projects/linux·blob master · refs

776 lines · 19.3 KiB

1// SPDX-License-Identifier: GPL-2.0
2#include <linux/kernel.h>
3#include <linux/errno.h>
4#include <linux/fs.h>
5#include <linux/file.h>
6#include <linux/mm.h>
7#include <linux/slab.h>
8#include <linux/namei.h>
9#include <linux/poll.h>
10#include <linux/uio.h>
11#include <linux/vmalloc.h>
12#include <linux/io_uring.h>
13
14#include <uapi/linux/io_uring.h>
15
16#include "io_uring.h"
17#include "opdef.h"
18#include "kbuf.h"
19#include "memmap.h"
20
21/* BIDs are addressed by a 16-bit field in a CQE */
22#define MAX_BIDS_PER_BGID (1 << 16)
23
24/* Mapped buffer ring, return io_uring_buf from head */
25#define io_ring_head_to_buf(br, head, mask) (&(br)->bufs[(head) & (mask)])
26
27struct io_provide_buf {
28 struct file *file;
29 __u64 addr;
30 __u32 len;
31 __u32 bgid;
32 __u32 nbufs;
33 __u16 bid;
34};
35
36static bool io_kbuf_inc_commit(struct io_buffer_list *bl, int len)
37{
38 /* No data consumed, return false early to avoid consuming the buffer */
39 if (!len)
40 return false;
41
42 while (len) {
43 struct io_uring_buf *buf;
44 u32 buf_len, this_len;
45
46 buf = io_ring_head_to_buf(bl->buf_ring, bl->head, bl->mask);
47 buf_len = READ_ONCE(buf->len);
48 this_len = min_t(u32, len, buf_len);
49 buf_len -= this_len;
50 /* Stop looping for invalid buffer length of 0 */
51 if (buf_len > bl->min_left_sub_one || !this_len) {
52 WRITE_ONCE(buf->addr, READ_ONCE(buf->addr) + this_len);
53 WRITE_ONCE(buf->len, buf_len);
54 return false;
55 }
56 WRITE_ONCE(buf->len, 0);
57 bl->head++;
58 len -= this_len;
59 }
60 return true;
61}
62
63bool io_kbuf_commit(struct io_kiocb *req,
64 struct io_buffer_list *bl, int len, int nr)
65{
66 if (unlikely(!(req->flags & REQ_F_BUFFERS_COMMIT)))
67 return true;
68
69 req->flags &= ~REQ_F_BUFFERS_COMMIT;
70
71 if (unlikely(len < 0))
72 return true;
73 if (bl->flags & IOBL_INC)
74 return io_kbuf_inc_commit(bl, len);
75 bl->head += nr;
76 return true;
77}
78
79static inline struct io_buffer_list *io_buffer_get_list(struct io_ring_ctx *ctx,
80 unsigned int bgid)
81{
82 lockdep_assert_held(&ctx->uring_lock);
83
84 return xa_load(&ctx->io_bl_xa, bgid);
85}
86
87static int io_buffer_add_list(struct io_ring_ctx *ctx,
88 struct io_buffer_list *bl, unsigned int bgid)
89{
90 /*
91 * Store buffer group ID and finally mark the list as visible.
92 * The normal lookup doesn't care about the visibility as we're
93 * always under the ->uring_lock, but lookups from mmap do.
94 */
95 bl->bgid = bgid;
96 guard(mutex)(&ctx->mmap_lock);
97 return xa_err(xa_store(&ctx->io_bl_xa, bgid, bl, GFP_KERNEL));
98}
99
100void io_kbuf_drop_legacy(struct io_kiocb *req)
101{
102 if (WARN_ON_ONCE(!(req->flags & REQ_F_BUFFER_SELECTED)))
103 return;
104 req->flags &= ~REQ_F_BUFFER_SELECTED;
105 kfree(req->kbuf);
106 req->kbuf = NULL;
107}
108
109bool io_kbuf_recycle_legacy(struct io_kiocb *req, unsigned issue_flags)
110{
111 struct io_ring_ctx *ctx = req->ctx;
112 struct io_buffer_list *bl;
113 struct io_buffer *buf;
114
115 io_ring_submit_lock(ctx, issue_flags);
116
117 buf = req->kbuf;
118 bl = io_buffer_get_list(ctx, buf->bgid);
119 /*
120 * If the buffer list was upgraded to a ring-based one, or removed,
121 * while the request was in-flight in io-wq, drop it.
