io_uring: remove timeout.list after hrtimer cancel
[linux-2.6-microblaze.git] / fs / io_uring.c
index 268d8c5..3ce72d4 100644 (file)
@@ -80,6 +80,7 @@
 #include <linux/task_work.h>
 #include <linux/pagemap.h>
 #include <linux/io_uring.h>
+#include <linux/blk-cgroup.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/io_uring.h>
@@ -190,6 +191,7 @@ struct io_mapped_ubuf {
        size_t          len;
        struct          bio_vec *bvec;
        unsigned int    nr_bvecs;
+       unsigned long   acct_pages;
 };
 
 struct fixed_file_table {
@@ -299,6 +301,10 @@ struct io_ring_ctx {
        /* Only used for accounting purposes */
        struct mm_struct        *mm_account;
 
+#ifdef CONFIG_BLK_CGROUP
+       struct cgroup_subsys_state      *sqo_blkcg_css;
+#endif
+
        struct io_sq_data       *sq_data;       /* if using sq thread polling */
 
        struct wait_queue_head  sqo_sq_wait;
@@ -428,13 +434,16 @@ struct io_cancel {
 
 struct io_timeout {
        struct file                     *file;
-       u64                             addr;
-       int                             flags;
        u32                             off;
        u32                             target_seq;
        struct list_head                list;
 };
 
+struct io_timeout_rem {
+       struct file                     *file;
+       u64                             addr;
+};
+
 struct io_rw {
        /* NOTE: kiocb has the file as the first member, so don't do it here */
        struct kiocb                    kiocb;
@@ -638,6 +647,7 @@ struct io_kiocb {
                struct io_sync          sync;
                struct io_cancel        cancel;
                struct io_timeout       timeout;
+               struct io_timeout_rem   timeout_rem;
                struct io_connect       connect;
                struct io_sr_msg        sr_msg;
                struct io_open          open;
@@ -747,6 +757,8 @@ struct io_op_def {
        unsigned                needs_fsize : 1;
        /* must always have async data allocated */
        unsigned                needs_async_data : 1;
+       /* needs blkcg context, issues async io potentially */
+       unsigned                needs_blkcg : 1;
        /* size of async data needed, if any */
        unsigned short          async_size;
 };
@@ -760,6 +772,7 @@ static const struct io_op_def io_op_defs[] __read_mostly = {
                .pollin                 = 1,
                .buffer_select          = 1,
                .needs_async_data       = 1,
+               .needs_blkcg            = 1,
                .async_size             = sizeof(struct io_async_rw),
        },
        [IORING_OP_WRITEV] = {
@@ -770,15 +783,18 @@ static const struct io_op_def io_op_defs[] __read_mostly = {
                .pollout                = 1,
                .needs_fsize            = 1,
                .needs_async_data       = 1,
+               .needs_blkcg            = 1,
                .async_size             = sizeof(struct io_async_rw),
        },
        [IORING_OP_FSYNC] = {
                .needs_file             = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_READ_FIXED] = {
                .needs_file             = 1,
                .unbound_nonreg_file    = 1,
                .pollin                 = 1,
+               .needs_blkcg            = 1,
                .async_size             = sizeof(struct io_async_rw),
        },
        [IORING_OP_WRITE_FIXED] = {
@@ -787,6 +803,7 @@ static const struct io_op_def io_op_defs[] __read_mostly = {
                .unbound_nonreg_file    = 1,
                .pollout                = 1,
                .needs_fsize            = 1,
+               .needs_blkcg            = 1,
                .async_size             = sizeof(struct io_async_rw),
        },
        [IORING_OP_POLL_ADD] = {
@@ -796,6 +813,7 @@ static const struct io_op_def io_op_defs[] __read_mostly = {
        [IORING_OP_POLL_REMOVE] = {},
        [IORING_OP_SYNC_FILE_RANGE] = {
                .needs_file             = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_SENDMSG] = {
                .needs_mm               = 1,
@@ -804,6 +822,7 @@ static const struct io_op_def io_op_defs[] __read_mostly = {
                .needs_fs               = 1,
                .pollout                = 1,
                .needs_async_data       = 1,
+               .needs_blkcg            = 1,
                .async_size             = sizeof(struct io_async_msghdr),
        },
        [IORING_OP_RECVMSG] = {
@@ -814,6 +833,7 @@ static const struct io_op_def io_op_defs[] __read_mostly = {
                .pollin                 = 1,
                .buffer_select          = 1,
                .needs_async_data       = 1,
+               .needs_blkcg            = 1,
                .async_size             = sizeof(struct io_async_msghdr),
        },
        [IORING_OP_TIMEOUT] = {
@@ -846,15 +866,18 @@ static const struct io_op_def io_op_defs[] __read_mostly = {
        [IORING_OP_FALLOCATE] = {
                .needs_file             = 1,
                .needs_fsize            = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_OPENAT] = {
                .file_table             = 1,
                .needs_fs               = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_CLOSE] = {
                .needs_file             = 1,
                .needs_file_no_error    = 1,
                .file_table             = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_FILES_UPDATE] = {
                .needs_mm               = 1,
@@ -864,6 +887,7 @@ static const struct io_op_def io_op_defs[] __read_mostly = {
                .needs_mm               = 1,
                .needs_fs               = 1,
                .file_table             = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_READ] = {
                .needs_mm               = 1,
@@ -871,6 +895,7 @@ static const struct io_op_def io_op_defs[] __read_mostly = {
                .unbound_nonreg_file    = 1,
                .pollin                 = 1,
                .buffer_select          = 1,
+               .needs_blkcg            = 1,
                .async_size             = sizeof(struct io_async_rw),
        },
        [IORING_OP_WRITE] = {
@@ -879,19 +904,23 @@ static const struct io_op_def io_op_defs[] __read_mostly = {
                .unbound_nonreg_file    = 1,
                .pollout                = 1,
                .needs_fsize            = 1,
+               .needs_blkcg            = 1,
                .async_size             = sizeof(struct io_async_rw),
        },
        [IORING_OP_FADVISE] = {
                .needs_file             = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_MADVISE] = {
                .needs_mm               = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_SEND] = {
                .needs_mm               = 1,
                .needs_file             = 1,
                .unbound_nonreg_file    = 1,
                .pollout                = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_RECV] = {
                .needs_mm               = 1,
@@ -899,10 +928,12 @@ static const struct io_op_def io_op_defs[] __read_mostly = {
                .unbound_nonreg_file    = 1,
                .pollin                 = 1,
                .buffer_select          = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_OPENAT2] = {
                .file_table             = 1,
                .needs_fs               = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_EPOLL_CTL] = {
                .unbound_nonreg_file    = 1,
@@ -912,6 +943,7 @@ static const struct io_op_def io_op_defs[] __read_mostly = {
                .needs_file             = 1,
                .hash_reg_file          = 1,
                .unbound_nonreg_file    = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_PROVIDE_BUFFERS] = {},
        [IORING_OP_REMOVE_BUFFERS] = {},
@@ -939,13 +971,10 @@ static void io_queue_linked_timeout(struct io_kiocb *req);
 static int __io_sqe_files_update(struct io_ring_ctx *ctx,
                                 struct io_uring_files_update *ip,
                                 unsigned nr_args);
-static int io_prep_work_files(struct io_kiocb *req);
 static void __io_clean_op(struct io_kiocb *req);
-static int io_file_get(struct io_submit_state *state, struct io_kiocb *req,
-                      int fd, struct file **out_file, bool fixed);
-static void __io_queue_sqe(struct io_kiocb *req,
-                          const struct io_uring_sqe *sqe,
-                          struct io_comp_state *cs);
+static struct file *io_file_get(struct io_submit_state *state,
+                               struct io_kiocb *req, int fd, bool fixed);
+static void __io_queue_sqe(struct io_kiocb *req, struct io_comp_state *cs);
 static void io_file_put_work(struct work_struct *work);
 
 static ssize_t io_import_iovec(int rw, struct io_kiocb *req,
@@ -1010,6 +1039,26 @@ static int io_sq_thread_acquire_mm(struct io_ring_ctx *ctx,
        return __io_sq_thread_acquire_mm(ctx);
 }
 
