens Axboe io_queue_sqe_fallback(state->link.head); 2369ed29b0b4SJens Axboe /* flush only after queuing links as they can generate completions */ 2370ed29b0b4SJens Axboe io_submit_flush_completions(ctx); 2371ed29b0b4SJens Axboe if (state->plug_started) 2372ed29b0b4SJens Axboe blk_finish_plug(&state->plug); 2373ed29b0b4SJens Axboe } 2374ed29b0b4SJens Axboe 2375ed29b0b4SJens Axboe /* 2376ed29b0b4SJens Axboe * Start submission side cache. 2377ed29b0b4SJens Axboe */ 2378ed29b0b4SJens Axboe static void io_submit_state_start(struct io_submit_state *state, 2379ed29b0b4SJens Axboe unsigned int max_ios) 2380ed29b0b4SJens Axboe { 2381ed29b0b4SJens Axboe state->plug_started = false; 2382ed29b0b4SJens Axboe state->need_plug = max_ios > 2; 2383ed29b0b4SJens Axboe state->submit_nr = max_ios; 2384ed29b0b4SJens Axboe /* set only head, no need to init link_last in advance */ 2385ed29b0b4SJens Axboe state->link.head = NULL; 2386ed29b0b4SJens Axboe } 2387ed29b0b4SJens Axboe 2388ed29b0b4SJens Axboe static void io_commit_sqring(struct io_ring_ctx *ctx) 2389ed29b0b4SJens Axboe { 2390ed29b0b4SJens Axboe struct io_rings *rings = ctx->rings; 2391ed29b0b4SJens Axboe 2392ed29b0b4SJens Axboe /* 2393ed29b0b4SJens Axboe * Ensure any loads from the SQEs are done at this point, 2394ed29b0b4SJens Axboe * since once we write the new head, the application could 2395ed29b0b4SJens Axboe * write new data to them. 2396ed29b0b4SJens Axboe */ 2397ed29b0b4SJens Axboe smp_store_release(&rings->sq.head, ctx->cached_sq_head); 2398ed29b0b4SJens Axboe } 2399ed29b0b4SJens Axboe 2400ed29b0b4SJens Axboe /* 2401ed29b0b4SJens Axboe * Fetch an sqe, if one is available. Note this returns a pointer to memory 2402ed29b0b4SJens Axboe * that is mapped by userspace. This means that care needs to be taken to 2403ed29b0b4SJens Axboe * ensure that reads are stable, as we cannot rely on userspace always 2404ed29b0b4SJens Axboe * being a good citizen. If members of the sqe are validated and then later 2405ed29b0b4SJens Axboe * used, it's important that those reads are done through READ_ONCE() to 2406ed29b0b4SJens Axboe * prevent a re-load down the line. 2407ed29b0b4SJens Axboe */ 2408b5083dfaSPavel Begunkov static bool io_get_sqe(struct io_ring_ctx *ctx, const struct io_uring_sqe **sqe) 2409ed29b0b4SJens Axboe { 2410ed29b0b4SJens Axboe unsigned head, mask = ctx->sq_entries - 1; 2411ed29b0b4SJens Axboe unsigned sq_idx = ctx->cached_sq_head++ & mask; 2412ed29b0b4SJens Axboe 2413ed29b0b4SJens Axboe /* 2414ed29b0b4SJens Axboe * The cached sq head (or cq tail) serves two purposes: 2415ed29b0b4SJens Axboe * 2416ed29b0b4SJens Axboe * 1) allows us to batch the cost of updating the user visible 2417ed29b0b4SJens Axboe * head updates. 2418ed29b0b4SJens Axboe * 2) allows the kernel side to track the head on its own, even 2419ed29b0b4SJens Axboe * though the application is the one updating it. 2420ed29b0b4SJens Axboe */ 2421ed29b0b4SJens Axboe head = READ_ONCE(ctx->sq_array[sq_idx]); 2422ed29b0b4SJens Axboe if (likely(head < ctx->sq_entries)) { 2423ed29b0b4SJens Axboe /* double index for 128-byte SQEs, twice as long */ 2424ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_SQE128) 2425ed29b0b4SJens Axboe head <<= 1; 2426b5083dfaSPavel Begunkov *sqe = &ctx->sq_sqes[head]; 2427b5083dfaSPavel Begunkov return true; 2428ed29b0b4SJens Axboe } 2429ed29b0b4SJens Axboe 2430ed29b0b4SJens Axboe /* drop invalid entries */ 2431ed29b0b4SJens Axboe ctx->cq_extra--; 2432ed29b0b4SJens Axboe WRITE_ONCE(ctx->rings->sq_dropped, 2433ed29b0b4SJens Axboe READ_ONCE(ctx->rings->sq_dropped) + 1); 2434b5083dfaSPavel Begunkov return false; 2435ed29b0b4SJens Axboe } 2436ed29b0b4SJens Axboe 243717437f31SJens Axboe int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr) 2438ed29b0b4SJens Axboe __must_hold(&ctx->uring_lock) 2439ed29b0b4SJens Axboe { 2440ed29b0b4SJens Axboe unsigned int entries = io_sqring_entries(ctx); 2441ed29b0b4SJens Axboe unsigned int left; 2442ed29b0b4SJens Axboe int ret; 2443ed29b0b4SJens Axboe 2444ed29b0b4SJens Axboe if (unlikely(!entries)) 2445ed29b0b4SJens Axboe return 0; 2446ed29b0b4SJens Axboe /* make sure SQ entry isn't read before tail */ 2447e3ef728fSJens Axboe ret = left = min(nr, entries); 2448ed29b0b4SJens Axboe io_get_task_refs(left); 2449ed29b0b4SJens Axboe io_submit_state_start(&ctx->submit_state, left); 2450ed29b0b4SJens Axboe 2451ed29b0b4SJens Axboe do { 2452ed29b0b4SJens Axboe const struct io_uring_sqe *sqe; 2453ed29b0b4SJens Axboe struct io_kiocb *req; 2454ed29b0b4SJens Axboe 2455c8576f3eSPavel Begunkov if (unlikely(!io_alloc_req(ctx, &req))) 2456ed29b0b4SJens Axboe break; 2457b5083dfaSPavel Begunkov if (unlikely(!io_get_sqe(ctx, &sqe))) { 2458ed29b0b4SJens Axboe io_req_add_to_cache(req, ctx); 2459ed29b0b4SJens Axboe break; 2460ed29b0b4SJens Axboe } 2461ed29b0b4SJens Axboe 2462ed29b0b4SJens Axboe /* 2463ed29b0b4SJens Axboe * Continue submitting even for sqe failure if the 2464ed29b0b4SJens Axboe * ring was setup with IORING_SETUP_SUBMIT_ALL 2465ed29b0b4SJens Axboe */ 2466ed29b0b4SJens Axboe if (unlikely(io_submit_sqe(ctx, req, sqe)) && 2467ed29b0b4SJens Axboe !(ctx->flags & IORING_SETUP_SUBMIT_ALL)) { 2468ed29b0b4SJens Axboe left--; 2469ed29b0b4SJens Axboe break; 2470ed29b0b4SJens Axboe } 2471ed29b0b4SJens Axboe } while (--left); 2472ed29b0b4SJens Axboe 2473ed29b0b4SJens Axboe if (unlikely(left)) { 2474ed29b0b4SJens Axboe ret -= left; 2475ed29b0b4SJens Axboe /* try again if it submitted nothing and can't allocate a req */ 2476ed29b0b4SJens Axboe if (!ret && io_req_cache_empty(ctx)) 2477ed29b0b4SJens Axboe ret = -EAGAIN; 2478ed29b0b4SJens Axboe current->io_uring->cached_refs += left; 2479ed29b0b4SJens Axboe } 2480ed29b0b4SJens Axboe 2481ed29b0b4SJens Axboe io_submit_state_end(ctx); 2482ed29b0b4SJens Axboe /* Commit SQ ring head once we've consumed and submitted all SQEs */ 2483ed29b0b4SJens Axboe io_commit_sqring(ctx); 2484ed29b0b4SJens Axboe return ret; 2485ed29b0b4SJens Axboe } 2486ed29b0b4SJens Axboe 2487ed29b0b4SJens Axboe struct io_wait_queue { 2488ed29b0b4SJens Axboe struct wait_queue_entry wq; 2489ed29b0b4SJens Axboe struct io_ring_ctx *ctx; 2490ed29b0b4SJens Axboe unsigned cq_tail; 2491ed29b0b4SJens Axboe unsigned nr_timeouts; 2492d33a39e5SPavel Begunkov ktime_t timeout; 2493ed29b0b4SJens Axboe }; 2494ed29b0b4SJens Axboe 2495b4c98d59SDylan Yudaken static inline bool io_has_work(struct io_ring_ctx *ctx) 2496b4c98d59SDylan Yudaken { 2497c0e0d6baSDylan Yudaken return test_bit(IO_CHECK_CQ_OVERFLOW_BIT, &ctx->check_cq) || 2498490c00ebSPavel Begunkov !llist_empty(&ctx->work_llist); 2499b4c98d59SDylan Yudaken } 2500b4c98d59SDylan Yudaken 2501ed29b0b4SJens Axboe static inline bool io_should_wake(struct io_wait_queue *iowq) 2502ed29b0b4SJens Axboe { 2503ed29b0b4SJens Axboe struct io_ring_ctx *ctx = iowq->ctx; 25040fc8c2acSDylan Yudaken int dist = READ_ONCE(ctx->rings->cq.tail) - (int) iowq->cq_tail; 2505ed29b0b4SJens Axboe 2506ed29b0b4SJens Axboe /* 2507ed29b0b4SJens Axboe * Wake up if we have enough events, or if a timeout occurred since we 2508ed29b0b4SJens Axboe * started waiting. For timeouts, we always want to return to userspace, 2509ed29b0b4SJens Axboe * regardless of event count. 2510ed29b0b4SJens Axboe */ 2511ed29b0b4SJens Axboe return dist >= 0 || atomic_read(&ctx->cq_timeouts) != iowq->nr_timeouts; 2512ed29b0b4SJens Axboe } 2513ed29b0b4SJens Axboe 2514ed29b0b4SJens Axboe static int io_wake_function(struct wait_queue_entry *curr, unsigned int mode, 2515ed29b0b4SJens Axboe int wake_flags, void *key) 2516ed29b0b4SJens Axboe { 2517bd550173SPavel Begunkov struct io_wait_queue *iowq = container_of(curr, struct io_wait_queue, wq); 2518ed29b0b4SJens Axboe 2519ed29b0b4SJens Axboe /* 2520ed29b0b4SJens Axboe * Cannot safely flush overflowed CQEs from here, ensure we wake up 2521ed29b0b4SJens Axboe * the task, and the next invocation will do it. 2522ed29b0b4SJens Axboe */ 2523bd550173SPavel Begunkov if (io_should_wake(iowq) || io_has_work(iowq->ctx)) 2524ed29b0b4SJens Axboe return autoremove_wake_function(curr, mode, wake_flags, key); 2525ed29b0b4SJens Axboe return -1; 2526ed29b0b4SJens Axboe } 2527ed29b0b4SJens Axboe 2528c0e0d6baSDylan Yudaken int io_run_task_work_sig(struct io_ring_ctx *ctx) 2529ed29b0b4SJens Axboe { 25301414d629SPavel Begunkov if (!llist_empty(&ctx->work_llist)) { 25312f413956SPavel Begunkov __set_current_state(TASK_RUNNING); 25321414d629SPavel Begunkov if (io_run_local_work(ctx) > 0) 25331414d629SPavel Begunkov return 1; 25341414d629SPavel Begunkov } 25351414d629SPavel Begunkov if (io_run_task_work() > 0) 2536ed29b0b4SJens Axboe return 1; 2537ed29b0b4SJens Axboe if (task_sigpending(current)) 2538ed29b0b4SJens Axboe return -EINTR; 2539ed29b0b4SJens Axboe return 0; 2540ed29b0b4SJens Axboe } 2541ed29b0b4SJens Axboe 2542ed29b0b4SJens Axboe /* when returns >0, the caller should retry */ 2543ed29b0b4SJens Axboe static inline int io_cqring_wait_schedule(struct io_ring_ctx *ctx, 2544d33a39e5SPavel Begunkov struct io_wait_queue *iowq) 2545ed29b0b4SJens Axboe { 25463fcf19d5SPavel Begunkov if (unlikely(READ_ONCE(ctx->check_cq))) 25473fcf19d5SPavel Begunkov return 1; 2548846072f1SPavel Begunkov if (unlikely(!llist_empty(&ctx->work_llist))) 2549846072f1SPavel Begunkov return 1; 2550846072f1SPavel Begunkov if (unlikely(test_thread_flag(TIF_NOTIFY_SIGNAL))) 2551846072f1SPavel Begunkov return 1; 2552846072f1SPavel Begunkov if (unlikely(task_sigpending(current))) 2553846072f1SPavel Begunkov return -EINTR; 2554846072f1SPavel Begunkov if (unlikely(io_should_wake(iowq))) 2555846072f1SPavel Begunkov return 0; 2556d33a39e5SPavel Begunkov if (iowq->timeout == KTIME_MAX) 255746ae7eefSPavel Begunkov schedule(); 2558d33a39e5SPavel Begunkov else if (!schedule_hrtimeout(&iowq->timeout, HRTIMER_MODE_ABS)) 2559ed29b0b4SJens Axboe return -ETIME; 2560846072f1SPavel Begunkov return 0; 2561ed29b0b4SJens Axboe } 2562ed29b0b4SJens Axboe 2563ed29b0b4SJens Axboe /* 2564ed29b0b4SJens Axboe * Wait until events become available, if we don't already have some. The 2565ed29b0b4SJens Axboe * application must reap them itself, as they reside on the shared cq ring. 2566ed29b0b4SJens Axboe */ 2567ed29b0b4SJens Axboe static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events, 2568ed29b0b4SJens Axboe const sigset_t __user *sig, size_t sigsz, 2569ed29b0b4SJens Axboe struct __kernel_timespec __user *uts) 2570ed29b0b4SJens Axboe { 2571ed29b0b4SJens Axboe struct io_wait_queue iowq; 2572ed29b0b4SJens Axboe struct io_rings *rings = ctx->rings; 2573ed29b0b4SJens Axboe int ret; 2574ed29b0b4SJens Axboe 257576de6749SPavel Begunkov if (!io_allowed_run_tw(ctx)) 257676de6749SPavel Begunkov return -EEXIST; 2577140102aeSPavel Begunkov if (!llist_empty(&ctx->work_llist)) 2578140102aeSPavel Begunkov io_run_local_work(ctx); 2579f36ba6cfSPavel Begunkov io_run_task_work(); 2580ed29b0b4SJens Axboe io_cqring_overflow_flush(ctx); 25810fc8c2acSDylan Yudaken /* if user messes with these they will just get an early return */ 25820fc8c2acSDylan Yudaken if (__io_cqring_events_user(ctx) >= min_events) 2583ed29b0b4SJens Axboe return 0; 2584ed29b0b4SJens Axboe 2585ed29b0b4SJens Axboe if (sig) { 2586ed29b0b4SJens Axboe #ifdef CONFIG_COMPAT 2587ed29b0b4SJens Axboe if (in_compat_syscall()) 2588ed29b0b4SJens Axboe ret = set_compat_user_sigmask((const compat_sigset_t __user *)sig, 2589ed29b0b4SJens Axboe sigsz); 2590ed29b0b4SJens Axboe else 2591ed29b0b4SJens Axboe #endif 2592ed29b0b4SJens Axboe ret = set_user_sigmask(sig, sigsz); 2593ed29b0b4SJens Axboe 2594ed29b0b4SJens Axboe if (ret) 2595ed29b0b4SJens Axboe return ret; 2596ed29b0b4SJens Axboe } 2597ed29b0b4SJens Axboe 2598ed29b0b4SJens Axboe init_waitqueue_func_entry(&iowq.wq, io_wake_function); 2599ed29b0b4SJens Axboe iowq.wq.private = current; 2600ed29b0b4SJens Axboe INIT_LIST_HEAD(&iowq.wq.entry); 2601ed29b0b4SJens Axboe iowq.ctx = ctx; 2602ed29b0b4SJens Axboe iowq.nr_timeouts = atomic_read(&ctx->cq_timeouts); 2603ed29b0b4SJens Axboe iowq.cq_tail = READ_ONCE(ctx->rings->cq.head) + min_events; 2604d33a39e5SPavel Begunkov iowq.timeout = KTIME_MAX; 2605d33a39e5SPavel Begunkov 2606d33a39e5SPavel Begunkov if (uts) { 2607d33a39e5SPavel Begunkov struct timespec64 ts; 2608d33a39e5SPavel Begunkov 2609d33a39e5SPavel Begunkov if (get_timespec64(&ts, uts)) 2610d33a39e5SPavel Begunkov return -EFAULT; 2611d33a39e5SPavel Begunkov iowq.timeout = ktime_add_ns(timespec64_to_ktime(ts), ktime_get_ns()); 2612d33a39e5SPavel Begunkov } 2613ed29b0b4SJens Axboe 2614ed29b0b4SJens Axboe trace_io_uring_cqring_wait(ctx, min_events); 2615ed29b0b4SJens Axboe do { 26163fcf19d5SPavel Begunkov unsigned long check_cq; 26173fcf19d5SPavel Begunkov 2618130bd686SPavel Begunkov if (ctx->flags & IORING_SETUP_DEFER_TASKRUN) { 26198751d154SPavel Begunkov int nr_wait = (int) iowq.cq_tail - READ_ONCE(ctx->rings->cq.tail); 26208751d154SPavel Begunkov 26218751d154SPavel Begunkov atomic_set(&ctx->cq_wait_nr, nr_wait); 2622130bd686SPavel Begunkov set_current_state(TASK_INTERRUPTIBLE); 2623130bd686SPavel Begunkov } else { 2624ed29b0b4SJens Axboe prepare_to_wait_exclusive(&ctx->cq_wait, &iowq.wq, 2625ed29b0b4SJens Axboe TASK_INTERRUPTIBLE); 2626130bd686SPavel Begunkov } 2627130bd686SPavel Begunkov 2628d33a39e5SPavel Begunkov ret = io_cqring_wait_schedule(ctx, &iowq); 2629130bd686SPavel Begunkov __set_current_state(TASK_RUNNING); 26308751d154SPavel Begunkov atomic_set(&ctx->cq_wait_nr, 0); 2631d80c0f00SPavel Begunkov 2632846072f1SPavel Begunkov if (ret < 0) 2633846072f1SPavel Begunkov break; 2634846072f1SPavel Begunkov /* 2635846072f1SPavel Begunkov * Run task_work after scheduling and before io_should_wake(). 2636846072f1SPavel Begunkov * If we got woken because of task_work being processed, run it 2637846072f1SPavel Begunkov * now rather than let the caller do another wait loop. 2638846072f1SPavel Begunkov */ 2639846072f1SPavel Begunkov io_run_task_work(); 2640846072f1SPavel Begunkov if (!llist_empty(&ctx->work_llist)) 2641846072f1SPavel Begunkov io_run_local_work(ctx); 26423fcf19d5SPavel Begunkov 26433fcf19d5SPavel Begunkov check_cq = READ_ONCE(ctx->check_cq); 26443fcf19d5SPavel Begunkov if (unlikely(check_cq)) { 26453fcf19d5SPavel Begunkov /* let the caller flush overflows, retry */ 2646326a9e48SPavel Begunkov if (check_cq & BIT(IO_CHECK_CQ_OVERFLOW_BIT)) 26473fcf19d5SPavel Begunkov io_cqring_do_overflow_flush(ctx); 26483fcf19d5SPavel Begunkov if (check_cq & BIT(IO_CHECK_CQ_DROPPED_BIT)) { 26493fcf19d5SPavel Begunkov ret = -EBADR; 26503fcf19d5SPavel Begunkov break; 26513fcf19d5SPavel Begunkov } 26523fcf19d5SPavel Begunkov } 26533fcf19d5SPavel Begunkov 2654846072f1SPavel Begunkov if (io_should_wake(&iowq)) { 2655846072f1SPavel Begunkov ret = 0; 265635d90f95SJens Axboe break; 2657846072f1SPavel Begunkov } 2658ed29b0b4SJens Axboe cond_resched(); 2659846072f1SPavel Begunkov } while (1); 2660ed29b0b4SJens Axboe 2661130bd686SPavel Begunkov if (!