122 */
123 if (bl && !(bl->flags & IOBL_BUF_RING)) {
124 list_add(&buf->list, &bl->buf_list);
125 bl->nbufs++;
126 } else {
127 kfree(buf);
128 }
129 req->flags &= ~REQ_F_BUFFER_SELECTED;
130 req->kbuf = NULL;
131
132 io_ring_submit_unlock(ctx, issue_flags);
133 return true;
134}
135
136static void __user *io_provided_buffer_select(struct io_kiocb *req, size_t *len,
137 struct io_buffer_list *bl)
138{
139 if (!list_empty(&bl->buf_list)) {
140 struct io_buffer *kbuf;
141
142 kbuf = list_first_entry(&bl->buf_list, struct io_buffer, list);
143 list_del(&kbuf->list);
144 bl->nbufs--;
145 if (*len == 0 || *len > kbuf->len)
146 *len = kbuf->len;
147 if (list_empty(&bl->buf_list))
148 req->flags |= REQ_F_BL_EMPTY;
149 req->flags |= REQ_F_BUFFER_SELECTED;
150 req->kbuf = kbuf;
151 req->buf_index = kbuf->bid;
152 return u64_to_user_ptr(kbuf->addr);
153 }
154 return NULL;
155}
156
157static int io_provided_buffers_select(struct io_kiocb *req, size_t *len,
158 struct io_buffer_list *bl,
159 struct iovec *iov)
160{
161 void __user *buf;
162
163 buf = io_provided_buffer_select(req, len, bl);
164 if (unlikely(!buf))
165 return -ENOBUFS;
166
167 iov[0].iov_base = buf;
168 iov[0].iov_len = *len;
169 return 1;
170}
171
172static bool io_should_commit(struct io_kiocb *req, unsigned int issue_flags)
173{
174 /*
175 * If we came in unlocked, we have no choice but to consume the
176 * buffer here, otherwise nothing ensures that the buffer won't
177 * get used by others. This does mean it'll be pinned until the
178 * IO completes, coming in unlocked means we're being called from
179 * io-wq context and there may be further retries in async hybrid
180 * mode. For the locked case, the caller must call commit when
181 * the transfer completes (or if we get -EAGAIN and must poll of
182 * retry).
183 */
184 if (issue_flags & IO_URING_F_UNLOCKED)
185 return true;
186
187 /* uring_cmd commits kbuf upfront, no need to auto-commit */
188 if (!io_file_can_poll(req) && !io_is_uring_cmd(req))
189 return true;
190 return false;
191}
192
193static struct io_br_sel io_ring_buffer_select(struct io_kiocb *req, size_t *len,
194 struct io_buffer_list *bl,
195 unsigned int issue_flags)
196{
197 struct io_uring_buf_ring *br = bl->buf_ring;
198 __u16 tail, head = bl->head;
199 struct io_br_sel sel = { };
200 struct io_uring_buf *buf;
201 u32 buf_len;
202
203 tail = smp_load_acquire(&br->tail);
204 if (unlikely(tail == head))
205 return sel;
206
207 if (head + 1 == tail)
208 req->flags |= REQ_F_BL_EMPTY;
209
210 buf = io_ring_head_to_buf(br, head, bl->mask);
211 buf_len = READ_ONCE(buf->len);
212 if (*len == 0 || *len > buf_len)
213 *len = buf_len;
214 sel.addr = u64_to_user_ptr(READ_ONCE(buf->addr));
215 if (unlikely(!access_ok(sel.addr, *len))) {
216 sel.addr = NULL;
217 return sel;
218 }
219 req->flags |= REQ_F_BUFFER_RING | REQ_F_BUFFERS_COMMIT;
220 req->buf_index = READ_ONCE(buf->bid);
221 sel.buf_list = bl;
222
223 if (io_should_commit(req, issue_flags)) {
224 if (!io_kbuf_commit(req, sel.buf_list, *len, 1))
225 req->flags |= REQ_F_BUF_MORE;
226 sel.buf_list = NULL;
227 }
228 return sel;
229}
230
231struct io_br_sel io_buffer_select(struct io_kiocb *req, size_t *len,
232 unsigned buf_group, unsigned int issue_flags)
233{
234 struct io_ring_ctx *ctx = req->ctx;
235 struct io_br_sel sel = { };
236 struct io_buffer_list *bl;
237
238 io_ring_submit_lock(ctx, issue_flags);