+static void io_sq_thread_associate_blkcg(struct io_ring_ctx *ctx,
+                                        struct cgroup_subsys_state **cur_css)
+
+{
+#ifdef CONFIG_BLK_CGROUP
+       /* puts the old one when swapping */
+       if (*cur_css != ctx->sqo_blkcg_css) {
+               kthread_associate_blkcg(ctx->sqo_blkcg_css);
+               *cur_css = ctx->sqo_blkcg_css;
+       }
+#endif
+}
+
+static void io_sq_thread_unassociate_blkcg(void)
+{
+#ifdef CONFIG_BLK_CGROUP
+       kthread_associate_blkcg(NULL);
+#endif
+}
+
 static inline void req_set_fail_links(struct io_kiocb *req)
 {
        if ((req->flags & (REQ_F_LINK | REQ_F_HARDLINK)) == REQ_F_LINK)
@@ -1147,6 +1196,10 @@ static bool io_req_clean_work(struct io_kiocb *req)
                mmdrop(req->work.mm);
                req->work.mm = NULL;
        }
+#ifdef CONFIG_BLK_CGROUP
+       if (req->work.blkcg_css)
+               css_put(req->work.blkcg_css);
+#endif
        if (req->work.creds) {
                put_cred(req->work.creds);
                req->work.creds = NULL;
@@ -1172,20 +1225,45 @@ static bool io_req_clean_work(struct io_kiocb *req)
 static void io_prep_async_work(struct io_kiocb *req)
 {
        const struct io_op_def *def = &io_op_defs[req->opcode];
+       struct io_ring_ctx *ctx = req->ctx;
 
        io_req_init_async(req);
 
        if (req->flags & REQ_F_ISREG) {
-               if (def->hash_reg_file || (req->ctx->flags & IORING_SETUP_IOPOLL))
+               if (def->hash_reg_file || (ctx->flags & IORING_SETUP_IOPOLL))
                        io_wq_hash_work(&req->work, file_inode(req->file));
        } else {
                if (def->unbound_nonreg_file)
                        req->work.flags |= IO_WQ_WORK_UNBOUND;
        }
+       if (!req->work.files && io_op_defs[req->opcode].file_table &&
+           !(req->flags & REQ_F_NO_FILE_TABLE)) {
+               req->work.files = get_files_struct(current);
+               get_nsproxy(current->nsproxy);
+               req->work.nsproxy = current->nsproxy;
+               req->flags |= REQ_F_INFLIGHT;
+
+               spin_lock_irq(&ctx->inflight_lock);
+               list_add(&req->inflight_entry, &ctx->inflight_list);
+               spin_unlock_irq(&ctx->inflight_lock);
+       }
        if (!req->work.mm && def->needs_mm) {
                mmgrab(current->mm);
                req->work.mm = current->mm;
        }
+#ifdef CONFIG_BLK_CGROUP
+       if (!req->work.blkcg_css && def->needs_blkcg) {
+               rcu_read_lock();
+               req->work.blkcg_css = blkcg_css();
+               /*
+                * This should be rare, either the cgroup is dying or the task
+                * is moving cgroups. Just punt to root for the handful of ios.
+                */
+               if (!css_tryget_online(req->work.blkcg_css))
+                       req->work.blkcg_css = NULL;
+               rcu_read_unlock();
+       }
+#endif
        if (!req->work.creds)
                req->work.creds = get_current_cred();
        if (!req->work.fs && def->needs_fs) {
@@ -1585,10 +1663,8 @@ static struct io_kiocb *io_get_fallback_req(struct io_ring_ctx *ctx)
 static struct io_kiocb *io_alloc_req(struct io_ring_ctx *ctx,
                                     struct io_submit_state *state)
 {
-       gfp_t gfp = GFP_KERNEL | __GFP_NOWARN;
-       struct io_kiocb *req;
-
        if (!state->free_reqs) {
+               gfp_t gfp = GFP_KERNEL | __GFP_NOWARN;
                size_t sz;
                int ret;
 
@@ -1605,14 +1681,11 @@ static struct io_kiocb *io_alloc_req(struct io_ring_ctx *ctx,
                                goto fallback;
                        ret = 1;
                }
-               state->free_reqs = ret - 1;
-               req = state->reqs[ret - 1];
-       } else {
-               state->free_reqs--;
-               req = state->reqs[state->free_reqs];
+               state->free_reqs = ret;
        }
 
-       return req;
+       state->free_reqs--;
+       return state->reqs[state->free_reqs];
 fallback:
        return io_get_fallback_req(ctx);
 }
@@ -1828,8 +1901,7 @@ static struct io_kiocb *io_req_find_next(struct io_kiocb *req)
        return __io_req_find_next(req);
 }
 
-static int io_req_task_work_add(struct io_kiocb *req, struct callback_head *cb,
-                               bool twa_signal_ok)
+static int io_req_task_work_add(struct io_kiocb *req, bool twa_signal_ok)
 {
        struct task_struct *tsk = req->task;
        struct io_ring_ctx *ctx = req->ctx;
@@ -1848,7 +1920,7 @@ static int io_req_task_work_add(struct io_kiocb *req, struct callback_head *cb,
        if (!(ctx->flags & IORING_SETUP_SQPOLL) && twa_signal_ok)
                notify = TWA_SIGNAL;
 
-       ret = task_work_add(tsk, cb, notify);
+       ret = task_work_add(tsk, &req->task_work, notify);
        if (!ret)
                wake_up_process(tsk);
 
@@ -1884,7 +1956,7 @@ static void __io_req_task_submit(struct io_kiocb *req)
 
        if (!__io_sq_thread_acquire_mm(ctx)) {
                mutex_lock(&ctx->uring_lock);
-               __io_queue_sqe(req, NULL, NULL);
+               __io_queue_sqe(req, NULL);
                mutex_unlock(&ctx->uring_lock);
        } else {
                __io_req_task_cancel(req, -EFAULT);
@@ -1907,7 +1979,7 @@ static void io_req_task_queue(struct io_kiocb *req)
        init_task_work(&req->task_work, io_req_task_submit);
        percpu_ref_get(&req->ctx->refs);
 
-       ret = io_req_task_work_add(req, &req->task_work, true);
+       ret = io_req_task_work_add(req, true);
        if (unlikely(ret)) {
                struct task_struct *tsk;
 
@@ -2513,7 +2585,6 @@ static struct file *__io_file_get(struct io_submit_state *state, int fd)
        if (state->file) {
                if (state->fd == fd) {
                        state->has_refs--;
-                       state->ios_left--;
                        return state->file;
                }
                __io_state_file_put(state);
@@ -2523,8 +2594,7 @@ static struct file *__io_file_get(struct io_submit_state *state, int fd)
                return NULL;
 
        state->fd = fd;
-       state->ios_left--;
-       state->has_refs = state->ios_left;
+       state->has_refs = state->ios_left - 1;
        return state->file;
 }
 
@@ -2573,8 +2643,7 @@ static bool io_file_supports_async(struct file *file, int rw)
        return file->f_op->write_iter != NULL;
 }
 