(ctx->flags & IORING_SETUP_DEFER_TASKRUN)) 2662ed29b0b4SJens Axboe finish_wait(&ctx->cq_wait, &iowq.wq); 2663ed29b0b4SJens Axboe restore_saved_sigmask_unless(ret == -EINTR); 2664ed29b0b4SJens Axboe 2665ed29b0b4SJens Axboe return READ_ONCE(rings->cq.head) == READ_ONCE(rings->cq.tail) ? ret : 0; 2666ed29b0b4SJens Axboe } 2667ed29b0b4SJens Axboe 2668ed29b0b4SJens Axboe static void io_mem_free(void *ptr) 2669ed29b0b4SJens Axboe { 2670ed29b0b4SJens Axboe struct page *page; 2671ed29b0b4SJens Axboe 2672ed29b0b4SJens Axboe if (!ptr) 2673ed29b0b4SJens Axboe return; 2674ed29b0b4SJens Axboe 2675ed29b0b4SJens Axboe page = virt_to_head_page(ptr); 2676ed29b0b4SJens Axboe if (put_page_testzero(page)) 2677ed29b0b4SJens Axboe free_compound_page(page); 2678ed29b0b4SJens Axboe } 2679ed29b0b4SJens Axboe 268003d89a2dSJens Axboe static void io_pages_free(struct page ***pages, int npages) 268103d89a2dSJens Axboe { 268203d89a2dSJens Axboe struct page **page_array; 268303d89a2dSJens Axboe int i; 268403d89a2dSJens Axboe 268503d89a2dSJens Axboe if (!pages) 268603d89a2dSJens Axboe return; 268703d89a2dSJens Axboe page_array = *pages; 268803d89a2dSJens Axboe for (i = 0; i < npages; i++) 268903d89a2dSJens Axboe unpin_user_page(page_array[i]); 269003d89a2dSJens Axboe kvfree(page_array); 269103d89a2dSJens Axboe *pages = NULL; 269203d89a2dSJens Axboe } 269303d89a2dSJens Axboe 269403d89a2dSJens Axboe static void *__io_uaddr_map(struct page ***pages, unsigned short *npages, 269503d89a2dSJens Axboe unsigned long uaddr, size_t size) 269603d89a2dSJens Axboe { 269703d89a2dSJens Axboe struct page **page_array; 269803d89a2dSJens Axboe unsigned int nr_pages; 269903d89a2dSJens Axboe int ret; 270003d89a2dSJens Axboe 270103d89a2dSJens Axboe *npages = 0; 270203d89a2dSJens Axboe 270303d89a2dSJens Axboe if (uaddr & (PAGE_SIZE - 1) || !size) 270403d89a2dSJens Axboe return ERR_PTR(-EINVAL); 270503d89a2dSJens Axboe 270603d89a2dSJens Axboe nr_pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT; 270703d89a2dSJens Axboe if (nr_pages > USHRT_MAX) 270803d89a2dSJens Axboe return ERR_PTR(-EINVAL); 270903d89a2dSJens Axboe page_array = kvmalloc_array(nr_pages, sizeof(struct page *), GFP_KERNEL); 271003d89a2dSJens Axboe if (!page_array) 271103d89a2dSJens Axboe return ERR_PTR(-ENOMEM); 271203d89a2dSJens Axboe 271303d89a2dSJens Axboe ret = pin_user_pages_fast(uaddr, nr_pages, FOLL_WRITE | FOLL_LONGTERM, 271403d89a2dSJens Axboe page_array); 271503d89a2dSJens Axboe if (ret != nr_pages) { 271603d89a2dSJens Axboe err: 271703d89a2dSJens Axboe io_pages_free(&page_array, ret > 0 ? ret : 0); 271803d89a2dSJens Axboe return ret < 0 ? ERR_PTR(ret) : ERR_PTR(-EFAULT); 271903d89a2dSJens Axboe } 272003d89a2dSJens Axboe /* 272103d89a2dSJens Axboe * Should be a single page. If the ring is small enough that we can 272203d89a2dSJens Axboe * use a normal page, that is fine. If we need multiple pages, then 272303d89a2dSJens Axboe * userspace should use a huge page. That's the only way to guarantee 272403d89a2dSJens Axboe * that we get contigious memory, outside of just being lucky or 272503d89a2dSJens Axboe * (currently) having low memory fragmentation. 272603d89a2dSJens Axboe */ 272703d89a2dSJens Axboe if (page_array[0] != page_array[ret - 1]) 272803d89a2dSJens Axboe goto err; 272903d89a2dSJens Axboe *pages = page_array; 273003d89a2dSJens Axboe *npages = nr_pages; 273103d89a2dSJens Axboe return page_to_virt(page_array[0]); 273203d89a2dSJens Axboe } 273303d89a2dSJens Axboe 273403d89a2dSJens Axboe static void *io_rings_map(struct io_ring_ctx *ctx, unsigned long uaddr, 273503d89a2dSJens Axboe size_t size) 273603d89a2dSJens Axboe { 273703d89a2dSJens Axboe return __io_uaddr_map(&ctx->ring_pages, &ctx->n_ring_pages, uaddr, 273803d89a2dSJens Axboe size); 273903d89a2dSJens Axboe } 274003d89a2dSJens Axboe 274103d89a2dSJens Axboe static void *io_sqes_map(struct io_ring_ctx *ctx, unsigned long uaddr, 274203d89a2dSJens Axboe size_t size) 274303d89a2dSJens Axboe { 274403d89a2dSJens Axboe return __io_uaddr_map(&ctx->sqe_pages, &ctx->n_sqe_pages, uaddr, 274503d89a2dSJens Axboe size); 274603d89a2dSJens Axboe } 274703d89a2dSJens Axboe 27489c189eeeSJens Axboe static void io_rings_free(struct io_ring_ctx *ctx) 27499c189eeeSJens Axboe { 275003d89a2dSJens Axboe if (!(ctx->flags & IORING_SETUP_NO_MMAP)) { 27519c189eeeSJens Axboe io_mem_free(ctx->rings); 27529c189eeeSJens Axboe io_mem_free(ctx->sq_sqes); 27539c189eeeSJens Axboe ctx->rings = NULL; 27549c189eeeSJens Axboe ctx->sq_sqes = NULL; 275503d89a2dSJens Axboe } else { 275603d89a2dSJens Axboe io_pages_free(&ctx->ring_pages, ctx->n_ring_pages); 275703d89a2dSJens Axboe io_pages_free(&ctx->sqe_pages, ctx->n_sqe_pages); 275803d89a2dSJens Axboe } 27599c189eeeSJens Axboe } 27609c189eeeSJens Axboe 2761ed29b0b4SJens Axboe static void *io_mem_alloc(size_t size) 2762ed29b0b4SJens Axboe { 2763ed29b0b4SJens Axboe gfp_t gfp = GFP_KERNEL_ACCOUNT | __GFP_ZERO | __GFP_NOWARN | __GFP_COMP; 2764e27cef86SJens Axboe void *ret; 2765ed29b0b4SJens Axboe 2766e27cef86SJens Axboe ret = (void *) __get_free_pages(gfp, get_order(size)); 2767e27cef86SJens Axboe if (ret) 2768e27cef86SJens Axboe return ret; 2769e27cef86SJens Axboe return ERR_PTR(-ENOMEM); 2770ed29b0b4SJens Axboe } 2771ed29b0b4SJens Axboe 2772ed29b0b4SJens Axboe static unsigned long rings_size(struct io_ring_ctx *ctx, unsigned int sq_entries, 2773ed29b0b4SJens Axboe unsigned int cq_entries, size_t *sq_offset) 2774ed29b0b4SJens Axboe { 2775ed29b0b4SJens Axboe struct io_rings *rings; 2776ed29b0b4SJens Axboe size_t off, sq_array_size; 2777ed29b0b4SJens Axboe 2778ed29b0b4SJens Axboe off = struct_size(rings, cqes, cq_entries); 2779ed29b0b4SJens Axboe if (off == SIZE_MAX) 2780ed29b0b4SJens Axboe return SIZE_MAX; 2781ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_CQE32) { 2782ed29b0b4SJens Axboe if (check_shl_overflow(off, 1, &off)) 2783ed29b0b4SJens Axboe return SIZE_MAX; 2784ed29b0b4SJens Axboe } 2785ed29b0b4SJens Axboe 2786ed29b0b4SJens Axboe #ifdef CONFIG_SMP 2787ed29b0b4SJens Axboe off = ALIGN(off, SMP_CACHE_BYTES); 2788ed29b0b4SJens Axboe if (off == 0) 2789ed29b0b4SJens Axboe return SIZE_MAX; 2790ed29b0b4SJens Axboe #endif 2791ed29b0b4SJens Axboe 2792ed29b0b4SJens Axboe if (sq_offset) 2793ed29b0b4SJens Axboe *sq_offset = off; 2794ed29b0b4SJens Axboe 2795ed29b0b4SJens Axboe sq_array_size = array_size(sizeof(u32), sq_entries); 2796ed29b0b4SJens Axboe if (sq_array_size == SIZE_MAX) 2797ed29b0b4SJens Axboe return SIZE_MAX; 2798ed29b0b4SJens Axboe 2799ed29b0b4SJens Axboe if (check_add_overflow(off, sq_array_size, &off)) 2800ed29b0b4SJens Axboe return SIZE_MAX; 2801ed29b0b4SJens Axboe 2802ed29b0b4SJens Axboe return off; 2803ed29b0b4SJens Axboe } 2804ed29b0b4SJens Axboe 2805ed29b0b4SJens Axboe static int io_eventfd_register(struct io_ring_ctx *ctx, void __user *arg, 2806ed29b0b4SJens Axboe unsigned int eventfd_async) 2807ed29b0b4SJens Axboe { 2808ed29b0b4SJens Axboe struct io_ev_fd *ev_fd; 2809ed29b0b4SJens Axboe __s32 __user *fds = arg; 2810ed29b0b4SJens Axboe int fd; 2811ed29b0b4SJens Axboe 2812ed29b0b4SJens Axboe ev_fd = rcu_dereference_protected(ctx->io_ev_fd, 2813ed29b0b4SJens Axboe lockdep_is_held(&ctx->uring_lock)); 2814ed29b0b4SJens Axboe if (ev_fd) 2815ed29b0b4SJens Axboe return -EBUSY; 2816ed29b0b4SJens Axboe 2817ed29b0b4SJens Axboe if (copy_from_user(&fd, fds, sizeof(*fds))) 2818ed29b0b4SJens Axboe return -EFAULT; 2819ed29b0b4SJens Axboe 2820ed29b0b4SJens Axboe ev_fd = kmalloc(sizeof(*ev_fd), GFP_KERNEL); 2821ed29b0b4SJens Axboe if (!ev_fd) 2822ed29b0b4SJens Axboe return -ENOMEM; 2823ed29b0b4SJens Axboe 2824ed29b0b4SJens Axboe ev_fd->cq_ev_fd = eventfd_ctx_fdget(fd); 2825ed29b0b4SJens Axboe if (IS_ERR(ev_fd->cq_ev_fd)) { 2826ed29b0b4SJens Axboe int ret = PTR_ERR(ev_fd->cq_ev_fd); 2827ed29b0b4SJens Axboe kfree(ev_fd); 2828ed29b0b4SJens Axboe return ret; 2829ed29b0b4SJens Axboe } 2830305bef98SPavel Begunkov 2831305bef98SPavel Begunkov spin_lock(&ctx->completion_lock); 2832305bef98SPavel Begunkov ctx->evfd_last_cq_tail = ctx->cached_cq_tail; 2833305bef98SPavel Begunkov spin_unlock(&ctx->completion_lock); 2834305bef98SPavel Begunkov 2835ed29b0b4SJens Axboe ev_fd->eventfd_async = eventfd_async; 2836ed29b0b4SJens Axboe ctx->has_evfd = true; 2837ed29b0b4SJens Axboe rcu_assign_pointer(ctx->io_ev_fd, ev_fd); 283821a091b9SDylan Yudaken atomic_set(&ev_fd->refs, 1); 283921a091b9SDylan Yudaken atomic_set(&ev_fd->ops, 0); 2840ed29b0b4SJens Axboe return 0; 2841ed29b0b4SJens Axboe } 2842ed29b0b4SJens Axboe 2843ed29b0b4SJens Axboe static int io_eventfd_unregister(struct io_ring_ctx *ctx) 2844ed29b0b4SJens Axboe { 2845ed29b0b4SJens Axboe struct io_ev_fd *ev_fd; 2846ed29b0b4SJens Axboe 2847ed29b0b4SJens Axboe ev_fd = rcu_dereference_protected(ctx->io_ev_fd, 2848ed29b0b4SJens Axboe lockdep_is_held(&ctx->uring_lock)); 2849ed29b0b4SJens Axboe if (ev_fd) { 2850ed29b0b4SJens Axboe ctx->has_evfd = false; 2851ed29b0b4SJens Axboe rcu_assign_pointer(ctx->io_ev_fd, NULL); 285221a091b9SDylan Yudaken if (!atomic_fetch_or(BIT(IO_EVENTFD_OP_FREE_BIT), &ev_fd->ops)) 285321a091b9SDylan Yudaken call_rcu(&ev_fd->rcu, io_eventfd_ops); 2854ed29b0b4SJens Axboe return 0; 2855ed29b0b4SJens Axboe } 2856ed29b0b4SJens Axboe 2857ed29b0b4SJens Axboe return -ENXIO; 2858ed29b0b4SJens Axboe } 2859ed29b0b4SJens Axboe 2860ed29b0b4SJens Axboe static void io_req_caches_free(struct io_ring_ctx *ctx) 2861ed29b0b4SJens Axboe { 2862c8576f3eSPavel Begunkov struct io_kiocb *req; 2863ed29b0b4SJens Axboe int nr = 0; 2864ed29b0b4SJens Axboe 2865ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 286634f0bc42SPavel Begunkov io_flush_cached_locked_reqs(ctx, &ctx->submit_state); 2867ed29b0b4SJens Axboe 2868ed29b0b4SJens Axboe while (!io_req_cache_empty(ctx)) { 2869c8576f3eSPavel Begunkov req = io_extract_req(ctx); 2870ed29b0b4SJens Axboe kmem_cache_free(req_cachep, req); 2871ed29b0b4SJens Axboe nr++; 2872ed29b0b4SJens Axboe } 2873ed29b0b4SJens Axboe if (nr) 2874ed29b0b4SJens Axboe percpu_ref_put_many(&ctx->refs, nr); 2875ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 2876ed29b0b4SJens Axboe } 2877ed29b0b4SJens Axboe 28789eae8655SPavel Begunkov static void io_rsrc_node_cache_free(struct io_cache_entry *entry) 28799eae8655SPavel Begunkov { 28809eae8655SPavel Begunkov kfree(container_of(entry, struct io_rsrc_node, cache)); 28819eae8655SPavel Begunkov } 28829eae8655SPavel Begunkov 2883ed29b0b4SJens Axboe static __cold void io_ring_ctx_free(struct io_ring_ctx *ctx) 2884ed29b0b4SJens Axboe { 2885ed29b0b4SJens Axboe io_sq_thread_finish(ctx); 2886ed29b0b4SJens Axboe /* __io_rsrc_put_work() may need uring_lock to progress, wait w/o it */ 28870b222eebSPavel Begunkov if (WARN_ON_ONCE(!list_empty(&ctx->rsrc_ref_list))) 28880b222eebSPavel Begunkov return; 2889ed29b0b4SJens Axboe 2890ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 2891ed29b0b4SJens Axboe if (ctx->buf_data) 2892ed29b0b4SJens Axboe __io_sqe_buffers_unregister(ctx); 2893ed29b0b4SJens Axboe if (ctx->file_data) 2894ed29b0b4SJens Axboe __io_sqe_files_unregister(ctx); 2895a85381d8SPavel Begunkov io_cqring_overflow_kill(ctx); 2896ed29b0b4SJens Axboe io_eventfd_unregister(ctx); 28979b797a37SJens Axboe io_alloc_cache_free(&ctx->apoll_cache, io_apoll_cache_free); 289843e0bbbdSJens Axboe io_alloc_cache_free(&ctx->netmsg_cache, io_netmsg_cache_free); 2899ed29b0b4SJens Axboe io_destroy_buffers(ctx); 2900b4a72c05SWojciech Lukowicz mutex_unlock(&ctx->uring_lock); 2901ed29b0b4SJens Axboe if (ctx->sq_creds) 2902ed29b0b4SJens Axboe put_cred(ctx->sq_creds); 290397bbdc06SPavel Begunkov if (ctx->submitter_task) 290497bbdc06SPavel Begunkov put_task_struct(ctx->submitter_task); 2905ed29b0b4SJens Axboe 2906ed29b0b4SJens Axboe /* there are no registered resources left, nobody uses it */ 2907ed29b0b4SJens Axboe if (ctx->rsrc_node) 29089eae8655SPavel Begunkov io_rsrc_node_destroy(ctx, ctx->rsrc_node); 2909ed29b0b4SJens Axboe 2910ed29b0b4SJens Axboe WARN_ON_ONCE(!list_empty(&ctx->rsrc_ref_list)); 2911ed29b0b4SJens Axboe 2912ed29b0b4SJens Axboe #if defined(CONFIG_UNIX) 2913ed29b0b4SJens Axboe if (ctx->ring_sock) { 2914ed29b0b4SJens Axboe ctx->ring_sock->file = NULL; /* so that iput() is called */ 2915ed29b0b4SJens Axboe sock_release(ctx->ring_sock); 2916ed29b0b4SJens Axboe } 2917ed29b0b4SJens Axboe #endif 2918ed29b0b4SJens Axboe WARN_ON_ONCE(!list_empty(&ctx->ltimeout_list)); 2919ed29b0b4SJens Axboe 29209eae8655SPavel Begunkov io_alloc_cache_free(&ctx->rsrc_node_cache, io_rsrc_node_cache_free); 292142b6419dSPavel Begunkov if (ctx->mm_account) { 292242b6419dSPavel Begunkov mmdrop(ctx->mm_account); 292342b6419dSPavel Begunkov ctx->mm_account = NULL; 292442b6419dSPavel Begunkov } 29259c189eeeSJens Axboe io_rings_free(ctx); 2926ed29b0b4SJens Axboe 2927ed29b0b4SJens Axboe percpu_ref_exit(&ctx->refs); 2928ed29b0b4SJens Axboe free_uid(ctx->user); 2929ed29b0b4SJens Axboe io_req_caches_free(ctx); 2930ed29b0b4SJens Axboe if (ctx->hash_map) 2931ed29b0b4SJens Axboe io_wq_put_hash(ctx->hash_map); 2932e6f89be6SPavel Begunkov kfree(ctx->cancel_table.hbs); 29339ca9fb24SPavel Begunkov kfree(ctx->cancel_table_locked.hbs); 2934ed29b0b4SJens Axboe kfree(ctx->dummy_ubuf); 2935ed29b0b4SJens Axboe kfree(ctx->io_bl); 2936ed29b0b4SJens Axboe xa_destroy(&ctx->io_bl_xa); 2937ed29b0b4SJens Axboe kfree(ctx); 2938ed29b0b4SJens Axboe } 2939ed29b0b4SJens Axboe 2940bca39f39SPavel Begunkov static __cold void io_activate_pollwq_cb(struct callback_head *cb) 2941bca39f39SPavel Begunkov { 2942bca39f39SPavel Begunkov struct io_ring_ctx *ctx = container_of(cb, struct io_ring_ctx, 2943bca39f39SPavel Begunkov poll_wq_task_work); 2944bca39f39SPavel Begunkov 2945bca39f39SPavel Begunkov mutex_lock(&ctx->uring_lock); 2946bca39f39SPavel Begunkov ctx->poll_activated = true; 2947bca39f39SPavel Begunkov mutex_unlock(&ctx->uring_lock); 2948bca39f39SPavel Begunkov 2949bca39f39SPavel Begunkov /* 2950bca39f39SPavel Begunkov * Wake ups for some events between start of polling and activation 2951bca39f39SPavel Begunkov * might've been lost due to loose synchronisation. 