Re: [PATCH v1 03/11] io_uring/kbuf: add support for kernel-managed buffer rings

[Joanne Koong <joannelkoong@gmail.com>]

On Mon, Feb 23, 2026 at 12:00 PM Pavel Begunkov <asml.silence@gmail.com> wrote:
>
> On 2/21/26 02:14, Joanne Koong wrote:
> > On Fri, Feb 20, 2026 at 4:53 AM Pavel Begunkov <asml.silence@gmail.com> wrote:
> ...
> >> So I'm asking whether you expect that a server or other user space
> >> program should be able to issue a READ_OP_RECV, READ_OP_READ or any
> >> other similar request, which would consume buffers/entries from the
> >> km ring without any fuse kernel code involved? Do you have some
> >> use case for that in mind?
> >
> > Thanks for clarifying your question. Yes, this would be a useful
> > optimization in the future for fuse servers with certain workload
> > characteristics (eg network-backed servers with high concurrency and
> > unpredictable latencies). I don't think the concept of kmbufrings is
> > exclusively fuse-specific though (for example, Christoph's use case
> > being a recent instance);
>
> Sorry, I don't see relevance b/w km rings and what Christoph wants.
> I explained why in some sub-thread, but maybe someone can tell
> what I'm missing.
>
> > I think other subsystems/users that'll use
> > kmbuf rings would also generically find it useful to have the option
> > of READ_OP_RECV/READ_OP_READ operating directly on the ring.
>
> Yep, it could be, potentially, it's just the patchset doesn't plumb
> it to other requests and uses it within fuse. It's just cases like

This patchset just represents the most basic foundation. The
optimization patches (eg incremental buffer consumption, plumbing it
to other io-uring requests, etc) were to be follow-up patchsets that
would be on top of this.

> that always make me wonder, here it was why what is basically an
> internal kernel fuse API is exposed as an io_uring uapi. Maybe there

It's not really an internal kernel fuse API. There's nothing
fuse-specific about it - the infrastructure that's added is the
infrastructure for a generic buffer ring.

The memory that backs the buffers for the buf ring needs to be
io-uring specific. io-uring already has all the infrastructure for
buffer rings. So I'm not really fully understanding why it's better in
this case to just have the fuse kernel code re-implement all the logic
for a buffer ring and go through these layers of indirection to use
registered buffers, instead of just leveraging what's already in
io-uring.