239
240 bl = io_buffer_get_list(ctx, buf_group);
241 if (likely(bl)) {
242 if (bl->flags & IOBL_BUF_RING)
243 sel = io_ring_buffer_select(req, len, bl, issue_flags);
244 else
245 sel.addr = io_provided_buffer_select(req, len, bl);
246 }
247 io_ring_submit_unlock(ctx, issue_flags);
248 return sel;
249}
250
251/* cap it at a reasonable 256, will be one page even for 4K */
252#define PEEK_MAX_IMPORT 256
253
254static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
255 struct io_buffer_list *bl)
256{
257 struct io_uring_buf_ring *br = bl->buf_ring;
258 struct iovec *org_iovs = arg->iovs;
259 struct iovec *iov = arg->iovs;
260 int nr_iovs = arg->nr_iovs;
261 __u16 nr_avail, tail, head;
262 struct io_uring_buf *buf;
263
264 tail = smp_load_acquire(&br->tail);
265 head = bl->head;
266 nr_avail = min_t(__u16, tail - head, UIO_MAXIOV);
267 if (unlikely(!nr_avail))
268 return -ENOBUFS;
269
270 /* MAX_RW_COUNT is the universal Linux per-call IO maximum */
271 arg->max_len = min_t(size_t, arg->max_len, MAX_RW_COUNT);
272
273 buf = io_ring_head_to_buf(br, head, bl->mask);
274 if (arg->max_len) {
275 u32 len = READ_ONCE(buf->len);
276 size_t needed;
277
278 if (unlikely(!len))
279 return -ENOBUFS;
280 needed = (arg->max_len + len - 1) / len;
281 needed = min_not_zero(needed, (size_t) PEEK_MAX_IMPORT);
282 if (nr_avail > needed)
283 nr_avail = needed;
284 }
285
286 /*
287 * only alloc a bigger array if we know we have data to map, eg not
288 * a speculative peek operation.
289 */
290 if (arg->mode & KBUF_MODE_EXPAND && nr_avail > nr_iovs && arg->max_len) {
291 iov = kmalloc_objs(struct iovec, nr_avail);
292 if (unlikely(!iov))
293 return -ENOMEM;
294 arg->iovs = iov;
295 nr_iovs = nr_avail;
296 } else if (nr_avail < nr_iovs) {
297 nr_iovs = nr_avail;
298 }
299
300 /* set it to max, if not set, so we can use it unconditionally */
301 if (!arg->max_len)
302 arg->max_len = MAX_RW_COUNT;
303
304 req->buf_index = READ_ONCE(buf->bid);
305 do {
306 u32 len = READ_ONCE(buf->len);
307
308 /* truncate end piece, if needed, for non partial buffers */
309 if (len > arg->max_len) {
310 len = arg->max_len;
311 if (!(bl->flags & IOBL_INC)) {
312 arg->partial_map = 1;
313 if (iov != arg->iovs)
314 break;
315 }
316 }
317
318 iov->iov_base = u64_to_user_ptr(READ_ONCE(buf->addr));
319 iov->iov_len = len;
320 if (unlikely(!access_ok(iov->iov_base, len))) {
321 if (arg->iovs != org_iovs)
322 kfree(arg->iovs);
323 return -EFAULT;
324 }
325 iov++;
326
327 arg->out_len += len;
328 arg->max_len -= len;
329 if (!arg->max_len)
330 break;
331
332 buf = io_ring_head_to_buf(br, ++head, bl->mask);
333 } while (--nr_iovs);
334
335 if (arg->iovs != org_iovs && (arg->mode & KBUF_MODE_FREE))
336 kfree(org_iovs);
337
338 if (head == tail)
339 req->flags |= REQ_F_BL_EMPTY;
340
341 req->flags |= REQ_F_BUFFER_RING;
342 return iov - arg->iovs;
343}
344
345int io_buffers_select(struct io_kiocb *req, struct buf_sel_arg *arg,
346 struct io_br_sel *sel, unsigned int issue_flags)
347{
348 struct io_ring_ctx *ctx = req->ctx;
349 int ret = -ENOENT;
350
351 io_ring_submit_lock(ctx, issue_flags);
352 sel->buf_list = io_buffer_get_list(ctx, arg->buf_group);
353 if (unlikely(!sel->buf_list))
354 goto out_unlock;
355
356 if (sel->buf_list->flags & IOBL_BUF_RING) {
357 ret = io_ring_buffers_peek(req, arg, sel->buf_list);
358 /*
359 * Don't recycle these buffers if we need to go through poll.
