From: Keith Busch <kbusch@xxxxxxxxxx>
The nvme passthrough interface through io_uring is intended to be fast, so we
should avoid calling capable() every io. Checking other permission first helped
reduce this overhead, but it's still called for many commands.
Use the new uring_cmd sys admin issue_flag to see if we can skip
additional checks. The ioctl path won't be able to use this
optimization, but that wasn't considered a fast path anyway.
Signed-off-by: Keith Busch <kbusch@xxxxxxxxxx>
---
drivers/nvme/host/ioctl.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
index 6c5ae820bc0fc..83c0a1170505c 100644
--- a/drivers/nvme/host/ioctl.c
+++ b/drivers/nvme/host/ioctl.c
@@ -11,6 +11,7 @@
enum {
NVME_IOCTL_VEC = (1 << 0),
NVME_IOCTL_PARTITION = (1 << 1),
+ NVME_IOCTL_SYS_ADMIN = (1 << 2),
};
static bool nvme_cmd_allowed(struct nvme_ns *ns, struct nvme_command *c,
@@ -18,6 +19,9 @@ static bool nvme_cmd_allowed(struct nvme_ns *ns, struct nvme_command *c,
{
u32 effects;
+ if (flags & NVME_IOCTL_SYS_ADMIN)
+ return true;
+
/*
* Do not allow unprivileged passthrough on partitions, as that allows an
* escape from the containment of the partition.
@@ -445,7 +449,7 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
struct request *req;
blk_opf_t rq_flags = REQ_ALLOC_CACHE;
blk_mq_req_flags_t blk_flags = 0;
- int ret;
+ int ret, flags = 0;
c.common.opcode = READ_ONCE(cmd->opcode);
c.common.flags = READ_ONCE(cmd->flags);
@@ -468,7 +472,11 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
c.common.cdw14 = cpu_to_le32(READ_ONCE(cmd->cdw14));
c.common.cdw15 = cpu_to_le32(READ_ONCE(cmd->cdw15));
- if (!nvme_cmd_allowed(ns, &c, 0, ioucmd->file->f_mode & FMODE_WRITE))
+ if (issue_flags & IO_URING_F_SYS_ADMIN)
+ flags |= NVME_IOCTL_SYS_ADMIN;
+
+ if (!nvme_cmd_allowed(ns, &c, flags,
+ ioucmd->file->f_mode & FMODE_WRITE))
return -EACCES;
d.metadata = READ_ONCE(cmd->metadata);
--
2.34.1
