1 /*- 2 * Copyright (c) 2013-2015 Gleb Smirnoff <glebius@FreeBSD.org> 3 * Copyright (c) 1998, David Greenman. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the University nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include "opt_kern_tls.h" 34 35 #include <sys/param.h> 36 #include <sys/systm.h> 37 #include <sys/capsicum.h> 38 #include <sys/kernel.h> 39 #include <netinet/in.h> 40 #include <sys/lock.h> 41 #include <sys/ktls.h> 42 #include <sys/mutex.h> 43 #include <sys/sysproto.h> 44 #include <sys/malloc.h> 45 #include <sys/proc.h> 46 #include <sys/mman.h> 47 #include <sys/mount.h> 48 #include <sys/mbuf.h> 49 #include <sys/protosw.h> 50 #include <sys/rwlock.h> 51 #include <sys/sf_buf.h> 52 #include <sys/socket.h> 53 #include <sys/socketvar.h> 54 #include <sys/syscallsubr.h> 55 #include <sys/sysctl.h> 56 #include <sys/vnode.h> 57 58 #include <net/vnet.h> 59 #include <netinet/tcp.h> 60 61 #include <security/audit/audit.h> 62 #include <security/mac/mac_framework.h> 63 64 #include <vm/vm.h> 65 #include <vm/vm_object.h> 66 #include <vm/vm_pager.h> 67 68 #define EXT_FLAG_SYNC EXT_FLAG_VENDOR1 69 #define EXT_FLAG_NOCACHE EXT_FLAG_VENDOR2 70 #define EXT_FLAG_CACHE_LAST EXT_FLAG_VENDOR3 71 72 /* 73 * Structure describing a single sendfile(2) I/O, which may consist of 74 * several underlying pager I/Os. 75 * 76 * The syscall context allocates the structure and initializes 'nios' 77 * to 1. As sendfile_swapin() runs through pages and starts asynchronous 78 * paging operations, it increments 'nios'. 79 * 80 * Every I/O completion calls sendfile_iodone(), which decrements the 'nios', 81 * and the syscall also calls sendfile_iodone() after allocating all mbufs, 82 * linking them and sending to socket. Whoever reaches zero 'nios' is 83 * responsible to * call pru_ready on the socket, to notify it of readyness 84 * of the data. 85 */ 86 struct sf_io { 87 volatile u_int nios; 88 u_int error; 89 int npages; 90 struct socket *so; 91 struct mbuf *m; 92 vm_object_t obj; 93 #ifdef KERN_TLS 94 struct ktls_session *tls; 95 #endif 96 vm_page_t pa[]; 97 }; 98 99 /* 100 * Structure used to track requests with SF_SYNC flag. 101 */ 102 struct sendfile_sync { 103 struct mtx mtx; 104 struct cv cv; 105 unsigned count; 106 }; 107 108 counter_u64_t sfstat[sizeof(struct sfstat) / sizeof(uint64_t)]; 109 110 static void 111 sfstat_init(const void *unused) 112 { 113 114 COUNTER_ARRAY_ALLOC(sfstat, sizeof(struct sfstat) / sizeof(uint64_t), 115 M_WAITOK); 116 } 117 SYSINIT(sfstat, SI_SUB_MBUF, SI_ORDER_FIRST, sfstat_init, NULL); 118 119 static int 120 sfstat_sysctl(SYSCTL_HANDLER_ARGS) 121 { 122 struct sfstat s; 123 124 COUNTER_ARRAY_COPY(sfstat, &s, sizeof(s) / sizeof(uint64_t)); 125 if (req->newptr) 126 COUNTER_ARRAY_ZERO(sfstat, sizeof(s) / sizeof(uint64_t)); 127 return (SYSCTL_OUT(req, &s, sizeof(s))); 128 } 129 SYSCTL_PROC(_kern_ipc, OID_AUTO, sfstat, CTLTYPE_OPAQUE | CTLFLAG_RW, 130 NULL, 0, sfstat_sysctl, "I", "sendfile statistics"); 131 132 static void 133 sendfile_free_mext(struct mbuf *m) 134 { 135 struct sf_buf *sf; 136 vm_page_t pg; 137 int flags; 138 139 KASSERT(m->m_flags & M_EXT && m->m_ext.ext_type == EXT_SFBUF, 140 ("%s: m %p !M_EXT or !EXT_SFBUF", __func__, m)); 141 142 sf = m->m_ext.ext_arg1; 143 pg = sf_buf_page(sf); 144 flags = (m->m_ext.ext_flags & EXT_FLAG_NOCACHE) != 0 ? VPR_TRYFREE : 0; 145 146 sf_buf_free(sf); 147 vm_page_release(pg, flags); 148 149 if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { 150 struct sendfile_sync *sfs = m->m_ext.ext_arg2; 151 152 mtx_lock(&sfs->mtx); 153 KASSERT(sfs->count > 0, ("Sendfile sync botchup count == 0")); 154 if (--sfs->count == 0) 155 cv_signal(&sfs->cv); 156 mtx_unlock(&sfs->mtx); 157 } 158 } 159 160 static void 161 sendfile_free_mext_pg(struct mbuf *m) 162 { 163 