[RFC v1 3/3] io_uring: introduce io_uring querying

[Pavel Begunkov <asml.silence@gmail.com>]

There are many characteristics of a ring or the io_uring subsystem the
user wants to query. Sometimes it's needed to be done before there is a
created ring, and sometimes it's needed at runtime in a slow path.
Introduce a querying interface to achieve that.

It was written with several requirements in mind:
- Can be used with or without an io_uring instance.
- Can query multiple attributes in one syscall.
- Backward and forward compatible.
- Should be reasobably easy to use.
- Reduce the kernel code size for introducing new query types.

API: it's implemented as a new registration op IORING_REGISTER_QUERY.
The user passes one or more query strutctures, each represented by
struct io_uring_query_hdr. The header stores common control fields for
query processing and expected to be wrapped into a larger structure
that has opcode specific fields.

The header contains
- The query opcode
- The result field, which on return contains the error code for the query
- The size of the query structure. The kernel will only populate up to
  the size, which helps with backward compatibility. The kernel can also
  reduce the size, so if the current kernel is older than the inteface
  the user tries to use, it'll get only the supported bits.
- next_entry field is used to chain multiple queries.

The patch adds a single query type for now, i.e. IO_URING_QUERY_OPCODES,
which tells what register / request / etc. opcodes are supported, but
there are particular plans to extend it.

Note: there is a request probing interface via IORING_REGISTER_PROBE,
but it's a mess. It requires the user to create a ring first, it only
works for requests, and requires dynamic allocations.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 include/uapi/linux/io_uring.h       |  3 ++
 include/uapi/linux/io_uring/query.h | 40 ++++++++++++++
 io_uring/Makefile                   |  2 +-
 io_uring/query.c                    | 84 +++++++++++++++++++++++++++++
 io_uring/query.h                    |  9 ++++
 io_uring/register.c                 |  6 +++
 6 files changed, 143 insertions(+), 1 deletion(-)
 create mode 100644 include/uapi/linux/io_uring/query.h
 create mode 100644 io_uring/query.c
 create mode 100644 io_uring/query.h

diff --git a/include/uapi/linux/io_uring.h b/include/uapi/linux/io_uring.h
index 6957dc539d83..7a06da49e2cd 100644
--- a/include/uapi/linux/io_uring.h
+++ b/include/uapi/linux/io_uring.h
@@ -665,6 +665,9 @@ enum io_uring_register_op {
 
 	IORING_REGISTER_MEM_REGION		= 34,
 
+	/* query various aspects of io_uring, see linux/io_uring/query.h */
+	IORING_REGISTER_QUERY			= 35,
+
 	/* this goes last */
 	IORING_REGISTER_LAST,
 
