1 /*- 2 * Copyright (c) 2013-2015 Gleb Smirnoff <glebius@FreeBSD.org> 3 * Copyright (c) 1998, David Greenman. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the University nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include "opt_kern_tls.h" 34 35 #include <sys/param.h> 36 #include <sys/systm.h> 37 #include <sys/capsicum.h> 38 #include <sys/kernel.h> 39 #include <netinet/in.h> 40 #include <sys/lock.h> 41 #include <sys/ktls.h> 42 #include <sys/mutex.h> 43 #include <sys/sysproto.h> 44 #include <sys/malloc.h> 45 #include <sys/proc.h> 46 #include <sys/mman.h> 47 #include <sys/mount.h> 48 #include <sys/mbuf.h> 49 #include <sys/protosw.h> 50 #include <sys/rwlock.h> 51 #include <sys/sf_buf.h> 52 #include <sys/socket.h> 53 #include <sys/socketvar.h> 54 #include <sys/syscallsubr.h> 55 #include <sys/sysctl.h> 56 #include <sys/vnode.h> 57 58 #include <net/vnet.h> 59 #include <netinet/tcp.h> 60 61 #include <security/audit/audit.h> 62 #include <security/mac/mac_framework.h> 63 64 #include <vm/vm.h> 65 #include <vm/vm_object.h> 66 #include <vm/vm_pager.h> 67 68 #define EXT_FLAG_SYNC EXT_FLAG_VENDOR1 69 #define EXT_FLAG_NOCACHE EXT_FLAG_VENDOR2 70 #define EXT_FLAG_CACHE_LAST EXT_FLAG_VENDOR3 71 72 /* 73 * Structure describing a single sendfile(2) I/O, which may consist of 74 * several underlying pager I/Os. 75 * 76 * The syscall context allocates the structure and initializes 'nios' 77 * to 1. As sendfile_swapin() runs through pages and starts asynchronous 78 * paging operations, it increments 'nios'. 79 * 80 * Every I/O completion calls sendfile_iodone(), which decrements the 'nios', 81 * and the syscall also calls sendfile_iodone() after allocating all mbufs, 82 * linking them and sending to socket. Whoever reaches zero 'nios' is 83 * responsible to * call pru_ready on the socket, to notify it of readyness 84 * of the data. 85 */ 86 struct sf_io { 87 volatile u_int nios; 88 u_int error; 89 int npages; 90 struct socket *so; 91 struct mbuf *m; 92 #ifdef KERN_TLS 93 struct ktls_session *tls; 94 #endif 95 vm_page_t pa[]; 96 }; 97 98 /* 99 * Structure used to track requests with SF_SYNC flag. 100 */ 101 struct sendfile_sync { 102 struct mtx mtx; 103 struct cv cv; 104 unsigned count; 105 }; 106 107 counter_u64_t sfstat[sizeof(struct sfstat) / sizeof(uint64_t)]; 108 109 static void 110 sfstat_init(const void *unused) 111 { 112 113 COUNTER_ARRAY_ALLOC(sfstat, sizeof(struct sfstat) / sizeof(uint64_t), 114 M_WAITOK); 115 } 116 SYSINIT(sfstat, SI_SUB_MBUF, SI_ORDER_FIRST, sfstat_init, NULL); 117 118 static int 119 sfstat_sysctl(SYSCTL_HANDLER_ARGS) 120 { 121 struct sfstat s; 122 123 COUNTER_ARRAY_COPY(sfstat, &s, sizeof(s) / sizeof(uint64_t)); 124 if (req->newptr) 125 COUNTER_ARRAY_ZERO(sfstat, sizeof(s) / sizeof(uint64_t)); 126 return (SYSCTL_OUT(req, &s, sizeof(s))); 127 } 128 SYSCTL_PROC(_kern_ipc, OID_AUTO, sfstat, CTLTYPE_OPAQUE | CTLFLAG_RW, 129 NULL, 0, sfstat_sysctl, "I", "sendfile statistics"); 130 131 static void 132 sendfile_free_mext(struct mbuf *m) 133 { 134 struct sf_buf *sf; 135 vm_page_t pg; 136 int flags; 137 138 KASSERT(m->m_flags & M_EXT && m->m_ext.ext_type == EXT_SFBUF, 139 ("%s: m %p !M_EXT or !EXT_SFBUF", __func__, m)); 140 141 sf = m->m_ext.ext_arg1; 142 pg = sf_buf_page(sf); 143 flags = (m->m_ext.ext_flags & EXT_FLAG_NOCACHE) != 0 ? VPR_TRYFREE : 0; 144 145 sf_buf_free(sf); 146 vm_page_release(pg, flags); 147 148 if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { 149 struct sendfile_sync *sfs = m->m_ext.ext_arg2; 150 151 mtx_lock(&sfs->mtx); 152 KASSERT(sfs->count > 0, ("Sendfile sync botchup count == 0")); 153 if (--sfs->count == 0) 154 cv_signal(&sfs->cv); 155 mtx_unlock(&sfs->mtx); 156 } 157 } 158 159 static void 160 sendfile_free_mext_pg(struct mbuf *m) 161 { 162 struct mbuf_ext_pgs *ext_pgs; 163 vm_page_t pg; 164 int flags, i; 165 bool cache_last; 166 167 KASSERT(m->m_flags & M_EXT && m->m_ext.ext_type == EXT_PGS, 168 ("%s: m %p !M_EXT or !EXT_PGS", __func__, m)); 169 170 cache_last = m->m_ext.ext_flags & EXT_FLAG_CACHE_LAST; 171 ext_pgs = m->m_ext.ext_pgs; 172 