struct mbuf_ext_pgs *ext_pgs; 164 vm_page_t pg; 165 int flags, i; 166 bool cache_last; 167 168 KASSERT(m->m_flags & M_EXT && m->m_ext.ext_type == EXT_PGS, 169 ("%s: m %p !M_EXT or !EXT_PGS", __func__, m)); 170 171 cache_last = m->m_ext.ext_flags & EXT_FLAG_CACHE_LAST; 172 ext_pgs = m->m_ext.ext_pgs; 173 flags = (m->m_ext.ext_flags & EXT_FLAG_NOCACHE) != 0 ? VPR_TRYFREE : 0; 174 175 for (i = 0; i < ext_pgs->npgs; i++) { 176 if (cache_last && i == ext_pgs->npgs - 1) 177 flags = 0; 178 pg = PHYS_TO_VM_PAGE(ext_pgs->pa[i]); 179 vm_page_release(pg, flags); 180 } 181 182 if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { 183 struct sendfile_sync *sfs = m->m_ext.ext_arg2; 184 185 mtx_lock(&sfs->mtx); 186 KASSERT(sfs->count > 0, ("Sendfile sync botchup count == 0")); 187 if (--sfs->count == 0) 188 cv_signal(&sfs->cv); 189 mtx_unlock(&sfs->mtx); 190 } 191 } 192 193 /* 194 * Helper function to calculate how much data to put into page i of n. 195 * Only first and last pages are special. 196 */ 197 static inline off_t 198 xfsize(int i, int n, off_t off, off_t len) 199 { 200 201 if (i == 0) 202 return (omin(PAGE_SIZE - (off & PAGE_MASK), len)); 203 204 if (i == n - 1 && ((off + len) & PAGE_MASK) > 0) 205 return ((off + len) & PAGE_MASK); 206 207 return (PAGE_SIZE); 208 } 209 210 /* 211 * Helper function to get offset within object for i page. 212 */ 213 static inline vm_ooffset_t 214 vmoff(int i, off_t off) 215 { 216 217 if (i == 0) 218 return ((vm_ooffset_t)off); 219 220 return (trunc_page(off + i * PAGE_SIZE)); 221 } 222 223 /* 224 * Helper function used when allocation of a page or sf_buf failed. 225 * Pretend as if we don't have enough space, subtract xfsize() of 226 * all pages that failed. 227 */ 228 static inline void 229 fixspace(int old, int new, off_t off, int *space) 230 { 231 232 KASSERT(old > new, ("%s: old %d new %d", __func__, old, new)); 233 234 /* Subtract last one. */ 235 *space -= xfsize(old - 1, old, off, *space); 236 old--; 237 238 if (new == old) 239 /* There was only one page. */ 240 return; 241 242 /* Subtract first one. */ 243 if (new == 0) { 244 *space -= xfsize(0, old, off, *space); 245 new++; 246 } 247 248 /* Rest of pages are full sized. */ 249 *space -= (old - new) * PAGE_SIZE; 250 251 KASSERT(*space >= 0, ("%s: space went backwards", __func__)); 252 } 253 254 /* 255 * I/O completion callback. 256 */ 257 static void 258 sendfile_iodone(void *arg, vm_page_t *pg, int count, int error) 259 { 260 struct sf_io *sfio = arg; 261 struct socket *so = sfio->so; 262 263 for (int i = 0; i < count; i++) 264 if (pg[i] != bogus_page) 265 vm_page_xunbusy_unchecked(pg[i]); 266 267 if (error) 268 sfio->error = error; 269 270 if (!refcount_release(&sfio->nios)) 271 return; 272 273 vm_object_pip_wakeup(sfio->obj); 274 275 if (__predict_false(sfio->error && sfio->m == NULL)) { 276 /* 277 * I/O operation failed, but pru_send hadn't been executed - 278 * nothing had been sent to the socket. The syscall has 279 * returned error to the user. 280 */ 281 free(sfio, M_TEMP); 282 return; 283 } 284 285 #if defined(KERN_TLS) && defined(INVARIANTS) 286 if ((sfio->m->m_flags & M_EXT) != 0 && 287 sfio->m->m_ext.ext_type == EXT_PGS) 288 KASSERT(sfio->tls == sfio->m->m_ext.ext_pgs->tls, 289 ("TLS session mismatch")); 290 else 291 KASSERT(sfio->tls == NULL, 292 ("non-ext_pgs mbuf with TLS session")); 293 #endif 294 CURVNET_SET(so->so_vnet); 295 if (__predict_false(sfio->error)) { 296 /* 297 * I/O operation failed. The state of data in the socket 298 * is now inconsistent, and all what we can do is to tear 299 * it down. Protocol abort method would tear down protocol 300 * state, free all ready mbufs and detach not ready ones. 301 * We will free the mbufs corresponding to this I/O manually. 