2952bca39f39SPavel Begunkov */ 2953bca39f39SPavel Begunkov wake_up_all(&ctx->poll_wq); 2954bca39f39SPavel Begunkov percpu_ref_put(&ctx->refs); 2955bca39f39SPavel Begunkov } 2956bca39f39SPavel Begunkov 2957bca39f39SPavel Begunkov static __cold void io_activate_pollwq(struct io_ring_ctx *ctx) 2958bca39f39SPavel Begunkov { 2959bca39f39SPavel Begunkov spin_lock(&ctx->completion_lock); 2960bca39f39SPavel Begunkov /* already activated or in progress */ 2961bca39f39SPavel Begunkov if (ctx->poll_activated || ctx->poll_wq_task_work.func) 2962bca39f39SPavel Begunkov goto out; 2963bca39f39SPavel Begunkov if (WARN_ON_ONCE(!ctx->task_complete)) 2964bca39f39SPavel Begunkov goto out; 2965bca39f39SPavel Begunkov if (!ctx->submitter_task) 2966bca39f39SPavel Begunkov goto out; 2967bca39f39SPavel Begunkov /* 2968bca39f39SPavel Begunkov * with ->submitter_task only the submitter task completes requests, we 2969bca39f39SPavel Begunkov * only need to sync with it, which is done by injecting a tw 2970bca39f39SPavel Begunkov */ 2971bca39f39SPavel Begunkov init_task_work(&ctx->poll_wq_task_work, io_activate_pollwq_cb); 2972bca39f39SPavel Begunkov percpu_ref_get(&ctx->refs); 2973bca39f39SPavel Begunkov if (task_work_add(ctx->submitter_task, &ctx->poll_wq_task_work, TWA_SIGNAL)) 2974bca39f39SPavel Begunkov percpu_ref_put(&ctx->refs); 2975bca39f39SPavel Begunkov out: 2976bca39f39SPavel Begunkov spin_unlock(&ctx->completion_lock); 2977bca39f39SPavel Begunkov } 2978bca39f39SPavel Begunkov 2979ed29b0b4SJens Axboe static __poll_t io_uring_poll(struct file *file, poll_table *wait) 2980ed29b0b4SJens Axboe { 2981ed29b0b4SJens Axboe struct io_ring_ctx *ctx = file->private_data; 2982ed29b0b4SJens Axboe __poll_t mask = 0; 2983ed29b0b4SJens Axboe 2984bca39f39SPavel Begunkov if (unlikely(!ctx->poll_activated)) 2985bca39f39SPavel Begunkov io_activate_pollwq(ctx); 2986bca39f39SPavel Begunkov 29877b235dd8SPavel Begunkov poll_wait(file, &ctx->poll_wq, wait); 2988ed29b0b4SJens Axboe /* 2989ed29b0b4SJens Axboe * synchronizes with barrier from wq_has_sleeper call in 2990ed29b0b4SJens Axboe * io_commit_cqring 2991ed29b0b4SJens Axboe */ 2992ed29b0b4SJens Axboe smp_rmb(); 2993ed29b0b4SJens Axboe if (!io_sqring_full(ctx)) 2994ed29b0b4SJens Axboe mask |= EPOLLOUT | EPOLLWRNORM; 2995ed29b0b4SJens Axboe 2996ed29b0b4SJens Axboe /* 2997ed29b0b4SJens Axboe * Don't flush cqring overflow list here, just do a simple check. 2998ed29b0b4SJens Axboe * Otherwise there could possible be ABBA deadlock: 2999ed29b0b4SJens Axboe * CPU0 CPU1 3000ed29b0b4SJens Axboe * ---- ---- 3001ed29b0b4SJens Axboe * lock(&ctx->uring_lock); 3002ed29b0b4SJens Axboe * lock(&ep->mtx); 3003ed29b0b4SJens Axboe * lock(&ctx->uring_lock); 3004ed29b0b4SJens Axboe * lock(&ep->mtx); 3005ed29b0b4SJens Axboe * 3006ed29b0b4SJens Axboe * Users may get EPOLLIN meanwhile seeing nothing in cqring, this 300710d8bc35SDylan Yudaken * pushes them to do the flush. 3008ed29b0b4SJens Axboe */ 3009b4c98d59SDylan Yudaken 3010c10bb646SPavel Begunkov if (__io_cqring_events_user(ctx) || io_has_work(ctx)) 3011ed29b0b4SJens Axboe mask |= EPOLLIN | EPOLLRDNORM; 3012ed29b0b4SJens Axboe 3013ed29b0b4SJens Axboe return mask; 3014ed29b0b4SJens Axboe } 3015ed29b0b4SJens Axboe 3016ed29b0b4SJens Axboe static int io_unregister_personality(struct io_ring_ctx *ctx, unsigned id) 3017ed29b0b4SJens Axboe { 3018ed29b0b4SJens Axboe const struct cred *creds; 3019ed29b0b4SJens Axboe 3020ed29b0b4SJens Axboe creds = xa_erase(&ctx->personalities, id); 3021ed29b0b4SJens Axboe if (creds) { 3022ed29b0b4SJens Axboe put_cred(creds); 3023ed29b0b4SJens Axboe return 0; 3024ed29b0b4SJens Axboe } 3025ed29b0b4SJens Axboe 3026ed29b0b4SJens Axboe return -EINVAL; 3027ed29b0b4SJens Axboe } 3028ed29b0b4SJens Axboe 3029ed29b0b4SJens Axboe struct io_tctx_exit { 3030ed29b0b4SJens Axboe struct callback_head task_work; 3031ed29b0b4SJens Axboe struct completion completion; 3032ed29b0b4SJens Axboe struct io_ring_ctx *ctx; 3033ed29b0b4SJens Axboe }; 3034ed29b0b4SJens Axboe 3035ed29b0b4SJens Axboe static __cold void io_tctx_exit_cb(struct callback_head *cb) 3036ed29b0b4SJens Axboe { 3037ed29b0b4SJens Axboe struct io_uring_task *tctx = current->io_uring; 3038ed29b0b4SJens Axboe struct io_tctx_exit *work; 3039ed29b0b4SJens Axboe 3040ed29b0b4SJens Axboe work = container_of(cb, struct io_tctx_exit, task_work); 3041ed29b0b4SJens Axboe /* 30428d664282SJens Axboe * When @in_cancel, we're in cancellation and it's racy to remove the 3043ed29b0b4SJens Axboe * node. It'll be removed by the end of cancellation, just ignore it. 3044998b30c3SHarshit Mogalapalli * tctx can be NULL if the queueing of this task_work raced with 3045998b30c3SHarshit Mogalapalli * work cancelation off the exec path. 3046ed29b0b4SJens Axboe */ 30478d664282SJens Axboe if (tctx && !atomic_read(&tctx->in_cancel)) 3048ed29b0b4SJens Axboe io_uring_del_tctx_node((unsigned long)work->ctx); 3049ed29b0b4SJens Axboe complete(&work->completion); 3050ed29b0b4SJens Axboe } 3051ed29b0b4SJens Axboe 3052ed29b0b4SJens Axboe static __cold bool io_cancel_ctx_cb(struct io_wq_work *work, void *data) 3053ed29b0b4SJens Axboe { 3054ed29b0b4SJens Axboe struct io_kiocb *req = container_of(work, struct io_kiocb, work); 3055ed29b0b4SJens Axboe 3056ed29b0b4SJens Axboe return req->ctx == data; 3057ed29b0b4SJens Axboe } 3058ed29b0b4SJens Axboe 3059ed29b0b4SJens Axboe static __cold void io_ring_exit_work(struct work_struct *work) 3060ed29b0b4SJens Axboe { 3061ed29b0b4SJens Axboe struct io_ring_ctx *ctx = container_of(work, struct io_ring_ctx, exit_work); 3062ed29b0b4SJens Axboe unsigned long timeout = jiffies + HZ * 60 * 5; 3063ed29b0b4SJens Axboe unsigned long interval = HZ / 20; 3064ed29b0b4SJens Axboe struct io_tctx_exit exit; 3065ed29b0b4SJens Axboe struct io_tctx_node *node; 3066ed29b0b4SJens Axboe int ret; 3067ed29b0b4SJens Axboe 3068ed29b0b4SJens Axboe /* 3069ed29b0b4SJens Axboe * If we're doing polled IO and end up having requests being 3070ed29b0b4SJens Axboe * submitted async (out-of-line), then completions can come in while 3071ed29b0b4SJens Axboe * we're waiting for refs to drop. We need to reap these manually, 3072ed29b0b4SJens Axboe * as nobody else will be looking for them. 3073ed29b0b4SJens Axboe */ 3074ed29b0b4SJens Axboe do { 3075a85381d8SPavel Begunkov if (test_bit(IO_CHECK_CQ_OVERFLOW_BIT, &ctx->check_cq)) { 3076a85381d8SPavel Begunkov mutex_lock(&ctx->uring_lock); 3077a85381d8SPavel Begunkov io_cqring_overflow_kill(ctx); 3078a85381d8SPavel Begunkov mutex_unlock(&ctx->uring_lock); 3079a85381d8SPavel Begunkov } 3080a85381d8SPavel Begunkov 3081c0e0d6baSDylan Yudaken if (ctx->flags & IORING_SETUP_DEFER_TASKRUN) 3082c0e0d6baSDylan Yudaken io_move_task_work_from_local(ctx); 3083c0e0d6baSDylan Yudaken 3084affa87dbSPavel Begunkov while (io_uring_try_cancel_requests(ctx, NULL, true)) 3085affa87dbSPavel Begunkov cond_resched(); 3086affa87dbSPavel Begunkov 3087ed29b0b4SJens Axboe if (ctx->sq_data) { 3088ed29b0b4SJens Axboe struct io_sq_data *sqd = ctx->sq_data; 3089ed29b0b4SJens Axboe struct task_struct *tsk; 3090ed29b0b4SJens Axboe 3091ed29b0b4SJens Axboe io_sq_thread_park(sqd); 3092ed29b0b4SJens Axboe tsk = sqd->thread; 3093ed29b0b4SJens Axboe if (tsk && tsk->io_uring && tsk->io_uring->io_wq) 3094ed29b0b4SJens Axboe io_wq_cancel_cb(tsk->io_uring->io_wq, 3095ed29b0b4SJens Axboe io_cancel_ctx_cb, ctx, true); 3096ed29b0b4SJens Axboe io_sq_thread_unpark(sqd); 3097ed29b0b4SJens Axboe } 3098ed29b0b4SJens Axboe 3099ed29b0b4SJens Axboe io_req_caches_free(ctx); 3100ed29b0b4SJens Axboe 3101ed29b0b4SJens Axboe if (WARN_ON_ONCE(time_after(jiffies, timeout))) { 3102ed29b0b4SJens Axboe /* there is little hope left, don't run it too often */ 3103ed29b0b4SJens Axboe interval = HZ * 60; 3104ed29b0b4SJens Axboe } 31054826c594SJens Axboe /* 31064826c594SJens Axboe * This is really an uninterruptible wait, as it has to be 31074826c594SJens Axboe * complete. But it's also run from a kworker, which doesn't 31084826c594SJens Axboe * take signals, so it's fine to make it interruptible. This 31094826c594SJens Axboe * avoids scenarios where we knowingly can wait much longer 31104826c594SJens Axboe * on completions, for example if someone does a SIGSTOP on 31114826c594SJens Axboe * a task that needs to finish task_work to make this loop 31124826c594SJens Axboe * complete. That's a synthetic situation that should not 31134826c594SJens Axboe * cause a stuck task backtrace, and hence a potential panic 31144826c594SJens Axboe * on stuck tasks if that is enabled. 31154826c594SJens Axboe */ 31164826c594SJens Axboe } while (!wait_for_completion_interruptible_timeout(&ctx->ref_comp, interval)); 3117ed29b0b4SJens Axboe 3118ed29b0b4SJens Axboe init_completion(&exit.completion); 3119ed29b0b4SJens Axboe init_task_work(&exit.task_work, io_tctx_exit_cb); 3120ed29b0b4SJens Axboe exit.ctx = ctx; 3121ed29b0b4SJens Axboe /* 3122ed29b0b4SJens Axboe * Some may use context even when all refs and requests have been put, 3123ed29b0b4SJens Axboe * and they are free to do so while still holding uring_lock or 3124ed29b0b4SJens Axboe * completion_lock, see io_req_task_submit(). Apart from other work, 3125ed29b0b4SJens Axboe * this lock/unlock section also waits them to finish. 3126ed29b0b4SJens Axboe */ 3127ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 3128ed29b0b4SJens Axboe while (!list_empty(&ctx->tctx_list)) { 3129ed29b0b4SJens Axboe WARN_ON_ONCE(time_after(jiffies, timeout)); 3130ed29b0b4SJens Axboe 3131ed29b0b4SJens Axboe node = list_first_entry(&ctx->tctx_list, struct io_tctx_node, 3132ed29b0b4SJens Axboe ctx_node); 3133ed29b0b4SJens Axboe /* don't spin on a single task if cancellation failed */ 3134ed29b0b4SJens Axboe list_rotate_left(&ctx->tctx_list); 3135ed29b0b4SJens Axboe ret = task_work_add(node->task, &exit.task_work, TWA_SIGNAL); 3136ed29b0b4SJens Axboe if (WARN_ON_ONCE(ret)) 3137ed29b0b4SJens Axboe continue; 3138ed29b0b4SJens Axboe 3139ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 31404826c594SJens Axboe /* 31414826c594SJens Axboe * See comment above for 31424826c594SJens Axboe * wait_for_completion_interruptible_timeout() on why this 31434826c594SJens Axboe * wait is marked as interruptible. 31444826c594SJens Axboe */ 31454826c594SJens Axboe wait_for_completion_interruptible(&exit.completion); 3146ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 3147ed29b0b4SJens Axboe } 3148ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 3149ed29b0b4SJens Axboe spin_lock(&ctx->completion_lock); 3150ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 3151ed29b0b4SJens Axboe 3152d73a572dSPavel Begunkov /* pairs with RCU read section in io_req_local_work_add() */ 3153d73a572dSPavel Begunkov if (ctx->flags & IORING_SETUP_DEFER_TASKRUN) 3154d73a572dSPavel Begunkov synchronize_rcu(); 3155d73a572dSPavel Begunkov 3156ed29b0b4SJens Axboe io_ring_ctx_free(ctx); 3157ed29b0b4SJens Axboe } 3158ed29b0b4SJens Axboe 3159ed29b0b4SJens Axboe static __cold void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx) 3160ed29b0b4SJens Axboe { 3161ed29b0b4SJens Axboe unsigned long index; 3162ed29b0b4SJens Axboe struct creds *creds; 3163ed29b0b4SJens Axboe 3164ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 3165ed29b0b4SJens Axboe percpu_ref_kill(&ctx->refs); 3166ed29b0b4SJens Axboe xa_for_each(&ctx->personalities, index, creds) 3167ed29b0b4SJens Axboe io_unregister_personality(ctx, index); 31689ca9fb24SPavel Begunkov if (ctx->rings) 31699ca9fb24SPavel Begunkov io_poll_remove_all(ctx, NULL, true); 3170ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 3171ed29b0b4SJens Axboe 317202bac94bSPavel Begunkov /* 317302bac94bSPavel Begunkov * If we failed setting up the ctx, we might not have any rings 317402bac94bSPavel Begunkov * and therefore did not submit any requests 317502bac94bSPavel Begunkov */ 317602bac94bSPavel Begunkov if (ctx->rings) 3177ed29b0b4SJens Axboe io_kill_timeouts(ctx, NULL, true); 3178ed29b0b4SJens Axboe 3179ed29b0b4SJens Axboe INIT_WORK(&ctx->exit_work, io_ring_exit_work); 3180ed29b0b4SJens Axboe /* 3181ed29b0b4SJens Axboe * Use system_unbound_wq to avoid spawning tons of event kworkers 3182ed29b0b4SJens Axboe * if we're exiting a ton of rings at the same time. It just adds 3183ed29b0b4SJens Axboe * noise and overhead, there's no discernable change in runtime 3184ed29b0b4SJens Axboe * over using system_wq. 3185ed29b0b4SJens Axboe */ 3186ed29b0b4SJens Axboe queue_work(system_unbound_wq, &ctx->exit_work); 3187ed29b0b4SJens Axboe } 3188ed29b0b4SJens Axboe 3189ed29b0b4SJens Axboe static int io_uring_release(struct inode *inode, struct file *file) 3190ed29b0b4SJens Axboe { 3191ed29b0b4SJens Axboe struct io_ring_ctx *ctx = file->private_data; 3192ed29b0b4SJens Axboe 3193ed29b0b4SJens Axboe file->private_data = NULL; 3194ed29b0b4SJens Axboe io_ring_ctx_wait_and_kill(ctx); 3195ed29b0b4SJens Axboe return 0; 3196ed29b0b4SJens Axboe } 3197ed29b0b4SJens Axboe 3198ed29b0b4SJens Axboe struct io_task_cancel { 3199ed29b0b4SJens Axboe struct task_struct *task; 3200ed29b0b4SJens Axboe bool all; 3201ed29b0b4SJens Axboe }; 3202ed29b0b4SJens Axboe 3203ed29b0b4SJens Axboe static bool io_cancel_task_cb(struct io_wq_work *work, void *data) 3204ed29b0b4SJens Axboe { 3205ed29b0b4SJens Axboe struct io_kiocb *req = container_of(work, struct io_kiocb, work); 3206ed29b0b4SJens Axboe struct io_task_cancel *cancel = data; 3207ed29b0b4SJens Axboe 3208ed29b0b4SJens Axboe return io_match_task_safe(req, cancel->task, cancel->all); 3209ed29b0b4SJens Axboe } 3210ed29b0b4SJens Axboe 3211ed29b0b4SJens Axboe static __cold bool io_cancel_defer_files(struct io_ring_ctx *ctx, 3212ed29b0b4SJens Axboe struct task_struct *task, 3213ed29b0b4SJens Axboe bool cancel_all) 3214ed29b0b4SJens Axboe { 3215ed29b0b4SJens Axboe struct io_defer_entry *de; 3216ed29b0b4SJens Axboe LIST_HEAD(list); 3217ed29b0b4SJens Axboe 