360 * Nobody else can use them anyway, and holding on to provided
361 * buffers for a send/write operation would happen on the app
362 * side anyway with normal buffers. Besides, we already
363 * committed them, they cannot be put back in the queue.
364 */
365 if (ret > 0) {
366 req->flags |= REQ_F_BUFFERS_COMMIT | REQ_F_BL_NO_RECYCLE;
367 if (!io_kbuf_commit(req, sel->buf_list, arg->out_len, ret))
368 req->flags |= REQ_F_BUF_MORE;
369 }
370 } else {
371 ret = io_provided_buffers_select(req, &arg->out_len, sel->buf_list, arg->iovs);
372 }
373out_unlock:
374 if (issue_flags & IO_URING_F_UNLOCKED) {
375 sel->buf_list = NULL;
376 mutex_unlock(&ctx->uring_lock);
377 }
378 return ret;
379}
380
381int io_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
382 struct io_br_sel *sel)
383{
384 struct io_ring_ctx *ctx = req->ctx;
385 struct io_buffer_list *bl;
386 int ret;
387
388 lockdep_assert_held(&ctx->uring_lock);
389
390 bl = io_buffer_get_list(ctx, arg->buf_group);
391 if (unlikely(!bl))
392 return -ENOENT;
393
394 if (bl->flags & IOBL_BUF_RING) {
395 ret = io_ring_buffers_peek(req, arg, bl);
396 if (ret > 0)
397 req->flags |= REQ_F_BUFFERS_COMMIT;
398 sel->buf_list = bl;
399 return ret;
400 }
401
402 /* don't support multiple buffer selections for legacy */
403 sel->buf_list = NULL;
404 return io_provided_buffers_select(req, &arg->max_len, bl, arg->iovs);
405}
406
407static inline bool __io_put_kbuf_ring(struct io_kiocb *req,
408 struct io_buffer_list *bl, int len, int nr)
409{
410 bool ret = true;
411
412 if (bl)
413 ret = io_kbuf_commit(req, bl, len, nr);
414 if (ret && (req->flags & REQ_F_BUF_MORE))
415 ret = false;
416
417 req->flags &= ~(REQ_F_BUFFER_RING | REQ_F_BUF_MORE);
418 return ret;
419}
420
421unsigned int __io_put_kbufs(struct io_kiocb *req, struct io_buffer_list *bl,
422 int len, int nbufs)
423{
424 unsigned int ret;
425
426 ret = IORING_CQE_F_BUFFER | (req->buf_index << IORING_CQE_BUFFER_SHIFT);
427
428 if (unlikely(!(req->flags & REQ_F_BUFFER_RING))) {
429 io_kbuf_drop_legacy(req);
430 return ret;
431 }
432
433 if (!__io_put_kbuf_ring(req, bl, len, nbufs))
434 ret |= IORING_CQE_F_BUF_MORE;
435 return ret;
436}
437
438static int io_remove_buffers_legacy(struct io_ring_ctx *ctx,
439 struct io_buffer_list *bl,
440 unsigned long nbufs)
441{
442 unsigned long i = 0;
443 struct io_buffer *nxt;
444
445 /* protects io_buffers_cache */
446 lockdep_assert_held(&ctx->uring_lock);
447 WARN_ON_ONCE(bl->flags & IOBL_BUF_RING);
448
449 for (i = 0; i < nbufs && !list_empty(&bl->buf_list); i++) {
450 nxt = list_first_entry(&bl->buf_list, struct io_buffer, list);
451 list_del(&nxt->list);
452 bl->nbufs--;
453 kfree(nxt);
454 cond_resched();
455 }
456 return i;
457}
458
