io_uring: clean file_data access in files_register
[linux-2.6-microblaze.git] / fs / io_uring.c
index 546bc1f..c3ca82f 100644 (file)
@@ -80,6 +80,7 @@
 #include <linux/task_work.h>
 #include <linux/pagemap.h>
 #include <linux/io_uring.h>
+#include <linux/blk-cgroup.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/io_uring.h>
@@ -190,6 +191,7 @@ struct io_mapped_ubuf {
        size_t          len;
        struct          bio_vec *bvec;
        unsigned int    nr_bvecs;
+       unsigned long   acct_pages;
 };
 
 struct fixed_file_table {
@@ -299,8 +301,13 @@ struct io_ring_ctx {
        /* Only used for accounting purposes */
        struct mm_struct        *mm_account;
 
+#ifdef CONFIG_BLK_CGROUP
+       struct cgroup_subsys_state      *sqo_blkcg_css;
+#endif
+
        struct io_sq_data       *sq_data;       /* if using sq thread polling */
 
+       struct wait_queue_head  sqo_sq_wait;
        struct wait_queue_entry sqo_wait_entry;
        struct list_head        sqd_list;
 
@@ -427,13 +434,16 @@ struct io_cancel {
 
 struct io_timeout {
        struct file                     *file;
-       u64                             addr;
-       int                             flags;
        u32                             off;
        u32                             target_seq;
        struct list_head                list;
 };
 
+struct io_timeout_rem {
+       struct file                     *file;
+       u64                             addr;
+};
+
 struct io_rw {
        /* NOTE: kiocb has the file as the first member, so don't do it here */
        struct kiocb                    kiocb;
@@ -549,15 +559,6 @@ struct io_async_rw {
        struct wait_page_queue          wpq;
 };
 
-struct io_async_ctx {
-       union {
-               struct io_async_rw      rw;
-               struct io_async_msghdr  msg;
-               struct io_async_connect connect;
-               struct io_timeout_data  timeout;
-       };
-};
-
 enum {
        REQ_F_FIXED_FILE_BIT    = IOSQE_FIXED_FILE_BIT,
        REQ_F_IO_DRAIN_BIT      = IOSQE_IO_DRAIN_BIT,
@@ -646,6 +647,7 @@ struct io_kiocb {
                struct io_sync          sync;
                struct io_cancel        cancel;
                struct io_timeout       timeout;
+               struct io_timeout_rem   timeout_rem;
                struct io_connect       connect;
                struct io_sr_msg        sr_msg;
                struct io_open          open;
@@ -661,7 +663,8 @@ struct io_kiocb {
                struct io_completion    compl;
        };
 
-       struct io_async_ctx             *io;
+       /* opcode allocated if it needs to store data for async defer */
+       void                            *async_data;
        u8                              opcode;
        /* polled IO has completed */
        u8                              iopoll_completed;
@@ -729,8 +732,6 @@ struct io_submit_state {
 };
 
 struct io_op_def {
-       /* needs req->io allocated for deferral/async */
-       unsigned                async_ctx : 1;
        /* needs current->mm setup, does mm access */
        unsigned                needs_mm : 1;
        /* needs req->file assigned */
@@ -752,35 +753,49 @@ struct io_op_def {
        unsigned                pollout : 1;
        /* op supports buffer selection */
        unsigned                buffer_select : 1;
+       /* needs rlimit(RLIMIT_FSIZE) assigned */
        unsigned                needs_fsize : 1;
+       /* must always have async data allocated */
+       unsigned                needs_async_data : 1;
+       /* needs blkcg context, issues async io potentially */
+       unsigned                needs_blkcg : 1;
+       /* size of async data needed, if any */
+       unsigned short          async_size;
 };
 
-static const struct io_op_def io_op_defs[] = {
+static const struct io_op_def io_op_defs[] __read_mostly = {
        [IORING_OP_NOP] = {},
        [IORING_OP_READV] = {
-               .async_ctx              = 1,
                .needs_mm               = 1,
                .needs_file             = 1,
                .unbound_nonreg_file    = 1,
                .pollin                 = 1,
                .buffer_select          = 1,
+               .needs_async_data       = 1,
+               .needs_blkcg            = 1,
+               .async_size             = sizeof(struct io_async_rw),
        },
        [IORING_OP_WRITEV] = {
-               .async_ctx              = 1,
                .needs_mm               = 1,
                .needs_file             = 1,
                .hash_reg_file          = 1,
                .unbound_nonreg_file    = 1,
                .pollout                = 1,
                .needs_fsize            = 1,
+               .needs_async_data       = 1,
+               .needs_blkcg            = 1,
+               .async_size             = sizeof(struct io_async_rw),
        },
        [IORING_OP_FSYNC] = {
                .needs_file             = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_READ_FIXED] = {
                .needs_file             = 1,
                .unbound_nonreg_file    = 1,
                .pollin                 = 1,
+               .needs_blkcg            = 1,
+               .async_size             = sizeof(struct io_async_rw),
        },
        [IORING_OP_WRITE_FIXED] = {
                .needs_file             = 1,
@@ -788,6 +803,8 @@ static const struct io_op_def io_op_defs[] = {
                .unbound_nonreg_file    = 1,
                .pollout                = 1,
                .needs_fsize            = 1,
+               .needs_blkcg            = 1,
+               .async_size             = sizeof(struct io_async_rw),
        },
        [IORING_OP_POLL_ADD] = {
                .needs_file             = 1,
@@ -796,27 +813,33 @@ static const struct io_op_def io_op_defs[] = {
        [IORING_OP_POLL_REMOVE] = {},
        [IORING_OP_SYNC_FILE_RANGE] = {
                .needs_file             = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_SENDMSG] = {
-               .async_ctx              = 1,
                .needs_mm               = 1,
                .needs_file             = 1,
                .unbound_nonreg_file    = 1,
                .needs_fs               = 1,
                .pollout                = 1,
+               .needs_async_data       = 1,
+               .needs_blkcg            = 1,
+               .async_size             = sizeof(struct io_async_msghdr),
        },
        [IORING_OP_RECVMSG] = {
-               .async_ctx              = 1,
                .needs_mm               = 1,
                .needs_file             = 1,
                .unbound_nonreg_file    = 1,
                .needs_fs               = 1,
                .pollin                 = 1,
                .buffer_select          = 1,
+               .needs_async_data       = 1,
+               .needs_blkcg            = 1,
+               .async_size             = sizeof(struct io_async_msghdr),
        },
        [IORING_OP_TIMEOUT] = {
-               .async_ctx              = 1,
                .needs_mm               = 1,
+               .needs_async_data       = 1,
+               .async_size             = sizeof(struct io_timeout_data),
        },
        [IORING_OP_TIMEOUT_REMOVE] = {},
        [IORING_OP_ACCEPT] = {
@@ -828,28 +851,33 @@ static const struct io_op_def io_op_defs[] = {
        },
        [IORING_OP_ASYNC_CANCEL] = {},
        [IORING_OP_LINK_TIMEOUT] = {
-               .async_ctx              = 1,
                .needs_mm               = 1,
+               .needs_async_data       = 1,
+               .async_size             = sizeof(struct io_timeout_data),
        },
        [IORING_OP_CONNECT] = {
-               .async_ctx              = 1,
                .needs_mm               = 1,
                .needs_file             = 1,
                .unbound_nonreg_file    = 1,
                .pollout                = 1,
+               .needs_async_data       = 1,
+               .async_size             = sizeof(struct io_async_connect),
        },
        [IORING_OP_FALLOCATE] = {
                .needs_file             = 1,
                .needs_fsize            = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_OPENAT] = {
                .file_table             = 1,
                .needs_fs               = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_CLOSE] = {
                .needs_file             = 1,
                .needs_file_no_error    = 1,
                .file_table             = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_FILES_UPDATE] = {
                .needs_mm               = 1,
@@ -859,6 +887,7 @@ static const struct io_op_def io_op_defs[] = {
                .needs_mm               = 1,
                .needs_fs               = 1,
                .file_table             = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_READ] = {
                .needs_mm               = 1,
@@ -866,6 +895,8 @@ static const struct io_op_def io_op_defs[] = {
                .unbound_nonreg_file    = 1,
                .pollin                 = 1,
                .buffer_select          = 1,
+               .needs_blkcg            = 1,
+               .async_size             = sizeof(struct io_async_rw),
        },
        [IORING_OP_WRITE] = {
                .needs_mm               = 1,
@@ -873,18 +904,23 @@ static const struct io_op_def io_op_defs[] = {
                .unbound_nonreg_file    = 1,
                .pollout                = 1,
                .needs_fsize            = 1,
+               .needs_blkcg            = 1,
+               .async_size             = sizeof(struct io_async_rw),
        },
        [IORING_OP_FADVISE] = {
                .needs_file             = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_MADVISE] = {
                .needs_mm               = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_SEND] = {
                .needs_mm               = 1,
                .needs_file             = 1,
                .unbound_nonreg_file    = 1,
                .pollout                = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_RECV] = {
                .needs_mm               = 1,
@@ -892,10 +928,12 @@ static const struct io_op_def io_op_defs[] = {
                .unbound_nonreg_file    = 1,
                .pollin                 = 1,
                .buffer_select          = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_OPENAT2] = {
                .file_table             = 1,
                .needs_fs               = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_EPOLL_CTL] = {
                .unbound_nonreg_file    = 1,
@@ -905,6 +943,7 @@ static const struct io_op_def io_op_defs[] = {
                .needs_file             = 1,
                .hash_reg_file          = 1,
                .unbound_nonreg_file    = 1,
+               .needs_blkcg            = 1,
        },
        [IORING_OP_PROVIDE_BUFFERS] = {},
        [IORING_OP_REMOVE_BUFFERS] = {},
@@ -932,13 +971,10 @@ static void io_queue_linked_timeout(struct io_kiocb *req);
 static int __io_sqe_files_update(struct io_ring_ctx *ctx,
                                 struct io_uring_files_update *ip,
                                 unsigned nr_args);
-static int io_prep_work_files(struct io_kiocb *req);
 static void __io_clean_op(struct io_kiocb *req);
-static int io_file_get(struct io_submit_state *state, struct io_kiocb *req,
-                      int fd, struct file **out_file, bool fixed);
-static void __io_queue_sqe(struct io_kiocb *req,
-                          const struct io_uring_sqe *sqe,
-                          struct io_comp_state *cs);
+static struct file *io_file_get(struct io_submit_state *state,
+                               struct io_kiocb *req, int fd, bool fixed);
+static void __io_queue_sqe(struct io_kiocb *req, struct io_comp_state *cs);
 static void io_file_put_work(struct work_struct *work);
 
 static ssize_t io_import_iovec(int rw, struct io_kiocb *req,
@@ -950,7 +986,7 @@ static int io_setup_async_rw(struct io_kiocb *req, const struct iovec *iovec,
 
 static struct kmem_cache *req_cachep;
 
-static const struct file_operations io_uring_fops;
+static const struct file_operations io_uring_fops __read_mostly;
 
 struct sock *io_uring_get_socket(struct file *file)
 {
@@ -1003,6 +1039,26 @@ static int io_sq_thread_acquire_mm(struct io_ring_ctx *ctx,
        return __io_sq_thread_acquire_mm(ctx);
 }
 
