1ed29b0b4SJens Axboe // SPDX-License-Identifier: GPL-2.0 2ed29b0b4SJens Axboe /* 3ed29b0b4SJens Axboe * Shared application/kernel submission and completion ring pairs, for 4ed29b0b4SJens Axboe * supporting fast/efficient IO. 5ed29b0b4SJens Axboe * 6ed29b0b4SJens Axboe * A note on the read/write ordering memory barriers that are matched between 7ed29b0b4SJens Axboe * the application and kernel side. 8ed29b0b4SJens Axboe * 9ed29b0b4SJens Axboe * After the application reads the CQ ring tail, it must use an 10ed29b0b4SJens Axboe * appropriate smp_rmb() to pair with the smp_wmb() the kernel uses 11ed29b0b4SJens Axboe * before writing the tail (using smp_load_acquire to read the tail will 12ed29b0b4SJens Axboe * do). It also needs a smp_mb() before updating CQ head (ordering the 13ed29b0b4SJens Axboe * entry load(s) with the head store), pairing with an implicit barrier 14ed29b0b4SJens Axboe * through a control-dependency in io_get_cqe (smp_store_release to 15ed29b0b4SJens Axboe * store head will do). Failure to do so could lead to reading invalid 16ed29b0b4SJens Axboe * CQ entries. 17ed29b0b4SJens Axboe * 18ed29b0b4SJens Axboe * Likewise, the application must use an appropriate smp_wmb() before 19ed29b0b4SJens Axboe * writing the SQ tail (ordering SQ entry stores with the tail store), 20ed29b0b4SJens Axboe * which pairs with smp_load_acquire in io_get_sqring (smp_store_release 21ed29b0b4SJens Axboe * to store the tail will do). And it needs a barrier ordering the SQ 22ed29b0b4SJens Axboe * head load before writing new SQ entries (smp_load_acquire to read 23ed29b0b4SJens Axboe * head will do). 24ed29b0b4SJens Axboe * 25ed29b0b4SJens Axboe * When using the SQ poll thread (IORING_SETUP_SQPOLL), the application 26ed29b0b4SJens Axboe * needs to check the SQ flags for IORING_SQ_NEED_WAKEUP *after* 27ed29b0b4SJens Axboe * updating the SQ tail; a full memory barrier smp_mb() is needed 28ed29b0b4SJens Axboe * between. 29ed29b0b4SJens Axboe * 30ed29b0b4SJens Axboe * Also see the examples in the liburing library: 31ed29b0b4SJens Axboe * 32ed29b0b4SJens Axboe * git://git.kernel.dk/liburing 33ed29b0b4SJens Axboe * 34ed29b0b4SJens Axboe * io_uring also uses READ/WRITE_ONCE() for _any_ store or load that happens 35ed29b0b4SJens Axboe * from data shared between the kernel and application. This is done both 36ed29b0b4SJens Axboe * for ordering purposes, but also to ensure that once a value is loaded from 37ed29b0b4SJens Axboe * data that the application could potentially modify, it remains stable. 38ed29b0b4SJens Axboe * 39ed29b0b4SJens Axboe * Copyright (C) 2018-2019 Jens Axboe 40ed29b0b4SJens Axboe * Copyright (c) 2018-2019 Christoph Hellwig 41ed29b0b4SJens Axboe */ 42ed29b0b4SJens Axboe #include <linux/kernel.h> 43ed29b0b4SJens Axboe #include <linux/init.h> 44ed29b0b4SJens Axboe #include <linux/errno.h> 45ed29b0b4SJens Axboe #include <linux/syscalls.h> 46ed29b0b4SJens Axboe #include <net/compat.h> 47ed29b0b4SJens Axboe #include <linux/refcount.h> 48ed29b0b4SJens Axboe #include <linux/uio.h> 49ed29b0b4SJens Axboe #include <linux/bits.h> 50ed29b0b4SJens Axboe 51ed29b0b4SJens Axboe #include <linux/sched/signal.h> 52ed29b0b4SJens Axboe #include <linux/fs.h> 53ed29b0b4SJens Axboe #include <linux/file.h> 54ed29b0b4SJens Axboe #include <linux/fdtable.h> 55ed29b0b4SJens Axboe #include <linux/mm.h> 56ed29b0b4SJens Axboe #include <linux/mman.h> 57ed29b0b4SJens Axboe #include <linux/percpu.h> 58ed29b0b4SJens Axboe #include <linux/slab.h> 59ed29b0b4SJens Axboe #include <linux/bvec.h> 60ed29b0b4SJens Axboe #include <linux/net.h> 61ed29b0b4SJens Axboe #include <net/sock.h> 62ed29b0b4SJens Axboe #include <net/af_unix.h> 63ed29b0b4SJens Axboe #include <net/scm.h> 64ed29b0b4SJens Axboe #include <linux/anon_inodes.h> 65ed29b0b4SJens Axboe #include <linux/sched/mm.h> 66ed29b0b4SJens Axboe #include <linux/uaccess.h> 67ed29b0b4SJens Axboe #include <linux/nospec.h> 68ed29b0b4SJens Axboe #include <linux/highmem.h> 69ed29b0b4SJens Axboe #include <linux/fsnotify.h> 70ed29b0b4SJens Axboe #include <linux/fadvise.h> 71ed29b0b4SJens Axboe #include <linux/task_work.h> 72ed29b0b4SJens Axboe #include <linux/io_uring.h> 73ed29b0b4SJens Axboe #include <linux/audit.h> 74ed29b0b4SJens Axboe #include <linux/security.h> 75ed29b0b4SJens Axboe 76ed29b0b4SJens Axboe #define CREATE_TRACE_POINTS 77ed29b0b4SJens Axboe #include <trace/events/io_uring.h> 78ed29b0b4SJens Axboe 79ed29b0b4SJens Axboe #include <uapi/linux/io_uring.h> 80ed29b0b4SJens Axboe 81ed29b0b4SJens Axboe #include "io-wq.h" 82ed29b0b4SJens Axboe 83de23077eSJens Axboe #include "io_uring.h" 84329061d3SJens Axboe #include "opdef.h" 85e418bbc9SJens Axboe #include "refs.h" 86c9f06aa7SJens Axboe #include "tctx.h" 8717437f31SJens Axboe #include "sqpoll.h" 88a4ad4f74SJens Axboe #include "fdinfo.h" 893b77495aSJens Axboe #include "kbuf.h" 9073572984SJens Axboe #include "rsrc.h" 9138513c46SHao Xu #include "cancel.h" 9243e0bbbdSJens Axboe #include "net.h" 93eb42cebbSPavel Begunkov #include "notif.h" 94e27f928eSJens Axboe 9559915143SJens Axboe #include "timeout.h" 96329061d3SJens Axboe #include "poll.h" 979b797a37SJens Axboe #include "alloc_cache.h" 985e2a18d9SJens Axboe 99ed29b0b4SJens Axboe #define IORING_MAX_ENTRIES 32768 100ed29b0b4SJens Axboe #define IORING_MAX_CQ_ENTRIES (2 * IORING_MAX_ENTRIES) 101ed29b0b4SJens Axboe 102ed29b0b4SJens Axboe #define IORING_MAX_RESTRICTIONS (IORING_RESTRICTION_LAST + \ 103ed29b0b4SJens Axboe IORING_REGISTER_LAST + IORING_OP_LAST) 104ed29b0b4SJens Axboe 105ed29b0b4SJens Axboe #define SQE_COMMON_FLAGS (IOSQE_FIXED_FILE | IOSQE_IO_LINK | \ 106ed29b0b4SJens Axboe IOSQE_IO_HARDLINK | IOSQE_ASYNC) 107ed29b0b4SJens Axboe 108ed29b0b4SJens Axboe #define SQE_VALID_FLAGS (SQE_COMMON_FLAGS | IOSQE_BUFFER_SELECT | \ 109ed29b0b4SJens Axboe IOSQE_IO_DRAIN | IOSQE_CQE_SKIP_SUCCESS) 110ed29b0b4SJens Axboe 111ed29b0b4SJens Axboe #define IO_REQ_CLEAN_FLAGS (REQ_F_BUFFER_SELECTED | REQ_F_NEED_CLEANUP | \ 112ed29b0b4SJens Axboe REQ_F_POLLED | REQ_F_INFLIGHT | REQ_F_CREDS | \ 113ed29b0b4SJens Axboe REQ_F_ASYNC_DATA) 114ed29b0b4SJens Axboe 115ed29b0b4SJens Axboe #define IO_REQ_CLEAN_SLOW_FLAGS (REQ_F_REFCOUNT | REQ_F_LINK | REQ_F_HARDLINK |\ 116ed29b0b4SJens Axboe IO_REQ_CLEAN_FLAGS) 117ed29b0b4SJens Axboe 118ed29b0b4SJens Axboe #define IO_TCTX_REFS_CACHE_NR (1U << 10) 119ed29b0b4SJens Axboe 120ed29b0b4SJens Axboe #define IO_COMPL_BATCH 32 121ed29b0b4SJens Axboe #define IO_REQ_ALLOC_BATCH 8 122ed29b0b4SJens Axboe 123ed29b0b4SJens Axboe enum { 124ed29b0b4SJens Axboe IO_CHECK_CQ_OVERFLOW_BIT, 125ed29b0b4SJens Axboe IO_CHECK_CQ_DROPPED_BIT, 126ed29b0b4SJens Axboe }; 127ed29b0b4SJens Axboe 128ed29b0b4SJens Axboe struct io_defer_entry { 129ed29b0b4SJens Axboe struct list_head list; 130ed29b0b4SJens Axboe struct io_kiocb *req; 131ed29b0b4SJens Axboe u32 seq; 132ed29b0b4SJens Axboe }; 133ed29b0b4SJens Axboe 134ed29b0b4SJens Axboe /* requests with any of those set should undergo io_disarm_next() */ 135ed29b0b4SJens Axboe #define IO_DISARM_MASK (REQ_F_ARM_LTIMEOUT | REQ_F_LINK_TIMEOUT | REQ_F_FAIL) 136ed29b0b4SJens Axboe #define IO_REQ_LINK_FLAGS (REQ_F_LINK | REQ_F_HARDLINK) 137ed29b0b4SJens Axboe 138affa87dbSPavel Begunkov static bool io_uring_try_cancel_requests(struct io_ring_ctx *ctx, 139ed29b0b4SJens Axboe struct task_struct *task, 140ed29b0b4SJens Axboe bool cancel_all); 141ed29b0b4SJens Axboe 142ed29b0b4SJens Axboe static void io_dismantle_req(struct io_kiocb *req); 143ed29b0b4SJens Axboe static void io_clean_op(struct io_kiocb *req); 144ed29b0b4SJens Axboe static void io_queue_sqe(struct io_kiocb *req); 145ed29b0b4SJens Axboe 146ed29b0b4SJens Axboe static void __io_submit_flush_completions(struct io_ring_ctx *ctx); 147ed29b0b4SJens Axboe 148ed29b0b4SJens Axboe static struct kmem_cache *req_cachep; 149ed29b0b4SJens Axboe 150ed29b0b4SJens Axboe struct sock *io_uring_get_socket(struct file *file) 151ed29b0b4SJens Axboe { 152ed29b0b4SJens Axboe #if defined(CONFIG_UNIX) 153cd40cae2SJens Axboe if (io_is_uring_fops(file)) { 154ed29b0b4SJens Axboe struct io_ring_ctx *ctx = file->private_data; 155ed29b0b4SJens Axboe 156ed29b0b4SJens Axboe return ctx->ring_sock->sk; 157ed29b0b4SJens Axboe } 158ed29b0b4SJens Axboe #endif 159ed29b0b4SJens Axboe return NULL; 160ed29b0b4SJens Axboe } 161ed29b0b4SJens Axboe EXPORT_SYMBOL(io_uring_get_socket); 162ed29b0b4SJens Axboe 163ed29b0b4SJens Axboe static inline void io_submit_flush_completions(struct io_ring_ctx *ctx) 164ed29b0b4SJens Axboe { 165ed29b0b4SJens Axboe if (!wq_list_empty(&ctx->submit_state.compl_reqs)) 166ed29b0b4SJens Axboe __io_submit_flush_completions(ctx); 167ed29b0b4SJens Axboe } 168ed29b0b4SJens Axboe 169faf88ddeSPavel Begunkov static inline unsigned int __io_cqring_events(struct io_ring_ctx *ctx) 170faf88ddeSPavel Begunkov { 171faf88ddeSPavel Begunkov return ctx->cached_cq_tail - READ_ONCE(ctx->rings->cq.head); 172faf88ddeSPavel Begunkov } 173faf88ddeSPavel Begunkov 174ed29b0b4SJens Axboe static bool io_match_linked(struct io_kiocb *head) 175ed29b0b4SJens Axboe { 176ed29b0b4SJens Axboe struct io_kiocb *req; 177ed29b0b4SJens Axboe 178ed29b0b4SJens Axboe io_for_each_link(req, head) { 179ed29b0b4SJens Axboe if (req->flags & REQ_F_INFLIGHT) 180ed29b0b4SJens Axboe return true; 181ed29b0b4SJens Axboe } 182ed29b0b4SJens Axboe return false; 183ed29b0b4SJens Axboe } 184ed29b0b4SJens Axboe 185ed29b0b4SJens Axboe /* 186ed29b0b4SJens Axboe * As io_match_task() but protected against racing with linked timeouts. 187ed29b0b4SJens Axboe * User must not hold timeout_lock. 188ed29b0b4SJens Axboe */ 189329061d3SJens Axboe bool io_match_task_safe(struct io_kiocb *head, struct task_struct *task, 190ed29b0b4SJens Axboe bool cancel_all) 191ed29b0b4SJens Axboe { 192ed29b0b4SJens Axboe bool matched; 193ed29b0b4SJens Axboe 194ed29b0b4SJens Axboe if (task && head->task != task) 195ed29b0b4SJens Axboe return false; 196ed29b0b4SJens Axboe if (cancel_all) 197ed29b0b4SJens Axboe return true; 198ed29b0b4SJens Axboe 199ed29b0b4SJens Axboe if (head->flags & REQ_F_LINK_TIMEOUT) { 200ed29b0b4SJens Axboe struct io_ring_ctx *ctx = head->ctx; 201ed29b0b4SJens Axboe 202ed29b0b4SJens Axboe /* protect against races with linked timeouts */ 203ed29b0b4SJens Axboe spin_lock_irq(&ctx->timeout_lock); 204ed29b0b4SJens Axboe matched = io_match_linked(head); 205ed29b0b4SJens Axboe spin_unlock_irq(&ctx->timeout_lock); 206ed29b0b4SJens Axboe } else { 207ed29b0b4SJens Axboe matched = io_match_linked(head); 208ed29b0b4SJens Axboe } 209ed29b0b4SJens Axboe return matched; 210ed29b0b4SJens Axboe } 211ed29b0b4SJens Axboe 212ed29b0b4SJens Axboe static inline void req_fail_link_node(struct io_kiocb *req, int res) 213ed29b0b4SJens Axboe { 214ed29b0b4SJens Axboe req_set_fail(req); 21597b388d7SJens Axboe io_req_set_res(req, res, 0); 216ed29b0b4SJens Axboe } 217ed29b0b4SJens Axboe 218ed29b0b4SJens Axboe static inline void io_req_add_to_cache(struct io_kiocb *req, struct io_ring_ctx *ctx) 219ed29b0b4SJens Axboe { 220ed29b0b4SJens Axboe wq_stack_add_head(&req->comp_list, &ctx->submit_state.free_list); 221ed29b0b4SJens Axboe } 222ed29b0b4SJens Axboe 223ed29b0b4SJens Axboe static __cold void io_ring_ctx_ref_free(struct percpu_ref *ref) 224ed29b0b4SJens Axboe { 225ed29b0b4SJens Axboe struct io_ring_ctx *ctx = container_of(ref, struct io_ring_ctx, refs); 226ed29b0b4SJens Axboe 227ed29b0b4SJens Axboe complete(&ctx->ref_comp); 228ed29b0b4SJens Axboe } 229ed29b0b4SJens Axboe 230ed29b0b4SJens Axboe static __cold void io_fallback_req_func(struct work_struct *work) 231ed29b0b4SJens Axboe { 232ed29b0b4SJens Axboe struct io_ring_ctx *ctx = container_of(work, struct io_ring_ctx, 233ed29b0b4SJens Axboe fallback_work.work); 234ed29b0b4SJens Axboe struct llist_node *node = llist_del_all(&ctx->fallback_llist); 235ed29b0b4SJens Axboe struct io_kiocb *req, *tmp; 236ed29b0b4SJens Axboe bool locked = false; 237ed29b0b4SJens Axboe 238ed29b0b4SJens Axboe percpu_ref_get(&ctx->refs); 2393218e5d3SPavel Begunkov llist_for_each_entry_safe(req, tmp, node, io_task_work.node) 240ed29b0b4SJens Axboe req->io_task_work.func(req, &locked); 241ed29b0b4SJens Axboe 242ed29b0b4SJens Axboe if (locked) { 243ed29b0b4SJens Axboe io_submit_flush_completions(ctx); 244ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 245ed29b0b4SJens Axboe } 246ed29b0b4SJens Axboe percpu_ref_put(&ctx->refs); 247ed29b0b4SJens Axboe } 248ed29b0b4SJens Axboe 249e6f89be6SPavel Begunkov static int io_alloc_hash_table(struct io_hash_table *table, unsigned bits) 250e6f89be6SPavel Begunkov { 251e6f89be6SPavel Begunkov unsigned hash_buckets = 1U << bits; 252e6f89be6SPavel Begunkov size_t hash_size = hash_buckets * sizeof(table->hbs[0]); 253e6f89be6SPavel Begunkov 254e6f89be6SPavel Begunkov table->hbs = kmalloc(hash_size, GFP_KERNEL); 255e6f89be6SPavel Begunkov if (!table->hbs) 256e6f89be6SPavel Begunkov return -ENOMEM; 257e6f89be6SPavel Begunkov 258e6f89be6SPavel Begunkov table->hash_bits = bits; 259e6f89be6SPavel Begunkov init_hash_table(table, hash_buckets); 260e6f89be6SPavel Begunkov return 0; 261e6f89be6SPavel Begunkov } 262e6f89be6SPavel Begunkov 263ed29b0b4SJens Axboe static __cold struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p) 264ed29b0b4SJens Axboe { 265ed29b0b4SJens Axboe struct io_ring_ctx *ctx; 266ed29b0b4SJens Axboe int hash_bits; 267ed29b0b4SJens Axboe 268ed29b0b4SJens Axboe ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); 269ed29b0b4SJens Axboe if (!ctx) 270ed29b0b4SJens Axboe return NULL; 271ed29b0b4SJens Axboe 272ed29b0b4SJens Axboe xa_init(&ctx->io_bl_xa); 273ed29b0b4SJens Axboe 274ed29b0b4SJens Axboe /* 275ed29b0b4SJens Axboe * Use 5 bits less than the max cq entries, that should give us around 2764a07723fSPavel Begunkov * 32 entries per hash list if totally full and uniformly spread, but 2774a07723fSPavel Begunkov * don't keep too many buckets to not overconsume memory. 278ed29b0b4SJens Axboe */ 2794a07723fSPavel Begunkov hash_bits = ilog2(p->cq_entries) - 5; 2804a07723fSPavel Begunkov hash_bits = clamp(hash_bits, 1, 8); 281e6f89be6SPavel Begunkov if (io_alloc_hash_table(&ctx->cancel_table, hash_bits)) 282ed29b0b4SJens Axboe goto err; 2839ca9fb24SPavel Begunkov if (io_alloc_hash_table(&ctx->cancel_table_locked, hash_bits)) 2849ca9fb24SPavel Begunkov goto err; 28538513c46SHao Xu 286ed29b0b4SJens Axboe ctx->dummy_ubuf = kzalloc(sizeof(*ctx->dummy_ubuf), GFP_KERNEL); 287ed29b0b4SJens Axboe if (!ctx->dummy_ubuf) 288ed29b0b4SJens Axboe goto err; 289ed29b0b4SJens Axboe /* set invalid range, so io_import_fixed() fails meeting it */ 290ed29b0b4SJens Axboe ctx->dummy_ubuf->ubuf = -1UL; 291ed29b0b4SJens Axboe 292ed29b0b4SJens Axboe if (percpu_ref_init(&ctx->refs, io_ring_ctx_ref_free, 29348904229SMichal Koutný 0, GFP_KERNEL)) 294ed29b0b4SJens Axboe goto err; 295ed29b0b4SJens Axboe 296ed29b0b4SJens Axboe ctx->flags = p->flags; 297ed29b0b4SJens Axboe init_waitqueue_head(&ctx->sqo_sq_wait); 298ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->sqd_list); 299ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->cq_overflow_list); 300ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->io_buffers_cache); 3019b797a37SJens Axboe io_alloc_cache_init(&ctx->apoll_cache); 30243e0bbbdSJens Axboe io_alloc_cache_init(&ctx->netmsg_cache); 303ed29b0b4SJens Axboe init_completion(&ctx->ref_comp); 304ed29b0b4SJens Axboe xa_init_flags(&ctx->personalities, XA_FLAGS_ALLOC1); 305ed29b0b4SJens Axboe mutex_init(&ctx->uring_lock); 306ed29b0b4SJens Axboe init_waitqueue_head(&ctx->cq_wait); 307ed29b0b4SJens Axboe spin_lock_init(&ctx->completion_lock); 308ed29b0b4SJens Axboe spin_lock_init(&ctx->timeout_lock); 309ed29b0b4SJens Axboe INIT_WQ_LIST(&ctx->iopoll_list); 310ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->io_buffers_pages); 311ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->io_buffers_comp); 312ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->defer_list); 313ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->timeout_list); 314ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->ltimeout_list); 315ed29b0b4SJens Axboe spin_lock_init(&ctx->rsrc_ref_lock); 316ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->rsrc_ref_list); 317ed29b0b4SJens Axboe INIT_DELAYED_WORK(&ctx->rsrc_put_work, io_rsrc_put_work); 318ed29b0b4SJens Axboe init_llist_head(&ctx->rsrc_put_llist); 319ed29b0b4SJens Axboe INIT_LIST_HEAD(&ctx->tctx_list); 320ed29b0b4SJens Axboe ctx->submit_state.free_list.next = NULL; 321ed29b0b4SJens Axboe INIT_WQ_LIST(&ctx->locked_free_list); 322ed29b0b4SJens Axboe INIT_DELAYED_WORK(&ctx->fallback_work, io_fallback_req_func); 323ed29b0b4SJens Axboe INIT_WQ_LIST(&ctx->submit_state.compl_reqs); 324ed29b0b4SJens Axboe return ctx; 325ed29b0b4SJens Axboe err: 326ed29b0b4SJens Axboe kfree(ctx->dummy_ubuf); 327e6f89be6SPavel Begunkov kfree(ctx->cancel_table.hbs); 3289ca9fb24SPavel Begunkov kfree(ctx->cancel_table_locked.hbs); 329ed29b0b4SJens Axboe kfree(ctx->io_bl); 330ed29b0b4SJens Axboe xa_destroy(&ctx->io_bl_xa); 331ed29b0b4SJens Axboe kfree(ctx); 332ed29b0b4SJens Axboe return NULL; 333ed29b0b4SJens Axboe } 334ed29b0b4SJens Axboe 335ed29b0b4SJens Axboe static void io_account_cq_overflow(struct io_ring_ctx *ctx) 336ed29b0b4SJens Axboe { 337ed29b0b4SJens Axboe struct io_rings *r = ctx->rings; 338ed29b0b4SJens Axboe 339ed29b0b4SJens Axboe WRITE_ONCE(r->cq_overflow, READ_ONCE(r->cq_overflow) + 1); 340ed29b0b4SJens Axboe ctx->cq_extra--; 341ed29b0b4SJens Axboe } 342ed29b0b4SJens Axboe 343ed29b0b4SJens Axboe static bool req_need_defer(struct io_kiocb *req, u32 seq) 344ed29b0b4SJens Axboe { 345ed29b0b4SJens Axboe if (unlikely(req->flags & REQ_F_IO_DRAIN)) { 346ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 347ed29b0b4SJens Axboe 348ed29b0b4SJens Axboe return seq + READ_ONCE(ctx->cq_extra) != ctx->cached_cq_tail; 349ed29b0b4SJens Axboe } 350ed29b0b4SJens Axboe 351ed29b0b4SJens Axboe return false; 352ed29b0b4SJens Axboe } 353ed29b0b4SJens Axboe 354ed29b0b4SJens Axboe static inline void io_req_track_inflight(struct io_kiocb *req) 355ed29b0b4SJens Axboe { 356ed29b0b4SJens Axboe if (!(req->flags & REQ_F_INFLIGHT)) { 357ed29b0b4SJens Axboe req->flags |= REQ_F_INFLIGHT; 358ed29b0b4SJens Axboe atomic_inc(&req->task->io_uring->inflight_tracked); 359ed29b0b4SJens Axboe } 360ed29b0b4SJens Axboe } 361ed29b0b4SJens Axboe 362ed29b0b4SJens Axboe static struct io_kiocb *__io_prep_linked_timeout(struct io_kiocb *req) 363ed29b0b4SJens Axboe { 364ed29b0b4SJens Axboe if (WARN_ON_ONCE(!req->link)) 365ed29b0b4SJens Axboe return NULL; 366ed29b0b4SJens Axboe 367ed29b0b4SJens Axboe req->flags &= ~REQ_F_ARM_LTIMEOUT; 368ed29b0b4SJens Axboe req->flags |= REQ_F_LINK_TIMEOUT; 369ed29b0b4SJens Axboe 370ed29b0b4SJens Axboe /* linked timeouts should have two refs once prep'ed */ 371ed29b0b4SJens Axboe io_req_set_refcount(req); 372ed29b0b4SJens Axboe __io_req_set_refcount(req->link, 2); 373ed29b0b4SJens Axboe return req->link; 374ed29b0b4SJens Axboe } 375ed29b0b4SJens Axboe 376ed29b0b4SJens Axboe static inline struct io_kiocb *io_prep_linked_timeout(struct io_kiocb *req) 377ed29b0b4SJens Axboe { 378ed29b0b4SJens Axboe if (likely(!(req->flags & REQ_F_ARM_LTIMEOUT))) 379ed29b0b4SJens Axboe return NULL; 380ed29b0b4SJens Axboe return __io_prep_linked_timeout(req); 381ed29b0b4SJens Axboe } 382ed29b0b4SJens Axboe 383ed29b0b4SJens Axboe static noinline void __io_arm_ltimeout(struct io_kiocb *req) 384ed29b0b4SJens Axboe { 385ed29b0b4SJens Axboe io_queue_linked_timeout(__io_prep_linked_timeout(req)); 386ed29b0b4SJens Axboe } 387ed29b0b4SJens Axboe 388ed29b0b4SJens Axboe static inline void io_arm_ltimeout(struct io_kiocb *req) 389ed29b0b4SJens Axboe { 390ed29b0b4SJens Axboe if (unlikely(req->flags & REQ_F_ARM_LTIMEOUT)) 391ed29b0b4SJens Axboe __io_arm_ltimeout(req); 392ed29b0b4SJens Axboe } 393ed29b0b4SJens Axboe 394ed29b0b4SJens Axboe static void io_prep_async_work(struct io_kiocb *req) 395ed29b0b4SJens Axboe { 396ed29b0b4SJens Axboe const struct io_op_def *def = &io_op_defs[req->opcode]; 397ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 398ed29b0b4SJens Axboe 399ed29b0b4SJens Axboe if (!(req->flags & REQ_F_CREDS)) { 400ed29b0b4SJens Axboe req->flags |= REQ_F_CREDS; 401ed29b0b4SJens Axboe req->creds = get_current_cred(); 402ed29b0b4SJens Axboe } 403ed29b0b4SJens Axboe 404ed29b0b4SJens Axboe req->work.list.next = NULL; 405ed29b0b4SJens Axboe req->work.flags = 0; 406ed29b0b4SJens Axboe req->work.cancel_seq = atomic_read(&ctx->cancel_seq); 407ed29b0b4SJens Axboe if (req->flags & REQ_F_FORCE_ASYNC) 408ed29b0b4SJens Axboe req->work.flags |= IO_WQ_WORK_CONCURRENT; 409ed29b0b4SJens Axboe 410f6b543fdSJens Axboe if (req->file && !io_req_ffs_set(req)) 411f6b543fdSJens Axboe req->flags |= io_file_get_flags(req->file) << REQ_F_SUPPORT_NOWAIT_BIT; 412f6b543fdSJens Axboe 413ed29b0b4SJens Axboe if (req->flags & REQ_F_ISREG) { 414ed29b0b4SJens Axboe if (def->hash_reg_file || (ctx->flags & IORING_SETUP_IOPOLL)) 415ed29b0b4SJens Axboe io_wq_hash_work(&req->work, file_inode(req->file)); 416ed29b0b4SJens Axboe } else if (!req->file || !S_ISBLK(file_inode(req->file)->i_mode)) { 417ed29b0b4SJens Axboe if (def->unbound_nonreg_file) 418ed29b0b4SJens Axboe req->work.flags |= IO_WQ_WORK_UNBOUND; 419ed29b0b4SJens Axboe } 420ed29b0b4SJens Axboe } 421ed29b0b4SJens Axboe 422ed29b0b4SJens Axboe static void io_prep_async_link(struct io_kiocb *req) 423ed29b0b4SJens Axboe { 424ed29b0b4SJens Axboe struct io_kiocb *cur; 425ed29b0b4SJens Axboe 426ed29b0b4SJens Axboe if (req->flags & REQ_F_LINK_TIMEOUT) { 427ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 428ed29b0b4SJens Axboe 429ed29b0b4SJens Axboe spin_lock_irq(&ctx->timeout_lock); 430ed29b0b4SJens Axboe io_for_each_link(cur, req) 431ed29b0b4SJens Axboe io_prep_async_work(cur); 432ed29b0b4SJens Axboe spin_unlock_irq(&ctx->timeout_lock); 433ed29b0b4SJens Axboe } else { 434ed29b0b4SJens Axboe io_for_each_link(cur, req) 435ed29b0b4SJens Axboe io_prep_async_work(cur); 436ed29b0b4SJens Axboe } 437ed29b0b4SJens Axboe } 438ed29b0b4SJens Axboe 439f3b44f92SJens Axboe void io_queue_iowq(struct io_kiocb *req, bool *dont_use) 440ed29b0b4SJens Axboe { 441ed29b0b4SJens Axboe struct io_kiocb *link = io_prep_linked_timeout(req); 442ed29b0b4SJens Axboe struct io_uring_task *tctx = req->task->io_uring; 443ed29b0b4SJens Axboe 444ed29b0b4SJens Axboe BUG_ON(!tctx); 445ed29b0b4SJens Axboe BUG_ON(!tctx->io_wq); 446ed29b0b4SJens Axboe 447ed29b0b4SJens Axboe /* init ->work of the whole link before punting */ 448ed29b0b4SJens Axboe io_prep_async_link(req); 449ed29b0b4SJens Axboe 450ed29b0b4SJens Axboe /* 451ed29b0b4SJens Axboe * Not expected to happen, but if we do have a bug where this _can_ 452ed29b0b4SJens Axboe * happen, catch it here and ensure the request is marked as 453ed29b0b4SJens Axboe * canceled. That will make io-wq go through the usual work cancel 454ed29b0b4SJens Axboe * procedure rather than attempt to run this request (or create a new 455ed29b0b4SJens Axboe * worker for it). 