-static int io_prep_rw(struct io_kiocb *req, const struct io_uring_sqe *sqe,
-                     bool force_nonblock)
+static int io_prep_rw(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
        struct io_ring_ctx *ctx = req->ctx;
        struct kiocb *kiocb = &req->rw.kiocb;
@@ -2609,9 +2678,6 @@ static int io_prep_rw(struct io_kiocb *req, const struct io_uring_sqe *sqe,
        if (kiocb->ki_flags & IOCB_NOWAIT)
                req->flags |= REQ_F_NOWAIT;
 
-       if (force_nonblock)
-               kiocb->ki_flags |= IOCB_NOWAIT;
-
        if (ctx->flags & IORING_SETUP_IOPOLL) {
                if (!(kiocb->ki_flags & IOCB_DIRECT) ||
                    !kiocb->ki_filp->f_op->iopoll)
@@ -2948,7 +3014,7 @@ static ssize_t io_import_iovec(int rw, struct io_kiocb *req,
 
 static inline loff_t *io_kiocb_ppos(struct kiocb *kiocb)
 {
-       return kiocb->ki_filp->f_mode & FMODE_STREAM ? NULL : &kiocb->ki_pos;
+       return (kiocb->ki_filp->f_mode & FMODE_STREAM) ? NULL : &kiocb->ki_pos;
 }
 
 /*
@@ -3066,14 +3132,13 @@ static int io_setup_async_rw(struct io_kiocb *req, const struct iovec *iovec,
        return 0;
 }
 
-static inline int io_rw_prep_async(struct io_kiocb *req, int rw,
-                                  bool force_nonblock)
+static inline int io_rw_prep_async(struct io_kiocb *req, int rw)
 {
        struct io_async_rw *iorw = req->async_data;
        struct iovec *iov = iorw->fast_iov;
        ssize_t ret;
 
-       ret = __io_import_iovec(rw, req, &iov, &iorw->iter, !force_nonblock);
+       ret = __io_import_iovec(rw, req, &iov, &iorw->iter, false);
        if (unlikely(ret < 0))
                return ret;
 
@@ -3084,12 +3149,11 @@ static inline int io_rw_prep_async(struct io_kiocb *req, int rw,
        return 0;
 }
 
-static int io_read_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe,
-                       bool force_nonblock)
+static int io_read_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
        ssize_t ret;
 
-       ret = io_prep_rw(req, sqe, force_nonblock);
+       ret = io_prep_rw(req, sqe);
        if (ret)
                return ret;
 
@@ -3097,9 +3161,9 @@ static int io_read_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe,
                return -EBADF;
 
        /* either don't need iovec imported or already have it */
-       if (!req->async_data || req->flags & REQ_F_NEED_CLEANUP)
+       if (!req->async_data)
                return 0;
-       return io_rw_prep_async(req, READ, force_nonblock);
+       return io_rw_prep_async(req, READ);
 }
 
 /*
@@ -3133,7 +3197,7 @@ static int io_async_buf_func(struct wait_queue_entry *wait, unsigned mode,
 
        /* submit ref gets dropped, acquire a new one */
        refcount_inc(&req->refs);
-       ret = io_req_task_work_add(req, &req->task_work, true);
+       ret = io_req_task_work_add(req, true);
        if (unlikely(ret)) {
                struct task_struct *tsk;
 
@@ -3224,6 +3288,9 @@ static int io_read(struct io_kiocb *req, bool force_nonblock,
        /* Ensure we clear previously set non-block flag */
        if (!force_nonblock)
                kiocb->ki_flags &= ~IOCB_NOWAIT;
+       else
+               kiocb->ki_flags |= IOCB_NOWAIT;
+
 
        /* If the file doesn't support async, just async punt */
        no_async = force_nonblock && !io_file_supports_async(req->file, READ);
@@ -3308,12 +3375,11 @@ out_free:
        return ret;
 }
 
-static int io_write_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe,
-                        bool force_nonblock)
+static int io_write_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
        ssize_t ret;
 
-       ret = io_prep_rw(req, sqe, force_nonblock);
+       ret = io_prep_rw(req, sqe);
        if (ret)
                return ret;
 
@@ -3321,9 +3387,9 @@ static int io_write_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe,
                return -EBADF;
 
        /* either don't need iovec imported or already have it */
-       if (!req->async_data || req->flags & REQ_F_NEED_CLEANUP)
+       if (!req->async_data)
                return 0;
-       return io_rw_prep_async(req, WRITE, force_nonblock);
+       return io_rw_prep_async(req, WRITE);
 }
 
 static int io_write(struct io_kiocb *req, bool force_nonblock,
@@ -3348,7 +3414,9 @@ static int io_write(struct io_kiocb *req, bool force_nonblock,
 
        /* Ensure we clear previously set non-block flag */
        if (!force_nonblock)
-               req->rw.kiocb.ki_flags &= ~IOCB_NOWAIT;
+               kiocb->ki_flags &= ~IOCB_NOWAIT;
+       else
+               kiocb->ki_flags |= IOCB_NOWAIT;
 
        /* If the file doesn't support async, just async punt */
        if (force_nonblock && !io_file_supports_async(req->file, WRITE))
@@ -3420,10 +3488,7 @@ static int __io_splice_prep(struct io_kiocb *req,
 {
        struct io_splice* sp = &req->splice;
        unsigned int valid_flags = SPLICE_F_FD_IN_FIXED | SPLICE_F_ALL;
-       int ret;
 
-       if (req->flags & REQ_F_NEED_CLEANUP)
-               return 0;
        if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
                return -EINVAL;
 
@@ -3434,10 +3499,10 @@ static int __io_splice_prep(struct io_kiocb *req,
        if (unlikely(sp->flags & ~valid_flags))
                return -EINVAL;
 
-       ret = io_file_get(NULL, req, READ_ONCE(sqe->splice_fd_in), &sp->file_in,
-                         (sp->flags & SPLICE_F_FD_IN_FIXED));
-       if (ret)
-               return ret;
+       sp->file_in = io_file_get(NULL, req, READ_ONCE(sqe->splice_fd_in),
+                                 (sp->flags & SPLICE_F_FD_IN_FIXED));
+       if (!sp->file_in)
+               return -EBADF;
        req->flags |= REQ_F_NEED_CLEANUP;
 
        if (!S_ISREG(file_inode(sp->file_in)->i_mode)) {
@@ -3633,8 +3698,6 @@ static int io_openat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 
        if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL|IORING_SETUP_SQPOLL)))
                return -EINVAL;
-       if (req->flags & REQ_F_NEED_CLEANUP)
-               return 0;
        mode = READ_ONCE(sqe->len);
        flags = READ_ONCE(sqe->open_flags);
        req->open.how = build_open_how(flags, mode);
@@ -3649,8 +3712,6 @@ static int io_openat2_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 
        if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL|IORING_SETUP_SQPOLL)))
                return -EINVAL;
-       if (req->flags & REQ_F_NEED_CLEANUP)
-               return 0;
        how = u64_to_user_ptr(READ_ONCE(sqe->addr2));
        len = READ_ONCE(sqe->len);
        if (len < OPEN_HOW_SIZE_VER0)
@@ -4158,10 +4219,6 @@ static int io_sendmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 
        if (!async_msg || !io_op_defs[req->opcode].needs_async_data)
                return 0;
-       /* iovec is already imported */
-       if (req->flags & REQ_F_NEED_CLEANUP)
-               return 0;
-
        ret = io_sendmsg_copy_hdr(req, async_msg);
        if (!ret)
                req->flags |= REQ_F_NEED_CLEANUP;
@@ -4231,7 +4288,7 @@ static int io_send(struct io_kiocb *req, bool force_nonblock,
 
        ret = import_single_range(WRITE, sr->buf, sr->len, &iov, &msg.msg_iter);
        if (unlikely(ret))
-               return ret;;
+               return ret;
 
        msg.msg_name = NULL;
        msg.msg_control = NULL;
@@ -4388,10 +4445,6 @@ static int io_recvmsg_prep(struct io_kiocb *req,
 
        if (!async_msg || !io_op_defs[req->opcode].needs_async_data)
                return 0;
-       /* iovec is already imported */
-       if (req->flags & REQ_F_NEED_CLEANUP)
-               return 0;
-
        ret = io_recvmsg_copy_hdr(req, async_msg);
        if (!ret)
                req->flags |= REQ_F_NEED_CLEANUP;
@@ -4710,7 +4763,7 @@ static int __io_async_wake(struct io_kiocb *req, struct io_poll_iocb *poll,
         * of executing it. We can't safely execute it anyway, as we may not
         * have the needed state needed for it anyway.
         */
-       ret = io_req_task_work_add(req, &req->task_work, twa_signal_ok);
+       ret = io_req_task_work_add(req, twa_signal_ok);
        if (unlikely(ret)) {
                struct task_struct *tsk;
 