302 * 303 * The socket would be marked with EIO and made available 304 * for read, so that application receives EIO on next 305 * syscall and eventually closes the socket. 306 */ 307 so->so_proto->pr_usrreqs->pru_abort(so); 308 so->so_error = EIO; 309 310 mb_free_notready(sfio->m, sfio->npages); 311 #ifdef KERN_TLS 312 } else if (sfio->tls != NULL && sfio->tls->mode == TCP_TLS_MODE_SW) { 313 /* 314 * I/O operation is complete, but we still need to 315 * encrypt. We cannot do this in the interrupt thread 316 * of the disk controller, so forward the mbufs to a 317 * different thread. 318 * 319 * Donate the socket reference from sfio to rather 320 * than explicitly invoking soref(). 321 */ 322 ktls_enqueue(sfio->m, so, sfio->npages); 323 goto out_with_ref; 324 #endif 325 } else 326 (void)(so->so_proto->pr_usrreqs->pru_ready)(so, sfio->m, 327 sfio->npages); 328 329 SOCK_LOCK(so); 330 sorele(so); 331 #ifdef KERN_TLS 332 out_with_ref: 333 #endif 334 CURVNET_RESTORE(); 335 free(sfio, M_TEMP); 336 } 337 338 /* 339 * Iterate through pages vector and request paging for non-valid pages. 340 */ 341 static int 342 sendfile_swapin(vm_object_t obj, struct sf_io *sfio, int *nios, off_t off, 343 off_t len, int npages, int rhpages, int flags) 344 { 345 vm_page_t *pa = sfio->pa; 346 int grabbed; 347 348 *nios = 0; 349 flags = (flags & SF_NODISKIO) ? VM_ALLOC_NOWAIT : 0; 350 351 /* 352 * First grab all the pages and wire them. Note that we grab 353 * only required pages. Readahead pages are dealt with later. 354 */ 355 VM_OBJECT_WLOCK(obj); 356 357 grabbed = vm_page_grab_pages(obj, OFF_TO_IDX(off), 358 VM_ALLOC_NORMAL | VM_ALLOC_WIRED | flags, pa, npages); 359 if (grabbed < npages) { 360 for (int i = grabbed; i < npages; i++) 361 pa[i] = NULL; 362 npages = grabbed; 363 rhpages = 0; 364 } 365 366 for (int i = 0; i < npages;) { 367 int j, a, count, rv; 368 369 /* Skip valid pages. */ 370 if (vm_page_is_valid(pa[i], vmoff(i, off) & PAGE_MASK, 371 xfsize(i, npages, off, len))) { 372 vm_page_xunbusy(pa[i]); 373 SFSTAT_INC(sf_pages_valid); 374 i++; 375 continue; 376 } 377 378 /* 379 * Next page is invalid. Check if it belongs to pager. It 380 * may not be there, which is a regular situation for shmem 381 * pager. For vnode pager this happens only in case of 382 * a sparse file. 383 * 384 * Important feature of vm_pager_has_page() is the hint 385 * stored in 'a', about how many pages we can pagein after 386 * this page in a single I/O. 387 */ 388 if (!vm_pager_has_page(obj, OFF_TO_IDX(vmoff(i, off)), NULL, 389 &a)) { 390 pmap_zero_page(pa[i]); 391 pa[i]->valid = VM_PAGE_BITS_ALL; 392 MPASS(pa[i]->dirty == 0); 393 vm_page_xunbusy(pa[i]); 394 i++; 395 continue; 396 } 397 398 /* 399 * We want to pagein as many pages as possible, limited only 400 * by the 'a' hint and actual request. 401 */ 402 count = min(a + 1, npages - i); 403 404 /* 405 * We should not pagein into a valid page, thus we first trim 406 * any valid pages off the end of request, and substitute 407 * to bogus_page those, that are in the middle. 408 */ 409 for (j = i + count - 1; j > i; j--) { 410 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 411 xfsize(j, npages, off, len))) { 412 count--; 413 rhpages = 0; 414 } else 415 break; 416 } 417 for (j = i + 1; j < i + count - 1; j++) 418 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 419 xfsize(j, npages, off, len))) { 420 vm_page_xunbusy(pa[j]); 421 SFSTAT_INC(sf_pages_valid); 422 SFSTAT_INC(sf_pages_bogus); 423 pa[j] = bogus_page; 424 } 425 426 refcount_acquire(&sfio->nios); 427 VM_OBJECT_WUNLOCK(obj); 428 rv = vm_pager_get_pages_async(obj, pa + i, count, NULL, 429 i + count == npages ? &rhpages : NULL, 430 &sendfile_iodone, sfio); 431 VM_OBJECT_WLOCK(obj); 432 if (__predict_false(rv != VM_PAGER_OK)) { 433 /* 434 * Perform full pages recovery before returning EIO. 435 * Pages from 0 to npages are wired. 