flags = (m->m_ext.ext_flags & EXT_FLAG_NOCACHE) != 0 ? VPR_TRYFREE : 0; 173 174 for (i = 0; i < ext_pgs->npgs; i++) { 175 if (cache_last && i == ext_pgs->npgs - 1) 176 flags = 0; 177 pg = PHYS_TO_VM_PAGE(ext_pgs->pa[i]); 178 vm_page_release(pg, flags); 179 } 180 181 if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { 182 struct sendfile_sync *sfs = m->m_ext.ext_arg2; 183 184 mtx_lock(&sfs->mtx); 185 KASSERT(sfs->count > 0, ("Sendfile sync botchup count == 0")); 186 if (--sfs->count == 0) 187 cv_signal(&sfs->cv); 188 mtx_unlock(&sfs->mtx); 189 } 190 } 191 192 /* 193 * Helper function to calculate how much data to put into page i of n. 194 * Only first and last pages are special. 195 */ 196 static inline off_t 197 xfsize(int i, int n, off_t off, off_t len) 198 { 199 200 if (i == 0) 201 return (omin(PAGE_SIZE - (off & PAGE_MASK), len)); 202 203 if (i == n - 1 && ((off + len) & PAGE_MASK) > 0) 204 return ((off + len) & PAGE_MASK); 205 206 return (PAGE_SIZE); 207 } 208 209 /* 210 * Helper function to get offset within object for i page. 211 */ 212 static inline vm_ooffset_t 213 vmoff(int i, off_t off) 214 { 215 216 if (i == 0) 217 return ((vm_ooffset_t)off); 218 219 return (trunc_page(off + i * PAGE_SIZE)); 220 } 221 222 /* 223 * Helper function used when allocation of a page or sf_buf failed. 224 * Pretend as if we don't have enough space, subtract xfsize() of 225 * all pages that failed. 226 */ 227 static inline void 228 fixspace(int old, int new, off_t off, int *space) 229 { 230 231 KASSERT(old > new, ("%s: old %d new %d", __func__, old, new)); 232 233 /* Subtract last one. */ 234 *space -= xfsize(old - 1, old, off, *space); 235 old--; 236 237 if (new == old) 238 /* There was only one page. */ 239 return; 240 241 /* Subtract first one. */ 242 if (new == 0) { 243 *space -= xfsize(0, old, off, *space); 244 new++; 245 } 246 247 /* Rest of pages are full sized. */ 248 *space -= (old - new) * PAGE_SIZE; 249 250 KASSERT(*space >= 0, ("%s: space went backwards", __func__)); 251 } 252 253 /* 254 * I/O completion callback. 255 */ 256 static void 257 sendfile_iodone(void *arg, vm_page_t *pg, int count, int error) 258 { 259 struct sf_io *sfio = arg; 260 struct socket *so = sfio->so; 261 262 for (int i = 0; i < count; i++) 263 if (pg[i] != bogus_page) 264 vm_page_xunbusy_unchecked(pg[i]); 265 266 if (error) 267 sfio->error = error; 268 269 if (!refcount_release(&sfio->nios)) 270 return; 271 272 if (__predict_false(sfio->error && sfio->m == NULL)) { 273 /* 274 * I/O operation failed, but pru_send hadn't been executed - 275 * nothing had been sent to the socket. The syscall has 276 * returned error to the user. 277 */ 278 free(sfio, M_TEMP); 279 return; 280 } 281 282 #if defined(KERN_TLS) && defined(INVARIANTS) 283 if ((sfio->m->m_flags & M_EXT) != 0 && 284 sfio->m->m_ext.ext_type == EXT_PGS) 285 KASSERT(sfio->tls == sfio->m->m_ext.ext_pgs->tls, 286 ("TLS session mismatch")); 287 else 288 KASSERT(sfio->tls == NULL, 289 ("non-ext_pgs mbuf with TLS session")); 290 #endif 291 CURVNET_SET(so->so_vnet); 292 if (__predict_false(sfio->error)) { 293 /* 294 * I/O operation failed. The state of data in the socket 295 * is now inconsistent, and all what we can do is to tear 296 * it down. Protocol abort method would tear down protocol 297 * state, free all ready mbufs and detach not ready ones. 298 * We will free the mbufs corresponding to this I/O manually. 299 * 300 * The socket would be marked with EIO and made available 301 * for read, so that application receives EIO on next 302 * syscall and eventually closes the socket. 303 */ 304 so->so_proto->pr_usrreqs->pru_abort(so); 305 so->so_error = EIO; 306 307 mb_free_notready(sfio->m, sfio->npages); 308 #ifdef KERN_TLS 309 } else if (sfio->tls != NULL && sfio->tls->mode == TCP_TLS_MODE_SW) { 310 /* 311 * I/O operation is complete, but we still need to 312 * encrypt. We cannot do this in the interrupt thread 313 * of the disk controller, so forward the mbufs to a 314 * different thread. 315 * 316 * Donate the socket reference from sfio to rather 317 * than explicitly invoking soref(). 