@@ -5248,16 +5301,10 @@ static enum hrtimer_restart io_timeout_fn(struct hrtimer *timer)
        unsigned long flags;
 
        spin_lock_irqsave(&ctx->completion_lock, flags);
+       list_del_init(&req->timeout.list);
        atomic_set(&req->ctx->cq_timeouts,
                atomic_read(&req->ctx->cq_timeouts) + 1);
 
-       /*
-        * We could be racing with timeout deletion. If the list is empty,
-        * then timeout lookup already found it and will be handling it.
-        */
-       if (!list_empty(&req->timeout.list))
-               list_del_init(&req->timeout.list);
-
        io_cqring_fill_event(req, -ETIME);
        io_commit_cqring(ctx);
        spin_unlock_irqrestore(&ctx->completion_lock, flags);
@@ -5273,11 +5320,10 @@ static int __io_timeout_cancel(struct io_kiocb *req)
        struct io_timeout_data *io = req->async_data;
        int ret;
 
-       list_del_init(&req->timeout.list);
-
        ret = hrtimer_try_to_cancel(&io->timer);
        if (ret == -1)
                return -EALREADY;
+       list_del_init(&req->timeout.list);
 
        req_set_fail_links(req);
        req->flags |= REQ_F_COMP_LOCKED;
@@ -5311,14 +5357,10 @@ static int io_timeout_remove_prep(struct io_kiocb *req,
                return -EINVAL;
        if (unlikely(req->flags & (REQ_F_FIXED_FILE | REQ_F_BUFFER_SELECT)))
                return -EINVAL;
-       if (sqe->ioprio || sqe->buf_index || sqe->len)
-               return -EINVAL;
-
-       req->timeout.addr = READ_ONCE(sqe->addr);
-       req->timeout.flags = READ_ONCE(sqe->timeout_flags);
-       if (req->timeout.flags)
+       if (sqe->ioprio || sqe->buf_index || sqe->len || sqe->timeout_flags)
                return -EINVAL;
 
+       req->timeout_rem.addr = READ_ONCE(sqe->addr);
        return 0;
 }
 
@@ -5331,7 +5373,7 @@ static int io_timeout_remove(struct io_kiocb *req)
        int ret;
 
        spin_lock_irq(&ctx->completion_lock);
-       ret = io_timeout_cancel(ctx, req->timeout.addr);
+       ret = io_timeout_cancel(ctx, req->timeout_rem.addr);
 
        io_cqring_fill_event(req, ret);
        io_commit_cqring(ctx);
@@ -5546,120 +5588,86 @@ static int io_files_update(struct io_kiocb *req, bool force_nonblock,
        return 0;
 }
 
-static int io_req_defer_prep(struct io_kiocb *req,
-                            const struct io_uring_sqe *sqe)
+static int io_req_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
-       ssize_t ret = 0;
-
-       if (!sqe)
-               return 0;
-
-       if (io_alloc_async_data(req))
-               return -EAGAIN;
-       ret = io_prep_work_files(req);
-       if (unlikely(ret))
-               return ret;
-
-       io_prep_async_work(req);
-
        switch (req->opcode) {
        case IORING_OP_NOP:
-               break;
+               return 0;
        case IORING_OP_READV:
        case IORING_OP_READ_FIXED:
        case IORING_OP_READ:
-               ret = io_read_prep(req, sqe, true);
-               break;
+               return io_read_prep(req, sqe);
        case IORING_OP_WRITEV:
        case IORING_OP_WRITE_FIXED:
        case IORING_OP_WRITE:
-               ret = io_write_prep(req, sqe, true);
-               break;
+               return io_write_prep(req, sqe);
        case IORING_OP_POLL_ADD:
-               ret = io_poll_add_prep(req, sqe);
-               break;
+               return io_poll_add_prep(req, sqe);
        case IORING_OP_POLL_REMOVE:
-               ret = io_poll_remove_prep(req, sqe);
-               break;
+               return io_poll_remove_prep(req, sqe);
        case IORING_OP_FSYNC:
-               ret = io_prep_fsync(req, sqe);
-               break;
+               return io_prep_fsync(req, sqe);
        case IORING_OP_SYNC_FILE_RANGE:
-               ret = io_prep_sfr(req, sqe);
-               break;
+               return io_prep_sfr(req, sqe);
        case IORING_OP_SENDMSG:
        case IORING_OP_SEND:
-               ret = io_sendmsg_prep(req, sqe);
-               break;
+               return io_sendmsg_prep(req, sqe);
        case IORING_OP_RECVMSG:
        case IORING_OP_RECV:
-               ret = io_recvmsg_prep(req, sqe);
-               break;
+               return io_recvmsg_prep(req, sqe);
        case IORING_OP_CONNECT:
-               ret = io_connect_prep(req, sqe);
-               break;
+               return io_connect_prep(req, sqe);
        case IORING_OP_TIMEOUT:
-               ret = io_timeout_prep(req, sqe, false);
-               break;
+               return io_timeout_prep(req, sqe, false);
        case IORING_OP_TIMEOUT_REMOVE:
-               ret = io_timeout_remove_prep(req, sqe);
-               break;
+               return io_timeout_remove_prep(req, sqe);
        case IORING_OP_ASYNC_CANCEL:
-               ret = io_async_cancel_prep(req, sqe);
-               break;
+               return io_async_cancel_prep(req, sqe);
        case IORING_OP_LINK_TIMEOUT:
-               ret = io_timeout_prep(req, sqe, true);
-               break;
+               return io_timeout_prep(req, sqe, true);
        case IORING_OP_ACCEPT:
-               ret = io_accept_prep(req, sqe);
-               break;
+               return io_accept_prep(req, sqe);
        case IORING_OP_FALLOCATE:
-               ret = io_fallocate_prep(req, sqe);
-               break;
+               return io_fallocate_prep(req, sqe);
        case IORING_OP_OPENAT:
-               ret = io_openat_prep(req, sqe);
-               break;
+               return io_openat_prep(req, sqe);
        case IORING_OP_CLOSE:
-               ret = io_close_prep(req, sqe);
-               break;
+               return io_close_prep(req, sqe);
        case IORING_OP_FILES_UPDATE:
-               ret = io_files_update_prep(req, sqe);
-               break;
+               return io_files_update_prep(req, sqe);
        case IORING_OP_STATX:
-               ret = io_statx_prep(req, sqe);
-               break;
+               return io_statx_prep(req, sqe);
        case IORING_OP_FADVISE:
-               ret = io_fadvise_prep(req, sqe);
-               break;
+               return io_fadvise_prep(req, sqe);
        case IORING_OP_MADVISE:
-               ret = io_madvise_prep(req, sqe);
-               break;
+               return io_madvise_prep(req, sqe);
        case IORING_OP_OPENAT2:
-               ret = io_openat2_prep(req, sqe);
-               break;
+               return io_openat2_prep(req, sqe);
        case IORING_OP_EPOLL_CTL:
-               ret = io_epoll_ctl_prep(req, sqe);
-               break;
+               return io_epoll_ctl_prep(req, sqe);
        case IORING_OP_SPLICE:
-               ret = io_splice_prep(req, sqe);
-               break;
+               return io_splice_prep(req, sqe);
        case IORING_OP_PROVIDE_BUFFERS:
-               ret = io_provide_buffers_prep(req, sqe);
-               break;
+               return io_provide_buffers_prep(req, sqe);
        case IORING_OP_REMOVE_BUFFERS:
-               ret = io_remove_buffers_prep(req, sqe);
-               break;
+               return io_remove_buffers_prep(req, sqe);
        case IORING_OP_TEE:
-               ret = io_tee_prep(req, sqe);
-               break;
-       default:
-               printk_once(KERN_WARNING "io_uring: unhandled opcode %d\n",
-                               req->opcode);
-               ret = -EINVAL;
-               break;
+               return io_tee_prep(req, sqe);
        }
 