+static void io_sq_thread_associate_blkcg(struct io_ring_ctx *ctx,
+                                        struct cgroup_subsys_state **cur_css)
+
+{
+#ifdef CONFIG_BLK_CGROUP
+       /* puts the old one when swapping */
+       if (*cur_css != ctx->sqo_blkcg_css) {
+               kthread_associate_blkcg(ctx->sqo_blkcg_css);
+               *cur_css = ctx->sqo_blkcg_css;
+       }
+#endif
+}
+
+static void io_sq_thread_unassociate_blkcg(void)
+{
+#ifdef CONFIG_BLK_CGROUP
+       kthread_associate_blkcg(NULL);
+#endif
+}
+
 static inline void req_set_fail_links(struct io_kiocb *req)
 {
        if ((req->flags & (REQ_F_LINK | REQ_F_HARDLINK)) == REQ_F_LINK)
@@ -1072,6 +1128,7 @@ static struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p)
                goto err;
 
        ctx->flags = p->flags;
+       init_waitqueue_head(&ctx->sqo_sq_wait);
        INIT_LIST_HEAD(&ctx->sqd_list);
        init_waitqueue_head(&ctx->cq_wait);
        INIT_LIST_HEAD(&ctx->cq_overflow_list);
@@ -1139,6 +1196,10 @@ static bool io_req_clean_work(struct io_kiocb *req)
                mmdrop(req->work.mm);
                req->work.mm = NULL;
        }
+#ifdef CONFIG_BLK_CGROUP
+       if (req->work.blkcg_css)
+               css_put(req->work.blkcg_css);
+#endif
        if (req->work.creds) {
                put_cred(req->work.creds);
                req->work.creds = NULL;
@@ -1164,20 +1225,45 @@ static bool io_req_clean_work(struct io_kiocb *req)
 static void io_prep_async_work(struct io_kiocb *req)
 {
        const struct io_op_def *def = &io_op_defs[req->opcode];
+       struct io_ring_ctx *ctx = req->ctx;
 
        io_req_init_async(req);
 
        if (req->flags & REQ_F_ISREG) {
-               if (def->hash_reg_file || (req->ctx->flags & IORING_SETUP_IOPOLL))
+               if (def->hash_reg_file || (ctx->flags & IORING_SETUP_IOPOLL))
                        io_wq_hash_work(&req->work, file_inode(req->file));
        } else {
                if (def->unbound_nonreg_file)
                        req->work.flags |= IO_WQ_WORK_UNBOUND;
        }
+       if (!req->work.files && io_op_defs[req->opcode].file_table &&
+           !(req->flags & REQ_F_NO_FILE_TABLE)) {
+               req->work.files = get_files_struct(current);
+               get_nsproxy(current->nsproxy);
+               req->work.nsproxy = current->nsproxy;
+               req->flags |= REQ_F_INFLIGHT;
+
+               spin_lock_irq(&ctx->inflight_lock);
+               list_add(&req->inflight_entry, &ctx->inflight_list);
+               spin_unlock_irq(&ctx->inflight_lock);
+       }
        if (!req->work.mm && def->needs_mm) {
                mmgrab(current->mm);
                req->work.mm = current->mm;
        }
+#ifdef CONFIG_BLK_CGROUP
+       if (!req->work.blkcg_css && def->needs_blkcg) {
+               rcu_read_lock();
+               req->work.blkcg_css = blkcg_css();
+               /*
+                * This should be rare, either the cgroup is dying or the task
+                * is moving cgroups. Just punt to root for the handful of ios.
+                */
+               if (!css_tryget_online(req->work.blkcg_css))
+                       req->work.blkcg_css = NULL;
+               rcu_read_unlock();
+       }
+#endif
        if (!req->work.creds)
                req->work.creds = get_current_cred();
        if (!req->work.fs && def->needs_fs) {
@@ -1231,9 +1317,10 @@ static void io_queue_async_work(struct io_kiocb *req)
 
 static void io_kill_timeout(struct io_kiocb *req)
 {
+       struct io_timeout_data *io = req->async_data;
        int ret;
 
-       ret = hrtimer_try_to_cancel(&req->io->timeout.timer);
+       ret = hrtimer_try_to_cancel(&io->timer);
        if (ret != -1) {
                atomic_set(&req->ctx->cq_timeouts,
                        atomic_read(&req->ctx->cq_timeouts) + 1);
@@ -1324,6 +1411,13 @@ static void io_commit_cqring(struct io_ring_ctx *ctx)
                __io_queue_deferred(ctx);
 }
 
+static inline bool io_sqring_full(struct io_ring_ctx *ctx)
+{
+       struct io_rings *r = ctx->rings;
+
+       return READ_ONCE(r->sq.tail) - ctx->cached_sq_head == r->sq_ring_entries;
+}
+
 static struct io_uring_cqe *io_get_cqring(struct io_ring_ctx *ctx)
 {
        struct io_rings *rings = ctx->rings;
@@ -1569,10 +1663,8 @@ static struct io_kiocb *io_get_fallback_req(struct io_ring_ctx *ctx)
 static struct io_kiocb *io_alloc_req(struct io_ring_ctx *ctx,
                                     struct io_submit_state *state)
 {
-       gfp_t gfp = GFP_KERNEL | __GFP_NOWARN;
-       struct io_kiocb *req;
-
        if (!state->free_reqs) {
+               gfp_t gfp = GFP_KERNEL | __GFP_NOWARN;
                size_t sz;
                int ret;
 
@@ -1589,14 +1681,11 @@ static struct io_kiocb *io_alloc_req(struct io_ring_ctx *ctx,
                                goto fallback;
                        ret = 1;
                }
-               state->free_reqs = ret - 1;
-               req = state->reqs[ret - 1];
-       } else {
-               state->free_reqs--;
-               req = state->reqs[state->free_reqs];
+               state->free_reqs = ret;
        }
 
-       return req;
+       state->free_reqs--;
+       return state->reqs[state->free_reqs];
 fallback:
        return io_get_fallback_req(ctx);
 }
@@ -1614,8 +1703,8 @@ static bool io_dismantle_req(struct io_kiocb *req)
 {
        io_clean_op(req);
 
-       if (req->io)
-               kfree(req->io);
+       if (req->async_data)
+               kfree(req->async_data);
        if (req->file)
                io_put_file(req, req->file, (req->flags & REQ_F_FIXED_FILE));
 
@@ -1674,10 +1763,11 @@ static void __io_free_req(struct io_kiocb *req)
 
 static bool io_link_cancel_timeout(struct io_kiocb *req)
 {
+       struct io_timeout_data *io = req->async_data;
        struct io_ring_ctx *ctx = req->ctx;
        int ret;
 
-       ret = hrtimer_try_to_cancel(&req->io->timeout.timer);
+       ret = hrtimer_try_to_cancel(&io->timer);
        if (ret != -1) {
                io_cqring_fill_event(req, -ECANCELED);
                io_commit_cqring(ctx);
@@ -1811,8 +1901,7 @@ static struct io_kiocb *io_req_find_next(struct io_kiocb *req)
        return __io_req_find_next(req);
 }
 
-static int io_req_task_work_add(struct io_kiocb *req, struct callback_head *cb,
-                               bool twa_signal_ok)
+static int io_req_task_work_add(struct io_kiocb *req, bool twa_signal_ok)
 {
        struct task_struct *tsk = req->task;
        struct io_ring_ctx *ctx = req->ctx;
@@ -1831,7 +1920,7 @@ static int io_req_task_work_add(struct io_kiocb *req, struct callback_head *cb,
        if (!(ctx->flags & IORING_SETUP_SQPOLL) && twa_signal_ok)
                notify = TWA_SIGNAL;
 
-       ret = task_work_add(tsk, cb, notify);
+       ret = task_work_add(tsk, &req->task_work, notify);
        if (!ret)
                wake_up_process(tsk);
 
@@ -1867,7 +1956,7 @@ static void __io_req_task_submit(struct io_kiocb *req)
 
        if (!__io_sq_thread_acquire_mm(ctx)) {
                mutex_lock(&ctx->uring_lock);
-               __io_queue_sqe(req, NULL, NULL);
+               __io_queue_sqe(req, NULL);
                mutex_unlock(&ctx->uring_lock);
        } else {
                __io_req_task_cancel(req, -EFAULT);
@@ -1890,7 +1979,7 @@ static void io_req_task_queue(struct io_kiocb *req)
        init_task_work(&req->task_work, io_req_task_submit);
        percpu_ref_get(&req->ctx->refs);
 
-       ret = io_req_task_work_add(req, &req->task_work, true);
+       ret = io_req_task_work_add(req, true);
        if (unlikely(ret)) {
                struct task_struct *tsk;
 
@@ -2359,7 +2448,7 @@ static bool io_resubmit_prep(struct io_kiocb *req, int error)
                goto end_req;
        }
 
-       if (!req->io) {
+       if (!req->async_data) {
                ret = io_import_iovec(rw, req, &iovec, &iter, false);
                if (ret < 0)
                        goto end_req;
@@ -2496,7 +2585,6 @@ static struct file *__io_file_get(struct io_submit_state *state, int fd)
        if (state->file) {
                if (state->fd == fd) {
                        state->has_refs--;
-                       state->ios_left--;
                        return state->file;
                }
                __io_state_file_put(state);
@@ -2506,8 +2594,7 @@ static struct file *__io_file_get(struct io_submit_state *state, int fd)
                return NULL;
 
        state->fd = fd;
-       state->ios_left--;
-       state->has_refs = state->ios_left;
+       state->has_refs = state->ios_left - 1;
        return state->file;
 }
 
@@ -2556,8 +2643,7 @@ static bool io_file_supports_async(struct file *file, int rw)
        return file->f_op->write_iter != NULL;
 }
 
-static int io_prep_rw(struct io_kiocb *req, const struct io_uring_sqe *sqe,
-                     bool force_nonblock)
+static int io_prep_rw(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
        struct io_ring_ctx *ctx = req->ctx;
        struct kiocb *kiocb = &req->rw.kiocb;
@@ -2592,9 +2678,6 @@ static int io_prep_rw(struct io_kiocb *req, const struct io_uring_sqe *sqe,
        if (kiocb->ki_flags & IOCB_NOWAIT)
                req->flags |= REQ_F_NOWAIT;
 
-       if (force_nonblock)
-               kiocb->ki_flags |= IOCB_NOWAIT;
-
        if (ctx->flags & IORING_SETUP_IOPOLL) {
                if (!(kiocb->ki_flags & IOCB_DIRECT) ||
                    !kiocb->ki_filp->f_op->iopoll)
@@ -2640,13 +2723,14 @@ static void kiocb_done(struct kiocb *kiocb, ssize_t ret,
                       struct io_comp_state *cs)
 {
        struct io_kiocb *req = container_of(kiocb, struct io_kiocb, rw.kiocb);
+       struct io_async_rw *io = req->async_data;
 
        /* add previously done IO, if any */
-       if (req->io && req->io->rw.bytes_done > 0) {
+       if (io && io->bytes_done > 0) {
                if (ret < 0)
-                       ret = req->io->rw.bytes_done;
+                       ret = io->bytes_done;
                else
-                       ret += req->io->rw.bytes_done;
+                       ret += io->bytes_done;
        }
 
        if (req->flags & REQ_F_CUR_POS)
@@ -2663,18 +2747,12 @@ static ssize_t io_import_fixed(struct io_kiocb *req, int rw,
        struct io_ring_ctx *ctx = req->ctx;
        size_t len = req->rw.len;
        struct io_mapped_ubuf *imu;
-       u16 index, buf_index;
+       u16 index, buf_index = req->buf_index;
        size_t offset;
        u64 buf_addr;
 
