[PATCH 0/2] io_uring/uring_cmd cleanups

[PATCH 0/2] io_uring/uring_cmd cleanups

[Yang Xiuwei]

Two small io_uring/uring_cmd cleanups:

- copy the SQE into async data in io_uring_cmd_issue_blocking()
  before punting to io-wq, as the -EAGAIN and fallback punt paths
  already do (discussed in May [1])
- fix comment typos in io_uring_cmd_mark_cancelable() and correct
  the memory-ordering note in __io_uring_cmd_done()

The sqe_copy fix still has not made it to mainline; sending this series
in case it is still useful.

[1] https://lore.kernel.org/io-uring/56388741-f507-44e3-a144-5512a1fd99cb@kernel.dk/

Yang Xiuwei (2):
  io_uring/uring_cmd: copy SQE before issue_blocking punt
  io_uring/uring_cmd: fix uring_cmd.c comments

 io_uring/uring_cmd.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

-- 
2.25.1

[PATCH 1/2] io_uring/uring_cmd: copy SQE before issue_blocking punt

[Yang Xiuwei]

io_uring_cmd_issue_blocking() punts to io-wq without copying the SQE
off the submission queue, unlike the -EAGAIN and fallback paths. Copy
the SQE into async data before queuing the work.

Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
---
 io_uring/uring_cmd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c
index 7b25dcd9d05f..fe32311b2e51 100644
--- a/io_uring/uring_cmd.c
+++ b/io_uring/uring_cmd.c
@@ -326,6 +326,10 @@ void io_uring_cmd_issue_blocking(struct io_uring_cmd *ioucmd)
 {
 	struct io_kiocb *req = cmd_to_io_kiocb(ioucmd);
 
+	if (!(req->flags & REQ_F_SQE_COPIED)) {
+		io_uring_cmd_sqe_copy(req);
+		req->flags |= REQ_F_SQE_COPIED;
+	}
 	io_req_queue_iowq(req);
 }
 
-- 
2.25.1

[PATCH 2/2] io_uring/uring_cmd: fix uring_cmd.c comments

[Yang Xiuwei]

Fix "concelable" -> "cancelable" in the comment above
io_uring_cmd_mark_cancelable(), and fix the memory ordering comment
in __io_uring_cmd_done() to reference io_do_iopoll() and
->iopoll_completed.

Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
---
 io_uring/uring_cmd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c
index fe32311b2e51..8313600583b5 100644
--- a/io_uring/uring_cmd.c
+++ b/io_uring/uring_cmd.c
@@ -90,7 +90,7 @@ static void io_uring_cmd_del_cancelable(struct io_uring_cmd *cmd,
 }
 
 /*
- * Mark this command as concelable, then io_uring_try_cancel_uring_cmd()
+ * Mark this command as cancelable, then io_uring_try_cancel_uring_cmd()
  * will try to cancel this issued command by sending ->uring_cmd() with
  * issue_flags of IO_URING_F_CANCEL.
  *
@@ -168,7 +168,7 @@ void __io_uring_cmd_done(struct io_uring_cmd *ioucmd, s32 ret, u64 res2,
 	}
 	io_req_uring_cleanup(req, issue_flags);
 	if (req->flags & REQ_F_IOPOLL) {
-		/* order with io_iopoll_req_issued() checking ->iopoll_complete */
+		/* order with io_do_iopoll() checking ->iopoll_completed */
 		smp_store_release(&req->iopoll_completed, 1);
 	} else if (issue_flags & IO_URING_F_COMPLETE_DEFER) {
 		if (WARN_ON_ONCE(issue_flags & IO_URING_F_UNLOCKED))
-- 
2.25.1

Re: [PATCH 0/2] io_uring/uring_cmd cleanups

[Jens Axboe]

On Thu, 02 Jul 2026 16:29:35 +0800, Yang Xiuwei wrote:
> Two small io_uring/uring_cmd cleanups:
> 
> - copy the SQE into async data in io_uring_cmd_issue_blocking()
>   before punting to io-wq, as the -EAGAIN and fallback punt paths
>   already do (discussed in May [1])
> - fix comment typos in io_uring_cmd_mark_cancelable() and correct
>   the memory-ordering note in __io_uring_cmd_done()
> 
> [...]

Applied, thanks!

[1/2] io_uring/uring_cmd: copy SQE before issue_blocking punt
      commit: c0da6ecf90e4f54dd8a3afe6ddeed427cb4aa091
[2/2] io_uring/uring_cmd: fix uring_cmd.c comments
      commit: 12dbe5d2476980aa78883b12c9cb90b656f5c50c

Best regards,
-- 
Jens Axboe

Re: [PATCH 2/2] io_uring/uring_cmd: fix uring_cmd.c comments

[Caleb Sander Mateos]