-       return ret;
+       printk_once(KERN_WARNING "io_uring: unhandled opcode %d\n",
+                       req->opcode);
+       return-EINVAL;
+}
+
+static int io_req_defer_prep(struct io_kiocb *req,
+                            const struct io_uring_sqe *sqe)
+{
+       if (!sqe)
+               return 0;
+       if (io_alloc_async_data(req))
+               return -EAGAIN;
+       return io_req_prep(req, sqe);
 }
 
 static u32 io_get_sequence(struct io_kiocb *req)
@@ -5790,8 +5798,8 @@ static void __io_clean_op(struct io_kiocb *req)
                io_req_drop_files(req);
 }
 
-static int io_issue_sqe(struct io_kiocb *req, const struct io_uring_sqe *sqe,
-                       bool force_nonblock, struct io_comp_state *cs)
+static int io_issue_sqe(struct io_kiocb *req, bool force_nonblock,
+                       struct io_comp_state *cs)
 {
        struct io_ring_ctx *ctx = req->ctx;
        int ret;
@@ -5803,62 +5811,27 @@ static int io_issue_sqe(struct io_kiocb *req, const struct io_uring_sqe *sqe,
        case IORING_OP_READV:
        case IORING_OP_READ_FIXED:
        case IORING_OP_READ:
-               if (sqe) {
-                       ret = io_read_prep(req, sqe, force_nonblock);
-                       if (ret < 0)
-                               break;
-               }
                ret = io_read(req, force_nonblock, cs);
                break;
        case IORING_OP_WRITEV:
        case IORING_OP_WRITE_FIXED:
        case IORING_OP_WRITE:
-               if (sqe) {
-                       ret = io_write_prep(req, sqe, force_nonblock);
-                       if (ret < 0)
-                               break;
-               }
                ret = io_write(req, force_nonblock, cs);
                break;
        case IORING_OP_FSYNC:
-               if (sqe) {
-                       ret = io_prep_fsync(req, sqe);
-                       if (ret < 0)
-                               break;
-               }
                ret = io_fsync(req, force_nonblock);
                break;
        case IORING_OP_POLL_ADD:
-               if (sqe) {
-                       ret = io_poll_add_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_poll_add(req);
                break;
        case IORING_OP_POLL_REMOVE:
-               if (sqe) {
-                       ret = io_poll_remove_prep(req, sqe);
-                       if (ret < 0)
-                               break;
-               }
                ret = io_poll_remove(req);
                break;
        case IORING_OP_SYNC_FILE_RANGE:
-               if (sqe) {
-                       ret = io_prep_sfr(req, sqe);
-                       if (ret < 0)
-                               break;
-               }
                ret = io_sync_file_range(req, force_nonblock);
                break;
        case IORING_OP_SENDMSG:
        case IORING_OP_SEND:
-               if (sqe) {
-                       ret = io_sendmsg_prep(req, sqe);
-                       if (ret < 0)
-                               break;
-               }
                if (req->opcode == IORING_OP_SENDMSG)
                        ret = io_sendmsg(req, force_nonblock, cs);
                else
@@ -5866,158 +5839,63 @@ static int io_issue_sqe(struct io_kiocb *req, const struct io_uring_sqe *sqe,
                break;
        case IORING_OP_RECVMSG:
        case IORING_OP_RECV:
-               if (sqe) {
-                       ret = io_recvmsg_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                if (req->opcode == IORING_OP_RECVMSG)
                        ret = io_recvmsg(req, force_nonblock, cs);
                else
                        ret = io_recv(req, force_nonblock, cs);
                break;
        case IORING_OP_TIMEOUT:
-               if (sqe) {
-                       ret = io_timeout_prep(req, sqe, false);
-                       if (ret)
-                               break;
-               }
                ret = io_timeout(req);
                break;
        case IORING_OP_TIMEOUT_REMOVE:
-               if (sqe) {
-                       ret = io_timeout_remove_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_timeout_remove(req);
                break;
        case IORING_OP_ACCEPT:
-               if (sqe) {
-                       ret = io_accept_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_accept(req, force_nonblock, cs);
                break;
        case IORING_OP_CONNECT:
-               if (sqe) {
-                       ret = io_connect_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_connect(req, force_nonblock, cs);
                break;
        case IORING_OP_ASYNC_CANCEL:
-               if (sqe) {
-                       ret = io_async_cancel_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_async_cancel(req);
                break;
        case IORING_OP_FALLOCATE:
-               if (sqe) {
-                       ret = io_fallocate_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_fallocate(req, force_nonblock);
                break;
        case IORING_OP_OPENAT:
-               if (sqe) {
-                       ret = io_openat_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_openat(req, force_nonblock);
                break;
        case IORING_OP_CLOSE:
-               if (sqe) {
-                       ret = io_close_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_close(req, force_nonblock, cs);
                break;
        case IORING_OP_FILES_UPDATE:
-               if (sqe) {
-                       ret = io_files_update_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_files_update(req, force_nonblock, cs);
                break;
        case IORING_OP_STATX:
-               if (sqe) {
-                       ret = io_statx_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_statx(req, force_nonblock);
                break;
        case IORING_OP_FADVISE:
-               if (sqe) {
-                       ret = io_fadvise_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_fadvise(req, force_nonblock);
                break;
        case IORING_OP_MADVISE:
-               if (sqe) {
-                       ret = io_madvise_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_madvise(req, force_nonblock);
                break;
        case IORING_OP_OPENAT2:
-               if (sqe) {
-                       ret = io_openat2_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_openat2(req, force_nonblock);
                break;
        case IORING_OP_EPOLL_CTL:
-               if (sqe) {
-                       ret = io_epoll_ctl_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_epoll_ctl(req, force_nonblock, cs);
                break;
        case IORING_OP_SPLICE:
-               if (sqe) {
-                       ret = io_splice_prep(req, sqe);
-                       if (ret < 0)
-                               break;
-               }
                ret = io_splice(req, force_nonblock);
                break;
        case IORING_OP_PROVIDE_BUFFERS:
-               if (sqe) {
-                       ret = io_provide_buffers_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_provide_buffers(req, force_nonblock, cs);
                break;
        case IORING_OP_REMOVE_BUFFERS:
-               if (sqe) {
-                       ret = io_remove_buffers_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_remove_buffers(req, force_nonblock, cs);
                break;
        case IORING_OP_TEE:
-               if (sqe) {
-                       ret = io_tee_prep(req, sqe);
-                       if (ret < 0)
-                               break;
-               }
                ret = io_tee(req, force_nonblock);
                break;
        default:
@@ -6063,7 +5941,7 @@ static struct io_wq_work *io_wq_submit_work(struct io_wq_work *work)
 
        if (!ret) {
                do {
-                       ret = io_issue_sqe(req, NULL, false, NULL);
+                       ret = io_issue_sqe(req, false, NULL);
                        /*
                         * We can get EAGAIN for polled IO even though we're
                         * forcing a sync submission from here, since we can't
@@ -6092,16 +5970,15 @@ static inline struct file *io_file_from_index(struct io_ring_ctx *ctx,
        return table->files[index & IORING_FILE_TABLE_MASK];
 }
 
