[PATCH] nvme: map uring_cmd data even if address is 0

[PATCH] nvme: map uring_cmd data even if address is 0

[Xinyu Zhang]

When using kernel registered bvec fixed buffers, the "address" is
actually the offset into the bvec rather than userspace address.
Therefore it can be 0.
We can skip checking whether the address is NULL before mapping
uring_cmd data. Bad userspace address will be handled properly later when
the user buffer is imported.
With this patch, we will be able to use the kernel registered bvec fixed
buffers in io_uring NVMe passthru with ublk zero-copy support in
https://lore.kernel.org/io-uring/20250218224229.837848-1-kbusch@meta.com/T/#u.

Signed-off-by: Xinyu Zhang <xizhang@purestorage.com>
Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
---
 drivers/nvme/host/ioctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
index 60383da86feda..724ab542b4c33 100644
--- a/drivers/nvme/host/ioctl.c
+++ b/drivers/nvme/host/ioctl.c
@@ -500,7 +500,7 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
 		return PTR_ERR(req);
 	req->timeout = d.timeout_ms ? msecs_to_jiffies(d.timeout_ms) : 0;
 
-	if (d.addr && d.data_len) {
+	if (d.data_len) {
 		ret = nvme_map_user_request(req, d.addr,
 			d.data_len, nvme_to_user_ptr(d.metadata),
 			d.metadata_len, 0, ioucmd, vec);
-- 
2.17.1

Re: [PATCH] nvme: map uring_cmd data even if address is 0

[Keith Busch]

On Thu, Feb 20, 2025 at 04:51:01PM -0700, Xinyu Zhang wrote:
> When using kernel registered bvec fixed buffers, the "address" is
> actually the offset into the bvec rather than userspace address.
> Therefore it can be 0.

Nice, thanks for catching this.

I'm prepping a new ublk-zc version based on previous feedback. I'll add
this into the series once its ready, and I'm hoping by tomorrow.

Re: [PATCH] nvme: map uring_cmd data even if address is 0

[Jens Axboe]

On 2/20/25 4:51 PM, Xinyu Zhang wrote:
> When using kernel registered bvec fixed buffers, the "address" is
> actually the offset into the bvec rather than userspace address.
> Therefore it can be 0.
> We can skip checking whether the address is NULL before mapping
> uring_cmd data. Bad userspace address will be handled properly later when
> the user buffer is imported.
> With this patch, we will be able to use the kernel registered bvec fixed
> buffers in io_uring NVMe passthru with ublk zero-copy support in
> https://lore.kernel.org/io-uring/20250218224229.837848-1-kbusch@meta.com/T/#u.
> 
> Signed-off-by: Xinyu Zhang <xizhang@purestorage.com>
> Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
> ---
>  drivers/nvme/host/ioctl.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
> index 60383da86feda..724ab542b4c33 100644
> --- a/drivers/nvme/host/ioctl.c
> +++ b/drivers/nvme/host/ioctl.c
> @@ -500,7 +500,7 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
>  		return PTR_ERR(req);
>  	req->timeout = d.timeout_ms ? msecs_to_jiffies(d.timeout_ms) : 0;
>  
> -	if (d.addr && d.data_len) {
> +	if (d.data_len) {
>  		ret = nvme_map_user_request(req, d.addr,
>  			d.data_len, nvme_to_user_ptr(d.metadata),
>  			d.metadata_len, 0, ioucmd, vec);

Looks good to me:

Reviewed-by: Jens Axboe <axboe@kernel.dk>

-- 
Jens Axboe

Re: [PATCH] nvme: map uring_cmd data even if address is 0

[Christoph Hellwig]

On Thu, Feb 20, 2025 at 04:51:01PM -0700, Xinyu Zhang wrote:
> When using kernel registered bvec fixed buffers, the "address" is
> actually the offset into the bvec rather than userspace address.
> Therefore it can be 0.

How is that actually going to work?  Who is interpreting that address?

Re: [PATCH] nvme: map uring_cmd data even if address is 0

[Keith Busch]

On Mon, Feb 24, 2025 at 03:33:51PM +0100, Christoph Hellwig wrote:
> On Thu, Feb 20, 2025 at 04:51:01PM -0700, Xinyu Zhang wrote:
> > When using kernel registered bvec fixed buffers, the "address" is
> > actually the offset into the bvec rather than userspace address.
> > Therefore it can be 0.
> 
> How is that actually going to work?  Who is interpreting that address?

io_import_fixed() treats the address as an offset into its bio_vec.

Re: [PATCH] nvme: map uring_cmd data even if address is 0

[Christoph Hellwig]

On Mon, Feb 24, 2025 at 07:54:59AM -0700, Keith Busch wrote:
> On Mon, Feb 24, 2025 at 03:33:51PM +0100, Christoph Hellwig wrote:
> > On Thu, Feb 20, 2025 at 04:51:01PM -0700, Xinyu Zhang wrote:
> > > When using kernel registered bvec fixed buffers, the "address" is
> > > actually the offset into the bvec rather than userspace address.
> > > Therefore it can be 0.
> > 
> > How is that actually going to work?  Who is interpreting that address?
> 
> io_import_fixed() treats the address as an offset into its bio_vec.

Ah, yes.  This is in nvme_uring_data and read from the SQE.  I thought
we were further down.