318 */ 319 ktls_enqueue(sfio->m, so, sfio->npages); 320 goto out_with_ref; 321 #endif 322 } else 323 (void)(so->so_proto->pr_usrreqs->pru_ready)(so, sfio->m, 324 sfio->npages); 325 326 SOCK_LOCK(so); 327 sorele(so); 328 #ifdef KERN_TLS 329 out_with_ref: 330 #endif 331 CURVNET_RESTORE(); 332 free(sfio, M_TEMP); 333 } 334 335 /* 336 * Iterate through pages vector and request paging for non-valid pages. 337 */ 338 static int 339 sendfile_swapin(vm_object_t obj, struct sf_io *sfio, int *nios, off_t off, 340 off_t len, int npages, int rhpages, int flags) 341 { 342 vm_page_t *pa = sfio->pa; 343 int grabbed; 344 345 *nios = 0; 346 flags = (flags & SF_NODISKIO) ? VM_ALLOC_NOWAIT : 0; 347 348 /* 349 * First grab all the pages and wire them. Note that we grab 350 * only required pages. Readahead pages are dealt with later. 351 */ 352 VM_OBJECT_WLOCK(obj); 353 354 grabbed = vm_page_grab_pages(obj, OFF_TO_IDX(off), 355 VM_ALLOC_NORMAL | VM_ALLOC_WIRED | flags, pa, npages); 356 if (grabbed < npages) { 357 for (int i = grabbed; i < npages; i++) 358 pa[i] = NULL; 359 npages = grabbed; 360 rhpages = 0; 361 } 362 363 for (int i = 0; i < npages;) { 364 int j, a, count, rv; 365 366 /* Skip valid pages. */ 367 if (vm_page_is_valid(pa[i], vmoff(i, off) & PAGE_MASK, 368 xfsize(i, npages, off, len))) { 369 vm_page_xunbusy(pa[i]); 370 SFSTAT_INC(sf_pages_valid); 371 i++; 372 continue; 373 } 374 375 /* 376 * Next page is invalid. Check if it belongs to pager. It 377 * may not be there, which is a regular situation for shmem 378 * pager. For vnode pager this happens only in case of 379 * a sparse file. 380 * 381 * Important feature of vm_pager_has_page() is the hint 382 * stored in 'a', about how many pages we can pagein after 383 * this page in a single I/O. 384 */ 385 if (!vm_pager_has_page(obj, OFF_TO_IDX(vmoff(i, off)), NULL, 386 &a)) { 387 pmap_zero_page(pa[i]); 388 pa[i]->valid = VM_PAGE_BITS_ALL; 389 MPASS(pa[i]->dirty == 0); 390 vm_page_xunbusy(pa[i]); 391 i++; 392 continue; 393 } 394 395 /* 396 * We want to pagein as many pages as possible, limited only 397 * by the 'a' hint and actual request. 398 */ 399 count = min(a + 1, npages - i); 400 401 /* 402 * We should not pagein into a valid page, thus we first trim 403 * any valid pages off the end of request, and substitute 404 * to bogus_page those, that are in the middle. 405 */ 406 for (j = i + count - 1; j > i; j--) { 407 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 408 xfsize(j, npages, off, len))) { 409 count--; 410 rhpages = 0; 411 } else 412 break; 413 } 414 for (j = i + 1; j < i + count - 1; j++) 415 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 416 xfsize(j, npages, off, len))) { 417 vm_page_xunbusy(pa[j]); 418 SFSTAT_INC(sf_pages_valid); 419 SFSTAT_INC(sf_pages_bogus); 420 pa[j] = bogus_page; 421 } 422 423 refcount_acquire(&sfio->nios); 424 rv = vm_pager_get_pages_async(obj, pa + i, count, NULL, 425 i + count == npages ? &rhpages : NULL, 426 &sendfile_iodone, sfio); 427 if (__predict_false(rv != VM_PAGER_OK)) { 428 /* 429 * Perform full pages recovery before returning EIO. 430 * Pages from 0 to npages are wired. 431 * Pages from i to npages are also busied. 432 * Pages from (i + 1) to (i + count - 1) may be 433 * substituted to bogus page, and not busied. 434 */ 435 for (j = 0; j < npages; j++) { 436 if (j > i && j < i + count - 1 && 437 pa[j] == bogus_page) 438 pa[j] = vm_page_lookup(obj, 439 OFF_TO_IDX(vmoff(j, off))); 440 else if (j >= i) 441 vm_page_xunbusy(pa[j]); 442 KASSERT(pa[j] != NULL && pa[j] != bogus_page, 443 ("%s: page %p[%d] I/O recovery failure", 444 __func__, pa, j)); 445 vm_page_unwire(pa[j], PQ_INACTIVE); 446 } 447 VM_OBJECT_WUNLOCK(obj); 448 return (EIO); 449 } 450 451 SFSTAT_INC(sf_iocnt); 452 SFSTAT_ADD(sf_pages_read, count); 453 if (i + count == npages) 454 SFSTAT_ADD(sf_rhpages_read, rhpages); 455 456 /* 457 * Restore the valid page pointers. They are already 458 * unbusied, but still wired. 