-       /* attempt to use fixed buffers without having provided iovecs */
-       if (unlikely(!ctx->user_bufs))
-               return -EFAULT;
-
-       buf_index = req->buf_index;
        if (unlikely(buf_index >= ctx->nr_user_bufs))
                return -EFAULT;
-
        index = array_index_nospec(buf_index, ctx->nr_user_bufs);
        imu = &ctx->user_bufs[index];
        buf_addr = req->rw.addr;
@@ -2926,15 +3004,17 @@ static ssize_t io_import_iovec(int rw, struct io_kiocb *req,
                               struct iovec **iovec, struct iov_iter *iter,
                               bool needs_lock)
 {
-       if (!req->io)
+       struct io_async_rw *iorw = req->async_data;
+
+       if (!iorw)
                return __io_import_iovec(rw, req, iovec, iter, needs_lock);
        *iovec = NULL;
-       return iov_iter_count(&req->io->rw.iter);
+       return iov_iter_count(&iorw->iter);
 }
 
 static inline loff_t *io_kiocb_ppos(struct kiocb *kiocb)
 {
-       return kiocb->ki_filp->f_mode & FMODE_STREAM ? NULL : &kiocb->ki_pos;
+       return (kiocb->ki_filp->f_mode & FMODE_STREAM) ? NULL : &kiocb->ki_pos;
 }
 
 /*
@@ -2998,10 +3078,10 @@ static ssize_t loop_rw_iter(int rw, struct file *file, struct kiocb *kiocb,
 static void io_req_map_rw(struct io_kiocb *req, const struct iovec *iovec,
                          const struct iovec *fast_iov, struct iov_iter *iter)
 {
-       struct io_async_rw *rw = &req->io->rw;
+       struct io_async_rw *rw = req->async_data;
 
        memcpy(&rw->iter, iter, sizeof(*iter));
-       rw->free_iovec = NULL;
+       rw->free_iovec = iovec;
        rw->bytes_done = 0;
        /* can only be fixed buffers, no need to do anything */
        if (iter->type == ITER_BVEC)
@@ -3018,33 +3098,33 @@ static void io_req_map_rw(struct io_kiocb *req, const struct iovec *iovec,
                        memcpy(rw->fast_iov + iov_off, fast_iov + iov_off,
                               sizeof(struct iovec) * iter->nr_segs);
        } else {
-               rw->free_iovec = iovec;
                req->flags |= REQ_F_NEED_CLEANUP;
        }
 }
 
-static inline int __io_alloc_async_ctx(struct io_kiocb *req)
+static inline int __io_alloc_async_data(struct io_kiocb *req)
 {
-       req->io = kmalloc(sizeof(*req->io), GFP_KERNEL);
-       return req->io == NULL;
+       WARN_ON_ONCE(!io_op_defs[req->opcode].async_size);
+       req->async_data = kmalloc(io_op_defs[req->opcode].async_size, GFP_KERNEL);
+       return req->async_data == NULL;
 }
 
-static int io_alloc_async_ctx(struct io_kiocb *req)
+static int io_alloc_async_data(struct io_kiocb *req)
 {
-       if (!io_op_defs[req->opcode].async_ctx)
+       if (!io_op_defs[req->opcode].needs_async_data)
                return 0;
 
-       return  __io_alloc_async_ctx(req);
+       return  __io_alloc_async_data(req);
 }
 
 static int io_setup_async_rw(struct io_kiocb *req, const struct iovec *iovec,
                             const struct iovec *fast_iov,
                             struct iov_iter *iter, bool force)
 {
-       if (!force && !io_op_defs[req->opcode].async_ctx)
+       if (!force && !io_op_defs[req->opcode].needs_async_data)
                return 0;
-       if (!req->io) {
-               if (__io_alloc_async_ctx(req))
+       if (!req->async_data) {
+               if (__io_alloc_async_data(req))
                        return -ENOMEM;
 
                io_req_map_rw(req, iovec, fast_iov, iter);
@@ -3052,29 +3132,28 @@ static int io_setup_async_rw(struct io_kiocb *req, const struct iovec *iovec,
        return 0;
 }
 
-static inline int io_rw_prep_async(struct io_kiocb *req, int rw,
-                                  bool force_nonblock)
+static inline int io_rw_prep_async(struct io_kiocb *req, int rw)
 {
-       struct io_async_rw *iorw = &req->io->rw;
-       struct iovec *iov;
+       struct io_async_rw *iorw = req->async_data;
+       struct iovec *iov = iorw->fast_iov;
        ssize_t ret;
 
-       iorw->iter.iov = iov = iorw->fast_iov;
-       ret = __io_import_iovec(rw, req, &iov, &iorw->iter, !force_nonblock);
+       ret = __io_import_iovec(rw, req, &iov, &iorw->iter, false);
        if (unlikely(ret < 0))
                return ret;
 
-       iorw->iter.iov = iov;
-       io_req_map_rw(req, iorw->iter.iov, iorw->fast_iov, &iorw->iter);
+       iorw->bytes_done = 0;
+       iorw->free_iovec = iov;
+       if (iov)
+               req->flags |= REQ_F_NEED_CLEANUP;
        return 0;
 }
 
-static int io_read_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe,
-                       bool force_nonblock)
+static int io_read_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
        ssize_t ret;
 
-       ret = io_prep_rw(req, sqe, force_nonblock);
+       ret = io_prep_rw(req, sqe);
        if (ret)
                return ret;
 
@@ -3082,9 +3161,9 @@ static int io_read_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe,
                return -EBADF;
 
        /* either don't need iovec imported or already have it */
-       if (!req->io || req->flags & REQ_F_NEED_CLEANUP)
+       if (!req->async_data)
                return 0;
-       return io_rw_prep_async(req, READ, force_nonblock);
+       return io_rw_prep_async(req, READ);
 }
 
 /*
@@ -3118,7 +3197,7 @@ static int io_async_buf_func(struct wait_queue_entry *wait, unsigned mode,
 
        /* submit ref gets dropped, acquire a new one */
        refcount_inc(&req->refs);
-       ret = io_req_task_work_add(req, &req->task_work, true);
+       ret = io_req_task_work_add(req, true);
        if (unlikely(ret)) {
                struct task_struct *tsk;
 
@@ -3145,7 +3224,8 @@ static int io_async_buf_func(struct wait_queue_entry *wait, unsigned mode,
  */
 static bool io_rw_should_retry(struct io_kiocb *req)
 {
-       struct wait_page_queue *wait = &req->io->rw.wpq;
+       struct io_async_rw *rw = req->async_data;
+       struct wait_page_queue *wait = &rw->wpq;
        struct kiocb *kiocb = &req->rw.kiocb;
 
        /* never retry for NOWAIT, we just complete with -EAGAIN */
@@ -3189,12 +3269,13 @@ static int io_read(struct io_kiocb *req, bool force_nonblock,
        struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs;
        struct kiocb *kiocb = &req->rw.kiocb;
        struct iov_iter __iter, *iter = &__iter;
+       struct io_async_rw *rw = req->async_data;
        ssize_t io_size, ret, ret2;
        size_t iov_count;
        bool no_async;
 
-       if (req->io)
-               iter = &req->io->rw.iter;
+       if (rw)
+               iter = &rw->iter;
 
        ret = io_import_iovec(READ, req, &iovec, iter, !force_nonblock);
        if (ret < 0)
@@ -3207,6 +3288,9 @@ static int io_read(struct io_kiocb *req, bool force_nonblock,
        /* Ensure we clear previously set non-block flag */
        if (!force_nonblock)
                kiocb->ki_flags &= ~IOCB_NOWAIT;
+       else
+               kiocb->ki_flags |= IOCB_NOWAIT;
+
 
        /* If the file doesn't support async, just async punt */
        no_async = force_nonblock && !io_file_supports_async(req->file, READ);
@@ -3254,12 +3338,13 @@ copy_iov:
        }
        if (no_async)
                return -EAGAIN;
+       rw = req->async_data;
        /* it's copied and will be cleaned with ->io */
        iovec = NULL;
        /* now use our persistent iterator, if we aren't already */
-       iter = &req->io->rw.iter;
+       iter = &rw->iter;
 retry:
-       req->io->rw.bytes_done += ret;
+       rw->bytes_done += ret;
        /* if we can retry, do so with the callbacks armed */
        if (!io_rw_should_retry(req)) {
                kiocb->ki_flags &= ~IOCB_WAITQ;
@@ -3290,12 +3375,11 @@ out_free:
        return ret;
 }
 
-static int io_write_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe,
-                        bool force_nonblock)
+static int io_write_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
        ssize_t ret;
 
-       ret = io_prep_rw(req, sqe, force_nonblock);
+       ret = io_prep_rw(req, sqe);
        if (ret)
                return ret;
 
@@ -3303,9 +3387,9 @@ static int io_write_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe,
                return -EBADF;
 
        /* either don't need iovec imported or already have it */
-       if (!req->io || req->flags & REQ_F_NEED_CLEANUP)
+       if (!req->async_data)
                return 0;
-       return io_rw_prep_async(req, WRITE, force_nonblock);
+       return io_rw_prep_async(req, WRITE);
 }
 
 static int io_write(struct io_kiocb *req, bool force_nonblock,
@@ -3314,11 +3398,12 @@ static int io_write(struct io_kiocb *req, bool force_nonblock,
        struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs;
        struct kiocb *kiocb = &req->rw.kiocb;
        struct iov_iter __iter, *iter = &__iter;
+       struct io_async_rw *rw = req->async_data;
        size_t iov_count;
        ssize_t ret, ret2, io_size;
 
-       if (req->io)
-               iter = &req->io->rw.iter;
+       if (rw)
+               iter = &rw->iter;
 
        ret = io_import_iovec(WRITE, req, &iovec, iter, !force_nonblock);
        if (ret < 0)
@@ -3329,7 +3414,9 @@ static int io_write(struct io_kiocb *req, bool force_nonblock,
 
        /* Ensure we clear previously set non-block flag */
        if (!force_nonblock)
-               req->rw.kiocb.ki_flags &= ~IOCB_NOWAIT;
+               kiocb->ki_flags &= ~IOCB_NOWAIT;
+       else
+               kiocb->ki_flags |= IOCB_NOWAIT;
 
        /* If the file doesn't support async, just async punt */
        if (force_nonblock && !io_file_supports_async(req->file, WRITE))
@@ -3401,10 +3488,7 @@ static int __io_splice_prep(struct io_kiocb *req,
 {
        struct io_splice* sp = &req->splice;
        unsigned int valid_flags = SPLICE_F_FD_IN_FIXED | SPLICE_F_ALL;
-       int ret;
 
-       if (req->flags & REQ_F_NEED_CLEANUP)
-               return 0;
        if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
                return -EINVAL;
 
@@ -3415,10 +3499,10 @@ static int __io_splice_prep(struct io_kiocb *req,
        if (unlikely(sp->flags & ~valid_flags))
                return -EINVAL;
 
