1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/bsg.h>
3 #include <linux/io_uring/cmd.h>
4 #include <scsi/scsi.h>
5 #include <scsi/scsi_ioctl.h>
6 #include <scsi/scsi_cmnd.h>
7 #include <scsi/scsi_device.h>
8 #include <scsi/sg.h>
9 #include "scsi_priv.h"
10
11 #define uptr64(val) ((void __user *)(uintptr_t)(val))
12
13 /*
14 * Per-command BSG SCSI PDU stored in io_uring_cmd.pdu[32].
15 * Holds temporary state between submission, completion and task_work.
16 */
17 struct scsi_bsg_uring_cmd_pdu {
18 struct bio *bio; /* mapped user buffer, unmap in task work */
19 struct request *req; /* block request, freed in task work */
20 u64 response_addr; /* user space response buffer address */
21 u32 max_response_len; /* user response buffer size */
22 };
23 static_assert(sizeof(struct scsi_bsg_uring_cmd_pdu) <= sizeof_field(struct io_uring_cmd, pdu));
24
scsi_bsg_uring_cmd_pdu(struct io_uring_cmd * ioucmd)25 static inline struct scsi_bsg_uring_cmd_pdu *scsi_bsg_uring_cmd_pdu(
26 struct io_uring_cmd *ioucmd)
27 {
28 return io_uring_cmd_to_pdu(ioucmd, struct scsi_bsg_uring_cmd_pdu);
29 }
30
31 /* Task work: build res2 (layout in uapi/linux/bsg.h) and copy sense to user. */
scsi_bsg_uring_task_cb(struct io_tw_req tw_req,io_tw_token_t tw)32 static void scsi_bsg_uring_task_cb(struct io_tw_req tw_req, io_tw_token_t tw)
33 {
34 struct io_uring_cmd *ioucmd = io_uring_cmd_from_tw(tw_req);
35 struct scsi_bsg_uring_cmd_pdu *pdu = scsi_bsg_uring_cmd_pdu(ioucmd);
36 struct request *rq = pdu->req;
37 struct scsi_cmnd *scmd = blk_mq_rq_to_pdu(rq);
38 u64 res2;
39 int ret = 0;
40 u8 driver_status = 0;
41 u8 sense_len_wr = 0;
42
43 if (pdu->bio)
44 blk_rq_unmap_user(pdu->bio);
45
46 if (scsi_status_is_check_condition(scmd->result)) {
47 driver_status = DRIVER_SENSE;
48 if (pdu->response_addr)
49 sense_len_wr = min_t(unsigned int, pdu->max_response_len,
50 scmd->sense_len);
51 }
52
53 if (sense_len_wr) {
54 if (copy_to_user(uptr64(pdu->response_addr), scmd->sense_buffer,
55 sense_len_wr))
56 ret = -EFAULT;
57 }
58
59 res2 = bsg_scsi_res2_build(status_byte(scmd->result), driver_status,
60 host_byte(scmd->result), sense_len_wr,
61 scmd->resid_len);
62
63 blk_mq_free_request(rq);
64 io_uring_cmd_done32(ioucmd, ret, res2,
65 IO_URING_CMD_TASK_WORK_ISSUE_FLAGS);
66 }
67
scsi_bsg_uring_cmd_done(struct request * req,blk_status_t status,const struct io_comp_batch * iocb)68 static enum rq_end_io_ret scsi_bsg_uring_cmd_done(struct request *req,
69 blk_status_t status,
70 const struct io_comp_batch *iocb)
71 {
72 struct io_uring_cmd *ioucmd = req->end_io_data;
73
74 io_uring_cmd_do_in_task_lazy(ioucmd, scsi_bsg_uring_task_cb);
75 return RQ_END_IO_NONE;
76 }
77
scsi_bsg_map_user_buffer(struct request * req,struct io_uring_cmd * ioucmd,unsigned int issue_flags,gfp_t gfp_mask,bool is_write,u64 buf_addr,unsigned long buf_len)78 static int scsi_bsg_map_user_buffer(struct request *req,
79 struct io_uring_cmd *ioucmd,
80 unsigned int issue_flags, gfp_t gfp_mask,
81 bool is_write, u64 buf_addr,
