[GIT PULL] io_uring changes for 6.18-rc1

[Jens Axboe <axboe@kernel.dk>]

Hi Linus,

Here are the io_uring changes slated for the 6.18 merge window. Not
sending early as per usual due to travel and other things. This pull
request contains:

- Series storing ring provided buffers locally for the users, rather
  than stuff them into struct io_kiocb. These types of buffers must
  always be fully consumed or recycled in the current context, and
  leaving them in struct io_kiocb is hence not a good ideas as that
  struct has a vastly different life time. Basically just an
  architecture cleanup, that can help prevent issues with ring provided
  buffers in the future.

- Support for mixed CQE sizes in the same ring. Before this change, a CQ
  ring either used the default 16b CQEs, or it was setup with 32b CQE
  using IORING_SETUP_CQE32. For use cases where a few 32b CQEs were
  needed, this caused everything else to use big CQEs. This is wasteful
  both in terms of memory usage, but also memory bandwidth for the
  posted CQEs. With IORING_SETUP_CQE_MIXED, applications may use request
  types that post both normal 16b and big 32b CQEs on the same ring.

- Add helpers for async data management, to make it harder for opcode
  handlers to mess it up.

- Add support for multishot for uring_cmd, which ublk can use. This
  helps improve efficiency, by providing a persistent request type that
  can trigger multiple CQEs.

- Add initial support for ring feature querying. We had basic support
  for probe operations, but the API isn't great. Rather than expand
  that, add support for QUERY which is easily expandable and can cover a
  lot more cases than the existing probe support. This will help
  applications get a better idea of what operations are supported on a
  given host.

- zcrx improvements from Pavel
	- Improve refill entry alignment for better caching
	- Various cleanups, especially around deduplicating normal
	  memory vs dmabuf setup.
	- Generalisation of the niov size (Patch 12). It's still hard
	  coded to PAGE_SIZE on init, but will let the user to specify
	  the rx buffer length on setup.
	- Syscall / synchronous bufer return. It'll be used as a slow
	  fallback path for returning buffers when the refill queue is
	  full. Useful for tolerating slight queue size misconfiguration
	  or with inconsistent load.
	- Accounting more memory to cgroups.
	- Additional independent cleanups that will also be useful for
	  mutli-area support.

- Various fixes and cleanups

Note that this will throw a trivial conflict in io_uring/kbuf.c, where
the resolution is just to get rid of the void __user *ret argument as it
got killed by the io_br_sel provided ring buffer localization changes.

Please pull!


The following changes since commit 1b237f190eb3d36f52dffe07a40b5eb210280e00:

  Linux 6.17-rc3 (2025-08-24 12:04:12 -0400)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git tags/for-6.18/io_uring-20250929

for you to fetch changes up to ef9f603fd3d4b7937f2cdbce40e47df0a54b2a55:

  io_uring/cmd: drop unused res2 param from io_uring_cmd_done() (2025-09-23 00:15:02 -0600)

----------------------------------------------------------------
for-6.18/io_uring-20250929

----------------------------------------------------------------
Caleb Sander Mateos (10):
      io_uring/cmd: deduplicate uring_cmd_flags checks
      io_uring/cmd: consolidate REQ_F_BUFFER_SELECT checks
      io_uring/register: drop redundant submitter_task check
      io_uring/uring_cmd: add io_uring_cmd_tw_t type alias
      io_uring/uring_cmd: correct io_uring_cmd_done() ret type
      io_uring/cmd: remove unused io_uring_cmd_iopoll_done()
      io_uring: remove WRITE_ONCE() in io_uring_create()
      io_uring: don't include filetable.h in io_uring.h
      io_uring/rsrc: respect submitter_task in io_register_clone_buffers()
      io_uring/cmd: drop unused res2 param from io_uring_cmd_done()

Jens Axboe (25):
      io_uring/kbuf: drop 'issue_flags' from io_put_kbuf(s)() arguments
      io_uring/net: don't use io_net_kbuf_recyle() for non-provided cases
      io_uring/net: clarify io_recv_buf_select() return value
      io_uring/kbuf: pass in struct io_buffer_list to commit/recycle helpers
      io_uring/kbuf: introduce struct io_br_sel
      io_uring/rw: recycle buffers manually for non-mshot reads
      io_uring/kbuf: use struct io_br_sel for multiple buffers picking
      io_uring/net: use struct io_br_sel->val as the recv finish value
      io_uring/net: use struct io_br_sel->val as the send finish value
      io_uring/kbuf: switch to storing struct io_buffer_list locally
      io_uring: remove async/poll related provided buffer recycles
      io_uring/kbuf: check for ring provided buffers first in recycling
      io_uring: remove io_ctx_cqe32() helper
      io_uring: add UAPI definitions for mixed CQE postings
      io_uring/fdinfo: handle mixed sized CQEs
      io_uring/trace: support completion tracing of mixed 32b CQEs
      io_uring: add support for IORING_SETUP_CQE_MIXED
      io_uring/nop: add support for IORING_SETUP_CQE_MIXED
      io_uring/uring_cmd: add support for IORING_SETUP_CQE_MIXED
      io_uring/zcrx: add support for IORING_SETUP_CQE_MIXED
      io_uring: add async data clear/free helpers
      io_uring/net: correct type for min_not_zero() cast
      io_uring/uring_cmd: fix __io_uring_cmd_do_in_task !CONFIG_IO_URING typo
      io_uring: correct size of overflow CQE calculation
      io_uring/uring_cmd: correct signature for io_uring_mshot_cmd_post_cqe()