-       ret = io_file_get(NULL, req, READ_ONCE(sqe->splice_fd_in), &sp->file_in,
-                         (sp->flags & SPLICE_F_FD_IN_FIXED));
-       if (ret)
-               return ret;
+       sp->file_in = io_file_get(NULL, req, READ_ONCE(sqe->splice_fd_in),
+                                 (sp->flags & SPLICE_F_FD_IN_FIXED));
+       if (!sp->file_in)
+               return -EBADF;
        req->flags |= REQ_F_NEED_CLEANUP;
 
        if (!S_ISREG(file_inode(sp->file_in)->i_mode)) {
@@ -3614,8 +3698,6 @@ static int io_openat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 
        if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL|IORING_SETUP_SQPOLL)))
                return -EINVAL;
-       if (req->flags & REQ_F_NEED_CLEANUP)
-               return 0;
        mode = READ_ONCE(sqe->len);
        flags = READ_ONCE(sqe->open_flags);
        req->open.how = build_open_how(flags, mode);
@@ -3630,8 +3712,6 @@ static int io_openat2_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 
        if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL|IORING_SETUP_SQPOLL)))
                return -EINVAL;
-       if (req->flags & REQ_F_NEED_CLEANUP)
-               return 0;
        how = u64_to_user_ptr(READ_ONCE(sqe->addr2));
        len = READ_ONCE(sqe->len);
        if (len < OPEN_HOW_SIZE_VER0)
@@ -4095,15 +4175,18 @@ static int io_sync_file_range(struct io_kiocb *req, bool force_nonblock)
 static int io_setup_async_msg(struct io_kiocb *req,
                              struct io_async_msghdr *kmsg)
 {
-       if (req->io)
+       struct io_async_msghdr *async_msg = req->async_data;
+
+       if (async_msg)
                return -EAGAIN;
-       if (io_alloc_async_ctx(req)) {
+       if (io_alloc_async_data(req)) {
                if (kmsg->iov != kmsg->fast_iov)
                        kfree(kmsg->iov);
                return -ENOMEM;
        }
+       async_msg = req->async_data;
        req->flags |= REQ_F_NEED_CLEANUP;
-       memcpy(&req->io->msg, kmsg, sizeof(*kmsg));
+       memcpy(async_msg, kmsg, sizeof(*kmsg));
        return -EAGAIN;
 }
 
@@ -4118,8 +4201,8 @@ static int io_sendmsg_copy_hdr(struct io_kiocb *req,
 
 static int io_sendmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
+       struct io_async_msghdr *async_msg = req->async_data;
        struct io_sr_msg *sr = &req->sr_msg;
-       struct io_async_ctx *io = req->io;
        int ret;
 
        if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
@@ -4134,13 +4217,9 @@ static int io_sendmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
                sr->msg_flags |= MSG_CMSG_COMPAT;
 #endif
 
-       if (!io || req->opcode == IORING_OP_SEND)
-               return 0;
-       /* iovec is already imported */
-       if (req->flags & REQ_F_NEED_CLEANUP)
+       if (!async_msg || !io_op_defs[req->opcode].needs_async_data)
                return 0;
-
-       ret = io_sendmsg_copy_hdr(req, &io->msg);
+       ret = io_sendmsg_copy_hdr(req, async_msg);
        if (!ret)
                req->flags |= REQ_F_NEED_CLEANUP;
        return ret;
@@ -4158,9 +4237,9 @@ static int io_sendmsg(struct io_kiocb *req, bool force_nonblock,
        if (unlikely(!sock))
                return ret;
 
-       if (req->io) {
-               kmsg = &req->io->msg;
-               kmsg->msg.msg_name = &req->io->msg.addr;
+       if (req->async_data) {
+               kmsg = req->async_data;
+               kmsg->msg.msg_name = &kmsg->addr;
                /* if iov is set, it's allocated already */
                if (!kmsg->iov)
                        kmsg->iov = kmsg->fast_iov;
@@ -4209,7 +4288,7 @@ static int io_send(struct io_kiocb *req, bool force_nonblock,
 
        ret = import_single_range(WRITE, sr->buf, sr->len, &iov, &msg.msg_iter);
        if (unlikely(ret))
-               return ret;;
+               return ret;
 
        msg.msg_name = NULL;
        msg.msg_control = NULL;
@@ -4347,8 +4426,8 @@ static inline unsigned int io_put_recv_kbuf(struct io_kiocb *req)
 static int io_recvmsg_prep(struct io_kiocb *req,
                           const struct io_uring_sqe *sqe)
 {
+       struct io_async_msghdr *async_msg = req->async_data;
        struct io_sr_msg *sr = &req->sr_msg;
-       struct io_async_ctx *io = req->io;
        int ret;
 
        if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
@@ -4364,13 +4443,9 @@ static int io_recvmsg_prep(struct io_kiocb *req,
                sr->msg_flags |= MSG_CMSG_COMPAT;
 #endif
 
-       if (!io || req->opcode == IORING_OP_RECV)
-               return 0;
-       /* iovec is already imported */
-       if (req->flags & REQ_F_NEED_CLEANUP)
+       if (!async_msg || !io_op_defs[req->opcode].needs_async_data)
                return 0;
-
-       ret = io_recvmsg_copy_hdr(req, &io->msg);
+       ret = io_recvmsg_copy_hdr(req, async_msg);
        if (!ret)
                req->flags |= REQ_F_NEED_CLEANUP;
        return ret;
@@ -4389,9 +4464,9 @@ static int io_recvmsg(struct io_kiocb *req, bool force_nonblock,
        if (unlikely(!sock))
                return ret;
 
-       if (req->io) {
-               kmsg = &req->io->msg;
-               kmsg->msg.msg_name = &req->io->msg.addr;
+       if (req->async_data) {
+               kmsg = req->async_data;
+               kmsg->msg.msg_name = &kmsg->addr;
                /* if iov is set, it's allocated already */
                if (!kmsg->iov)
                        kmsg->iov = kmsg->fast_iov;
@@ -4533,7 +4608,7 @@ static int io_accept(struct io_kiocb *req, bool force_nonblock,
 static int io_connect_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
        struct io_connect *conn = &req->connect;
-       struct io_async_ctx *io = req->io;
+       struct io_async_connect *io = req->async_data;
 
        if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL|IORING_SETUP_SQPOLL)))
                return -EINVAL;
@@ -4547,22 +4622,22 @@ static int io_connect_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
                return 0;
 
        return move_addr_to_kernel(conn->addr, conn->addr_len,
-                                       &io->connect.address);
+                                       &io->address);
 }
 
 static int io_connect(struct io_kiocb *req, bool force_nonblock,
                      struct io_comp_state *cs)
 {
-       struct io_async_ctx __io, *io;
+       struct io_async_connect __io, *io;
        unsigned file_flags;
        int ret;
 
-       if (req->io) {
-               io = req->io;
+       if (req->async_data) {
+               io = req->async_data;
        } else {
                ret = move_addr_to_kernel(req->connect.addr,
                                                req->connect.addr_len,
-                                               &__io.connect.address);
+                                               &__io.address);
                if (ret)
                        goto out;
                io = &__io;
@@ -4570,16 +4645,17 @@ static int io_connect(struct io_kiocb *req, bool force_nonblock,
 
        file_flags = force_nonblock ? O_NONBLOCK : 0;
 
-       ret = __sys_connect_file(req->file, &io->connect.address,
+       ret = __sys_connect_file(req->file, &io->address,
                                        req->connect.addr_len, file_flags);
        if ((ret == -EAGAIN || ret == -EINPROGRESS) && force_nonblock) {
-               if (req->io)
+               if (req->async_data)
                        return -EAGAIN;
-               if (io_alloc_async_ctx(req)) {
+               if (io_alloc_async_data(req)) {
                        ret = -ENOMEM;
                        goto out;
                }
-               memcpy(&req->io->connect, &__io.connect, sizeof(__io.connect));
+               io = req->async_data;
+               memcpy(req->async_data, &__io, sizeof(__io));
                return -EAGAIN;
        }
        if (ret == -ERESTARTSYS)
@@ -4687,7 +4763,7 @@ static int __io_async_wake(struct io_kiocb *req, struct io_poll_iocb *poll,
         * of executing it. We can't safely execute it anyway, as we may not
         * have the needed state needed for it anyway.
         */
-       ret = io_req_task_work_add(req, &req->task_work, twa_signal_ok);
+       ret = io_req_task_work_add(req, twa_signal_ok);
        if (unlikely(ret)) {
                struct task_struct *tsk;
 
@@ -4721,9 +4797,9 @@ static bool io_poll_rewait(struct io_kiocb *req, struct io_poll_iocb *poll)
 
 static struct io_poll_iocb *io_poll_get_double(struct io_kiocb *req)
 {
-       /* pure poll stashes this in ->io, poll driven retry elsewhere */
+       /* pure poll stashes this in ->async_data, poll driven retry elsewhere */
        if (req->opcode == IORING_OP_POLL_ADD)
-               return (struct io_poll_iocb *) req->io;
+               return req->async_data;
        return req->apoll->double_poll;
 }
 
@@ -5166,7 +5242,7 @@ static void io_poll_queue_proc(struct file *file, struct wait_queue_head *head,
 {
        struct io_poll_table *pt = container_of(p, struct io_poll_table, pt);
 
-       __io_queue_proc(&pt->req->poll, pt, head, (struct io_poll_iocb **) &pt->req->io);
+       __io_queue_proc(&pt->req->poll, pt, head, (struct io_poll_iocb **) &pt->req->async_data);
 }
 
 static int io_poll_add_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
@@ -5225,16 +5301,10 @@ static enum hrtimer_restart io_timeout_fn(struct hrtimer *timer)
        unsigned long flags;
 
        spin_lock_irqsave(&ctx->completion_lock, flags);
+       list_del_init(&req->timeout.list);
        atomic_set(&req->ctx->cq_timeouts,
                atomic_read(&req->ctx->cq_timeouts) + 1);
 
-       /*
-        * We could be racing with timeout deletion. If the list is empty,
-        * then timeout lookup already found it and will be handling it.
-        */
-       if (!list_empty(&req->timeout.list))
-               list_del_init(&req->timeout.list);
-
        io_cqring_fill_event(req, -ETIME);
        io_commit_cqring(ctx);
        spin_unlock_irqrestore(&ctx->completion_lock, flags);
@@ -5247,13 +5317,13 @@ static enum hrtimer_restart io_timeout_fn(struct hrtimer *timer)
 
 static int __io_timeout_cancel(struct io_kiocb *req)
 {
+       struct io_timeout_data *io = req->async_data;
        int ret;
 
-       list_del_init(&req->timeout.list);
-
-       ret = hrtimer_try_to_cancel(&req->io->timeout.timer);
+       ret = hrtimer_try_to_cancel(&io->timer);
        if (ret == -1)
                return -EALREADY;
+       list_del_init(&req->timeout.list);
 
        req_set_fail_links(req);
        req->flags |= REQ_F_COMP_LOCKED;
@@ -5287,14 +5357,10 @@ static int io_timeout_remove_prep(struct io_kiocb *req,
                return -EINVAL;
        if (unlikely(req->flags & (REQ_F_FIXED_FILE | REQ_F_BUFFER_SELECT)))
                return -EINVAL;
-       if (sqe->ioprio || sqe->buf_index || sqe->len)
-               return -EINVAL;
-
-       req->timeout.addr = READ_ONCE(sqe->addr);
-       req->timeout.flags = READ_ONCE(sqe->timeout_flags);
-       if (req->timeout.flags)
+       if (sqe->ioprio || sqe->buf_index || sqe->len || sqe->timeout_flags)
                return -EINVAL;
 
+       req->timeout_rem.addr = READ_ONCE(sqe->addr);
        return 0;
 }
 
@@ -5307,7 +5373,7 @@ static int io_timeout_remove(struct io_kiocb *req)
        int ret;
 
        spin_lock_irq(&ctx->completion_lock);
-       ret = io_timeout_cancel(ctx, req->timeout.addr);
+       ret = io_timeout_cancel(ctx, req->timeout_rem.addr);
 
        io_cqring_fill_event(req, ret);
        io_commit_cqring(ctx);
@@ -5338,10 +5404,10 @@ static int io_timeout_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe,
 
        req->timeout.off = off;
 
-       if (!req->io && io_alloc_async_ctx(req))
+       if (!req->async_data && io_alloc_async_data(req))
                return -ENOMEM;
 