> was a discussion about it I missed?
>
> >> So you already can do all that using the mmap()'ed region user
> >> pointer, and you just want it to be more efficient, right?
> >> For that let's just reuse registered buffers, we don't need a
> >> new mechanism that needs to be propagated to all request types.
> >> And registered buffer are already optimised for I/O in a bunch
> >> of ways. And as a bonus, it'll be similar to the zero-copy
> >> internally registered buffers if you still plan to add them.
> >>
> >> The simplest way to do that is to create a registered buffer out
> >> of the mmap'ed region pointer. Pseudo code:
> >>
> >> // mmap'ed if it's kernel allocated.
> >> {region_ptr, region_size} = create_region();
> >>
> >> struct iovec iov;
> >> iov.iov_base = region_ptr;
> >> iov.iov_len = region_size;
> >> io_uring_register_buffers(ring, &iov, 1);
> >>
> >> // later instead of this:
> >> ptr = region_ptr + off;
> >> io_uring_prep_read(sqe, fd, ptr, ...);
> >>
> >> // you use registered buffers as usual:
> >> io_uring_prep_read_fixed(sqe, fd, off, regbuf_idx, ...);
> >>
> >
> > I feel like this design makes the interface more convoluted and now
> > muddies different concepts together by adding new complexity /
> > relationships between them whereas they were otherwise cleanly
> > isolated. Maybe I'm just not seeing/understanding the overarching
> > vision for why conceptually it makes sense for them to be tied
> > together besides as a mechanism to tell io-uring requests where to
> > copy from by reusing what exists for fixed buffer ids. There's more
> > complexity now on the kernel side (eg having to detect if the buffer
> > passed in is kernel-allocated to know whether to pin the pages /
> > charge it against the user's RLIMIT_MEMLOCK limit) but I'm not
> > understanding what we gain from it.
>
> That would avoid doing a large revamp of uapi and plumbing it
> to each every request type when there is already a uapi that does
> what you want, does it well and have lots of things figured out.
> Keeping the I/O path sane is important, io_uring already has 3
> different ways of passing buffers, let's not add a 4th one
> unless it achieves something meaningful.
>
> > I got the sense from your previous
> > comments that memory regions are the de facto way to go and should be
>
> Sorry, maybe I wasn't clear. With what I see you're trying to do,
> i.e. copying client's data into user space (server), I think
> registered buffers would be a better abstraction. However, I just
> went with your design on top of regions, since it's not the first
> iteration of the series and I wasn't following previous ones, and
> IIRC you was already using registered buffers in previous revisions
> but moved from that for some reason. IOW, I was taking you main I/O
> path and was trying to make the setup path a bit more flexible and
> reusable.
>
> > decoupled from other structures, so if that's the case, why doesn't it
> > make sense for io-uring to add native support for using memory regions
> > for io-uring requests? I feel like from the userspace side it makes
> > things more confusing with this extra layer of indirection that now
> > has to go through a fixed buffer.
>
> There is a high bar for adding a new interface for passing buffers
> that needs to be propagated to a good number of request handlers,
> and there is already one that gives you all you need to write
> efficient user space.
>
> >> IIRC the registration would fail because it doesn't allow file
> >> backed pages, but it should be fine if we know it's io_uring
> >> region memory, so that would need to be patched.
> >>
> >> There might be a bunch of other ways you can do that like
> >> create a kernel allocated registered buffer like what Cristoph
> >> wants, and then register it as a region. Or allow creating
> >> registered buffers out of a region. etc.
> >>
> >> I wanted to unify registered buffers and regions internally
> >> at some point, but then drifted away from active io_uring core
> >> infrastructure development, so I guess that could've been useful.
> >>
> >>> Right now there's only a uapi to register a memory region and none to
> >>> unregister one. Is it guaranteed that io-uring will never add
> >>> something in the future that will let userspace unregister the memory
> >>> region or at least unregister it while it's being used (eg if we add
> >>> future refcounting to it to track active uses of it)?
> >>
> >> Let's talk about it when it's needed or something changes, but if
> >> you do registered buffers instead as per above, they'll be holding
> >> page references and or have to pin the region in some other way.
> >
> > I don't think we can guarantee that the caller will register the
> > memory region as a fixed buffer (eg if it doesn't need/want to use the
> > buffer for normal io-uring requests). On the kernel side, the internal
>
> It's up to the user (i.e. fuse server) to either use OP_READ/etc. using
> user addresses that you have in your design from mmap()ing regions, or
> registering it and using OP_READ_FIXED.

Yes but I don't think this solves the concern of userspace being able
to unregister the memory region at any time (eg while not doing
io-uring requests) while the kernel still points to those addresses
for the backing buffers of the bufring, since there's no callback that
gets triggered in the subsystem when a memory region is unregistered,
which means there will need to be extra per I/O overhead for having to
ensure the memory region is still valid. Though since there's no uapi
for unregistering a memory region this is not a concern, unless this
is planned to be added in the future.

Thanks,
Joanne

>
> > buffer entry uses the kaddr of the registered memory region buffer for
> > any memcpys. If it's not guaranteed that registered memory regions
> > persist for the lifetime of the ring, there'll have to be extra
> > overhead for every I/O (eg grab the io-uring lock, checking if the mem
> > region is still registered, grab a refcount to that mem region, unlock
> > the ring, do the memcpy to the kaddr, then grab the io-uring lock
> > again, decrement the refcount, and unlock). Or I guess we could add
> > pinning to a registered memory region.
>
>
>
> --
> Pavel Begunkov
>