-static int io_file_get(struct io_submit_state *state, struct io_kiocb *req,
-                       int fd, struct file **out_file, bool fixed)
+static struct file *io_file_get(struct io_submit_state *state,
+                               struct io_kiocb *req, int fd, bool fixed)
 {
        struct io_ring_ctx *ctx = req->ctx;
        struct file *file;
 
        if (fixed) {
-               if (unlikely(!ctx->file_data ||
-                   (unsigned) fd >= ctx->nr_user_files))
-                       return -EBADF;
+               if (unlikely((unsigned int)fd >= ctx->nr_user_files))
+                       return NULL;
                fd = array_index_nospec(fd, ctx->nr_user_files);
                file = io_file_from_index(ctx, fd);
                if (file) {
@@ -6113,11 +5990,7 @@ static int io_file_get(struct io_submit_state *state, struct io_kiocb *req,
                file = __io_file_get(state, fd);
        }
 
-       if (file || io_op_defs[req->opcode].needs_file_no_error) {
-               *out_file = file;
-               return 0;
-       }
-       return -EBADF;
+       return file;
 }
 
 static int io_req_set_file(struct io_submit_state *state, struct io_kiocb *req,
@@ -6129,34 +6002,10 @@ static int io_req_set_file(struct io_submit_state *state, struct io_kiocb *req,
        if (unlikely(!fixed && io_async_submit(req->ctx)))
                return -EBADF;
 
-       return io_file_get(state, req, fd, &req->file, fixed);
-}
-
-static int io_grab_files(struct io_kiocb *req)
-{
-       struct io_ring_ctx *ctx = req->ctx;
-
-       io_req_init_async(req);
-
-       if (req->work.files || (req->flags & REQ_F_NO_FILE_TABLE))
+       req->file = io_file_get(state, req, fd, fixed);
+       if (req->file || io_op_defs[req->opcode].needs_file_no_error)
                return 0;
-
-       req->work.files = get_files_struct(current);
-       get_nsproxy(current->nsproxy);
-       req->work.nsproxy = current->nsproxy;
-       req->flags |= REQ_F_INFLIGHT;
-
-       spin_lock_irq(&ctx->inflight_lock);
-       list_add(&req->inflight_entry, &ctx->inflight_list);
-       spin_unlock_irq(&ctx->inflight_lock);
-       return 0;
-}
-
-static inline int io_prep_work_files(struct io_kiocb *req)
-{
-       if (!io_op_defs[req->opcode].file_table)
-               return 0;
-       return io_grab_files(req);
+       return -EBADF;
 }
 
 static enum hrtimer_restart io_link_timeout_fn(struct hrtimer *timer)
@@ -6241,8 +6090,7 @@ static struct io_kiocb *io_prep_linked_timeout(struct io_kiocb *req)
        return nxt;
 }
 
-static void __io_queue_sqe(struct io_kiocb *req, const struct io_uring_sqe *sqe,
-                          struct io_comp_state *cs)
+static void __io_queue_sqe(struct io_kiocb *req, struct io_comp_state *cs)
 {
        struct io_kiocb *linked_timeout;
        struct io_kiocb *nxt;
@@ -6262,7 +6110,7 @@ again:
                        old_creds = override_creds(req->work.creds);
        }
 
-       ret = io_issue_sqe(req, sqe, true, cs);
+       ret = io_issue_sqe(req, true, cs);
 
        /*
         * We async punt it if the file wasn't marked NOWAIT, or if the file
@@ -6271,9 +6119,6 @@ again:
        if (ret == -EAGAIN && !(req->flags & REQ_F_NOWAIT)) {
                if (!io_arm_poll_handler(req)) {
 punt:
-                       ret = io_prep_work_files(req);
-                       if (unlikely(ret))
-                               goto err;
                        /*
                         * Queued up for async execution, worker will release
                         * submit reference when the iocb is actually submitted.
@@ -6287,7 +6132,6 @@ punt:
        }
 
        if (unlikely(ret)) {
-err:
                /* un-prep timeout, so it'll be killed as any other linked */
                req->flags &= ~REQ_F_LINK_TIMEOUT;
                req_set_fail_links(req);
@@ -6341,7 +6185,12 @@ fail_req:
                req->work.flags |= IO_WQ_WORK_CONCURRENT;
                io_queue_async_work(req);
        } else {
-               __io_queue_sqe(req, sqe, cs);
+               if (sqe) {
+                       ret = io_req_prep(req, sqe);
+                       if (unlikely(ret))
+                               goto fail_req;
+               }
+               __io_queue_sqe(req, cs);
        }
 }
 
@@ -6528,7 +6377,7 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req,
                       struct io_submit_state *state)
 {
        unsigned int sqe_flags;
-       int id;
+       int id, ret;
 
        req->opcode = READ_ONCE(sqe->opcode);
        req->user_data = READ_ONCE(sqe->user_data);
@@ -6539,8 +6388,6 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req,
        /* one is dropped after submission, the other at completion */
        refcount_set(&req->refs, 2);
        req->task = current;
-       get_task_struct(req->task);
-       atomic_long_inc(&req->task->io_uring->req_issue);
        req->result = 0;
 
        if (unlikely(req->opcode >= IORING_OP_LAST))
@@ -6576,7 +6423,9 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req,
        if (!io_op_defs[req->opcode].needs_file)
                return 0;
 
-       return io_req_set_file(state, req, READ_ONCE(sqe->fd));
+       ret = io_req_set_file(state, req, READ_ONCE(sqe->fd));
+       state->ios_left--;
+       return ret;
 }
 
 static int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr)
@@ -6598,6 +6447,9 @@ static int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr)
        if (!percpu_ref_tryget_many(&ctx->refs, nr))
                return -EAGAIN;
 
+       atomic_long_add(nr, &current->io_uring->req_issue);
+       refcount_add(nr, &current->usage);
+
        io_submit_state_start(&state, ctx, nr);
 
        for (i = 0; i < nr; i++) {
@@ -6640,6 +6492,8 @@ fail_req:
                int ref_used = (submitted == -EAGAIN) ? 0 : submitted;
 
                percpu_ref_put_many(&ctx->refs, nr - ref_used);
+               atomic_long_sub(nr - ref_used, &current->io_uring->req_issue);
+               put_task_struct_many(current, nr - ref_used);
        }
        if (link)
                io_queue_link_head(link, &state.comp);
@@ -6690,7 +6544,7 @@ enum sq_ret {
 };
 
 static enum sq_ret __io_sq_thread(struct io_ring_ctx *ctx,
-                                 unsigned long start_jiffies)
+                                 unsigned long start_jiffies, bool cap_entries)
 {
        unsigned long timeout = start_jiffies + ctx->sq_thread_idle;
        struct io_sq_data *sqd = ctx->sq_data;
@@ -6758,6 +6612,10 @@ again:
        finish_wait(&sqd->wait, &ctx->sqo_wait_entry);
        io_ring_clear_wakeup_flag(ctx);
 