82 unsigned long buf_len)
83 {
84 struct iov_iter iter;
85 int ret;
86
87 if (ioucmd->flags & IORING_URING_CMD_FIXED) {
88 ret = io_uring_cmd_import_fixed(buf_addr, buf_len,
89 is_write ? WRITE : READ,
90 &iter, ioucmd, issue_flags);
91 if (ret < 0)
92 return ret;
93 ret = blk_rq_map_user_iov(req->q, req, NULL, &iter, gfp_mask);
94 } else {
95 ret = blk_rq_map_user(req->q, req, NULL, uptr64(buf_addr),
96 buf_len, gfp_mask);
97 }
98
99 return ret;
100 }
101
scsi_bsg_uring_cmd(struct request_queue * q,struct io_uring_cmd * ioucmd,unsigned int issue_flags,bool open_for_write)102 static int scsi_bsg_uring_cmd(struct request_queue *q, struct io_uring_cmd *ioucmd,
103 unsigned int issue_flags, bool open_for_write)
104 {
105 struct scsi_bsg_uring_cmd_pdu *pdu = scsi_bsg_uring_cmd_pdu(ioucmd);
106 const struct bsg_uring_cmd *cmd =
107 io_uring_sqe128_cmd(ioucmd->sqe, struct bsg_uring_cmd);
108 struct scsi_cmnd *scmd;
109 struct request *req;
110 blk_mq_req_flags_t blk_flags = 0;
111 gfp_t gfp_mask = GFP_KERNEL;
112 u64 request = READ_ONCE(cmd->request);
113 u32 request_len = READ_ONCE(cmd->request_len);
114 u64 dout_xferp = READ_ONCE(cmd->dout_xferp);
115 u32 dout_xfer_len = READ_ONCE(cmd->dout_xfer_len);
116 u64 din_xferp = READ_ONCE(cmd->din_xferp);
117 u32 din_xfer_len = READ_ONCE(cmd->din_xfer_len);
118 int ret;
119
120 if (cmd->protocol != BSG_PROTOCOL_SCSI ||
121 cmd->subprotocol != BSG_SUB_PROTOCOL_SCSI_CMD)
122 return -EINVAL;
123
124 if (!request || request_len == 0)
125 return -EINVAL;
126
127 if (dout_xfer_len && din_xfer_len) {
128 pr_warn_once("BIDI support in bsg has been removed.\n");
129 return -EOPNOTSUPP;
130 }
131
132 if (cmd->dout_iovec_count > 0 || cmd->din_iovec_count > 0)
133 return -EOPNOTSUPP;
134
135 if (issue_flags & IO_URING_F_NONBLOCK) {
136 blk_flags = BLK_MQ_REQ_NOWAIT;
137 gfp_mask = GFP_NOWAIT;
138 }
139
140 req = scsi_alloc_request(q, dout_xfer_len ?
141 REQ_OP_DRV_OUT : REQ_OP_DRV_IN, blk_flags);
142 if (IS_ERR(req))
143 return PTR_ERR(req);
144
145 scmd = blk_mq_rq_to_pdu(req);
146 if (request_len > sizeof(scmd->cmnd)) {
147 ret = -EINVAL;
148 goto out_free_req;
149 }
150 scmd->cmd_len = request_len;
151 scmd->allowed = SG_DEFAULT_RETRIES;
152
153 if (copy_from_user(scmd->cmnd, uptr64(request), request_len)) {
154 ret = -EFAULT;
155 goto out_free_req;
156 }
157
158 if (!scsi_cmd_allowed(scmd->cmnd, open_for_write)) {
159 ret = -EPERM;
160 goto out_free_req;
161 }
162
163 pdu->response_addr = cmd->response;
164 pdu->max_response_len = cmd->max_response_len;
165
166 if (dout_xfer_len || din_xfer_len) {
167 bool is_write = dout_xfer_len > 0;
168 u64 buf_addr = is_write ? dout_xferp : din_xferp;
169 unsigned long buf_len = is_write ? dout_xfer_len : din_xfer_len;
170
171 ret = scsi_bsg_map_user_buffer(req, ioucmd, issue_flags,
172 gfp_mask, is_write, buf_addr,
173 buf_len);
174 if (ret)
175 goto out_free_req;
176 pdu->bio = req->bio;
177 } else {
178 pdu->bio = NULL;
179 }
180
181 req->timeout = cmd->timeout_ms ?