On Thu, Jul 2, 2026 at 1:43 AM Yang Xiuwei <yangxiuwei@kylinos.cn> wrote:
>
> Fix "concelable" -> "cancelable" in the comment above
> io_uring_cmd_mark_cancelable(), and fix the memory ordering comment
> in __io_uring_cmd_done() to reference io_do_iopoll() and
> ->iopoll_completed.
>
> Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
> ---
>  io_uring/uring_cmd.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c
> index fe32311b2e51..8313600583b5 100644
> --- a/io_uring/uring_cmd.c
> +++ b/io_uring/uring_cmd.c
> @@ -90,7 +90,7 @@ static void io_uring_cmd_del_cancelable(struct io_uring_cmd *cmd,
>  }
>
>  /*
> - * Mark this command as concelable, then io_uring_try_cancel_uring_cmd()
> + * Mark this command as cancelable, then io_uring_try_cancel_uring_cmd()
>   * will try to cancel this issued command by sending ->uring_cmd() with
>   * issue_flags of IO_URING_F_CANCEL.
>   *
> @@ -168,7 +168,7 @@ void __io_uring_cmd_done(struct io_uring_cmd *ioucmd, s32 ret, u64 res2,
>         }
>         io_req_uring_cleanup(req, issue_flags);
>         if (req->flags & REQ_F_IOPOLL) {
> -               /* order with io_iopoll_req_issued() checking ->iopoll_complete */
> +               /* order with io_do_iopoll() checking ->iopoll_completed */

Looks like the comment in io_complete_rw_iopoll() also refers to a
(different) incorrect function

Best,
Caleb

>                 smp_store_release(&req->iopoll_completed, 1);
>         } else if (issue_flags & IO_URING_F_COMPLETE_DEFER) {
>                 if (WARN_ON_ONCE(issue_flags & IO_URING_F_UNLOCKED))
> --
> 2.25.1
>
>

Re: [PATCH 1/2] io_uring/uring_cmd: copy SQE before issue_blocking punt

[Caleb Sander Mateos]

On Thu, Jul 2, 2026 at 1:41 AM Yang Xiuwei <yangxiuwei@kylinos.cn> wrote:
>
> io_uring_cmd_issue_blocking() punts to io-wq without copying the SQE
> off the submission queue, unlike the -EAGAIN and fallback paths. Copy
> the SQE into async data before queuing the work.

Add a Fixes tag?
Fixes: ecf47d452ced ("io_uring/uring_cmd: implement ->sqe_copy() to
avoid unnecessary copies")

>
> Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
> ---
>  io_uring/uring_cmd.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c
> index 7b25dcd9d05f..fe32311b2e51 100644
> --- a/io_uring/uring_cmd.c
> +++ b/io_uring/uring_cmd.c
> @@ -326,6 +326,10 @@ void io_uring_cmd_issue_blocking(struct io_uring_cmd *ioucmd)
>  {
>         struct io_kiocb *req = cmd_to_io_kiocb(ioucmd);
>
> +       if (!(req->flags & REQ_F_SQE_COPIED)) {
> +               io_uring_cmd_sqe_copy(req);
> +               req->flags |= REQ_F_SQE_COPIED;

Isn't this too late to copy the SQE? io_uring_cmd_issue_blocking() is
called from the blk_cmd_complete() task work, which is already
asynchronous with respect to the submission. So the kernel will
already returned the SQ slot to userspace.

Best,
Caleb

> +       }
>         io_req_queue_iowq(req);
>  }
>
> --
> 2.25.1
>
>

Re: [PATCH 1/2] io_uring/uring_cmd: copy SQE before issue_blocking punt

[Caleb Sander Mateos]

On Thu, Jul 2, 2026 at 10:43 AM Caleb Sander Mateos
<csander@purestorage.com> wrote:
>
> On Thu, Jul 2, 2026 at 1:41 AM Yang Xiuwei <yangxiuwei@kylinos.cn> wrote:
> >
> > io_uring_cmd_issue_blocking() punts to io-wq without copying the SQE
> > off the submission queue, unlike the -EAGAIN and fallback paths. Copy
> > the SQE into async data before queuing the work.
>
> Add a Fixes tag?
> Fixes: ecf47d452ced ("io_uring/uring_cmd: implement ->sqe_copy() to
> avoid unnecessary copies")

Actually I'm not convinced this is an issue at all. Since commit
212ec34e4e72 ("block: only read from sqe on initial invocation of
blkdev_uring_cmd()"), blkdev_uring_cmd() only accesses the SQE on the
initial issue. Even if the uring_cmd is re-issued asynchronously, it
doesn't rely on the SQE having been preserved.

Best,
Caleb

Re: [PATCH 1/2] io_uring/uring_cmd: copy SQE before issue_blocking punt

[Jens Axboe]

On 7/2/26 12:06 PM, Caleb Sander Mateos wrote:
> On Thu, Jul 2, 2026 at 10:43 AM Caleb Sander Mateos
> <csander@purestorage.com> wrote:
>>
>> On Thu, Jul 2, 2026 at 1:41 AM Yang Xiuwei <yangxiuwei@kylinos.cn> wrote:
>>>
>>> io_uring_cmd_issue_blocking() punts to io-wq without copying the SQE
>>> off the submission queue, unlike the -EAGAIN and fallback paths. Copy
>>> the SQE into async data before queuing the work.
>>
>> Add a Fixes tag?
>> Fixes: ecf47d452ced ("io_uring/uring_cmd: implement ->sqe_copy() to
>> avoid unnecessary copies")
> 
> Actually I'm not convinced this is an issue at all. Since commit
> 212ec34e4e72 ("block: only read from sqe on initial invocation of
> blkdev_uring_cmd()"), blkdev_uring_cmd() only accesses the SQE on the
> initial issue. Even if the uring_cmd is re-issued asynchronously, it
> doesn't rely on the SQE having been preserved.

Yeah I agree, after taking a closer look. I'll kill this patch. I do
like your followup cleaning up the punting, will queue that for 7.3.

-- 
Jens Axboe