436 * Pages from i to npages are also busied. 437 * Pages from (i + 1) to (i + count - 1) may be 438 * substituted to bogus page, and not busied. 439 */ 440 for (j = 0; j < npages; j++) { 441 if (j > i && j < i + count - 1 && 442 pa[j] == bogus_page) 443 pa[j] = vm_page_lookup(obj, 444 OFF_TO_IDX(vmoff(j, off))); 445 else if (j >= i) 446 vm_page_xunbusy(pa[j]); 447 KASSERT(pa[j] != NULL && pa[j] != bogus_page, 448 ("%s: page %p[%d] I/O recovery failure", 449 __func__, pa, j)); 450 vm_page_unwire(pa[j], PQ_INACTIVE); 451 } 452 VM_OBJECT_WUNLOCK(obj); 453 return (EIO); 454 } 455 456 SFSTAT_INC(sf_iocnt); 457 SFSTAT_ADD(sf_pages_read, count); 458 if (i + count == npages) 459 SFSTAT_ADD(sf_rhpages_read, rhpages); 460 461 /* 462 * Restore the valid page pointers. They are already 463 * unbusied, but still wired. 464 */ 465 for (j = i; j < i + count; j++) 466 if (pa[j] == bogus_page) { 467 pa[j] = vm_page_lookup(obj, 468 OFF_TO_IDX(vmoff(j, off))); 469 KASSERT(pa[j], ("%s: page %p[%d] disappeared", 470 __func__, pa, j)); 471 472 } 473 i += count; 474 (*nios)++; 475 } 476 477 VM_OBJECT_WUNLOCK(obj); 478 479 if (*nios == 0 && npages != 0) 480 SFSTAT_INC(sf_noiocnt); 481 482 return (0); 483 } 484 485 static int 486 sendfile_getobj(struct thread *td, struct file *fp, vm_object_t *obj_res, 487 struct vnode **vp_res, struct shmfd **shmfd_res, off_t *obj_size, 488 int *bsize) 489 { 490 struct vattr va; 491 vm_object_t obj; 492 struct vnode *vp; 493 struct shmfd *shmfd; 494 int error; 495 496 vp = *vp_res = NULL; 497 obj = NULL; 498 shmfd = *shmfd_res = NULL; 499 *bsize = 0; 500 501 /* 502 * The file descriptor must be a regular file and have a 503 * backing VM object. 504 */ 505 if (fp->f_type == DTYPE_VNODE) { 506 vp = fp->f_vnode; 507 vn_lock(vp, LK_SHARED | LK_RETRY); 508 if (vp->v_type != VREG) { 509 error = EINVAL; 510 goto out; 511 } 512 *bsize = vp->v_mount->mnt_stat.f_iosize; 513 error = VOP_GETATTR(vp, &va, td->td_ucred); 514 if (error != 0) 515 goto out; 516 *obj_size = va.va_size; 517 obj = vp->v_object; 518 if (obj == NULL) { 519 error = EINVAL; 520 goto out; 521 } 522 } else if (fp->f_type == DTYPE_SHM) { 523 error = 0; 524 shmfd = fp->f_data; 525 obj = shmfd->shm_object; 526 *obj_size = shmfd->shm_size; 527 } else { 528 error = EINVAL; 529 goto out; 530 } 531 532 VM_OBJECT_WLOCK(obj); 533 if ((obj->flags & OBJ_DEAD) != 0) { 534 VM_OBJECT_WUNLOCK(obj); 535 error = EBADF; 536 goto out; 537 } 538 539 /* 540 * Temporarily increase the backing VM object's reference 541 * count so that a forced reclamation of its vnode does not 542 * immediately destroy it. 543 */ 544 vm_object_reference_locked(obj); 545 VM_OBJECT_WUNLOCK(obj); 546 *obj_res = obj; 547 *vp_res = vp; 548 *shmfd_res = shmfd; 549 550 out: 551 if (vp != NULL) 552 VOP_UNLOCK(vp); 553 return (error); 554 } 555 556 static int 557 sendfile_getsock(struct thread *td, int s, struct file **sock_fp, 558 struct socket **so) 559 { 560 int error; 561 562 *sock_fp = NULL; 563 *so = NULL; 564 565 /* 566 * The socket must be a stream socket and connected. 567 */ 568 error = getsock_cap(td, s, &cap_send_rights, 569 sock_fp, NULL, NULL); 570 if (error != 0) 571 return (error); 572 *so = (*sock_fp)->f_data; 573 if ((*so)->so_type != SOCK_STREAM) 574 return (EINVAL); 575 if (SOLISTENING(*so)) 576 return (ENOTCONN); 577 return (0); 578 } 579 580 int 581 vn_sendfile(struct file *fp, int sockfd, struct uio *hdr_uio, 582 struct uio *trl_uio, off_t offset, size_t nbytes, off_t *sent, int flags, 583 struct thread *td) 584 { 585 struct file *sock_fp; 586 struct vnode *vp; 587 struct vm_object *obj; 588 struct socket *so; 589 #ifdef KERN_TLS 590 struct ktls_session *tls; 591 #endif 592 struct mbuf_ext_pgs *ext_pgs; 593 struct mbuf *m, *mh, *mhtail; 594 struct sf_buf *sf; 595 struct shmfd *shmfd; 596 struct sendfile_sync *sfs; 597 struct vattr va; 598 off_t off, sbytes, rem, obj_size; 599 int bsize, error, ext_pgs_idx, hdrlen, max_pgs, softerr; 600 #ifdef KERN_TLS 601 int tls_enq_cnt; 602 #endif 603 bool use_ext_pgs; 604 605 obj = NULL; 606 so = NULL; 607 m = mh = NULL; 608 sfs = NULL; 609 #ifdef KERN_TLS 610 tls = NULL; 611 #endif 612 hdrlen = sbytes = 0; 613 softerr = 0; 614 use_ext_pgs = false; 615 616 error = sendfile_getobj(td, fp, &obj, &vp, &shmfd, &obj_size, &bsize); 617 if (error != 0) 618 return (error); 619 620 error = sendfile_getsock(td, sockfd, &sock_fp, &so); 621 if (error != 0) 622 goto out; 623 624 #ifdef MAC 625 error = mac_socket_check_send(td->td_ucred, so); 626 if (error != 0) 627 goto out; 628 #endif 629 630 SFSTAT_INC(sf_syscalls); 631 SFSTAT_ADD(sf_rhpages_requested, SF_READAHEAD(flags)); 632 633 if (flags & SF_SYNC) { 634 sfs = malloc(sizeof *sfs, M_TEMP, M_WAITOK | M_ZERO); 635 mtx_init(&sfs->mtx, "sendfile", NULL, MTX_DEF); 636 cv_init(&sfs->cv, "sendfile"); 637 } 638 639 rem = nbytes ? omin(nbytes, obj_size - offset) : obj_size - offset; 640 641 /* 642 * Protect against multiple writers to the socket. 643 * 644 * XXXRW: Historically this has assumed non-interruptibility, so now 645 * we implement that, but possibly shouldn't. 646 */ 647 (void)sblock(&so->so_snd, SBL_WAIT | SBL_NOINTR); 648 #ifdef KERN_TLS 649 tls = ktls_hold(so->so_snd.sb_tls_info); 650 #endif 651 652 /* 653 * Loop through the pages of the file, starting with the requested 654 * offset. Get a file page (do I/O if necessary), map the file page 655 * into an sf_buf, attach an mbuf header to the sf_buf, and queue 656 * it on the socket. 657 * This is done in two loops. The inner loop turns as many pages 658 * as it can, up to available socket buffer space, without blocking 659 * into mbufs to have it bulk delivered into the socket send buffer. 660 * The outer loop checks the state and available space of the socket 661 * and takes care of the overall progress. 662 */ 663 for (off = offset; rem > 0; ) { 664 struct sf_io *sfio; 665 vm_page_t *pa; 666 struct mbuf *mtail; 667 int nios, space, npages, rhpages; 668 669 mtail = NULL; 670 /* 671 * Check the socket state for ongoing connection, 672 * no errors and space in socket buffer. 673 * If space is low allow for the remainder of the 674 * file to be processed if it fits the socket buffer. 675 * Otherwise block in waiting for sufficient space 676 * to proceed, or if the socket is nonblocking, return 677 * to userland with EAGAIN while reporting how far 678 * we've come. 679 * We wait until the socket buffer has significant free 680 * space to do bulk sends. This makes good use of file 681 * system read ahead and allows packet segmentation 682 * offloading hardware to take over lots of work. If 683 * we were not careful here we would send off only one 684 * sfbuf at a time. 685 */ 686 SOCKBUF_LOCK(&so->so_snd); 687 if (so->so_snd.sb_lowat < so->so_snd.sb_hiwat / 2) 688 so->so_snd.sb_lowat = so->so_snd.sb_hiwat / 2; 689 retry_space: 690 if (so->so_snd.sb_state & SBS_CANTSENDMORE) { 691 error = EPIPE; 692 SOCKBUF_UNLOCK(&so->so_snd); 693 goto done; 694 } else if (so->so_error) { 695 error = so->so_error; 696 so->so_error = 0; 697 SOCKBUF_UNLOCK(&so->so_snd); 698 goto done; 699 } 700 if ((so->so_state & SS_ISCONNECTED) == 0) { 701 SOCKBUF_UNLOCK(&so->so_snd); 702 error = ENOTCONN; 703 goto done; 704 } 705 706 space = sbspace(&so->so_snd); 707 if (space < rem && 708 (space <= 0 || 709 space < so->so_snd.sb_lowat)) { 710 if (so->so_state & SS_NBIO) { 711 SOCKBUF_UNLOCK(&so->so_snd); 712 error = EAGAIN; 713 goto done; 714 } 715 /* 716 * sbwait drops the lock while sleeping. 