Keith Busch (1):
      io_uring: fix nvme's 32b cqes on mixed cq

Marco Crivellari (2):
      io_uring: replace use of system_wq with system_percpu_wq
      io_uring: replace use of system_unbound_wq with system_dfl_wq

Ming Lei (2):
      io-uring: move `struct io_br_sel` into io_uring_types.h
      io_uring: uring_cmd: add multishot support

Pavel Begunkov (27):
      io_uring: add request poisoning
      io_uring/zctx: check chained notif contexts
      io_uring: add helper for *REGISTER_SEND_MSG_RING
      io_uring: add macros for avaliable flags
      io_uring: introduce io_uring querying
      io_uring/zcrx: improve rqe cache alignment
      io_uring/zcrx: replace memchar_inv with is_zero
      io_uring/zcrx: use page_pool_unref_and_test()
      io_uring/zcrx: remove extra io_zcrx_drop_netdev
      io_uring/zcrx: don't pass slot to io_zcrx_create_area
      io_uring/zcrx: move area reg checks into io_import_area
      io_uring/zcrx: check all niovs filled with dma addresses
      io_uring/zcrx: pass ifq to io_zcrx_alloc_fallback()
      io_uring/zcrx: deduplicate area mapping
      io_uring/zcrx: remove dmabuf_offset
      io_uring/zcrx: set sgt for umem area
      io_uring/zcrx: make niov size variable
      io_uring/zcrx: rename dma lock
      io_uring/zcrx: protect netdev with pp_lock
      io_uring/zcrx: reduce netmem scope in refill
      io_uring/zcrx: use guards for the refill lock
      io_uring/zcrx: don't adjust free cache space
      io_uring/zcrx: introduce io_parse_rqe()
      io_uring/zcrx: allow synchronous buffer return
      io_uring/zcrx: account niov arrays to cgroup
      io_uring/query: prevent infinite loops
      io_uring/query: cap number of queries

Thorsten Blum (1):
      io_uring: Replace kzalloc() + copy_from_user() with memdup_user()

 Documentation/networking/iou-zcrx.rst |   2 +-
 block/ioctl.c                         |   2 +-
 drivers/block/ublk_drv.c              |   6 +-
 drivers/nvme/host/ioctl.c             |   2 +-
 fs/btrfs/ioctl.c                      |   2 +-
 fs/fuse/dev_uring.c                   |   8 +-
 include/linux/io_uring/cmd.h          |  69 +++++---
 include/linux/io_uring_types.h        |  31 ++--
 include/linux/poison.h                |   3 +
 include/trace/events/io_uring.h       |   4 +-
 include/uapi/linux/io_uring.h         |  38 ++++-
 include/uapi/linux/io_uring/query.h   |  41 +++++
 io_uring/Makefile                     |   2 +-
 io_uring/cancel.c                     |   1 +
 io_uring/cmd_net.c                    |   3 +-
 io_uring/fdinfo.c                     |  24 +--
 io_uring/futex.c                      |  13 +-
 io_uring/io_uring.c                   | 145 +++++++++++------
 io_uring/io_uring.h                   | 120 ++++++++++++--
 io_uring/kbuf.c                       |  67 ++++----
 io_uring/kbuf.h                       |  39 +++--
 io_uring/net.c                        | 160 +++++++++---------
 io_uring/nop.c                        |  17 +-
 io_uring/notif.c                      |   5 +
 io_uring/opdef.c                      |   1 +
 io_uring/openclose.c                  |   1 +
 io_uring/poll.c                       |   4 -
 io_uring/query.c                      | 101 ++++++++++++
 io_uring/query.h                      |   9 ++
 io_uring/register.c                   |  60 ++++---
 io_uring/rsrc.c                       |   8 +
 io_uring/rw.c                         |  63 ++++----
 io_uring/splice.c                     |   1 +
 io_uring/uring_cmd.c                  |  83 ++++++++--
 io_uring/waitid.c                     |   4 +-
 io_uring/zcrx.c                       | 295 ++++++++++++++++++++++------------
 io_uring/zcrx.h                       |  19 ++-
 37 files changed, 1001 insertions(+), 452 deletions(-)
 create mode 100644 include/uapi/linux/io_uring/query.h
 create mode 100644 io_uring/query.c
 create mode 100644 io_uring/query.h

-- 
Jens Axboe