3218ed29b0b4SJens Axboe spin_lock(&ctx->completion_lock); 3219ed29b0b4SJens Axboe list_for_each_entry_reverse(de, &ctx->defer_list, list) { 3220ed29b0b4SJens Axboe if (io_match_task_safe(de->req, task, cancel_all)) { 3221ed29b0b4SJens Axboe list_cut_position(&list, &ctx->defer_list, &de->list); 3222ed29b0b4SJens Axboe break; 3223ed29b0b4SJens Axboe } 3224ed29b0b4SJens Axboe } 3225ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 3226ed29b0b4SJens Axboe if (list_empty(&list)) 3227ed29b0b4SJens Axboe return false; 3228ed29b0b4SJens Axboe 3229ed29b0b4SJens Axboe while (!list_empty(&list)) { 3230ed29b0b4SJens Axboe de = list_first_entry(&list, struct io_defer_entry, list); 3231ed29b0b4SJens Axboe list_del_init(&de->list); 3232e276ae34SPavel Begunkov io_req_task_queue_fail(de->req, -ECANCELED); 3233ed29b0b4SJens Axboe kfree(de); 3234ed29b0b4SJens Axboe } 3235ed29b0b4SJens Axboe return true; 3236ed29b0b4SJens Axboe } 3237ed29b0b4SJens Axboe 3238ed29b0b4SJens Axboe static __cold bool io_uring_try_cancel_iowq(struct io_ring_ctx *ctx) 3239ed29b0b4SJens Axboe { 3240ed29b0b4SJens Axboe struct io_tctx_node *node; 3241ed29b0b4SJens Axboe enum io_wq_cancel cret; 3242ed29b0b4SJens Axboe bool ret = false; 3243ed29b0b4SJens Axboe 3244ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 3245ed29b0b4SJens Axboe list_for_each_entry(node, &ctx->tctx_list, ctx_node) { 3246ed29b0b4SJens Axboe struct io_uring_task *tctx = node->task->io_uring; 3247ed29b0b4SJens Axboe 3248ed29b0b4SJens Axboe /* 3249ed29b0b4SJens Axboe * io_wq will stay alive while we hold uring_lock, because it's 3250ed29b0b4SJens Axboe * killed after ctx nodes, which requires to take the lock. 3251ed29b0b4SJens Axboe */ 3252ed29b0b4SJens Axboe if (!tctx || !tctx->io_wq) 3253ed29b0b4SJens Axboe continue; 3254ed29b0b4SJens Axboe cret = io_wq_cancel_cb(tctx->io_wq, io_cancel_ctx_cb, ctx, true); 3255ed29b0b4SJens Axboe ret |= (cret != IO_WQ_CANCEL_NOTFOUND); 3256ed29b0b4SJens Axboe } 3257ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 3258ed29b0b4SJens Axboe 3259ed29b0b4SJens Axboe return ret; 3260ed29b0b4SJens Axboe } 3261ed29b0b4SJens Axboe 3262affa87dbSPavel Begunkov static __cold bool io_uring_try_cancel_requests(struct io_ring_ctx *ctx, 3263ed29b0b4SJens Axboe struct task_struct *task, 3264ed29b0b4SJens Axboe bool cancel_all) 3265ed29b0b4SJens Axboe { 3266ed29b0b4SJens Axboe struct io_task_cancel cancel = { .task = task, .all = cancel_all, }; 3267ed29b0b4SJens Axboe struct io_uring_task *tctx = task ? task->io_uring : NULL; 3268affa87dbSPavel Begunkov enum io_wq_cancel cret; 3269affa87dbSPavel Begunkov bool ret = false; 3270ed29b0b4SJens Axboe 3271360cd42cSPavel Begunkov /* set it so io_req_local_work_add() would wake us up */ 3272360cd42cSPavel Begunkov if (ctx->flags & IORING_SETUP_DEFER_TASKRUN) { 3273360cd42cSPavel Begunkov atomic_set(&ctx->cq_wait_nr, 1); 3274360cd42cSPavel Begunkov smp_mb(); 3275360cd42cSPavel Begunkov } 3276360cd42cSPavel Begunkov 3277ed29b0b4SJens Axboe /* failed during ring init, it couldn't have issued any requests */ 3278ed29b0b4SJens Axboe if (!ctx->rings) 3279affa87dbSPavel Begunkov return false; 3280ed29b0b4SJens Axboe 3281ed29b0b4SJens Axboe if (!task) { 3282ed29b0b4SJens Axboe ret |= io_uring_try_cancel_iowq(ctx); 3283ed29b0b4SJens Axboe } else if (tctx && tctx->io_wq) { 3284ed29b0b4SJens Axboe /* 3285ed29b0b4SJens Axboe * Cancels requests of all rings, not only @ctx, but 3286ed29b0b4SJens Axboe * it's fine as the task is in exit/exec. 3287ed29b0b4SJens Axboe */ 3288ed29b0b4SJens Axboe cret = io_wq_cancel_cb(tctx->io_wq, io_cancel_task_cb, 3289ed29b0b4SJens Axboe &cancel, true); 3290ed29b0b4SJens Axboe ret |= (cret != IO_WQ_CANCEL_NOTFOUND); 3291ed29b0b4SJens Axboe } 3292ed29b0b4SJens Axboe 3293ed29b0b4SJens Axboe /* SQPOLL thread does its own polling */ 3294ed29b0b4SJens Axboe if ((!(ctx->flags & IORING_SETUP_SQPOLL) && cancel_all) || 3295ed29b0b4SJens Axboe (ctx->sq_data && ctx->sq_data->thread == current)) { 3296ed29b0b4SJens Axboe while (!wq_list_empty(&ctx->iopoll_list)) { 3297ed29b0b4SJens Axboe io_iopoll_try_reap_events(ctx); 3298ed29b0b4SJens Axboe ret = true; 3299fcc926bbSJens Axboe cond_resched(); 3300ed29b0b4SJens Axboe } 3301ed29b0b4SJens Axboe } 3302ed29b0b4SJens Axboe 3303140102aeSPavel Begunkov if ((ctx->flags & IORING_SETUP_DEFER_TASKRUN) && 3304140102aeSPavel Begunkov io_allowed_defer_tw_run(ctx)) 3305c0e0d6baSDylan Yudaken ret |= io_run_local_work(ctx) > 0; 3306ed29b0b4SJens Axboe ret |= io_cancel_defer_files(ctx, task, cancel_all); 33079ca9fb24SPavel Begunkov mutex_lock(&ctx->uring_lock); 3308ed29b0b4SJens Axboe ret |= io_poll_remove_all(ctx, task, cancel_all); 33099ca9fb24SPavel Begunkov mutex_unlock(&ctx->uring_lock); 3310ed29b0b4SJens Axboe ret |= io_kill_timeouts(ctx, task, cancel_all); 3311ed29b0b4SJens Axboe if (task) 3312c0e0d6baSDylan Yudaken ret |= io_run_task_work() > 0; 3313affa87dbSPavel Begunkov return ret; 3314ed29b0b4SJens Axboe } 3315ed29b0b4SJens Axboe 3316ed29b0b4SJens Axboe static s64 tctx_inflight(struct io_uring_task *tctx, bool tracked) 3317ed29b0b4SJens Axboe { 3318ed29b0b4SJens Axboe if (tracked) 3319ed29b0b4SJens Axboe return atomic_read(&tctx->inflight_tracked); 3320ed29b0b4SJens Axboe return percpu_counter_sum(&tctx->inflight); 3321ed29b0b4SJens Axboe } 3322ed29b0b4SJens Axboe 3323ed29b0b4SJens Axboe /* 3324ed29b0b4SJens Axboe * Find any io_uring ctx that this task has registered or done IO on, and cancel 3325ed29b0b4SJens Axboe * requests. @sqd should be not-null IFF it's an SQPOLL thread cancellation. 3326ed29b0b4SJens Axboe */ 332717437f31SJens Axboe __cold void io_uring_cancel_generic(bool cancel_all, struct io_sq_data *sqd) 3328ed29b0b4SJens Axboe { 3329ed29b0b4SJens Axboe struct io_uring_task *tctx = current->io_uring; 3330ed29b0b4SJens Axboe struct io_ring_ctx *ctx; 3331360cd42cSPavel Begunkov struct io_tctx_node *node; 3332360cd42cSPavel Begunkov unsigned long index; 3333ed29b0b4SJens Axboe s64 inflight; 3334ed29b0b4SJens Axboe DEFINE_WAIT(wait); 3335ed29b0b4SJens Axboe 3336ed29b0b4SJens Axboe WARN_ON_ONCE(sqd && sqd->thread != current); 3337ed29b0b4SJens Axboe 3338ed29b0b4SJens Axboe if (!current->io_uring) 3339ed29b0b4SJens Axboe return; 3340ed29b0b4SJens Axboe if (tctx->io_wq) 3341ed29b0b4SJens Axboe io_wq_exit_start(tctx->io_wq); 3342ed29b0b4SJens Axboe 33438d664282SJens Axboe atomic_inc(&tctx->in_cancel); 3344ed29b0b4SJens Axboe do { 3345affa87dbSPavel Begunkov bool loop = false; 3346affa87dbSPavel Begunkov 3347ed29b0b4SJens Axboe io_uring_drop_tctx_refs(current); 3348ed29b0b4SJens Axboe /* read completions before cancelations */ 3349ed29b0b4SJens Axboe inflight = tctx_inflight(tctx, !cancel_all); 3350ed29b0b4SJens Axboe if (!inflight) 3351ed29b0b4SJens Axboe break; 3352ed29b0b4SJens Axboe 3353ed29b0b4SJens Axboe if (!sqd) { 3354ed29b0b4SJens Axboe xa_for_each(&tctx->xa, index, node) { 3355ed29b0b4SJens Axboe /* sqpoll task will cancel all its requests */ 3356ed29b0b4SJens Axboe if (node->ctx->sq_data) 3357ed29b0b4SJens Axboe continue; 3358affa87dbSPavel Begunkov loop |= io_uring_try_cancel_requests(node->ctx, 3359affa87dbSPavel Begunkov current, cancel_all); 3360ed29b0b4SJens Axboe } 3361ed29b0b4SJens Axboe } else { 3362ed29b0b4SJens Axboe list_for_each_entry(ctx, &sqd->ctx_list, sqd_list) 3363affa87dbSPavel Begunkov loop |= io_uring_try_cancel_requests(ctx, 3364affa87dbSPavel Begunkov current, 3365ed29b0b4SJens Axboe cancel_all); 3366ed29b0b4SJens Axboe } 3367ed29b0b4SJens Axboe 3368affa87dbSPavel Begunkov if (loop) { 3369affa87dbSPavel Begunkov cond_resched(); 3370affa87dbSPavel Begunkov continue; 3371affa87dbSPavel Begunkov } 3372affa87dbSPavel Begunkov 3373ed29b0b4SJens Axboe prepare_to_wait(&tctx->wait, &wait, TASK_INTERRUPTIBLE); 3374ed29b0b4SJens Axboe io_run_task_work(); 3375ed29b0b4SJens Axboe io_uring_drop_tctx_refs(current); 3376360cd42cSPavel Begunkov xa_for_each(&tctx->xa, index, node) { 3377360cd42cSPavel Begunkov if (!llist_empty(&node->ctx->work_llist)) { 3378360cd42cSPavel Begunkov WARN_ON_ONCE(node->ctx->submitter_task && 3379360cd42cSPavel Begunkov node->ctx->submitter_task != current); 3380360cd42cSPavel Begunkov goto end_wait; 3381360cd42cSPavel Begunkov } 3382360cd42cSPavel Begunkov } 3383ed29b0b4SJens Axboe /* 3384ed29b0b4SJens Axboe * If we've seen completions, retry without waiting. This 3385ed29b0b4SJens Axboe * avoids a race where a completion comes in before we did 3386ed29b0b4SJens Axboe * prepare_to_wait(). 3387ed29b0b4SJens Axboe */ 3388ed29b0b4SJens Axboe if (inflight == tctx_inflight(tctx, !cancel_all)) 3389ed29b0b4SJens Axboe schedule(); 3390360cd42cSPavel Begunkov end_wait: 3391ed29b0b4SJens Axboe finish_wait(&tctx->wait, &wait); 3392ed29b0b4SJens Axboe } while (1); 3393ed29b0b4SJens Axboe 3394ed29b0b4SJens Axboe io_uring_clean_tctx(tctx); 3395ed29b0b4SJens Axboe if (cancel_all) { 3396ed29b0b4SJens Axboe /* 3397ed29b0b4SJens Axboe * We shouldn't run task_works after cancel, so just leave 33988d664282SJens Axboe * ->in_cancel set for normal exit. 3399ed29b0b4SJens Axboe */ 34008d664282SJens Axboe atomic_dec(&tctx->in_cancel); 3401ed29b0b4SJens Axboe /* for exec all current's requests should be gone, kill tctx */ 3402ed29b0b4SJens Axboe __io_uring_free(current); 3403ed29b0b4SJens Axboe } 3404ed29b0b4SJens Axboe } 3405ed29b0b4SJens Axboe 3406ed29b0b4SJens Axboe void __io_uring_cancel(bool cancel_all) 3407ed29b0b4SJens Axboe { 3408ed29b0b4SJens Axboe io_uring_cancel_generic(cancel_all, NULL); 3409ed29b0b4SJens Axboe } 3410ed29b0b4SJens Axboe 3411ed29b0b4SJens Axboe static void *io_uring_validate_mmap_request(struct file *file, 3412ed29b0b4SJens Axboe loff_t pgoff, size_t sz) 3413ed29b0b4SJens Axboe { 3414ed29b0b4SJens Axboe struct io_ring_ctx *ctx = file->private_data; 3415ed29b0b4SJens Axboe loff_t offset = pgoff << PAGE_SHIFT; 3416ed29b0b4SJens Axboe struct page *page; 3417ed29b0b4SJens Axboe void *ptr; 3418ed29b0b4SJens Axboe 341903d89a2dSJens Axboe /* Don't allow mmap if the ring was setup without it */ 342003d89a2dSJens Axboe if (ctx->flags & IORING_SETUP_NO_MMAP) 342103d89a2dSJens Axboe return ERR_PTR(-EINVAL); 342203d89a2dSJens Axboe 3423c56e022cSJens Axboe switch (offset & IORING_OFF_MMAP_MASK) { 3424ed29b0b4SJens Axboe case IORING_OFF_SQ_RING: 3425ed29b0b4SJens Axboe case IORING_OFF_CQ_RING: 3426ed29b0b4SJens Axboe ptr = ctx->rings; 3427ed29b0b4SJens Axboe break; 3428ed29b0b4SJens Axboe case IORING_OFF_SQES: 3429ed29b0b4SJens Axboe ptr = ctx->sq_sqes; 3430ed29b0b4SJens Axboe break; 3431c56e022cSJens Axboe case IORING_OFF_PBUF_RING: { 3432c56e022cSJens Axboe unsigned int bgid; 3433c56e022cSJens Axboe 3434c56e022cSJens Axboe bgid = (offset & ~IORING_OFF_MMAP_MASK) >> IORING_OFF_PBUF_SHIFT; 3435c56e022cSJens Axboe mutex_lock(&ctx->uring_lock); 3436c56e022cSJens Axboe ptr = io_pbuf_get_address(ctx, bgid); 3437c56e022cSJens Axboe mutex_unlock(&ctx->uring_lock); 3438c56e022cSJens Axboe if (!ptr) 3439c56e022cSJens Axboe return ERR_PTR(-EINVAL); 3440c56e022cSJens Axboe break; 3441c56e022cSJens Axboe } 3442ed29b0b4SJens Axboe default: 3443ed29b0b4SJens Axboe return ERR_PTR(-EINVAL); 3444ed29b0b4SJens Axboe } 3445ed29b0b4SJens Axboe 3446ed29b0b4SJens Axboe page = virt_to_head_page(ptr); 3447ed29b0b4SJens Axboe if (sz > page_size(page)) 3448ed29b0b4SJens Axboe return ERR_PTR(-EINVAL); 3449ed29b0b4SJens Axboe 3450ed29b0b4SJens Axboe return ptr; 3451ed29b0b4SJens Axboe } 3452ed29b0b4SJens Axboe 3453ed29b0b4SJens Axboe #ifdef CONFIG_MMU 3454ed29b0b4SJens Axboe 3455ed29b0b4SJens Axboe static __cold int io_uring_mmap(struct file *file, struct vm_area_struct *vma) 3456ed29b0b4SJens Axboe { 3457ed29b0b4SJens Axboe size_t sz = vma->vm_end - vma->vm_start; 3458ed29b0b4SJens Axboe unsigned long pfn; 3459ed29b0b4SJens Axboe void *ptr; 3460ed29b0b4SJens Axboe 3461ed29b0b4SJens Axboe ptr = io_uring_validate_mmap_request(file, vma->vm_pgoff, sz); 3462ed29b0b4SJens Axboe if (IS_ERR(ptr)) 3463ed29b0b4SJens Axboe return PTR_ERR(ptr); 3464ed29b0b4SJens Axboe 3465ed29b0b4SJens Axboe pfn = virt_to_phys(ptr) >> PAGE_SHIFT; 3466ed29b0b4SJens Axboe return remap_pfn_range(vma, vma->vm_start, pfn, sz, vma->vm_page_prot); 3467ed29b0b4SJens Axboe } 3468ed29b0b4SJens Axboe 3469d808459bSHelge Deller static unsigned long io_uring_mmu_get_unmapped_area(struct file *filp, 3470d808459bSHelge Deller unsigned long addr, unsigned long len, 3471d808459bSHelge Deller unsigned long pgoff, unsigned long flags) 3472d808459bSHelge Deller { 3473d808459bSHelge Deller const unsigned long mmap_end = arch_get_mmap_end(addr, len, flags); 3474d808459bSHelge Deller struct vm_unmapped_area_info info; 3475d808459bSHelge Deller void *ptr; 3476d808459bSHelge Deller 3477d808459bSHelge Deller /* 3478d808459bSHelge Deller * Do not allow to map to user-provided address to avoid breaking the 3479d808459bSHelge Deller * aliasing rules. Userspace is not able to guess the offset address of 3480d808459bSHelge Deller * kernel kmalloc()ed memory area. 3481d808459bSHelge Deller */ 3482d808459bSHelge Deller if (addr) 3483d808459bSHelge Deller return -EINVAL; 3484d808459bSHelge Deller 3485d808459bSHelge Deller ptr = io_uring_validate_mmap_request(filp, pgoff, len); 3486d808459bSHelge Deller if (IS_ERR(ptr)) 3487d808459bSHelge Deller return -ENOMEM; 3488d808459bSHelge Deller 3489d808459bSHelge Deller info.flags = VM_UNMAPPED_AREA_TOPDOWN; 3490d808459bSHelge Deller info.length = len; 3491d808459bSHelge Deller info.low_limit = max(PAGE_SIZE, mmap_min_addr); 3492d808459bSHelge Deller info.high_limit = arch_get_mmap_base(addr, current->mm->mmap_base); 3493d808459bSHelge Deller #ifdef SHM_COLOUR 3494d808459bSHelge Deller info.align_mask = PAGE_MASK & (SHM_COLOUR - 1UL); 3495d808459bSHelge Deller #else 3496d808459bSHelge Deller info.align_mask = PAGE_MASK & (SHMLBA - 1UL); 3497d808459bSHelge Deller #endif 3498d808459bSHelge Deller info.align_offset = (unsigned long) ptr; 3499d808459bSHelge Deller 3500d808459bSHelge Deller /* 3501d808459bSHelge Deller * A failed mmap() very likely causes application failure, 3502d808459bSHelge Deller * so fall back to the bottom-up function here. This scenario 3503d808459bSHelge Deller * can happen with large stack limits and large mmap() 3504d808459bSHelge Deller * allocations. 