456ed29b0b4SJens Axboe */ 457ed29b0b4SJens Axboe if (WARN_ON_ONCE(!same_thread_group(req->task, current))) 458ed29b0b4SJens Axboe req->work.flags |= IO_WQ_WORK_CANCEL; 459ed29b0b4SJens Axboe 46048863ffdSPavel Begunkov trace_io_uring_queue_async_work(req, io_wq_is_hashed(&req->work)); 461ed29b0b4SJens Axboe io_wq_enqueue(tctx->io_wq, &req->work); 462ed29b0b4SJens Axboe if (link) 463ed29b0b4SJens Axboe io_queue_linked_timeout(link); 464ed29b0b4SJens Axboe } 465ed29b0b4SJens Axboe 466ed29b0b4SJens Axboe static __cold void io_queue_deferred(struct io_ring_ctx *ctx) 467ed29b0b4SJens Axboe { 468ed29b0b4SJens Axboe while (!list_empty(&ctx->defer_list)) { 469ed29b0b4SJens Axboe struct io_defer_entry *de = list_first_entry(&ctx->defer_list, 470ed29b0b4SJens Axboe struct io_defer_entry, list); 471ed29b0b4SJens Axboe 472ed29b0b4SJens Axboe if (req_need_defer(de->req, de->seq)) 473ed29b0b4SJens Axboe break; 474ed29b0b4SJens Axboe list_del_init(&de->list); 475ed29b0b4SJens Axboe io_req_task_queue(de->req); 476ed29b0b4SJens Axboe kfree(de); 477ed29b0b4SJens Axboe } 478ed29b0b4SJens Axboe } 479ed29b0b4SJens Axboe 480ed29b0b4SJens Axboe static void io_eventfd_signal(struct io_ring_ctx *ctx) 481ed29b0b4SJens Axboe { 482ed29b0b4SJens Axboe struct io_ev_fd *ev_fd; 483305bef98SPavel Begunkov bool skip; 484305bef98SPavel Begunkov 485305bef98SPavel Begunkov spin_lock(&ctx->completion_lock); 486305bef98SPavel Begunkov /* 487305bef98SPavel Begunkov * Eventfd should only get triggered when at least one event has been 488305bef98SPavel Begunkov * posted. Some applications rely on the eventfd notification count only 489305bef98SPavel Begunkov * changing IFF a new CQE has been added to the CQ ring. There's no 490305bef98SPavel Begunkov * depedency on 1:1 relationship between how many times this function is 491305bef98SPavel Begunkov * called (and hence the eventfd count) and number of CQEs posted to the 492305bef98SPavel Begunkov * CQ ring. 493305bef98SPavel Begunkov */ 494305bef98SPavel Begunkov skip = ctx->cached_cq_tail == ctx->evfd_last_cq_tail; 495305bef98SPavel Begunkov ctx->evfd_last_cq_tail = ctx->cached_cq_tail; 496305bef98SPavel Begunkov spin_unlock(&ctx->completion_lock); 497305bef98SPavel Begunkov if (skip) 498305bef98SPavel Begunkov return; 499ed29b0b4SJens Axboe 500ed29b0b4SJens Axboe rcu_read_lock(); 501ed29b0b4SJens Axboe /* 502ed29b0b4SJens Axboe * rcu_dereference ctx->io_ev_fd once and use it for both for checking 503ed29b0b4SJens Axboe * and eventfd_signal 504ed29b0b4SJens Axboe */ 505ed29b0b4SJens Axboe ev_fd = rcu_dereference(ctx->io_ev_fd); 506ed29b0b4SJens Axboe 507ed29b0b4SJens Axboe /* 508ed29b0b4SJens Axboe * Check again if ev_fd exists incase an io_eventfd_unregister call 509ed29b0b4SJens Axboe * completed between the NULL check of ctx->io_ev_fd at the start of 510ed29b0b4SJens Axboe * the function and rcu_read_lock. 511ed29b0b4SJens Axboe */ 512ed29b0b4SJens Axboe if (unlikely(!ev_fd)) 513ed29b0b4SJens Axboe goto out; 514ed29b0b4SJens Axboe if (READ_ONCE(ctx->rings->cq_flags) & IORING_CQ_EVENTFD_DISABLED) 515ed29b0b4SJens Axboe goto out; 516ed29b0b4SJens Axboe 517ed29b0b4SJens Axboe if (!ev_fd->eventfd_async || io_wq_current_is_worker()) 518ed29b0b4SJens Axboe eventfd_signal(ev_fd->cq_ev_fd, 1); 519ed29b0b4SJens Axboe out: 520ed29b0b4SJens Axboe rcu_read_unlock(); 521ed29b0b4SJens Axboe } 522ed29b0b4SJens Axboe 523a830ffd2SPavel Begunkov void __io_commit_cqring_flush(struct io_ring_ctx *ctx) 524a830ffd2SPavel Begunkov { 525a830ffd2SPavel Begunkov if (ctx->off_timeout_used || ctx->drain_active) { 526a830ffd2SPavel Begunkov spin_lock(&ctx->completion_lock); 527a830ffd2SPavel Begunkov if (ctx->off_timeout_used) 528a830ffd2SPavel Begunkov io_flush_timeouts(ctx); 529a830ffd2SPavel Begunkov if (ctx->drain_active) 530a830ffd2SPavel Begunkov io_queue_deferred(ctx); 531a830ffd2SPavel Begunkov spin_unlock(&ctx->completion_lock); 532a830ffd2SPavel Begunkov } 533a830ffd2SPavel Begunkov if (ctx->has_evfd) 534a830ffd2SPavel Begunkov io_eventfd_signal(ctx); 535a830ffd2SPavel Begunkov } 536a830ffd2SPavel Begunkov 53725399321SPavel Begunkov static inline void io_cqring_ev_posted(struct io_ring_ctx *ctx) 538ed29b0b4SJens Axboe { 53946929b08SPavel Begunkov io_commit_cqring_flush(ctx); 540ed29b0b4SJens Axboe io_cqring_wake(ctx); 541ed29b0b4SJens Axboe } 542ed29b0b4SJens Axboe 54325399321SPavel Begunkov static inline void __io_cq_unlock_post(struct io_ring_ctx *ctx) 54425399321SPavel Begunkov __releases(ctx->completion_lock) 54525399321SPavel Begunkov { 54625399321SPavel Begunkov io_commit_cqring(ctx); 54725399321SPavel Begunkov spin_unlock(&ctx->completion_lock); 54825399321SPavel Begunkov io_cqring_ev_posted(ctx); 54925399321SPavel Begunkov } 55025399321SPavel Begunkov 55125399321SPavel Begunkov void io_cq_unlock_post(struct io_ring_ctx *ctx) 55225399321SPavel Begunkov { 55325399321SPavel Begunkov __io_cq_unlock_post(ctx); 55425399321SPavel Begunkov } 55525399321SPavel Begunkov 556ed29b0b4SJens Axboe /* Returns true if there are no backlogged entries after the flush */ 557ed29b0b4SJens Axboe static bool __io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool force) 558ed29b0b4SJens Axboe { 559305bef98SPavel Begunkov bool all_flushed; 560ed29b0b4SJens Axboe size_t cqe_size = sizeof(struct io_uring_cqe); 561ed29b0b4SJens Axboe 562ed29b0b4SJens Axboe if (!force && __io_cqring_events(ctx) == ctx->cq_entries) 563ed29b0b4SJens Axboe return false; 564ed29b0b4SJens Axboe 565ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_CQE32) 566ed29b0b4SJens Axboe cqe_size <<= 1; 567ed29b0b4SJens Axboe 56825399321SPavel Begunkov io_cq_lock(ctx); 569ed29b0b4SJens Axboe while (!list_empty(&ctx->cq_overflow_list)) { 570ed29b0b4SJens Axboe struct io_uring_cqe *cqe = io_get_cqe(ctx); 571ed29b0b4SJens Axboe struct io_overflow_cqe *ocqe; 572ed29b0b4SJens Axboe 573ed29b0b4SJens Axboe if (!cqe && !force) 574ed29b0b4SJens Axboe break; 575ed29b0b4SJens Axboe ocqe = list_first_entry(&ctx->cq_overflow_list, 576ed29b0b4SJens Axboe struct io_overflow_cqe, list); 577ed29b0b4SJens Axboe if (cqe) 578ed29b0b4SJens Axboe memcpy(cqe, &ocqe->cqe, cqe_size); 579ed29b0b4SJens Axboe else 580ed29b0b4SJens Axboe io_account_cq_overflow(ctx); 581ed29b0b4SJens Axboe 582ed29b0b4SJens Axboe list_del(&ocqe->list); 583ed29b0b4SJens Axboe kfree(ocqe); 584ed29b0b4SJens Axboe } 585ed29b0b4SJens Axboe 586ed29b0b4SJens Axboe all_flushed = list_empty(&ctx->cq_overflow_list); 587ed29b0b4SJens Axboe if (all_flushed) { 588ed29b0b4SJens Axboe clear_bit(IO_CHECK_CQ_OVERFLOW_BIT, &ctx->check_cq); 589ed29b0b4SJens Axboe atomic_andnot(IORING_SQ_CQ_OVERFLOW, &ctx->rings->sq_flags); 590ed29b0b4SJens Axboe } 591ed29b0b4SJens Axboe 59225399321SPavel Begunkov io_cq_unlock_post(ctx); 593ed29b0b4SJens Axboe return all_flushed; 594ed29b0b4SJens Axboe } 595ed29b0b4SJens Axboe 596ed29b0b4SJens Axboe static bool io_cqring_overflow_flush(struct io_ring_ctx *ctx) 597ed29b0b4SJens Axboe { 598ed29b0b4SJens Axboe bool ret = true; 599ed29b0b4SJens Axboe 600ed29b0b4SJens Axboe if (test_bit(IO_CHECK_CQ_OVERFLOW_BIT, &ctx->check_cq)) { 601ed29b0b4SJens Axboe /* iopoll syncs against uring_lock, not completion_lock */ 602ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_IOPOLL) 603ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 604ed29b0b4SJens Axboe ret = __io_cqring_overflow_flush(ctx, false); 605ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_IOPOLL) 606ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 607ed29b0b4SJens Axboe } 608ed29b0b4SJens Axboe 609ed29b0b4SJens Axboe return ret; 610ed29b0b4SJens Axboe } 611ed29b0b4SJens Axboe 612e70cb608SPavel Begunkov void __io_put_task(struct task_struct *task, int nr) 613ed29b0b4SJens Axboe { 614ed29b0b4SJens Axboe struct io_uring_task *tctx = task->io_uring; 615ed29b0b4SJens Axboe 616ed29b0b4SJens Axboe percpu_counter_sub(&tctx->inflight, nr); 617ed29b0b4SJens Axboe if (unlikely(atomic_read(&tctx->in_idle))) 618ed29b0b4SJens Axboe wake_up(&tctx->wait); 619ed29b0b4SJens Axboe put_task_struct_many(task, nr); 620ed29b0b4SJens Axboe } 621ed29b0b4SJens Axboe 62263809137SPavel Begunkov void io_task_refs_refill(struct io_uring_task *tctx) 623ed29b0b4SJens Axboe { 624ed29b0b4SJens Axboe unsigned int refill = -tctx->cached_refs + IO_TCTX_REFS_CACHE_NR; 625ed29b0b4SJens Axboe 626ed29b0b4SJens Axboe percpu_counter_add(&tctx->inflight, refill); 627ed29b0b4SJens Axboe refcount_add(refill, ¤t->usage); 628ed29b0b4SJens Axboe tctx->cached_refs += refill; 629ed29b0b4SJens Axboe } 630ed29b0b4SJens Axboe 631ed29b0b4SJens Axboe static __cold void io_uring_drop_tctx_refs(struct task_struct *task) 632ed29b0b4SJens Axboe { 633ed29b0b4SJens Axboe struct io_uring_task *tctx = task->io_uring; 634ed29b0b4SJens Axboe unsigned int refs = tctx->cached_refs; 635ed29b0b4SJens Axboe 636ed29b0b4SJens Axboe if (refs) { 637ed29b0b4SJens Axboe tctx->cached_refs = 0; 638ed29b0b4SJens Axboe percpu_counter_sub(&tctx->inflight, refs); 639ed29b0b4SJens Axboe put_task_struct_many(task, refs); 640ed29b0b4SJens Axboe } 641ed29b0b4SJens Axboe } 642ed29b0b4SJens Axboe 64368494a65SPavel Begunkov static bool io_cqring_event_overflow(struct io_ring_ctx *ctx, u64 user_data, 64468494a65SPavel Begunkov s32 res, u32 cflags, u64 extra1, u64 extra2) 645ed29b0b4SJens Axboe { 646ed29b0b4SJens Axboe struct io_overflow_cqe *ocqe; 647ed29b0b4SJens Axboe size_t ocq_size = sizeof(struct io_overflow_cqe); 648ed29b0b4SJens Axboe bool is_cqe32 = (ctx->flags & IORING_SETUP_CQE32); 649ed29b0b4SJens Axboe 650ed29b0b4SJens Axboe if (is_cqe32) 651ed29b0b4SJens Axboe ocq_size += sizeof(struct io_uring_cqe); 652ed29b0b4SJens Axboe 653ed29b0b4SJens Axboe ocqe = kmalloc(ocq_size, GFP_ATOMIC | __GFP_ACCOUNT); 654ed29b0b4SJens Axboe trace_io_uring_cqe_overflow(ctx, user_data, res, cflags, ocqe); 655ed29b0b4SJens Axboe if (!ocqe) { 656ed29b0b4SJens Axboe /* 657ed29b0b4SJens Axboe * If we're in ring overflow flush mode, or in task cancel mode, 658ed29b0b4SJens Axboe * or cannot allocate an overflow entry, then we need to drop it 659ed29b0b4SJens Axboe * on the floor. 660ed29b0b4SJens Axboe */ 661ed29b0b4SJens Axboe io_account_cq_overflow(ctx); 662ed29b0b4SJens Axboe set_bit(IO_CHECK_CQ_DROPPED_BIT, &ctx->check_cq); 663ed29b0b4SJens Axboe return false; 664ed29b0b4SJens Axboe } 665ed29b0b4SJens Axboe if (list_empty(&ctx->cq_overflow_list)) { 666ed29b0b4SJens Axboe set_bit(IO_CHECK_CQ_OVERFLOW_BIT, &ctx->check_cq); 667ed29b0b4SJens Axboe atomic_or(IORING_SQ_CQ_OVERFLOW, &ctx->rings->sq_flags); 668ed29b0b4SJens Axboe 669ed29b0b4SJens Axboe } 670ed29b0b4SJens Axboe ocqe->cqe.user_data = user_data; 671ed29b0b4SJens Axboe ocqe->cqe.res = res; 672ed29b0b4SJens Axboe ocqe->cqe.flags = cflags; 673ed29b0b4SJens Axboe if (is_cqe32) { 674ed29b0b4SJens Axboe ocqe->cqe.big_cqe[0] = extra1; 675ed29b0b4SJens Axboe ocqe->cqe.big_cqe[1] = extra2; 676ed29b0b4SJens Axboe } 677ed29b0b4SJens Axboe list_add_tail(&ocqe->list, &ctx->cq_overflow_list); 678ed29b0b4SJens Axboe return true; 679ed29b0b4SJens Axboe } 680ed29b0b4SJens Axboe 68168494a65SPavel Begunkov bool io_req_cqe_overflow(struct io_kiocb *req) 68268494a65SPavel Begunkov { 68368494a65SPavel Begunkov if (!(req->flags & REQ_F_CQE32_INIT)) { 68468494a65SPavel Begunkov req->extra1 = 0; 68568494a65SPavel Begunkov req->extra2 = 0; 68668494a65SPavel Begunkov } 68768494a65SPavel Begunkov return io_cqring_event_overflow(req->ctx, req->cqe.user_data, 68868494a65SPavel Begunkov req->cqe.res, req->cqe.flags, 68968494a65SPavel Begunkov req->extra1, req->extra2); 69068494a65SPavel Begunkov } 69168494a65SPavel Begunkov 692faf88ddeSPavel Begunkov /* 693faf88ddeSPavel Begunkov * writes to the cq entry need to come after reading head; the 694faf88ddeSPavel Begunkov * control dependency is enough as we're using WRITE_ONCE to 695faf88ddeSPavel Begunkov * fill the cq entry 696faf88ddeSPavel Begunkov */ 697faf88ddeSPavel Begunkov struct io_uring_cqe *__io_get_cqe(struct io_ring_ctx *ctx) 698faf88ddeSPavel Begunkov { 699faf88ddeSPavel Begunkov struct io_rings *rings = ctx->rings; 700faf88ddeSPavel Begunkov unsigned int off = ctx->cached_cq_tail & (ctx->cq_entries - 1); 701faf88ddeSPavel Begunkov unsigned int free, queued, len; 702faf88ddeSPavel Begunkov 703faf88ddeSPavel Begunkov 704faf88ddeSPavel Begunkov /* userspace may cheat modifying the tail, be safe and do min */ 705faf88ddeSPavel Begunkov queued = min(__io_cqring_events(ctx), ctx->cq_entries); 706faf88ddeSPavel Begunkov free = ctx->cq_entries - queued; 707faf88ddeSPavel Begunkov /* we need a contiguous range, limit based on the current array offset */ 708faf88ddeSPavel Begunkov len = min(free, ctx->cq_entries - off); 709faf88ddeSPavel Begunkov if (!len) 710faf88ddeSPavel Begunkov return NULL; 711faf88ddeSPavel Begunkov 712b3659a65SPavel Begunkov if (ctx->flags & IORING_SETUP_CQE32) { 713b3659a65SPavel Begunkov off <<= 1; 714b3659a65SPavel Begunkov len <<= 1; 715b3659a65SPavel Begunkov } 716b3659a65SPavel Begunkov 717faf88ddeSPavel Begunkov ctx->cqe_cached = &rings->cqes[off]; 718faf88ddeSPavel Begunkov ctx->cqe_sentinel = ctx->cqe_cached + len; 719b3659a65SPavel Begunkov 720b3659a65SPavel Begunkov ctx->cached_cq_tail++; 721faf88ddeSPavel Begunkov ctx->cqe_cached++; 722b3659a65SPavel Begunkov if (ctx->flags & IORING_SETUP_CQE32) 723b3659a65SPavel Begunkov ctx->cqe_cached++; 724b3659a65SPavel Begunkov return &rings->cqes[off]; 725faf88ddeSPavel Begunkov } 726faf88ddeSPavel Begunkov 727eb42cebbSPavel Begunkov bool io_fill_cqe_aux(struct io_ring_ctx *ctx, u64 user_data, s32 res, u32 cflags, 72852120f0fSDylan Yudaken bool allow_overflow) 729ed29b0b4SJens Axboe { 730ed29b0b4SJens Axboe struct io_uring_cqe *cqe; 731ed29b0b4SJens Axboe 732ed29b0b4SJens Axboe ctx->cq_extra++; 733ed29b0b4SJens Axboe 734ed29b0b4SJens Axboe /* 735ed29b0b4SJens Axboe * If we can't get a cq entry, userspace overflowed the 736ed29b0b4SJens Axboe * submission (by quite a lot). Increment the overflow count in 737ed29b0b4SJens Axboe * the ring. 738ed29b0b4SJens Axboe */ 739ed29b0b4SJens Axboe cqe = io_get_cqe(ctx); 740ed29b0b4SJens Axboe if (likely(cqe)) { 741e0486f3fSDylan Yudaken trace_io_uring_complete(ctx, NULL, user_data, res, cflags, 0, 0); 742e0486f3fSDylan Yudaken 743ed29b0b4SJens Axboe WRITE_ONCE(cqe->user_data, user_data); 744ed29b0b4SJens Axboe WRITE_ONCE(cqe->res, res); 745ed29b0b4SJens Axboe WRITE_ONCE(cqe->flags, cflags); 746ed29b0b4SJens Axboe 747ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_CQE32) { 748ed29b0b4SJens Axboe WRITE_ONCE(cqe->big_cqe[0], 0); 749ed29b0b4SJens Axboe WRITE_ONCE(cqe->big_cqe[1], 0); 750ed29b0b4SJens Axboe } 751ed29b0b4SJens Axboe return true; 752ed29b0b4SJens Axboe } 75352120f0fSDylan Yudaken 75452120f0fSDylan Yudaken if (allow_overflow) 755ed29b0b4SJens Axboe return io_cqring_event_overflow(ctx, user_data, res, cflags, 0, 0); 75652120f0fSDylan Yudaken 75752120f0fSDylan Yudaken return false; 758ed29b0b4SJens Axboe } 759ed29b0b4SJens Axboe 760d245bca6SPavel Begunkov bool io_post_aux_cqe(struct io_ring_ctx *ctx, 76152120f0fSDylan Yudaken u64 user_data, s32 res, u32 cflags, 76252120f0fSDylan Yudaken bool allow_overflow) 763d245bca6SPavel Begunkov { 764d245bca6SPavel Begunkov bool filled; 765d245bca6SPavel Begunkov 76625399321SPavel Begunkov io_cq_lock(ctx); 76752120f0fSDylan Yudaken filled = io_fill_cqe_aux(ctx, user_data, res, cflags, allow_overflow); 76825399321SPavel Begunkov io_cq_unlock_post(ctx); 769d245bca6SPavel Begunkov return filled; 770d245bca6SPavel Begunkov } 771d245bca6SPavel Begunkov 772ed29b0b4SJens Axboe static void __io_req_complete_put(struct io_kiocb *req) 773ed29b0b4SJens Axboe { 774ed29b0b4SJens Axboe /* 775ed29b0b4SJens Axboe * If we're the last reference to this request, add to our locked 776ed29b0b4SJens Axboe * free_list cache. 777ed29b0b4SJens Axboe */ 778ed29b0b4SJens Axboe if (req_ref_put_and_test(req)) { 779ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 780ed29b0b4SJens Axboe 781ed29b0b4SJens Axboe if (req->flags & IO_REQ_LINK_FLAGS) { 782ed29b0b4SJens Axboe if (req->flags & IO_DISARM_MASK) 783ed29b0b4SJens Axboe io_disarm_next(req); 784ed29b0b4SJens Axboe if (req->link) { 785ed29b0b4SJens Axboe io_req_task_queue(req->link); 786ed29b0b4SJens Axboe req->link = NULL; 787ed29b0b4SJens Axboe } 788ed29b0b4SJens Axboe } 789ed29b0b4SJens Axboe io_req_put_rsrc(req); 790ed29b0b4SJens Axboe /* 791ed29b0b4SJens Axboe * Selected buffer deallocation in io_clean_op() assumes that 792ed29b0b4SJens Axboe * we don't hold ->completion_lock. Clean them here to avoid 793ed29b0b4SJens Axboe * deadlocks. 794ed29b0b4SJens Axboe */ 795ed29b0b4SJens Axboe io_put_kbuf_comp(req); 796ed29b0b4SJens Axboe io_dismantle_req(req); 797ed29b0b4SJens Axboe io_put_task(req->task, 1); 798ed29b0b4SJens Axboe wq_list_add_head(&req->comp_list, &ctx->locked_free_list); 799ed29b0b4SJens Axboe ctx->locked_free_nr++; 800ed29b0b4SJens Axboe } 801ed29b0b4SJens Axboe } 802ed29b0b4SJens Axboe 80359915143SJens Axboe void __io_req_complete_post(struct io_kiocb *req) 804ed29b0b4SJens Axboe { 80597b388d7SJens Axboe if (!(req->flags & REQ_F_CQE_SKIP)) 806ed29b0b4SJens Axboe __io_fill_cqe_req(req->ctx, req); 807ed29b0b4SJens Axboe __io_req_complete_put(req); 808ed29b0b4SJens Axboe } 809ed29b0b4SJens Axboe 81059915143SJens Axboe void io_req_complete_post(struct io_kiocb *req) 811ed29b0b4SJens Axboe { 812ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 813ed29b0b4SJens Axboe 81425399321SPavel Begunkov io_cq_lock(ctx); 81597b388d7SJens Axboe __io_req_complete_post(req); 81625399321SPavel Begunkov io_cq_unlock_post(ctx); 817ed29b0b4SJens Axboe } 818ed29b0b4SJens Axboe 81999f15d8dSJens Axboe inline void __io_req_complete(struct io_kiocb *req, unsigned issue_flags) 820ed29b0b4SJens Axboe { 82197b388d7SJens Axboe io_req_complete_post(req); 822ed29b0b4SJens Axboe } 823ed29b0b4SJens Axboe 824329061d3SJens Axboe void io_req_complete_failed(struct io_kiocb *req, s32 res) 825ed29b0b4SJens Axboe { 826ed29b0b4SJens Axboe req_set_fail(req); 82797b388d7SJens Axboe io_req_set_res(req, res, io_put_kbuf(req, IO_URING_F_UNLOCKED)); 82897b388d7SJens Axboe io_req_complete_post(req); 829ed29b0b4SJens Axboe } 830ed29b0b4SJens Axboe 831ed29b0b4SJens Axboe /* 832ed29b0b4SJens Axboe * Don't initialise the fields below on every allocation, but do that in 833ed29b0b4SJens Axboe * advance and keep them valid across allocations. 834ed29b0b4SJens Axboe */ 835ed29b0b4SJens Axboe static void io_preinit_req(struct io_kiocb *req, struct io_ring_ctx *ctx) 836ed29b0b4SJens Axboe { 837ed29b0b4SJens Axboe req->ctx = ctx; 838ed29b0b4SJens Axboe req->link = NULL; 839ed29b0b4SJens Axboe req->async_data = NULL; 840ed29b0b4SJens Axboe /* not necessary, but safer to zero */ 841ed29b0b4SJens Axboe req->cqe.res = 0; 842ed29b0b4SJens Axboe } 843ed29b0b4SJens Axboe 844ed29b0b4SJens Axboe static void io_flush_cached_locked_reqs(struct io_ring_ctx *ctx, 845ed29b0b4SJens Axboe struct io_submit_state *state) 846ed29b0b4SJens Axboe { 847ed29b0b4SJens Axboe spin_lock(&ctx->completion_lock); 848ed29b0b4SJens Axboe wq_list_splice(&ctx->locked_free_list, &state->free_list); 849ed29b0b4SJens Axboe ctx->locked_free_nr = 0; 850ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 851ed29b0b4SJens Axboe } 852ed29b0b4SJens Axboe 853ed29b0b4SJens Axboe /* 854ed29b0b4SJens Axboe * A request might get retired back into the request caches even before opcode 855ed29b0b4SJens Axboe * handlers and io_issue_sqe() are done with it, e.g. inline completion path. 856ed29b0b4SJens Axboe * Because of that, io_alloc_req() should be called only under ->uring_lock 857ed29b0b4SJens Axboe * and with extra caution to not get a request that is still worked on. 858ed29b0b4SJens Axboe */ 859bd1a3783SPavel Begunkov __cold bool __io_alloc_req_refill(struct io_ring_ctx *ctx) 860ed29b0b4SJens Axboe __must_hold(&ctx->uring_lock) 861ed29b0b4SJens Axboe { 862ed29b0b4SJens Axboe gfp_t gfp = GFP_KERNEL | __GFP_NOWARN; 863ed29b0b4SJens Axboe void *reqs[IO_REQ_ALLOC_BATCH]; 864ed29b0b4SJens Axboe int ret, i; 865ed29b0b4SJens Axboe 866ed29b0b4SJens Axboe /* 867ed29b0b4SJens Axboe * If we have more than a batch's worth of requests in our IRQ side 868ed29b0b4SJens Axboe * locked cache, grab the lock and move them over to our submission 869ed29b0b4SJens Axboe * side cache. 870ed29b0b4SJens Axboe */ 871ed29b0b4SJens Axboe if (data_race(ctx->locked_free_nr) > IO_COMPL_BATCH) { 872ed29b0b4SJens Axboe io_flush_cached_locked_reqs(ctx, &ctx->submit_state); 873ed29b0b4SJens Axboe if (!io_req_cache_empty(ctx)) 874ed29b0b4SJens Axboe return true; 875ed29b0b4SJens Axboe } 876ed29b0b4SJens Axboe 877ed29b0b4SJens Axboe ret = kmem_cache_alloc_bulk(req_cachep, gfp, ARRAY_SIZE(reqs), reqs); 878ed29b0b4SJens Axboe 879ed29b0b4SJens Axboe /* 880ed29b0b4SJens Axboe * Bulk alloc is all-or-nothing. If we fail to get a batch, 881ed29b0b4SJens Axboe * retry single alloc to be on the safe side. 882ed29b0b4SJens Axboe */ 883ed29b0b4SJens Axboe if (unlikely(ret <= 0)) { 884ed29b0b4SJens Axboe reqs[0] = kmem_cache_alloc(req_cachep, gfp); 885ed29b0b4SJens Axboe if (!reqs[0]) 886ed29b0b4SJens Axboe return false; 887ed29b0b4SJens Axboe ret = 1; 888ed29b0b4SJens Axboe } 889ed29b0b4SJens Axboe 890ed29b0b4SJens Axboe percpu_ref_get_many(&ctx->refs, ret); 891ed29b0b4SJens Axboe for (i = 0; i < ret; i++) { 892ed29b0b4SJens Axboe struct io_kiocb *req = reqs[i]; 893ed29b0b4SJens Axboe 894ed29b0b4SJens Axboe io_preinit_req(req, ctx); 895ed29b0b4SJens Axboe io_req_add_to_cache(req, ctx); 896ed29b0b4SJens Axboe } 897ed29b0b4SJens Axboe return true; 898ed29b0b4SJens Axboe } 899ed29b0b4SJens Axboe 900ed29b0b4SJens Axboe static inline void io_dismantle_req(struct io_kiocb *req) 901ed29b0b4SJens Axboe { 902ed29b0b4SJens Axboe unsigned int flags = req->flags; 903ed29b0b4SJens Axboe 904ed29b0b4SJens Axboe if (unlikely(flags & IO_REQ_CLEAN_FLAGS)) 905ed29b0b4SJens Axboe io_clean_op(req); 906ed29b0b4SJens Axboe if (!(flags & REQ_F_FIXED_FILE)) 907ed29b0b4SJens Axboe io_put_file(req->file); 908ed29b0b4SJens Axboe } 909ed29b0b4SJens Axboe 91059915143SJens Axboe __cold void io_free_req(struct io_kiocb *req) 911ed29b0b4SJens Axboe { 912ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 913ed29b0b4SJens Axboe 914ed29b0b4SJens Axboe io_req_put_rsrc(req); 915ed29b0b4SJens Axboe io_dismantle_req(req); 916ed29b0b4SJens Axboe io_put_task(req->task, 1); 917ed29b0b4SJens Axboe 918ed29b0b4SJens Axboe spin_lock(&ctx->completion_lock); 919ed29b0b4SJens Axboe wq_list_add_head(&req->comp_list, &ctx->locked_free_list); 920ed29b0b4SJens Axboe ctx->locked_free_nr++; 921ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 922ed29b0b4SJens Axboe } 923ed29b0b4SJens Axboe 924ed29b0b4SJens Axboe static void __io_req_find_next_prep(struct io_kiocb *req) 925ed29b0b4SJens Axboe { 926ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 927ed29b0b4SJens Axboe 92825399321SPavel Begunkov io_cq_lock(ctx); 929305bef98SPavel Begunkov io_disarm_next(req); 93025399321SPavel Begunkov io_cq_unlock_post(ctx); 931ed29b0b4SJens Axboe } 932ed29b0b4SJens Axboe 933ed29b0b4SJens Axboe static inline struct io_kiocb *io_req_find_next(struct io_kiocb *req) 934ed29b0b4SJens Axboe { 935ed29b0b4SJens Axboe struct io_kiocb *nxt; 936ed29b0b4SJens Axboe 937ed29b0b4SJens Axboe /* 938ed29b0b4SJens Axboe * If LINK is set, we have dependent requests in this chain. If we 939ed29b0b4SJens Axboe * didn't fail this request, queue the first one up, moving any other 940ed29b0b4SJens Axboe * dependencies to the next request. In case of failure, fail the rest 941ed29b0b4SJens Axboe * of the chain. 942ed29b0b4SJens Axboe */ 943ed29b0b4SJens Axboe if (unlikely(req->flags & IO_DISARM_MASK)) 944ed29b0b4SJens Axboe __io_req_find_next_prep(req); 945ed29b0b4SJens Axboe nxt = req->link; 946ed29b0b4SJens Axboe req->link = NULL; 947ed29b0b4SJens Axboe return nxt; 948ed29b0b4SJens Axboe } 949ed29b0b4SJens Axboe 950ed29b0b4SJens Axboe static void ctx_flush_and_put(struct io_ring_ctx *ctx, bool *locked) 951ed29b0b4SJens Axboe { 952ed29b0b4SJens Axboe if (!ctx) 953ed29b0b4SJens Axboe return; 954ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_TASKRUN_FLAG) 955ed29b0b4SJens Axboe atomic_andnot(IORING_SQ_TASKRUN, &ctx->rings->sq_flags); 956ed29b0b4SJens Axboe if (*locked) { 957ed29b0b4SJens Axboe io_submit_flush_completions(ctx); 958ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 959ed29b0b4SJens Axboe *locked = false; 960ed29b0b4SJens Axboe } 961ed29b0b4SJens Axboe percpu_ref_put(&ctx->refs); 962ed29b0b4SJens Axboe } 963ed29b0b4SJens Axboe 964c6dd763cSDylan Yudaken static unsigned int handle_tw_list(struct llist_node *node, 9653a0c037bSDylan Yudaken struct io_ring_ctx **ctx, bool *locked, 9663a0c037bSDylan Yudaken struct llist_node *last) 967ed29b0b4SJens Axboe { 968c6dd763cSDylan Yudaken unsigned int count = 0; 969c6dd763cSDylan Yudaken 9703a0c037bSDylan Yudaken while (node != last) { 971f88262e6SDylan Yudaken struct llist_node *next = node->next; 972ed29b0b4SJens Axboe struct io_kiocb *req = container_of(node, struct io_kiocb, 973ed29b0b4SJens Axboe io_task_work.node); 974ed29b0b4SJens Axboe 975ed29b0b4SJens Axboe prefetch(container_of(next, struct io_kiocb, io_task_work.node)); 976ed29b0b4SJens Axboe 977ed29b0b4SJens Axboe if (req->ctx != *ctx) { 978ed29b0b4SJens Axboe ctx_flush_and_put(*ctx, locked); 979ed29b0b4SJens Axboe *ctx = req->ctx; 980ed29b0b4SJens Axboe /* if not contended, grab and improve batching */ 981ed29b0b4SJens Axboe *locked = mutex_trylock(&(*ctx)->uring_lock); 982ed29b0b4SJens Axboe percpu_ref_get(&(*ctx)->refs); 983ed29b0b4SJens Axboe } 984ed29b0b4SJens Axboe req->io_task_work.func(req, locked); 985ed29b0b4SJens Axboe node = next; 986c6dd763cSDylan Yudaken count++; 9873a0c037bSDylan Yudaken } 988c6dd763cSDylan Yudaken 989c6dd763cSDylan Yudaken return count; 990ed29b0b4SJens Axboe } 991ed29b0b4SJens Axboe 992923d1592SDylan Yudaken /** 993923d1592SDylan Yudaken * io_llist_xchg - swap all entries in a lock-less list 994923d1592SDylan Yudaken * @head: the head of lock-less list to delete all entries 995923d1592SDylan Yudaken * @new: new entry as the head of the list 996923d1592SDylan Yudaken * 997923d1592SDylan Yudaken * If list is empty, return NULL, otherwise, return the pointer to the first entry. 