717 * When we loop back to retry_space the 718 * state may have changed and we retest 719 * for it. 720 */ 721 error = sbwait(&so->so_snd); 722 /* 723 * An error from sbwait usually indicates that we've 724 * been interrupted by a signal. If we've sent anything 725 * then return bytes sent, otherwise return the error. 726 */ 727 if (error != 0) { 728 SOCKBUF_UNLOCK(&so->so_snd); 729 goto done; 730 } 731 goto retry_space; 732 } 733 SOCKBUF_UNLOCK(&so->so_snd); 734 735 /* 736 * At the beginning of the first loop check if any headers 737 * are specified and copy them into mbufs. Reduce space in 738 * the socket buffer by the size of the header mbuf chain. 739 * Clear hdr_uio here and hdrlen at the end of the first loop. 740 */ 741 if (hdr_uio != NULL && hdr_uio->uio_resid > 0) { 742 hdr_uio->uio_td = td; 743 hdr_uio->uio_rw = UIO_WRITE; 744 #ifdef KERN_TLS 745 if (tls != NULL) 746 mh = m_uiotombuf(hdr_uio, M_WAITOK, space, 747 tls->params.max_frame_len, M_NOMAP); 748 else 749 #endif 750 mh = m_uiotombuf(hdr_uio, M_WAITOK, 751 space, 0, 0); 752 hdrlen = m_length(mh, &mhtail); 753 space -= hdrlen; 754 /* 755 * If header consumed all the socket buffer space, 756 * don't waste CPU cycles and jump to the end. 757 */ 758 if (space == 0) { 759 sfio = NULL; 760 nios = 0; 761 goto prepend_header; 762 } 763 hdr_uio = NULL; 764 } 765 766 if (vp != NULL) { 767 error = vn_lock(vp, LK_SHARED); 768 if (error != 0) 769 goto done; 770 error = VOP_GETATTR(vp, &va, td->td_ucred); 771 if (error != 0 || off >= va.va_size) { 772 VOP_UNLOCK(vp); 773 goto done; 774 } 775 if (va.va_size != obj_size) { 776 obj_size = va.va_size; 777 rem = nbytes ? 778 omin(nbytes + offset, obj_size) : obj_size; 779 rem -= off; 780 } 781 } 782 783 if (space > rem) 784 space = rem; 785 else if (space > PAGE_SIZE) { 786 /* 787 * Use page boundaries when possible for large 788 * requests. 789 */ 790 if (off & PAGE_MASK) 791 space -= (PAGE_SIZE - (off & PAGE_MASK)); 792 space = trunc_page(space); 793 if (off & PAGE_MASK) 794 space += (PAGE_SIZE - (off & PAGE_MASK)); 795 } 796 797 npages = howmany(space + (off & PAGE_MASK), PAGE_SIZE); 798 799 /* 800 * Calculate maximum allowed number of pages for readahead 801 * at this iteration. If SF_USER_READAHEAD was set, we don't 802 * do any heuristics and use exactly the value supplied by 803 * application. Otherwise, we allow readahead up to "rem". 804 * If application wants more, let it be, but there is no 805 * reason to go above MAXPHYS. Also check against "obj_size", 806 * since vm_pager_has_page() can hint beyond EOF. 807 */ 808 if (flags & SF_USER_READAHEAD) { 809 rhpages = SF_READAHEAD(flags); 810 } else { 811 rhpages = howmany(rem + (off & PAGE_MASK), PAGE_SIZE) - 812 npages; 813 rhpages += SF_READAHEAD(flags); 814 } 815 rhpages = min(howmany(MAXPHYS, PAGE_SIZE), rhpages); 816 rhpages = min(howmany(obj_size - trunc_page(off), PAGE_SIZE) - 817 npages, rhpages); 818 819 sfio = malloc(sizeof(struct sf_io) + 820 npages * sizeof(vm_page_t), M_TEMP, M_WAITOK); 821 refcount_init(&sfio->nios, 1); 822 sfio->so = so; 823 sfio->obj = obj; 824 sfio->error = 0; 825 vm_object_pip_add(obj, 1); 826 827 #ifdef KERN_TLS 828 /* 829 * This doesn't use ktls_hold() because sfio->m will 830 * also have a reference on 'tls' that will be valid 831 * for all of sfio's lifetime. 832 */ 833 sfio->tls = tls; 834 #endif 835 836 error = sendfile_swapin(obj, sfio, &nios, off, space, npages, 837 rhpages, flags); 838 if (error != 0) { 839 if (vp != NULL) 840 VOP_UNLOCK(vp); 841 sfio->m = NULL; 842 sendfile_iodone(sfio, NULL, 0, error); 843 goto done; 844 } 845 846 /* 847 * Loop and construct maximum sized mbuf chain to be bulk 848 * dumped into socket buffer. 