3505d808459bSHelge Deller */ 3506d808459bSHelge Deller addr = vm_unmapped_area(&info); 3507d808459bSHelge Deller if (offset_in_page(addr)) { 3508d808459bSHelge Deller info.flags = 0; 3509d808459bSHelge Deller info.low_limit = TASK_UNMAPPED_BASE; 3510d808459bSHelge Deller info.high_limit = mmap_end; 3511d808459bSHelge Deller addr = vm_unmapped_area(&info); 3512d808459bSHelge Deller } 3513d808459bSHelge Deller 3514d808459bSHelge Deller return addr; 3515d808459bSHelge Deller } 3516d808459bSHelge Deller 3517ed29b0b4SJens Axboe #else /* !CONFIG_MMU */ 3518ed29b0b4SJens Axboe 3519ed29b0b4SJens Axboe static int io_uring_mmap(struct file *file, struct vm_area_struct *vma) 3520ed29b0b4SJens Axboe { 3521fc4f4be9SDavid Hildenbrand return is_nommu_shared_mapping(vma->vm_flags) ? 0 : -EINVAL; 3522ed29b0b4SJens Axboe } 3523ed29b0b4SJens Axboe 3524ed29b0b4SJens Axboe static unsigned int io_uring_nommu_mmap_capabilities(struct file *file) 3525ed29b0b4SJens Axboe { 3526ed29b0b4SJens Axboe return NOMMU_MAP_DIRECT | NOMMU_MAP_READ | NOMMU_MAP_WRITE; 3527ed29b0b4SJens Axboe } 3528ed29b0b4SJens Axboe 3529ed29b0b4SJens Axboe static unsigned long io_uring_nommu_get_unmapped_area(struct file *file, 3530ed29b0b4SJens Axboe unsigned long addr, unsigned long len, 3531ed29b0b4SJens Axboe unsigned long pgoff, unsigned long flags) 3532ed29b0b4SJens Axboe { 3533ed29b0b4SJens Axboe void *ptr; 3534ed29b0b4SJens Axboe 3535ed29b0b4SJens Axboe ptr = io_uring_validate_mmap_request(file, pgoff, len); 3536ed29b0b4SJens Axboe if (IS_ERR(ptr)) 3537ed29b0b4SJens Axboe return PTR_ERR(ptr); 3538ed29b0b4SJens Axboe 3539ed29b0b4SJens Axboe return (unsigned long) ptr; 3540ed29b0b4SJens Axboe } 3541ed29b0b4SJens Axboe 3542ed29b0b4SJens Axboe #endif /* !CONFIG_MMU */ 3543ed29b0b4SJens Axboe 3544ed29b0b4SJens Axboe static int io_validate_ext_arg(unsigned flags, const void __user *argp, size_t argsz) 3545ed29b0b4SJens Axboe { 3546ed29b0b4SJens Axboe if (flags & IORING_ENTER_EXT_ARG) { 3547ed29b0b4SJens Axboe struct io_uring_getevents_arg arg; 3548ed29b0b4SJens Axboe 3549ed29b0b4SJens Axboe if (argsz != sizeof(arg)) 3550ed29b0b4SJens Axboe return -EINVAL; 3551ed29b0b4SJens Axboe if (copy_from_user(&arg, argp, sizeof(arg))) 3552ed29b0b4SJens Axboe return -EFAULT; 3553ed29b0b4SJens Axboe } 3554ed29b0b4SJens Axboe return 0; 3555ed29b0b4SJens Axboe } 3556ed29b0b4SJens Axboe 3557ed29b0b4SJens Axboe static int io_get_ext_arg(unsigned flags, const void __user *argp, size_t *argsz, 3558ed29b0b4SJens Axboe struct __kernel_timespec __user **ts, 3559ed29b0b4SJens Axboe const sigset_t __user **sig) 3560ed29b0b4SJens Axboe { 3561ed29b0b4SJens Axboe struct io_uring_getevents_arg arg; 3562ed29b0b4SJens Axboe 3563ed29b0b4SJens Axboe /* 3564ed29b0b4SJens Axboe * If EXT_ARG isn't set, then we have no timespec and the argp pointer 3565ed29b0b4SJens Axboe * is just a pointer to the sigset_t. 3566ed29b0b4SJens Axboe */ 3567ed29b0b4SJens Axboe if (!(flags & IORING_ENTER_EXT_ARG)) { 3568ed29b0b4SJens Axboe *sig = (const sigset_t __user *) argp; 3569ed29b0b4SJens Axboe *ts = NULL; 3570ed29b0b4SJens Axboe return 0; 3571ed29b0b4SJens Axboe } 3572ed29b0b4SJens Axboe 3573ed29b0b4SJens Axboe /* 3574ed29b0b4SJens Axboe * EXT_ARG is set - ensure we agree on the size of it and copy in our 3575ed29b0b4SJens Axboe * timespec and sigset_t pointers if good. 3576ed29b0b4SJens Axboe */ 3577ed29b0b4SJens Axboe if (*argsz != sizeof(arg)) 3578ed29b0b4SJens Axboe return -EINVAL; 3579ed29b0b4SJens Axboe if (copy_from_user(&arg, argp, sizeof(arg))) 3580ed29b0b4SJens Axboe return -EFAULT; 3581ed29b0b4SJens Axboe if (arg.pad) 3582ed29b0b4SJens Axboe return -EINVAL; 3583ed29b0b4SJens Axboe *sig = u64_to_user_ptr(arg.sigmask); 3584ed29b0b4SJens Axboe *argsz = arg.sigmask_sz; 3585ed29b0b4SJens Axboe *ts = u64_to_user_ptr(arg.ts); 3586ed29b0b4SJens Axboe return 0; 3587ed29b0b4SJens Axboe } 3588ed29b0b4SJens Axboe 3589ed29b0b4SJens Axboe SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit, 3590ed29b0b4SJens Axboe u32, min_complete, u32, flags, const void __user *, argp, 3591ed29b0b4SJens Axboe size_t, argsz) 3592ed29b0b4SJens Axboe { 3593ed29b0b4SJens Axboe struct io_ring_ctx *ctx; 3594ed29b0b4SJens Axboe struct fd f; 3595ed29b0b4SJens Axboe long ret; 3596ed29b0b4SJens Axboe 3597ed29b0b4SJens Axboe if (unlikely(flags & ~(IORING_ENTER_GETEVENTS | IORING_ENTER_SQ_WAKEUP | 3598ed29b0b4SJens Axboe IORING_ENTER_SQ_WAIT | IORING_ENTER_EXT_ARG | 3599ed29b0b4SJens Axboe IORING_ENTER_REGISTERED_RING))) 3600ed29b0b4SJens Axboe return -EINVAL; 3601ed29b0b4SJens Axboe 3602ed29b0b4SJens Axboe /* 3603ed29b0b4SJens Axboe * Ring fd has been registered via IORING_REGISTER_RING_FDS, we 3604ed29b0b4SJens Axboe * need only dereference our task private array to find it. 3605ed29b0b4SJens Axboe */ 3606ed29b0b4SJens Axboe if (flags & IORING_ENTER_REGISTERED_RING) { 3607ed29b0b4SJens Axboe struct io_uring_task *tctx = current->io_uring; 3608ed29b0b4SJens Axboe 36093273c440SPavel Begunkov if (unlikely(!tctx || fd >= IO_RINGFD_REG_MAX)) 3610ed29b0b4SJens Axboe return -EINVAL; 3611ed29b0b4SJens Axboe fd = array_index_nospec(fd, IO_RINGFD_REG_MAX); 3612ed29b0b4SJens Axboe f.file = tctx->registered_rings[fd]; 3613ed29b0b4SJens Axboe f.flags = 0; 3614ed29b0b4SJens Axboe if (unlikely(!f.file)) 3615ed29b0b4SJens Axboe return -EBADF; 36163273c440SPavel Begunkov } else { 36173273c440SPavel Begunkov f = fdget(fd); 36183273c440SPavel Begunkov if (unlikely(!f.file)) 36193273c440SPavel Begunkov return -EBADF; 3620ed29b0b4SJens Axboe ret = -EOPNOTSUPP; 3621e5550a14SJens Axboe if (unlikely(!io_is_uring_fops(f.file))) 3622fbb8bb02SPavel Begunkov goto out; 36233273c440SPavel Begunkov } 3624ed29b0b4SJens Axboe 3625ed29b0b4SJens Axboe ctx = f.file->private_data; 3626ed29b0b4SJens Axboe ret = -EBADFD; 3627ed29b0b4SJens Axboe if (unlikely(ctx->flags & IORING_SETUP_R_DISABLED)) 3628ed29b0b4SJens Axboe goto out; 3629ed29b0b4SJens Axboe 3630ed29b0b4SJens Axboe /* 3631ed29b0b4SJens Axboe * For SQ polling, the thread will do all submissions and completions. 3632ed29b0b4SJens Axboe * Just return the requested submit count, and wake the thread if 3633ed29b0b4SJens Axboe * we were asked to. 3634ed29b0b4SJens Axboe */ 3635ed29b0b4SJens Axboe ret = 0; 3636ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_SQPOLL) { 3637ed29b0b4SJens Axboe io_cqring_overflow_flush(ctx); 3638ed29b0b4SJens Axboe 3639ed29b0b4SJens Axboe if (unlikely(ctx->sq_data->thread == NULL)) { 3640ed29b0b4SJens Axboe ret = -EOWNERDEAD; 3641ed29b0b4SJens Axboe goto out; 3642ed29b0b4SJens Axboe } 3643ed29b0b4SJens Axboe if (flags & IORING_ENTER_SQ_WAKEUP) 3644ed29b0b4SJens Axboe wake_up(&ctx->sq_data->wait); 364588b80534SQuanfa Fu if (flags & IORING_ENTER_SQ_WAIT) 364688b80534SQuanfa Fu io_sqpoll_wait_sq(ctx); 364788b80534SQuanfa Fu 3648ed29b0b4SJens Axboe ret = to_submit; 3649ed29b0b4SJens Axboe } else if (to_submit) { 3650ed29b0b4SJens Axboe ret = io_uring_add_tctx_node(ctx); 3651ed29b0b4SJens Axboe if (unlikely(ret)) 3652ed29b0b4SJens Axboe goto out; 3653ed29b0b4SJens Axboe 3654ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 3655ed29b0b4SJens Axboe ret = io_submit_sqes(ctx, to_submit); 3656ed29b0b4SJens Axboe if (ret != to_submit) { 3657ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 3658ed29b0b4SJens Axboe goto out; 3659ed29b0b4SJens Axboe } 366044f87745SPavel Begunkov if (flags & IORING_ENTER_GETEVENTS) { 366144f87745SPavel Begunkov if (ctx->syscall_iopoll) 3662ed29b0b4SJens Axboe goto iopoll_locked; 366344f87745SPavel Begunkov /* 366444f87745SPavel Begunkov * Ignore errors, we'll soon call io_cqring_wait() and 366544f87745SPavel Begunkov * it should handle ownership problems if any. 366644f87745SPavel Begunkov */ 366744f87745SPavel Begunkov if (ctx->flags & IORING_SETUP_DEFER_TASKRUN) 366844f87745SPavel Begunkov (void)io_run_local_work_locked(ctx); 366944f87745SPavel Begunkov } 3670ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 3671ed29b0b4SJens Axboe } 3672c0e0d6baSDylan Yudaken 3673ed29b0b4SJens Axboe if (flags & IORING_ENTER_GETEVENTS) { 3674ed29b0b4SJens Axboe int ret2; 3675c0e0d6baSDylan Yudaken 3676ed29b0b4SJens Axboe if (ctx->syscall_iopoll) { 3677ed29b0b4SJens Axboe /* 3678ed29b0b4SJens Axboe * We disallow the app entering submit/complete with 3679ed29b0b4SJens Axboe * polling, but we still need to lock the ring to 3680ed29b0b4SJens Axboe * prevent racing with polled issue that got punted to 3681ed29b0b4SJens Axboe * a workqueue. 3682ed29b0b4SJens Axboe */ 3683ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 3684ed29b0b4SJens Axboe iopoll_locked: 3685ed29b0b4SJens Axboe ret2 = io_validate_ext_arg(flags, argp, argsz); 3686ed29b0b4SJens Axboe if (likely(!ret2)) { 3687ed29b0b4SJens Axboe min_complete = min(min_complete, 3688ed29b0b4SJens Axboe ctx->cq_entries); 3689ed29b0b4SJens Axboe ret2 = io_iopoll_check(ctx, min_complete); 3690ed29b0b4SJens Axboe } 3691ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 3692ed29b0b4SJens Axboe } else { 3693ed29b0b4SJens Axboe const sigset_t __user *sig; 3694ed29b0b4SJens Axboe struct __kernel_timespec __user *ts; 3695ed29b0b4SJens Axboe 3696ed29b0b4SJens Axboe ret2 = io_get_ext_arg(flags, argp, &argsz, &ts, &sig); 3697ed29b0b4SJens Axboe if (likely(!ret2)) { 3698ed29b0b4SJens Axboe min_complete = min(min_complete, 3699ed29b0b4SJens Axboe ctx->cq_entries); 3700ed29b0b4SJens Axboe ret2 = io_cqring_wait(ctx, min_complete, sig, 3701ed29b0b4SJens Axboe argsz, ts); 3702ed29b0b4SJens Axboe } 3703ed29b0b4SJens Axboe } 3704ed29b0b4SJens Axboe 3705ed29b0b4SJens Axboe if (!ret) { 3706ed29b0b4SJens Axboe ret = ret2; 3707ed29b0b4SJens Axboe 3708ed29b0b4SJens Axboe /* 3709ed29b0b4SJens Axboe * EBADR indicates that one or more CQE were dropped. 3710ed29b0b4SJens Axboe * Once the user has been informed we can clear the bit 3711ed29b0b4SJens Axboe * as they are obviously ok with those drops. 3712ed29b0b4SJens Axboe */ 3713ed29b0b4SJens Axboe if (unlikely(ret2 == -EBADR)) 3714ed29b0b4SJens Axboe clear_bit(IO_CHECK_CQ_DROPPED_BIT, 3715ed29b0b4SJens Axboe &ctx->check_cq); 3716ed29b0b4SJens Axboe } 3717ed29b0b4SJens Axboe } 3718ed29b0b4SJens Axboe out: 3719ed29b0b4SJens Axboe fdput(f); 3720ed29b0b4SJens Axboe return ret; 3721ed29b0b4SJens Axboe } 3722ed29b0b4SJens Axboe 3723ed29b0b4SJens Axboe static const struct file_operations io_uring_fops = { 3724ed29b0b4SJens Axboe .release = io_uring_release, 3725ed29b0b4SJens Axboe .mmap = io_uring_mmap, 3726ed29b0b4SJens Axboe #ifndef CONFIG_MMU 3727ed29b0b4SJens Axboe .get_unmapped_area = io_uring_nommu_get_unmapped_area, 3728ed29b0b4SJens Axboe .mmap_capabilities = io_uring_nommu_mmap_capabilities, 3729d808459bSHelge Deller #else 3730d808459bSHelge Deller .get_unmapped_area = io_uring_mmu_get_unmapped_area, 3731ed29b0b4SJens Axboe #endif 3732ed29b0b4SJens Axboe .poll = io_uring_poll, 3733ed29b0b4SJens Axboe #ifdef CONFIG_PROC_FS 3734ed29b0b4SJens Axboe .show_fdinfo = io_uring_show_fdinfo, 3735ed29b0b4SJens Axboe #endif 3736ed29b0b4SJens Axboe }; 3737ed29b0b4SJens Axboe 373892ac8beaSJens Axboe bool io_is_uring_fops(struct file *file) 373992ac8beaSJens Axboe { 374092ac8beaSJens Axboe return file->f_op == &io_uring_fops; 374192ac8beaSJens Axboe } 374292ac8beaSJens Axboe 3743ed29b0b4SJens Axboe static __cold int io_allocate_scq_urings(struct io_ring_ctx *ctx, 3744ed29b0b4SJens Axboe struct io_uring_params *p) 3745ed29b0b4SJens Axboe { 3746ed29b0b4SJens Axboe struct io_rings *rings; 3747ed29b0b4SJens Axboe size_t size, sq_array_offset; 3748e27cef86SJens Axboe void *ptr; 3749ed29b0b4SJens Axboe 3750ed29b0b4SJens Axboe /* make sure these are sane, as we already accounted them */ 3751ed29b0b4SJens Axboe ctx->sq_entries = p->sq_entries; 3752ed29b0b4SJens Axboe ctx->cq_entries = p->cq_entries; 3753ed29b0b4SJens Axboe 3754ed29b0b4SJens Axboe size = rings_size(ctx, p->sq_entries, p->cq_entries, &sq_array_offset); 3755ed29b0b4SJens Axboe if (size == SIZE_MAX) 3756ed29b0b4SJens Axboe return -EOVERFLOW; 3757ed29b0b4SJens Axboe 375803d89a2dSJens Axboe if (!(ctx->flags & IORING_SETUP_NO_MMAP)) 3759ed29b0b4SJens Axboe rings = io_mem_alloc(size); 376003d89a2dSJens Axboe else 376103d89a2dSJens Axboe rings = io_rings_map(ctx, p->cq_off.user_addr, size); 376203d89a2dSJens Axboe 3763e27cef86SJens Axboe if (IS_ERR(rings)) 3764e27cef86SJens Axboe return PTR_ERR(rings); 3765ed29b0b4SJens Axboe 3766ed29b0b4SJens Axboe ctx->rings = rings; 3767ed29b0b4SJens Axboe ctx->sq_array = (u32 *)((char *)rings + sq_array_offset); 3768ed29b0b4SJens Axboe rings->sq_ring_mask = p->sq_entries - 1; 3769ed29b0b4SJens Axboe rings->cq_ring_mask = p->cq_entries - 1; 3770ed29b0b4SJens Axboe rings->sq_ring_entries = p->sq_entries; 3771ed29b0b4SJens Axboe rings->cq_ring_entries = p->cq_entries; 3772ed29b0b4SJens Axboe 3773ed29b0b4SJens Axboe if (p->flags & IORING_SETUP_SQE128) 3774ed29b0b4SJens Axboe size = array_size(2 * sizeof(struct io_uring_sqe), p->sq_entries); 3775ed29b0b4SJens Axboe else 3776ed29b0b4SJens Axboe size = array_size(sizeof(struct io_uring_sqe), p->sq_entries); 3777ed29b0b4SJens Axboe if (size == SIZE_MAX) { 37789c189eeeSJens Axboe io_rings_free(ctx); 3779ed29b0b4SJens Axboe return -EOVERFLOW; 3780ed29b0b4SJens Axboe } 3781ed29b0b4SJens Axboe 378203d89a2dSJens Axboe if (!(ctx->flags & IORING_SETUP_NO_MMAP)) 3783e27cef86SJens Axboe ptr = io_mem_alloc(size); 378403d89a2dSJens Axboe else 378503d89a2dSJens Axboe ptr = io_sqes_map(ctx, p->sq_off.user_addr, size); 378603d89a2dSJens Axboe 3787e27cef86SJens Axboe if (IS_ERR(ptr)) { 37889c189eeeSJens Axboe io_rings_free(ctx); 3789e27cef86SJens Axboe return PTR_ERR(ptr); 3790ed29b0b4SJens Axboe } 3791ed29b0b4SJens Axboe 3792e27cef86SJens Axboe ctx->sq_sqes = ptr; 3793ed29b0b4SJens Axboe return 0; 3794ed29b0b4SJens Axboe } 3795ed29b0b4SJens Axboe 37966e76ac59SJosh Triplett static int io_uring_install_fd(struct file *file) 3797ed29b0b4SJens Axboe { 37986e76ac59SJosh Triplett int fd; 3799ed29b0b4SJens Axboe 3800ed29b0b4SJens Axboe fd = get_unused_fd_flags(O_RDWR | O_CLOEXEC); 3801ed29b0b4SJens Axboe if (fd < 0) 3802ed29b0b4SJens Axboe return fd; 3803ed29b0b4SJens Axboe fd_install(fd, file); 3804ed29b0b4SJens Axboe return fd; 3805ed29b0b4SJens Axboe } 3806ed29b0b4SJens Axboe 3807ed29b0b4SJens Axboe /* 3808ed29b0b4SJens Axboe * Allocate an anonymous fd, this is what constitutes the application 3809ed29b0b4SJens Axboe * visible backing of an io_uring instance. The application mmaps this 3810ed29b0b4SJens Axboe * fd to gain access to the SQ/CQ ring details. If UNIX sockets are enabled, 3811ed29b0b4SJens Axboe * we have to tie this fd to a socket for file garbage collection purposes. 