998923d1592SDylan Yudaken * The order of entries returned is from the newest to the oldest added one. 999923d1592SDylan Yudaken */ 1000923d1592SDylan Yudaken static inline struct llist_node *io_llist_xchg(struct llist_head *head, 1001923d1592SDylan Yudaken struct llist_node *new) 1002923d1592SDylan Yudaken { 1003923d1592SDylan Yudaken return xchg(&head->first, new); 1004923d1592SDylan Yudaken } 1005923d1592SDylan Yudaken 1006923d1592SDylan Yudaken /** 1007923d1592SDylan Yudaken * io_llist_cmpxchg - possibly swap all entries in a lock-less list 1008923d1592SDylan Yudaken * @head: the head of lock-less list to delete all entries 1009923d1592SDylan Yudaken * @old: expected old value of the first entry of the list 1010923d1592SDylan Yudaken * @new: new entry as the head of the list 1011923d1592SDylan Yudaken * 1012923d1592SDylan Yudaken * perform a cmpxchg on the first entry of the list. 1013923d1592SDylan Yudaken */ 1014923d1592SDylan Yudaken 1015923d1592SDylan Yudaken static inline struct llist_node *io_llist_cmpxchg(struct llist_head *head, 1016923d1592SDylan Yudaken struct llist_node *old, 1017923d1592SDylan Yudaken struct llist_node *new) 1018923d1592SDylan Yudaken { 1019923d1592SDylan Yudaken return cmpxchg(&head->first, old, new); 1020923d1592SDylan Yudaken } 1021923d1592SDylan Yudaken 1022c9f06aa7SJens Axboe void tctx_task_work(struct callback_head *cb) 1023ed29b0b4SJens Axboe { 1024ed29b0b4SJens Axboe bool uring_locked = false; 1025ed29b0b4SJens Axboe struct io_ring_ctx *ctx = NULL; 1026ed29b0b4SJens Axboe struct io_uring_task *tctx = container_of(cb, struct io_uring_task, 1027ed29b0b4SJens Axboe task_work); 10283a0c037bSDylan Yudaken struct llist_node fake = {}; 10293a0c037bSDylan Yudaken struct llist_node *node = io_llist_xchg(&tctx->task_list, &fake); 1030c6dd763cSDylan Yudaken unsigned int loops = 1; 1031c6dd763cSDylan Yudaken unsigned int count = handle_tw_list(node, &ctx, &uring_locked, NULL); 1032ed29b0b4SJens Axboe 10333a0c037bSDylan Yudaken node = io_llist_cmpxchg(&tctx->task_list, &fake, NULL); 10343a0c037bSDylan Yudaken while (node != &fake) { 1035c6dd763cSDylan Yudaken loops++; 10363a0c037bSDylan Yudaken node = io_llist_xchg(&tctx->task_list, &fake); 1037c6dd763cSDylan Yudaken count += handle_tw_list(node, &ctx, &uring_locked, &fake); 10383a0c037bSDylan Yudaken node = io_llist_cmpxchg(&tctx->task_list, &fake, NULL); 1039ed29b0b4SJens Axboe } 1040ed29b0b4SJens Axboe 1041ed29b0b4SJens Axboe ctx_flush_and_put(ctx, &uring_locked); 1042ed29b0b4SJens Axboe 1043ed29b0b4SJens Axboe /* relaxed read is enough as only the task itself sets ->in_idle */ 1044ed29b0b4SJens Axboe if (unlikely(atomic_read(&tctx->in_idle))) 1045ed29b0b4SJens Axboe io_uring_drop_tctx_refs(current); 1046c6dd763cSDylan Yudaken 1047c6dd763cSDylan Yudaken trace_io_uring_task_work_run(tctx, count, loops); 1048ed29b0b4SJens Axboe } 1049ed29b0b4SJens Axboe 1050c34398a8SDylan Yudaken void io_req_task_work_add(struct io_kiocb *req) 1051ed29b0b4SJens Axboe { 1052c34398a8SDylan Yudaken struct io_uring_task *tctx = req->task->io_uring; 1053ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 1054f88262e6SDylan Yudaken struct llist_node *node; 1055ed29b0b4SJens Axboe bool running; 1056ed29b0b4SJens Axboe 1057f88262e6SDylan Yudaken running = !llist_add(&req->io_task_work.node, &tctx->task_list); 1058ed29b0b4SJens Axboe 1059ed29b0b4SJens Axboe /* task_work already pending, we're done */ 1060ed29b0b4SJens Axboe if (running) 1061ed29b0b4SJens Axboe return; 1062ed29b0b4SJens Axboe 1063ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_TASKRUN_FLAG) 1064ed29b0b4SJens Axboe atomic_or(IORING_SQ_TASKRUN, &ctx->rings->sq_flags); 1065ed29b0b4SJens Axboe 1066ed29b0b4SJens Axboe if (likely(!task_work_add(req->task, &tctx->task_work, ctx->notify_method))) 1067ed29b0b4SJens Axboe return; 1068ed29b0b4SJens Axboe 1069f88262e6SDylan Yudaken node = llist_del_all(&tctx->task_list); 1070ed29b0b4SJens Axboe 1071ed29b0b4SJens Axboe while (node) { 1072ed29b0b4SJens Axboe req = container_of(node, struct io_kiocb, io_task_work.node); 1073ed29b0b4SJens Axboe node = node->next; 10743218e5d3SPavel Begunkov if (llist_add(&req->io_task_work.node, 1075ed29b0b4SJens Axboe &req->ctx->fallback_llist)) 1076ed29b0b4SJens Axboe schedule_delayed_work(&req->ctx->fallback_work, 1); 1077ed29b0b4SJens Axboe } 1078ed29b0b4SJens Axboe } 1079ed29b0b4SJens Axboe 1080ed29b0b4SJens Axboe static void io_req_tw_post(struct io_kiocb *req, bool *locked) 1081ed29b0b4SJens Axboe { 108297b388d7SJens Axboe io_req_complete_post(req); 1083ed29b0b4SJens Axboe } 1084ed29b0b4SJens Axboe 108559915143SJens Axboe void io_req_tw_post_queue(struct io_kiocb *req, s32 res, u32 cflags) 1086ed29b0b4SJens Axboe { 108797b388d7SJens Axboe io_req_set_res(req, res, cflags); 1088ed29b0b4SJens Axboe req->io_task_work.func = io_req_tw_post; 1089ed29b0b4SJens Axboe io_req_task_work_add(req); 1090ed29b0b4SJens Axboe } 1091ed29b0b4SJens Axboe 1092ed29b0b4SJens Axboe static void io_req_task_cancel(struct io_kiocb *req, bool *locked) 1093ed29b0b4SJens Axboe { 1094ed29b0b4SJens Axboe /* not needed for normal modes, but SQPOLL depends on it */ 1095ed29b0b4SJens Axboe io_tw_lock(req->ctx, locked); 1096ed29b0b4SJens Axboe io_req_complete_failed(req, req->cqe.res); 1097ed29b0b4SJens Axboe } 1098ed29b0b4SJens Axboe 1099329061d3SJens Axboe void io_req_task_submit(struct io_kiocb *req, bool *locked) 1100ed29b0b4SJens Axboe { 1101ed29b0b4SJens Axboe io_tw_lock(req->ctx, locked); 1102ed29b0b4SJens Axboe /* req->task == current here, checking PF_EXITING is safe */ 1103ed29b0b4SJens Axboe if (likely(!(req->task->flags & PF_EXITING))) 1104ed29b0b4SJens Axboe io_queue_sqe(req); 1105ed29b0b4SJens Axboe else 1106ed29b0b4SJens Axboe io_req_complete_failed(req, -EFAULT); 1107ed29b0b4SJens Axboe } 1108ed29b0b4SJens Axboe 110959915143SJens Axboe void io_req_task_queue_fail(struct io_kiocb *req, int ret) 1110ed29b0b4SJens Axboe { 111197b388d7SJens Axboe io_req_set_res(req, ret, 0); 1112ed29b0b4SJens Axboe req->io_task_work.func = io_req_task_cancel; 1113ed29b0b4SJens Axboe io_req_task_work_add(req); 1114ed29b0b4SJens Axboe } 1115ed29b0b4SJens Axboe 1116f3b44f92SJens Axboe void io_req_task_queue(struct io_kiocb *req) 1117ed29b0b4SJens Axboe { 1118ed29b0b4SJens Axboe req->io_task_work.func = io_req_task_submit; 1119ed29b0b4SJens Axboe io_req_task_work_add(req); 1120ed29b0b4SJens Axboe } 1121ed29b0b4SJens Axboe 112259915143SJens Axboe void io_queue_next(struct io_kiocb *req) 1123ed29b0b4SJens Axboe { 1124ed29b0b4SJens Axboe struct io_kiocb *nxt = io_req_find_next(req); 1125ed29b0b4SJens Axboe 1126ed29b0b4SJens Axboe if (nxt) 1127ed29b0b4SJens Axboe io_req_task_queue(nxt); 1128ed29b0b4SJens Axboe } 1129ed29b0b4SJens Axboe 1130f3b44f92SJens Axboe void io_free_batch_list(struct io_ring_ctx *ctx, struct io_wq_work_node *node) 1131ed29b0b4SJens Axboe __must_hold(&ctx->uring_lock) 1132ed29b0b4SJens Axboe { 1133ed29b0b4SJens Axboe struct task_struct *task = NULL; 1134ed29b0b4SJens Axboe int task_refs = 0; 1135ed29b0b4SJens Axboe 1136ed29b0b4SJens Axboe do { 1137ed29b0b4SJens Axboe struct io_kiocb *req = container_of(node, struct io_kiocb, 1138ed29b0b4SJens Axboe comp_list); 1139ed29b0b4SJens Axboe 1140ed29b0b4SJens Axboe if (unlikely(req->flags & IO_REQ_CLEAN_SLOW_FLAGS)) { 1141ed29b0b4SJens Axboe if (req->flags & REQ_F_REFCOUNT) { 1142ed29b0b4SJens Axboe node = req->comp_list.next; 1143ed29b0b4SJens Axboe if (!req_ref_put_and_test(req)) 1144ed29b0b4SJens Axboe continue; 1145ed29b0b4SJens Axboe } 1146ed29b0b4SJens Axboe if ((req->flags & REQ_F_POLLED) && req->apoll) { 1147ed29b0b4SJens Axboe struct async_poll *apoll = req->apoll; 1148ed29b0b4SJens Axboe 1149ed29b0b4SJens Axboe if (apoll->double_poll) 1150ed29b0b4SJens Axboe kfree(apoll->double_poll); 11519731bc98SJens Axboe if (!io_alloc_cache_put(&ctx->apoll_cache, &apoll->cache)) 11529731bc98SJens Axboe kfree(apoll); 1153ed29b0b4SJens Axboe req->flags &= ~REQ_F_POLLED; 1154ed29b0b4SJens Axboe } 1155ed29b0b4SJens Axboe if (req->flags & IO_REQ_LINK_FLAGS) 1156ed29b0b4SJens Axboe io_queue_next(req); 1157ed29b0b4SJens Axboe if (unlikely(req->flags & IO_REQ_CLEAN_FLAGS)) 1158ed29b0b4SJens Axboe io_clean_op(req); 1159ed29b0b4SJens Axboe } 1160ed29b0b4SJens Axboe if (!(req->flags & REQ_F_FIXED_FILE)) 1161ed29b0b4SJens Axboe io_put_file(req->file); 1162ed29b0b4SJens Axboe 1163ed29b0b4SJens Axboe io_req_put_rsrc_locked(req, ctx); 1164ed29b0b4SJens Axboe 1165ed29b0b4SJens Axboe if (req->task != task) { 1166ed29b0b4SJens Axboe if (task) 1167ed29b0b4SJens Axboe io_put_task(task, task_refs); 1168ed29b0b4SJens Axboe task = req->task; 1169ed29b0b4SJens Axboe task_refs = 0; 1170ed29b0b4SJens Axboe } 1171ed29b0b4SJens Axboe task_refs++; 1172ed29b0b4SJens Axboe node = req->comp_list.next; 1173ed29b0b4SJens Axboe io_req_add_to_cache(req, ctx); 1174ed29b0b4SJens Axboe } while (node); 1175ed29b0b4SJens Axboe 1176ed29b0b4SJens Axboe if (task) 1177ed29b0b4SJens Axboe io_put_task(task, task_refs); 1178ed29b0b4SJens Axboe } 1179ed29b0b4SJens Axboe 1180ed29b0b4SJens Axboe static void __io_submit_flush_completions(struct io_ring_ctx *ctx) 1181ed29b0b4SJens Axboe __must_hold(&ctx->uring_lock) 1182ed29b0b4SJens Axboe { 1183ed29b0b4SJens Axboe struct io_wq_work_node *node, *prev; 1184ed29b0b4SJens Axboe struct io_submit_state *state = &ctx->submit_state; 1185ed29b0b4SJens Axboe 1186ed29b0b4SJens Axboe spin_lock(&ctx->completion_lock); 1187ed29b0b4SJens Axboe wq_list_for_each(node, prev, &state->compl_reqs) { 1188ed29b0b4SJens Axboe struct io_kiocb *req = container_of(node, struct io_kiocb, 1189ed29b0b4SJens Axboe comp_list); 1190ed29b0b4SJens Axboe 1191ed29b0b4SJens Axboe if (!(req->flags & REQ_F_CQE_SKIP)) 1192ed29b0b4SJens Axboe __io_fill_cqe_req(ctx, req); 1193ed29b0b4SJens Axboe } 119425399321SPavel Begunkov __io_cq_unlock_post(ctx); 1195ed29b0b4SJens Axboe 1196ed29b0b4SJens Axboe io_free_batch_list(ctx, state->compl_reqs.first); 1197ed29b0b4SJens Axboe INIT_WQ_LIST(&state->compl_reqs); 1198ed29b0b4SJens Axboe } 1199ed29b0b4SJens Axboe 1200ed29b0b4SJens Axboe /* 1201ed29b0b4SJens Axboe * Drop reference to request, return next in chain (if there is one) if this 1202ed29b0b4SJens Axboe * was the last reference to this request. 1203ed29b0b4SJens Axboe */ 1204ed29b0b4SJens Axboe static inline struct io_kiocb *io_put_req_find_next(struct io_kiocb *req) 1205ed29b0b4SJens Axboe { 1206ed29b0b4SJens Axboe struct io_kiocb *nxt = NULL; 1207ed29b0b4SJens Axboe 1208ed29b0b4SJens Axboe if (req_ref_put_and_test(req)) { 1209ed29b0b4SJens Axboe if (unlikely(req->flags & IO_REQ_LINK_FLAGS)) 1210ed29b0b4SJens Axboe nxt = io_req_find_next(req); 1211ed29b0b4SJens Axboe io_free_req(req); 1212ed29b0b4SJens Axboe } 1213ed29b0b4SJens Axboe return nxt; 1214ed29b0b4SJens Axboe } 1215ed29b0b4SJens Axboe 1216ed29b0b4SJens Axboe static unsigned io_cqring_events(struct io_ring_ctx *ctx) 1217ed29b0b4SJens Axboe { 1218ed29b0b4SJens Axboe /* See comment at the top of this file */ 1219ed29b0b4SJens Axboe smp_rmb(); 1220ed29b0b4SJens Axboe return __io_cqring_events(ctx); 1221ed29b0b4SJens Axboe } 1222ed29b0b4SJens Axboe 1223ed29b0b4SJens Axboe /* 1224ed29b0b4SJens Axboe * We can't just wait for polled events to come to us, we have to actively 1225ed29b0b4SJens Axboe * find and complete them. 1226ed29b0b4SJens Axboe */ 1227ed29b0b4SJens Axboe static __cold void io_iopoll_try_reap_events(struct io_ring_ctx *ctx) 1228ed29b0b4SJens Axboe { 1229ed29b0b4SJens Axboe if (!(ctx->flags & IORING_SETUP_IOPOLL)) 1230ed29b0b4SJens Axboe return; 1231ed29b0b4SJens Axboe 1232ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 1233ed29b0b4SJens Axboe while (!wq_list_empty(&ctx->iopoll_list)) { 1234ed29b0b4SJens Axboe /* let it sleep and repeat later if can't complete a request */ 1235ed29b0b4SJens Axboe if (io_do_iopoll(ctx, true) == 0) 1236ed29b0b4SJens Axboe break; 1237ed29b0b4SJens Axboe /* 1238ed29b0b4SJens Axboe * Ensure we allow local-to-the-cpu processing to take place, 1239ed29b0b4SJens Axboe * in this case we need to ensure that we reap all events. 1240ed29b0b4SJens Axboe * Also let task_work, etc. to progress by releasing the mutex 1241ed29b0b4SJens Axboe */ 1242ed29b0b4SJens Axboe if (need_resched()) { 1243ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 1244ed29b0b4SJens Axboe cond_resched(); 1245ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 1246ed29b0b4SJens Axboe } 1247ed29b0b4SJens Axboe } 1248ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 1249ed29b0b4SJens Axboe } 1250ed29b0b4SJens Axboe 1251ed29b0b4SJens Axboe static int io_iopoll_check(struct io_ring_ctx *ctx, long min) 1252ed29b0b4SJens Axboe { 1253ed29b0b4SJens Axboe unsigned int nr_events = 0; 1254ed29b0b4SJens Axboe int ret = 0; 1255ed29b0b4SJens Axboe unsigned long check_cq; 1256ed29b0b4SJens Axboe 12573a08576bSPavel Begunkov check_cq = READ_ONCE(ctx->check_cq); 12583a08576bSPavel Begunkov if (unlikely(check_cq)) { 12593a08576bSPavel Begunkov if (check_cq & BIT(IO_CHECK_CQ_OVERFLOW_BIT)) 12603a08576bSPavel Begunkov __io_cqring_overflow_flush(ctx, false); 12613a08576bSPavel Begunkov /* 12623a08576bSPavel Begunkov * Similarly do not spin if we have not informed the user of any 12633a08576bSPavel Begunkov * dropped CQE. 12643a08576bSPavel Begunkov */ 12653a08576bSPavel Begunkov if (check_cq & BIT(IO_CHECK_CQ_DROPPED_BIT)) 12663a08576bSPavel Begunkov return -EBADR; 12673a08576bSPavel Begunkov } 1268ed29b0b4SJens Axboe /* 1269ed29b0b4SJens Axboe * Don't enter poll loop if we already have events pending. 1270ed29b0b4SJens Axboe * If we do, we can potentially be spinning for commands that 1271ed29b0b4SJens Axboe * already triggered a CQE (eg in error). 1272ed29b0b4SJens Axboe */ 1273ed29b0b4SJens Axboe if (io_cqring_events(ctx)) 1274ed29b0b4SJens Axboe return 0; 1275ed29b0b4SJens Axboe 1276ed29b0b4SJens Axboe do { 1277ed29b0b4SJens Axboe /* 1278ed29b0b4SJens Axboe * If a submit got punted to a workqueue, we can have the 1279ed29b0b4SJens Axboe * application entering polling for a command before it gets 1280ed29b0b4SJens Axboe * issued. That app will hold the uring_lock for the duration 1281ed29b0b4SJens Axboe * of the poll right here, so we need to take a breather every 1282ed29b0b4SJens Axboe * now and then to ensure that the issue has a chance to add 1283ed29b0b4SJens Axboe * the poll to the issued list. Otherwise we can spin here 1284ed29b0b4SJens Axboe * forever, while the workqueue is stuck trying to acquire the 1285ed29b0b4SJens Axboe * very same mutex. 1286ed29b0b4SJens Axboe */ 1287ed29b0b4SJens Axboe if (wq_list_empty(&ctx->iopoll_list)) { 1288ed29b0b4SJens Axboe u32 tail = ctx->cached_cq_tail; 1289ed29b0b4SJens Axboe 1290ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 1291ed29b0b4SJens Axboe io_run_task_work(); 1292ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 1293ed29b0b4SJens Axboe 1294ed29b0b4SJens Axboe /* some requests don't go through iopoll_list */ 1295ed29b0b4SJens Axboe if (tail != ctx->cached_cq_tail || 1296ed29b0b4SJens Axboe wq_list_empty(&ctx->iopoll_list)) 1297ed29b0b4SJens Axboe break; 1298ed29b0b4SJens Axboe } 1299ed29b0b4SJens Axboe ret = io_do_iopoll(ctx, !min); 1300ed29b0b4SJens Axboe if (ret < 0) 1301ed29b0b4SJens Axboe break; 1302ed29b0b4SJens Axboe nr_events += ret; 1303ed29b0b4SJens Axboe ret = 0; 1304ed29b0b4SJens Axboe } while (nr_events < min && !need_resched()); 1305ed29b0b4SJens Axboe 1306ed29b0b4SJens Axboe return ret; 1307ed29b0b4SJens Axboe } 13087012c815SPavel Begunkov 13097012c815SPavel Begunkov void io_req_task_complete(struct io_kiocb *req, bool *locked) 1310ed29b0b4SJens Axboe { 13117012c815SPavel Begunkov if (req->flags & (REQ_F_BUFFER_SELECTED|REQ_F_BUFFER_RING)) { 13127012c815SPavel Begunkov unsigned issue_flags = *locked ? 0 : IO_URING_F_UNLOCKED; 13137012c815SPavel Begunkov 13147012c815SPavel Begunkov req->cqe.flags |= io_put_kbuf(req, issue_flags); 1315ed29b0b4SJens Axboe } 13167012c815SPavel Begunkov 13177012c815SPavel Begunkov if (*locked) 13189da070b1SPavel Begunkov io_req_complete_defer(req); 13197012c815SPavel Begunkov else 13207012c815SPavel Begunkov io_req_complete_post(req); 1321ed29b0b4SJens Axboe } 1322ed29b0b4SJens Axboe 1323ed29b0b4SJens Axboe /* 1324ed29b0b4SJens Axboe * After the iocb has been issued, it's safe to be found on the poll list. 1325ed29b0b4SJens Axboe * Adding the kiocb to the list AFTER submission ensures that we don't 1326ed29b0b4SJens Axboe * find it from a io_do_iopoll() thread before the issuer is done 1327ed29b0b4SJens Axboe * accessing the kiocb cookie. 1328ed29b0b4SJens Axboe */ 1329ed29b0b4SJens Axboe static void io_iopoll_req_issued(struct io_kiocb *req, unsigned int issue_flags) 1330ed29b0b4SJens Axboe { 1331ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 1332ed29b0b4SJens Axboe const bool needs_lock = issue_flags & IO_URING_F_UNLOCKED; 1333ed29b0b4SJens Axboe 1334ed29b0b4SJens Axboe /* workqueue context doesn't hold uring_lock, grab it now */ 1335ed29b0b4SJens Axboe if (unlikely(needs_lock)) 1336ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 1337ed29b0b4SJens Axboe 1338ed29b0b4SJens Axboe /* 1339ed29b0b4SJens Axboe * Track whether we have multiple files in our lists. This will impact 1340ed29b0b4SJens Axboe * how we do polling eventually, not spinning if we're on potentially 1341ed29b0b4SJens Axboe * different devices. 1342ed29b0b4SJens Axboe */ 1343ed29b0b4SJens Axboe if (wq_list_empty(&ctx->iopoll_list)) { 1344ed29b0b4SJens Axboe ctx->poll_multi_queue = false; 1345ed29b0b4SJens Axboe } else if (!ctx->poll_multi_queue) { 1346ed29b0b4SJens Axboe struct io_kiocb *list_req; 1347ed29b0b4SJens Axboe 1348ed29b0b4SJens Axboe list_req = container_of(ctx->iopoll_list.first, struct io_kiocb, 1349ed29b0b4SJens Axboe comp_list); 1350ed29b0b4SJens Axboe if (list_req->file != req->file) 1351ed29b0b4SJens Axboe ctx->poll_multi_queue = true; 1352ed29b0b4SJens Axboe } 1353ed29b0b4SJens Axboe 1354ed29b0b4SJens Axboe /* 1355ed29b0b4SJens Axboe * For fast devices, IO may have already completed. If it has, add 1356ed29b0b4SJens Axboe * it to the front so we find it first. 1357ed29b0b4SJens Axboe */ 1358ed29b0b4SJens Axboe if (READ_ONCE(req->iopoll_completed)) 1359ed29b0b4SJens Axboe wq_list_add_head(&req->comp_list, &ctx->iopoll_list); 1360ed29b0b4SJens Axboe else 1361ed29b0b4SJens Axboe wq_list_add_tail(&req->comp_list, &ctx->iopoll_list); 1362ed29b0b4SJens Axboe 1363ed29b0b4SJens Axboe if (unlikely(needs_lock)) { 1364ed29b0b4SJens Axboe /* 1365ed29b0b4SJens Axboe * If IORING_SETUP_SQPOLL is enabled, sqes are either handle 1366ed29b0b4SJens Axboe * in sq thread task context or in io worker task context. If 1367ed29b0b4SJens Axboe * current task context is sq thread, we don't need to check 1368ed29b0b4SJens Axboe * whether should wake up sq thread. 1369ed29b0b4SJens Axboe */ 1370ed29b0b4SJens Axboe if ((ctx->flags & IORING_SETUP_SQPOLL) && 1371ed29b0b4SJens Axboe wq_has_sleeper(&ctx->sq_data->wait)) 1372ed29b0b4SJens Axboe wake_up(&ctx->sq_data->wait); 1373ed29b0b4SJens Axboe 1374ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 1375ed29b0b4SJens Axboe } 1376ed29b0b4SJens Axboe } 1377ed29b0b4SJens Axboe 1378ed29b0b4SJens Axboe static bool io_bdev_nowait(struct block_device *bdev) 1379ed29b0b4SJens Axboe { 1380ed29b0b4SJens Axboe return !bdev || blk_queue_nowait(bdev_get_queue(bdev)); 1381ed29b0b4SJens Axboe } 1382ed29b0b4SJens Axboe 1383ed29b0b4SJens Axboe /* 1384ed29b0b4SJens Axboe * If we tracked the file through the SCM inflight mechanism, we could support 1385ed29b0b4SJens Axboe * any file. For now, just ensure that anything potentially problematic is done 1386ed29b0b4SJens Axboe * inline. 1387ed29b0b4SJens Axboe */ 1388ed29b0b4SJens Axboe static bool __io_file_supports_nowait(struct file *file, umode_t mode) 1389ed29b0b4SJens Axboe { 1390ed29b0b4SJens Axboe if (S_ISBLK(mode)) { 1391ed29b0b4SJens Axboe if (IS_ENABLED(CONFIG_BLOCK) && 1392ed29b0b4SJens Axboe io_bdev_nowait(I_BDEV(file->f_mapping->host))) 1393ed29b0b4SJens Axboe return true; 1394ed29b0b4SJens Axboe return false; 1395ed29b0b4SJens Axboe } 1396ed29b0b4SJens Axboe if (S_ISSOCK(mode)) 1397ed29b0b4SJens Axboe return true; 1398ed29b0b4SJens Axboe if (S_ISREG(mode)) { 1399ed29b0b4SJens Axboe if (IS_ENABLED(CONFIG_BLOCK) && 1400ed29b0b4SJens Axboe io_bdev_nowait(file->f_inode->i_sb->s_bdev) && 1401e5550a14SJens Axboe !io_is_uring_fops(file)) 1402ed29b0b4SJens Axboe return true; 1403ed29b0b4SJens Axboe return false; 1404ed29b0b4SJens Axboe } 1405ed29b0b4SJens Axboe 1406ed29b0b4SJens Axboe /* any ->read/write should understand O_NONBLOCK */ 1407ed29b0b4SJens Axboe if (file->f_flags & O_NONBLOCK) 1408ed29b0b4SJens Axboe return true; 1409ed29b0b4SJens Axboe return file->f_mode & FMODE_NOWAIT; 1410ed29b0b4SJens Axboe } 1411ed29b0b4SJens Axboe 1412ed29b0b4SJens Axboe /* 1413ed29b0b4SJens Axboe * If we tracked the file through the SCM inflight mechanism, we could support 1414ed29b0b4SJens Axboe * any file. For now, just ensure that anything potentially problematic is done 1415ed29b0b4SJens Axboe * inline. 1416ed29b0b4SJens Axboe */ 1417a4ad4f74SJens Axboe unsigned int io_file_get_flags(struct file *file) 1418ed29b0b4SJens Axboe { 1419ed29b0b4SJens Axboe umode_t mode = file_inode(file)->i_mode; 1420ed29b0b4SJens Axboe unsigned int res = 0; 1421ed29b0b4SJens Axboe 1422ed29b0b4SJens Axboe if (S_ISREG(mode)) 1423ed29b0b4SJens Axboe res |= FFS_ISREG; 1424ed29b0b4SJens Axboe if (__io_file_supports_nowait(file, mode)) 1425ed29b0b4SJens Axboe res |= FFS_NOWAIT; 1426ed29b0b4SJens Axboe if (io_file_need_scm(file)) 1427ed29b0b4SJens Axboe res |= FFS_SCM; 1428ed29b0b4SJens Axboe return res; 1429ed29b0b4SJens Axboe } 1430ed29b0b4SJens Axboe 143199f15d8dSJens Axboe bool io_alloc_async_data(struct io_kiocb *req) 1432ed29b0b4SJens Axboe { 1433ed29b0b4SJens Axboe WARN_ON_ONCE(!io_op_defs[req->opcode].async_size); 1434ed29b0b4SJens Axboe req->async_data = kmalloc(io_op_defs[req->opcode].async_size, GFP_KERNEL); 1435ed29b0b4SJens Axboe if (req->async_data) { 1436ed29b0b4SJens Axboe req->flags |= REQ_F_ASYNC_DATA; 1437ed29b0b4SJens Axboe return false; 1438ed29b0b4SJens Axboe } 1439ed29b0b4SJens Axboe return true; 1440ed29b0b4SJens Axboe } 1441ed29b0b4SJens Axboe 1442f3b44f92SJens Axboe int io_req_prep_async(struct io_kiocb *req) 1443ed29b0b4SJens Axboe { 1444ed29b0b4SJens Axboe const struct io_op_def *def = &io_op_defs[req->opcode]; 1445ed29b0b4SJens Axboe 1446ed29b0b4SJens Axboe /* assign early for deferred execution for non-fixed file */ 1447ed29b0b4SJens Axboe if (def->needs_file && !