849 */ 850 pa = sfio->pa; 851 852 /* 853 * Use unmapped mbufs if enabled for TCP. Unmapped 854 * bufs are restricted to TCP as that is what has been 855 * tested. In particular, unmapped mbufs have not 856 * been tested with UNIX-domain sockets. 857 * 858 * TLS frames always require unmapped mbufs. 859 */ 860 if ((mb_use_ext_pgs && 861 so->so_proto->pr_protocol == IPPROTO_TCP) 862 #ifdef KERN_TLS 863 || tls != NULL 864 #endif 865 ) { 866 use_ext_pgs = true; 867 #ifdef KERN_TLS 868 if (tls != NULL) 869 max_pgs = num_pages(tls->params.max_frame_len); 870 else 871 #endif 872 max_pgs = MBUF_PEXT_MAX_PGS; 873 874 /* Start at last index, to wrap on first use. */ 875 ext_pgs_idx = max_pgs - 1; 876 } 877 878 for (int i = 0; i < npages; i++) { 879 struct mbuf *m0; 880 881 /* 882 * If a page wasn't grabbed successfully, then 883 * trim the array. Can happen only with SF_NODISKIO. 884 */ 885 if (pa[i] == NULL) { 886 SFSTAT_INC(sf_busy); 887 fixspace(npages, i, off, &space); 888 npages = i; 889 softerr = EBUSY; 890 break; 891 } 892 893 if (use_ext_pgs) { 894 off_t xfs; 895 896 ext_pgs_idx++; 897 if (ext_pgs_idx == max_pgs) { 898 m0 = mb_alloc_ext_pgs(M_WAITOK, false, 899 sendfile_free_mext_pg); 900 901 if (flags & SF_NOCACHE) { 902 m0->m_ext.ext_flags |= 903 EXT_FLAG_NOCACHE; 904 905 /* 906 * See comment below regarding 907 * ignoring SF_NOCACHE for the 908 * last page. 909 */ 910 if ((npages - i <= max_pgs) && 911 ((off + space) & PAGE_MASK) && 912 (rem > space || rhpages > 0)) 913 m0->m_ext.ext_flags |= 914 EXT_FLAG_CACHE_LAST; 915 } 916 if (sfs != NULL) { 917 m0->m_ext.ext_flags |= 918 EXT_FLAG_SYNC; 919 m0->m_ext.ext_arg2 = sfs; 920 mtx_lock(&sfs->mtx); 921 sfs->count++; 922 mtx_unlock(&sfs->mtx); 923 } 924 ext_pgs = m0->m_ext.ext_pgs; 925 if (i == 0) 926 sfio->m = m0; 927 ext_pgs_idx = 0; 928 929 /* Append to mbuf chain. */ 930 if (mtail != NULL) 931 mtail->m_next = m0; 932 else 933 m = m0; 934 mtail = m0; 935 ext_pgs->first_pg_off = 936 vmoff(i, off) & PAGE_MASK; 937 } 938 if (nios) { 939 mtail->m_flags |= M_NOTREADY; 940 ext_pgs->nrdy++; 941 } 942 943 ext_pgs->pa[ext_pgs_idx] = VM_PAGE_TO_PHYS(pa[i]); 944 ext_pgs->npgs++; 945 xfs = xfsize(i, npages, off, space); 946 ext_pgs->last_pg_len = xfs; 947 MBUF_EXT_PGS_ASSERT_SANITY(ext_pgs); 948 mtail->m_len += xfs; 949 mtail->m_ext.ext_size += PAGE_SIZE; 950 continue; 951 } 952 953 /* 954 * Get a sendfile buf. When allocating the 955 * first buffer for mbuf chain, we usually 956 * wait as long as necessary, but this wait 957 * can be interrupted. For consequent 958 * buffers, do not sleep, since several 959 * threads might exhaust the buffers and then 960 * deadlock. 961 */ 962 sf = sf_buf_alloc(pa[i], 963 m != NULL ? SFB_NOWAIT : SFB_CATCH); 964 if (sf == NULL) { 965 SFSTAT_INC(sf_allocfail); 966 for (int j = i; j < npages; j++) 967 vm_page_unwire(pa[j], PQ_INACTIVE); 968 if (m == NULL) 969 softerr = ENOBUFS; 970 fixspace(npages, i, off, &space); 971 npages = i; 972 break; 973 } 974 975 m0 = m_get(M_WAITOK, MT_DATA); 976 m0->m_ext.ext_buf = (char *)sf_buf_kva(sf); 977 m0->m_ext.ext_size = PAGE_SIZE; 978 m0->m_ext.ext_arg1 = sf; 979 m0->m_ext.ext_type = EXT_SFBUF; 980 m0->m_ext.ext_flags = EXT_FLAG_EMBREF; 981 m0->m_ext.ext_free = sendfile_free_mext; 982 /* 983 * SF_NOCACHE sets the page as being freed upon send. 984 * However, we ignore it for the last page in 'space', 985 * if the page is truncated, and we got more data to 986 * send (rem > space), or if we have readahead 987 * configured (rhpages > 0). 988 */ 989 if ((flags & SF_NOCACHE) && 990 (i != npages - 1 || 991 !((off + space) & PAGE_MASK) || 992 !