459static void io_put_bl(struct io_ring_ctx *ctx, struct io_buffer_list *bl)
460{
461 if (bl->flags & IOBL_BUF_RING)
462 io_free_region(NULL, &bl->region);
463 else
464 io_remove_buffers_legacy(ctx, bl, -1U);
465
466 kfree(bl);
467}
468
469void io_destroy_buffers(struct io_ring_ctx *ctx)
470{
471 struct io_buffer_list *bl;
472
473 while (1) {
474 unsigned long index = 0;
475
476 scoped_guard(mutex, &ctx->mmap_lock) {
477 bl = xa_find(&ctx->io_bl_xa, &index, ULONG_MAX, XA_PRESENT);
478 if (bl)
479 xa_erase(&ctx->io_bl_xa, bl->bgid);
480 }
481 if (!bl)
482 break;
483 io_put_bl(ctx, bl);
484 }
485}
486
487static void io_destroy_bl(struct io_ring_ctx *ctx, struct io_buffer_list *bl)
488{
489 scoped_guard(mutex, &ctx->mmap_lock)
490 WARN_ON_ONCE(xa_erase(&ctx->io_bl_xa, bl->bgid) != bl);
491 io_put_bl(ctx, bl);
492}
493
494int io_remove_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
495{
496 struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf);
497 u64 tmp;
498
499 if (sqe->rw_flags || sqe->addr || sqe->len || sqe->off ||
500 sqe->splice_fd_in)
501 return -EINVAL;
502
503 tmp = READ_ONCE(sqe->fd);
504 if (!tmp || tmp > MAX_BIDS_PER_BGID)
505 return -EINVAL;
506
507 memset(p, 0, sizeof(*p));
508 p->nbufs = tmp;
509 p->bgid = READ_ONCE(sqe->buf_group);
510 return 0;
511}
512
513int io_provide_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
514{
515 unsigned long size, tmp_check;
516 struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf);
517 u64 tmp;
518
519 if (sqe->rw_flags || sqe->splice_fd_in)
520 return -EINVAL;
521
522 tmp = READ_ONCE(sqe->fd);
523 if (!tmp || tmp > MAX_BIDS_PER_BGID)
524 return -E2BIG;
525 p->nbufs = tmp;
526 p->addr = READ_ONCE(sqe->addr);
527 p->len = READ_ONCE(sqe->len);
528 if (!p->len)
529 return -EINVAL;
530
531 if (check_mul_overflow((unsigned long)p->len, (unsigned long)p->nbufs,
532 &size))
533 return -EOVERFLOW;
534 if (check_add_overflow((unsigned long)p->addr, size, &tmp_check))
535 return -EOVERFLOW;
536 if (!access_ok(u64_to_user_ptr(p->addr), size))
537 return -EFAULT;
538
539 p->bgid = READ_ONCE(sqe->buf_group);
540 tmp = READ_ONCE(sqe->off);
541 if (tmp > USHRT_MAX)
542 return -E2BIG;
543 if (tmp + p->nbufs > MAX_BIDS_PER_BGID)
544 return -EINVAL;
545 p->bid = tmp;
546 return 0;
547}
548
549static int io_add_buffers(struct io_ring_ctx *ctx, struct io_provide_buf *pbuf,
550 struct io_buffer_list *bl)
551{
552 struct io_buffer *buf;
553 u64 addr = pbuf->addr;
554 int ret = -ENOMEM, i, bid = pbuf->bid;
555
556 for (i = 0; i < pbuf->nbufs; i++) {
557 /*
558 * Nonsensical to have more than MAX_BIDS_PER_BGID buffers in a
559 * buffer list, as the application then has no way of knowing
560 * which duplicate bid refers to what buffer.