3812ed29b0b4SJens Axboe */ 3813ed29b0b4SJens Axboe static struct file *io_uring_get_file(struct io_ring_ctx *ctx) 3814ed29b0b4SJens Axboe { 3815ed29b0b4SJens Axboe struct file *file; 3816ed29b0b4SJens Axboe #if defined(CONFIG_UNIX) 3817ed29b0b4SJens Axboe int ret; 3818ed29b0b4SJens Axboe 3819ed29b0b4SJens Axboe ret = sock_create_kern(&init_net, PF_UNIX, SOCK_RAW, IPPROTO_IP, 3820ed29b0b4SJens Axboe &ctx->ring_sock); 3821ed29b0b4SJens Axboe if (ret) 3822ed29b0b4SJens Axboe return ERR_PTR(ret); 3823ed29b0b4SJens Axboe #endif 3824ed29b0b4SJens Axboe 3825ed29b0b4SJens Axboe file = anon_inode_getfile_secure("[io_uring]", &io_uring_fops, ctx, 3826ed29b0b4SJens Axboe O_RDWR | O_CLOEXEC, NULL); 3827ed29b0b4SJens Axboe #if defined(CONFIG_UNIX) 3828ed29b0b4SJens Axboe if (IS_ERR(file)) { 3829ed29b0b4SJens Axboe sock_release(ctx->ring_sock); 3830ed29b0b4SJens Axboe ctx->ring_sock = NULL; 3831ed29b0b4SJens Axboe } else { 3832ed29b0b4SJens Axboe ctx->ring_sock->file = file; 3833ed29b0b4SJens Axboe } 3834ed29b0b4SJens Axboe #endif 3835ed29b0b4SJens Axboe return file; 3836ed29b0b4SJens Axboe } 3837ed29b0b4SJens Axboe 3838ed29b0b4SJens Axboe static __cold int io_uring_create(unsigned entries, struct io_uring_params *p, 3839ed29b0b4SJens Axboe struct io_uring_params __user *params) 3840ed29b0b4SJens Axboe { 3841ed29b0b4SJens Axboe struct io_ring_ctx *ctx; 38426e76ac59SJosh Triplett struct io_uring_task *tctx; 3843ed29b0b4SJens Axboe struct file *file; 3844ed29b0b4SJens Axboe int ret; 3845ed29b0b4SJens Axboe 3846ed29b0b4SJens Axboe if (!entries) 3847ed29b0b4SJens Axboe return -EINVAL; 3848ed29b0b4SJens Axboe if (entries > IORING_MAX_ENTRIES) { 3849ed29b0b4SJens Axboe if (!(p->flags & IORING_SETUP_CLAMP)) 3850ed29b0b4SJens Axboe return -EINVAL; 3851ed29b0b4SJens Axboe entries = IORING_MAX_ENTRIES; 3852ed29b0b4SJens Axboe } 3853ed29b0b4SJens Axboe 38546e76ac59SJosh Triplett if ((p->flags & IORING_SETUP_REGISTERED_FD_ONLY) 38556e76ac59SJosh Triplett && !(p->flags & IORING_SETUP_NO_MMAP)) 38566e76ac59SJosh Triplett return -EINVAL; 38576e76ac59SJosh Triplett 3858ed29b0b4SJens Axboe /* 3859ed29b0b4SJens Axboe * Use twice as many entries for the CQ ring. It's possible for the 3860ed29b0b4SJens Axboe * application to drive a higher depth than the size of the SQ ring, 3861ed29b0b4SJens Axboe * since the sqes are only used at submission time. This allows for 3862ed29b0b4SJens Axboe * some flexibility in overcommitting a bit. If the application has 3863ed29b0b4SJens Axboe * set IORING_SETUP_CQSIZE, it will have passed in the desired number 3864ed29b0b4SJens Axboe * of CQ ring entries manually. 3865ed29b0b4SJens Axboe */ 3866ed29b0b4SJens Axboe p->sq_entries = roundup_pow_of_two(entries); 3867ed29b0b4SJens Axboe if (p->flags & IORING_SETUP_CQSIZE) { 3868ed29b0b4SJens Axboe /* 3869ed29b0b4SJens Axboe * If IORING_SETUP_CQSIZE is set, we do the same roundup 3870ed29b0b4SJens Axboe * to a power-of-two, if it isn't already. We do NOT impose 3871ed29b0b4SJens Axboe * any cq vs sq ring sizing. 3872ed29b0b4SJens Axboe */ 3873ed29b0b4SJens Axboe if (!p->cq_entries) 3874ed29b0b4SJens Axboe return -EINVAL; 3875ed29b0b4SJens Axboe if (p->cq_entries > IORING_MAX_CQ_ENTRIES) { 3876ed29b0b4SJens Axboe if (!(p->flags & IORING_SETUP_CLAMP)) 3877ed29b0b4SJens Axboe return -EINVAL; 3878ed29b0b4SJens Axboe p->cq_entries = IORING_MAX_CQ_ENTRIES; 3879ed29b0b4SJens Axboe } 3880ed29b0b4SJens Axboe p->cq_entries = roundup_pow_of_two(p->cq_entries); 3881ed29b0b4SJens Axboe if (p->cq_entries < p->sq_entries) 3882ed29b0b4SJens Axboe return -EINVAL; 3883ed29b0b4SJens Axboe } else { 3884ed29b0b4SJens Axboe p->cq_entries = 2 * p->sq_entries; 3885ed29b0b4SJens Axboe } 3886ed29b0b4SJens Axboe 3887ed29b0b4SJens Axboe ctx = io_ring_ctx_alloc(p); 3888ed29b0b4SJens Axboe if (!ctx) 3889ed29b0b4SJens Axboe return -ENOMEM; 3890ed29b0b4SJens Axboe 3891e6aeb272SPavel Begunkov if ((ctx->flags & IORING_SETUP_DEFER_TASKRUN) && 3892e6aeb272SPavel Begunkov !(ctx->flags & IORING_SETUP_IOPOLL) && 3893e6aeb272SPavel Begunkov !(ctx->flags & IORING_SETUP_SQPOLL)) 3894e6aeb272SPavel Begunkov ctx->task_complete = true; 3895e6aeb272SPavel Begunkov 3896ed29b0b4SJens Axboe /* 3897bca39f39SPavel Begunkov * lazy poll_wq activation relies on ->task_complete for synchronisation 3898bca39f39SPavel Begunkov * purposes, see io_activate_pollwq() 3899bca39f39SPavel Begunkov */ 3900bca39f39SPavel Begunkov if (!ctx->task_complete) 3901bca39f39SPavel Begunkov ctx->poll_activated = true; 3902bca39f39SPavel Begunkov 3903bca39f39SPavel Begunkov /* 3904ed29b0b4SJens Axboe * When SETUP_IOPOLL and SETUP_SQPOLL are both enabled, user 3905ed29b0b4SJens Axboe * space applications don't need to do io completion events 3906ed29b0b4SJens Axboe * polling again, they can rely on io_sq_thread to do polling 3907ed29b0b4SJens Axboe * work, which can reduce cpu usage and uring_lock contention. 3908ed29b0b4SJens Axboe */ 3909ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_IOPOLL && 3910ed29b0b4SJens Axboe !(ctx->flags & IORING_SETUP_SQPOLL)) 3911ed29b0b4SJens Axboe ctx->syscall_iopoll = 1; 3912ed29b0b4SJens Axboe 3913ed29b0b4SJens Axboe ctx->compat = in_compat_syscall(); 3914ed29b0b4SJens Axboe if (!capable(CAP_IPC_LOCK)) 3915ed29b0b4SJens Axboe ctx->user = get_uid(current_user()); 3916ed29b0b4SJens Axboe 3917ed29b0b4SJens Axboe /* 3918ed29b0b4SJens Axboe * For SQPOLL, we just need a wakeup, always. For !SQPOLL, if 3919ed29b0b4SJens Axboe * COOP_TASKRUN is set, then IPIs are never needed by the app. 3920ed29b0b4SJens Axboe */ 3921ed29b0b4SJens Axboe ret = -EINVAL; 3922ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_SQPOLL) { 3923ed29b0b4SJens Axboe /* IPI related flags don't make sense with SQPOLL */ 3924ed29b0b4SJens Axboe if (ctx->flags & (IORING_SETUP_COOP_TASKRUN | 3925c0e0d6baSDylan Yudaken IORING_SETUP_TASKRUN_FLAG | 3926c0e0d6baSDylan Yudaken IORING_SETUP_DEFER_TASKRUN)) 3927ed29b0b4SJens Axboe goto err; 3928ed29b0b4SJens Axboe ctx->notify_method = TWA_SIGNAL_NO_IPI; 3929ed29b0b4SJens Axboe } else if (ctx->flags & IORING_SETUP_COOP_TASKRUN) { 3930ed29b0b4SJens Axboe ctx->notify_method = TWA_SIGNAL_NO_IPI; 3931ed29b0b4SJens Axboe } else { 3932c0e0d6baSDylan Yudaken if (ctx->flags & IORING_SETUP_TASKRUN_FLAG && 3933c0e0d6baSDylan Yudaken !(ctx->flags & IORING_SETUP_DEFER_TASKRUN)) 3934ed29b0b4SJens Axboe goto err; 3935ed29b0b4SJens Axboe ctx->notify_method = TWA_SIGNAL; 3936ed29b0b4SJens Axboe } 3937ed29b0b4SJens Axboe 3938ed29b0b4SJens Axboe /* 3939c0e0d6baSDylan Yudaken * For DEFER_TASKRUN we require the completion task to be the same as the 3940c0e0d6baSDylan Yudaken * submission task. This implies that there is only one submitter, so enforce 3941c0e0d6baSDylan Yudaken * that. 3942c0e0d6baSDylan Yudaken */ 3943c0e0d6baSDylan Yudaken if (ctx->flags & IORING_SETUP_DEFER_TASKRUN && 3944c0e0d6baSDylan Yudaken !(ctx->flags & IORING_SETUP_SINGLE_ISSUER)) { 3945c0e0d6baSDylan Yudaken goto err; 3946c0e0d6baSDylan Yudaken } 3947c0e0d6baSDylan Yudaken 3948c0e0d6baSDylan Yudaken /* 3949ed29b0b4SJens Axboe * This is just grabbed for accounting purposes. When a process exits, 3950ed29b0b4SJens Axboe * the mm is exited and dropped before the files, hence we need to hang 3951ed29b0b4SJens Axboe * on to this mm purely for the purposes of being able to unaccount 3952ed29b0b4SJens Axboe * memory (locked/pinned vm). It's not used for anything else. 3953ed29b0b4SJens Axboe */ 3954ed29b0b4SJens Axboe mmgrab(current->mm); 3955ed29b0b4SJens Axboe ctx->mm_account = current->mm; 3956ed29b0b4SJens Axboe 3957ed29b0b4SJens Axboe ret = io_allocate_scq_urings(ctx, p); 3958ed29b0b4SJens Axboe if (ret) 3959ed29b0b4SJens Axboe goto err; 3960ed29b0b4SJens Axboe 3961ed29b0b4SJens Axboe ret = io_sq_offload_create(ctx, p); 3962ed29b0b4SJens Axboe if (ret) 3963ed29b0b4SJens Axboe goto err; 39642933ae6eSPavel Begunkov 39652933ae6eSPavel Begunkov ret = io_rsrc_init(ctx); 3966ed29b0b4SJens Axboe if (ret) 3967ed29b0b4SJens Axboe goto err; 3968ed29b0b4SJens Axboe 3969ed29b0b4SJens Axboe p->sq_off.head = offsetof(struct io_rings, sq.head); 3970ed29b0b4SJens Axboe p->sq_off.tail = offsetof(struct io_rings, sq.tail); 3971ed29b0b4SJens Axboe p->sq_off.ring_mask = offsetof(struct io_rings, sq_ring_mask); 3972ed29b0b4SJens Axboe p->sq_off.ring_entries = offsetof(struct io_rings, sq_ring_entries); 3973ed29b0b4SJens Axboe p->sq_off.flags = offsetof(struct io_rings, sq_flags); 3974ed29b0b4SJens Axboe p->sq_off.dropped = offsetof(struct io_rings, sq_dropped); 3975ed29b0b4SJens Axboe p->sq_off.array = (char *)ctx->sq_array - (char *)ctx->rings; 39769b1b58caSJens Axboe p->sq_off.resv1 = 0; 397703d89a2dSJens Axboe if (!(ctx->flags & IORING_SETUP_NO_MMAP)) 397803d89a2dSJens Axboe p->sq_off.user_addr = 0; 3979ed29b0b4SJens Axboe 3980ed29b0b4SJens Axboe p->cq_off.head = offsetof(struct io_rings, cq.head); 3981ed29b0b4SJens Axboe p->cq_off.tail = offsetof(struct io_rings, cq.tail); 3982ed29b0b4SJens Axboe p->cq_off.ring_mask = offsetof(struct io_rings, cq_ring_mask); 3983ed29b0b4SJens Axboe p->cq_off.ring_entries = offsetof(struct io_rings, cq_ring_entries); 3984ed29b0b4SJens Axboe p->cq_off.overflow = offsetof(struct io_rings, cq_overflow); 3985ed29b0b4SJens Axboe p->cq_off.cqes = offsetof(struct io_rings, cqes); 3986ed29b0b4SJens Axboe p->cq_off.flags = offsetof(struct io_rings, cq_flags); 39879b1b58caSJens Axboe p->cq_off.resv1 = 0; 398803d89a2dSJens Axboe if (!(ctx->flags & IORING_SETUP_NO_MMAP)) 398903d89a2dSJens Axboe p->cq_off.user_addr = 0; 3990ed29b0b4SJens Axboe 3991ed29b0b4SJens Axboe p->features = IORING_FEAT_SINGLE_MMAP | IORING_FEAT_NODROP | 3992ed29b0b4SJens Axboe IORING_FEAT_SUBMIT_STABLE | IORING_FEAT_RW_CUR_POS | 3993ed29b0b4SJens Axboe IORING_FEAT_CUR_PERSONALITY | IORING_FEAT_FAST_POLL | 3994ed29b0b4SJens Axboe IORING_FEAT_POLL_32BITS | IORING_FEAT_SQPOLL_NONFIXED | 3995ed29b0b4SJens Axboe IORING_FEAT_EXT_ARG | IORING_FEAT_NATIVE_WORKERS | 3996ed29b0b4SJens Axboe IORING_FEAT_RSRC_TAGS | IORING_FEAT_CQE_SKIP | 39977d3fd88dSJosh Triplett IORING_FEAT_LINKED_FILE | IORING_FEAT_REG_REG_RING; 3998ed29b0b4SJens Axboe 3999ed29b0b4SJens Axboe if (copy_to_user(params, p, sizeof(*p))) { 4000ed29b0b4SJens Axboe ret = -EFAULT; 4001ed29b0b4SJens Axboe goto err; 4002ed29b0b4SJens Axboe } 4003ed29b0b4SJens Axboe 40047cae596bSDylan Yudaken if (ctx->flags & IORING_SETUP_SINGLE_ISSUER 40057cae596bSDylan Yudaken && !(ctx->flags & IORING_SETUP_R_DISABLED)) 40068579538cSPavel Begunkov WRITE_ONCE(ctx->submitter_task, get_task_struct(current)); 40077cae596bSDylan Yudaken 4008ed29b0b4SJens Axboe file = io_uring_get_file(ctx); 4009ed29b0b4SJens Axboe if (IS_ERR(file)) { 4010ed29b0b4SJens Axboe ret = PTR_ERR(file); 4011ed29b0b4SJens Axboe goto err; 4012ed29b0b4SJens Axboe } 4013ed29b0b4SJens Axboe 40146e76ac59SJosh Triplett ret = __io_uring_add_tctx_node(ctx); 40156e76ac59SJosh Triplett if (ret) 40166e76ac59SJosh Triplett goto err_fput; 40176e76ac59SJosh Triplett tctx = current->io_uring; 40186e76ac59SJosh Triplett 4019ed29b0b4SJens Axboe /* 4020ed29b0b4SJens Axboe * Install ring fd as the very last thing, so we don't risk someone 4021ed29b0b4SJens Axboe * having closed it before we finish setup 4022ed29b0b4SJens Axboe */ 40236e76ac59SJosh Triplett if (p->flags & IORING_SETUP_REGISTERED_FD_ONLY) 40246e76ac59SJosh Triplett ret = io_ring_add_registered_file(tctx, file, 0, IO_RINGFD_REG_MAX); 40256e76ac59SJosh Triplett else 40266e76ac59SJosh Triplett ret = io_uring_install_fd(file); 40276e76ac59SJosh Triplett if (ret < 0) 40286e76ac59SJosh Triplett goto err_fput; 4029ed29b0b4SJens Axboe 4030ed29b0b4SJens Axboe trace_io_uring_create(ret, ctx, p->sq_entries, p->cq_entries, p->flags); 4031ed29b0b4SJens Axboe return ret; 4032ed29b0b4SJens Axboe err: 4033ed29b0b4SJens Axboe io_ring_ctx_wait_and_kill(ctx); 4034ed29b0b4SJens Axboe return ret; 40356e76ac59SJosh Triplett err_fput: 40366e76ac59SJosh Triplett fput(file); 40376e76ac59SJosh Triplett return ret; 4038ed29b0b4SJens Axboe } 4039ed29b0b4SJens Axboe 4040ed29b0b4SJens Axboe /* 4041ed29b0b4SJens Axboe * Sets up an aio uring context, and returns the fd. Applications asks for a 4042ed29b0b4SJens Axboe * ring size, we return the actual sq/cq ring sizes (among other things) in the 4043ed29b0b4SJens Axboe * params structure passed in. 4044ed29b0b4SJens Axboe */ 4045ed29b0b4SJens Axboe static long io_uring_setup(u32 entries, struct io_uring_params __user *params) 4046ed29b0b4SJens Axboe { 4047ed29b0b4SJens Axboe struct io_uring_params p; 4048ed29b0b4SJens Axboe int i; 4049ed29b0b4SJens Axboe 4050ed29b0b4SJens Axboe if (copy_from_user(&p, params, sizeof(p))) 4051ed29b0b4SJens Axboe return -EFAULT; 4052ed29b0b4SJens Axboe for (i = 0; i < ARRAY_SIZE(p.resv); i++) { 4053ed29b0b4SJens Axboe if (p.resv[i]) 4054ed29b0b4SJens Axboe return -EINVAL; 4055ed29b0b4SJens Axboe } 4056ed29b0b4SJens Axboe 4057ed29b0b4SJens Axboe if (p.flags & ~(IORING_SETUP_IOPOLL | IORING_SETUP_SQPOLL | 4058ed29b0b4SJens Axboe IORING_SETUP_SQ_AFF | IORING_SETUP_CQSIZE | 4059ed29b0b4SJens Axboe IORING_SETUP_CLAMP | IORING_SETUP_ATTACH_WQ | 4060ed29b0b4SJens Axboe IORING_SETUP_R_DISABLED | IORING_SETUP_SUBMIT_ALL | 4061ed29b0b4SJens Axboe IORING_SETUP_COOP_TASKRUN | IORING_SETUP_TASKRUN_FLAG | 406297bbdc06SPavel Begunkov IORING_SETUP_SQE128 | IORING_SETUP_CQE32 | 406303d89a2dSJens Axboe IORING_SETUP_SINGLE_ISSUER | IORING_SETUP_DEFER_TASKRUN | 40646e76ac59SJosh Triplett IORING_SETUP_NO_MMAP | IORING_SETUP_REGISTERED_FD_ONLY)) 4065ed29b0b4SJens Axboe return -EINVAL; 4066ed29b0b4SJens Axboe 4067ed29b0b4SJens Axboe return io_uring_create(entries, &p, params); 4068ed29b0b4SJens Axboe } 4069ed29b0b4SJens Axboe 4070ed29b0b4SJens Axboe SYSCALL_DEFINE2(io_uring_setup, u32, entries, 4071ed29b0b4SJens Axboe struct io_uring_params __user *, params) 4072ed29b0b4SJens Axboe { 4073ed29b0b4SJens Axboe