+       /* if we're handling multiple rings, cap submit size for fairness */
+       if (cap_entries && to_submit > 8)
+               to_submit = 8;
+
        mutex_lock(&ctx->uring_lock);
        if (likely(!percpu_ref_is_dying(&ctx->refs)))
                ret = io_submit_sqes(ctx, to_submit);
@@ -6784,6 +6642,7 @@ static void io_sqd_init_new(struct io_sq_data *sqd)
 
 static int io_sq_thread(void *data)
 {
+       struct cgroup_subsys_state *cur_css = NULL;
        const struct cred *old_cred = NULL;
        struct io_sq_data *sqd = data;
        struct io_ring_ctx *ctx;
@@ -6792,6 +6651,7 @@ static int io_sq_thread(void *data)
        start_jiffies = jiffies;
        while (!kthread_should_stop()) {
                enum sq_ret ret = 0;
+               bool cap_entries;
 
                /*
                 * Any changes to the sqd lists are synchronized through the
@@ -6804,14 +6664,17 @@ static int io_sq_thread(void *data)
                if (unlikely(!list_empty(&sqd->ctx_new_list)))
                        io_sqd_init_new(sqd);
 
+               cap_entries = !list_is_singular(&sqd->ctx_list);
+
                list_for_each_entry(ctx, &sqd->ctx_list, sqd_list) {
                        if (current->cred != ctx->creds) {
                                if (old_cred)
                                        revert_creds(old_cred);
                                old_cred = override_creds(ctx->creds);
                        }
+                       io_sq_thread_associate_blkcg(ctx, &cur_css);
 
-                       ret |= __io_sq_thread(ctx, start_jiffies);
+                       ret |= __io_sq_thread(ctx, start_jiffies, cap_entries);
 
                        io_sq_thread_drop_mm();
                }
@@ -6833,6 +6696,8 @@ static int io_sq_thread(void *data)
 
        io_run_task_work();
 
+       if (cur_css)
+               io_sq_thread_unassociate_blkcg();
        if (old_cred)
                revert_creds(old_cred);
 
@@ -6874,6 +6739,22 @@ static int io_wake_function(struct wait_queue_entry *curr, unsigned int mode,
        return autoremove_wake_function(curr, mode, wake_flags, key);
 }
 
+static int io_run_task_work_sig(void)
+{
+       if (io_run_task_work())
+               return 1;
+       if (!signal_pending(current))
+               return 0;
+       if (current->jobctl & JOBCTL_TASK_WORK) {
+               spin_lock_irq(&current->sighand->siglock);
+               current->jobctl &= ~JOBCTL_TASK_WORK;
+               recalc_sigpending();
+               spin_unlock_irq(&current->sighand->siglock);
+               return 1;
+       }
+       return -EINTR;
+}
+
 /*
  * Wait until events become available, if we don't already have some. The
  * application must reap them itself, as they reside on the shared cq ring.
@@ -6919,19 +6800,11 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events,
                prepare_to_wait_exclusive(&ctx->wait, &iowq.wq,
                                                TASK_INTERRUPTIBLE);
                /* make sure we run task_work before checking for signals */
-               if (io_run_task_work())
+               ret = io_run_task_work_sig();
+               if (ret > 0)
                        continue;
-               if (signal_pending(current)) {
-                       if (current->jobctl & JOBCTL_TASK_WORK) {
-                               spin_lock_irq(&current->sighand->siglock);
-                               current->jobctl &= ~JOBCTL_TASK_WORK;
-                               recalc_sigpending();
-                               spin_unlock_irq(&current->sighand->siglock);
-                               continue;
-                       }
-                       ret = -EINTR;
+               else if (ret < 0)
                        break;
-               }
                if (io_should_wake(&iowq, false))
                        break;
                schedule();
@@ -7776,7 +7649,6 @@ void __io_uring_free(struct task_struct *tsk)
        struct io_uring_task *tctx = tsk->io_uring;
 
        WARN_ON_ONCE(!xa_empty(&tctx->xa));
-       xa_destroy(&tctx->xa);
        kfree(tctx);
        tsk->io_uring = NULL;
 }
@@ -7995,7 +7867,8 @@ static int io_sqe_buffer_unregister(struct io_ring_ctx *ctx)
                for (j = 0; j < imu->nr_bvecs; j++)
                        unpin_user_page(imu->bvec[j].bv_page);
 
-               io_unaccount_mem(ctx, imu->nr_bvecs, ACCT_PINNED);
+               if (imu->acct_pages)
+                       io_unaccount_mem(ctx, imu->acct_pages, ACCT_PINNED);
                kvfree(imu->bvec);
                imu->nr_bvecs = 0;
        }
@@ -8031,11 +7904,80 @@ static int io_copy_iov(struct io_ring_ctx *ctx, struct iovec *dst,
        return 0;
 }
 
+/*
+ * Not super efficient, but this is just a registration time. And we do cache
+ * the last compound head, so generally we'll only do a full search if we don't
+ * match that one.
+ *
+ * We check if the given compound head page has already been accounted, to
+ * avoid double accounting it. This allows us to account the full size of the
+ * page, not just the constituent pages of a huge page.
+ */
+static bool headpage_already_acct(struct io_ring_ctx *ctx, struct page **pages,
+                                 int nr_pages, struct page *hpage)
+{
+       int i, j;
+
+       /* check current page array */
+       for (i = 0; i < nr_pages; i++) {
+               if (!PageCompound(pages[i]))
+                       continue;
+               if (compound_head(pages[i]) == hpage)
+                       return true;
+       }
+
+       /* check previously registered pages */
+       for (i = 0; i < ctx->nr_user_bufs; i++) {
+               struct io_mapped_ubuf *imu = &ctx->user_bufs[i];
+
+               for (j = 0; j < imu->nr_bvecs; j++) {
+                       if (!PageCompound(imu->bvec[j].bv_page))
+                               continue;
+                       if (compound_head(imu->bvec[j].bv_page) == hpage)
+                               return true;
+               }
+       }
+
+       return false;
+}
+
+static int io_buffer_account_pin(struct io_ring_ctx *ctx, struct page **pages,
+                                int nr_pages, struct io_mapped_ubuf *imu,
+                                struct page **last_hpage)
+{
+       int i, ret;
+
+       for (i = 0; i < nr_pages; i++) {
+               if (!PageCompound(pages[i])) {
+                       imu->acct_pages++;
+               } else {
+                       struct page *hpage;
+
+                       hpage = compound_head(pages[i]);
+                       if (hpage == *last_hpage)
+                               continue;
+                       *last_hpage = hpage;
+                       if (headpage_already_acct(ctx, pages, i, hpage))
+                               continue;
+                       imu->acct_pages += page_size(hpage) >> PAGE_SHIFT;
+               }
+       }
+
+       if (!imu->acct_pages)
+               return 0;
+
+       ret = io_account_mem(ctx, imu->acct_pages, ACCT_PINNED);
+       if (ret)
+               imu->acct_pages = 0;
+       return ret;
+}
+
 static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg,
                                  unsigned nr_args)
 {
        struct vm_area_struct **vmas = NULL;
        struct page **pages = NULL;
+       struct page *last_hpage = NULL;
        int i, j, got_pages = 0;
        int ret = -EINVAL;
 
@@ -8078,10 +8020,6 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg,
                start = ubuf >> PAGE_SHIFT;
                nr_pages = end - start;
 