-       data = &req->io->timeout;
+       data = req->async_data;
        data->req = req;
 
        if (get_timespec64(&data->ts, u64_to_user_ptr(sqe->addr)))
@@ -5359,7 +5425,7 @@ static int io_timeout_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe,
 static int io_timeout(struct io_kiocb *req)
 {
        struct io_ring_ctx *ctx = req->ctx;
-       struct io_timeout_data *data = &req->io->timeout;
+       struct io_timeout_data *data = req->async_data;
        struct list_head *entry;
        u32 tail, off = req->timeout.off;
 
@@ -5522,120 +5588,86 @@ static int io_files_update(struct io_kiocb *req, bool force_nonblock,
        return 0;
 }
 
-static int io_req_defer_prep(struct io_kiocb *req,
-                            const struct io_uring_sqe *sqe)
+static int io_req_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
-       ssize_t ret = 0;
-
-       if (!sqe)
-               return 0;
-
-       if (io_alloc_async_ctx(req))
-               return -EAGAIN;
-       ret = io_prep_work_files(req);
-       if (unlikely(ret))
-               return ret;
-
-       io_prep_async_work(req);
-
        switch (req->opcode) {
        case IORING_OP_NOP:
-               break;
+               return 0;
        case IORING_OP_READV:
        case IORING_OP_READ_FIXED:
        case IORING_OP_READ:
-               ret = io_read_prep(req, sqe, true);
-               break;
+               return io_read_prep(req, sqe);
        case IORING_OP_WRITEV:
        case IORING_OP_WRITE_FIXED:
        case IORING_OP_WRITE:
-               ret = io_write_prep(req, sqe, true);
-               break;
+               return io_write_prep(req, sqe);
        case IORING_OP_POLL_ADD:
-               ret = io_poll_add_prep(req, sqe);
-               break;
+               return io_poll_add_prep(req, sqe);
        case IORING_OP_POLL_REMOVE:
-               ret = io_poll_remove_prep(req, sqe);
-               break;
+               return io_poll_remove_prep(req, sqe);
        case IORING_OP_FSYNC:
-               ret = io_prep_fsync(req, sqe);
-               break;
+               return io_prep_fsync(req, sqe);
        case IORING_OP_SYNC_FILE_RANGE:
-               ret = io_prep_sfr(req, sqe);
-               break;
+               return io_prep_sfr(req, sqe);
        case IORING_OP_SENDMSG:
        case IORING_OP_SEND:
-               ret = io_sendmsg_prep(req, sqe);
-               break;
+               return io_sendmsg_prep(req, sqe);
        case IORING_OP_RECVMSG:
        case IORING_OP_RECV:
-               ret = io_recvmsg_prep(req, sqe);
-               break;
+               return io_recvmsg_prep(req, sqe);
        case IORING_OP_CONNECT:
-               ret = io_connect_prep(req, sqe);
-               break;
+               return io_connect_prep(req, sqe);
        case IORING_OP_TIMEOUT:
-               ret = io_timeout_prep(req, sqe, false);
-               break;
+               return io_timeout_prep(req, sqe, false);
        case IORING_OP_TIMEOUT_REMOVE:
-               ret = io_timeout_remove_prep(req, sqe);
-               break;
+               return io_timeout_remove_prep(req, sqe);
        case IORING_OP_ASYNC_CANCEL:
-               ret = io_async_cancel_prep(req, sqe);
-               break;
+               return io_async_cancel_prep(req, sqe);
        case IORING_OP_LINK_TIMEOUT:
-               ret = io_timeout_prep(req, sqe, true);
-               break;
+               return io_timeout_prep(req, sqe, true);
        case IORING_OP_ACCEPT:
-               ret = io_accept_prep(req, sqe);
-               break;
+               return io_accept_prep(req, sqe);
        case IORING_OP_FALLOCATE:
-               ret = io_fallocate_prep(req, sqe);
-               break;
+               return io_fallocate_prep(req, sqe);
        case IORING_OP_OPENAT:
-               ret = io_openat_prep(req, sqe);
-               break;
+               return io_openat_prep(req, sqe);
        case IORING_OP_CLOSE:
-               ret = io_close_prep(req, sqe);
-               break;
+               return io_close_prep(req, sqe);
        case IORING_OP_FILES_UPDATE:
-               ret = io_files_update_prep(req, sqe);
-               break;
+               return io_files_update_prep(req, sqe);
        case IORING_OP_STATX:
-               ret = io_statx_prep(req, sqe);
-               break;
+               return io_statx_prep(req, sqe);
        case IORING_OP_FADVISE:
-               ret = io_fadvise_prep(req, sqe);
-               break;
+               return io_fadvise_prep(req, sqe);
        case IORING_OP_MADVISE:
-               ret = io_madvise_prep(req, sqe);
-               break;
+               return io_madvise_prep(req, sqe);
        case IORING_OP_OPENAT2:
-               ret = io_openat2_prep(req, sqe);
-               break;
+               return io_openat2_prep(req, sqe);
        case IORING_OP_EPOLL_CTL:
-               ret = io_epoll_ctl_prep(req, sqe);
-               break;
+               return io_epoll_ctl_prep(req, sqe);
        case IORING_OP_SPLICE:
-               ret = io_splice_prep(req, sqe);
-               break;
+               return io_splice_prep(req, sqe);
        case IORING_OP_PROVIDE_BUFFERS:
-               ret = io_provide_buffers_prep(req, sqe);
-               break;
+               return io_provide_buffers_prep(req, sqe);
        case IORING_OP_REMOVE_BUFFERS:
-               ret = io_remove_buffers_prep(req, sqe);
-               break;
+               return io_remove_buffers_prep(req, sqe);
        case IORING_OP_TEE:
-               ret = io_tee_prep(req, sqe);
-               break;
-       default:
-               printk_once(KERN_WARNING "io_uring: unhandled opcode %d\n",
-                               req->opcode);
-               ret = -EINVAL;
-               break;
+               return io_tee_prep(req, sqe);
        }
 
-       return ret;
+       printk_once(KERN_WARNING "io_uring: unhandled opcode %d\n",
+                       req->opcode);
+       return-EINVAL;
+}
+
+static int io_req_defer_prep(struct io_kiocb *req,
+                            const struct io_uring_sqe *sqe)
+{
+       if (!sqe)
+               return 0;
+       if (io_alloc_async_data(req))
+               return -EAGAIN;
+       return io_req_prep(req, sqe);
 }
 
 static u32 io_get_sequence(struct io_kiocb *req)
@@ -5669,7 +5701,7 @@ static int io_req_defer(struct io_kiocb *req, const struct io_uring_sqe *sqe)
        if (!req_need_defer(req, seq) && list_empty_careful(&ctx->defer_list))
                return 0;
 
-       if (!req->io) {
+       if (!req->async_data) {
                ret = io_req_defer_prep(req, sqe);
                if (ret)
                        return ret;
@@ -5713,8 +5745,6 @@ static void io_req_drop_files(struct io_kiocb *req)
 
 static void __io_clean_op(struct io_kiocb *req)
 {
-       struct io_async_ctx *io = req->io;
-
        if (req->flags & REQ_F_BUFFER_SELECTED) {
                switch (req->opcode) {
                case IORING_OP_READV:
@@ -5737,15 +5767,19 @@ static void __io_clean_op(struct io_kiocb *req)
                case IORING_OP_READ:
                case IORING_OP_WRITEV:
                case IORING_OP_WRITE_FIXED:
-               case IORING_OP_WRITE:
-                       if (io->rw.free_iovec)
-                               kfree(io->rw.free_iovec);
+               case IORING_OP_WRITE: {
+                       struct io_async_rw *io = req->async_data;
+                       if (io->free_iovec)
+                               kfree(io->free_iovec);
                        break;
+                       }
                case IORING_OP_RECVMSG:
-               case IORING_OP_SENDMSG:
-                       if (io->msg.iov != io->msg.fast_iov)
-                               kfree(io->msg.iov);
+               case IORING_OP_SENDMSG: {
+                       struct io_async_msghdr *io = req->async_data;
+                       if (io->iov != io->fast_iov)
+                               kfree(io->iov);
                        break;
+                       }
                case IORING_OP_SPLICE:
                case IORING_OP_TEE:
                        io_put_file(req, req->splice.file_in,
@@ -5764,8 +5798,8 @@ static void __io_clean_op(struct io_kiocb *req)
                io_req_drop_files(req);
 }
 
-static int io_issue_sqe(struct io_kiocb *req, const struct io_uring_sqe *sqe,
-                       bool force_nonblock, struct io_comp_state *cs)
+static int io_issue_sqe(struct io_kiocb *req, bool force_nonblock,
+                       struct io_comp_state *cs)
 {
        struct io_ring_ctx *ctx = req->ctx;
        int ret;
@@ -5777,221 +5811,89 @@ static int io_issue_sqe(struct io_kiocb *req, const struct io_uring_sqe *sqe,
        case IORING_OP_READV:
        case IORING_OP_READ_FIXED:
        case IORING_OP_READ:
-               if (sqe) {
-                       ret = io_read_prep(req, sqe, force_nonblock);
-                       if (ret < 0)
-                               break;
-               }
                ret = io_read(req, force_nonblock, cs);
                break;
        case IORING_OP_WRITEV:
        case IORING_OP_WRITE_FIXED:
        case IORING_OP_WRITE:
-               if (sqe) {
-                       ret = io_write_prep(req, sqe, force_nonblock);
-                       if (ret < 0)
-                               break;
-               }
                ret = io_write(req, force_nonblock, cs);
                break;
        case IORING_OP_FSYNC:
-               if (sqe) {
-                       ret = io_prep_fsync(req, sqe);
-                       if (ret < 0)
-                               break;
-               }
                ret = io_fsync(req, force_nonblock);
                break;
        case IORING_OP_POLL_ADD:
-               if (sqe) {
-                       ret = io_poll_add_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_poll_add(req);
                break;
        case IORING_OP_POLL_REMOVE:
-               if (sqe) {
-                       ret = io_poll_remove_prep(req, sqe);
-                       if (ret < 0)
-                               break;
-               }
                ret = io_poll_remove(req);
                break;
        case IORING_OP_SYNC_FILE_RANGE:
-               if (sqe) {
-                       ret = io_prep_sfr(req, sqe);
-                       if (ret < 0)
-                               break;
-               }
                ret = io_sync_file_range(req, force_nonblock);
                break;
        case IORING_OP_SENDMSG:
+               ret = io_sendmsg(req, force_nonblock, cs);
+               break;
        case IORING_OP_SEND:
-               if (sqe) {
-                       ret = io_sendmsg_prep(req, sqe);
-                       if (ret < 0)
-                               break;
-               }
-               if (req->opcode == IORING_OP_SENDMSG)
-                       ret = io_sendmsg(req, force_nonblock, cs);
-               else
-                       ret = io_send(req, force_nonblock, cs);
+               ret = io_send(req, force_nonblock, cs);
                break;
        case IORING_OP_RECVMSG:
+               ret = io_recvmsg(req, force_nonblock, cs);
+               break;
        case IORING_OP_RECV:
-               if (sqe) {
-                       ret = io_recvmsg_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
-               if (req->opcode == IORING_OP_RECVMSG)
-                       ret = io_recvmsg(req, force_nonblock, cs);
-               else
-                       ret = io_recv(req, force_nonblock, cs);
+               ret = io_recv(req, force_nonblock, cs);
                break;
        case IORING_OP_TIMEOUT:
-               if (sqe) {
-                       ret = io_timeout_prep(req, sqe, false);
-                       if (ret)
-                               break;
-               }
                ret = io_timeout(req);
                break;
        case IORING_OP_TIMEOUT_REMOVE:
-               if (sqe) {
-                       ret = io_timeout_remove_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_timeout_remove(req);
                break;
        case IORING_OP_ACCEPT:
-               if (sqe) {
-                       ret = io_accept_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_accept(req, force_nonblock, cs);
                break;
        case IORING_OP_CONNECT:
-               if (sqe) {
-                       ret = io_connect_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_connect(req, force_nonblock, cs);
                break;
        case IORING_OP_ASYNC_CANCEL:
-               if (sqe) {
-                       ret = io_async_cancel_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_async_cancel(req);
                break;
        case IORING_OP_FALLOCATE:
-               if (sqe) {
-                       ret = io_fallocate_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_fallocate(req, force_nonblock);
                break;
        case IORING_OP_OPENAT:
-               if (sqe) {
-                       ret = io_openat_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_openat(req, force_nonblock);
                break;
        case IORING_OP_CLOSE:
-               if (sqe) {
-                       ret = io_close_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_close(req, force_nonblock, cs);
                break;
        case IORING_OP_FILES_UPDATE:
-               if (sqe) {
-                       ret = io_files_update_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_files_update(req, force_nonblock, cs);
                break;
        case IORING_OP_STATX:
-               if (sqe) {
-                       ret = io_statx_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_statx(req, force_nonblock);
                break;
        case IORING_OP_FADVISE:
-               if (sqe) {
-                       ret = io_fadvise_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_fadvise(req, force_nonblock);
                break;
        case IORING_OP_MADVISE:
-               if (sqe) {
-                       ret = io_madvise_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_madvise(req, force_nonblock);
                break;
        case IORING_OP_OPENAT2:
-               if (sqe) {
-                       ret = io_openat2_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_openat2(req, force_nonblock);
                break;
        case IORING_OP_EPOLL_CTL:
-               if (sqe) {
-                       ret = io_epoll_ctl_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_epoll_ctl(req, force_nonblock, cs);
                break;
        case IORING_OP_SPLICE:
-               if (sqe) {
-                       ret = io_splice_prep(req, sqe);
-                       if (ret < 0)
-                               break;
-               }
                ret = io_splice(req, force_nonblock);
                break;
        case IORING_OP_PROVIDE_BUFFERS:
-               if (sqe) {
-                       ret = io_provide_buffers_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_provide_buffers(req, force_nonblock, cs);
                break;
        case IORING_OP_REMOVE_BUFFERS:
-               if (sqe) {
-                       ret = io_remove_buffers_prep(req, sqe);
-                       if (ret)
-                               break;
-               }
                ret = io_remove_buffers(req, force_nonblock, cs);
                break;
        case IORING_OP_TEE:
-               if (sqe) {
-                       ret = io_tee_prep(req, sqe);
-                       if (ret < 0)
-                               break;
-               }
                ret = io_tee(req, force_nonblock);
                break;
        default:
@@ -6037,7 +5939,7 @@ static struct io_wq_work *io_wq_submit_work(struct io_wq_work *work)
 