(req->flags & REQ_F_FIXED_FILE)) 1448ed29b0b4SJens Axboe req->file = io_file_get_normal(req, req->cqe.fd); 1449dc919cafSJens Axboe if (!def->prep_async) 1450ed29b0b4SJens Axboe return 0; 1451ed29b0b4SJens Axboe if (WARN_ON_ONCE(req_has_async_data(req))) 1452ed29b0b4SJens Axboe return -EFAULT; 1453*59169439SPavel Begunkov if (!io_op_defs[req->opcode].manual_alloc) { 1454ed29b0b4SJens Axboe if (io_alloc_async_data(req)) 1455ed29b0b4SJens Axboe return -EAGAIN; 1456*59169439SPavel Begunkov } 1457dc919cafSJens Axboe return def->prep_async(req); 1458ed29b0b4SJens Axboe } 1459ed29b0b4SJens Axboe 1460ed29b0b4SJens Axboe static u32 io_get_sequence(struct io_kiocb *req) 1461ed29b0b4SJens Axboe { 1462ed29b0b4SJens Axboe u32 seq = req->ctx->cached_sq_head; 1463ed29b0b4SJens Axboe struct io_kiocb *cur; 1464ed29b0b4SJens Axboe 1465ed29b0b4SJens Axboe /* need original cached_sq_head, but it was increased for each req */ 1466ed29b0b4SJens Axboe io_for_each_link(cur, req) 1467ed29b0b4SJens Axboe seq--; 1468ed29b0b4SJens Axboe return seq; 1469ed29b0b4SJens Axboe } 1470ed29b0b4SJens Axboe 1471ed29b0b4SJens Axboe static __cold void io_drain_req(struct io_kiocb *req) 1472ed29b0b4SJens Axboe { 1473ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 1474ed29b0b4SJens Axboe struct io_defer_entry *de; 1475ed29b0b4SJens Axboe int ret; 1476ed29b0b4SJens Axboe u32 seq = io_get_sequence(req); 1477ed29b0b4SJens Axboe 1478ed29b0b4SJens Axboe /* Still need defer if there is pending req in defer list. */ 1479ed29b0b4SJens Axboe spin_lock(&ctx->completion_lock); 1480ed29b0b4SJens Axboe if (!req_need_defer(req, seq) && list_empty_careful(&ctx->defer_list)) { 1481ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 1482ed29b0b4SJens Axboe queue: 1483ed29b0b4SJens Axboe ctx->drain_active = false; 1484ed29b0b4SJens Axboe io_req_task_queue(req); 1485ed29b0b4SJens Axboe return; 1486ed29b0b4SJens Axboe } 1487ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 1488ed29b0b4SJens Axboe 1489ed29b0b4SJens Axboe ret = io_req_prep_async(req); 1490ed29b0b4SJens Axboe if (ret) { 1491ed29b0b4SJens Axboe fail: 1492ed29b0b4SJens Axboe io_req_complete_failed(req, ret); 1493ed29b0b4SJens Axboe return; 1494ed29b0b4SJens Axboe } 1495ed29b0b4SJens Axboe io_prep_async_link(req); 1496ed29b0b4SJens Axboe de = kmalloc(sizeof(*de), GFP_KERNEL); 1497ed29b0b4SJens Axboe if (!de) { 1498ed29b0b4SJens Axboe ret = -ENOMEM; 1499ed29b0b4SJens Axboe goto fail; 1500ed29b0b4SJens Axboe } 1501ed29b0b4SJens Axboe 1502ed29b0b4SJens Axboe spin_lock(&ctx->completion_lock); 1503ed29b0b4SJens Axboe if (!req_need_defer(req, seq) && list_empty(&ctx->defer_list)) { 1504ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 1505ed29b0b4SJens Axboe kfree(de); 1506ed29b0b4SJens Axboe goto queue; 1507ed29b0b4SJens Axboe } 1508ed29b0b4SJens Axboe 150948863ffdSPavel Begunkov trace_io_uring_defer(req); 1510ed29b0b4SJens Axboe de->req = req; 1511ed29b0b4SJens Axboe de->seq = seq; 1512ed29b0b4SJens Axboe list_add_tail(&de->list, &ctx->defer_list); 1513ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 1514ed29b0b4SJens Axboe } 1515ed29b0b4SJens Axboe 1516ed29b0b4SJens Axboe static void io_clean_op(struct io_kiocb *req) 1517ed29b0b4SJens Axboe { 1518ed29b0b4SJens Axboe if (req->flags & REQ_F_BUFFER_SELECTED) { 1519ed29b0b4SJens Axboe spin_lock(&req->ctx->completion_lock); 1520ed29b0b4SJens Axboe io_put_kbuf_comp(req); 1521ed29b0b4SJens Axboe spin_unlock(&req->ctx->completion_lock); 1522ed29b0b4SJens Axboe } 1523ed29b0b4SJens Axboe 1524ed29b0b4SJens Axboe if (req->flags & REQ_F_NEED_CLEANUP) { 15254d4c9cffSJens Axboe const struct io_op_def *def = &io_op_defs[req->opcode]; 1526ed29b0b4SJens Axboe 15274d4c9cffSJens Axboe if (def->cleanup) 15284d4c9cffSJens Axboe def->cleanup(req); 1529ed29b0b4SJens Axboe } 1530ed29b0b4SJens Axboe if ((req->flags & REQ_F_POLLED) && req->apoll) { 1531ed29b0b4SJens Axboe kfree(req->apoll->double_poll); 1532ed29b0b4SJens Axboe kfree(req->apoll); 1533ed29b0b4SJens Axboe req->apoll = NULL; 1534ed29b0b4SJens Axboe } 1535ed29b0b4SJens Axboe if (req->flags & REQ_F_INFLIGHT) { 1536ed29b0b4SJens Axboe struct io_uring_task *tctx = req->task->io_uring; 1537ed29b0b4SJens Axboe 1538ed29b0b4SJens Axboe atomic_dec(&tctx->inflight_tracked); 1539ed29b0b4SJens Axboe } 1540ed29b0b4SJens Axboe if (req->flags & REQ_F_CREDS) 1541ed29b0b4SJens Axboe put_cred(req->creds); 1542ed29b0b4SJens Axboe if (req->flags & REQ_F_ASYNC_DATA) { 1543ed29b0b4SJens Axboe kfree(req->async_data); 1544ed29b0b4SJens Axboe req->async_data = NULL; 1545ed29b0b4SJens Axboe } 1546ed29b0b4SJens Axboe req->flags &= ~IO_REQ_CLEAN_FLAGS; 1547ed29b0b4SJens Axboe } 1548ed29b0b4SJens Axboe 1549ed29b0b4SJens Axboe static bool io_assign_file(struct io_kiocb *req, unsigned int issue_flags) 1550ed29b0b4SJens Axboe { 1551ed29b0b4SJens Axboe if (req->file || !io_op_defs[req->opcode].needs_file) 1552ed29b0b4SJens Axboe return true; 1553ed29b0b4SJens Axboe 1554ed29b0b4SJens Axboe if (req->flags & REQ_F_FIXED_FILE) 1555ed29b0b4SJens Axboe req->file = io_file_get_fixed(req, req->cqe.fd, issue_flags); 1556ed29b0b4SJens Axboe else 1557ed29b0b4SJens Axboe req->file = io_file_get_normal(req, req->cqe.fd); 1558ed29b0b4SJens Axboe 1559ed29b0b4SJens Axboe return !!req->file; 1560ed29b0b4SJens Axboe } 1561ed29b0b4SJens Axboe 1562ed29b0b4SJens Axboe static int io_issue_sqe(struct io_kiocb *req, unsigned int issue_flags) 1563ed29b0b4SJens Axboe { 1564ed29b0b4SJens Axboe const struct io_op_def *def = &io_op_defs[req->opcode]; 1565ed29b0b4SJens Axboe const struct cred *creds = NULL; 1566ed29b0b4SJens Axboe int ret; 1567ed29b0b4SJens Axboe 1568ed29b0b4SJens Axboe if (unlikely(!io_assign_file(req, issue_flags))) 1569ed29b0b4SJens Axboe return -EBADF; 1570ed29b0b4SJens Axboe 1571ed29b0b4SJens Axboe if (unlikely((req->flags & REQ_F_CREDS) && req->creds != current_cred())) 1572ed29b0b4SJens Axboe creds = override_creds(req->creds); 1573ed29b0b4SJens Axboe 1574ed29b0b4SJens Axboe if (!def->audit_skip) 1575ed29b0b4SJens Axboe audit_uring_entry(req->opcode); 1576ed29b0b4SJens Axboe 1577ed29b0b4SJens Axboe ret = def->issue(req, issue_flags); 1578ed29b0b4SJens Axboe 1579ed29b0b4SJens Axboe if (!def->audit_skip) 1580ed29b0b4SJens Axboe audit_uring_exit(!ret, ret); 1581ed29b0b4SJens Axboe 1582ed29b0b4SJens Axboe if (creds) 1583ed29b0b4SJens Axboe revert_creds(creds); 158497b388d7SJens Axboe 158575d7b3aeSPavel Begunkov if (ret == IOU_OK) { 158675d7b3aeSPavel Begunkov if (issue_flags & IO_URING_F_COMPLETE_DEFER) 15879da070b1SPavel Begunkov io_req_complete_defer(req); 158875d7b3aeSPavel Begunkov else 158975d7b3aeSPavel Begunkov io_req_complete_post(req); 159075d7b3aeSPavel Begunkov } else if (ret != IOU_ISSUE_SKIP_COMPLETE) 1591ed29b0b4SJens Axboe return ret; 159297b388d7SJens Axboe 1593ed29b0b4SJens Axboe /* If the op doesn't have a file, we're not polling for it */ 1594ed29b0b4SJens Axboe if ((req->ctx->flags & IORING_SETUP_IOPOLL) && req->file) 1595ed29b0b4SJens Axboe io_iopoll_req_issued(req, issue_flags); 1596ed29b0b4SJens Axboe 1597ed29b0b4SJens Axboe return 0; 1598ed29b0b4SJens Axboe } 1599ed29b0b4SJens Axboe 1600329061d3SJens Axboe int io_poll_issue(struct io_kiocb *req, bool *locked) 1601329061d3SJens Axboe { 1602329061d3SJens Axboe io_tw_lock(req->ctx, locked); 1603329061d3SJens Axboe if (unlikely(req->task->flags & PF_EXITING)) 1604329061d3SJens Axboe return -EFAULT; 1605aeaa72c6SPavel Begunkov return io_issue_sqe(req, IO_URING_F_NONBLOCK); 1606329061d3SJens Axboe } 1607329061d3SJens Axboe 1608c9f06aa7SJens Axboe struct io_wq_work *io_wq_free_work(struct io_wq_work *work) 1609ed29b0b4SJens Axboe { 1610ed29b0b4SJens Axboe struct io_kiocb *req = container_of(work, struct io_kiocb, work); 1611ed29b0b4SJens Axboe 1612ed29b0b4SJens Axboe req = io_put_req_find_next(req); 1613ed29b0b4SJens Axboe return req ? &req->work : NULL; 1614ed29b0b4SJens Axboe } 1615ed29b0b4SJens Axboe 1616c9f06aa7SJens Axboe void io_wq_submit_work(struct io_wq_work *work) 1617ed29b0b4SJens Axboe { 1618ed29b0b4SJens Axboe struct io_kiocb *req = container_of(work, struct io_kiocb, work); 1619ed29b0b4SJens Axboe const struct io_op_def *def = &io_op_defs[req->opcode]; 1620ed29b0b4SJens Axboe unsigned int issue_flags = IO_URING_F_UNLOCKED; 1621ed29b0b4SJens Axboe bool needs_poll = false; 1622ed29b0b4SJens Axboe int ret = 0, err = -ECANCELED; 1623ed29b0b4SJens Axboe 1624ed29b0b4SJens Axboe /* one will be dropped by ->io_free_work() after returning to io-wq */ 1625ed29b0b4SJens Axboe if (!(req->flags & REQ_F_REFCOUNT)) 1626ed29b0b4SJens Axboe __io_req_set_refcount(req, 2); 1627ed29b0b4SJens Axboe else 1628ed29b0b4SJens Axboe req_ref_get(req); 1629ed29b0b4SJens Axboe 1630ed29b0b4SJens Axboe io_arm_ltimeout(req); 1631ed29b0b4SJens Axboe 1632ed29b0b4SJens Axboe /* either cancelled or io-wq is dying, so don't touch tctx->iowq */ 1633ed29b0b4SJens Axboe if (work->flags & IO_WQ_WORK_CANCEL) { 1634ed29b0b4SJens Axboe fail: 1635ed29b0b4SJens Axboe io_req_task_queue_fail(req, err); 1636ed29b0b4SJens Axboe return; 1637ed29b0b4SJens Axboe } 1638ed29b0b4SJens Axboe if (!io_assign_file(req, issue_flags)) { 1639ed29b0b4SJens Axboe err = -EBADF; 1640ed29b0b4SJens Axboe work->flags |= IO_WQ_WORK_CANCEL; 1641ed29b0b4SJens Axboe goto fail; 1642ed29b0b4SJens Axboe } 1643ed29b0b4SJens Axboe 1644ed29b0b4SJens Axboe if (req->flags & REQ_F_FORCE_ASYNC) { 1645ed29b0b4SJens Axboe bool opcode_poll = def->pollin || def->pollout; 1646ed29b0b4SJens Axboe 1647ed29b0b4SJens Axboe if (opcode_poll && file_can_poll(req->file)) { 1648ed29b0b4SJens Axboe needs_poll = true; 1649ed29b0b4SJens Axboe issue_flags |= IO_URING_F_NONBLOCK; 1650ed29b0b4SJens Axboe } 1651ed29b0b4SJens Axboe } 1652ed29b0b4SJens Axboe 1653ed29b0b4SJens Axboe do { 1654ed29b0b4SJens Axboe ret = io_issue_sqe(req, issue_flags); 1655ed29b0b4SJens Axboe if (ret != -EAGAIN) 1656ed29b0b4SJens Axboe break; 1657ed29b0b4SJens Axboe /* 1658ed29b0b4SJens Axboe * We can get EAGAIN for iopolled IO even though we're 1659ed29b0b4SJens Axboe * forcing a sync submission from here, since we can't 1660ed29b0b4SJens Axboe * wait for request slots on the block side. 1661ed29b0b4SJens Axboe */ 1662ed29b0b4SJens Axboe if (!needs_poll) { 1663ed29b0b4SJens Axboe if (!(req->ctx->flags & IORING_SETUP_IOPOLL)) 1664ed29b0b4SJens Axboe break; 1665ed29b0b4SJens Axboe cond_resched(); 1666ed29b0b4SJens Axboe continue; 1667ed29b0b4SJens Axboe } 1668ed29b0b4SJens Axboe 1669ed29b0b4SJens Axboe if (io_arm_poll_handler(req, issue_flags) == IO_APOLL_OK) 1670ed29b0b4SJens Axboe return; 1671ed29b0b4SJens Axboe /* aborted or ready, in either case retry blocking */ 1672ed29b0b4SJens Axboe needs_poll = false; 1673ed29b0b4SJens Axboe issue_flags &= ~IO_URING_F_NONBLOCK; 1674ed29b0b4SJens Axboe } while (1); 1675ed29b0b4SJens Axboe 1676ed29b0b4SJens Axboe /* avoid locking problems by failing it from a clean context */ 167797b388d7SJens Axboe if (ret < 0) 1678ed29b0b4SJens Axboe io_req_task_queue_fail(req, ret); 1679ed29b0b4SJens Axboe } 1680ed29b0b4SJens Axboe 1681531113bbSJens Axboe inline struct file *io_file_get_fixed(struct io_kiocb *req, int fd, 1682ed29b0b4SJens Axboe unsigned int issue_flags) 1683ed29b0b4SJens Axboe { 1684ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 1685ed29b0b4SJens Axboe struct file *file = NULL; 1686ed29b0b4SJens Axboe unsigned long file_ptr; 1687ed29b0b4SJens Axboe 1688ed29b0b4SJens Axboe io_ring_submit_lock(ctx, issue_flags); 1689ed29b0b4SJens Axboe 1690ed29b0b4SJens Axboe if (unlikely((unsigned int)fd >= ctx->nr_user_files)) 1691ed29b0b4SJens Axboe goto out; 1692ed29b0b4SJens Axboe fd = array_index_nospec(fd, ctx->nr_user_files); 1693ed29b0b4SJens Axboe file_ptr = io_fixed_file_slot(&ctx->file_table, fd)->file_ptr; 1694ed29b0b4SJens Axboe file = (struct file *) (file_ptr & FFS_MASK); 1695ed29b0b4SJens Axboe file_ptr &= ~FFS_MASK; 1696ed29b0b4SJens Axboe /* mask in overlapping REQ_F and FFS bits */ 1697ed29b0b4SJens Axboe req->flags |= (file_ptr << REQ_F_SUPPORT_NOWAIT_BIT); 1698ed29b0b4SJens Axboe io_req_set_rsrc_node(req, ctx, 0); 1699ed29b0b4SJens Axboe WARN_ON_ONCE(file && !test_bit(fd, ctx->file_table.bitmap)); 1700ed29b0b4SJens Axboe out: 1701ed29b0b4SJens Axboe io_ring_submit_unlock(ctx, issue_flags); 1702ed29b0b4SJens Axboe return file; 1703ed29b0b4SJens Axboe } 1704ed29b0b4SJens Axboe 1705531113bbSJens Axboe struct file *io_file_get_normal(struct io_kiocb *req, int fd) 1706ed29b0b4SJens Axboe { 1707ed29b0b4SJens Axboe struct file *file = fget(fd); 1708ed29b0b4SJens Axboe 170948863ffdSPavel Begunkov trace_io_uring_file_get(req, fd); 1710ed29b0b4SJens Axboe 1711ed29b0b4SJens Axboe /* we don't allow fixed io_uring files */ 1712e5550a14SJens Axboe if (file && io_is_uring_fops(file)) 1713ed29b0b4SJens Axboe io_req_track_inflight(req); 1714ed29b0b4SJens Axboe return file; 1715ed29b0b4SJens Axboe } 1716ed29b0b4SJens Axboe 1717ed29b0b4SJens Axboe static void io_queue_async(struct io_kiocb *req, int ret) 1718ed29b0b4SJens Axboe __must_hold(&req->ctx->uring_lock) 1719ed29b0b4SJens Axboe { 1720ed29b0b4SJens Axboe struct io_kiocb *linked_timeout; 1721ed29b0b4SJens Axboe 1722ed29b0b4SJens Axboe if (ret != -EAGAIN || (req->flags & REQ_F_NOWAIT)) { 1723ed29b0b4SJens Axboe io_req_complete_failed(req, ret); 1724ed29b0b4SJens Axboe return; 1725ed29b0b4SJens Axboe } 1726ed29b0b4SJens Axboe 1727ed29b0b4SJens Axboe linked_timeout = io_prep_linked_timeout(req); 1728ed29b0b4SJens Axboe 1729ed29b0b4SJens Axboe switch (io_arm_poll_handler(req, 0)) { 1730ed29b0b4SJens Axboe case IO_APOLL_READY: 1731ed29b0b4SJens Axboe io_req_task_queue(req); 1732ed29b0b4SJens Axboe break; 1733ed29b0b4SJens Axboe case IO_APOLL_ABORTED: 1734ed29b0b4SJens Axboe /* 1735ed29b0b4SJens Axboe * Queued up for async execution, worker will release 1736ed29b0b4SJens Axboe * submit reference when the iocb is actually submitted. 1737ed29b0b4SJens Axboe */ 1738ed29b0b4SJens Axboe io_kbuf_recycle(req, 0); 1739ed29b0b4SJens Axboe io_queue_iowq(req, NULL); 1740ed29b0b4SJens Axboe break; 1741ed29b0b4SJens Axboe case IO_APOLL_OK: 1742ed29b0b4SJens Axboe break; 1743ed29b0b4SJens Axboe } 1744ed29b0b4SJens Axboe 1745ed29b0b4SJens Axboe if (linked_timeout) 1746ed29b0b4SJens Axboe io_queue_linked_timeout(linked_timeout); 1747ed29b0b4SJens Axboe } 1748ed29b0b4SJens Axboe 1749ed29b0b4SJens Axboe static inline void io_queue_sqe(struct io_kiocb *req) 1750ed29b0b4SJens Axboe __must_hold(&req->ctx->uring_lock) 1751ed29b0b4SJens Axboe { 1752ed29b0b4SJens Axboe int ret; 1753ed29b0b4SJens Axboe 1754ed29b0b4SJens Axboe ret = io_issue_sqe(req, IO_URING_F_NONBLOCK|IO_URING_F_COMPLETE_DEFER); 1755ed29b0b4SJens Axboe 1756ed29b0b4SJens Axboe /* 1757ed29b0b4SJens Axboe * We async punt it if the file wasn't marked NOWAIT, or if the file 1758ed29b0b4SJens Axboe * doesn't support non-blocking read/write attempts 1759ed29b0b4SJens Axboe */ 1760ed29b0b4SJens Axboe if (likely(!ret)) 1761ed29b0b4SJens Axboe io_arm_ltimeout(req); 1762ed29b0b4SJens Axboe else 1763ed29b0b4SJens Axboe io_queue_async(req, ret); 1764ed29b0b4SJens Axboe } 1765ed29b0b4SJens Axboe 1766ed29b0b4SJens Axboe static void io_queue_sqe_fallback(struct io_kiocb *req) 1767ed29b0b4SJens Axboe __must_hold(&req->ctx->uring_lock) 1768ed29b0b4SJens Axboe { 1769ed29b0b4SJens Axboe if (unlikely(req->flags & REQ_F_FAIL)) { 1770ed29b0b4SJens Axboe /* 1771ed29b0b4SJens Axboe * We don't submit, fail them all, for that replace hardlinks 1772ed29b0b4SJens Axboe * with normal links. Extra REQ_F_LINK is tolerated. 1773ed29b0b4SJens Axboe */ 1774ed29b0b4SJens Axboe req->flags &= ~REQ_F_HARDLINK; 1775ed29b0b4SJens Axboe req->flags |= REQ_F_LINK; 1776ed29b0b4SJens Axboe io_req_complete_failed(req, req->cqe.res); 1777ed29b0b4SJens Axboe } else if (unlikely(req->ctx->drain_active)) { 1778ed29b0b4SJens Axboe io_drain_req(req); 1779ed29b0b4SJens Axboe } else { 1780ed29b0b4SJens Axboe int ret = io_req_prep_async(req); 1781ed29b0b4SJens Axboe 1782ed29b0b4SJens Axboe if (unlikely(ret)) 1783ed29b0b4SJens Axboe io_req_complete_failed(req, ret); 1784ed29b0b4SJens Axboe else 1785ed29b0b4SJens Axboe io_queue_iowq(req, NULL); 1786ed29b0b4SJens Axboe } 1787ed29b0b4SJens Axboe } 1788ed29b0b4SJens Axboe 1789ed29b0b4SJens Axboe /* 1790ed29b0b4SJens Axboe * Check SQE restrictions (opcode and flags). 1791ed29b0b4SJens Axboe * 1792ed29b0b4SJens Axboe * Returns 'true' if SQE is allowed, 'false' otherwise. 1793ed29b0b4SJens Axboe */ 1794ed29b0b4SJens Axboe static inline bool io_check_restriction(struct io_ring_ctx *ctx, 1795ed29b0b4SJens Axboe struct io_kiocb *req, 1796ed29b0b4SJens Axboe unsigned int sqe_flags) 1797ed29b0b4SJens Axboe { 1798ed29b0b4SJens Axboe if (!test_bit(req->opcode, ctx->restrictions.sqe_op)) 1799ed29b0b4SJens Axboe return false; 1800ed29b0b4SJens Axboe 1801ed29b0b4SJens Axboe if ((sqe_flags & ctx->restrictions.sqe_flags_required) != 1802ed29b0b4SJens Axboe ctx->restrictions.sqe_flags_required) 1803ed29b0b4SJens Axboe return false; 1804ed29b0b4SJens Axboe 1805ed29b0b4SJens Axboe if (sqe_flags & ~(ctx->restrictions.sqe_flags_allowed | 1806ed29b0b4SJens Axboe ctx->restrictions.sqe_flags_required)) 1807ed29b0b4SJens Axboe return false; 1808ed29b0b4SJens Axboe 1809ed29b0b4SJens Axboe return true; 1810ed29b0b4SJens Axboe } 1811ed29b0b4SJens Axboe 1812ed29b0b4SJens Axboe static void io_init_req_drain(struct io_kiocb *req) 1813ed29b0b4SJens Axboe { 1814ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 1815ed29b0b4SJens Axboe struct io_kiocb *head = ctx->submit_state.link.head; 1816ed29b0b4SJens Axboe 1817ed29b0b4SJens Axboe ctx->drain_active = true; 1818ed29b0b4SJens Axboe if (head) { 1819ed29b0b4SJens Axboe /* 1820ed29b0b4SJens Axboe * If we need to drain a request in the middle of a link, drain 1821ed29b0b4SJens Axboe * the head request and the next request/link after the current 1822ed29b0b4SJens Axboe * link. Considering sequential execution of links, 1823ed29b0b4SJens Axboe * REQ_F_IO_DRAIN will be maintained for every request of our 1824ed29b0b4SJens Axboe * link. 1825ed29b0b4SJens Axboe */ 1826ed29b0b4SJens Axboe head->flags |= REQ_F_IO_DRAIN | REQ_F_FORCE_ASYNC; 1827ed29b0b4SJens Axboe ctx->drain_next = true; 1828ed29b0b4SJens Axboe } 1829ed29b0b4SJens Axboe } 1830ed29b0b4SJens Axboe 1831ed29b0b4SJens Axboe static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, 1832ed29b0b4SJens Axboe const struct io_uring_sqe *sqe) 1833ed29b0b4SJens Axboe __must_hold(&ctx->uring_lock) 1834ed29b0b4SJens Axboe { 1835ed29b0b4SJens Axboe const struct io_op_def *def; 1836ed29b0b4SJens Axboe unsigned int sqe_flags; 1837ed29b0b4SJens Axboe int personality; 1838ed29b0b4SJens Axboe u8 opcode; 1839ed29b0b4SJens Axboe 1840ed29b0b4SJens Axboe /* req is partially pre-initialised, see io_preinit_req() */ 1841ed29b0b4SJens Axboe req->opcode = opcode = READ_ONCE(sqe->opcode); 1842ed29b0b4SJens Axboe /* same numerical values with corresponding REQ_F_*, safe to copy */ 1843ed29b0b4SJens Axboe req->flags = sqe_flags = READ_ONCE(sqe->flags); 1844ed29b0b4SJens Axboe req->cqe.user_data = READ_ONCE(sqe->user_data); 1845ed29b0b4SJens Axboe req->file = NULL; 1846ed29b0b4SJens Axboe req->rsrc_node = NULL; 1847ed29b0b4SJens Axboe req->task = current; 1848ed29b0b4SJens Axboe 1849ed29b0b4SJens Axboe if (unlikely(opcode >= IORING_OP_LAST)) { 1850ed29b0b4SJens Axboe req->opcode = 0; 1851ed29b0b4SJens Axboe return -EINVAL; 1852ed29b0b4SJens Axboe } 1853ed29b0b4SJens Axboe def = &io_op_defs[opcode]; 1854ed29b0b4SJens Axboe if (unlikely(sqe_flags & ~SQE_COMMON_FLAGS)) { 1855ed29b0b4SJens Axboe /* enforce forwards compatibility on users */ 1856ed29b0b4SJens Axboe if (sqe_flags & ~SQE_VALID_FLAGS) 1857ed29b0b4SJens Axboe return -EINVAL; 1858ed29b0b4SJens Axboe if (sqe_flags & IOSQE_BUFFER_SELECT) { 1859ed29b0b4SJens Axboe if (!def->buffer_select) 1860ed29b0b4SJens Axboe return -EOPNOTSUPP; 1861ed29b0b4SJens Axboe req->buf_index = READ_ONCE(sqe->buf_group); 1862ed29b0b4SJens Axboe } 1863ed29b0b4SJens Axboe if (sqe_flags & IOSQE_CQE_SKIP_SUCCESS) 1864ed29b0b4SJens Axboe ctx->drain_disabled = true; 1865ed29b0b4SJens Axboe if (sqe_flags & IOSQE_IO_DRAIN) { 1866ed29b0b4SJens Axboe if (ctx->drain_disabled) 1867ed29b0b4SJens Axboe return -EOPNOTSUPP; 1868ed29b0b4SJens Axboe io_init_req_drain(req); 1869ed29b0b4SJens Axboe } 1870ed29b0b4SJens Axboe } 1871ed29b0b4SJens Axboe if (unlikely(ctx->restricted || ctx->drain_active || ctx->drain_next)) { 1872ed29b0b4SJens Axboe if (ctx->restricted && !io_check_restriction(ctx, req, sqe_flags)) 1873ed29b0b4SJens Axboe return -EACCES; 1874ed29b0b4SJens Axboe /* knock it to the slow queue path, will be drained there */ 1875ed29b0b4SJens Axboe if (ctx->drain_active) 1876ed29b0b4SJens Axboe req->flags |= REQ_F_FORCE_ASYNC; 1877ed29b0b4SJens Axboe /* if there is no link, we're at "next" request and need to drain */ 1878ed29b0b4SJens Axboe if (unlikely(ctx->drain_next) && !ctx->submit_state.link.head) { 1879ed29b0b4SJens Axboe ctx->drain_next = false; 1880ed29b0b4SJens Axboe ctx->drain_active = true; 1881ed29b0b4SJens Axboe req->flags |= REQ_F_IO_DRAIN | REQ_F_FORCE_ASYNC; 1882ed29b0b4SJens Axboe } 1883ed29b0b4SJens Axboe } 1884ed29b0b4SJens Axboe 1885ed29b0b4SJens Axboe if (!def->ioprio && sqe->ioprio) 1886ed29b0b4SJens Axboe return -EINVAL; 1887ed29b0b4SJens Axboe if (!def->iopoll && (ctx->flags & IORING_SETUP_IOPOLL)) 1888ed29b0b4SJens Axboe return -EINVAL; 1889ed29b0b4SJens Axboe 1890ed29b0b4SJens Axboe if (def->needs_file) { 1891ed29b0b4SJens Axboe struct io_submit_state *state = &ctx->submit_state; 1892ed29b0b4SJens Axboe 1893ed29b0b4SJens Axboe req->cqe.fd = READ_ONCE(sqe->fd); 1894ed29b0b4SJens Axboe 1895ed29b0b4SJens Axboe /* 1896ed29b0b4SJens Axboe * Plug now if we have more than 2 IO left after this, and the 1897ed29b0b4SJens Axboe * target is potentially a read/write to block based storage. 1898ed29b0b4SJens Axboe */ 1899ed29b0b4SJens Axboe if (state->need_plug && def->plug) { 1900ed29b0b4SJens Axboe state->plug_started = true; 1901ed29b0b4SJens Axboe state->need_plug = false; 1902ed29b0b4SJens Axboe blk_start_plug_nr_ios(&state->plug, state->submit_nr); 1903ed29b0b4SJens Axboe } 1904ed29b0b4SJens Axboe } 1905ed29b0b4SJens Axboe 1906ed29b0b4SJens Axboe personality = READ_ONCE(sqe->personality); 1907ed29b0b4SJens Axboe if (personality) { 1908ed29b0b4SJens Axboe int ret; 1909ed29b0b4SJens Axboe 1910ed29b0b4SJens Axboe req->creds = xa_load(&ctx->personalities, personality); 1911ed29b0b4SJens Axboe if (!req->creds) 1912ed29b0b4SJens Axboe return -EINVAL; 1913ed29b0b4SJens Axboe get_cred(req->creds); 1914ed29b0b4SJens Axboe ret = security_uring_override_creds(req->creds); 1915ed29b0b4SJens Axboe if (ret) { 1916ed29b0b4SJens Axboe put_cred(req->creds); 1917ed29b0b4SJens Axboe return ret; 1918ed29b0b4SJens Axboe } 1919ed29b0b4SJens Axboe req->flags |= REQ_F_CREDS; 1920ed29b0b4SJens Axboe } 1921ed29b0b4SJens Axboe 1922ed29b0b4SJens Axboe return def->prep(req, sqe); 1923ed29b0b4SJens Axboe } 1924ed29b0b4SJens Axboe 1925ed29b0b4SJens Axboe static __cold int io_submit_fail_init(const struct io_uring_sqe *sqe, 1926ed29b0b4SJens Axboe struct io_kiocb *req, int ret) 1927ed29b0b4SJens Axboe { 1928ed29b0b4SJens Axboe struct io_ring_ctx *ctx = req->ctx; 1929ed29b0b4SJens Axboe struct io_submit_link *link = &ctx->submit_state.link; 1930ed29b0b4SJens Axboe struct io_kiocb *head = link->head; 1931ed29b0b4SJens Axboe 193248863ffdSPavel Begunkov trace_io_uring_req_failed(sqe, req, ret); 1933ed29b0b4SJens Axboe 1934ed29b0b4SJens Axboe /* 1935ed29b0b4SJens Axboe * Avoid breaking links in the middle as it renders links with SQPOLL 1936ed29b0b4SJens Axboe * unusable. Instead of failing eagerly, continue assembling the link if 1937ed29b0b4SJens Axboe * applicable and mark the head with REQ_F_FAIL. The link flushing code 1938ed29b0b4SJens Axboe * should find the flag and handle the rest. 1939ed29b0b4SJens Axboe */ 1940ed29b0b4SJens Axboe req_fail_link_node(req, ret); 1941ed29b0b4SJens Axboe if (head && !(head->flags & REQ_F_FAIL)) 1942ed29b0b4SJens Axboe req_fail_link_node(head, -ECANCELED); 1943ed29b0b4SJens Axboe 1944ed29b0b4SJens Axboe if (!