-               ret = io_account_mem(ctx, nr_pages, ACCT_PINNED);
-               if (ret)
-                       goto err;
-
                ret = 0;
                if (!pages || nr_pages > got_pages) {
                        kvfree(vmas);
@@ -8093,7 +8031,6 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg,
                                        GFP_KERNEL);
                        if (!pages || !vmas) {
                                ret = -ENOMEM;
-                               io_unaccount_mem(ctx, nr_pages, ACCT_PINNED);
                                goto err;
                        }
                        got_pages = nr_pages;
@@ -8102,10 +8039,8 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg,
                imu->bvec = kvmalloc_array(nr_pages, sizeof(struct bio_vec),
                                                GFP_KERNEL);
                ret = -ENOMEM;
-               if (!imu->bvec) {
-                       io_unaccount_mem(ctx, nr_pages, ACCT_PINNED);
+               if (!imu->bvec)
                        goto err;
-               }
 
                ret = 0;
                mmap_read_lock(current->mm);
@@ -8134,7 +8069,13 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg,
                         */
                        if (pret > 0)
                                unpin_user_pages(pages, pret);
-                       io_unaccount_mem(ctx, nr_pages, ACCT_PINNED);
+                       kvfree(imu->bvec);
+                       goto err;
+               }
+
+               ret = io_buffer_account_pin(ctx, pages, pret, imu, &last_hpage);
+               if (ret) {
+                       unpin_user_pages(pages, pret);
                        kvfree(imu->bvec);
                        goto err;
                }
@@ -8227,6 +8168,11 @@ static void io_ring_ctx_free(struct io_ring_ctx *ctx)
                ctx->mm_account = NULL;
        }
 
+#ifdef CONFIG_BLK_CGROUP
+       if (ctx->sqo_blkcg_css)
+               css_put(ctx->sqo_blkcg_css);
+#endif
+
        io_sqe_files_unregister(ctx);
        io_eventfd_unregister(ctx);
        io_destroy_buffers(ctx);
@@ -8601,27 +8547,24 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx,
  */
 static int io_uring_add_task_file(struct file *file)
 {
-       if (unlikely(!current->io_uring)) {
+       struct io_uring_task *tctx = current->io_uring;
+
+       if (unlikely(!tctx)) {
                int ret;
 
                ret = io_uring_alloc_task_context(current);
                if (unlikely(ret))
                        return ret;
+               tctx = current->io_uring;
        }
-       if (current->io_uring->last != file) {
-               XA_STATE(xas, &current->io_uring->xa, (unsigned long) file);
-               void *old;
+       if (tctx->last != file) {
+               void *old = xa_load(&tctx->xa, (unsigned long)file);
 
-               rcu_read_lock();
-               old = xas_load(&xas);
-               if (old != file) {
+               if (!old) {
                        get_file(file);
-                       xas_lock(&xas);
-                       xas_store(&xas, file);
-                       xas_unlock(&xas);
+                       xa_store(&tctx->xa, (unsigned long)file, file, GFP_KERNEL);
                }
-               rcu_read_unlock();
-               current->io_uring->last = file;
+               tctx->last = file;
        }
 
        return 0;
@@ -8633,27 +8576,17 @@ static int io_uring_add_task_file(struct file *file)
 static void io_uring_del_task_file(struct file *file)
 {
        struct io_uring_task *tctx = current->io_uring;
-       XA_STATE(xas, &tctx->xa, (unsigned long) file);
 
        if (tctx->last == file)
                tctx->last = NULL;
-
-       xas_lock(&xas);
-       file = xas_store(&xas, NULL);
-       xas_unlock(&xas);
-
+       file = xa_erase(&tctx->xa, (unsigned long)file);
        if (file)
                fput(file);
 }
 
 static void __io_uring_attempt_task_drop(struct file *file)
 {
-       XA_STATE(xas, &current->io_uring->xa, (unsigned long) file);
-       struct file *old;
-
-       rcu_read_lock();
-       old = xas_load(&xas);
-       rcu_read_unlock();
+       struct file *old = xa_load(&current->io_uring->xa, (unsigned long)file);
 
        if (old == file)
                io_uring_del_task_file(file);
@@ -8680,28 +8613,19 @@ static void io_uring_attempt_task_drop(struct file *file, bool exiting)
 void __io_uring_files_cancel(struct files_struct *files)
 {
        struct io_uring_task *tctx = current->io_uring;
-       XA_STATE(xas, &tctx->xa, 0);
+       struct file *file;
+       unsigned long index;
 
        /* make sure overflow events are dropped */
        tctx->in_idle = true;
 
-       do {
-               struct io_ring_ctx *ctx;
-               struct file *file;
-
-               xas_lock(&xas);
-               file = xas_next_entry(&xas, ULONG_MAX);
-               xas_unlock(&xas);
-
-               if (!file)
-                       break;
-
-               ctx = file->private_data;
+       xa_for_each(&tctx->xa, index, file) {
+               struct io_ring_ctx *ctx = file->private_data;
 
                io_uring_cancel_task_requests(ctx, files);
                if (files)
                        io_uring_del_task_file(file);
-       } while (1);
+       }
 }
 
 static inline bool io_uring_task_idle(struct io_uring_task *tctx)
@@ -8966,6 +8890,7 @@ static int io_uring_show_cred(int id, void *p, void *data)
 
 static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 {
+       struct io_sq_data *sq = NULL;
        bool has_lock;
        int i;
 
@@ -8977,6 +8902,11 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
         */
        has_lock = mutex_trylock(&ctx->uring_lock);
 
+       if (has_lock && (ctx->flags & IORING_SETUP_SQPOLL))
+               sq = ctx->sq_data;
+
+       seq_printf(m, "SqThread:\t%d\n", sq ? task_pid_nr(sq->thread) : -1);
+       seq_printf(m, "SqThreadCpu:\t%d\n", sq ? task_cpu(sq->thread) : -1);
        seq_printf(m, "UserFiles:\t%u\n", ctx->nr_user_files);
        for (i = 0; has_lock && i < ctx->nr_user_files; i++) {
                struct fixed_file_table *table;
@@ -9211,6 +9141,25 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p,
        mmgrab(current->mm);
        ctx->mm_account = current->mm;
 
+#ifdef CONFIG_BLK_CGROUP
+       /*
+        * The sq thread will belong to the original cgroup it was inited in.
+        * If the cgroup goes offline (e.g. disabling the io controller), then
+        * issued bios will be associated with the closest cgroup later in the
+        * block layer.
+        */
+       rcu_read_lock();
+       ctx->sqo_blkcg_css = blkcg_css();
+       ret = css_tryget_online(ctx->sqo_blkcg_css);
+       rcu_read_unlock();
+       if (!ret) {
+               /* don't init against a dying cgroup, have the user try again */
+               ctx->sqo_blkcg_css = NULL;
+               ret = -ENODEV;
+               goto err;
+       }
+#endif
+
        /*
         * Account memory _before_ installing the file descriptor. Once
         * the descriptor is installed, it can get closed at any time. Also
@@ -9497,11 +9446,19 @@ static int __io_uring_register(struct io_ring_ctx *ctx, unsigned opcode,
                 * after we've killed the percpu ref.
                 */
                mutex_unlock(&ctx->uring_lock);
-               ret = wait_for_completion_interruptible(&ctx->ref_comp);
+               do {
+                       ret = wait_for_completion_interruptible(&ctx->ref_comp);
+                       if (!ret)
+                               break;
+                       ret = io_run_task_work_sig();
+                       if (ret < 0)
+                               break;
+               } while (1);
+
                mutex_lock(&ctx->uring_lock);
+
                if (ret) {
                        percpu_ref_resurrect(&ctx->refs);
-                       ret = -EINTR;
                        goto out_quiesce;
                }
        }