        if (!ret) {
                do {
-                       ret = io_issue_sqe(req, NULL, false, NULL);
+                       ret = io_issue_sqe(req, false, NULL);
                        /*
                         * We can get EAGAIN for polled IO even though we're
                         * forcing a sync submission from here, since we can't
@@ -6066,16 +5968,15 @@ static inline struct file *io_file_from_index(struct io_ring_ctx *ctx,
        return table->files[index & IORING_FILE_TABLE_MASK];
 }
 
-static int io_file_get(struct io_submit_state *state, struct io_kiocb *req,
-                       int fd, struct file **out_file, bool fixed)
+static struct file *io_file_get(struct io_submit_state *state,
+                               struct io_kiocb *req, int fd, bool fixed)
 {
        struct io_ring_ctx *ctx = req->ctx;
        struct file *file;
 
        if (fixed) {
-               if (unlikely(!ctx->file_data ||
-                   (unsigned) fd >= ctx->nr_user_files))
-                       return -EBADF;
+               if (unlikely((unsigned int)fd >= ctx->nr_user_files))
+                       return NULL;
                fd = array_index_nospec(fd, ctx->nr_user_files);
                file = io_file_from_index(ctx, fd);
                if (file) {
@@ -6087,11 +5988,7 @@ static int io_file_get(struct io_submit_state *state, struct io_kiocb *req,
                file = __io_file_get(state, fd);
        }
 
-       if (file || io_op_defs[req->opcode].needs_file_no_error) {
-               *out_file = file;
-               return 0;
-       }
-       return -EBADF;
+       return file;
 }
 
 static int io_req_set_file(struct io_submit_state *state, struct io_kiocb *req,
@@ -6103,34 +6000,10 @@ static int io_req_set_file(struct io_submit_state *state, struct io_kiocb *req,
        if (unlikely(!fixed && io_async_submit(req->ctx)))
                return -EBADF;
 
-       return io_file_get(state, req, fd, &req->file, fixed);
-}
-
-static int io_grab_files(struct io_kiocb *req)
-{
-       struct io_ring_ctx *ctx = req->ctx;
-
-       io_req_init_async(req);
-
-       if (req->work.files || (req->flags & REQ_F_NO_FILE_TABLE))
+       req->file = io_file_get(state, req, fd, fixed);
+       if (req->file || io_op_defs[req->opcode].needs_file_no_error)
                return 0;
-
-       req->work.files = get_files_struct(current);
-       get_nsproxy(current->nsproxy);
-       req->work.nsproxy = current->nsproxy;
-       req->flags |= REQ_F_INFLIGHT;
-
-       spin_lock_irq(&ctx->inflight_lock);
-       list_add(&req->inflight_entry, &ctx->inflight_list);
-       spin_unlock_irq(&ctx->inflight_lock);
-       return 0;
-}
-
-static inline int io_prep_work_files(struct io_kiocb *req)
-{
-       if (!io_op_defs[req->opcode].file_table)
-               return 0;
-       return io_grab_files(req);
+       return -EBADF;
 }
 
 static enum hrtimer_restart io_link_timeout_fn(struct hrtimer *timer)
@@ -6177,7 +6050,7 @@ static void __io_queue_linked_timeout(struct io_kiocb *req)
         * we got a chance to setup the timer
         */
        if (!list_empty(&req->link_list)) {
-               struct io_timeout_data *data = &req->io->timeout;
+               struct io_timeout_data *data = req->async_data;
 
                data->timer.function = io_link_timeout_fn;
                hrtimer_start(&data->timer, timespec64_to_ktime(data->ts),
@@ -6215,8 +6088,7 @@ static struct io_kiocb *io_prep_linked_timeout(struct io_kiocb *req)
        return nxt;
 }
 
-static void __io_queue_sqe(struct io_kiocb *req, const struct io_uring_sqe *sqe,
-                          struct io_comp_state *cs)
+static void __io_queue_sqe(struct io_kiocb *req, struct io_comp_state *cs)
 {
        struct io_kiocb *linked_timeout;
        struct io_kiocb *nxt;
@@ -6236,7 +6108,7 @@ again:
                        old_creds = override_creds(req->work.creds);
        }
 
-       ret = io_issue_sqe(req, sqe, true, cs);
+       ret = io_issue_sqe(req, true, cs);
 
        /*
         * We async punt it if the file wasn't marked NOWAIT, or if the file
@@ -6245,9 +6117,6 @@ again:
        if (ret == -EAGAIN && !(req->flags & REQ_F_NOWAIT)) {
                if (!io_arm_poll_handler(req)) {
 punt:
-                       ret = io_prep_work_files(req);
-                       if (unlikely(ret))
-                               goto err;
                        /*
                         * Queued up for async execution, worker will release
                         * submit reference when the iocb is actually submitted.
@@ -6261,7 +6130,6 @@ punt:
        }
 
        if (unlikely(ret)) {
-err:
                /* un-prep timeout, so it'll be killed as any other linked */
                req->flags &= ~REQ_F_LINK_TIMEOUT;
                req_set_fail_links(req);
@@ -6301,7 +6169,7 @@ fail_req:
                        io_req_complete(req, ret);
                }
        } else if (req->flags & REQ_F_FORCE_ASYNC) {
-               if (!req->io) {
+               if (!req->async_data) {
                        ret = io_req_defer_prep(req, sqe);
                        if (unlikely(ret))
                                goto fail_req;
@@ -6315,7 +6183,12 @@ fail_req:
                req->work.flags |= IO_WQ_WORK_CONCURRENT;
                io_queue_async_work(req);
        } else {
-               __io_queue_sqe(req, sqe, cs);
+               if (sqe) {
+                       ret = io_req_prep(req, sqe);
+                       if (unlikely(ret))
+                               goto fail_req;
+               }
+               __io_queue_sqe(req, cs);
        }
 }
 
@@ -6502,19 +6375,17 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req,
                       struct io_submit_state *state)
 {
        unsigned int sqe_flags;
-       int id;
+       int id, ret;
 
        req->opcode = READ_ONCE(sqe->opcode);
        req->user_data = READ_ONCE(sqe->user_data);
-       req->io = NULL;
+       req->async_data = NULL;
        req->file = NULL;
        req->ctx = ctx;
        req->flags = 0;
        /* one is dropped after submission, the other at completion */
        refcount_set(&req->refs, 2);
        req->task = current;
-       get_task_struct(req->task);
-       atomic_long_inc(&req->task->io_uring->req_issue);
        req->result = 0;
 
        if (unlikely(req->opcode >= IORING_OP_LAST))
@@ -6550,7 +6421,9 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req,
        if (!io_op_defs[req->opcode].needs_file)
                return 0;
 
-       return io_req_set_file(state, req, READ_ONCE(sqe->fd));
+       ret = io_req_set_file(state, req, READ_ONCE(sqe->fd));
+       state->ios_left--;
+       return ret;
 }
 
 static int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr)
@@ -6572,6 +6445,9 @@ static int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr)
        if (!percpu_ref_tryget_many(&ctx->refs, nr))
                return -EAGAIN;
 
+       atomic_long_add(nr, &current->io_uring->req_issue);
+       refcount_add(nr, &current->usage);
+
        io_submit_state_start(&state, ctx, nr);
 
        for (i = 0; i < nr; i++) {
@@ -6590,12 +6466,11 @@ static int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr)
                                submitted = -EAGAIN;
                        break;
                }
-
-               err = io_init_req(ctx, req, sqe, &state);
                io_consume_sqe(ctx);
                /* will complete beyond this point, count as submitted */
                submitted++;
 
+               err = io_init_req(ctx, req, sqe, &state);
                if (unlikely(err)) {
 fail_req:
                        io_put_req(req);
@@ -6614,6 +6489,8 @@ fail_req:
                int ref_used = (submitted == -EAGAIN) ? 0 : submitted;
 
                percpu_ref_put_many(&ctx->refs, nr - ref_used);
+               atomic_long_sub(nr - ref_used, &current->io_uring->req_issue);
+               put_task_struct_many(current, nr - ref_used);
        }
        if (link)
                io_queue_link_head(link, &state.comp);
@@ -6664,7 +6541,7 @@ enum sq_ret {
 };
 
 static enum sq_ret __io_sq_thread(struct io_ring_ctx *ctx,
-                                 unsigned long start_jiffies)
+                                 unsigned long start_jiffies, bool cap_entries)
 {
        unsigned long timeout = start_jiffies + ctx->sq_thread_idle;
        struct io_sq_data *sqd = ctx->sq_data;
@@ -6732,10 +6609,18 @@ again:
        finish_wait(&sqd->wait, &ctx->sqo_wait_entry);
        io_ring_clear_wakeup_flag(ctx);
 
