[PATCH 6/6] nvme/ioctl: support fixed buffer for metadata

From: Caleb Sander Mateos

Date: Wed Sep 09 2026 - 18:39:22 EST


io_uring NVMe passthrough supports using a "fixed" (registered) buffer
for data, but not metadata. On high-IOPS workloads, the pinning and
unpinning overhead for the metadata pages is significant and could be
avoided if fixed metadata buffers were supported.

Define a NVME_URING_CMD_FIXED_METADATA bit for the nvme_uring_cmd's
flags field (which is currently required to be 0) to indicate that the
metadata buffer belongs to a fixed buffer registered with the io_uring.
The metadata fixed buffer index is specified in a metadata_buf_index
field replacing the existing rsvd1 in nvme_uring_cmd.

If NVME_URING_CMD_FIXED_METADATA is set, the metadata iov_iter is
obtained from io_uring_cmd_import_fixed_metadata() instead of
iov_iter_ubuf().

Signed-off-by: Caleb Sander Mateos <csander@xxxxxxxxxxxxxxx>
---
drivers/nvme/host/ioctl.c | 21 ++++++++++++++++-----
include/uapi/linux/nvme_ioctl.h | 5 ++++-
2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
index 8e722184ecf1..4da8cf92c2e0 100644
--- a/drivers/nvme/host/ioctl.c
+++ b/drivers/nvme/host/ioctl.c
@@ -488,21 +488,22 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
struct iov_iter iter, meta_iter;
struct iov_iter *map_iter = NULL, *map_meta_iter = NULL;
struct request *req;
blk_opf_t rq_flags = 0;
blk_mq_req_flags_t blk_flags = 0;
+ u8 flags = READ_ONCE(cmd->flags);
u32 metadata_len, data_len;
u64 metadata, addr;
u32 timeout_ms;
int ddir;
int ret;

- c.common.opcode = READ_ONCE(cmd->opcode);
- c.common.flags = READ_ONCE(cmd->flags);
- if (c.common.flags)
+ if (flags & ~NVME_URING_CMD_FIXED_METADATA)
return -EINVAL;

+ c.common.opcode = READ_ONCE(cmd->opcode);
+ c.common.flags = 0;
c.common.command_id = 0;
c.common.nsid = cpu_to_le32(cmd->nsid);
if (!nvme_validate_passthru_nsid(ctrl, ns, le32_to_cpu(c.common.nsid)))
return -EINVAL;

@@ -539,12 +540,22 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
return ret;

map_iter = &iter;
}
if (data_len && metadata && metadata_len) {
- iov_iter_ubuf(&meta_iter, ddir, nvme_to_user_ptr(metadata),
- metadata_len);
+ if (flags & NVME_URING_CMD_FIXED_METADATA) {
+ u16 buf_index = READ_ONCE(cmd->metadata_buf_index);
+
+ ret = io_uring_cmd_import_fixed_metadata(
+ ioucmd, buf_index, metadata, metadata_len, ddir,
+ &meta_iter, issue_flags);
+ if (ret < 0)
+ return ret;
+ } else {
+ iov_iter_ubuf(&meta_iter, ddir, nvme_to_user_ptr(metadata),
+ metadata_len);
+ }
map_meta_iter = &meta_iter;
}

if (issue_flags & IO_URING_F_NONBLOCK) {
rq_flags |= REQ_NOWAIT;
diff --git a/include/uapi/linux/nvme_ioctl.h b/include/uapi/linux/nvme_ioctl.h
index 2f76cba67166..93973f636b48 100644
--- a/include/uapi/linux/nvme_ioctl.h
+++ b/include/uapi/linux/nvme_ioctl.h
@@ -68,15 +68,18 @@ struct nvme_passthru_cmd64 {
__u32 timeout_ms;
__u32 rsvd2;
__u64 result;
};

+/* struct nvme_uring_cmd flags field bits */
+#define NVME_URING_CMD_FIXED_METADATA (1U << 0)
+
/* same as struct nvme_passthru_cmd64, minus the 8b result field */
struct nvme_uring_cmd {
__u8 opcode;
__u8 flags;
- __u16 rsvd1;
+ __u16 metadata_buf_index;
__u32 nsid;
__u32 cdw2;
__u32 cdw3;
__u64 metadata;
__u64 addr;
--
2.55.0