459 */ 460 for (j = i; j < i + count; j++) 461 if (pa[j] == bogus_page) { 462 pa[j] = vm_page_lookup(obj, 463 OFF_TO_IDX(vmoff(j, off))); 464 KASSERT(pa[j], ("%s: page %p[%d] disappeared", 465 __func__, pa, j)); 466 467 } 468 i += count; 469 (*nios)++; 470 } 471 472 VM_OBJECT_WUNLOCK(obj); 473 474 if (*nios == 0 && npages != 0) 475 SFSTAT_INC(sf_noiocnt); 476 477 return (0); 478 } 479 480 static int 481 sendfile_getobj(struct thread *td, struct file *fp, vm_object_t *obj_res, 482 struct vnode **vp_res, struct shmfd **shmfd_res, off_t *obj_size, 483 int *bsize) 484 { 485 struct vattr va; 486 vm_object_t obj; 487 struct vnode *vp; 488 struct shmfd *shmfd; 489 int error; 490 491 vp = *vp_res = NULL; 492 obj = NULL; 493 shmfd = *shmfd_res = NULL; 494 *bsize = 0; 495 496 /* 497 * The file descriptor must be a regular file and have a 498 * backing VM object. 499 */ 500 if (fp->f_type == DTYPE_VNODE) { 501 vp = fp->f_vnode; 502 vn_lock(vp, LK_SHARED | LK_RETRY); 503 if (vp->v_type != VREG) { 504 error = EINVAL; 505 goto out; 506 } 507 *bsize = vp->v_mount->mnt_stat.f_iosize; 508 error = VOP_GETATTR(vp, &va, td->td_ucred); 509 if (error != 0) 510 goto out; 511 *obj_size = va.va_size; 512 obj = vp->v_object; 513 if (obj == NULL) { 514 error = EINVAL; 515 goto out; 516 } 517 } else if (fp->f_type == DTYPE_SHM) { 518 error = 0; 519 shmfd = fp->f_data; 520 obj = shmfd->shm_object; 521 *obj_size = shmfd->shm_size; 522 } else { 523 error = EINVAL; 524 goto out; 525 } 526 527 VM_OBJECT_WLOCK(obj); 528 if ((obj->flags & OBJ_DEAD) != 0) { 529 VM_OBJECT_WUNLOCK(obj); 530 error = EBADF; 531 goto out; 532 } 533 534 /* 535 * Temporarily increase the backing VM object's reference 536 * count so that a forced reclamation of its vnode does not 537 * immediately destroy it. 538 */ 539 vm_object_reference_locked(obj); 540 VM_OBJECT_WUNLOCK(obj); 541 *obj_res = obj; 542 *vp_res = vp; 543 *shmfd_res = shmfd; 544 545 out: 546 if (vp != NULL) 547 VOP_UNLOCK(vp, 0); 548 return (error); 549 } 550 551 static int 552 sendfile_getsock(struct thread *td, int s, struct file **sock_fp, 553 struct socket **so) 554 { 555 int error; 556 557 *sock_fp = NULL; 558 *so = NULL; 559 560 /* 561 * The socket must be a stream socket and connected. 562 */ 563 error = getsock_cap(td, s, &cap_send_rights, 564 sock_fp, NULL, NULL); 565 if (error != 0) 566 return (error); 567 *so = (*sock_fp)->f_data; 568 if ((*so)->so_type != SOCK_STREAM) 569 return (EINVAL); 570 if (SOLISTENING(*so)) 571 return (ENOTCONN); 572 return (0); 573 } 574 575 int 576 vn_sendfile(struct file *fp, int sockfd, struct uio *hdr_uio, 577 struct uio *trl_uio, off_t offset, size_t nbytes, off_t *sent, int flags, 578 struct thread *td) 579 { 580 struct file *sock_fp; 581 struct vnode *vp; 582 struct vm_object *obj; 583 struct socket *so; 584 #ifdef KERN_TLS 585 struct ktls_session *tls; 586 #endif 587 struct mbuf_ext_pgs *ext_pgs; 588 struct mbuf *m, *mh, *mhtail; 589 struct sf_buf *sf; 590 struct shmfd *shmfd; 591 struct sendfile_sync *sfs; 592 struct vattr va; 593 off_t off, sbytes, rem, obj_size; 594 int bsize, error, ext_pgs_idx, hdrlen, max_pgs, softerr; 595 #ifdef KERN_TLS 596 int tls_enq_cnt; 597 #endif 598 bool use_ext_pgs; 599 600 obj = NULL; 601 so = NULL; 602 m = mh = NULL; 603 sfs = NULL; 604 #ifdef KERN_TLS 605 tls = NULL; 606 #endif 607 hdrlen = sbytes = 0; 608 softerr = 0; 609 use_ext_pgs = false; 610 611 error = sendfile_getobj(td, fp, &obj, &vp, &shmfd, &obj_size, &bsize); 612 if (error != 0) 613 return (error); 614 615 error = sendfile_getsock(td, sockfd, &sock_fp, &so); 616 if (error != 0) 617 goto out; 618 619 #ifdef MAC 620 error = mac_socket_check_send(td->td_ucred, so); 621 if (error != 0) 622 goto out; 623 #endif 624 625 SFSTAT_INC(sf_syscalls); 626 SFSTAT_ADD(sf_rhpages_requested, SF_READAHEAD(flags)); 627 628 if (flags & SF_SYNC) { 629 sfs = malloc(sizeof *sfs, M_TEMP, M_WAITOK | M_ZERO); 630 mtx_init(&sfs->mtx, "sendfile", NULL, MTX_DEF); 631 cv_init(&sfs->cv, "sendfile"); 632 } 633 634 rem = nbytes ? omin(nbytes, obj_size - offset) : obj_size - offset; 635 636 /* 637 * Protect against multiple writers to the socket. 