(req->flags & IO_REQ_LINK_FLAGS)) { 1945ed29b0b4SJens Axboe if (head) { 1946ed29b0b4SJens Axboe link->last->link = req; 1947ed29b0b4SJens Axboe link->head = NULL; 1948ed29b0b4SJens Axboe req = head; 1949ed29b0b4SJens Axboe } 1950ed29b0b4SJens Axboe io_queue_sqe_fallback(req); 1951ed29b0b4SJens Axboe return ret; 1952ed29b0b4SJens Axboe } 1953ed29b0b4SJens Axboe 1954ed29b0b4SJens Axboe if (head) 1955ed29b0b4SJens Axboe link->last->link = req; 1956ed29b0b4SJens Axboe else 1957ed29b0b4SJens Axboe link->head = req; 1958ed29b0b4SJens Axboe link->last = req; 1959ed29b0b4SJens Axboe return 0; 1960ed29b0b4SJens Axboe } 1961ed29b0b4SJens Axboe 1962ed29b0b4SJens Axboe static inline int io_submit_sqe(struct io_ring_ctx *ctx, struct io_kiocb *req, 1963ed29b0b4SJens Axboe const struct io_uring_sqe *sqe) 1964ed29b0b4SJens Axboe __must_hold(&ctx->uring_lock) 1965ed29b0b4SJens Axboe { 1966ed29b0b4SJens Axboe struct io_submit_link *link = &ctx->submit_state.link; 1967ed29b0b4SJens Axboe int ret; 1968ed29b0b4SJens Axboe 1969ed29b0b4SJens Axboe ret = io_init_req(ctx, req, sqe); 1970ed29b0b4SJens Axboe if (unlikely(ret)) 1971ed29b0b4SJens Axboe return io_submit_fail_init(sqe, req, ret); 1972ed29b0b4SJens Axboe 1973ed29b0b4SJens Axboe /* don't need @sqe from now on */ 197448863ffdSPavel Begunkov trace_io_uring_submit_sqe(req, true); 1975ed29b0b4SJens Axboe 1976ed29b0b4SJens Axboe /* 1977ed29b0b4SJens Axboe * If we already have a head request, queue this one for async 1978ed29b0b4SJens Axboe * submittal once the head completes. If we don't have a head but 1979ed29b0b4SJens Axboe * IOSQE_IO_LINK is set in the sqe, start a new head. This one will be 1980ed29b0b4SJens Axboe * submitted sync once the chain is complete. If none of those 1981ed29b0b4SJens Axboe * conditions are true (normal request), then just queue it. 1982ed29b0b4SJens Axboe */ 1983ed29b0b4SJens Axboe if (unlikely(link->head)) { 1984ed29b0b4SJens Axboe ret = io_req_prep_async(req); 1985ed29b0b4SJens Axboe if (unlikely(ret)) 1986ed29b0b4SJens Axboe return io_submit_fail_init(sqe, req, ret); 1987ed29b0b4SJens Axboe 198848863ffdSPavel Begunkov trace_io_uring_link(req, link->head); 1989ed29b0b4SJens Axboe link->last->link = req; 1990ed29b0b4SJens Axboe link->last = req; 1991ed29b0b4SJens Axboe 1992ed29b0b4SJens Axboe if (req->flags & IO_REQ_LINK_FLAGS) 1993ed29b0b4SJens Axboe return 0; 1994ed29b0b4SJens Axboe /* last request of the link, flush it */ 1995ed29b0b4SJens Axboe req = link->head; 1996ed29b0b4SJens Axboe link->head = NULL; 1997ed29b0b4SJens Axboe if (req->flags & (REQ_F_FORCE_ASYNC | REQ_F_FAIL)) 1998ed29b0b4SJens Axboe goto fallback; 1999ed29b0b4SJens Axboe 2000ed29b0b4SJens Axboe } else if (unlikely(req->flags & (IO_REQ_LINK_FLAGS | 2001ed29b0b4SJens Axboe REQ_F_FORCE_ASYNC | REQ_F_FAIL))) { 2002ed29b0b4SJens Axboe if (req->flags & IO_REQ_LINK_FLAGS) { 2003ed29b0b4SJens Axboe link->head = req; 2004ed29b0b4SJens Axboe link->last = req; 2005ed29b0b4SJens Axboe } else { 2006ed29b0b4SJens Axboe fallback: 2007ed29b0b4SJens Axboe io_queue_sqe_fallback(req); 2008ed29b0b4SJens Axboe } 2009ed29b0b4SJens Axboe return 0; 2010ed29b0b4SJens Axboe } 2011ed29b0b4SJens Axboe 2012ed29b0b4SJens Axboe io_queue_sqe(req); 2013ed29b0b4SJens Axboe return 0; 2014ed29b0b4SJens Axboe } 2015ed29b0b4SJens Axboe 2016ed29b0b4SJens Axboe /* 2017ed29b0b4SJens Axboe * Batched submission is done, ensure local IO is flushed out. 2018ed29b0b4SJens Axboe */ 2019ed29b0b4SJens Axboe static void io_submit_state_end(struct io_ring_ctx *ctx) 2020ed29b0b4SJens Axboe { 2021ed29b0b4SJens Axboe struct io_submit_state *state = &ctx->submit_state; 2022ed29b0b4SJens Axboe 2023ed29b0b4SJens Axboe if (unlikely(state->link.head)) 2024ed29b0b4SJens Axboe io_queue_sqe_fallback(state->link.head); 2025ed29b0b4SJens Axboe /* flush only after queuing links as they can generate completions */ 2026ed29b0b4SJens Axboe io_submit_flush_completions(ctx); 2027ed29b0b4SJens Axboe if (state->plug_started) 2028ed29b0b4SJens Axboe blk_finish_plug(&state->plug); 2029ed29b0b4SJens Axboe } 2030ed29b0b4SJens Axboe 2031ed29b0b4SJens Axboe /* 2032ed29b0b4SJens Axboe * Start submission side cache. 2033ed29b0b4SJens Axboe */ 2034ed29b0b4SJens Axboe static void io_submit_state_start(struct io_submit_state *state, 2035ed29b0b4SJens Axboe unsigned int max_ios) 2036ed29b0b4SJens Axboe { 2037ed29b0b4SJens Axboe state->plug_started = false; 2038ed29b0b4SJens Axboe state->need_plug = max_ios > 2; 2039ed29b0b4SJens Axboe state->submit_nr = max_ios; 2040ed29b0b4SJens Axboe /* set only head, no need to init link_last in advance */ 2041ed29b0b4SJens Axboe state->link.head = NULL; 2042ed29b0b4SJens Axboe } 2043ed29b0b4SJens Axboe 2044ed29b0b4SJens Axboe static void io_commit_sqring(struct io_ring_ctx *ctx) 2045ed29b0b4SJens Axboe { 2046ed29b0b4SJens Axboe struct io_rings *rings = ctx->rings; 2047ed29b0b4SJens Axboe 2048ed29b0b4SJens Axboe /* 2049ed29b0b4SJens Axboe * Ensure any loads from the SQEs are done at this point, 2050ed29b0b4SJens Axboe * since once we write the new head, the application could 2051ed29b0b4SJens Axboe * write new data to them. 2052ed29b0b4SJens Axboe */ 2053ed29b0b4SJens Axboe smp_store_release(&rings->sq.head, ctx->cached_sq_head); 2054ed29b0b4SJens Axboe } 2055ed29b0b4SJens Axboe 2056ed29b0b4SJens Axboe /* 2057ed29b0b4SJens Axboe * Fetch an sqe, if one is available. Note this returns a pointer to memory 2058ed29b0b4SJens Axboe * that is mapped by userspace. This means that care needs to be taken to 2059ed29b0b4SJens Axboe * ensure that reads are stable, as we cannot rely on userspace always 2060ed29b0b4SJens Axboe * being a good citizen. If members of the sqe are validated and then later 2061ed29b0b4SJens Axboe * used, it's important that those reads are done through READ_ONCE() to 2062ed29b0b4SJens Axboe * prevent a re-load down the line. 2063ed29b0b4SJens Axboe */ 2064ed29b0b4SJens Axboe static const struct io_uring_sqe *io_get_sqe(struct io_ring_ctx *ctx) 2065ed29b0b4SJens Axboe { 2066ed29b0b4SJens Axboe unsigned head, mask = ctx->sq_entries - 1; 2067ed29b0b4SJens Axboe unsigned sq_idx = ctx->cached_sq_head++ & mask; 2068ed29b0b4SJens Axboe 2069ed29b0b4SJens Axboe /* 2070ed29b0b4SJens Axboe * The cached sq head (or cq tail) serves two purposes: 2071ed29b0b4SJens Axboe * 2072ed29b0b4SJens Axboe * 1) allows us to batch the cost of updating the user visible 2073ed29b0b4SJens Axboe * head updates. 2074ed29b0b4SJens Axboe * 2) allows the kernel side to track the head on its own, even 2075ed29b0b4SJens Axboe * though the application is the one updating it. 2076ed29b0b4SJens Axboe */ 2077ed29b0b4SJens Axboe head = READ_ONCE(ctx->sq_array[sq_idx]); 2078ed29b0b4SJens Axboe if (likely(head < ctx->sq_entries)) { 2079ed29b0b4SJens Axboe /* double index for 128-byte SQEs, twice as long */ 2080ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_SQE128) 2081ed29b0b4SJens Axboe head <<= 1; 2082ed29b0b4SJens Axboe return &ctx->sq_sqes[head]; 2083ed29b0b4SJens Axboe } 2084ed29b0b4SJens Axboe 2085ed29b0b4SJens Axboe /* drop invalid entries */ 2086ed29b0b4SJens Axboe ctx->cq_extra--; 2087ed29b0b4SJens Axboe WRITE_ONCE(ctx->rings->sq_dropped, 2088ed29b0b4SJens Axboe READ_ONCE(ctx->rings->sq_dropped) + 1); 2089ed29b0b4SJens Axboe return NULL; 2090ed29b0b4SJens Axboe } 2091ed29b0b4SJens Axboe 209217437f31SJens Axboe int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr) 2093ed29b0b4SJens Axboe __must_hold(&ctx->uring_lock) 2094ed29b0b4SJens Axboe { 2095ed29b0b4SJens Axboe unsigned int entries = io_sqring_entries(ctx); 2096ed29b0b4SJens Axboe unsigned int left; 2097ed29b0b4SJens Axboe int ret; 2098ed29b0b4SJens Axboe 2099ed29b0b4SJens Axboe if (unlikely(!entries)) 2100ed29b0b4SJens Axboe return 0; 2101ed29b0b4SJens Axboe /* make sure SQ entry isn't read before tail */ 2102ed29b0b4SJens Axboe ret = left = min3(nr, ctx->sq_entries, entries); 2103ed29b0b4SJens Axboe io_get_task_refs(left); 2104ed29b0b4SJens Axboe io_submit_state_start(&ctx->submit_state, left); 2105ed29b0b4SJens Axboe 2106ed29b0b4SJens Axboe do { 2107ed29b0b4SJens Axboe const struct io_uring_sqe *sqe; 2108ed29b0b4SJens Axboe struct io_kiocb *req; 2109ed29b0b4SJens Axboe 2110ed29b0b4SJens Axboe if (unlikely(!io_alloc_req_refill(ctx))) 2111ed29b0b4SJens Axboe break; 2112ed29b0b4SJens Axboe req = io_alloc_req(ctx); 2113ed29b0b4SJens Axboe sqe = io_get_sqe(ctx); 2114ed29b0b4SJens Axboe if (unlikely(!sqe)) { 2115ed29b0b4SJens Axboe io_req_add_to_cache(req, ctx); 2116ed29b0b4SJens Axboe break; 2117ed29b0b4SJens Axboe } 2118ed29b0b4SJens Axboe 2119ed29b0b4SJens Axboe /* 2120ed29b0b4SJens Axboe * Continue submitting even for sqe failure if the 2121ed29b0b4SJens Axboe * ring was setup with IORING_SETUP_SUBMIT_ALL 2122ed29b0b4SJens Axboe */ 2123ed29b0b4SJens Axboe if (unlikely(io_submit_sqe(ctx, req, sqe)) && 2124ed29b0b4SJens Axboe !(ctx->flags & IORING_SETUP_SUBMIT_ALL)) { 2125ed29b0b4SJens Axboe left--; 2126ed29b0b4SJens Axboe break; 2127ed29b0b4SJens Axboe } 2128ed29b0b4SJens Axboe } while (--left); 2129ed29b0b4SJens Axboe 2130ed29b0b4SJens Axboe if (unlikely(left)) { 2131ed29b0b4SJens Axboe ret -= left; 2132ed29b0b4SJens Axboe /* try again if it submitted nothing and can't allocate a req */ 2133ed29b0b4SJens Axboe if (!ret && io_req_cache_empty(ctx)) 2134ed29b0b4SJens Axboe ret = -EAGAIN; 2135ed29b0b4SJens Axboe current->io_uring->cached_refs += left; 2136ed29b0b4SJens Axboe } 2137ed29b0b4SJens Axboe 2138ed29b0b4SJens Axboe io_submit_state_end(ctx); 2139ed29b0b4SJens Axboe /* Commit SQ ring head once we've consumed and submitted all SQEs */ 2140ed29b0b4SJens Axboe io_commit_sqring(ctx); 2141ed29b0b4SJens Axboe return ret; 2142ed29b0b4SJens Axboe } 2143ed29b0b4SJens Axboe 2144ed29b0b4SJens Axboe struct io_wait_queue { 2145ed29b0b4SJens Axboe struct wait_queue_entry wq; 2146ed29b0b4SJens Axboe struct io_ring_ctx *ctx; 2147ed29b0b4SJens Axboe unsigned cq_tail; 2148ed29b0b4SJens Axboe unsigned nr_timeouts; 2149ed29b0b4SJens Axboe }; 2150ed29b0b4SJens Axboe 2151ed29b0b4SJens Axboe static inline bool io_should_wake(struct io_wait_queue *iowq) 2152ed29b0b4SJens Axboe { 2153ed29b0b4SJens Axboe struct io_ring_ctx *ctx = iowq->ctx; 2154ed29b0b4SJens Axboe int dist = ctx->cached_cq_tail - (int) iowq->cq_tail; 2155ed29b0b4SJens Axboe 2156ed29b0b4SJens Axboe /* 2157ed29b0b4SJens Axboe * Wake up if we have enough events, or if a timeout occurred since we 2158ed29b0b4SJens Axboe * started waiting. For timeouts, we always want to return to userspace, 2159ed29b0b4SJens Axboe * regardless of event count. 2160ed29b0b4SJens Axboe */ 2161ed29b0b4SJens Axboe return dist >= 0 || atomic_read(&ctx->cq_timeouts) != iowq->nr_timeouts; 2162ed29b0b4SJens Axboe } 2163ed29b0b4SJens Axboe 2164ed29b0b4SJens Axboe static int io_wake_function(struct wait_queue_entry *curr, unsigned int mode, 2165ed29b0b4SJens Axboe int wake_flags, void *key) 2166ed29b0b4SJens Axboe { 2167ed29b0b4SJens Axboe struct io_wait_queue *iowq = container_of(curr, struct io_wait_queue, 2168ed29b0b4SJens Axboe wq); 2169ed29b0b4SJens Axboe 2170ed29b0b4SJens Axboe /* 2171ed29b0b4SJens Axboe * Cannot safely flush overflowed CQEs from here, ensure we wake up 2172ed29b0b4SJens Axboe * the task, and the next invocation will do it. 2173ed29b0b4SJens Axboe */ 2174ed29b0b4SJens Axboe if (io_should_wake(iowq) || 2175ed29b0b4SJens Axboe test_bit(IO_CHECK_CQ_OVERFLOW_BIT, &iowq->ctx->check_cq)) 2176ed29b0b4SJens Axboe return autoremove_wake_function(curr, mode, wake_flags, key); 2177ed29b0b4SJens Axboe return -1; 2178ed29b0b4SJens Axboe } 2179ed29b0b4SJens Axboe 218073572984SJens Axboe int io_run_task_work_sig(void) 2181ed29b0b4SJens Axboe { 2182ed29b0b4SJens Axboe if (io_run_task_work()) 2183ed29b0b4SJens Axboe return 1; 2184ed29b0b4SJens Axboe if (task_sigpending(current)) 2185ed29b0b4SJens Axboe return -EINTR; 2186ed29b0b4SJens Axboe return 0; 2187ed29b0b4SJens Axboe } 2188ed29b0b4SJens Axboe 2189ed29b0b4SJens Axboe /* when returns >0, the caller should retry */ 2190ed29b0b4SJens Axboe static inline int io_cqring_wait_schedule(struct io_ring_ctx *ctx, 2191ed29b0b4SJens Axboe struct io_wait_queue *iowq, 2192ed29b0b4SJens Axboe ktime_t timeout) 2193ed29b0b4SJens Axboe { 2194ed29b0b4SJens Axboe int ret; 2195ed29b0b4SJens Axboe unsigned long check_cq; 2196ed29b0b4SJens Axboe 2197ed29b0b4SJens Axboe /* make sure we run task_work before checking for signals */ 2198ed29b0b4SJens Axboe ret = io_run_task_work_sig(); 2199ed29b0b4SJens Axboe if (ret || io_should_wake(iowq)) 2200ed29b0b4SJens Axboe return ret; 22013a08576bSPavel Begunkov 2202ed29b0b4SJens Axboe check_cq = READ_ONCE(ctx->check_cq); 22033a08576bSPavel Begunkov if (unlikely(check_cq)) { 2204ed29b0b4SJens Axboe /* let the caller flush overflows, retry */ 2205ed29b0b4SJens Axboe if (check_cq & BIT(IO_CHECK_CQ_OVERFLOW_BIT)) 2206ed29b0b4SJens Axboe return 1; 22073a08576bSPavel Begunkov if (check_cq & BIT(IO_CHECK_CQ_DROPPED_BIT)) 2208ed29b0b4SJens Axboe return -EBADR; 22093a08576bSPavel Begunkov } 2210ed29b0b4SJens Axboe if (!schedule_hrtimeout(&timeout, HRTIMER_MODE_ABS)) 2211ed29b0b4SJens Axboe return -ETIME; 2212ed29b0b4SJens Axboe return 1; 2213ed29b0b4SJens Axboe } 2214ed29b0b4SJens Axboe 2215ed29b0b4SJens Axboe /* 2216ed29b0b4SJens Axboe * Wait until events become available, if we don't already have some. The 2217ed29b0b4SJens Axboe * application must reap them itself, as they reside on the shared cq ring. 2218ed29b0b4SJens Axboe */ 2219ed29b0b4SJens Axboe static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events, 2220ed29b0b4SJens Axboe const sigset_t __user *sig, size_t sigsz, 2221ed29b0b4SJens Axboe struct __kernel_timespec __user *uts) 2222ed29b0b4SJens Axboe { 2223ed29b0b4SJens Axboe struct io_wait_queue iowq; 2224ed29b0b4SJens Axboe struct io_rings *rings = ctx->rings; 2225ed29b0b4SJens Axboe ktime_t timeout = KTIME_MAX; 2226ed29b0b4SJens Axboe int ret; 2227ed29b0b4SJens Axboe 2228ed29b0b4SJens Axboe do { 2229ed29b0b4SJens Axboe io_cqring_overflow_flush(ctx); 2230ed29b0b4SJens Axboe if (io_cqring_events(ctx) >= min_events) 2231ed29b0b4SJens Axboe return 0; 2232ed29b0b4SJens Axboe if (!io_run_task_work()) 2233ed29b0b4SJens Axboe break; 2234ed29b0b4SJens Axboe } while (1); 2235ed29b0b4SJens Axboe 2236ed29b0b4SJens Axboe if (sig) { 2237ed29b0b4SJens Axboe #ifdef CONFIG_COMPAT 2238ed29b0b4SJens Axboe if (in_compat_syscall()) 2239ed29b0b4SJens Axboe ret = set_compat_user_sigmask((const compat_sigset_t __user *)sig, 2240ed29b0b4SJens Axboe sigsz); 2241ed29b0b4SJens Axboe else 2242ed29b0b4SJens Axboe #endif 2243ed29b0b4SJens Axboe ret = set_user_sigmask(sig, sigsz); 2244ed29b0b4SJens Axboe 2245ed29b0b4SJens Axboe if (ret) 2246ed29b0b4SJens Axboe return ret; 2247ed29b0b4SJens Axboe } 2248ed29b0b4SJens Axboe 2249ed29b0b4SJens Axboe if (uts) { 2250ed29b0b4SJens Axboe struct timespec64 ts; 2251ed29b0b4SJens Axboe 2252ed29b0b4SJens Axboe if (get_timespec64(&ts, uts)) 2253ed29b0b4SJens Axboe return -EFAULT; 2254ed29b0b4SJens Axboe timeout = ktime_add_ns(timespec64_to_ktime(ts), ktime_get_ns()); 2255ed29b0b4SJens Axboe } 2256ed29b0b4SJens Axboe 2257ed29b0b4SJens Axboe init_waitqueue_func_entry(&iowq.wq, io_wake_function); 2258ed29b0b4SJens Axboe iowq.wq.private = current; 2259ed29b0b4SJens Axboe INIT_LIST_HEAD(&iowq.wq.entry); 2260ed29b0b4SJens Axboe iowq.ctx = ctx; 2261ed29b0b4SJens Axboe iowq.nr_timeouts = atomic_read(&ctx->cq_timeouts); 2262ed29b0b4SJens Axboe iowq.cq_tail = READ_ONCE(ctx->rings->cq.head) + min_events; 2263ed29b0b4SJens Axboe 2264ed29b0b4SJens Axboe trace_io_uring_cqring_wait(ctx, min_events); 2265ed29b0b4SJens Axboe do { 2266ed29b0b4SJens Axboe /* if we can't even flush overflow, don't wait for more */ 2267ed29b0b4SJens Axboe if (!io_cqring_overflow_flush(ctx)) { 2268ed29b0b4SJens Axboe ret = -EBUSY; 2269ed29b0b4SJens Axboe break; 2270ed29b0b4SJens Axboe } 2271ed29b0b4SJens Axboe prepare_to_wait_exclusive(&ctx->cq_wait, &iowq.wq, 2272ed29b0b4SJens Axboe TASK_INTERRUPTIBLE); 2273ed29b0b4SJens Axboe ret = io_cqring_wait_schedule(ctx, &iowq, timeout); 2274ed29b0b4SJens Axboe cond_resched(); 2275ed29b0b4SJens Axboe } while (ret > 0); 2276ed29b0b4SJens Axboe 2277ed29b0b4SJens Axboe finish_wait(&ctx->cq_wait, &iowq.wq); 2278ed29b0b4SJens Axboe restore_saved_sigmask_unless(ret == -EINTR); 2279ed29b0b4SJens Axboe 2280ed29b0b4SJens Axboe return READ_ONCE(rings->cq.head) == READ_ONCE(rings->cq.tail) ? ret : 0; 2281ed29b0b4SJens Axboe } 2282ed29b0b4SJens Axboe 2283ed29b0b4SJens Axboe static void io_mem_free(void *ptr) 2284ed29b0b4SJens Axboe { 2285ed29b0b4SJens Axboe struct page *page; 2286ed29b0b4SJens Axboe 2287ed29b0b4SJens Axboe if (!ptr) 2288ed29b0b4SJens Axboe return; 2289ed29b0b4SJens Axboe 2290ed29b0b4SJens Axboe page = virt_to_head_page(ptr); 2291ed29b0b4SJens Axboe if (put_page_testzero(page)) 2292ed29b0b4SJens Axboe free_compound_page(page); 2293ed29b0b4SJens Axboe } 2294ed29b0b4SJens Axboe 2295ed29b0b4SJens Axboe static void *io_mem_alloc(size_t size) 2296ed29b0b4SJens Axboe { 2297ed29b0b4SJens Axboe gfp_t gfp = GFP_KERNEL_ACCOUNT | __GFP_ZERO | __GFP_NOWARN | __GFP_COMP; 2298ed29b0b4SJens Axboe 2299ed29b0b4SJens Axboe return (void *) __get_free_pages(gfp, get_order(size)); 2300ed29b0b4SJens Axboe } 2301ed29b0b4SJens Axboe 2302ed29b0b4SJens Axboe static unsigned long rings_size(struct io_ring_ctx *ctx, unsigned int sq_entries, 2303ed29b0b4SJens Axboe unsigned int cq_entries, size_t *sq_offset) 2304ed29b0b4SJens Axboe { 2305ed29b0b4SJens Axboe struct io_rings *rings; 2306ed29b0b4SJens Axboe size_t off, sq_array_size; 2307ed29b0b4SJens Axboe 2308ed29b0b4SJens Axboe off = struct_size(rings, cqes, cq_entries); 2309ed29b0b4SJens Axboe if (off == SIZE_MAX) 2310ed29b0b4SJens Axboe return SIZE_MAX; 2311ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_CQE32) { 2312ed29b0b4SJens Axboe if (check_shl_overflow(off, 1, &off)) 2313ed29b0b4SJens Axboe return SIZE_MAX; 2314ed29b0b4SJens Axboe } 2315ed29b0b4SJens Axboe 2316ed29b0b4SJens Axboe #ifdef CONFIG_SMP 2317ed29b0b4SJens Axboe off = ALIGN(off, SMP_CACHE_BYTES); 2318ed29b0b4SJens Axboe if (off == 0) 2319ed29b0b4SJens Axboe return SIZE_MAX; 2320ed29b0b4SJens Axboe #endif 2321ed29b0b4SJens Axboe 2322ed29b0b4SJens Axboe if (sq_offset) 2323ed29b0b4SJens Axboe *sq_offset = off; 2324ed29b0b4SJens Axboe 2325ed29b0b4SJens Axboe sq_array_size = array_size(sizeof(u32), sq_entries); 2326ed29b0b4SJens Axboe if (sq_array_size == SIZE_MAX) 2327ed29b0b4SJens Axboe return SIZE_MAX; 2328ed29b0b4SJens Axboe 2329ed29b0b4SJens Axboe if (check_add_overflow(off, sq_array_size, &off)) 2330ed29b0b4SJens Axboe return SIZE_MAX; 2331ed29b0b4SJens Axboe 2332ed29b0b4SJens Axboe return off; 2333ed29b0b4SJens Axboe } 2334ed29b0b4SJens Axboe 2335ed29b0b4SJens Axboe static int io_eventfd_register(struct io_ring_ctx *ctx, void __user *arg, 2336ed29b0b4SJens Axboe unsigned int eventfd_async) 2337ed29b0b4SJens Axboe { 2338ed29b0b4SJens Axboe struct io_ev_fd *ev_fd; 2339ed29b0b4SJens Axboe __s32 __user *fds = arg; 2340ed29b0b4SJens Axboe int fd; 2341ed29b0b4SJens Axboe 2342ed29b0b4SJens Axboe ev_fd = rcu_dereference_protected(ctx->io_ev_fd, 2343ed29b0b4SJens Axboe lockdep_is_held(&ctx->uring_lock)); 2344ed29b0b4SJens Axboe if (ev_fd) 2345ed29b0b4SJens Axboe return -EBUSY; 2346ed29b0b4SJens Axboe 2347ed29b0b4SJens Axboe if (copy_from_user(&fd, fds, sizeof(*fds))) 2348ed29b0b4SJens Axboe return -EFAULT; 2349ed29b0b4SJens Axboe 2350ed29b0b4SJens Axboe ev_fd = kmalloc(sizeof(*ev_fd), GFP_KERNEL); 2351ed29b0b4SJens Axboe if (!ev_fd) 2352ed29b0b4SJens Axboe return -ENOMEM; 2353ed29b0b4SJens Axboe 2354ed29b0b4SJens Axboe ev_fd->cq_ev_fd = eventfd_ctx_fdget(fd); 2355ed29b0b4SJens Axboe if (IS_ERR(ev_fd->cq_ev_fd)) { 2356ed29b0b4SJens Axboe int ret = PTR_ERR(ev_fd->cq_ev_fd); 2357ed29b0b4SJens Axboe kfree(ev_fd); 2358ed29b0b4SJens Axboe return ret; 2359ed29b0b4SJens Axboe } 2360305bef98SPavel Begunkov 2361305bef98SPavel Begunkov spin_lock(&ctx->completion_lock); 2362305bef98SPavel Begunkov ctx->evfd_last_cq_tail = ctx->cached_cq_tail; 2363305bef98SPavel Begunkov spin_unlock(&ctx->completion_lock); 2364305bef98SPavel Begunkov 2365ed29b0b4SJens Axboe ev_fd->eventfd_async = eventfd_async; 2366ed29b0b4SJens Axboe ctx->has_evfd = true; 2367ed29b0b4SJens Axboe rcu_assign_pointer(ctx->io_ev_fd, ev_fd); 2368ed29b0b4SJens Axboe return 0; 2369ed29b0b4SJens Axboe } 2370ed29b0b4SJens Axboe 2371ed29b0b4SJens Axboe static void io_eventfd_put(struct rcu_head *rcu) 2372ed29b0b4SJens Axboe { 2373ed29b0b4SJens Axboe struct io_ev_fd *ev_fd = container_of(rcu, struct io_ev_fd, rcu); 2374ed29b0b4SJens Axboe 2375ed29b0b4SJens Axboe eventfd_ctx_put(ev_fd->cq_ev_fd); 2376ed29b0b4SJens Axboe kfree(ev_fd); 2377ed29b0b4SJens Axboe } 2378ed29b0b4SJens Axboe 2379ed29b0b4SJens Axboe static int io_eventfd_unregister(struct io_ring_ctx *ctx) 2380ed29b0b4SJens Axboe { 2381ed29b0b4SJens Axboe struct io_ev_fd *ev_fd; 2382ed29b0b4SJens Axboe 2383ed29b0b4SJens Axboe ev_fd = rcu_dereference_protected(ctx->io_ev_fd, 2384ed29b0b4SJens Axboe lockdep_is_held(&ctx->uring_lock)); 2385ed29b0b4SJens Axboe if (ev_fd) { 2386ed29b0b4SJens Axboe ctx->has_evfd = false; 2387ed29b0b4SJens Axboe rcu_assign_pointer(ctx->io_ev_fd, NULL); 2388ed29b0b4SJens Axboe call_rcu(&ev_fd->rcu, io_eventfd_put); 2389ed29b0b4SJens Axboe return 0; 2390ed29b0b4SJens Axboe } 2391ed29b0b4SJens Axboe 2392ed29b0b4SJens Axboe return -ENXIO; 2393ed29b0b4SJens Axboe } 2394ed29b0b4SJens Axboe 2395ed29b0b4SJens Axboe static void io_req_caches_free(struct io_ring_ctx *ctx) 2396ed29b0b4SJens Axboe { 2397ed29b0b4SJens Axboe struct io_submit_state *state = &ctx->submit_state; 2398ed29b0b4SJens Axboe int nr = 0; 2399ed29b0b4SJens Axboe 2400ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 2401ed29b0b4SJens Axboe io_flush_cached_locked_reqs(ctx, state); 2402ed29b0b4SJens Axboe 2403ed29b0b4SJens Axboe while (!io_req_cache_empty(ctx)) { 2404ed29b0b4SJens Axboe struct io_wq_work_node *node; 2405ed29b0b4SJens Axboe struct io_kiocb *req; 2406ed29b0b4SJens Axboe 2407ed29b0b4SJens Axboe node = wq_stack_extract(&state->free_list); 2408ed29b0b4SJens Axboe req = container_of(node, struct io_kiocb, comp_list); 2409ed29b0b4SJens Axboe kmem_cache_free(req_cachep, req); 2410ed29b0b4SJens Axboe nr++; 2411ed29b0b4SJens Axboe } 2412ed29b0b4SJens Axboe if (nr) 2413ed29b0b4SJens Axboe percpu_ref_put_many(&ctx->refs, nr); 2414ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 2415ed29b0b4SJens Axboe } 2416ed29b0b4SJens Axboe 2417ed29b0b4SJens Axboe static __cold void io_ring_ctx_free(struct io_ring_ctx *ctx) 2418ed29b0b4SJens Axboe { 2419ed29b0b4SJens Axboe io_sq_thread_finish(ctx); 2420ed29b0b4SJens Axboe 2421ed29b0b4SJens Axboe if (ctx->mm_account) { 2422ed29b0b4SJens Axboe mmdrop(ctx->mm_account); 2423ed29b0b4SJens Axboe ctx->mm_account = NULL; 2424ed29b0b4SJens Axboe } 2425ed29b0b4SJens Axboe 2426ed29b0b4SJens Axboe io_rsrc_refs_drop(ctx); 2427ed29b0b4SJens Axboe /* __io_rsrc_put_work() may need uring_lock to progress, wait w/o it */ 2428ed29b0b4SJens Axboe io_wait_rsrc_data(ctx->buf_data); 2429ed29b0b4SJens Axboe io_wait_rsrc_data(ctx->file_data); 2430ed29b0b4SJens Axboe 2431ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 2432ed29b0b4SJens Axboe if (ctx->buf_data) 2433ed29b0b4SJens Axboe __io_sqe_buffers_unregister(ctx); 2434ed29b0b4SJens Axboe if (ctx->file_data) 2435ed29b0b4SJens Axboe __io_sqe_files_unregister(ctx); 2436ed29b0b4SJens Axboe if (ctx->rings) 2437ed29b0b4SJens Axboe __io_cqring_overflow_flush(ctx, true); 2438ed29b0b4SJens Axboe io_eventfd_unregister(ctx); 24399b797a37SJens Axboe io_alloc_cache_free(&ctx->apoll_cache, io_apoll_cache_free); 244043e0bbbdSJens Axboe io_alloc_cache_free(&ctx->netmsg_cache, io_netmsg_cache_free); 2441ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 2442ed29b0b4SJens Axboe io_destroy_buffers(ctx); 2443ed29b0b4SJens Axboe if (ctx->sq_creds) 2444ed29b0b4SJens Axboe put_cred(ctx->sq_creds); 244597bbdc06SPavel Begunkov if (ctx->submitter_task) 244697bbdc06SPavel Begunkov put_task_struct(ctx->submitter_task); 2447ed29b0b4SJens Axboe 2448ed29b0b4SJens Axboe /* there are no registered resources left, nobody uses it */ 2449ed29b0b4SJens Axboe if (ctx->rsrc_node) 2450ed29b0b4SJens Axboe io_rsrc_node_destroy(ctx->rsrc_node); 2451ed29b0b4SJens Axboe if (ctx->rsrc_backup_node) 2452ed29b0b4SJens Axboe io_rsrc_node_destroy(ctx->rsrc_backup_node); 2453ed29b0b4SJens Axboe flush_delayed_work(&ctx->rsrc_put_work); 2454ed29b0b4SJens Axboe flush_delayed_work(&ctx->fallback_work); 2455ed29b0b4SJens Axboe 2456ed29b0b4SJens Axboe WARN_ON_ONCE(!list_empty(&ctx->rsrc_ref_list)); 2457ed29b0b4SJens Axboe WARN_ON_ONCE(!llist_empty(&ctx->rsrc_put_llist)); 2458ed29b0b4SJens Axboe 2459ed29b0b4SJens Axboe #if defined(CONFIG_UNIX) 2460ed29b0b4SJens Axboe if (ctx->ring_sock) { 2461ed29b0b4SJens Axboe ctx->ring_sock->file = NULL; /* so that iput() is called */ 2462ed29b0b4SJens Axboe sock_release(ctx->ring_sock); 2463ed29b0b4SJens Axboe } 2464ed29b0b4SJens Axboe #endif 2465ed29b0b4SJens Axboe WARN_ON_ONCE(!list_empty(&ctx->ltimeout_list)); 2466eb42cebbSPavel Begunkov WARN_ON_ONCE(ctx->notif_slots || ctx->nr_notif_slots); 2467ed29b0b4SJens Axboe 2468ed29b0b4SJens Axboe io_mem_free(ctx->rings); 2469ed29b0b4SJens Axboe io_mem_free(ctx->sq_sqes); 2470ed29b0b4SJens Axboe 2471ed29b0b4SJens Axboe percpu_ref_exit(&ctx->refs); 2472ed29b0b4SJens Axboe free_uid(ctx->user); 2473ed29b0b4SJens Axboe io_req_caches_free(ctx); 2474ed29b0b4SJens Axboe if (ctx->hash_map) 2475ed29b0b4SJens Axboe io_wq_put_hash(ctx->hash_map); 2476e6f89be6SPavel Begunkov kfree(ctx->cancel_table.hbs); 24779ca9fb24SPavel Begunkov kfree(ctx->cancel_table_locked.hbs); 2478ed29b0b4SJens Axboe kfree(ctx->dummy_ubuf); 2479ed29b0b4SJens Axboe kfree(ctx->io_bl); 2480ed29b0b4SJens Axboe xa_destroy(&ctx->io_bl_xa); 2481ed29b0b4SJens Axboe kfree(ctx); 2482ed29b0b4SJens Axboe } 2483ed29b0b4SJens Axboe 2484ed29b0b4SJens Axboe static __poll_t io_uring_poll(struct file *file, poll_table *wait) 2485ed29b0b4SJens Axboe { 2486ed29b0b4SJens Axboe struct io_ring_ctx *ctx = file->private_data; 2487ed29b0b4SJens Axboe __poll_t mask = 0; 2488ed29b0b4SJens Axboe 2489ed29b0b4SJens Axboe poll_wait(file, &ctx->cq_wait, wait); 2490ed29b0b4SJens Axboe /* 2491ed29b0b4SJens Axboe * synchronizes with barrier from wq_has_sleeper call in 2492ed29b0b4SJens Axboe * io_commit_cqring 2493ed29b0b4SJens Axboe */ 2494ed29b0b4SJens Axboe smp_rmb(); 2495ed29b0b4SJens Axboe if (!io_sqring_full(ctx)) 2496ed29b0b4SJens Axboe mask |= EPOLLOUT | EPOLLWRNORM; 2497ed29b0b4SJens Axboe 2498ed29b0b4SJens Axboe /* 2499ed29b0b4SJens Axboe * Don't flush cqring overflow list here, just do a simple check. 