return io_uring_setup(entries, params); 4074ed29b0b4SJens Axboe } 4075ed29b0b4SJens Axboe 4076ed29b0b4SJens Axboe static __cold int io_probe(struct io_ring_ctx *ctx, void __user *arg, 4077ed29b0b4SJens Axboe unsigned nr_args) 4078ed29b0b4SJens Axboe { 4079ed29b0b4SJens Axboe struct io_uring_probe *p; 4080ed29b0b4SJens Axboe size_t size; 4081ed29b0b4SJens Axboe int i, ret; 4082ed29b0b4SJens Axboe 4083ed29b0b4SJens Axboe size = struct_size(p, ops, nr_args); 4084ed29b0b4SJens Axboe if (size == SIZE_MAX) 4085ed29b0b4SJens Axboe return -EOVERFLOW; 4086ed29b0b4SJens Axboe p = kzalloc(size, GFP_KERNEL); 4087ed29b0b4SJens Axboe if (!p) 4088ed29b0b4SJens Axboe return -ENOMEM; 4089ed29b0b4SJens Axboe 4090ed29b0b4SJens Axboe ret = -EFAULT; 4091ed29b0b4SJens Axboe if (copy_from_user(p, arg, size)) 4092ed29b0b4SJens Axboe goto out; 4093ed29b0b4SJens Axboe ret = -EINVAL; 4094ed29b0b4SJens Axboe if (memchr_inv(p, 0, size)) 4095ed29b0b4SJens Axboe goto out; 4096ed29b0b4SJens Axboe 4097ed29b0b4SJens Axboe p->last_op = IORING_OP_LAST - 1; 4098ed29b0b4SJens Axboe if (nr_args > IORING_OP_LAST) 4099ed29b0b4SJens Axboe nr_args = IORING_OP_LAST; 4100ed29b0b4SJens Axboe 4101ed29b0b4SJens Axboe for (i = 0; i < nr_args; i++) { 4102ed29b0b4SJens Axboe p->ops[i].op = i; 4103a7dd2782SBreno Leitao if (!io_issue_defs[i].not_supported) 4104ed29b0b4SJens Axboe p->ops[i].flags = IO_URING_OP_SUPPORTED; 4105ed29b0b4SJens Axboe } 4106ed29b0b4SJens Axboe p->ops_len = i; 4107ed29b0b4SJens Axboe 4108ed29b0b4SJens Axboe ret = 0; 4109ed29b0b4SJens Axboe if (copy_to_user(arg, p, size)) 4110ed29b0b4SJens Axboe ret = -EFAULT; 4111ed29b0b4SJens Axboe out: 4112ed29b0b4SJens Axboe kfree(p); 4113ed29b0b4SJens Axboe return ret; 4114ed29b0b4SJens Axboe } 4115ed29b0b4SJens Axboe 4116ed29b0b4SJens Axboe static int io_register_personality(struct io_ring_ctx *ctx) 4117ed29b0b4SJens Axboe { 4118ed29b0b4SJens Axboe const struct cred *creds; 4119ed29b0b4SJens Axboe u32 id; 4120ed29b0b4SJens Axboe int ret; 4121ed29b0b4SJens Axboe 4122ed29b0b4SJens Axboe creds = get_current_cred(); 4123ed29b0b4SJens Axboe 4124ed29b0b4SJens Axboe ret = xa_alloc_cyclic(&ctx->personalities, &id, (void *)creds, 4125ed29b0b4SJens Axboe XA_LIMIT(0, USHRT_MAX), &ctx->pers_next, GFP_KERNEL); 4126ed29b0b4SJens Axboe if (ret < 0) { 4127ed29b0b4SJens Axboe put_cred(creds); 4128ed29b0b4SJens Axboe return ret; 4129ed29b0b4SJens Axboe } 4130ed29b0b4SJens Axboe return id; 4131ed29b0b4SJens Axboe } 4132ed29b0b4SJens Axboe 4133ed29b0b4SJens Axboe static __cold int io_register_restrictions(struct io_ring_ctx *ctx, 4134ed29b0b4SJens Axboe void __user *arg, unsigned int nr_args) 4135ed29b0b4SJens Axboe { 4136ed29b0b4SJens Axboe struct io_uring_restriction *res; 4137ed29b0b4SJens Axboe size_t size; 4138ed29b0b4SJens Axboe int i, ret; 4139ed29b0b4SJens Axboe 4140ed29b0b4SJens Axboe /* Restrictions allowed only if rings started disabled */ 4141ed29b0b4SJens Axboe if (!(ctx->flags & IORING_SETUP_R_DISABLED)) 4142ed29b0b4SJens Axboe return -EBADFD; 4143ed29b0b4SJens Axboe 4144ed29b0b4SJens Axboe /* We allow only a single restrictions registration */ 4145ed29b0b4SJens Axboe if (ctx->restrictions.registered) 4146ed29b0b4SJens Axboe return -EBUSY; 4147ed29b0b4SJens Axboe 4148ed29b0b4SJens Axboe if (!arg || nr_args > IORING_MAX_RESTRICTIONS) 4149ed29b0b4SJens Axboe return -EINVAL; 4150ed29b0b4SJens Axboe 4151ed29b0b4SJens Axboe size = array_size(nr_args, sizeof(*res)); 4152ed29b0b4SJens Axboe if (size == SIZE_MAX) 4153ed29b0b4SJens Axboe return -EOVERFLOW; 4154ed29b0b4SJens Axboe 4155ed29b0b4SJens Axboe res = memdup_user(arg, size); 4156ed29b0b4SJens Axboe if (IS_ERR(res)) 4157ed29b0b4SJens Axboe return PTR_ERR(res); 4158ed29b0b4SJens Axboe 4159ed29b0b4SJens Axboe ret = 0; 4160ed29b0b4SJens Axboe 4161ed29b0b4SJens Axboe for (i = 0; i < nr_args; i++) { 4162ed29b0b4SJens Axboe switch (res[i].opcode) { 4163ed29b0b4SJens Axboe case IORING_RESTRICTION_REGISTER_OP: 4164ed29b0b4SJens Axboe if (res[i].register_op >= IORING_REGISTER_LAST) { 4165ed29b0b4SJens Axboe ret = -EINVAL; 4166ed29b0b4SJens Axboe goto out; 4167ed29b0b4SJens Axboe } 4168ed29b0b4SJens Axboe 4169ed29b0b4SJens Axboe __set_bit(res[i].register_op, 4170ed29b0b4SJens Axboe ctx->restrictions.register_op); 4171ed29b0b4SJens Axboe break; 4172ed29b0b4SJens Axboe case IORING_RESTRICTION_SQE_OP: 4173ed29b0b4SJens Axboe if (res[i].sqe_op >= IORING_OP_LAST) { 4174ed29b0b4SJens Axboe ret = -EINVAL; 4175ed29b0b4SJens Axboe goto out; 4176ed29b0b4SJens Axboe } 4177ed29b0b4SJens Axboe 4178ed29b0b4SJens Axboe __set_bit(res[i].sqe_op, ctx->restrictions.sqe_op); 4179ed29b0b4SJens Axboe break; 4180ed29b0b4SJens Axboe case IORING_RESTRICTION_SQE_FLAGS_ALLOWED: 4181ed29b0b4SJens Axboe ctx->restrictions.sqe_flags_allowed = res[i].sqe_flags; 4182ed29b0b4SJens Axboe break; 4183ed29b0b4SJens Axboe case IORING_RESTRICTION_SQE_FLAGS_REQUIRED: 4184ed29b0b4SJens Axboe ctx->restrictions.sqe_flags_required = res[i].sqe_flags; 4185ed29b0b4SJens Axboe break; 4186ed29b0b4SJens Axboe default: 4187ed29b0b4SJens Axboe ret = -EINVAL; 4188ed29b0b4SJens Axboe goto out; 4189ed29b0b4SJens Axboe } 4190ed29b0b4SJens Axboe } 4191ed29b0b4SJens Axboe 4192ed29b0b4SJens Axboe out: 4193ed29b0b4SJens Axboe /* Reset all restrictions if an error happened */ 4194ed29b0b4SJens Axboe if (ret != 0) 4195ed29b0b4SJens Axboe memset(&ctx->restrictions, 0, sizeof(ctx->restrictions)); 4196ed29b0b4SJens Axboe else 4197ed29b0b4SJens Axboe ctx->restrictions.registered = true; 4198ed29b0b4SJens Axboe 4199ed29b0b4SJens Axboe kfree(res); 4200ed29b0b4SJens Axboe return ret; 4201ed29b0b4SJens Axboe } 4202ed29b0b4SJens Axboe 4203ed29b0b4SJens Axboe static int io_register_enable_rings(struct io_ring_ctx *ctx) 4204ed29b0b4SJens Axboe { 4205ed29b0b4SJens Axboe if (!(ctx->flags & IORING_SETUP_R_DISABLED)) 4206ed29b0b4SJens Axboe return -EBADFD; 4207ed29b0b4SJens Axboe 4208bca39f39SPavel Begunkov if (ctx->flags & IORING_SETUP_SINGLE_ISSUER && !ctx->submitter_task) { 42098579538cSPavel Begunkov WRITE_ONCE(ctx->submitter_task, get_task_struct(current)); 4210bca39f39SPavel Begunkov /* 4211bca39f39SPavel Begunkov * Lazy activation attempts would fail if it was polled before 4212bca39f39SPavel Begunkov * submitter_task is set. 4213bca39f39SPavel Begunkov */ 4214bca39f39SPavel Begunkov if (wq_has_sleeper(&ctx->poll_wq)) 4215bca39f39SPavel Begunkov io_activate_pollwq(ctx); 4216bca39f39SPavel Begunkov } 42177cae596bSDylan Yudaken 4218ed29b0b4SJens Axboe if (ctx->restrictions.registered) 4219ed29b0b4SJens Axboe ctx->restricted = 1; 4220ed29b0b4SJens Axboe 4221ed29b0b4SJens Axboe ctx->flags &= ~IORING_SETUP_R_DISABLED; 4222ed29b0b4SJens Axboe if (ctx->sq_data && wq_has_sleeper(&ctx->sq_data->wait)) 4223ed29b0b4SJens Axboe wake_up(&ctx->sq_data->wait); 4224ed29b0b4SJens Axboe return 0; 4225ed29b0b4SJens Axboe } 4226ed29b0b4SJens Axboe 4227ed29b0b4SJens Axboe static __cold int io_register_iowq_aff(struct io_ring_ctx *ctx, 4228ed29b0b4SJens Axboe void __user *arg, unsigned len) 4229ed29b0b4SJens Axboe { 4230ed29b0b4SJens Axboe struct io_uring_task *tctx = current->io_uring; 4231ed29b0b4SJens Axboe cpumask_var_t new_mask; 4232ed29b0b4SJens Axboe int ret; 4233ed29b0b4SJens Axboe 4234ed29b0b4SJens Axboe if (!tctx || !tctx->io_wq) 4235ed29b0b4SJens Axboe return -EINVAL; 4236ed29b0b4SJens Axboe 4237ed29b0b4SJens Axboe if (!alloc_cpumask_var(&new_mask, GFP_KERNEL)) 4238ed29b0b4SJens Axboe return -ENOMEM; 4239ed29b0b4SJens Axboe 4240ed29b0b4SJens Axboe cpumask_clear(new_mask); 4241ed29b0b4SJens Axboe if (len > cpumask_size()) 4242ed29b0b4SJens Axboe len = cpumask_size(); 4243ed29b0b4SJens Axboe 4244ed29b0b4SJens Axboe if (in_compat_syscall()) { 4245ed29b0b4SJens Axboe ret = compat_get_bitmap(cpumask_bits(new_mask), 4246ed29b0b4SJens Axboe (const compat_ulong_t __user *)arg, 4247ed29b0b4SJens Axboe len * 8 /* CHAR_BIT */); 4248ed29b0b4SJens Axboe } else { 4249ed29b0b4SJens Axboe ret = copy_from_user(new_mask, arg, len); 4250ed29b0b4SJens Axboe } 4251ed29b0b4SJens Axboe 4252ed29b0b4SJens Axboe if (ret) { 4253ed29b0b4SJens Axboe free_cpumask_var(new_mask); 4254ed29b0b4SJens Axboe return -EFAULT; 4255ed29b0b4SJens Axboe } 4256ed29b0b4SJens Axboe 4257ed29b0b4SJens Axboe ret = io_wq_cpu_affinity(tctx->io_wq, new_mask); 4258ed29b0b4SJens Axboe free_cpumask_var(new_mask); 4259ed29b0b4SJens Axboe return ret; 4260ed29b0b4SJens Axboe } 4261ed29b0b4SJens Axboe 4262ed29b0b4SJens Axboe static __cold int io_unregister_iowq_aff(struct io_ring_ctx *ctx) 4263ed29b0b4SJens Axboe { 4264ed29b0b4SJens Axboe struct io_uring_task *tctx = current->io_uring; 4265ed29b0b4SJens Axboe 4266ed29b0b4SJens Axboe if (!tctx || !tctx->io_wq) 4267ed29b0b4SJens Axboe return -EINVAL; 4268ed29b0b4SJens Axboe 4269ed29b0b4SJens Axboe return io_wq_cpu_affinity(tctx->io_wq, NULL); 4270ed29b0b4SJens Axboe } 4271ed29b0b4SJens Axboe 4272ed29b0b4SJens Axboe static __cold int io_register_iowq_max_workers(struct io_ring_ctx *ctx, 4273ed29b0b4SJens Axboe void __user *arg) 4274ed29b0b4SJens Axboe __must_hold(&ctx->uring_lock) 4275ed29b0b4SJens Axboe { 4276ed29b0b4SJens Axboe struct io_tctx_node *node; 4277ed29b0b4SJens Axboe struct io_uring_task *tctx = NULL; 4278ed29b0b4SJens Axboe struct io_sq_data *sqd = NULL; 4279ed29b0b4SJens Axboe __u32 new_count[2]; 4280ed29b0b4SJens Axboe int i, ret; 4281ed29b0b4SJens Axboe 4282ed29b0b4SJens Axboe if (copy_from_user(new_count, arg, sizeof(new_count))) 4283ed29b0b4SJens Axboe return -EFAULT; 4284ed29b0b4SJens Axboe for (i = 0; i < ARRAY_SIZE(new_count); i++) 4285ed29b0b4SJens Axboe if (new_count[i] > INT_MAX) 4286ed29b0b4SJens Axboe return -EINVAL; 4287ed29b0b4SJens Axboe 4288ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_SQPOLL) { 4289ed29b0b4SJens Axboe sqd = ctx->sq_data; 4290ed29b0b4SJens Axboe if (sqd) { 4291ed29b0b4SJens Axboe /* 4292ed29b0b4SJens Axboe * Observe the correct sqd->lock -> ctx->uring_lock 4293ed29b0b4SJens Axboe * ordering. Fine to drop uring_lock here, we hold 4294ed29b0b4SJens Axboe * a ref to the ctx. 4295ed29b0b4SJens Axboe */ 4296ed29b0b4SJens Axboe refcount_inc(&sqd->refs); 4297ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 4298ed29b0b4SJens Axboe mutex_lock(&sqd->lock); 4299ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 4300ed29b0b4SJens Axboe if (sqd->thread) 4301ed29b0b4SJens Axboe tctx = sqd->thread->io_uring; 4302ed29b0b4SJens Axboe } 4303ed29b0b4SJens Axboe } else { 4304ed29b0b4SJens Axboe tctx = current->io_uring; 4305ed29b0b4SJens Axboe } 4306ed29b0b4SJens Axboe 4307ed29b0b4SJens Axboe BUILD_BUG_ON(sizeof(new_count) != sizeof(ctx->iowq_limits)); 4308ed29b0b4SJens Axboe 4309ed29b0b4SJens Axboe for (i = 0; i < ARRAY_SIZE(new_count); i++) 4310ed29b0b4SJens Axboe if (new_count[i]) 4311ed29b0b4SJens Axboe ctx->iowq_limits[i] = new_count[i]; 4312ed29b0b4SJens Axboe ctx->iowq_limits_set = true; 4313ed29b0b4SJens Axboe 4314ed29b0b4SJens Axboe if (tctx && tctx->io_wq) { 4315ed29b0b4SJens Axboe ret = io_wq_max_workers(tctx->io_wq, new_count); 4316ed29b0b4SJens Axboe if (ret) 4317ed29b0b4SJens Axboe goto err; 4318ed29b0b4SJens Axboe } else { 4319ed29b0b4SJens Axboe memset(new_count, 0, sizeof(new_count)); 4320ed29b0b4SJens Axboe } 4321ed29b0b4SJens Axboe 4322ed29b0b4SJens Axboe if (sqd) { 4323ed29b0b4SJens Axboe mutex_unlock(&sqd->lock); 4324ed29b0b4SJens Axboe io_put_sq_data(sqd); 4325ed29b0b4SJens Axboe } 4326ed29b0b4SJens Axboe 4327ed29b0b4SJens Axboe if (copy_to_user(arg, new_count, sizeof(new_count))) 4328ed29b0b4SJens Axboe return -EFAULT; 4329ed29b0b4SJens Axboe 4330ed29b0b4SJens Axboe /* that's it for SQPOLL, only the SQPOLL task creates requests */ 4331ed29b0b4SJens Axboe if (sqd) 4332ed29b0b4SJens Axboe return 0; 4333ed29b0b4SJens Axboe 4334ed29b0b4SJens Axboe /* now propagate the restriction to all registered users */ 4335ed29b0b4SJens Axboe list_for_each_entry(node, &ctx->tctx_list, ctx_node) { 4336ed29b0b4SJens Axboe struct io_uring_task *tctx = node->task->io_uring; 4337ed29b0b4SJens Axboe 4338ed29b0b4SJens Axboe if (WARN_ON_ONCE(!tctx->io_wq)) 4339ed29b0b4SJens Axboe continue; 4340ed29b0b4SJens Axboe 4341ed29b0b4SJens Axboe for (i = 0; i < ARRAY_SIZE(new_count); i++) 4342ed29b0b4SJens Axboe new_count[i] = ctx->iowq_limits[i]; 4343ed29b0b4SJens Axboe /* ignore errors, it always returns zero anyway */ 4344ed29b0b4SJens Axboe (void)io_wq_max_workers(tctx->io_wq, new_count); 4345ed29b0b4SJens Axboe } 4346ed29b0b4SJens Axboe return 0; 4347ed29b0b4SJens Axboe err: 4348ed29b0b4SJens Axboe if (sqd) { 4349ed29b0b4SJens Axboe mutex_unlock(&sqd->lock); 4350ed29b0b4SJens Axboe io_put_sq_data(sqd); 4351ed29b0b4SJens Axboe } 4352ed29b0b4SJens Axboe return ret; 4353ed29b0b4SJens Axboe } 4354ed29b0b4SJens Axboe 4355ed29b0b4SJens Axboe static int __io_uring_register(struct io_ring_ctx *ctx, unsigned opcode, 4356ed29b0b4SJens Axboe void __user *arg, unsigned nr_args) 4357ed29b0b4SJens Axboe __releases(ctx->uring_lock) 4358ed29b0b4SJens Axboe __acquires(ctx->uring_lock) 4359ed29b0b4SJens Axboe { 4360ed29b0b4SJens Axboe int ret; 4361ed29b0b4SJens Axboe 4362ed29b0b4SJens Axboe /* 4363fbb8bb02SPavel Begunkov * We don't quiesce the refs for register anymore and so it can't be 4364fbb8bb02SPavel Begunkov * dying as we're holding a file ref here. 4365ed29b0b4SJens Axboe */ 4366fbb8bb02SPavel Begunkov if (WARN_ON_ONCE(percpu_ref_is_dying(&ctx->refs))) 4367ed29b0b4SJens Axboe return -ENXIO; 4368ed29b0b4SJens Axboe 4369d7cce96cSPavel Begunkov if (ctx->submitter_task && ctx->submitter_task != current) 4370d7cce96cSPavel Begunkov return -EEXIST; 4371d7cce96cSPavel Begunkov 4372ed29b0b4SJens Axboe if (ctx->restricted) { 4373ed29b0b4SJens Axboe opcode = array_index_nospec(opcode, IORING_REGISTER_LAST); 4374ed29b0b4SJens Axboe if (!test_bit(opcode, ctx->restrictions.register_op)) 4375ed29b0b4SJens Axboe return -EACCES; 4376ed29b0b4SJens Axboe } 4377ed29b0b4SJens Axboe 4378ed29b0b4SJens Axboe switch (opcode) { 4379ed29b0b4SJens Axboe case IORING_REGISTER_BUFFERS: 4380ed29b0b4SJens Axboe ret = -EFAULT; 4381ed29b0b4SJens Axboe if (!arg) 4382ed29b0b4SJens Axboe break; 4383ed29b0b4SJens Axboe ret = io_sqe_buffers_register(ctx, arg, nr_args, NULL); 4384ed29b0b4SJens Axboe break; 4385ed29b0b4SJens Axboe case IORING_UNREGISTER_BUFFERS: 4386ed29b0b4SJens