182 msecs_to_jiffies(cmd->timeout_ms) : BLK_DEFAULT_SG_TIMEOUT;
183
184 req->end_io = scsi_bsg_uring_cmd_done;
185 req->end_io_data = ioucmd;
186 pdu->req = req;
187
188 blk_execute_rq_nowait(req, false);
189 return -EIOCBQUEUED;
190
191 out_free_req:
192 blk_mq_free_request(req);
193 return ret;
194 }
195
scsi_bsg_sg_io_fn(struct request_queue * q,struct sg_io_v4 * hdr,bool open_for_write,unsigned int timeout)196 static int scsi_bsg_sg_io_fn(struct request_queue *q, struct sg_io_v4 *hdr,
197 bool open_for_write, unsigned int timeout)
198 {
199 struct scsi_cmnd *scmd;
200 struct request *rq;
201 struct bio *bio;
202 int ret;
203
204 if (hdr->protocol != BSG_PROTOCOL_SCSI ||
205 hdr->subprotocol != BSG_SUB_PROTOCOL_SCSI_CMD)
206 return -EINVAL;
207 if (hdr->dout_xfer_len && hdr->din_xfer_len) {
208 pr_warn_once("BIDI support in bsg has been removed.\n");
209 return -EOPNOTSUPP;
210 }
211
212 rq = scsi_alloc_request(q, hdr->dout_xfer_len ?
213 REQ_OP_DRV_OUT : REQ_OP_DRV_IN, 0);
214 if (IS_ERR(rq))
215 return PTR_ERR(rq);
216 rq->timeout = timeout;
217
218 scmd = blk_mq_rq_to_pdu(rq);
219 scmd->cmd_len = hdr->request_len;
220 if (scmd->cmd_len > sizeof(scmd->cmnd)) {
221 ret = -EINVAL;
222 goto out_put_request;
223 }
224
225 ret = -EFAULT;
226 if (copy_from_user(scmd->cmnd, uptr64(hdr->request), scmd->cmd_len))
227 goto out_put_request;
228 ret = -EPERM;
229 if (!scsi_cmd_allowed(scmd->cmnd, open_for_write))
230 goto out_put_request;
231
232 ret = 0;
233 if (hdr->dout_xfer_len) {
234 ret = blk_rq_map_user(rq->q, rq, NULL, uptr64(hdr->dout_xferp),
235 hdr->dout_xfer_len, GFP_KERNEL);
236 } else if (hdr->din_xfer_len) {
237 ret = blk_rq_map_user(rq->q, rq, NULL, uptr64(hdr->din_xferp),
238 hdr->din_xfer_len, GFP_KERNEL);
239 }
240
241 if (ret)
242 goto out_put_request;
243
244 bio = rq->bio;
245 blk_execute_rq(rq, !(hdr->flags & BSG_FLAG_Q_AT_TAIL));
246
247 /*
248 * fill in all the output members
249 */
250 hdr->device_status = scmd->result & 0xff;
251 hdr->transport_status = host_byte(scmd->result);
252 hdr->driver_status = 0;
253 if (scsi_status_is_check_condition(scmd->result))
254 hdr->driver_status = DRIVER_SENSE;
255 hdr->info = 0;
256 if (hdr->device_status || hdr->transport_status || hdr->driver_status)
257 hdr->info |= SG_INFO_CHECK;
258 hdr->response_len = 0;
259
260 if (scmd->sense_len && hdr->response) {
261 int len = min_t(unsigned int, hdr->max_response_len,
262 scmd->sense_len);
263
264 if (copy_to_user(uptr64(hdr->response), scmd->sense_buffer,
265 len))
266 ret = -EFAULT;
267 else
268 hdr->response_len = len;
269 }
270
271 if (rq_data_dir(rq) == READ)
272 hdr->din_resid = scmd->resid_len;
273 else
274 hdr->dout_resid = scmd->resid_len;
275
276 blk_rq_unmap_user(bio);
277
278 out_put_request:
279 blk_mq_free_request(rq);
280 return ret;
281 }
282
scsi_bsg_register_queue(struct scsi_device * sdev)283 struct bsg_device *scsi_bsg_register_queue(struct scsi_device *sdev)
284 {
285 return bsg_register_queue(sdev->request_queue, &sdev->sdev_gendev,
286 dev_name(&sdev->sdev_gendev), scsi_bsg_sg_io_fn,
287 scsi_bsg_uring_cmd);
288 }
289