2500ed29b0b4SJens Axboe * Otherwise there could possible be ABBA deadlock: 2501ed29b0b4SJens Axboe * CPU0 CPU1 2502ed29b0b4SJens Axboe * ---- ---- 2503ed29b0b4SJens Axboe * lock(&ctx->uring_lock); 2504ed29b0b4SJens Axboe * lock(&ep->mtx); 2505ed29b0b4SJens Axboe * lock(&ctx->uring_lock); 2506ed29b0b4SJens Axboe * lock(&ep->mtx); 2507ed29b0b4SJens Axboe * 2508ed29b0b4SJens Axboe * Users may get EPOLLIN meanwhile seeing nothing in cqring, this 2509ed29b0b4SJens Axboe * pushs them to do the flush. 2510ed29b0b4SJens Axboe */ 2511ed29b0b4SJens Axboe if (io_cqring_events(ctx) || 2512ed29b0b4SJens Axboe test_bit(IO_CHECK_CQ_OVERFLOW_BIT, &ctx->check_cq)) 2513ed29b0b4SJens Axboe mask |= EPOLLIN | EPOLLRDNORM; 2514ed29b0b4SJens Axboe 2515ed29b0b4SJens Axboe return mask; 2516ed29b0b4SJens Axboe } 2517ed29b0b4SJens Axboe 2518ed29b0b4SJens Axboe static int io_unregister_personality(struct io_ring_ctx *ctx, unsigned id) 2519ed29b0b4SJens Axboe { 2520ed29b0b4SJens Axboe const struct cred *creds; 2521ed29b0b4SJens Axboe 2522ed29b0b4SJens Axboe creds = xa_erase(&ctx->personalities, id); 2523ed29b0b4SJens Axboe if (creds) { 2524ed29b0b4SJens Axboe put_cred(creds); 2525ed29b0b4SJens Axboe return 0; 2526ed29b0b4SJens Axboe } 2527ed29b0b4SJens Axboe 2528ed29b0b4SJens Axboe return -EINVAL; 2529ed29b0b4SJens Axboe } 2530ed29b0b4SJens Axboe 2531ed29b0b4SJens Axboe struct io_tctx_exit { 2532ed29b0b4SJens Axboe struct callback_head task_work; 2533ed29b0b4SJens Axboe struct completion completion; 2534ed29b0b4SJens Axboe struct io_ring_ctx *ctx; 2535ed29b0b4SJens Axboe }; 2536ed29b0b4SJens Axboe 2537ed29b0b4SJens Axboe static __cold void io_tctx_exit_cb(struct callback_head *cb) 2538ed29b0b4SJens Axboe { 2539ed29b0b4SJens Axboe struct io_uring_task *tctx = current->io_uring; 2540ed29b0b4SJens Axboe struct io_tctx_exit *work; 2541ed29b0b4SJens Axboe 2542ed29b0b4SJens Axboe work = container_of(cb, struct io_tctx_exit, task_work); 2543ed29b0b4SJens Axboe /* 2544ed29b0b4SJens Axboe * When @in_idle, we're in cancellation and it's racy to remove the 2545ed29b0b4SJens Axboe * node. It'll be removed by the end of cancellation, just ignore it. 2546ed29b0b4SJens Axboe */ 2547ed29b0b4SJens Axboe if (!atomic_read(&tctx->in_idle)) 2548ed29b0b4SJens Axboe io_uring_del_tctx_node((unsigned long)work->ctx); 2549ed29b0b4SJens Axboe complete(&work->completion); 2550ed29b0b4SJens Axboe } 2551ed29b0b4SJens Axboe 2552ed29b0b4SJens Axboe static __cold bool io_cancel_ctx_cb(struct io_wq_work *work, void *data) 2553ed29b0b4SJens Axboe { 2554ed29b0b4SJens Axboe struct io_kiocb *req = container_of(work, struct io_kiocb, work); 2555ed29b0b4SJens Axboe 2556ed29b0b4SJens Axboe return req->ctx == data; 2557ed29b0b4SJens Axboe } 2558ed29b0b4SJens Axboe 2559ed29b0b4SJens Axboe static __cold void io_ring_exit_work(struct work_struct *work) 2560ed29b0b4SJens Axboe { 2561ed29b0b4SJens Axboe struct io_ring_ctx *ctx = container_of(work, struct io_ring_ctx, exit_work); 2562ed29b0b4SJens Axboe unsigned long timeout = jiffies + HZ * 60 * 5; 2563ed29b0b4SJens Axboe unsigned long interval = HZ / 20; 2564ed29b0b4SJens Axboe struct io_tctx_exit exit; 2565ed29b0b4SJens Axboe struct io_tctx_node *node; 2566ed29b0b4SJens Axboe int ret; 2567ed29b0b4SJens Axboe 2568ed29b0b4SJens Axboe /* 2569ed29b0b4SJens Axboe * If we're doing polled IO and end up having requests being 2570ed29b0b4SJens Axboe * submitted async (out-of-line), then completions can come in while 2571ed29b0b4SJens Axboe * we're waiting for refs to drop. We need to reap these manually, 2572ed29b0b4SJens Axboe * as nobody else will be looking for them. 2573ed29b0b4SJens Axboe */ 2574ed29b0b4SJens Axboe do { 2575affa87dbSPavel Begunkov while (io_uring_try_cancel_requests(ctx, NULL, true)) 2576affa87dbSPavel Begunkov cond_resched(); 2577affa87dbSPavel Begunkov 2578ed29b0b4SJens Axboe if (ctx->sq_data) { 2579ed29b0b4SJens Axboe struct io_sq_data *sqd = ctx->sq_data; 2580ed29b0b4SJens Axboe struct task_struct *tsk; 2581ed29b0b4SJens Axboe 2582ed29b0b4SJens Axboe io_sq_thread_park(sqd); 2583ed29b0b4SJens Axboe tsk = sqd->thread; 2584ed29b0b4SJens Axboe if (tsk && tsk->io_uring && tsk->io_uring->io_wq) 2585ed29b0b4SJens Axboe io_wq_cancel_cb(tsk->io_uring->io_wq, 2586ed29b0b4SJens Axboe io_cancel_ctx_cb, ctx, true); 2587ed29b0b4SJens Axboe io_sq_thread_unpark(sqd); 2588ed29b0b4SJens Axboe } 2589ed29b0b4SJens Axboe 2590ed29b0b4SJens Axboe io_req_caches_free(ctx); 2591ed29b0b4SJens Axboe 2592ed29b0b4SJens Axboe if (WARN_ON_ONCE(time_after(jiffies, timeout))) { 2593ed29b0b4SJens Axboe /* there is little hope left, don't run it too often */ 2594ed29b0b4SJens Axboe interval = HZ * 60; 2595ed29b0b4SJens Axboe } 2596ed29b0b4SJens Axboe } while (!wait_for_completion_timeout(&ctx->ref_comp, interval)); 2597ed29b0b4SJens Axboe 2598ed29b0b4SJens Axboe init_completion(&exit.completion); 2599ed29b0b4SJens Axboe init_task_work(&exit.task_work, io_tctx_exit_cb); 2600ed29b0b4SJens Axboe exit.ctx = ctx; 2601ed29b0b4SJens Axboe /* 2602ed29b0b4SJens Axboe * Some may use context even when all refs and requests have been put, 2603ed29b0b4SJens Axboe * and they are free to do so while still holding uring_lock or 2604ed29b0b4SJens Axboe * completion_lock, see io_req_task_submit(). Apart from other work, 2605ed29b0b4SJens Axboe * this lock/unlock section also waits them to finish. 2606ed29b0b4SJens Axboe */ 2607ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 2608ed29b0b4SJens Axboe while (!list_empty(&ctx->tctx_list)) { 2609ed29b0b4SJens Axboe WARN_ON_ONCE(time_after(jiffies, timeout)); 2610ed29b0b4SJens Axboe 2611ed29b0b4SJens Axboe node = list_first_entry(&ctx->tctx_list, struct io_tctx_node, 2612ed29b0b4SJens Axboe ctx_node); 2613ed29b0b4SJens Axboe /* don't spin on a single task if cancellation failed */ 2614ed29b0b4SJens Axboe list_rotate_left(&ctx->tctx_list); 2615ed29b0b4SJens Axboe ret = task_work_add(node->task, &exit.task_work, TWA_SIGNAL); 2616ed29b0b4SJens Axboe if (WARN_ON_ONCE(ret)) 2617ed29b0b4SJens Axboe continue; 2618ed29b0b4SJens Axboe 2619ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 2620ed29b0b4SJens Axboe wait_for_completion(&exit.completion); 2621ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 2622ed29b0b4SJens Axboe } 2623ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 2624ed29b0b4SJens Axboe spin_lock(&ctx->completion_lock); 2625ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 2626ed29b0b4SJens Axboe 2627ed29b0b4SJens Axboe io_ring_ctx_free(ctx); 2628ed29b0b4SJens Axboe } 2629ed29b0b4SJens Axboe 2630ed29b0b4SJens Axboe static __cold void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx) 2631ed29b0b4SJens Axboe { 2632ed29b0b4SJens Axboe unsigned long index; 2633ed29b0b4SJens Axboe struct creds *creds; 2634ed29b0b4SJens Axboe 2635ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 2636ed29b0b4SJens Axboe percpu_ref_kill(&ctx->refs); 2637ed29b0b4SJens Axboe if (ctx->rings) 2638ed29b0b4SJens Axboe __io_cqring_overflow_flush(ctx, true); 2639ed29b0b4SJens Axboe xa_for_each(&ctx->personalities, index, creds) 2640ed29b0b4SJens Axboe io_unregister_personality(ctx, index); 26419ca9fb24SPavel Begunkov if (ctx->rings) 26429ca9fb24SPavel Begunkov io_poll_remove_all(ctx, NULL, true); 2643eb42cebbSPavel Begunkov io_notif_unregister(ctx); 2644ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 2645ed29b0b4SJens Axboe 2646ed29b0b4SJens Axboe /* failed during ring init, it couldn't have issued any requests */ 2647ed29b0b4SJens Axboe if (ctx->rings) { 2648ed29b0b4SJens Axboe io_kill_timeouts(ctx, NULL, true); 2649ed29b0b4SJens Axboe /* if we failed setting up the ctx, we might not have any rings */ 2650ed29b0b4SJens Axboe io_iopoll_try_reap_events(ctx); 2651ed29b0b4SJens Axboe } 2652ed29b0b4SJens Axboe 2653ed29b0b4SJens Axboe INIT_WORK(&ctx->exit_work, io_ring_exit_work); 2654ed29b0b4SJens Axboe /* 2655ed29b0b4SJens Axboe * Use system_unbound_wq to avoid spawning tons of event kworkers 2656ed29b0b4SJens Axboe * if we're exiting a ton of rings at the same time. It just adds 2657ed29b0b4SJens Axboe * noise and overhead, there's no discernable change in runtime 2658ed29b0b4SJens Axboe * over using system_wq. 2659ed29b0b4SJens Axboe */ 2660ed29b0b4SJens Axboe queue_work(system_unbound_wq, &ctx->exit_work); 2661ed29b0b4SJens Axboe } 2662ed29b0b4SJens Axboe 2663ed29b0b4SJens Axboe static int io_uring_release(struct inode *inode, struct file *file) 2664ed29b0b4SJens Axboe { 2665ed29b0b4SJens Axboe struct io_ring_ctx *ctx = file->private_data; 2666ed29b0b4SJens Axboe 2667ed29b0b4SJens Axboe file->private_data = NULL; 2668ed29b0b4SJens Axboe io_ring_ctx_wait_and_kill(ctx); 2669ed29b0b4SJens Axboe return 0; 2670ed29b0b4SJens Axboe } 2671ed29b0b4SJens Axboe 2672ed29b0b4SJens Axboe struct io_task_cancel { 2673ed29b0b4SJens Axboe struct task_struct *task; 2674ed29b0b4SJens Axboe bool all; 2675ed29b0b4SJens Axboe }; 2676ed29b0b4SJens Axboe 2677ed29b0b4SJens Axboe static bool io_cancel_task_cb(struct io_wq_work *work, void *data) 2678ed29b0b4SJens Axboe { 2679ed29b0b4SJens Axboe struct io_kiocb *req = container_of(work, struct io_kiocb, work); 2680ed29b0b4SJens Axboe struct io_task_cancel *cancel = data; 2681ed29b0b4SJens Axboe 2682ed29b0b4SJens Axboe return io_match_task_safe(req, cancel->task, cancel->all); 2683ed29b0b4SJens Axboe } 2684ed29b0b4SJens Axboe 2685ed29b0b4SJens Axboe static __cold bool io_cancel_defer_files(struct io_ring_ctx *ctx, 2686ed29b0b4SJens Axboe struct task_struct *task, 2687ed29b0b4SJens Axboe bool cancel_all) 2688ed29b0b4SJens Axboe { 2689ed29b0b4SJens Axboe struct io_defer_entry *de; 2690ed29b0b4SJens Axboe LIST_HEAD(list); 2691ed29b0b4SJens Axboe 2692ed29b0b4SJens Axboe spin_lock(&ctx->completion_lock); 2693ed29b0b4SJens Axboe list_for_each_entry_reverse(de, &ctx->defer_list, list) { 2694ed29b0b4SJens Axboe if (io_match_task_safe(de->req, task, cancel_all)) { 2695ed29b0b4SJens Axboe list_cut_position(&list, &ctx->defer_list, &de->list); 2696ed29b0b4SJens Axboe break; 2697ed29b0b4SJens Axboe } 2698ed29b0b4SJens Axboe } 2699ed29b0b4SJens Axboe spin_unlock(&ctx->completion_lock); 2700ed29b0b4SJens Axboe if (list_empty(&list)) 2701ed29b0b4SJens Axboe return false; 2702ed29b0b4SJens Axboe 2703ed29b0b4SJens Axboe while (!list_empty(&list)) { 2704ed29b0b4SJens Axboe de = list_first_entry(&list, struct io_defer_entry, list); 2705ed29b0b4SJens Axboe list_del_init(&de->list); 2706ed29b0b4SJens Axboe io_req_complete_failed(de->req, -ECANCELED); 2707ed29b0b4SJens Axboe kfree(de); 2708ed29b0b4SJens Axboe } 2709ed29b0b4SJens Axboe return true; 2710ed29b0b4SJens Axboe } 2711ed29b0b4SJens Axboe 2712ed29b0b4SJens Axboe static __cold bool io_uring_try_cancel_iowq(struct io_ring_ctx *ctx) 2713ed29b0b4SJens Axboe { 2714ed29b0b4SJens Axboe struct io_tctx_node *node; 2715ed29b0b4SJens Axboe enum io_wq_cancel cret; 2716ed29b0b4SJens Axboe bool ret = false; 2717ed29b0b4SJens Axboe 2718ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 2719ed29b0b4SJens Axboe list_for_each_entry(node, &ctx->tctx_list, ctx_node) { 2720ed29b0b4SJens Axboe struct io_uring_task *tctx = node->task->io_uring; 2721ed29b0b4SJens Axboe 2722ed29b0b4SJens Axboe /* 2723ed29b0b4SJens Axboe * io_wq will stay alive while we hold uring_lock, because it's 2724ed29b0b4SJens Axboe * killed after ctx nodes, which requires to take the lock. 2725ed29b0b4SJens Axboe */ 2726ed29b0b4SJens Axboe if (!tctx || !tctx->io_wq) 2727ed29b0b4SJens Axboe continue; 2728ed29b0b4SJens Axboe cret = io_wq_cancel_cb(tctx->io_wq, io_cancel_ctx_cb, ctx, true); 2729ed29b0b4SJens Axboe ret |= (cret != IO_WQ_CANCEL_NOTFOUND); 2730ed29b0b4SJens Axboe } 2731ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 2732ed29b0b4SJens Axboe 2733ed29b0b4SJens Axboe return ret; 2734ed29b0b4SJens Axboe } 2735ed29b0b4SJens Axboe 2736affa87dbSPavel Begunkov static __cold bool io_uring_try_cancel_requests(struct io_ring_ctx *ctx, 2737ed29b0b4SJens Axboe struct task_struct *task, 2738ed29b0b4SJens Axboe bool cancel_all) 2739ed29b0b4SJens Axboe { 2740ed29b0b4SJens Axboe struct io_task_cancel cancel = { .task = task, .all = cancel_all, }; 2741ed29b0b4SJens Axboe struct io_uring_task *tctx = task ? task->io_uring : NULL; 2742affa87dbSPavel Begunkov enum io_wq_cancel cret; 2743affa87dbSPavel Begunkov bool ret = false; 2744ed29b0b4SJens Axboe 2745ed29b0b4SJens Axboe /* failed during ring init, it couldn't have issued any requests */ 2746ed29b0b4SJens Axboe if (!ctx->rings) 2747affa87dbSPavel Begunkov return false; 2748ed29b0b4SJens Axboe 2749ed29b0b4SJens Axboe if (!task) { 2750ed29b0b4SJens Axboe ret |= io_uring_try_cancel_iowq(ctx); 2751ed29b0b4SJens Axboe } else if (tctx && tctx->io_wq) { 2752ed29b0b4SJens Axboe /* 2753ed29b0b4SJens Axboe * Cancels requests of all rings, not only @ctx, but 2754ed29b0b4SJens Axboe * it's fine as the task is in exit/exec. 2755ed29b0b4SJens Axboe */ 2756ed29b0b4SJens Axboe cret = io_wq_cancel_cb(tctx->io_wq, io_cancel_task_cb, 2757ed29b0b4SJens Axboe &cancel, true); 2758ed29b0b4SJens Axboe ret |= (cret != IO_WQ_CANCEL_NOTFOUND); 2759ed29b0b4SJens Axboe } 2760ed29b0b4SJens Axboe 2761ed29b0b4SJens Axboe /* SQPOLL thread does its own polling */ 2762ed29b0b4SJens Axboe if ((!(ctx->flags & IORING_SETUP_SQPOLL) && cancel_all) || 2763ed29b0b4SJens Axboe (ctx->sq_data && ctx->sq_data->thread == current)) { 2764ed29b0b4SJens Axboe while (!wq_list_empty(&ctx->iopoll_list)) { 2765ed29b0b4SJens Axboe io_iopoll_try_reap_events(ctx); 2766ed29b0b4SJens Axboe ret = true; 2767ed29b0b4SJens Axboe } 2768ed29b0b4SJens Axboe } 2769ed29b0b4SJens Axboe 2770ed29b0b4SJens Axboe ret |= io_cancel_defer_files(ctx, task, cancel_all); 27719ca9fb24SPavel Begunkov mutex_lock(&ctx->uring_lock); 2772ed29b0b4SJens Axboe ret |= io_poll_remove_all(ctx, task, cancel_all); 27739ca9fb24SPavel Begunkov mutex_unlock(&ctx->uring_lock); 2774ed29b0b4SJens Axboe ret |= io_kill_timeouts(ctx, task, cancel_all); 2775ed29b0b4SJens Axboe if (task) 2776ed29b0b4SJens Axboe ret |= io_run_task_work(); 2777affa87dbSPavel Begunkov return ret; 2778ed29b0b4SJens Axboe } 2779ed29b0b4SJens Axboe 2780ed29b0b4SJens Axboe static s64 tctx_inflight(struct io_uring_task *tctx, bool tracked) 2781ed29b0b4SJens Axboe { 2782ed29b0b4SJens Axboe if (tracked) 2783ed29b0b4SJens Axboe return atomic_read(&tctx->inflight_tracked); 2784ed29b0b4SJens Axboe return percpu_counter_sum(&tctx->inflight); 2785ed29b0b4SJens Axboe } 2786ed29b0b4SJens Axboe 2787ed29b0b4SJens Axboe /* 2788ed29b0b4SJens Axboe * Find any io_uring ctx that this task has registered or done IO on, and cancel 2789ed29b0b4SJens Axboe * requests. @sqd should be not-null IFF it's an SQPOLL thread cancellation. 2790ed29b0b4SJens Axboe */ 279117437f31SJens Axboe __cold void io_uring_cancel_generic(bool cancel_all, struct io_sq_data *sqd) 2792ed29b0b4SJens Axboe { 2793ed29b0b4SJens Axboe struct io_uring_task *tctx = current->io_uring; 2794ed29b0b4SJens Axboe struct io_ring_ctx *ctx; 2795ed29b0b4SJens Axboe s64 inflight; 2796ed29b0b4SJens Axboe DEFINE_WAIT(wait); 2797ed29b0b4SJens Axboe 2798ed29b0b4SJens Axboe WARN_ON_ONCE(sqd && sqd->thread != current); 2799ed29b0b4SJens Axboe 2800ed29b0b4SJens Axboe if (!current->io_uring) 2801ed29b0b4SJens Axboe return; 2802ed29b0b4SJens Axboe if (tctx->io_wq) 2803ed29b0b4SJens Axboe io_wq_exit_start(tctx->io_wq); 2804ed29b0b4SJens Axboe 2805ed29b0b4SJens Axboe atomic_inc(&tctx->in_idle); 2806ed29b0b4SJens Axboe do { 2807affa87dbSPavel Begunkov bool loop = false; 2808affa87dbSPavel Begunkov 2809ed29b0b4SJens Axboe io_uring_drop_tctx_refs(current); 2810ed29b0b4SJens Axboe /* read completions before cancelations */ 2811ed29b0b4SJens Axboe inflight = tctx_inflight(tctx, !cancel_all); 2812ed29b0b4SJens Axboe if (!inflight) 2813ed29b0b4SJens Axboe break; 2814ed29b0b4SJens Axboe 2815ed29b0b4SJens Axboe if (!sqd) { 2816ed29b0b4SJens Axboe struct io_tctx_node *node; 2817ed29b0b4SJens Axboe unsigned long index; 2818ed29b0b4SJens Axboe 2819ed29b0b4SJens Axboe xa_for_each(&tctx->xa, index, node) { 2820ed29b0b4SJens Axboe /* sqpoll task will cancel all its requests */ 2821ed29b0b4SJens Axboe if (node->ctx->sq_data) 2822ed29b0b4SJens Axboe continue; 2823affa87dbSPavel Begunkov loop |= io_uring_try_cancel_requests(node->ctx, 2824affa87dbSPavel Begunkov current, cancel_all); 2825ed29b0b4SJens Axboe } 2826ed29b0b4SJens Axboe } else { 2827ed29b0b4SJens Axboe list_for_each_entry(ctx, &sqd->ctx_list, sqd_list) 2828affa87dbSPavel Begunkov loop |= io_uring_try_cancel_requests(ctx, 2829affa87dbSPavel Begunkov current, 2830ed29b0b4SJens Axboe cancel_all); 2831ed29b0b4SJens Axboe } 2832ed29b0b4SJens Axboe 2833affa87dbSPavel Begunkov if (loop) { 2834affa87dbSPavel Begunkov cond_resched(); 2835affa87dbSPavel Begunkov continue; 2836affa87dbSPavel Begunkov } 2837affa87dbSPavel Begunkov 2838ed29b0b4SJens Axboe prepare_to_wait(&tctx->wait, &wait, TASK_INTERRUPTIBLE); 2839ed29b0b4SJens Axboe io_run_task_work(); 2840ed29b0b4SJens Axboe io_uring_drop_tctx_refs(current); 2841ed29b0b4SJens Axboe 2842ed29b0b4SJens Axboe /* 2843ed29b0b4SJens Axboe * If we've seen completions, retry without waiting. This 2844ed29b0b4SJens Axboe * avoids a race where a completion comes in before we did 2845ed29b0b4SJens Axboe * prepare_to_wait(). 2846ed29b0b4SJens Axboe */ 2847ed29b0b4SJens Axboe if (inflight == tctx_inflight(tctx, !cancel_all)) 2848ed29b0b4SJens Axboe schedule(); 2849ed29b0b4SJens Axboe finish_wait(&tctx->wait, &wait); 2850ed29b0b4SJens Axboe } while (1); 2851ed29b0b4SJens Axboe 2852ed29b0b4SJens Axboe io_uring_clean_tctx(tctx); 2853ed29b0b4SJens Axboe if (cancel_all) { 2854ed29b0b4SJens Axboe /* 2855ed29b0b4SJens Axboe * We shouldn't run task_works after cancel, so just leave 2856ed29b0b4SJens Axboe * ->in_idle set for normal exit. 2857ed29b0b4SJens Axboe */ 2858ed29b0b4SJens Axboe atomic_dec(&tctx->in_idle); 2859ed29b0b4SJens Axboe /* for exec all current's requests should be gone, kill tctx */ 2860ed29b0b4SJens Axboe __io_uring_free(current); 2861ed29b0b4SJens Axboe } 2862ed29b0b4SJens Axboe } 2863ed29b0b4SJens Axboe 2864ed29b0b4SJens Axboe void __io_uring_cancel(bool cancel_all) 2865ed29b0b4SJens Axboe { 2866ed29b0b4SJens Axboe io_uring_cancel_generic(cancel_all, NULL); 2867ed29b0b4SJens Axboe } 2868ed29b0b4SJens Axboe 2869ed29b0b4SJens Axboe static void *io_uring_validate_mmap_request(struct file *file, 2870ed29b0b4SJens Axboe loff_t pgoff, size_t sz) 2871ed29b0b4SJens Axboe { 2872ed29b0b4SJens Axboe struct io_ring_ctx *ctx = file->private_data; 2873ed29b0b4SJens Axboe loff_t offset = pgoff << PAGE_SHIFT; 2874ed29b0b4SJens Axboe struct page *page; 2875ed29b0b4SJens Axboe void *ptr; 2876ed29b0b4SJens Axboe 2877ed29b0b4SJens Axboe switch (offset) { 2878ed29b0b4SJens Axboe case IORING_OFF_SQ_RING: 2879ed29b0b4SJens Axboe case IORING_OFF_CQ_RING: 2880ed29b0b4SJens Axboe ptr = ctx->rings; 2881ed29b0b4SJens Axboe break; 2882ed29b0b4SJens Axboe case IORING_OFF_SQES: 2883ed29b0b4SJens Axboe ptr = ctx->sq_sqes; 2884ed29b0b4SJens Axboe break; 2885ed29b0b4SJens Axboe default: 2886ed29b0b4SJens Axboe return ERR_PTR(-EINVAL); 2887ed29b0b4SJens Axboe } 2888ed29b0b4SJens Axboe 2889ed29b0b4SJens Axboe page = virt_to_head_page(ptr); 2890ed29b0b4SJens Axboe if (sz > page_size(page)) 2891ed29b0b4SJens Axboe return ERR_PTR(-EINVAL); 2892ed29b0b4SJens Axboe 2893ed29b0b4SJens Axboe return ptr; 2894ed29b0b4SJens Axboe } 2895ed29b0b4SJens Axboe 2896ed29b0b4SJens Axboe #ifdef CONFIG_MMU 2897ed29b0b4SJens Axboe 2898ed29b0b4SJens Axboe static __cold int io_uring_mmap(struct file *file, struct vm_area_struct *vma) 2899ed29b0b4SJens Axboe { 2900ed29b0b4SJens Axboe size_t sz = vma->vm_end - vma->vm_start; 2901ed29b0b4SJens Axboe unsigned long pfn; 2902ed29b0b4SJens Axboe void *ptr; 2903ed29b0b4SJens Axboe 2904ed29b0b4SJens Axboe ptr = io_uring_validate_mmap_request(file, vma->vm_pgoff, sz); 2905ed29b0b4SJens Axboe if (IS_ERR(ptr)) 2906ed29b0b4SJens Axboe return PTR_ERR(ptr); 2907ed29b0b4SJens Axboe 2908ed29b0b4SJens Axboe pfn = virt_to_phys(ptr) >> PAGE_SHIFT; 2909ed29b0b4SJens Axboe return remap_pfn_range(vma, vma->vm_start, pfn, sz, vma->vm_page_prot); 2910ed29b0b4SJens Axboe } 2911ed29b0b4SJens Axboe 2912ed29b0b4SJens Axboe #else /* !CONFIG_MMU */ 2913ed29b0b4SJens Axboe 2914ed29b0b4SJens Axboe static int io_uring_mmap(struct file *file, struct vm_area_struct *vma) 2915ed29b0b4SJens Axboe { 2916ed29b0b4SJens Axboe return vma->vm_flags & (VM_SHARED | VM_MAYSHARE) ? 0 : -EINVAL; 2917ed29b0b4SJens Axboe } 2918ed29b0b4SJens Axboe 2919ed29b0b4SJens Axboe static unsigned int io_uring_nommu_mmap_capabilities(struct file *file) 2920ed29b0b4SJens Axboe { 2921ed29b0b4SJens Axboe return NOMMU_MAP_DIRECT | NOMMU_MAP_READ | NOMMU_MAP_WRITE; 2922ed29b0b4SJens Axboe } 2923ed29b0b4SJens Axboe 2924ed29b0b4SJens Axboe static unsigned long io_uring_nommu_get_unmapped_area(struct file *file, 2925ed29b0b4SJens Axboe unsigned long addr, unsigned long len, 2926ed29b0b4SJens Axboe unsigned long pgoff, unsigned long flags) 2927ed29b0b4SJens Axboe { 2928ed29b0b4SJens Axboe void *ptr; 2929ed29b0b4SJens Axboe 2930ed29b0b4SJens Axboe ptr = io_uring_validate_mmap_request(file, pgoff, len); 2931ed29b0b4SJens Axboe if (IS_ERR(ptr)) 2932ed29b0b4SJens Axboe return PTR_ERR(ptr); 2933ed29b0b4SJens Axboe 2934ed29b0b4SJens Axboe return (unsigned long) ptr; 2935ed29b0b4SJens Axboe } 2936ed29b0b4SJens Axboe 2937ed29b0b4SJens Axboe #endif /* !CONFIG_MMU */ 2938ed29b0b4SJens Axboe 2939ed29b0b4SJens Axboe static int io_validate_ext_arg(unsigned flags, const void __user *argp, size_t argsz) 2940ed29b0b4SJens Axboe { 2941ed29b0b4SJens Axboe if (flags & IORING_ENTER_EXT_ARG) { 2942ed29b0b4SJens Axboe struct io_uring_getevents_arg arg; 2943ed29b0b4SJens Axboe 2944ed29b0b4SJens Axboe if (argsz != sizeof(arg)) 2945ed29b0b4SJens Axboe return -EINVAL; 2946ed29b0b4SJens Axboe if (copy_from_user(&arg, argp, sizeof(arg))) 2947ed29b0b4SJens Axboe return -EFAULT; 2948ed29b0b4SJens Axboe } 2949ed29b0b4SJens Axboe return 0; 2950ed29b0b4SJens Axboe } 2951ed29b0b4SJens Axboe 2952ed29b0b4SJens Axboe static int io_get_ext_arg(unsigned flags, const void __user *argp, size_t *argsz, 2953ed29b0b4SJens Axboe struct __kernel_timespec __user **ts, 2954ed29b0b4SJens Axboe const sigset_t __user **sig) 2955ed29b0b4SJens Axboe { 2956ed29b0b4SJens Axboe struct io_uring_getevents_arg arg; 2957ed29b0b4SJens Axboe 2958ed29b0b4SJens Axboe /* 2959ed29b0b4SJens Axboe * If EXT_ARG isn't set, then we have no timespec and the argp pointer 2960ed29b0b4SJens Axboe * is just a pointer to the sigset_t. 2961ed29b0b4SJens Axboe */ 2962ed29b0b4SJens Axboe if (!