638 * 639 * XXXRW: Historically this has assumed non-interruptibility, so now 640 * we implement that, but possibly shouldn't. 641 */ 642 (void)sblock(&so->so_snd, SBL_WAIT | SBL_NOINTR); 643 #ifdef KERN_TLS 644 tls = ktls_hold(so->so_snd.sb_tls_info); 645 #endif 646 647 /* 648 * Loop through the pages of the file, starting with the requested 649 * offset. Get a file page (do I/O if necessary), map the file page 650 * into an sf_buf, attach an mbuf header to the sf_buf, and queue 651 * it on the socket. 652 * This is done in two loops. The inner loop turns as many pages 653 * as it can, up to available socket buffer space, without blocking 654 * into mbufs to have it bulk delivered into the socket send buffer. 655 * The outer loop checks the state and available space of the socket 656 * and takes care of the overall progress. 657 */ 658 for (off = offset; rem > 0; ) { 659 struct sf_io *sfio; 660 vm_page_t *pa; 661 struct mbuf *mtail; 662 int nios, space, npages, rhpages; 663 664 mtail = NULL; 665 /* 666 * Check the socket state for ongoing connection, 667 * no errors and space in socket buffer. 668 * If space is low allow for the remainder of the 669 * file to be processed if it fits the socket buffer. 670 * Otherwise block in waiting for sufficient space 671 * to proceed, or if the socket is nonblocking, return 672 * to userland with EAGAIN while reporting how far 673 * we've come. 674 * We wait until the socket buffer has significant free 675 * space to do bulk sends. This makes good use of file 676 * system read ahead and allows packet segmentation 677 * offloading hardware to take over lots of work. If 678 * we were not careful here we would send off only one 679 * sfbuf at a time. 680 */ 681 SOCKBUF_LOCK(&so->so_snd); 682 if (so->so_snd.sb_lowat < so->so_snd.sb_hiwat / 2) 683 so->so_snd.sb_lowat = so->so_snd.sb_hiwat / 2; 684 retry_space: 685 if (so->so_snd.sb_state & SBS_CANTSENDMORE) { 686 error = EPIPE; 687 SOCKBUF_UNLOCK(&so->so_snd); 688 goto done; 689 } else if (so->so_error) { 690 error = so->so_error; 691 so->so_error = 0; 692 SOCKBUF_UNLOCK(&so->so_snd); 693 goto done; 694 } 695 if ((so->so_state & SS_ISCONNECTED) == 0) { 696 SOCKBUF_UNLOCK(&so->so_snd); 697 error = ENOTCONN; 698 goto done; 699 } 700 701 space = sbspace(&so->so_snd); 702 if (space < rem && 703 (space <= 0 || 704 space < so->so_snd.sb_lowat)) { 705 if (so->so_state & SS_NBIO) { 706 SOCKBUF_UNLOCK(&so->so_snd); 707 error = EAGAIN; 708 goto done; 709 } 710 /* 711 * sbwait drops the lock while sleeping. 712 * When we loop back to retry_space the 713 * state may have changed and we retest 714 * for it. 715 */ 716 error = sbwait(&so->so_snd); 717 /* 718 * An error from sbwait usually indicates that we've 719 * been interrupted by a signal. If we've sent anything 720 * then return bytes sent, otherwise return the error. 721 */ 722 if (error != 0) { 723 SOCKBUF_UNLOCK(&so->so_snd); 724 goto done; 725 } 726 goto retry_space; 727 } 728 SOCKBUF_UNLOCK(&so->so_snd); 729 730 /* 731 * At the beginning of the first loop check if any headers 732 * are specified and copy them into mbufs. Reduce space in 733 * the socket buffer by the size of the header mbuf chain. 734 * Clear hdr_uio here and hdrlen at the end of the first loop. 735 */ 736 if (hdr_uio != NULL && hdr_uio->uio_resid > 0) { 737 hdr_uio->uio_td = td; 738 hdr_uio->uio_rw = UIO_WRITE; 739 #ifdef KERN_TLS 740 if (tls != NULL) 741 mh = m_uiotombuf(hdr_uio, M_WAITOK, space, 742 tls->params.max_frame_len, M_NOMAP); 743 else 744 #endif 745 mh = m_uiotombuf(hdr_uio, M_WAITOK, 746 space, 0, 0); 747 hdrlen = m_length(mh, &mhtail); 748 space -= hdrlen; 749 /* 750 * If header consumed all the socket buffer space, 751 * don't waste CPU cycles and jump to the end. 752 */ 753 if (space == 0) { 754 sfio = NULL; 755 nios = 0; 756 goto prepend_header; 757 } 758 hdr_uio = NULL; 759 } 760 761 if (vp != NULL) { 762 error = vn_lock(vp, LK_SHARED); 763 if (error != 0) 764 goto done; 765 error = VOP_GETATTR(vp, &va, td->td_ucred); 766 if (error != 0 || off >= va.va_size) { 767 VOP_UNLOCK(vp, 0); 768 goto done; 769 } 770 if (va.va_size != obj_size) { 771 obj_size = va.va_size; 772 rem = nbytes ? 