+       /* if we're handling multiple rings, cap submit size for fairness */
+       if (cap_entries && to_submit > 8)
+               to_submit = 8;
+
        mutex_lock(&ctx->uring_lock);
        if (likely(!percpu_ref_is_dying(&ctx->refs)))
                ret = io_submit_sqes(ctx, to_submit);
        mutex_unlock(&ctx->uring_lock);
+
+       if (!io_sqring_full(ctx) && wq_has_sleeper(&ctx->sqo_sq_wait))
+               wake_up(&ctx->sqo_sq_wait);
+
        return SQT_DID_WORK;
 }
 
@@ -6754,6 +6639,7 @@ static void io_sqd_init_new(struct io_sq_data *sqd)
 
 static int io_sq_thread(void *data)
 {
+       struct cgroup_subsys_state *cur_css = NULL;
        const struct cred *old_cred = NULL;
        struct io_sq_data *sqd = data;
        struct io_ring_ctx *ctx;
@@ -6762,6 +6648,7 @@ static int io_sq_thread(void *data)
        start_jiffies = jiffies;
        while (!kthread_should_stop()) {
                enum sq_ret ret = 0;
+               bool cap_entries;
 
                /*
                 * Any changes to the sqd lists are synchronized through the
@@ -6774,14 +6661,17 @@ static int io_sq_thread(void *data)
                if (unlikely(!list_empty(&sqd->ctx_new_list)))
                        io_sqd_init_new(sqd);
 
+               cap_entries = !list_is_singular(&sqd->ctx_list);
+
                list_for_each_entry(ctx, &sqd->ctx_list, sqd_list) {
                        if (current->cred != ctx->creds) {
                                if (old_cred)
                                        revert_creds(old_cred);
                                old_cred = override_creds(ctx->creds);
                        }
+                       io_sq_thread_associate_blkcg(ctx, &cur_css);
 
-                       ret |= __io_sq_thread(ctx, start_jiffies);
+                       ret |= __io_sq_thread(ctx, start_jiffies, cap_entries);
 
                        io_sq_thread_drop_mm();
                }
@@ -6803,6 +6693,8 @@ static int io_sq_thread(void *data)
 
        io_run_task_work();
 
+       if (cur_css)
+               io_sq_thread_unassociate_blkcg();
        if (old_cred)
                revert_creds(old_cred);
 
@@ -6844,6 +6736,22 @@ static int io_wake_function(struct wait_queue_entry *curr, unsigned int mode,
        return autoremove_wake_function(curr, mode, wake_flags, key);
 }
 
+static int io_run_task_work_sig(void)
+{
+       if (io_run_task_work())
+               return 1;
+       if (!signal_pending(current))
+               return 0;
+       if (current->jobctl & JOBCTL_TASK_WORK) {
+               spin_lock_irq(&current->sighand->siglock);
+               current->jobctl &= ~JOBCTL_TASK_WORK;
+               recalc_sigpending();
+               spin_unlock_irq(&current->sighand->siglock);
+               return 1;
+       }
+       return -EINTR;
+}
+
 /*
  * Wait until events become available, if we don't already have some. The
  * application must reap them itself, as they reside on the shared cq ring.
@@ -6889,19 +6797,11 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events,
                prepare_to_wait_exclusive(&ctx->wait, &iowq.wq,
                                                TASK_INTERRUPTIBLE);
                /* make sure we run task_work before checking for signals */
-               if (io_run_task_work())
+               ret = io_run_task_work_sig();
+               if (ret > 0)
                        continue;
-               if (signal_pending(current)) {
-                       if (current->jobctl & JOBCTL_TASK_WORK) {
-                               spin_lock_irq(&current->sighand->siglock);
-                               current->jobctl &= ~JOBCTL_TASK_WORK;
-                               recalc_sigpending();
-                               spin_unlock_irq(&current->sighand->siglock);
-                               continue;
-                       }
-                       ret = -EINTR;
+               else if (ret < 0)
                        break;
-               }
                if (io_should_wake(&iowq, false))
                        break;
                schedule();
@@ -7199,13 +7099,13 @@ static int io_sqe_files_scm(struct io_ring_ctx *ctx)
 }
 #endif
 
-static int io_sqe_alloc_file_tables(struct io_ring_ctx *ctx, unsigned nr_tables,
-                                   unsigned nr_files)
+static int io_sqe_alloc_file_tables(struct fixed_file_data *file_data,
+                                   unsigned nr_tables, unsigned nr_files)
 {
        int i;
 
        for (i = 0; i < nr_tables; i++) {
-               struct fixed_file_table *table = &ctx->file_data->table[i];
+               struct fixed_file_table *table = &file_data->table[i];
                unsigned this_files;
 
                this_files = min(nr_files, IORING_MAX_FILES_TABLE);
@@ -7220,7 +7120,7 @@ static int io_sqe_alloc_file_tables(struct io_ring_ctx *ctx, unsigned nr_tables,
                return 0;
 
        for (i = 0; i < nr_tables; i++) {
-               struct fixed_file_table *table = &ctx->file_data->table[i];
+               struct fixed_file_table *table = &file_data->table[i];
                kfree(table->files);
        }
        return 1;
@@ -7387,6 +7287,7 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
        int fd, ret = 0;
        unsigned i;
        struct fixed_file_ref_node *ref_node;
+       struct fixed_file_data *file_data;
 
        if (ctx->file_data)
                return -EBUSY;
@@ -7395,37 +7296,33 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
        if (nr_args > IORING_MAX_FIXED_FILES)
                return -EMFILE;
 
-       ctx->file_data = kzalloc(sizeof(*ctx->file_data), GFP_KERNEL);
-       if (!ctx->file_data)
+       file_data = kzalloc(sizeof(*ctx->file_data), GFP_KERNEL);
+       if (!file_data)
                return -ENOMEM;
-       ctx->file_data->ctx = ctx;
-       init_completion(&ctx->file_data->done);
-       INIT_LIST_HEAD(&ctx->file_data->ref_list);
-       spin_lock_init(&ctx->file_data->lock);
+       file_data->ctx = ctx;
+       init_completion(&file_data->done);
+       INIT_LIST_HEAD(&file_data->ref_list);
+       spin_lock_init(&file_data->lock);
 
        nr_tables = DIV_ROUND_UP(nr_args, IORING_MAX_FILES_TABLE);
-       ctx->file_data->table = kcalloc(nr_tables,
-                                       sizeof(struct fixed_file_table),
-                                       GFP_KERNEL);
-       if (!ctx->file_data->table) {
-               kfree(ctx->file_data);
-               ctx->file_data = NULL;
+       file_data->table = kcalloc(nr_tables, sizeof(file_data->table),
+                                  GFP_KERNEL);
+       if (!file_data->table) {
+               kfree(file_data);
                return -ENOMEM;
        }
 
-       if (percpu_ref_init(&ctx->file_data->refs, io_file_ref_kill,
+       if (percpu_ref_init(&file_data->refs, io_file_ref_kill,
                                PERCPU_REF_ALLOW_REINIT, GFP_KERNEL)) {
-               kfree(ctx->file_data->table);
-               kfree(ctx->file_data);
-               ctx->file_data = NULL;
+               kfree(file_data->table);
+               kfree(file_data);
                return -ENOMEM;
        }
 
-       if (io_sqe_alloc_file_tables(ctx, nr_tables, nr_args)) {
-               percpu_ref_exit(&ctx->file_data->refs);
-               kfree(ctx->file_data->table);
-               kfree(ctx->file_data);
-               ctx->file_data = NULL;
+       if (io_sqe_alloc_file_tables(file_data, nr_tables, nr_args)) {
+               percpu_ref_exit(&file_data->refs);
+               kfree(file_data->table);
+               kfree(file_data);
                return -ENOMEM;
        }
 
@@ -7442,7 +7339,7 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
                        continue;
                }
 
-               table = &ctx->file_data->table[i >> IORING_FILE_TABLE_SHIFT];
+               table = &file_data->table[i >> IORING_FILE_TABLE_SHIFT];
                index = i & IORING_FILE_TABLE_MASK;
                file = fget(fd);
 
@@ -7472,16 +7369,16 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
                                fput(file);
                }
                for (i = 0; i < nr_tables; i++)
-                       kfree(ctx->file_data->table[i].files);
+                       kfree(file_data->table[i].files);
 
-               percpu_ref_exit(&ctx->file_data->refs);
-               kfree(ctx->file_data->table);
-               kfree(ctx->file_data);
-               ctx->file_data = NULL;
+               percpu_ref_exit(&file_data->refs);
+               kfree(file_data->table);
+               kfree(file_data);
                ctx->nr_user_files = 0;
                return ret;
        }
 
+       ctx->file_data = file_data;
        ret = io_sqe_files_scm(ctx);
        if (ret) {
                io_sqe_files_unregister(ctx);
@@ -7494,11 +7391,11 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
                return PTR_ERR(ref_node);
        }
 
-       ctx->file_data->cur_refs = &ref_node->refs;
-       spin_lock(&ctx->file_data->lock);
-       list_add(&ref_node->node, &ctx->file_data->ref_list);
-       spin_unlock(&ctx->file_data->lock);
-       percpu_ref_get(&ctx->file_data->refs);
+       file_data->cur_refs = &ref_node->refs;
+       spin_lock(&file_data->lock);
+       list_add(&ref_node->node, &file_data->ref_list);
+       spin_unlock(&file_data->lock);
+       percpu_ref_get(&file_data->refs);
        return ret;
 }
 
@@ -7746,7 +7643,6 @@ void __io_uring_free(struct task_struct *tsk)
        struct io_uring_task *tctx = tsk->io_uring;
 
        WARN_ON_ONCE(!xa_empty(&tctx->xa));
-       xa_destroy(&tctx->xa);
        kfree(tctx);
        tsk->io_uring = NULL;
 }
@@ -7965,7 +7861,8 @@ static int io_sqe_buffer_unregister(struct io_ring_ctx *ctx)
                for (j = 0; j < imu->nr_bvecs; j++)
                        unpin_user_page(imu->bvec[j].bv_page);
 
-               io_unaccount_mem(ctx, imu->nr_bvecs, ACCT_PINNED);
+               if (imu->acct_pages)
+                       io_unaccount_mem(ctx, imu->acct_pages, ACCT_PINNED);
                kvfree(imu->bvec);
                imu->nr_bvecs = 0;
        }
@@ -8001,11 +7898,80 @@ static int io_copy_iov(struct io_ring_ctx *ctx, struct iovec *dst,
        return 0;
 }
 