(flags & IORING_ENTER_EXT_ARG)) { 2963ed29b0b4SJens Axboe *sig = (const sigset_t __user *) argp; 2964ed29b0b4SJens Axboe *ts = NULL; 2965ed29b0b4SJens Axboe return 0; 2966ed29b0b4SJens Axboe } 2967ed29b0b4SJens Axboe 2968ed29b0b4SJens Axboe /* 2969ed29b0b4SJens Axboe * EXT_ARG is set - ensure we agree on the size of it and copy in our 2970ed29b0b4SJens Axboe * timespec and sigset_t pointers if good. 2971ed29b0b4SJens Axboe */ 2972ed29b0b4SJens Axboe if (*argsz != sizeof(arg)) 2973ed29b0b4SJens Axboe return -EINVAL; 2974ed29b0b4SJens Axboe if (copy_from_user(&arg, argp, sizeof(arg))) 2975ed29b0b4SJens Axboe return -EFAULT; 2976ed29b0b4SJens Axboe if (arg.pad) 2977ed29b0b4SJens Axboe return -EINVAL; 2978ed29b0b4SJens Axboe *sig = u64_to_user_ptr(arg.sigmask); 2979ed29b0b4SJens Axboe *argsz = arg.sigmask_sz; 2980ed29b0b4SJens Axboe *ts = u64_to_user_ptr(arg.ts); 2981ed29b0b4SJens Axboe return 0; 2982ed29b0b4SJens Axboe } 2983ed29b0b4SJens Axboe 2984ed29b0b4SJens Axboe SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit, 2985ed29b0b4SJens Axboe u32, min_complete, u32, flags, const void __user *, argp, 2986ed29b0b4SJens Axboe size_t, argsz) 2987ed29b0b4SJens Axboe { 2988ed29b0b4SJens Axboe struct io_ring_ctx *ctx; 2989ed29b0b4SJens Axboe struct fd f; 2990ed29b0b4SJens Axboe long ret; 2991ed29b0b4SJens Axboe 2992ed29b0b4SJens Axboe io_run_task_work(); 2993ed29b0b4SJens Axboe 2994ed29b0b4SJens Axboe if (unlikely(flags & ~(IORING_ENTER_GETEVENTS | IORING_ENTER_SQ_WAKEUP | 2995ed29b0b4SJens Axboe IORING_ENTER_SQ_WAIT | IORING_ENTER_EXT_ARG | 2996ed29b0b4SJens Axboe IORING_ENTER_REGISTERED_RING))) 2997ed29b0b4SJens Axboe return -EINVAL; 2998ed29b0b4SJens Axboe 2999ed29b0b4SJens Axboe /* 3000ed29b0b4SJens Axboe * Ring fd has been registered via IORING_REGISTER_RING_FDS, we 3001ed29b0b4SJens Axboe * need only dereference our task private array to find it. 3002ed29b0b4SJens Axboe */ 3003ed29b0b4SJens Axboe if (flags & IORING_ENTER_REGISTERED_RING) { 3004ed29b0b4SJens Axboe struct io_uring_task *tctx = current->io_uring; 3005ed29b0b4SJens Axboe 30063273c440SPavel Begunkov if (unlikely(!tctx || fd >= IO_RINGFD_REG_MAX)) 3007ed29b0b4SJens Axboe return -EINVAL; 3008ed29b0b4SJens Axboe fd = array_index_nospec(fd, IO_RINGFD_REG_MAX); 3009ed29b0b4SJens Axboe f.file = tctx->registered_rings[fd]; 3010ed29b0b4SJens Axboe f.flags = 0; 3011ed29b0b4SJens Axboe if (unlikely(!f.file)) 3012ed29b0b4SJens Axboe return -EBADF; 30133273c440SPavel Begunkov } else { 30143273c440SPavel Begunkov f = fdget(fd); 30153273c440SPavel Begunkov if (unlikely(!f.file)) 30163273c440SPavel Begunkov return -EBADF; 3017ed29b0b4SJens Axboe ret = -EOPNOTSUPP; 3018e5550a14SJens Axboe if (unlikely(!io_is_uring_fops(f.file))) 3019fbb8bb02SPavel Begunkov goto out; 30203273c440SPavel Begunkov } 3021ed29b0b4SJens Axboe 3022ed29b0b4SJens Axboe ctx = f.file->private_data; 3023ed29b0b4SJens Axboe ret = -EBADFD; 3024ed29b0b4SJens Axboe if (unlikely(ctx->flags & IORING_SETUP_R_DISABLED)) 3025ed29b0b4SJens Axboe goto out; 3026ed29b0b4SJens Axboe 3027ed29b0b4SJens Axboe /* 3028ed29b0b4SJens Axboe * For SQ polling, the thread will do all submissions and completions. 3029ed29b0b4SJens Axboe * Just return the requested submit count, and wake the thread if 3030ed29b0b4SJens Axboe * we were asked to. 3031ed29b0b4SJens Axboe */ 3032ed29b0b4SJens Axboe ret = 0; 3033ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_SQPOLL) { 3034ed29b0b4SJens Axboe io_cqring_overflow_flush(ctx); 3035ed29b0b4SJens Axboe 3036ed29b0b4SJens Axboe if (unlikely(ctx->sq_data->thread == NULL)) { 3037ed29b0b4SJens Axboe ret = -EOWNERDEAD; 3038ed29b0b4SJens Axboe goto out; 3039ed29b0b4SJens Axboe } 3040ed29b0b4SJens Axboe if (flags & IORING_ENTER_SQ_WAKEUP) 3041ed29b0b4SJens Axboe wake_up(&ctx->sq_data->wait); 3042ed29b0b4SJens Axboe if (flags & IORING_ENTER_SQ_WAIT) { 3043ed29b0b4SJens Axboe ret = io_sqpoll_wait_sq(ctx); 3044ed29b0b4SJens Axboe if (ret) 3045ed29b0b4SJens Axboe goto out; 3046ed29b0b4SJens Axboe } 3047ed29b0b4SJens Axboe ret = to_submit; 3048ed29b0b4SJens Axboe } else if (to_submit) { 3049ed29b0b4SJens Axboe ret = io_uring_add_tctx_node(ctx); 3050ed29b0b4SJens Axboe if (unlikely(ret)) 3051ed29b0b4SJens Axboe goto out; 3052ed29b0b4SJens Axboe 3053ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 3054ed29b0b4SJens Axboe ret = io_submit_sqes(ctx, to_submit); 3055ed29b0b4SJens Axboe if (ret != to_submit) { 3056ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 3057ed29b0b4SJens Axboe goto out; 3058ed29b0b4SJens Axboe } 3059ed29b0b4SJens Axboe if ((flags & IORING_ENTER_GETEVENTS) && ctx->syscall_iopoll) 3060ed29b0b4SJens Axboe goto iopoll_locked; 3061ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 3062ed29b0b4SJens Axboe } 3063ed29b0b4SJens Axboe if (flags & IORING_ENTER_GETEVENTS) { 3064ed29b0b4SJens Axboe int ret2; 3065ed29b0b4SJens Axboe if (ctx->syscall_iopoll) { 3066ed29b0b4SJens Axboe /* 3067ed29b0b4SJens Axboe * We disallow the app entering submit/complete with 3068ed29b0b4SJens Axboe * polling, but we still need to lock the ring to 3069ed29b0b4SJens Axboe * prevent racing with polled issue that got punted to 3070ed29b0b4SJens Axboe * a workqueue. 3071ed29b0b4SJens Axboe */ 3072ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 3073ed29b0b4SJens Axboe iopoll_locked: 3074ed29b0b4SJens Axboe ret2 = io_validate_ext_arg(flags, argp, argsz); 3075ed29b0b4SJens Axboe if (likely(!ret2)) { 3076ed29b0b4SJens Axboe min_complete = min(min_complete, 3077ed29b0b4SJens Axboe ctx->cq_entries); 3078ed29b0b4SJens Axboe ret2 = io_iopoll_check(ctx, min_complete); 3079ed29b0b4SJens Axboe } 3080ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 3081ed29b0b4SJens Axboe } else { 3082ed29b0b4SJens Axboe const sigset_t __user *sig; 3083ed29b0b4SJens Axboe struct __kernel_timespec __user *ts; 3084ed29b0b4SJens Axboe 3085ed29b0b4SJens Axboe ret2 = io_get_ext_arg(flags, argp, &argsz, &ts, &sig); 3086ed29b0b4SJens Axboe if (likely(!ret2)) { 3087ed29b0b4SJens Axboe min_complete = min(min_complete, 3088ed29b0b4SJens Axboe ctx->cq_entries); 3089ed29b0b4SJens Axboe ret2 = io_cqring_wait(ctx, min_complete, sig, 3090ed29b0b4SJens Axboe argsz, ts); 3091ed29b0b4SJens Axboe } 3092ed29b0b4SJens Axboe } 3093ed29b0b4SJens Axboe 3094ed29b0b4SJens Axboe if (!ret) { 3095ed29b0b4SJens Axboe ret = ret2; 3096ed29b0b4SJens Axboe 3097ed29b0b4SJens Axboe /* 3098ed29b0b4SJens Axboe * EBADR indicates that one or more CQE were dropped. 3099ed29b0b4SJens Axboe * Once the user has been informed we can clear the bit 3100ed29b0b4SJens Axboe * as they are obviously ok with those drops. 3101ed29b0b4SJens Axboe */ 3102ed29b0b4SJens Axboe if (unlikely(ret2 == -EBADR)) 3103ed29b0b4SJens Axboe clear_bit(IO_CHECK_CQ_DROPPED_BIT, 3104ed29b0b4SJens Axboe &ctx->check_cq); 3105ed29b0b4SJens Axboe } 3106ed29b0b4SJens Axboe } 3107ed29b0b4SJens Axboe out: 3108ed29b0b4SJens Axboe fdput(f); 3109ed29b0b4SJens Axboe return ret; 3110ed29b0b4SJens Axboe } 3111ed29b0b4SJens Axboe 3112ed29b0b4SJens Axboe static const struct file_operations io_uring_fops = { 3113ed29b0b4SJens Axboe .release = io_uring_release, 3114ed29b0b4SJens Axboe .mmap = io_uring_mmap, 3115ed29b0b4SJens Axboe #ifndef CONFIG_MMU 3116ed29b0b4SJens Axboe .get_unmapped_area = io_uring_nommu_get_unmapped_area, 3117ed29b0b4SJens Axboe .mmap_capabilities = io_uring_nommu_mmap_capabilities, 3118ed29b0b4SJens Axboe #endif 3119ed29b0b4SJens Axboe .poll = io_uring_poll, 3120ed29b0b4SJens Axboe #ifdef CONFIG_PROC_FS 3121ed29b0b4SJens Axboe .show_fdinfo = io_uring_show_fdinfo, 3122ed29b0b4SJens Axboe #endif 3123ed29b0b4SJens Axboe }; 3124ed29b0b4SJens Axboe 312592ac8beaSJens Axboe bool io_is_uring_fops(struct file *file) 312692ac8beaSJens Axboe { 312792ac8beaSJens Axboe return file->f_op == &io_uring_fops; 312892ac8beaSJens Axboe } 312992ac8beaSJens Axboe 3130ed29b0b4SJens Axboe static __cold int io_allocate_scq_urings(struct io_ring_ctx *ctx, 3131ed29b0b4SJens Axboe struct io_uring_params *p) 3132ed29b0b4SJens Axboe { 3133ed29b0b4SJens Axboe struct io_rings *rings; 3134ed29b0b4SJens Axboe size_t size, sq_array_offset; 3135ed29b0b4SJens Axboe 3136ed29b0b4SJens Axboe /* make sure these are sane, as we already accounted them */ 3137ed29b0b4SJens Axboe ctx->sq_entries = p->sq_entries; 3138ed29b0b4SJens Axboe ctx->cq_entries = p->cq_entries; 3139ed29b0b4SJens Axboe 3140ed29b0b4SJens Axboe size = rings_size(ctx, p->sq_entries, p->cq_entries, &sq_array_offset); 3141ed29b0b4SJens Axboe if (size == SIZE_MAX) 3142ed29b0b4SJens Axboe return -EOVERFLOW; 3143ed29b0b4SJens Axboe 3144ed29b0b4SJens Axboe rings = io_mem_alloc(size); 3145ed29b0b4SJens Axboe if (!rings) 3146ed29b0b4SJens Axboe return -ENOMEM; 3147ed29b0b4SJens Axboe 3148ed29b0b4SJens Axboe ctx->rings = rings; 3149ed29b0b4SJens Axboe ctx->sq_array = (u32 *)((char *)rings + sq_array_offset); 3150ed29b0b4SJens Axboe rings->sq_ring_mask = p->sq_entries - 1; 3151ed29b0b4SJens Axboe rings->cq_ring_mask = p->cq_entries - 1; 3152ed29b0b4SJens Axboe rings->sq_ring_entries = p->sq_entries; 3153ed29b0b4SJens Axboe rings->cq_ring_entries = p->cq_entries; 3154ed29b0b4SJens Axboe 3155ed29b0b4SJens Axboe if (p->flags & IORING_SETUP_SQE128) 3156ed29b0b4SJens Axboe size = array_size(2 * sizeof(struct io_uring_sqe), p->sq_entries); 3157ed29b0b4SJens Axboe else 3158ed29b0b4SJens Axboe size = array_size(sizeof(struct io_uring_sqe), p->sq_entries); 3159ed29b0b4SJens Axboe if (size == SIZE_MAX) { 3160ed29b0b4SJens Axboe io_mem_free(ctx->rings); 3161ed29b0b4SJens Axboe ctx->rings = NULL; 3162ed29b0b4SJens Axboe return -EOVERFLOW; 3163ed29b0b4SJens Axboe } 3164ed29b0b4SJens Axboe 3165ed29b0b4SJens Axboe ctx->sq_sqes = io_mem_alloc(size); 3166ed29b0b4SJens Axboe if (!ctx->sq_sqes) { 3167ed29b0b4SJens Axboe io_mem_free(ctx->rings); 3168ed29b0b4SJens Axboe ctx->rings = NULL; 3169ed29b0b4SJens Axboe return -ENOMEM; 3170ed29b0b4SJens Axboe } 3171ed29b0b4SJens Axboe 3172ed29b0b4SJens Axboe return 0; 3173ed29b0b4SJens Axboe } 3174ed29b0b4SJens Axboe 3175ed29b0b4SJens Axboe static int io_uring_install_fd(struct io_ring_ctx *ctx, struct file *file) 3176ed29b0b4SJens Axboe { 3177ed29b0b4SJens Axboe int ret, fd; 3178ed29b0b4SJens Axboe 3179ed29b0b4SJens Axboe fd = get_unused_fd_flags(O_RDWR | O_CLOEXEC); 3180ed29b0b4SJens Axboe if (fd < 0) 3181ed29b0b4SJens Axboe return fd; 3182ed29b0b4SJens Axboe 318397bbdc06SPavel Begunkov ret = __io_uring_add_tctx_node(ctx, false); 3184ed29b0b4SJens Axboe if (ret) { 3185ed29b0b4SJens Axboe put_unused_fd(fd); 3186ed29b0b4SJens Axboe return ret; 3187ed29b0b4SJens Axboe } 3188ed29b0b4SJens Axboe fd_install(fd, file); 3189ed29b0b4SJens Axboe return fd; 3190ed29b0b4SJens Axboe } 3191ed29b0b4SJens Axboe 3192ed29b0b4SJens Axboe /* 3193ed29b0b4SJens Axboe * Allocate an anonymous fd, this is what constitutes the application 3194ed29b0b4SJens Axboe * visible backing of an io_uring instance. The application mmaps this 3195ed29b0b4SJens Axboe * fd to gain access to the SQ/CQ ring details. If UNIX sockets are enabled, 3196ed29b0b4SJens Axboe * we have to tie this fd to a socket for file garbage collection purposes. 3197ed29b0b4SJens Axboe */ 3198ed29b0b4SJens Axboe static struct file *io_uring_get_file(struct io_ring_ctx *ctx) 3199ed29b0b4SJens Axboe { 3200ed29b0b4SJens Axboe struct file *file; 3201ed29b0b4SJens Axboe #if defined(CONFIG_UNIX) 3202ed29b0b4SJens Axboe int ret; 3203ed29b0b4SJens Axboe 3204ed29b0b4SJens Axboe ret = sock_create_kern(&init_net, PF_UNIX, SOCK_RAW, IPPROTO_IP, 3205ed29b0b4SJens Axboe &ctx->ring_sock); 3206ed29b0b4SJens Axboe if (ret) 3207ed29b0b4SJens Axboe return ERR_PTR(ret); 3208ed29b0b4SJens Axboe #endif 3209ed29b0b4SJens Axboe 3210ed29b0b4SJens Axboe file = anon_inode_getfile_secure("[io_uring]", &io_uring_fops, ctx, 3211ed29b0b4SJens Axboe O_RDWR | O_CLOEXEC, NULL); 3212ed29b0b4SJens Axboe #if defined(CONFIG_UNIX) 3213ed29b0b4SJens Axboe if (IS_ERR(file)) { 3214ed29b0b4SJens Axboe sock_release(ctx->ring_sock); 3215ed29b0b4SJens Axboe ctx->ring_sock = NULL; 3216ed29b0b4SJens Axboe } else { 3217ed29b0b4SJens Axboe ctx->ring_sock->file = file; 3218ed29b0b4SJens Axboe } 3219ed29b0b4SJens Axboe #endif 3220ed29b0b4SJens Axboe return file; 3221ed29b0b4SJens Axboe } 3222ed29b0b4SJens Axboe 3223ed29b0b4SJens Axboe static __cold int io_uring_create(unsigned entries, struct io_uring_params *p, 3224ed29b0b4SJens Axboe struct io_uring_params __user *params) 3225ed29b0b4SJens Axboe { 3226ed29b0b4SJens Axboe struct io_ring_ctx *ctx; 3227ed29b0b4SJens Axboe struct file *file; 3228ed29b0b4SJens Axboe int ret; 3229ed29b0b4SJens Axboe 3230ed29b0b4SJens Axboe if (!entries) 3231ed29b0b4SJens Axboe return -EINVAL; 3232ed29b0b4SJens Axboe if (entries > IORING_MAX_ENTRIES) { 3233ed29b0b4SJens Axboe if (!(p->flags & IORING_SETUP_CLAMP)) 3234ed29b0b4SJens Axboe return -EINVAL; 3235ed29b0b4SJens Axboe entries = IORING_MAX_ENTRIES; 3236ed29b0b4SJens Axboe } 3237ed29b0b4SJens Axboe 3238ed29b0b4SJens Axboe /* 3239ed29b0b4SJens Axboe * Use twice as many entries for the CQ ring. It's possible for the 3240ed29b0b4SJens Axboe * application to drive a higher depth than the size of the SQ ring, 3241ed29b0b4SJens Axboe * since the sqes are only used at submission time. This allows for 3242ed29b0b4SJens Axboe * some flexibility in overcommitting a bit. If the application has 3243ed29b0b4SJens Axboe * set IORING_SETUP_CQSIZE, it will have passed in the desired number 3244ed29b0b4SJens Axboe * of CQ ring entries manually. 3245ed29b0b4SJens Axboe */ 3246ed29b0b4SJens Axboe p->sq_entries = roundup_pow_of_two(entries); 3247ed29b0b4SJens Axboe if (p->flags & IORING_SETUP_CQSIZE) { 3248ed29b0b4SJens Axboe /* 3249ed29b0b4SJens Axboe * If IORING_SETUP_CQSIZE is set, we do the same roundup 3250ed29b0b4SJens Axboe * to a power-of-two, if it isn't already. We do NOT impose 3251ed29b0b4SJens Axboe * any cq vs sq ring sizing. 3252ed29b0b4SJens Axboe */ 3253ed29b0b4SJens Axboe if (!p->cq_entries) 3254ed29b0b4SJens Axboe return -EINVAL; 3255ed29b0b4SJens Axboe if (p->cq_entries > IORING_MAX_CQ_ENTRIES) { 3256ed29b0b4SJens Axboe if (!(p->flags & IORING_SETUP_CLAMP)) 3257ed29b0b4SJens Axboe return -EINVAL; 3258ed29b0b4SJens Axboe p->cq_entries = IORING_MAX_CQ_ENTRIES; 3259ed29b0b4SJens Axboe } 3260ed29b0b4SJens Axboe p->cq_entries = roundup_pow_of_two(p->cq_entries); 3261ed29b0b4SJens Axboe if (p->cq_entries < p->sq_entries) 3262ed29b0b4SJens Axboe return -EINVAL; 3263ed29b0b4SJens Axboe } else { 3264ed29b0b4SJens Axboe p->cq_entries = 2 * p->sq_entries; 3265ed29b0b4SJens Axboe } 3266ed29b0b4SJens Axboe 3267ed29b0b4SJens Axboe ctx = io_ring_ctx_alloc(p); 3268ed29b0b4SJens Axboe if (!ctx) 3269ed29b0b4SJens Axboe return -ENOMEM; 3270ed29b0b4SJens Axboe 3271ed29b0b4SJens Axboe /* 3272ed29b0b4SJens Axboe * When SETUP_IOPOLL and SETUP_SQPOLL are both enabled, user 3273ed29b0b4SJens Axboe * space applications don't need to do io completion events 3274ed29b0b4SJens Axboe * polling again, they can rely on io_sq_thread to do polling 3275ed29b0b4SJens Axboe * work, which can reduce cpu usage and uring_lock contention. 3276ed29b0b4SJens Axboe */ 3277ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_IOPOLL && 3278ed29b0b4SJens Axboe !(ctx->flags & IORING_SETUP_SQPOLL)) 3279ed29b0b4SJens Axboe ctx->syscall_iopoll = 1; 3280ed29b0b4SJens Axboe 3281ed29b0b4SJens Axboe ctx->compat = in_compat_syscall(); 3282ed29b0b4SJens Axboe if (!capable(CAP_IPC_LOCK)) 3283ed29b0b4SJens Axboe ctx->user = get_uid(current_user()); 3284ed29b0b4SJens Axboe 3285ed29b0b4SJens Axboe /* 3286ed29b0b4SJens Axboe * For SQPOLL, we just need a wakeup, always. For !SQPOLL, if 3287ed29b0b4SJens Axboe * COOP_TASKRUN is set, then IPIs are never needed by the app. 3288ed29b0b4SJens Axboe */ 3289ed29b0b4SJens Axboe ret = -EINVAL; 3290ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_SQPOLL) { 3291ed29b0b4SJens Axboe /* IPI related flags don't make sense with SQPOLL */ 3292ed29b0b4SJens Axboe if (ctx->flags & (IORING_SETUP_COOP_TASKRUN | 3293ed29b0b4SJens Axboe IORING_SETUP_TASKRUN_FLAG)) 3294ed29b0b4SJens Axboe goto err; 3295ed29b0b4SJens Axboe ctx->notify_method = TWA_SIGNAL_NO_IPI; 3296ed29b0b4SJens Axboe } else if (ctx->flags & IORING_SETUP_COOP_TASKRUN) { 3297ed29b0b4SJens Axboe ctx->notify_method = TWA_SIGNAL_NO_IPI; 3298ed29b0b4SJens Axboe } else { 3299ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_TASKRUN_FLAG) 3300ed29b0b4SJens Axboe goto err; 3301ed29b0b4SJens Axboe ctx->notify_method = TWA_SIGNAL; 3302ed29b0b4SJens Axboe } 3303ed29b0b4SJens Axboe 3304ed29b0b4SJens Axboe /* 3305ed29b0b4SJens Axboe * This is just grabbed for accounting purposes. When a process exits, 3306ed29b0b4SJens Axboe * the mm is exited and dropped before the files, hence we need to hang 3307ed29b0b4SJens Axboe * on to this mm purely for the purposes of being able to unaccount 3308ed29b0b4SJens Axboe * memory (locked/pinned vm). It's not used for anything else. 3309ed29b0b4SJens Axboe */ 3310ed29b0b4SJens Axboe mmgrab(current->mm); 3311ed29b0b4SJens Axboe ctx->mm_account = current->mm; 3312ed29b0b4SJens Axboe 3313ed29b0b4SJens Axboe ret = io_allocate_scq_urings(ctx, p); 3314ed29b0b4SJens Axboe if (ret) 3315ed29b0b4SJens Axboe goto err; 3316ed29b0b4SJens Axboe 3317ed29b0b4SJens Axboe ret = io_sq_offload_create(ctx, p); 3318ed29b0b4SJens Axboe if (ret) 3319ed29b0b4SJens Axboe goto err; 3320ed29b0b4SJens Axboe /* always set a rsrc node */ 3321ed29b0b4SJens Axboe ret = io_rsrc_node_switch_start(ctx); 3322ed29b0b4SJens Axboe if (ret) 3323ed29b0b4SJens Axboe goto err; 3324ed29b0b4SJens Axboe io_rsrc_node_switch(ctx, NULL); 3325ed29b0b4SJens Axboe 3326ed29b0b4SJens Axboe memset(&p->sq_off, 0, sizeof(p->sq_off)); 3327ed29b0b4SJens Axboe p->sq_off.head = offsetof(struct io_rings, sq.head); 3328ed29b0b4SJens Axboe p->sq_off.tail = offsetof(struct io_rings, sq.tail); 3329ed29b0b4SJens Axboe p->sq_off.ring_mask = offsetof(struct io_rings, sq_ring_mask); 3330ed29b0b4SJens Axboe p->sq_off.ring_entries = offsetof(struct io_rings, sq_ring_entries); 3331ed29b0b4SJens Axboe p->sq_off.flags = offsetof(struct io_rings, sq_flags); 3332ed29b0b4SJens Axboe p->sq_off.dropped = offsetof(struct io_rings, sq_dropped); 3333ed29b0b4SJens Axboe p->sq_off.array = (char *)ctx->sq_array - (char *)ctx->rings; 3334ed29b0b4SJens Axboe 3335ed29b0b4SJens Axboe memset(&p->cq_off, 0, sizeof(p->cq_off)); 3336ed29b0b4SJens Axboe p->cq_off.head = offsetof(struct io_rings, cq.head); 3337ed29b0b4SJens Axboe p->cq_off.tail = offsetof(struct io_rings, cq.tail); 3338ed29b0b4SJens Axboe p->cq_off.ring_mask = offsetof(struct io_rings, cq_ring_mask); 3339ed29b0b4SJens Axboe p->cq_off.ring_entries = offsetof(struct io_rings, cq_ring_entries); 3340ed29b0b4SJens Axboe p->cq_off.overflow = offsetof(struct io_rings, cq_overflow); 3341ed29b0b4SJens Axboe p->cq_off.cqes = offsetof(struct io_rings, cqes); 3342ed29b0b4SJens Axboe p->cq_off.flags = offsetof(struct io_rings, cq_flags); 3343ed29b0b4SJens Axboe 3344ed29b0b4SJens Axboe p->features = IORING_FEAT_SINGLE_MMAP | IORING_FEAT_NODROP | 3345ed29b0b4SJens Axboe IORING_FEAT_SUBMIT_STABLE | IORING_FEAT_RW_CUR_POS | 3346ed29b0b4SJens Axboe IORING_FEAT_CUR_PERSONALITY | IORING_FEAT_FAST_POLL | 3347ed29b0b4SJens Axboe IORING_FEAT_POLL_32BITS | IORING_FEAT_SQPOLL_NONFIXED | 3348ed29b0b4SJens Axboe IORING_FEAT_EXT_ARG | IORING_FEAT_NATIVE_WORKERS | 3349ed29b0b4SJens Axboe IORING_FEAT_RSRC_TAGS | IORING_FEAT_CQE_SKIP | 3350ed29b0b4SJens Axboe IORING_FEAT_LINKED_FILE; 3351ed29b0b4SJens Axboe 3352ed29b0b4SJens Axboe if (copy_to_user(params, p, sizeof(*p))) { 3353ed29b0b4SJens Axboe ret = -EFAULT; 3354ed29b0b4SJens Axboe goto err; 3355ed29b0b4SJens Axboe } 3356ed29b0b4SJens Axboe 3357ed29b0b4SJens Axboe file = io_uring_get_file(ctx); 3358ed29b0b4SJens Axboe if (IS_ERR(file)) { 3359ed29b0b4SJens Axboe ret = PTR_ERR(file); 3360ed29b0b4SJens Axboe goto err; 3361ed29b0b4SJens Axboe } 3362ed29b0b4SJens Axboe 3363ed29b0b4SJens Axboe /* 3364ed29b0b4SJens Axboe * Install ring fd as the very last thing, so we don't risk someone 3365ed29b0b4SJens Axboe * having closed it before we finish setup 3366ed29b0b4SJens Axboe */ 3367ed29b0b4SJens Axboe ret = io_uring_install_fd(ctx, file); 3368ed29b0b4SJens Axboe if (ret < 0) { 3369ed29b0b4SJens Axboe /* fput will clean it up */ 3370ed29b0b4SJens Axboe fput(file); 3371ed29b0b4SJens Axboe return ret; 3372ed29b0b4SJens Axboe } 3373ed29b0b4SJens Axboe 3374ed29b0b4SJens Axboe trace_io_uring_create(ret, ctx, p->sq_entries, p->cq_entries, p->flags); 3375ed29b0b4SJens Axboe return ret; 3376ed29b0b4SJens Axboe err: 3377ed29b0b4SJens Axboe io_ring_ctx_wait_and_kill(ctx); 3378ed29b0b4SJens Axboe return ret; 3379ed29b0b4SJens Axboe } 3380ed29b0b4SJens Axboe 3381ed29b0b4SJens Axboe /* 3382ed29b0b4SJens Axboe * Sets up an aio uring context, and returns the fd. Applications asks for a 3383ed29b0b4SJens Axboe * ring size, we return the actual sq/cq ring sizes (among other things) in the 3384ed29b0b4SJens Axboe * params structure passed in. 3385ed29b0b4SJens Axboe */ 3386ed29b0b4SJens Axboe static long io_uring_setup(u32 entries, struct io_uring_params __user *params) 3387ed29b0b4SJens Axboe { 3388ed29b0b4SJens Axboe struct io_uring_params p; 3389ed29b0b4SJens Axboe int i; 3390ed29b0b4SJens Axboe 3391ed29b0b4SJens Axboe if (copy_from_user(&p, params, sizeof(p))) 3392ed29b0b4SJens Axboe return -EFAULT; 3393ed29b0b4SJens Axboe for (i = 0; i < ARRAY_SIZE(p.resv); i++) { 3394ed29b0b4SJens Axboe if (p.resv[i]) 3395ed29b0b4SJens Axboe return -EINVAL; 3396ed29b0b4SJens Axboe } 3397ed29b0b4SJens Axboe 3398ed29b0b4SJens Axboe if (p.flags & ~(IORING_SETUP_IOPOLL | IORING_SETUP_SQPOLL | 3399ed29b0b4SJens Axboe IORING_SETUP_SQ_AFF | IORING_SETUP_CQSIZE | 3400ed29b0b4SJens Axboe IORING_SETUP_CLAMP | IORING_SETUP_ATTACH_WQ | 3401ed29b0b4SJens Axboe IORING_SETUP_R_DISABLED | IORING_SETUP_SUBMIT_ALL | 3402ed29b0b4SJens Axboe IORING_SETUP_COOP_TASKRUN | IORING_SETUP_TASKRUN_FLAG | 340397bbdc06SPavel Begunkov IORING_SETUP_SQE128 | IORING_SETUP_CQE32 | 340497bbdc06SPavel Begunkov IORING_SETUP_SINGLE_ISSUER)) 3405ed29b0b4SJens Axboe return -EINVAL; 3406ed29b0b4SJens Axboe 3407ed29b0b4SJens Axboe return io_uring_create(entries, &p, params); 3408ed29b0b4SJens Axboe } 3409ed29b0b4SJens Axboe 3410ed29b0b4SJens Axboe SYSCALL_DEFINE2(io_uring_setup, u32, entries, 3411ed29b0b4SJens Axboe struct io_uring_params __user *, params) 3412ed29b0b4SJens Axboe { 3413ed29b0b4SJens Axboe return io_uring_setup(entries, params); 3414ed29b0b4SJens Axboe } 3415ed29b0b4SJens Axboe 3416ed29b0b4SJens Axboe static __cold int io_probe(struct io_ring_ctx *ctx, void __user *arg, 3417ed29b0b4SJens Axboe unsigned nr_args) 3418ed29b0b4SJens Axboe { 3419ed29b0b4SJens Axboe struct io_uring_probe *p; 3420ed29b0b4SJens Axboe size_t size; 3421ed29b0b4SJens Axboe int i, ret; 3422ed29b0b4SJens Axboe 3423ed29b0b4SJens Axboe size = struct_size(p, ops, nr_args); 3424ed29b0b4SJens Axboe if (size == SIZE_MAX) 3425ed29b0b4SJens Axboe return -EOVERFLOW; 3426ed29b0b4SJens Axboe p = kzalloc(size, GFP_KERNEL); 3427ed29b0b4SJens Axboe if (!p) 3428ed29b0b4SJens Axboe return -ENOMEM; 3429ed29b0b4SJens Axboe 3430ed29b0b4SJens Axboe ret = -EFAULT; 3431ed29b0b4SJens Axboe if (copy_from_user(p, arg, size)) 3432ed29b0b4SJens Axboe goto out; 3433ed29b0b4SJens Axboe ret = -EINVAL; 3434ed29b0b4SJens Axboe if (memchr_inv(p, 0, size)) 3435ed29b0b4SJens Axboe goto out; 3436ed29b0b4SJens Axboe 3437ed29b0b4SJens Axboe p->last_op = IORING_OP_LAST - 1; 3438ed29b0b4SJens Axboe if (nr_args > IORING_OP_LAST) 3439ed29b0b4SJens Axboe nr_args = IORING_OP_LAST; 3440ed29b0b4SJens Axboe 3441ed29b0b4SJens Axboe for (i = 0; i < nr_args; i++) { 3442ed29b0b4SJens Axboe p->ops[i].op = i; 3443ed29b0b4SJens Axboe if (!io_op_defs[i].not_supported) 3444ed29b0b4SJens Axboe p->ops[i].flags = IO_URING_OP_SUPPORTED; 3445ed29b0b4SJens Axboe } 3446ed29b0b4SJens Axboe p->ops_len = i; 3447ed29b0b4SJens Axboe 3448ed29b0b4SJens Axboe ret = 0; 3449ed29b0b4SJens Axboe if (copy_to_user(arg, p, size)) 3450ed29b0b4SJens Axboe ret = -EFAULT; 3451ed29b0b4SJens Axboe out: 3452ed29b0b4SJens Axboe kfree(p); 3453ed29b0b4SJens Axboe return ret; 3454ed29b0b4SJens Axboe } 3455ed29b0b4SJens Axboe 3456ed29b0b4SJens Axboe static int io_register_personality(struct io_ring_ctx *ctx) 3457ed29b0b4SJens Axboe { 3458ed29b0b4SJens Axboe const struct cred *creds; 3459ed29b0b4SJens Axboe u32 id; 3460ed29b0b4SJens Axboe int ret; 3461ed29b0b4SJens Axboe 3462ed29b0b4SJens Axboe creds = get_current_cred(); 3463ed29b0b4SJens Axboe 3464ed29b0b4SJens Axboe ret = xa_alloc_cyclic(&ctx->personalities, &id, (void *)creds, 3465ed29b0b4SJens Axboe XA_LIMIT(0, USHRT_MAX), &ctx->pers_next, GFP_KERNEL); 3466ed29b0b4SJens Axboe if (ret < 0) { 3467ed29b0b4SJens Axboe put_cred(creds); 3468ed29b0b4SJens Axboe return ret; 3469ed29b0b4SJens Axboe } 3470ed29b0b4SJens Axboe return id; 3471ed29b0b4SJens Axboe } 3472ed29b0b4SJens Axboe 3473ed29b0b4SJens Axboe static __cold int io_register_restrictions(struct io_ring_ctx *ctx, 3474ed29b0b4SJens Axboe void __user *arg, unsigned int nr_args) 3475ed29b0b4SJens Axboe { 3476ed29b0b4SJens Axboe struct io_uring_restriction *res; 3477ed29b0b4SJens Axboe size_t size; 3478ed29b0b4SJens Axboe int i, ret; 3479ed29b0b4SJens Axboe 3480ed29b0b4SJens Axboe /* Restrictions allowed only if rings started disabled */ 3481ed29b0b4SJens Axboe if (!