diff --git a/include/uapi/linux/io_uring/query.h b/include/uapi/linux/io_uring/query.h
new file mode 100644
index 000000000000..ca58e88095ed
--- /dev/null
+++ b/include/uapi/linux/io_uring/query.h
@@ -0,0 +1,40 @@
+/* SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note) OR MIT */
+/*
+ * Header file for the io_uring query interface.
+ *
+ * Copyright (C) 2025 Pavel Begunkov
+ */
+#ifndef LINUX_IO_URING_QUERY_H
+#define LINUX_IO_URING_QUERY_H
+
+#include <linux/types.h>
+
+struct io_uring_query_hdr {
+	__u64 next_entry;
+	__u32 query_op;
+	__u32 size;
+	__s32 result;
+	__u32 __resv[3];
+};
+
+enum {
+	IO_URING_QUERY_OPCODES			= 0,
+
+	__IO_URING_QUERY_MAX,
+};
+
+/* Doesn't require a ring */
+struct io_uring_query_opcode {
+	struct io_uring_query_hdr hdr;
+
+	/* The number of supported IORING_OP_* opcodes */
+	__u32	nr_request_opcodes;
+	/* The number of supported IORING_[UN]REGISTER_* opcodes */
+	__u32	nr_register_opcodes;
+	/* Bitmask of all supported IORING_FEAT_* flags */
+	__u64	features;
+	/* Bitmask of all supported IORING_SETUP_* flags */
+	__u64	ring_flags;
+};
+
+#endif
diff --git a/io_uring/Makefile b/io_uring/Makefile
index b3f1bd492804..bc4e4a3fa0a5 100644
--- a/io_uring/Makefile
+++ b/io_uring/Makefile
@@ -13,7 +13,7 @@ obj-$(CONFIG_IO_URING)		+= io_uring.o opdef.o kbuf.o rsrc.o notif.o \
 					sync.o msg_ring.o advise.o openclose.o \
 					statx.o timeout.o cancel.o \
 					waitid.o register.o truncate.o \
-					memmap.o alloc_cache.o
+					memmap.o alloc_cache.o query.o
 obj-$(CONFIG_IO_URING_ZCRX)	+= zcrx.o
 obj-$(CONFIG_IO_WQ)		+= io-wq.o
 obj-$(CONFIG_FUTEX)		+= futex.o
diff --git a/io_uring/query.c b/io_uring/query.c
new file mode 100644
index 000000000000..0ae9192f5a57
--- /dev/null
+++ b/io_uring/query.c
@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include "linux/io_uring/query.h"
+
+#include "query.h"
+#include "io_uring.h"
+
+#define IO_MAX_QUERY_SIZE		512
+
+static int io_query_ops(void *buffer)
+{
+	struct io_uring_query_opcode *e = buffer;
+
+	BUILD_BUG_ON(sizeof(struct io_uring_query_opcode) > IO_MAX_QUERY_SIZE);
+
+	e->hdr.size = min(e->hdr.size, sizeof(*e));
+	e->nr_request_opcodes = IORING_OP_LAST;
+	e->nr_register_opcodes = IORING_REGISTER_LAST;
+	e->features = IORING_FEATURES;
+	e->ring_flags = IORING_VALID_SETUP_FLAGS;
+	return 0;
+}
+
+static int io_handle_query_entry(struct io_ring_ctx *ctx,
+				 void *buffer,
+				 void __user *uentry, u64 *next_entry)
+{
+	struct io_uring_query_hdr *hdr = buffer;
+	size_t entry_size = sizeof(*hdr);
+	int ret = -EINVAL;
+
+	if (copy_from_user(hdr, uentry, sizeof(*hdr)) ||
+	    hdr->size <= sizeof(*hdr))
+		return -EFAULT;
+
+	if (hdr->query_op >= __IO_URING_QUERY_MAX) {
+		ret = -EOPNOTSUPP;
+		goto out;
+	}
+	if (!mem_is_zero(hdr->__resv, sizeof(hdr->__resv)) || hdr->result)
+		goto out;
+
+	hdr->size = min(hdr->size, IO_MAX_QUERY_SIZE);
+	if (copy_from_user(buffer + sizeof(*hdr), uentry + sizeof(*hdr),
+			   hdr->size - sizeof(*hdr)))
+		return -EFAULT;
+
+	switch (hdr->query_op) {
+	case IO_URING_QUERY_OPCODES:
+		ret = io_query_ops(buffer);
+		break;
+	}
+	if (!ret)
+		entry_size = hdr->size;
+out:
+	hdr->result = ret;
+	hdr->size = entry_size;
+	if (copy_to_user(uentry, buffer, entry_size))
+		return -EFAULT;
+	*next_entry = hdr->next_entry;
+	return 0;
+}
+
+int io_query(struct io_ring_ctx *ctx, void __user *arg, unsigned nr_args)
+{
+	char entry_buffer[IO_MAX_QUERY_SIZE];
+	void __user *uentry = arg;
+	int ret;
+
+	memset(entry_buffer, 0, sizeof(entry_buffer));
+
+	if (nr_args)
+		return -EINVAL;
+
+	while (uentry) {
+		u64 next;
+
+		ret = io_handle_query_entry(ctx, entry_buffer, uentry, &next);
+		if (ret)
+			return ret;
+		uentry = u64_to_user_ptr(next);
+	}
+	return 0;
+}
diff --git a/io_uring/query.h b/io_uring/query.h
new file mode 100644
index 000000000000..171d47ccaaba
--- /dev/null
+++ b/io_uring/query.h
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0
+#ifndef IORING_QUERY_H
+#define IORING_QUERY_H
+
+#include <linux/io_uring_types.h>
+
+int io_query(struct io_ring_ctx *ctx, void __user *arg, unsigned nr_args);
+
+#endif
diff --git a/io_uring/register.c b/io_uring/register.c
index 046dcb7ba4d1..6777bfe616ea 100644
--- a/io_uring/register.c
+++ b/io_uring/register.c
@@ -31,6 +31,7 @@
 #include "msg_ring.h"
 #include "memmap.h"
 #include "zcrx.h"
+#include "query.h"
 
 #define IORING_MAX_RESTRICTIONS	(IORING_RESTRICTION_LAST + \
 				 IORING_REGISTER_LAST + IORING_OP_LAST)
@@ -835,6 +836,9 @@ static int __io_uring_register(struct io_ring_ctx *ctx, unsigned opcode,
 			break;
 		ret = io_register_mem_region(ctx, arg);
 		break;
+	case IORING_REGISTER_QUERY:
+		ret = io_query(ctx, arg, nr_args);
+		break;
 	default:
 		ret = -EINVAL;
 		break;
@@ -904,6 +908,8 @@ static int io_uring_register_blind(unsigned int opcode, void __user *arg,
 	switch (opcode) {
 	case IORING_REGISTER_SEND_MSG_RING:
 		return io_uring_register_send_msg_ring(arg, nr_args);
+	case IORING_REGISTER_QUERY:
+		return io_query(NULL, arg, nr_args);
 	}
 	return -EINVAL;
 }
-- 
2.49.0