Re: [PATCH v1 03/11] io_uring/kbuf: add support for kernel-managed buffer rings

[Pavel Begunkov <asml.silence@gmail.com>]

On 2/18/26 21:43, Joanne Koong wrote:
> On Wed, Feb 18, 2026 at 4:36 AM Pavel Begunkov <asml.silence@gmail.com> wrote:
>>
>> On 2/13/26 22:04, Joanne Koong wrote:
>>> On Fri, Feb 13, 2026 at 4:41 AM Pavel Begunkov <asml.silence@gmail.com> wrote:
>> ...
>>>> Fuse is doing both adding (kernel) buffers to the ring and consuming
>>>> them. At which point it's not clear:
>>>>
>>>> 1. Why it even needs io_uring provided buffer rings, it can be all
>>>>       contained in fuse. Maybe it's trying to reuse pbuf ring code as
>>>>       basically an internal memory allocator, but then why expose buffer
>>>>       rings as an io_uring uapi instead of keeping it internally.
>>>>
>>>>       That's also why I mentioned whether those buffers are supposed to
>>>>       be used with other types of io_uring requests like recv, etc.
>>>
>>> On the userspace/server side, it uses the buffers for other io-uring
>>> operations (eg reading or writing the contents from/to a
>>> locally-backed file).
>>
> 
> Sorry, I submitted v2 last night thinking the conversation on this
> thread had died. After reading through your reply, I'll modify v2.

No worries at all, and sorry I'm a bit slow to reply

>> Oops, typo. I was asking whether the buffer rings (not buffers) are
>> supposed to be used with other requests. E.g. submitting a
>> IORING_OP_RECV with IOSQE_BUFFER_SELECT set and the bgid specifying
>> your kernel-managed buffer ring.
> 
> Yes the buffer rings are intended to be used with other io-uring
> requests. The ideal scenario is that the user can then do the
> equivalent of IORING_OP_READ/WRITE_FIXED operations on the
> kernel-managed buffers and avoid the per-i/o page pinning overhead
> costs.

You mention OP_READ_FIXED and below agreed not exposing km rings
an io_uring uapi, which makes me believe we're still talking about
different things.

Correct me if I'm wrong. Currently, only fuse cmds use the buffer
ring itself, I'm not talking about buffer, i.e. fuse cmds consume
entries from the ring (!!! that's the part I'm interested in), then
process them and tell the server "this offset in the region has user
data to process or should be populated with data".

Naturally, the server should be able to use the buffers to issue
some I/O and process it in other ways, whether it's a normal
OP_READ to which you pass the user space address (you can since
it's mmap()'ed by the server) or something else is important but
a separate question than the one I'm trying to understand.

So I'm asking whether you expect that a server or other user space
program should be able to issue a READ_OP_RECV, READ_OP_READ or any
other similar request, which would consume buffers/entries from the
km ring without any fuse kernel code involved? Do you have some
use case for that in mind?

Understanding that is the key in deciding whether km rings should
be exposed as io_uring uapi or not, regardless of where buffers
to populate the ring come from.

...
> With it going through a mem region, I don't think it should even go
> through the "pbuf ring" interface then if it's not going to specify
> the number of entries and buffer sizes upfront, if support is added
> for io-uring normal requests (eg IORING_OP_READ/WRITE) to use the
> backing pages from a memory region and if we're able to guarantee that
> the registered memory region will never be able to be unregistered by
> the user. I think if we repurpose the
> 
> union {
>    __u64 addr; /* pointer to buffer or iovecs */
>    __u64 splice_off_in;
> };
> 
> fields in the struct io_uring_sqe to
> 
> union {
>    __u64 addr; /* pointer to buffer or iovecs */
>    __u64 splice_off_in;
>    __u64 offset; /* offset into registered mem region */
> };
> 
> and add some IOSQE_ flag to indicate it should find the pages from the
> registered mem region, then that should work for normal requests.
> Where on the kernel side, it looks up the associated pages stored in
> the io_mapped_region's pages array for the offset passed in.

So you already can do all that using the mmap()'ed region user
pointer, and you just want it to be more efficient, right?
For that let's just reuse registered buffers, we don't need a
new mechanism that needs to be propagated to all request types.
And registered buffer are already optimised for I/O in a bunch
of ways. And as a bonus, it'll be similar to the zero-copy
internally registered buffers if you still plan to add them.

The simplest way to do that is to create a registered buffer out
of the mmap'ed region pointer. Pseudo code:

// mmap'ed if it's kernel allocated.
{region_ptr, region_size} = create_region();

struct iovec iov;
iov.iov_base = region_ptr;
iov.iov_len = region_size;
io_uring_register_buffers(ring, &iov, 1);

// later instead of this:
ptr = region_ptr + off;
io_uring_prep_read(sqe, fd, ptr, ...);

// you use registered buffers as usual:
io_uring_prep_read_fixed(sqe, fd, off, regbuf_idx, ...);


IIRC the registration would fail because it doesn't allow file
backed pages, but it should be fine if we know it's io_uring
region memory, so that would need to be patched.

There might be a bunch of other ways you can do that like
create a kernel allocated registered buffer like what Cristoph
wants, and then register it as a region. Or allow creating
registered buffers out of a region. etc.

I wanted to unify registered buffers and regions internally
at some point, but then drifted away from active io_uring core
infrastructure development, so I guess that could've been useful.

> Right now there's only a uapi to register a memory region and none to
> unregister one. Is it guaranteed that io-uring will never add
> something in the future that will let userspace unregister the memory
> region or at least unregister it while it's being used (eg if we add
> future refcounting to it to track active uses of it)?

Let's talk about it when it's needed or something changes, but if
you do registered buffers instead as per above, they'll be holding
page references and or have to pin the region in some other way.

> If so, then end-to-end, with it going through the mem region, it would
> be something like:
> * user creates a mem region for the io-uring
> * user mmaps the mem region

FWIW, we should just add a liburing helper, so that fuse server
doesn't need to deal with mmap'ing.

> * user passes in offset into region, length of each buffer, and number
> of entries in the ring to the subsystem
> * subsystem creates a locally managed bufring and adds buffers to that
> ring from the mem region

That's sounds clean to me _if_ it allows you to achieve all
(fast path) optimisations you want to have. I hope it does?

-- 
Pavel Begunkov