Axboe ret = -EINVAL; 4387ed29b0b4SJens Axboe if (arg || nr_args) 4388ed29b0b4SJens Axboe break; 4389ed29b0b4SJens Axboe ret = io_sqe_buffers_unregister(ctx); 4390ed29b0b4SJens Axboe break; 4391ed29b0b4SJens Axboe case IORING_REGISTER_FILES: 4392ed29b0b4SJens Axboe ret = -EFAULT; 4393ed29b0b4SJens Axboe if (!arg) 4394ed29b0b4SJens Axboe break; 4395ed29b0b4SJens Axboe ret = io_sqe_files_register(ctx, arg, nr_args, NULL); 4396ed29b0b4SJens Axboe break; 4397ed29b0b4SJens Axboe case IORING_UNREGISTER_FILES: 4398ed29b0b4SJens Axboe ret = -EINVAL; 4399ed29b0b4SJens Axboe if (arg || nr_args) 4400ed29b0b4SJens Axboe break; 4401ed29b0b4SJens Axboe ret = io_sqe_files_unregister(ctx); 4402ed29b0b4SJens Axboe break; 4403ed29b0b4SJens Axboe case IORING_REGISTER_FILES_UPDATE: 4404ed29b0b4SJens Axboe ret = io_register_files_update(ctx, arg, nr_args); 4405ed29b0b4SJens Axboe break; 4406ed29b0b4SJens Axboe case IORING_REGISTER_EVENTFD: 4407ed29b0b4SJens Axboe ret = -EINVAL; 4408ed29b0b4SJens Axboe if (nr_args != 1) 4409ed29b0b4SJens Axboe break; 4410ed29b0b4SJens Axboe ret = io_eventfd_register(ctx, arg, 0); 4411ed29b0b4SJens Axboe break; 4412ed29b0b4SJens Axboe case IORING_REGISTER_EVENTFD_ASYNC: 4413ed29b0b4SJens Axboe ret = -EINVAL; 4414ed29b0b4SJens Axboe if (nr_args != 1) 4415ed29b0b4SJens Axboe break; 4416ed29b0b4SJens Axboe ret = io_eventfd_register(ctx, arg, 1); 4417ed29b0b4SJens Axboe break; 4418ed29b0b4SJens Axboe case IORING_UNREGISTER_EVENTFD: 4419ed29b0b4SJens Axboe ret = -EINVAL; 4420ed29b0b4SJens Axboe if (arg || nr_args) 4421ed29b0b4SJens Axboe break; 4422ed29b0b4SJens Axboe ret = io_eventfd_unregister(ctx); 4423ed29b0b4SJens Axboe break; 4424ed29b0b4SJens Axboe case IORING_REGISTER_PROBE: 4425ed29b0b4SJens Axboe ret = -EINVAL; 4426ed29b0b4SJens Axboe if (!arg || nr_args > 256) 4427ed29b0b4SJens Axboe break; 4428ed29b0b4SJens Axboe ret = io_probe(ctx, arg, nr_args); 4429ed29b0b4SJens Axboe break; 4430ed29b0b4SJens Axboe case IORING_REGISTER_PERSONALITY: 4431ed29b0b4SJens Axboe ret = -EINVAL; 4432ed29b0b4SJens Axboe if (arg || nr_args) 4433ed29b0b4SJens Axboe break; 4434ed29b0b4SJens Axboe ret = io_register_personality(ctx); 4435ed29b0b4SJens Axboe break; 4436ed29b0b4SJens Axboe case IORING_UNREGISTER_PERSONALITY: 4437ed29b0b4SJens Axboe ret = -EINVAL; 4438ed29b0b4SJens Axboe if (arg) 4439ed29b0b4SJens Axboe break; 4440ed29b0b4SJens Axboe ret = io_unregister_personality(ctx, nr_args); 4441ed29b0b4SJens Axboe break; 4442ed29b0b4SJens Axboe case IORING_REGISTER_ENABLE_RINGS: 4443ed29b0b4SJens Axboe ret = -EINVAL; 4444ed29b0b4SJens Axboe if (arg || nr_args) 4445ed29b0b4SJens Axboe break; 4446ed29b0b4SJens Axboe ret = io_register_enable_rings(ctx); 4447ed29b0b4SJens Axboe break; 4448ed29b0b4SJens Axboe case IORING_REGISTER_RESTRICTIONS: 4449ed29b0b4SJens Axboe ret = io_register_restrictions(ctx, arg, nr_args); 4450ed29b0b4SJens Axboe break; 4451ed29b0b4SJens Axboe case IORING_REGISTER_FILES2: 4452ed29b0b4SJens Axboe ret = io_register_rsrc(ctx, arg, nr_args, IORING_RSRC_FILE); 4453ed29b0b4SJens Axboe break; 4454ed29b0b4SJens Axboe case IORING_REGISTER_FILES_UPDATE2: 4455ed29b0b4SJens Axboe ret = io_register_rsrc_update(ctx, arg, nr_args, 4456ed29b0b4SJens Axboe IORING_RSRC_FILE); 4457ed29b0b4SJens Axboe break; 4458ed29b0b4SJens Axboe case IORING_REGISTER_BUFFERS2: 4459ed29b0b4SJens Axboe ret = io_register_rsrc(ctx, arg, nr_args, IORING_RSRC_BUFFER); 4460ed29b0b4SJens Axboe break; 4461ed29b0b4SJens Axboe case IORING_REGISTER_BUFFERS_UPDATE: 4462ed29b0b4SJens Axboe ret = io_register_rsrc_update(ctx, arg, nr_args, 4463ed29b0b4SJens Axboe IORING_RSRC_BUFFER); 4464ed29b0b4SJens Axboe break; 4465ed29b0b4SJens Axboe case IORING_REGISTER_IOWQ_AFF: 4466ed29b0b4SJens Axboe ret = -EINVAL; 4467ed29b0b4SJens Axboe if (!arg || !nr_args) 4468ed29b0b4SJens Axboe break; 4469ed29b0b4SJens Axboe ret = io_register_iowq_aff(ctx, arg, nr_args); 4470ed29b0b4SJens Axboe break; 4471ed29b0b4SJens Axboe case IORING_UNREGISTER_IOWQ_AFF: 4472ed29b0b4SJens Axboe ret = -EINVAL; 4473ed29b0b4SJens Axboe if (arg || nr_args) 4474ed29b0b4SJens Axboe break; 4475ed29b0b4SJens Axboe ret = io_unregister_iowq_aff(ctx); 4476ed29b0b4SJens Axboe break; 4477ed29b0b4SJens Axboe case IORING_REGISTER_IOWQ_MAX_WORKERS: 4478ed29b0b4SJens Axboe ret = -EINVAL; 4479ed29b0b4SJens Axboe if (!arg || nr_args != 2) 4480ed29b0b4SJens Axboe break; 4481ed29b0b4SJens Axboe ret = io_register_iowq_max_workers(ctx, arg); 4482ed29b0b4SJens Axboe break; 4483ed29b0b4SJens Axboe case IORING_REGISTER_RING_FDS: 4484ed29b0b4SJens Axboe ret = io_ringfd_register(ctx, arg, nr_args); 4485ed29b0b4SJens Axboe break; 4486ed29b0b4SJens Axboe case IORING_UNREGISTER_RING_FDS: 4487ed29b0b4SJens Axboe ret = io_ringfd_unregister(ctx, arg, nr_args); 4488ed29b0b4SJens Axboe break; 4489ed29b0b4SJens Axboe case IORING_REGISTER_PBUF_RING: 4490ed29b0b4SJens Axboe ret = -EINVAL; 4491ed29b0b4SJens Axboe if (!arg || nr_args != 1) 4492ed29b0b4SJens Axboe break; 4493ed29b0b4SJens Axboe ret = io_register_pbuf_ring(ctx, arg); 4494ed29b0b4SJens Axboe break; 4495ed29b0b4SJens Axboe case IORING_UNREGISTER_PBUF_RING: 4496ed29b0b4SJens Axboe ret = -EINVAL; 4497ed29b0b4SJens Axboe if (!arg || nr_args != 1) 4498ed29b0b4SJens Axboe break; 4499ed29b0b4SJens Axboe ret = io_unregister_pbuf_ring(ctx, arg); 4500ed29b0b4SJens Axboe break; 450178a861b9SJens Axboe case IORING_REGISTER_SYNC_CANCEL: 450278a861b9SJens Axboe ret = -EINVAL; 450378a861b9SJens Axboe if (!arg || nr_args != 1) 450478a861b9SJens Axboe break; 450578a861b9SJens Axboe ret = io_sync_cancel(ctx, arg); 450678a861b9SJens Axboe break; 45076e73dffbSPavel Begunkov case IORING_REGISTER_FILE_ALLOC_RANGE: 45086e73dffbSPavel Begunkov ret = -EINVAL; 45096e73dffbSPavel Begunkov if (!arg || nr_args) 45106e73dffbSPavel Begunkov break; 45116e73dffbSPavel Begunkov ret = io_register_file_alloc_range(ctx, arg); 45126e73dffbSPavel Begunkov break; 4513ed29b0b4SJens Axboe default: 4514ed29b0b4SJens Axboe ret = -EINVAL; 4515ed29b0b4SJens Axboe break; 4516ed29b0b4SJens Axboe } 4517ed29b0b4SJens Axboe 4518ed29b0b4SJens Axboe return ret; 4519ed29b0b4SJens Axboe } 4520ed29b0b4SJens Axboe 4521ed29b0b4SJens Axboe SYSCALL_DEFINE4(io_uring_register, unsigned int, fd, unsigned int, opcode, 4522ed29b0b4SJens Axboe void __user *, arg, unsigned int, nr_args) 4523ed29b0b4SJens Axboe { 4524ed29b0b4SJens Axboe struct io_ring_ctx *ctx; 4525ed29b0b4SJens Axboe long ret = -EBADF; 4526ed29b0b4SJens Axboe struct fd f; 45277d3fd88dSJosh Triplett bool use_registered_ring; 45287d3fd88dSJosh Triplett 45297d3fd88dSJosh Triplett use_registered_ring = !!(opcode & IORING_REGISTER_USE_REGISTERED_RING); 45307d3fd88dSJosh Triplett opcode &= ~IORING_REGISTER_USE_REGISTERED_RING; 4531ed29b0b4SJens Axboe 453234319084SJens Axboe if (opcode >= IORING_REGISTER_LAST) 453334319084SJens Axboe return -EINVAL; 453434319084SJens Axboe 45357d3fd88dSJosh Triplett if (use_registered_ring) { 45367d3fd88dSJosh Triplett /* 45377d3fd88dSJosh Triplett * Ring fd has been registered via IORING_REGISTER_RING_FDS, we 45387d3fd88dSJosh Triplett * need only dereference our task private array to find it. 45397d3fd88dSJosh Triplett */ 45407d3fd88dSJosh Triplett struct io_uring_task *tctx = current->io_uring; 4541ed29b0b4SJens Axboe 45427d3fd88dSJosh Triplett if (unlikely(!tctx || fd >= IO_RINGFD_REG_MAX)) 45437d3fd88dSJosh Triplett return -EINVAL; 45447d3fd88dSJosh Triplett fd = array_index_nospec(fd, IO_RINGFD_REG_MAX); 45457d3fd88dSJosh Triplett f.file = tctx->registered_rings[fd]; 45467d3fd88dSJosh Triplett f.flags = 0; 45477d3fd88dSJosh Triplett if (unlikely(!f.file)) 45487d3fd88dSJosh Triplett return -EBADF; 45497d3fd88dSJosh Triplett } else { 45507d3fd88dSJosh Triplett f = fdget(fd); 45517d3fd88dSJosh Triplett if (unlikely(!f.file)) 45527d3fd88dSJosh Triplett return -EBADF; 4553ed29b0b4SJens Axboe ret = -EOPNOTSUPP; 4554e5550a14SJens Axboe if (!io_is_uring_fops(f.file)) 4555ed29b0b4SJens Axboe goto out_fput; 45567d3fd88dSJosh Triplett } 4557ed29b0b4SJens Axboe 4558ed29b0b4SJens Axboe ctx = f.file->private_data; 4559ed29b0b4SJens Axboe 4560ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 4561ed29b0b4SJens Axboe ret = __io_uring_register(ctx, opcode, arg, nr_args); 4562ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 4563ed29b0b4SJens Axboe trace_io_uring_register(ctx, opcode, ctx->nr_user_files, ctx->nr_user_bufs, ret); 4564ed29b0b4SJens Axboe out_fput: 4565ed29b0b4SJens Axboe fdput(f); 4566ed29b0b4SJens Axboe return ret; 4567ed29b0b4SJens Axboe } 4568ed29b0b4SJens Axboe 4569ed29b0b4SJens Axboe static int __init io_uring_init(void) 4570ed29b0b4SJens Axboe { 45719c71d39aSStefan Metzmacher #define __BUILD_BUG_VERIFY_OFFSET_SIZE(stype, eoffset, esize, ename) do { \ 4572ed29b0b4SJens Axboe BUILD_BUG_ON(offsetof(stype, ename) != eoffset); \ 45739c71d39aSStefan Metzmacher BUILD_BUG_ON(sizeof_field(stype, ename) != esize); \ 4574ed29b0b4SJens Axboe } while (0) 4575ed29b0b4SJens Axboe 4576ed29b0b4SJens Axboe #define BUILD_BUG_SQE_ELEM(eoffset, etype, ename) \ 45779c71d39aSStefan Metzmacher __BUILD_BUG_VERIFY_OFFSET_SIZE(struct io_uring_sqe, eoffset, sizeof(etype), ename) 45789c71d39aSStefan Metzmacher #define BUILD_BUG_SQE_ELEM_SIZE(eoffset, esize, ename) \ 45799c71d39aSStefan Metzmacher __BUILD_BUG_VERIFY_OFFSET_SIZE(struct io_uring_sqe, eoffset, esize, ename) 4580ed29b0b4SJens Axboe BUILD_BUG_ON(sizeof(struct io_uring_sqe) != 64); 4581ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(0, __u8, opcode); 4582ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(1, __u8, flags); 4583ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(2, __u16, ioprio); 4584ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(4, __s32, fd); 4585ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(8, __u64, off); 4586ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(8, __u64, addr2); 45879c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(8, __u32, cmd_op); 45889c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(12, __u32, __pad1); 4589ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(16, __u64, addr); 4590ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(16, __u64, splice_off_in); 4591ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(24, __u32, len); 4592ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __kernel_rwf_t, rw_flags); 4593ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, /* compat */ int, rw_flags); 4594ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, /* compat */ __u32, rw_flags); 4595ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, fsync_flags); 4596ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, /* compat */ __u16, poll_events); 4597ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, poll32_events); 4598ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, sync_range_flags); 4599ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, msg_flags); 4600ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, timeout_flags); 4601ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, accept_flags); 4602ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, cancel_flags); 4603ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, open_flags); 4604ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, statx_flags); 4605ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, fadvise_advice); 4606ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, splice_flags); 46079c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(28, __u32, rename_flags); 46089c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(28, __u32, unlink_flags); 46099c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(28, __u32, hardlink_flags); 46109c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(28, __u32, xattr_flags); 46119c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(28, __u32, msg_ring_flags); 4612ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(32, __u64, user_data); 4613ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(40, __u16, buf_index); 4614ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(40, __u16, buf_group); 4615ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(42, __u16, personality); 4616ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(44, __s32, splice_fd_in); 4617ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(44, __u32, file_index); 4618b48c312bSPavel Begunkov BUILD_BUG_SQE_ELEM(44, __u16, addr_len); 4619b48c312bSPavel Begunkov BUILD_BUG_SQE_ELEM(46, __u16, __pad3[0]); 4620ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(48, __u64, addr3); 46219c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM_SIZE(48, 0, cmd); 46229c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(56, __u64, __pad2); 4623ed29b0b4SJens Axboe 4624ed29b0b4SJens Axboe BUILD_BUG_ON(sizeof(struct io_uring_files_update) != 4625ed29b0b4SJens Axboe sizeof(struct io_uring_rsrc_update)); 4626ed29b0b4SJens Axboe BUILD_BUG_ON(sizeof(struct io_uring_rsrc_update) > 4627ed29b0b4SJens Axboe sizeof(struct io_uring_rsrc_update2)); 4628ed29b0b4SJens Axboe 4629ed29b0b4SJens Axboe /* ->buf_index is u16 */ 4630ed29b0b4SJens Axboe BUILD_BUG_ON(offsetof(struct io_uring_buf_ring, bufs) != 0); 4631ed29b0b4SJens Axboe BUILD_BUG_ON(offsetof(struct io_uring_buf, resv) != 4632ed29b0b4SJens Axboe offsetof(struct io_uring_buf_ring, tail)); 4633ed29b0b4SJens Axboe 4634ed29b0b4SJens Axboe /* should fit into one byte */ 4635ed29b0b4SJens Axboe BUILD_BUG_ON(SQE_VALID_FLAGS >= (1 << 8)); 4636ed29b0b4SJens Axboe BUILD_BUG_ON(SQE_COMMON_FLAGS >= (1 << 8)); 4637ed29b0b4SJens Axboe BUILD_BUG_ON((SQE_VALID_FLAGS | SQE_COMMON_FLAGS) != SQE_VALID_FLAGS); 4638ed29b0b4SJens Axboe 4639ed29b0b4SJens Axboe BUILD_BUG_ON(__REQ_F_LAST_BIT > 8 * sizeof(int)); 4640ed29b0b4SJens Axboe 4641ed29b0b4SJens Axboe BUILD_BUG_ON(sizeof(atomic_t) != sizeof(u32)); 4642ed29b0b4SJens Axboe 4643d9b57aa3SJens Axboe io_uring_optable_init(); 4644ed29b0b4SJens Axboe 4645ed29b0b4SJens Axboe req_cachep = KMEM_CACHE(io_kiocb, SLAB_HWCACHE_ALIGN | SLAB_PANIC | 46468751d154SPavel Begunkov SLAB_ACCOUNT | SLAB_TYPESAFE_BY_RCU); 4647ed29b0b4SJens Axboe return 0; 4648ed29b0b4SJens Axboe }; 4649ed29b0b4SJens Axboe __initcall(io_uring_init); 4650