773 omin(nbytes + offset, obj_size) : obj_size; 774 rem -= off; 775 } 776 } 777 778 if (space > rem) 779 space = rem; 780 else if (space > PAGE_SIZE) { 781 /* 782 * Use page boundaries when possible for large 783 * requests. 784 */ 785 if (off & PAGE_MASK) 786 space -= (PAGE_SIZE - (off & PAGE_MASK)); 787 space = trunc_page(space); 788 if (off & PAGE_MASK) 789 space += (PAGE_SIZE - (off & PAGE_MASK)); 790 } 791 792 npages = howmany(space + (off & PAGE_MASK), PAGE_SIZE); 793 794 /* 795 * Calculate maximum allowed number of pages for readahead 796 * at this iteration. If SF_USER_READAHEAD was set, we don't 797 * do any heuristics and use exactly the value supplied by 798 * application. Otherwise, we allow readahead up to "rem". 799 * If application wants more, let it be, but there is no 800 * reason to go above MAXPHYS. Also check against "obj_size", 801 * since vm_pager_has_page() can hint beyond EOF. 802 */ 803 if (flags & SF_USER_READAHEAD) { 804 rhpages = SF_READAHEAD(flags); 805 } else { 806 rhpages = howmany(rem + (off & PAGE_MASK), PAGE_SIZE) - 807 npages; 808 rhpages += SF_READAHEAD(flags); 809 } 810 rhpages = min(howmany(MAXPHYS, PAGE_SIZE), rhpages); 811 rhpages = min(howmany(obj_size - trunc_page(off), PAGE_SIZE) - 812 npages, rhpages); 813 814 sfio = malloc(sizeof(struct sf_io) + 815 npages * sizeof(vm_page_t), M_TEMP, M_WAITOK); 816 refcount_init(&sfio->nios, 1); 817 sfio->so = so; 818 sfio->error = 0; 819 820 #ifdef KERN_TLS 821 /* 822 * This doesn't use ktls_hold() because sfio->m will 823 * also have a reference on 'tls' that will be valid 824 * for all of sfio's lifetime. 825 */ 826 sfio->tls = tls; 827 #endif 828 829 error = sendfile_swapin(obj, sfio, &nios, off, space, npages, 830 rhpages, flags); 831 if (error != 0) { 832 if (vp != NULL) 833 VOP_UNLOCK(vp, 0); 834 sfio->m = NULL; 835 sendfile_iodone(sfio, NULL, 0, error); 836 goto done; 837 } 838 839 /* 840 * Loop and construct maximum sized mbuf chain to be bulk 841 * dumped into socket buffer. 842 */ 843 pa = sfio->pa; 844 845 /* 846 * Use unmapped mbufs if enabled for TCP. Unmapped 847 * bufs are restricted to TCP as that is what has been 848 * tested. In particular, unmapped mbufs have not 849 * been tested with UNIX-domain sockets. 850 * 851 * TLS frames always require unmapped mbufs. 852 */ 853 if ((mb_use_ext_pgs && 854 so->so_proto->pr_protocol == IPPROTO_TCP) 855 #ifdef KERN_TLS 856 || tls != NULL 857 #endif 858 ) { 859 use_ext_pgs = true; 860 #ifdef KERN_TLS 861 if (tls != NULL) 862 max_pgs = num_pages(tls->params.max_frame_len); 863 else 864 #endif 865 max_pgs = MBUF_PEXT_MAX_PGS; 866 867 /* Start at last index, to wrap on first use. */ 868 ext_pgs_idx = max_pgs - 1; 869 } 870 871 for (int i = 0; i < npages; i++) { 872 struct mbuf *m0; 873 874 /* 875 * If a page wasn't grabbed successfully, then 876 * trim the array. Can happen only with SF_NODISKIO. 877 */ 878 if (pa[i] == NULL) { 879 SFSTAT_INC(sf_busy); 880 fixspace(npages, i, off, &space); 881 npages = i; 882 softerr = EBUSY; 883 break; 884 } 885 886 if (use_ext_pgs) { 887 off_t xfs; 888 889 ext_pgs_idx++; 890 if (ext_pgs_idx == max_pgs) { 891 m0 = mb_alloc_ext_pgs(M_WAITOK, false, 892 sendfile_free_mext_pg); 893 894 if (flags & SF_NOCACHE) { 895 m0->m_ext.ext_flags |= 896 EXT_FLAG_NOCACHE; 897 898 /* 899 * See comment below regarding 900 * ignoring SF_NOCACHE for the 901 * last page. 902 */ 903 if ((npages - i <= max_pgs) && 904 ((off + space) & PAGE_MASK) && 905 (rem > space || rhpages > 0)) 906 m0->m_ext.ext_flags |= 907 EXT_FLAG_CACHE_LAST; 908 } 909 if (sfs != NULL) { 910 m0->m_ext.ext_flags |= 911 EXT_FLAG_SYNC; 912 m0->m_ext.ext_arg2 = sfs; 913 mtx_lock(&sfs->mtx); 914 sfs->count++; 915 mtx_unlock(&sfs->mtx); 916 } 917 ext_pgs = m0->m_ext.ext_pgs; 918 if (i == 0) 919 sfio->m = m0; 920 ext_pgs_idx = 0; 921 922 /* Append to mbuf chain. */ 923 if (mtail != NULL) 924 mtail->m_next = m0; 925 else 926 m = m0; 927 mtail = m0; 928 ext_pgs->first_pg_off = 929 