+/*
+ * Not super efficient, but this is just a registration time. And we do cache
+ * the last compound head, so generally we'll only do a full search if we don't
+ * match that one.
+ *
+ * We check if the given compound head page has already been accounted, to
+ * avoid double accounting it. This allows us to account the full size of the
+ * page, not just the constituent pages of a huge page.
+ */
+static bool headpage_already_acct(struct io_ring_ctx *ctx, struct page **pages,
+                                 int nr_pages, struct page *hpage)
+{
+       int i, j;
+
+       /* check current page array */
+       for (i = 0; i < nr_pages; i++) {
+               if (!PageCompound(pages[i]))
+                       continue;
+               if (compound_head(pages[i]) == hpage)
+                       return true;
+       }
+
+       /* check previously registered pages */
+       for (i = 0; i < ctx->nr_user_bufs; i++) {
+               struct io_mapped_ubuf *imu = &ctx->user_bufs[i];
+
+               for (j = 0; j < imu->nr_bvecs; j++) {
+                       if (!PageCompound(imu->bvec[j].bv_page))
+                               continue;
+                       if (compound_head(imu->bvec[j].bv_page) == hpage)
+                               return true;
+               }
+       }
+
+       return false;
+}
+
+static int io_buffer_account_pin(struct io_ring_ctx *ctx, struct page **pages,
+                                int nr_pages, struct io_mapped_ubuf *imu,
+                                struct page **last_hpage)
+{
+       int i, ret;
+
+       for (i = 0; i < nr_pages; i++) {
+               if (!PageCompound(pages[i])) {
+                       imu->acct_pages++;
+               } else {
+                       struct page *hpage;
+
+                       hpage = compound_head(pages[i]);
+                       if (hpage == *last_hpage)
+                               continue;
+                       *last_hpage = hpage;
+                       if (headpage_already_acct(ctx, pages, i, hpage))
+                               continue;
+                       imu->acct_pages += page_size(hpage) >> PAGE_SHIFT;
+               }
+       }
+
+       if (!imu->acct_pages)
+               return 0;
+
+       ret = io_account_mem(ctx, imu->acct_pages, ACCT_PINNED);
+       if (ret)
+               imu->acct_pages = 0;
+       return ret;
+}
+
 static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg,
                                  unsigned nr_args)
 {
        struct vm_area_struct **vmas = NULL;
        struct page **pages = NULL;
+       struct page *last_hpage = NULL;
        int i, j, got_pages = 0;
        int ret = -EINVAL;
 
@@ -8048,10 +8014,6 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg,
                start = ubuf >> PAGE_SHIFT;
                nr_pages = end - start;
 
-               ret = io_account_mem(ctx, nr_pages, ACCT_PINNED);
-               if (ret)
-                       goto err;
-
                ret = 0;
                if (!pages || nr_pages > got_pages) {
                        kvfree(vmas);
@@ -8063,7 +8025,6 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg,
                                        GFP_KERNEL);
                        if (!pages || !vmas) {
                                ret = -ENOMEM;
-                               io_unaccount_mem(ctx, nr_pages, ACCT_PINNED);
                                goto err;
                        }
                        got_pages = nr_pages;
@@ -8072,10 +8033,8 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg,
                imu->bvec = kvmalloc_array(nr_pages, sizeof(struct bio_vec),
                                                GFP_KERNEL);
                ret = -ENOMEM;
-               if (!imu->bvec) {
-                       io_unaccount_mem(ctx, nr_pages, ACCT_PINNED);
+               if (!imu->bvec)
                        goto err;
-               }
 
                ret = 0;
                mmap_read_lock(current->mm);
@@ -8104,7 +8063,13 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg,
                         */
                        if (pret > 0)
                                unpin_user_pages(pages, pret);
-                       io_unaccount_mem(ctx, nr_pages, ACCT_PINNED);
+                       kvfree(imu->bvec);
+                       goto err;
+               }
+
+               ret = io_buffer_account_pin(ctx, pages, pret, imu, &last_hpage);
+               if (ret) {
+                       unpin_user_pages(pages, pret);
                        kvfree(imu->bvec);
                        goto err;
                }
@@ -8197,6 +8162,11 @@ static void io_ring_ctx_free(struct io_ring_ctx *ctx)
                ctx->mm_account = NULL;
        }
 
+#ifdef CONFIG_BLK_CGROUP
+       if (ctx->sqo_blkcg_css)
+               css_put(ctx->sqo_blkcg_css);
+#endif
+
        io_sqe_files_unregister(ctx);
        io_eventfd_unregister(ctx);
        io_destroy_buffers(ctx);
@@ -8231,8 +8201,7 @@ static __poll_t io_uring_poll(struct file *file, poll_table *wait)
         * io_commit_cqring
         */
        smp_rmb();
-       if (READ_ONCE(ctx->rings->sq.tail) - ctx->cached_sq_head !=
-           ctx->rings->sq_ring_entries)
+       if (!io_sqring_full(ctx))
                mask |= EPOLLOUT | EPOLLWRNORM;
        if (io_cqring_events(ctx, false))
                mask |= EPOLLIN | EPOLLRDNORM;
@@ -8572,27 +8541,24 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx,
  */
 static int io_uring_add_task_file(struct file *file)
 {
-       if (unlikely(!current->io_uring)) {
+       struct io_uring_task *tctx = current->io_uring;
+
+       if (unlikely(!tctx)) {
                int ret;
 
                ret = io_uring_alloc_task_context(current);
                if (unlikely(ret))
                        return ret;
+               tctx = current->io_uring;
        }
-       if (current->io_uring->last != file) {
-               XA_STATE(xas, &current->io_uring->xa, (unsigned long) file);
-               void *old;
+       if (tctx->last != file) {
+               void *old = xa_load(&tctx->xa, (unsigned long)file);
 
-               rcu_read_lock();
-               old = xas_load(&xas);
-               if (old != file) {
+               if (!old) {
                        get_file(file);
-                       xas_lock(&xas);
-                       xas_store(&xas, file);
-                       xas_unlock(&xas);
+                       xa_store(&tctx->xa, (unsigned long)file, file, GFP_KERNEL);
                }
-               rcu_read_unlock();
-               current->io_uring->last = file;
+               tctx->last = file;
        }
 
        return 0;
@@ -8604,27 +8570,17 @@ static int io_uring_add_task_file(struct file *file)
 static void io_uring_del_task_file(struct file *file)
 {
        struct io_uring_task *tctx = current->io_uring;
-       XA_STATE(xas, &tctx->xa, (unsigned long) file);
 
        if (tctx->last == file)
                tctx->last = NULL;
-
-       xas_lock(&xas);
-       file = xas_store(&xas, NULL);
-       xas_unlock(&xas);
-
+       file = xa_erase(&tctx->xa, (unsigned long)file);
        if (file)
                fput(file);
 }
 
 static void __io_uring_attempt_task_drop(struct file *file)
 {
-       XA_STATE(xas, &current->io_uring->xa, (unsigned long) file);
-       struct file *old;
-
-       rcu_read_lock();
-       old = xas_load(&xas);
-       rcu_read_unlock();
+       struct file *old = xa_load(&current->io_uring->xa, (unsigned long)file);
 
        if (old == file)
                io_uring_del_task_file(file);
@@ -8651,28 +8607,19 @@ static void io_uring_attempt_task_drop(struct file *file, bool exiting)
 void __io_uring_files_cancel(struct files_struct *files)
 {
        struct io_uring_task *tctx = current->io_uring;
-       XA_STATE(xas, &tctx->xa, 0);
+       struct file *file;
+       unsigned long index;
 
        /* make sure overflow events are dropped */
        tctx->in_idle = true;
 
-       do {
-               struct io_ring_ctx *ctx;
-               struct file *file;
-
-               xas_lock(&xas);
-               file = xas_next_entry(&xas, ULONG_MAX);
-               xas_unlock(&xas);
-
-               if (!file)
-                       break;
-
-               ctx = file->private_data;
+       xa_for_each(&tctx->xa, index, file) {
+               struct io_ring_ctx *ctx = file->private_data;
 
                io_uring_cancel_task_requests(ctx, files);
                if (files)
                        io_uring_del_task_file(file);
-       } while (1);
+       }
 }
 
 static inline bool io_uring_task_idle(struct io_uring_task *tctx)
@@ -8801,6 +8748,25 @@ static unsigned long io_uring_nommu_get_unmapped_area(struct file *file,
 
 #endif /* !CONFIG_MMU */
 
+static void io_sqpoll_wait_sq(struct io_ring_ctx *ctx)
+{
+       DEFINE_WAIT(wait);
+
+       do {
+               if (!io_sqring_full(ctx))
+                       break;
+
+               prepare_to_wait(&ctx->sqo_sq_wait, &wait, TASK_INTERRUPTIBLE);
+
+               if (!io_sqring_full(ctx))
+                       break;
+
+               schedule();
+       } while (!signal_pending(current));
+
+       finish_wait(&ctx->sqo_sq_wait, &wait);
+}
+
 SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit,
                u32, min_complete, u32, flags, const sigset_t __user *, sig,
                size_t, sigsz)
@@ -8812,7 +8778,8 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit,
 
        io_run_task_work();
 
-       if (flags & ~(IORING_ENTER_GETEVENTS | IORING_ENTER_SQ_WAKEUP))
+       if (flags & ~(IORING_ENTER_GETEVENTS | IORING_ENTER_SQ_WAKEUP |
+                       IORING_ENTER_SQ_WAIT))
                return -EINVAL;
 
        f = fdget(fd);
@@ -8843,6 +8810,8 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit,
                        io_cqring_overflow_flush(ctx, false, NULL, NULL);
                if (flags & IORING_ENTER_SQ_WAKEUP)
                        wake_up(&ctx->sq_data->wait);
+               if (flags & IORING_ENTER_SQ_WAIT)
+                       io_sqpoll_wait_sq(ctx);
                submitted = to_submit;
        } else if (to_submit) {
                ret = io_uring_add_task_file(f.file);
@@ -8915,6 +8884,7 @@ static int io_uring_show_cred(int id, void *p, void *data)
 
 static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 {
+       struct io_sq_data *sq = NULL;
        bool has_lock;
        int i;
 
@@ -8926,6 +8896,11 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
         */
        has_lock = mutex_trylock(&ctx->uring_lock);
 
+       if (has_lock && (ctx->flags & IORING_SETUP_SQPOLL))
+               sq = ctx->sq_data;
+
+       seq_printf(m, "SqThread:\t%d\n", sq ? task_pid_nr(sq->thread) : -1);
+       seq_printf(m, "SqThreadCpu:\t%d\n", sq ? task_cpu(sq->thread) : -1);
        seq_printf(m, "UserFiles:\t%u\n", ctx->nr_user_files);
        for (i = 0; has_lock && i < ctx->nr_user_files; i++) {
                struct fixed_file_table *table;
@@ -9160,6 +9135,25 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p,
        mmgrab(current->mm);
        ctx->mm_account = current->mm;
 
+#ifdef CONFIG_BLK_CGROUP
+       /*
+        * The sq thread will belong to the original cgroup it was inited in.
+        * If the cgroup goes offline (e.g. disabling the io controller), then
+        * issued bios will be associated with the closest cgroup later in the
+        * block layer.
+        */
+       rcu_read_lock();
+       ctx->sqo_blkcg_css = blkcg_css();
+       ret = css_tryget_online(ctx->sqo_blkcg_css);
+       rcu_read_unlock();
+       if (!ret) {
+               /* don't init against a dying cgroup, have the user try again */
+               ctx->sqo_blkcg_css = NULL;
+               ret = -ENODEV;
+               goto err;
+       }
+#endif
+
        /*
         * Account memory _before_ installing the file descriptor. Once
         * the descriptor is installed, it can get closed at any time. Also
@@ -9446,11 +9440,19 @@ static int __io_uring_register(struct io_ring_ctx *ctx, unsigned opcode,
                 * after we've killed the percpu ref.
                 */
                mutex_unlock(&ctx->uring_lock);
-               ret = wait_for_completion_interruptible(&ctx->ref_comp);
+               do {
+                       ret = wait_for_completion_interruptible(&ctx->ref_comp);
+                       if (!ret)
+                               break;
+                       ret = io_run_task_work_sig();
+                       if (ret < 0)
+                               break;
+               } while (1);
+
                mutex_lock(&ctx->uring_lock);
+
                if (ret) {
                        percpu_ref_resurrect(&ctx->refs);
-                       ret = -EINTR;
                        goto out_quiesce;
                }
        }