561 */
562 if (bl->nbufs == MAX_BIDS_PER_BGID) {
563 ret = -EOVERFLOW;
564 break;
565 }
566 buf = kmalloc_obj(*buf, GFP_KERNEL_ACCOUNT);
567 if (!buf)
568 break;
569
570 list_add_tail(&buf->list, &bl->buf_list);
571 bl->nbufs++;
572 buf->addr = addr;
573 buf->len = min_t(__u32, pbuf->len, MAX_RW_COUNT);
574 buf->bid = bid;
575 buf->bgid = pbuf->bgid;
576 addr += pbuf->len;
577 bid++;
578 cond_resched();
579 }
580
581 return i ? 0 : ret;
582}
583
584static int __io_manage_buffers_legacy(struct io_kiocb *req,
585 struct io_buffer_list *bl)
586{
587 struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf);
588 int ret;
589
590 if (!bl) {
591 if (req->opcode != IORING_OP_PROVIDE_BUFFERS)
592 return -ENOENT;
593 bl = kzalloc_obj(*bl, GFP_KERNEL_ACCOUNT);
594 if (!bl)
595 return -ENOMEM;
596
597 INIT_LIST_HEAD(&bl->buf_list);
598 ret = io_buffer_add_list(req->ctx, bl, p->bgid);
599 if (ret) {
600 kfree(bl);
601 return ret;
602 }
603 }
604 /* can't use provide/remove buffers command on mapped buffers */
605 if (bl->flags & IOBL_BUF_RING)
606 return -EINVAL;
607 if (req->opcode == IORING_OP_PROVIDE_BUFFERS)
608 return io_add_buffers(req->ctx, p, bl);
609 return io_remove_buffers_legacy(req->ctx, bl, p->nbufs);
610}
611
612int io_manage_buffers_legacy(struct io_kiocb *req, unsigned int issue_flags)
613{
614 struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf);
615 struct io_ring_ctx *ctx = req->ctx;
616 struct io_buffer_list *bl;
617 int ret;
618
619 io_ring_submit_lock(ctx, issue_flags);
620 bl = io_buffer_get_list(ctx, p->bgid);
621 ret = __io_manage_buffers_legacy(req, bl);
622 io_ring_submit_unlock(ctx, issue_flags);
623
624 if (ret < 0)
625 req_set_fail(req);
626 io_req_set_res(req, ret, 0);
627 return IOU_COMPLETE;
628}
629
630int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg)
631{
632 struct io_uring_buf_reg reg;
633 struct io_buffer_list *bl;
634 struct io_uring_region_desc rd;
635 struct io_uring_buf_ring *br;
636 unsigned long mmap_offset;
637 unsigned long ring_size;
638 int ret;
639
640 lockdep_assert_held(&ctx->uring_lock);
641
642 if (copy_from_user(&reg, arg, sizeof(reg)))
643 return -EFAULT;
644 if (!mem_is_zero(reg.resv, sizeof(reg.resv)))
645 return -EINVAL;
646 if (reg.flags & ~(IOU_PBUF_RING_MMAP | IOU_PBUF_RING_INC))
647 return -EINVAL;
648 if (!is_power_of_2(reg.ring_entries))
649 return -EINVAL;
650 /* cannot disambiguate full vs empty due to head/tail size */
651 if (reg.ring_entries >= 65536)
652 return -EINVAL;
653
654 /* minimum left byte count is a property of incremental buffers */
655 if (!(reg.flags & IOU_PBUF_RING_INC) && reg.min_left)
656 return -EINVAL;
657
658 bl = io_buffer_get_list(ctx, reg.bgid);
659 if (bl) {
660 /* if mapped buffer ring OR classic exists, don't allow */
661 if (bl->flags & IOBL_BUF_RING || !list_empty(&bl->buf_list))
662 return -EEXIST;
663 io_destroy_bl(ctx, bl);
664 }
665
666 bl = kzalloc_obj(*bl, GFP_KERNEL_ACCOUNT);
667 if (!bl)
668 return -ENOMEM;
669
670 mmap_offset = (unsigned long)reg.bgid << IORING_OFF_PBUF_SHIFT;
671 ring_size = flex_array_size(br, bufs, reg.ring_entries);
672
673 memset(&rd, 0, sizeof(rd));
674 rd.size = PAGE_ALIGN(ring_size);
675 if (!(reg.flags & IOU_PBUF_RING_MMAP)) {
676 rd.user_addr = reg.ring_addr;
677 rd.flags |= IORING_MEM_REGION_TYPE_USER;
678 }
679 ret = io_create_region(NULL, &bl->region, &rd, mmap_offset);
680 if (ret)
681 goto fail;
682 br = io_region_get_ptr(&bl->region);
683
684#ifdef SHM_COLOUR
685 /*
686 * On platforms that have specific aliasing requirements, SHM_COLOUR
687 * is set and we must guarantee that the kernel and user side align
688 * nicely. We cannot do that if IOU_PBUF_RING_MMAP isn't set and
689 * the application mmap's the provided ring buffer. Fail the request
690 * if we, by chance, don't end up with aligned addresses. The app
691 * should use IOU_PBUF_RING_MMAP instead, and liburing will handle
692 * this transparently.