vmoff(i, off) & PAGE_MASK; 930 } 931 if (nios) { 932 mtail->m_flags |= M_NOTREADY; 933 ext_pgs->nrdy++; 934 } 935 936 ext_pgs->pa[ext_pgs_idx] = VM_PAGE_TO_PHYS(pa[i]); 937 ext_pgs->npgs++; 938 xfs = xfsize(i, npages, off, space); 939 ext_pgs->last_pg_len = xfs; 940 MBUF_EXT_PGS_ASSERT_SANITY(ext_pgs); 941 mtail->m_len += xfs; 942 mtail->m_ext.ext_size += PAGE_SIZE; 943 continue; 944 } 945 946 /* 947 * Get a sendfile buf. When allocating the 948 * first buffer for mbuf chain, we usually 949 * wait as long as necessary, but this wait 950 * can be interrupted. For consequent 951 * buffers, do not sleep, since several 952 * threads might exhaust the buffers and then 953 * deadlock. 954 */ 955 sf = sf_buf_alloc(pa[i], 956 m != NULL ? SFB_NOWAIT : SFB_CATCH); 957 if (sf == NULL) { 958 SFSTAT_INC(sf_allocfail); 959 for (int j = i; j < npages; j++) 960 vm_page_unwire(pa[j], PQ_INACTIVE); 961 if (m == NULL) 962 softerr = ENOBUFS; 963 fixspace(npages, i, off, &space); 964 npages = i; 965 break; 966 } 967 968 m0 = m_get(M_WAITOK, MT_DATA); 969 m0->m_ext.ext_buf = (char *)sf_buf_kva(sf); 970 m0->m_ext.ext_size = PAGE_SIZE; 971 m0->m_ext.ext_arg1 = sf; 972 m0->m_ext.ext_type = EXT_SFBUF; 973 m0->m_ext.ext_flags = EXT_FLAG_EMBREF; 974 m0->m_ext.ext_free = sendfile_free_mext; 975 /* 976 * SF_NOCACHE sets the page as being freed upon send. 977 * However, we ignore it for the last page in 'space', 978 * if the page is truncated, and we got more data to 979 * send (rem > space), or if we have readahead 980 * configured (rhpages > 0). 981 */ 982 if ((flags & SF_NOCACHE) && 983 (i != npages - 1 || 984 !((off + space) & PAGE_MASK) || 985 !(rem > space || rhpages > 0))) 986 m0->m_ext.ext_flags |= EXT_FLAG_NOCACHE; 987 if (sfs != NULL) { 988 m0->m_ext.ext_flags |= EXT_FLAG_SYNC; 989 m0->m_ext.ext_arg2 = sfs; 990 mtx_lock(&sfs->mtx); 991 sfs->count++; 992 mtx_unlock(&sfs->mtx); 993 } 994 m0->m_ext.ext_count = 1; 995 m0->m_flags |= (M_EXT | M_RDONLY); 996 if (nios) 997 m0->m_flags |= M_NOTREADY; 998 m0->m_data = (char *)sf_buf_kva(sf) + 999 (vmoff(i, off) & PAGE_MASK); 1000 m0->m_len = xfsize(i, npages, off, space); 1001 1002 if (i == 0) 1003 sfio->m = m0; 1004 1005 /* Append to mbuf chain. */ 1006 if (mtail != NULL) 1007 mtail->m_next = m0; 1008 else 1009 m = m0; 1010 mtail = m0; 1011 } 1012 1013 if (vp != NULL) 1014 VOP_UNLOCK(vp, 0); 1015 1016 /* Keep track of bytes processed. */ 1017 off += space; 1018 rem -= space; 1019 1020 /* Prepend header, if any. */ 1021 if (hdrlen) { 1022 prepend_header: 1023 mhtail->m_next = m; 1024 m = mh; 1025 mh = NULL; 1026 } 1027 1028 if (m == NULL) { 1029 KASSERT(softerr, ("%s: m NULL, no error", __func__)); 1030 error = softerr; 1031 free(sfio, M_TEMP); 1032 goto done; 1033 } 1034 1035 /* Add the buffer chain to the socket buffer. */ 1036 KASSERT(m_length(m, NULL) == space + hdrlen, 1037 ("%s: mlen %u space %d hdrlen %d", 1038 __func__, m_length(m, NULL), space, hdrlen)); 1039 1040 CURVNET_SET(so->so_vnet); 1041 #ifdef KERN_TLS 1042 if (tls != NULL) { 1043 error = ktls_frame(m, tls, &tls_enq_cnt, 1044 TLS_RLTYPE_APP); 1045 if (error != 0) 1046 goto done; 1047 } 1048 #endif 1049 if (nios == 0) { 1050 /* 1051 * If sendfile_swapin() didn't initiate any I/Os, 1052 * which happens if all data is cached in VM, then 1053 * we can send data right now without the 1054 * PRUS_NOTREADY flag. 1055 */ 1056 free(sfio, M_TEMP); 1057 #ifdef KERN_TLS 1058 if (tls != NULL && tls->mode == TCP_TLS_MODE_SW) { 1059 error = (*so->so_proto->pr_usrreqs->pru_send) 1060 (so, PRUS_NOTREADY, m, NULL, NULL, td); 1061 soref(so); 1062 ktls_enqueue(m, so, tls_enq_cnt); 1063 } else 1064 #endif 1065 error = (*so->so_proto->pr_usrreqs->pru_send) 1066 (so, 0, m, NULL, NULL, td); 1067 } else { 1068 sfio->npages = npages; 1069 soref(so); 1070 error = (*so->so_proto->pr_usrreqs->pru_send) 1071 (so, PRUS_NOTREADY, m, NULL, NULL, td); 1072 sendfile_iodone(sfio, NULL, 0, 0); 1073 } 1074 CURVNET_RESTORE(); 1075 1076 m = NULL; /* pru_send always consumes */ 1077 if (error) 1078 goto done; 1079 sbytes += space + hdrlen; 1080 if (hdrlen) 1081 hdrlen = 0; 1082 if (softerr) { 1083 error = softerr; 1084 goto done; 1085 } 1086 } 1087 1088 /* 1089 * Send trailers. Wimp out and use writev(2). 