(ctx->flags & IORING_SETUP_R_DISABLED)) 3482ed29b0b4SJens Axboe return -EBADFD; 3483ed29b0b4SJens Axboe 3484ed29b0b4SJens Axboe /* We allow only a single restrictions registration */ 3485ed29b0b4SJens Axboe if (ctx->restrictions.registered) 3486ed29b0b4SJens Axboe return -EBUSY; 3487ed29b0b4SJens Axboe 3488ed29b0b4SJens Axboe if (!arg || nr_args > IORING_MAX_RESTRICTIONS) 3489ed29b0b4SJens Axboe return -EINVAL; 3490ed29b0b4SJens Axboe 3491ed29b0b4SJens Axboe size = array_size(nr_args, sizeof(*res)); 3492ed29b0b4SJens Axboe if (size == SIZE_MAX) 3493ed29b0b4SJens Axboe return -EOVERFLOW; 3494ed29b0b4SJens Axboe 3495ed29b0b4SJens Axboe res = memdup_user(arg, size); 3496ed29b0b4SJens Axboe if (IS_ERR(res)) 3497ed29b0b4SJens Axboe return PTR_ERR(res); 3498ed29b0b4SJens Axboe 3499ed29b0b4SJens Axboe ret = 0; 3500ed29b0b4SJens Axboe 3501ed29b0b4SJens Axboe for (i = 0; i < nr_args; i++) { 3502ed29b0b4SJens Axboe switch (res[i].opcode) { 3503ed29b0b4SJens Axboe case IORING_RESTRICTION_REGISTER_OP: 3504ed29b0b4SJens Axboe if (res[i].register_op >= IORING_REGISTER_LAST) { 3505ed29b0b4SJens Axboe ret = -EINVAL; 3506ed29b0b4SJens Axboe goto out; 3507ed29b0b4SJens Axboe } 3508ed29b0b4SJens Axboe 3509ed29b0b4SJens Axboe __set_bit(res[i].register_op, 3510ed29b0b4SJens Axboe ctx->restrictions.register_op); 3511ed29b0b4SJens Axboe break; 3512ed29b0b4SJens Axboe case IORING_RESTRICTION_SQE_OP: 3513ed29b0b4SJens Axboe if (res[i].sqe_op >= IORING_OP_LAST) { 3514ed29b0b4SJens Axboe ret = -EINVAL; 3515ed29b0b4SJens Axboe goto out; 3516ed29b0b4SJens Axboe } 3517ed29b0b4SJens Axboe 3518ed29b0b4SJens Axboe __set_bit(res[i].sqe_op, ctx->restrictions.sqe_op); 3519ed29b0b4SJens Axboe break; 3520ed29b0b4SJens Axboe case IORING_RESTRICTION_SQE_FLAGS_ALLOWED: 3521ed29b0b4SJens Axboe ctx->restrictions.sqe_flags_allowed = res[i].sqe_flags; 3522ed29b0b4SJens Axboe break; 3523ed29b0b4SJens Axboe case IORING_RESTRICTION_SQE_FLAGS_REQUIRED: 3524ed29b0b4SJens Axboe ctx->restrictions.sqe_flags_required = res[i].sqe_flags; 3525ed29b0b4SJens Axboe break; 3526ed29b0b4SJens Axboe default: 3527ed29b0b4SJens Axboe ret = -EINVAL; 3528ed29b0b4SJens Axboe goto out; 3529ed29b0b4SJens Axboe } 3530ed29b0b4SJens Axboe } 3531ed29b0b4SJens Axboe 3532ed29b0b4SJens Axboe out: 3533ed29b0b4SJens Axboe /* Reset all restrictions if an error happened */ 3534ed29b0b4SJens Axboe if (ret != 0) 3535ed29b0b4SJens Axboe memset(&ctx->restrictions, 0, sizeof(ctx->restrictions)); 3536ed29b0b4SJens Axboe else 3537ed29b0b4SJens Axboe ctx->restrictions.registered = true; 3538ed29b0b4SJens Axboe 3539ed29b0b4SJens Axboe kfree(res); 3540ed29b0b4SJens Axboe return ret; 3541ed29b0b4SJens Axboe } 3542ed29b0b4SJens Axboe 3543ed29b0b4SJens Axboe static int io_register_enable_rings(struct io_ring_ctx *ctx) 3544ed29b0b4SJens Axboe { 3545ed29b0b4SJens Axboe if (!(ctx->flags & IORING_SETUP_R_DISABLED)) 3546ed29b0b4SJens Axboe return -EBADFD; 3547ed29b0b4SJens Axboe 3548ed29b0b4SJens Axboe if (ctx->restrictions.registered) 3549ed29b0b4SJens Axboe ctx->restricted = 1; 3550ed29b0b4SJens Axboe 3551ed29b0b4SJens Axboe ctx->flags &= ~IORING_SETUP_R_DISABLED; 3552ed29b0b4SJens Axboe if (ctx->sq_data && wq_has_sleeper(&ctx->sq_data->wait)) 3553ed29b0b4SJens Axboe wake_up(&ctx->sq_data->wait); 3554ed29b0b4SJens Axboe return 0; 3555ed29b0b4SJens Axboe } 3556ed29b0b4SJens Axboe 3557ed29b0b4SJens Axboe static __cold int io_register_iowq_aff(struct io_ring_ctx *ctx, 3558ed29b0b4SJens Axboe void __user *arg, unsigned len) 3559ed29b0b4SJens Axboe { 3560ed29b0b4SJens Axboe struct io_uring_task *tctx = current->io_uring; 3561ed29b0b4SJens Axboe cpumask_var_t new_mask; 3562ed29b0b4SJens Axboe int ret; 3563ed29b0b4SJens Axboe 3564ed29b0b4SJens Axboe if (!tctx || !tctx->io_wq) 3565ed29b0b4SJens Axboe return -EINVAL; 3566ed29b0b4SJens Axboe 3567ed29b0b4SJens Axboe if (!alloc_cpumask_var(&new_mask, GFP_KERNEL)) 3568ed29b0b4SJens Axboe return -ENOMEM; 3569ed29b0b4SJens Axboe 3570ed29b0b4SJens Axboe cpumask_clear(new_mask); 3571ed29b0b4SJens Axboe if (len > cpumask_size()) 3572ed29b0b4SJens Axboe len = cpumask_size(); 3573ed29b0b4SJens Axboe 3574ed29b0b4SJens Axboe if (in_compat_syscall()) { 3575ed29b0b4SJens Axboe ret = compat_get_bitmap(cpumask_bits(new_mask), 3576ed29b0b4SJens Axboe (const compat_ulong_t __user *)arg, 3577ed29b0b4SJens Axboe len * 8 /* CHAR_BIT */); 3578ed29b0b4SJens Axboe } else { 3579ed29b0b4SJens Axboe ret = copy_from_user(new_mask, arg, len); 3580ed29b0b4SJens Axboe } 3581ed29b0b4SJens Axboe 3582ed29b0b4SJens Axboe if (ret) { 3583ed29b0b4SJens Axboe free_cpumask_var(new_mask); 3584ed29b0b4SJens Axboe return -EFAULT; 3585ed29b0b4SJens Axboe } 3586ed29b0b4SJens Axboe 3587ed29b0b4SJens Axboe ret = io_wq_cpu_affinity(tctx->io_wq, new_mask); 3588ed29b0b4SJens Axboe free_cpumask_var(new_mask); 3589ed29b0b4SJens Axboe return ret; 3590ed29b0b4SJens Axboe } 3591ed29b0b4SJens Axboe 3592ed29b0b4SJens Axboe static __cold int io_unregister_iowq_aff(struct io_ring_ctx *ctx) 3593ed29b0b4SJens Axboe { 3594ed29b0b4SJens Axboe struct io_uring_task *tctx = current->io_uring; 3595ed29b0b4SJens Axboe 3596ed29b0b4SJens Axboe if (!tctx || !tctx->io_wq) 3597ed29b0b4SJens Axboe return -EINVAL; 3598ed29b0b4SJens Axboe 3599ed29b0b4SJens Axboe return io_wq_cpu_affinity(tctx->io_wq, NULL); 3600ed29b0b4SJens Axboe } 3601ed29b0b4SJens Axboe 3602ed29b0b4SJens Axboe static __cold int io_register_iowq_max_workers(struct io_ring_ctx *ctx, 3603ed29b0b4SJens Axboe void __user *arg) 3604ed29b0b4SJens Axboe __must_hold(&ctx->uring_lock) 3605ed29b0b4SJens Axboe { 3606ed29b0b4SJens Axboe struct io_tctx_node *node; 3607ed29b0b4SJens Axboe struct io_uring_task *tctx = NULL; 3608ed29b0b4SJens Axboe struct io_sq_data *sqd = NULL; 3609ed29b0b4SJens Axboe __u32 new_count[2]; 3610ed29b0b4SJens Axboe int i, ret; 3611ed29b0b4SJens Axboe 3612ed29b0b4SJens Axboe if (copy_from_user(new_count, arg, sizeof(new_count))) 3613ed29b0b4SJens Axboe return -EFAULT; 3614ed29b0b4SJens Axboe for (i = 0; i < ARRAY_SIZE(new_count); i++) 3615ed29b0b4SJens Axboe if (new_count[i] > INT_MAX) 3616ed29b0b4SJens Axboe return -EINVAL; 3617ed29b0b4SJens Axboe 3618ed29b0b4SJens Axboe if (ctx->flags & IORING_SETUP_SQPOLL) { 3619ed29b0b4SJens Axboe sqd = ctx->sq_data; 3620ed29b0b4SJens Axboe if (sqd) { 3621ed29b0b4SJens Axboe /* 3622ed29b0b4SJens Axboe * Observe the correct sqd->lock -> ctx->uring_lock 3623ed29b0b4SJens Axboe * ordering. Fine to drop uring_lock here, we hold 3624ed29b0b4SJens Axboe * a ref to the ctx. 3625ed29b0b4SJens Axboe */ 3626ed29b0b4SJens Axboe refcount_inc(&sqd->refs); 3627ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 3628ed29b0b4SJens Axboe mutex_lock(&sqd->lock); 3629ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 3630ed29b0b4SJens Axboe if (sqd->thread) 3631ed29b0b4SJens Axboe tctx = sqd->thread->io_uring; 3632ed29b0b4SJens Axboe } 3633ed29b0b4SJens Axboe } else { 3634ed29b0b4SJens Axboe tctx = current->io_uring; 3635ed29b0b4SJens Axboe } 3636ed29b0b4SJens Axboe 3637ed29b0b4SJens Axboe BUILD_BUG_ON(sizeof(new_count) != sizeof(ctx->iowq_limits)); 3638ed29b0b4SJens Axboe 3639ed29b0b4SJens Axboe for (i = 0; i < ARRAY_SIZE(new_count); i++) 3640ed29b0b4SJens Axboe if (new_count[i]) 3641ed29b0b4SJens Axboe ctx->iowq_limits[i] = new_count[i]; 3642ed29b0b4SJens Axboe ctx->iowq_limits_set = true; 3643ed29b0b4SJens Axboe 3644ed29b0b4SJens Axboe if (tctx && tctx->io_wq) { 3645ed29b0b4SJens Axboe ret = io_wq_max_workers(tctx->io_wq, new_count); 3646ed29b0b4SJens Axboe if (ret) 3647ed29b0b4SJens Axboe goto err; 3648ed29b0b4SJens Axboe } else { 3649ed29b0b4SJens Axboe memset(new_count, 0, sizeof(new_count)); 3650ed29b0b4SJens Axboe } 3651ed29b0b4SJens Axboe 3652ed29b0b4SJens Axboe if (sqd) { 3653ed29b0b4SJens Axboe mutex_unlock(&sqd->lock); 3654ed29b0b4SJens Axboe io_put_sq_data(sqd); 3655ed29b0b4SJens Axboe } 3656ed29b0b4SJens Axboe 3657ed29b0b4SJens Axboe if (copy_to_user(arg, new_count, sizeof(new_count))) 3658ed29b0b4SJens Axboe return -EFAULT; 3659ed29b0b4SJens Axboe 3660ed29b0b4SJens Axboe /* that's it for SQPOLL, only the SQPOLL task creates requests */ 3661ed29b0b4SJens Axboe if (sqd) 3662ed29b0b4SJens Axboe return 0; 3663ed29b0b4SJens Axboe 3664ed29b0b4SJens Axboe /* now propagate the restriction to all registered users */ 3665ed29b0b4SJens Axboe list_for_each_entry(node, &ctx->tctx_list, ctx_node) { 3666ed29b0b4SJens Axboe struct io_uring_task *tctx = node->task->io_uring; 3667ed29b0b4SJens Axboe 3668ed29b0b4SJens Axboe if (WARN_ON_ONCE(!tctx->io_wq)) 3669ed29b0b4SJens Axboe continue; 3670ed29b0b4SJens Axboe 3671ed29b0b4SJens Axboe for (i = 0; i < ARRAY_SIZE(new_count); i++) 3672ed29b0b4SJens Axboe new_count[i] = ctx->iowq_limits[i]; 3673ed29b0b4SJens Axboe /* ignore errors, it always returns zero anyway */ 3674ed29b0b4SJens Axboe (void)io_wq_max_workers(tctx->io_wq, new_count); 3675ed29b0b4SJens Axboe } 3676ed29b0b4SJens Axboe return 0; 3677ed29b0b4SJens Axboe err: 3678ed29b0b4SJens Axboe if (sqd) { 3679ed29b0b4SJens Axboe mutex_unlock(&sqd->lock); 3680ed29b0b4SJens Axboe io_put_sq_data(sqd); 3681ed29b0b4SJens Axboe } 3682ed29b0b4SJens Axboe return ret; 3683ed29b0b4SJens Axboe } 3684ed29b0b4SJens Axboe 3685ed29b0b4SJens Axboe static int __io_uring_register(struct io_ring_ctx *ctx, unsigned opcode, 3686ed29b0b4SJens Axboe void __user *arg, unsigned nr_args) 3687ed29b0b4SJens Axboe __releases(ctx->uring_lock) 3688ed29b0b4SJens Axboe __acquires(ctx->uring_lock) 3689ed29b0b4SJens Axboe { 3690ed29b0b4SJens Axboe int ret; 3691ed29b0b4SJens Axboe 3692ed29b0b4SJens Axboe /* 3693fbb8bb02SPavel Begunkov * We don't quiesce the refs for register anymore and so it can't be 3694fbb8bb02SPavel Begunkov * dying as we're holding a file ref here. 3695ed29b0b4SJens Axboe */ 3696fbb8bb02SPavel Begunkov if (WARN_ON_ONCE(percpu_ref_is_dying(&ctx->refs))) 3697ed29b0b4SJens Axboe return -ENXIO; 3698ed29b0b4SJens Axboe 3699ed29b0b4SJens Axboe if (ctx->restricted) { 3700ed29b0b4SJens Axboe if (opcode >= IORING_REGISTER_LAST) 3701ed29b0b4SJens Axboe return -EINVAL; 3702ed29b0b4SJens Axboe opcode = array_index_nospec(opcode, IORING_REGISTER_LAST); 3703ed29b0b4SJens Axboe if (!test_bit(opcode, ctx->restrictions.register_op)) 3704ed29b0b4SJens Axboe return -EACCES; 3705ed29b0b4SJens Axboe } 3706ed29b0b4SJens Axboe 3707ed29b0b4SJens Axboe switch (opcode) { 3708ed29b0b4SJens Axboe case IORING_REGISTER_BUFFERS: 3709ed29b0b4SJens Axboe ret = -EFAULT; 3710ed29b0b4SJens Axboe if (!arg) 3711ed29b0b4SJens Axboe break; 3712ed29b0b4SJens Axboe ret = io_sqe_buffers_register(ctx, arg, nr_args, NULL); 3713ed29b0b4SJens Axboe break; 3714ed29b0b4SJens Axboe case IORING_UNREGISTER_BUFFERS: 3715ed29b0b4SJens Axboe ret = -EINVAL; 3716ed29b0b4SJens Axboe if (arg || nr_args) 3717ed29b0b4SJens Axboe break; 3718ed29b0b4SJens Axboe ret = io_sqe_buffers_unregister(ctx); 3719ed29b0b4SJens Axboe break; 3720ed29b0b4SJens Axboe case IORING_REGISTER_FILES: 3721ed29b0b4SJens Axboe ret = -EFAULT; 3722ed29b0b4SJens Axboe if (!arg) 3723ed29b0b4SJens Axboe break; 3724ed29b0b4SJens Axboe ret = io_sqe_files_register(ctx, arg, nr_args, NULL); 3725ed29b0b4SJens Axboe break; 3726ed29b0b4SJens Axboe case IORING_UNREGISTER_FILES: 3727ed29b0b4SJens Axboe ret = -EINVAL; 3728ed29b0b4SJens Axboe if (arg || nr_args) 3729ed29b0b4SJens Axboe break; 3730ed29b0b4SJens Axboe ret = io_sqe_files_unregister(ctx); 3731ed29b0b4SJens Axboe break; 3732ed29b0b4SJens Axboe case IORING_REGISTER_FILES_UPDATE: 3733ed29b0b4SJens Axboe ret = io_register_files_update(ctx, arg, nr_args); 3734ed29b0b4SJens Axboe break; 3735ed29b0b4SJens Axboe case IORING_REGISTER_EVENTFD: 3736ed29b0b4SJens Axboe ret = -EINVAL; 3737ed29b0b4SJens Axboe if (nr_args != 1) 3738ed29b0b4SJens Axboe break; 3739ed29b0b4SJens Axboe ret = io_eventfd_register(ctx, arg, 0); 3740ed29b0b4SJens Axboe break; 3741ed29b0b4SJens Axboe case IORING_REGISTER_EVENTFD_ASYNC: 3742ed29b0b4SJens Axboe ret = -EINVAL; 3743ed29b0b4SJens Axboe if (nr_args != 1) 3744ed29b0b4SJens Axboe break; 3745ed29b0b4SJens Axboe ret = io_eventfd_register(ctx, arg, 1); 3746ed29b0b4SJens Axboe break; 3747ed29b0b4SJens Axboe case IORING_UNREGISTER_EVENTFD: 3748ed29b0b4SJens Axboe ret = -EINVAL; 3749ed29b0b4SJens Axboe if (arg || nr_args) 3750ed29b0b4SJens Axboe break; 3751ed29b0b4SJens Axboe ret = io_eventfd_unregister(ctx); 3752ed29b0b4SJens Axboe break; 3753ed29b0b4SJens Axboe case IORING_REGISTER_PROBE: 3754ed29b0b4SJens Axboe ret = -EINVAL; 3755ed29b0b4SJens Axboe if (!arg || nr_args > 256) 3756ed29b0b4SJens Axboe break; 3757ed29b0b4SJens Axboe ret = io_probe(ctx, arg, nr_args); 3758ed29b0b4SJens Axboe break; 3759ed29b0b4SJens Axboe case IORING_REGISTER_PERSONALITY: 3760ed29b0b4SJens Axboe ret = -EINVAL; 3761ed29b0b4SJens Axboe if (arg || nr_args) 3762ed29b0b4SJens Axboe break; 3763ed29b0b4SJens Axboe ret = io_register_personality(ctx); 3764ed29b0b4SJens Axboe break; 3765ed29b0b4SJens Axboe case IORING_UNREGISTER_PERSONALITY: 3766ed29b0b4SJens Axboe ret = -EINVAL; 3767ed29b0b4SJens Axboe if (arg) 3768ed29b0b4SJens Axboe break; 3769ed29b0b4SJens Axboe ret = io_unregister_personality(ctx, nr_args); 3770ed29b0b4SJens Axboe break; 3771ed29b0b4SJens Axboe case IORING_REGISTER_ENABLE_RINGS: 3772ed29b0b4SJens Axboe ret = -EINVAL; 3773ed29b0b4SJens Axboe if (arg || nr_args) 3774ed29b0b4SJens Axboe break; 3775ed29b0b4SJens Axboe ret = io_register_enable_rings(ctx); 3776ed29b0b4SJens Axboe break; 3777ed29b0b4SJens Axboe case IORING_REGISTER_RESTRICTIONS: 3778ed29b0b4SJens Axboe ret = io_register_restrictions(ctx, arg, nr_args); 3779ed29b0b4SJens Axboe break; 3780ed29b0b4SJens Axboe case IORING_REGISTER_FILES2: 3781ed29b0b4SJens Axboe ret = io_register_rsrc(ctx, arg, nr_args, IORING_RSRC_FILE); 3782ed29b0b4SJens Axboe break; 3783ed29b0b4SJens Axboe case IORING_REGISTER_FILES_UPDATE2: 3784ed29b0b4SJens Axboe ret = io_register_rsrc_update(ctx, arg, nr_args, 3785ed29b0b4SJens Axboe IORING_RSRC_FILE); 3786ed29b0b4SJens Axboe break; 3787ed29b0b4SJens Axboe case IORING_REGISTER_BUFFERS2: 3788ed29b0b4SJens Axboe ret = io_register_rsrc(ctx, arg, nr_args, IORING_RSRC_BUFFER); 3789ed29b0b4SJens Axboe break; 3790ed29b0b4SJens Axboe case IORING_REGISTER_BUFFERS_UPDATE: 3791ed29b0b4SJens Axboe ret = io_register_rsrc_update(ctx, arg, nr_args, 3792ed29b0b4SJens Axboe IORING_RSRC_BUFFER); 3793ed29b0b4SJens Axboe break; 3794ed29b0b4SJens Axboe case IORING_REGISTER_IOWQ_AFF: 3795ed29b0b4SJens Axboe ret = -EINVAL; 3796ed29b0b4SJens Axboe if (!arg || !nr_args) 3797ed29b0b4SJens Axboe break; 3798ed29b0b4SJens Axboe ret = io_register_iowq_aff(ctx, arg, nr_args); 3799ed29b0b4SJens Axboe break; 3800ed29b0b4SJens Axboe case IORING_UNREGISTER_IOWQ_AFF: 3801ed29b0b4SJens Axboe ret = -EINVAL; 3802ed29b0b4SJens Axboe if (arg || nr_args) 3803ed29b0b4SJens Axboe break; 3804ed29b0b4SJens Axboe ret = io_unregister_iowq_aff(ctx); 3805ed29b0b4SJens Axboe break; 3806ed29b0b4SJens Axboe case IORING_REGISTER_IOWQ_MAX_WORKERS: 3807ed29b0b4SJens Axboe ret = -EINVAL; 3808ed29b0b4SJens Axboe if (!arg || nr_args != 2) 3809ed29b0b4SJens Axboe break; 3810ed29b0b4SJens Axboe ret = io_register_iowq_max_workers(ctx, arg); 3811ed29b0b4SJens Axboe break; 3812ed29b0b4SJens Axboe case IORING_REGISTER_RING_FDS: 3813ed29b0b4SJens Axboe ret = io_ringfd_register(ctx, arg, nr_args); 3814ed29b0b4SJens Axboe break; 3815ed29b0b4SJens Axboe case IORING_UNREGISTER_RING_FDS: 3816ed29b0b4SJens Axboe ret = io_ringfd_unregister(ctx, arg, nr_args); 3817ed29b0b4SJens Axboe break; 3818ed29b0b4SJens Axboe case IORING_REGISTER_PBUF_RING: 3819ed29b0b4SJens Axboe ret = -EINVAL; 3820ed29b0b4SJens Axboe if (!arg || nr_args != 1) 3821ed29b0b4SJens Axboe break; 3822ed29b0b4SJens Axboe ret = io_register_pbuf_ring(ctx, arg); 3823ed29b0b4SJens Axboe break; 3824ed29b0b4SJens Axboe case IORING_UNREGISTER_PBUF_RING: 3825ed29b0b4SJens Axboe ret = -EINVAL; 3826ed29b0b4SJens Axboe if (!arg || nr_args != 1) 3827ed29b0b4SJens Axboe break; 3828ed29b0b4SJens Axboe ret = io_unregister_pbuf_ring(ctx, arg); 3829ed29b0b4SJens Axboe break; 383078a861b9SJens Axboe case IORING_REGISTER_SYNC_CANCEL: 383178a861b9SJens Axboe ret = -EINVAL; 383278a861b9SJens Axboe if (!arg || nr_args != 1) 383378a861b9SJens Axboe break; 383478a861b9SJens Axboe ret = io_sync_cancel(ctx, arg); 383578a861b9SJens Axboe break; 38366e73dffbSPavel Begunkov case IORING_REGISTER_FILE_ALLOC_RANGE: 38376e73dffbSPavel Begunkov ret = -EINVAL; 38386e73dffbSPavel Begunkov if (!arg || nr_args) 38396e73dffbSPavel Begunkov break; 38406e73dffbSPavel Begunkov ret = io_register_file_alloc_range(ctx, arg); 38416e73dffbSPavel Begunkov break; 3842bc24d6bdSPavel Begunkov case IORING_REGISTER_NOTIFIERS: 3843bc24d6bdSPavel Begunkov ret = io_notif_register(ctx, arg, nr_args); 3844bc24d6bdSPavel Begunkov break; 3845bc24d6bdSPavel Begunkov case IORING_UNREGISTER_NOTIFIERS: 3846bc24d6bdSPavel Begunkov ret = -EINVAL; 3847bc24d6bdSPavel Begunkov if (arg || nr_args) 3848bc24d6bdSPavel Begunkov break; 3849bc24d6bdSPavel Begunkov ret = io_notif_unregister(ctx); 3850bc24d6bdSPavel Begunkov break; 3851ed29b0b4SJens Axboe default: 3852ed29b0b4SJens Axboe ret = -EINVAL; 3853ed29b0b4SJens Axboe break; 3854ed29b0b4SJens Axboe } 3855ed29b0b4SJens Axboe 3856ed29b0b4SJens Axboe return ret; 3857ed29b0b4SJens Axboe } 3858ed29b0b4SJens Axboe 3859ed29b0b4SJens Axboe SYSCALL_DEFINE4(io_uring_register, unsigned int, fd, unsigned int, opcode, 3860ed29b0b4SJens Axboe void __user *, arg, unsigned int, nr_args) 3861ed29b0b4SJens Axboe { 3862ed29b0b4SJens Axboe struct io_ring_ctx *ctx; 3863ed29b0b4SJens Axboe long ret = -EBADF; 3864ed29b0b4SJens Axboe struct fd f; 3865ed29b0b4SJens Axboe 3866ed29b0b4SJens Axboe f = fdget(fd); 3867ed29b0b4SJens Axboe if (!f.file) 3868ed29b0b4SJens Axboe return -EBADF; 3869ed29b0b4SJens Axboe 3870ed29b0b4SJens Axboe ret = -EOPNOTSUPP; 3871e5550a14SJens Axboe if (!io_is_uring_fops(f.file)) 3872ed29b0b4SJens Axboe goto out_fput; 3873ed29b0b4SJens Axboe 3874ed29b0b4SJens Axboe ctx = f.file->private_data; 3875ed29b0b4SJens Axboe 3876ed29b0b4SJens Axboe io_run_task_work(); 3877ed29b0b4SJens Axboe 3878ed29b0b4SJens Axboe mutex_lock(&ctx->uring_lock); 3879ed29b0b4SJens Axboe ret = __io_uring_register(ctx, opcode, arg, nr_args); 3880ed29b0b4SJens Axboe mutex_unlock(&ctx->uring_lock); 3881ed29b0b4SJens Axboe trace_io_uring_register(ctx, opcode, ctx->nr_user_files, ctx->nr_user_bufs, ret); 3882ed29b0b4SJens Axboe out_fput: 3883ed29b0b4SJens Axboe fdput(f); 3884ed29b0b4SJens Axboe return ret; 3885ed29b0b4SJens Axboe } 3886ed29b0b4SJens Axboe 3887ed29b0b4SJens Axboe static int __init io_uring_init(void) 3888ed29b0b4SJens Axboe { 38899c71d39aSStefan Metzmacher #define __BUILD_BUG_VERIFY_OFFSET_SIZE(stype, eoffset, esize, ename) do { \ 3890ed29b0b4SJens Axboe BUILD_BUG_ON(offsetof(stype, ename) != eoffset); \ 38919c71d39aSStefan Metzmacher BUILD_BUG_ON(sizeof_field(stype, ename) != esize); \ 3892ed29b0b4SJens Axboe } while (0) 3893ed29b0b4SJens Axboe 3894ed29b0b4SJens Axboe #define BUILD_BUG_SQE_ELEM(eoffset, etype, ename) \ 38959c71d39aSStefan Metzmacher __BUILD_BUG_VERIFY_OFFSET_SIZE(struct io_uring_sqe, eoffset, sizeof(etype), ename) 38969c71d39aSStefan Metzmacher #define BUILD_BUG_SQE_ELEM_SIZE(eoffset, esize, ename) \ 38979c71d39aSStefan Metzmacher __BUILD_BUG_VERIFY_OFFSET_SIZE(struct io_uring_sqe, eoffset, esize, ename) 3898ed29b0b4SJens Axboe BUILD_BUG_ON(sizeof(struct io_uring_sqe) != 64); 3899ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(0, __u8, opcode); 3900ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(1, __u8, flags); 3901ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(2, __u16, ioprio); 3902ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(4, __s32, fd); 3903ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(8, __u64, off); 3904ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(8, __u64, addr2); 39059c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(8, __u32, cmd_op); 39069c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(12, __u32, __pad1); 3907ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(16, __u64, addr); 3908ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(16, __u64, splice_off_in); 3909ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(24, __u32, len); 3910ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __kernel_rwf_t, rw_flags); 3911ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, /* compat */ int, rw_flags); 3912ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, /* compat */ __u32, rw_flags); 3913ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, fsync_flags); 3914ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, /* compat */ __u16, poll_events); 3915ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, poll32_events); 3916ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, sync_range_flags); 3917ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, msg_flags); 3918ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, timeout_flags); 3919ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, accept_flags); 3920ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, cancel_flags); 3921ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, open_flags); 3922ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, statx_flags); 3923ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, fadvise_advice); 3924ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(28, __u32, splice_flags); 39259c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(28, __u32, rename_flags); 39269c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(28, __u32, unlink_flags); 39279c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(28, __u32, hardlink_flags); 39289c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(28, __u32, xattr_flags); 39299c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(28, __u32, msg_ring_flags); 3930ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(32, __u64, user_data); 3931ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(40, __u16, buf_index); 3932ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(40, __u16, buf_group); 3933ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(42, __u16, personality); 3934ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(44, __s32, splice_fd_in); 3935ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(44, __u32, file_index); 39369c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(44, __u16, notification_idx); 39379c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(46, __u16, addr_len); 3938ed29b0b4SJens Axboe BUILD_BUG_SQE_ELEM(48, __u64, addr3); 39399c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM_SIZE(48, 0, cmd); 39409c71d39aSStefan Metzmacher BUILD_BUG_SQE_ELEM(56, __u64, __pad2); 3941ed29b0b4SJens Axboe 3942ed29b0b4SJens Axboe BUILD_BUG_ON(sizeof(struct io_uring_files_update) != 3943ed29b0b4SJens Axboe sizeof(struct io_uring_rsrc_update)); 3944ed29b0b4SJens Axboe BUILD_BUG_ON(sizeof(struct io_uring_rsrc_update) > 3945ed29b0b4SJens Axboe sizeof(struct io_uring_rsrc_update2)); 3946ed29b0b4SJens Axboe 3947ed29b0b4SJens Axboe /* ->buf_index is u16 */ 3948ed29b0b4SJens Axboe BUILD_BUG_ON(offsetof(struct io_uring_buf_ring, bufs) != 0); 3949ed29b0b4SJens Axboe BUILD_BUG_ON(offsetof(struct io_uring_buf, resv) != 3950ed29b0b4SJens Axboe offsetof(struct io_uring_buf_ring, tail)); 3951ed29b0b4SJens Axboe 3952ed29b0b4SJens Axboe /* should fit into one byte */ 3953ed29b0b4SJens Axboe BUILD_BUG_ON(SQE_VALID_FLAGS >= (1 << 8)); 3954ed29b0b4SJens Axboe BUILD_BUG_ON(SQE_COMMON_FLAGS >= (1 << 8)); 3955ed29b0b4SJens Axboe BUILD_BUG_ON((SQE_VALID_FLAGS | SQE_COMMON_FLAGS) != SQE_VALID_FLAGS); 3956ed29b0b4SJens Axboe 3957ed29b0b4SJens Axboe BUILD_BUG_ON(__REQ_F_LAST_BIT > 8 * sizeof(int)); 3958ed29b0b4SJens Axboe 3959ed29b0b4SJens Axboe BUILD_BUG_ON(sizeof(atomic_t) != sizeof(u32)); 3960ed29b0b4SJens Axboe 3961d9b57aa3SJens Axboe io_uring_optable_init(); 3962ed29b0b4SJens Axboe 3963ed29b0b4SJens Axboe req_cachep = KMEM_CACHE(io_kiocb, SLAB_HWCACHE_ALIGN | SLAB_PANIC | 3964ed29b0b4SJens Axboe SLAB_ACCOUNT); 3965ed29b0b4SJens Axboe return 0; 3966ed29b0b4SJens Axboe }; 3967ed29b0b4SJens Axboe __initcall(io_uring_init); 3968