693 */
694 if (!(reg.flags & IOU_PBUF_RING_MMAP) &&
695 ((reg.ring_addr | (unsigned long)br) & (SHM_COLOUR - 1))) {
696 ret = -EINVAL;
697 goto fail;
698 }
699#endif
700
701 bl->mask = reg.ring_entries - 1;
702 bl->flags |= IOBL_BUF_RING;
703 bl->buf_ring = br;
704 if (reg.min_left)
705 bl->min_left_sub_one = reg.min_left - 1;
706 if (reg.flags & IOU_PBUF_RING_INC)
707 bl->flags |= IOBL_INC;
708 ret = io_buffer_add_list(ctx, bl, reg.bgid);
709 if (!ret)
710 return 0;
711fail:
712 io_free_region(NULL, &bl->region);
713 kfree(bl);
714 return ret;
715}
716
717int io_unregister_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg)
718{
719 struct io_uring_buf_reg reg;
720 struct io_buffer_list *bl;
721
722 lockdep_assert_held(&ctx->uring_lock);
723
724 if (copy_from_user(&reg, arg, sizeof(reg)))
725 return -EFAULT;
726 if (!mem_is_zero(reg.resv, sizeof(reg.resv)) || reg.flags)
727 return -EINVAL;
728
729 bl = io_buffer_get_list(ctx, reg.bgid);
730 if (!bl)
731 return -ENOENT;
732 if (!(bl->flags & IOBL_BUF_RING))
733 return -EINVAL;
734
735 scoped_guard(mutex, &ctx->mmap_lock)
736 xa_erase(&ctx->io_bl_xa, bl->bgid);
737
738 io_put_bl(ctx, bl);
739 return 0;
740}
741
742int io_register_pbuf_status(struct io_ring_ctx *ctx, void __user *arg)
743{
744 struct io_uring_buf_status buf_status;
745 struct io_buffer_list *bl;
746
747 if (copy_from_user(&buf_status, arg, sizeof(buf_status)))
748 return -EFAULT;
749 if (!mem_is_zero(buf_status.resv, sizeof(buf_status.resv)))
750 return -EINVAL;
751
752 bl = io_buffer_get_list(ctx, buf_status.buf_group);
753 if (!bl)
754 return -ENOENT;
755 if (!(bl->flags & IOBL_BUF_RING))
756 return -EINVAL;
757
758 buf_status.head = bl->head;
759 if (copy_to_user(arg, &buf_status, sizeof(buf_status)))
760 return -EFAULT;
761
762 return 0;
763}
764
765struct io_mapped_region *io_pbuf_get_region(struct io_ring_ctx *ctx,
766 unsigned int bgid)
767{
768 struct io_buffer_list *bl;
769
770 lockdep_assert_held(&ctx->mmap_lock);
771
772 bl = xa_load(&ctx->io_bl_xa, bgid);
773 if (!bl || !(bl->flags & IOBL_BUF_RING))
774 return NULL;
775 return &bl->region;
776}