1090 */ 1091 if (trl_uio != NULL) { 1092 sbunlock(&so->so_snd); 1093 error = kern_writev(td, sockfd, trl_uio); 1094 if (error == 0) 1095 sbytes += td->td_retval[0]; 1096 goto out; 1097 } 1098 1099 done: 1100 sbunlock(&so->so_snd); 1101 out: 1102 /* 1103 * If there was no error we have to clear td->td_retval[0] 1104 * because it may have been set by writev. 1105 */ 1106 if (error == 0) { 1107 td->td_retval[0] = 0; 1108 } 1109 if (sent != NULL) { 1110 (*sent) = sbytes; 1111 } 1112 if (obj != NULL) 1113 vm_object_deallocate(obj); 1114 if (so) 1115 fdrop(sock_fp, td); 1116 if (m) 1117 m_freem(m); 1118 if (mh) 1119 m_freem(mh); 1120 1121 if (sfs != NULL) { 1122 mtx_lock(&sfs->mtx); 1123 if (sfs->count != 0) 1124 cv_wait(&sfs->cv, &sfs->mtx); 1125 KASSERT(sfs->count == 0, ("sendfile sync still busy")); 1126 cv_destroy(&sfs->cv); 1127 mtx_destroy(&sfs->mtx); 1128 free(sfs, M_TEMP); 1129 } 1130 #ifdef KERN_TLS 1131 if (tls != NULL) 1132 ktls_free(tls); 1133 #endif 1134 1135 if (error == ERESTART) 1136 error = EINTR; 1137 1138 return (error); 1139 } 1140 1141 static int 1142 sendfile(struct thread *td, struct sendfile_args *uap, int compat) 1143 { 1144 struct sf_hdtr hdtr; 1145 struct uio *hdr_uio, *trl_uio; 1146 struct file *fp; 1147 off_t sbytes; 1148 int error; 1149 1150 /* 1151 * File offset must be positive. If it goes beyond EOF 1152 * we send only the header/trailer and no payload data. 1153 */ 1154 if (uap->offset < 0) 1155 return (EINVAL); 1156 1157 sbytes = 0; 1158 hdr_uio = trl_uio = NULL; 1159 1160 if (uap->hdtr != NULL) { 1161 error = copyin(uap->hdtr, &hdtr, sizeof(hdtr)); 1162 if (error != 0) 1163 goto out; 1164 if (hdtr.headers != NULL) { 1165 error = copyinuio(hdtr.headers, hdtr.hdr_cnt, 1166 &hdr_uio); 1167 if (error != 0) 1168 goto out; 1169 #ifdef COMPAT_FREEBSD4 1170 /* 1171 * In FreeBSD < 5.0 the nbytes to send also included 1172 * the header. If compat is specified subtract the 1173 * header size from nbytes. 1174 */ 1175 if (compat) { 1176 if (uap->nbytes > hdr_uio->uio_resid) 1177 uap->nbytes -= hdr_uio->uio_resid; 1178 else 1179 uap->nbytes = 0; 1180 } 1181 #endif 1182 } 1183 if (hdtr.trailers != NULL) { 1184 error = copyinuio(hdtr.trailers, hdtr.trl_cnt, 1185 &trl_uio); 1186 if (error != 0) 1187 goto out; 1188 } 1189 } 1190 1191 AUDIT_ARG_FD(uap->fd); 1192 1193 /* 1194 * sendfile(2) can start at any offset within a file so we require 1195 * CAP_READ+CAP_SEEK = CAP_PREAD. 1196 */ 1197 if ((error = fget_read(td, uap->fd, &cap_pread_rights, &fp)) != 0) 1198 goto out; 1199 1200 error = fo_sendfile(fp, uap->s, hdr_uio, trl_uio, uap->offset, 1201 uap->nbytes, &sbytes, uap->flags, td); 1202 fdrop(fp, td); 1203 1204 if (uap->sbytes != NULL) 1205 copyout(&sbytes, uap->sbytes, sizeof(off_t)); 1206 1207 out: 1208 free(hdr_uio, M_IOV); 1209 free(trl_uio, M_IOV); 1210 return (error); 1211 } 1212 1213 /* 1214 * sendfile(2) 1215 * 1216 * int sendfile(int fd, int s, off_t offset, size_t nbytes, 1217 * struct sf_hdtr *hdtr, off_t *sbytes, int flags) 1218 * 1219 * Send a file specified by 'fd' and starting at 'offset' to a socket 1220 * specified by 's'. Send only 'nbytes' of the file or until EOF if nbytes == 1221 * 0. Optionally add a header and/or trailer to the socket output. If 1222 * specified, write the total number of bytes sent into *sbytes. 1223 */ 1224 int 1225 sys_sendfile(struct thread *td, struct sendfile_args *uap) 1226 { 1227 1228 return (sendfile(td, uap, 0)); 1229 } 1230 1231 #ifdef COMPAT_FREEBSD4 1232 int 1233 freebsd4_sendfile(struct thread *td, struct freebsd4_sendfile_args *uap) 1234 { 1235 struct sendfile_args args; 1236 1237 args.fd = uap->fd; 1238 args.s = uap->s; 1239 args.offset = uap->offset; 1240 args.nbytes = uap->nbytes; 1241 args.hdtr = uap->hdtr; 1242 args.sbytes = uap->sbytes; 1243 args.flags = uap->flags; 1244 1245 return (sendfile(td, &args, 1)); 1246 } 1247 #endif /* COMPAT_FREEBSD4 */ 1248