(rem > space || rhpages > 0))) 993 m0->m_ext.ext_flags |= EXT_FLAG_NOCACHE; 994 if (sfs != NULL) { 995 m0->m_ext.ext_flags |= EXT_FLAG_SYNC; 996 m0->m_ext.ext_arg2 = sfs; 997 mtx_lock(&sfs->mtx); 998 sfs->count++; 999 mtx_unlock(&sfs->mtx); 1000 } 1001 m0->m_ext.ext_count = 1; 1002 m0->m_flags |= (M_EXT | M_RDONLY); 1003 if (nios) 1004 m0->m_flags |= M_NOTREADY; 1005 m0->m_data = (char *)sf_buf_kva(sf) + 1006 (vmoff(i, off) & PAGE_MASK); 1007 m0->m_len = xfsize(i, npages, off, space); 1008 1009 if (i == 0) 1010 sfio->m = m0; 1011 1012 /* Append to mbuf chain. */ 1013 if (mtail != NULL) 1014 mtail->m_next = m0; 1015 else 1016 m = m0; 1017 mtail = m0; 1018 } 1019 1020 if (vp != NULL) 1021 VOP_UNLOCK(vp); 1022 1023 /* Keep track of bytes processed. */ 1024 off += space; 1025 rem -= space; 1026 1027 /* Prepend header, if any. */ 1028 if (hdrlen) { 1029 prepend_header: 1030 mhtail->m_next = m; 1031 m = mh; 1032 mh = NULL; 1033 } 1034 1035 if (m == NULL) { 1036 KASSERT(softerr, ("%s: m NULL, no error", __func__)); 1037 error = softerr; 1038 free(sfio, M_TEMP); 1039 goto done; 1040 } 1041 1042 /* Add the buffer chain to the socket buffer. */ 1043 KASSERT(m_length(m, NULL) == space + hdrlen, 1044 ("%s: mlen %u space %d hdrlen %d", 1045 __func__, m_length(m, NULL), space, hdrlen)); 1046 1047 CURVNET_SET(so->so_vnet); 1048 #ifdef KERN_TLS 1049 if (tls != NULL) { 1050 error = ktls_frame(m, tls, &tls_enq_cnt, 1051 TLS_RLTYPE_APP); 1052 if (error != 0) 1053 goto done; 1054 } 1055 #endif 1056 if (nios == 0) { 1057 /* 1058 * If sendfile_swapin() didn't initiate any I/Os, 1059 * which happens if all data is cached in VM, then 1060 * we can send data right now without the 1061 * PRUS_NOTREADY flag. 1062 */ 1063 vm_object_pip_wakeup(sfio->obj); 1064 free(sfio, M_TEMP); 1065 #ifdef KERN_TLS 1066 if (tls != NULL && tls->mode == TCP_TLS_MODE_SW) { 1067 error = (*so->so_proto->pr_usrreqs->pru_send) 1068 (so, PRUS_NOTREADY, m, NULL, NULL, td); 1069 soref(so); 1070 ktls_enqueue(m, so, tls_enq_cnt); 1071 } else 1072 #endif 1073 error = (*so->so_proto->pr_usrreqs->pru_send) 1074 (so, 0, m, NULL, NULL, td); 1075 } else { 1076 sfio->npages = npages; 1077 soref(so); 1078 error = (*so->so_proto->pr_usrreqs->pru_send) 1079 (so, PRUS_NOTREADY, m, NULL, NULL, td); 1080 sendfile_iodone(sfio, NULL, 0, 0); 1081 } 1082 CURVNET_RESTORE(); 1083 1084 m = NULL; /* pru_send always consumes */ 1085 if (error) 1086 goto done; 1087 sbytes += space + hdrlen; 1088 if (hdrlen) 1089 hdrlen = 0; 1090 if (softerr) { 1091 error = softerr; 1092 goto done; 1093 } 1094 } 1095 1096 /* 1097 * Send trailers. Wimp out and use writev(2). 1098 */ 1099 if (trl_uio != NULL) { 1100 sbunlock(&so->so_snd); 1101 error = kern_writev(td, sockfd, trl_uio); 1102 if (error == 0) 1103 sbytes += td->td_retval[0]; 1104 goto out; 1105 } 1106 1107 done: 1108 sbunlock(&so->so_snd); 1109 out: 1110 /* 1111 * If there was no error we have to clear td->td_retval[0] 1112 * because it may have been set by writev. 1113 */ 1114 if (error == 0) { 1115 td->td_retval[0] = 0; 1116 } 1117 if (sent != NULL) { 1118 (*sent) = sbytes; 1119 } 1120 if (obj != NULL) 1121 vm_object_deallocate(obj); 1122 if (so) 1123 fdrop(sock_fp, td); 1124 if (m) 1125 m_freem(m); 1126 if (mh) 1127 m_freem(mh); 1128 1129 if (sfs != NULL) { 1130 mtx_lock(&sfs->mtx); 1131 if (sfs->count != 0) 1132 cv_wait(&sfs->cv, &sfs->mtx); 1133 KASSERT(sfs->count == 0, ("sendfile sync still busy")); 1134 cv_destroy(&sfs->cv); 1135 mtx_destroy(&sfs->mtx); 1136 free(sfs, M_TEMP); 1137 } 1138 #ifdef KERN_TLS 1139 if (tls != NULL) 1140 ktls_free(tls); 1141 #endif 1142 1143 if (error == ERESTART) 1144 error = EINTR; 1145 1146 return (error); 1147 } 1148 1149 static int 1150 sendfile(struct thread *td, struct sendfile_args *uap, int compat) 1151 { 1152 struct sf_hdtr hdtr; 1153 struct uio *hdr_uio, *trl_uio; 1154 struct file *fp; 1155 off_t sbytes; 1156 int error; 1157 1158 /* 1159 * File offset must be positive. If it goes beyond EOF 1160 * we send only the header/trailer and no payload data. 1161 */ 1162 if (uap->offset < 0) 1163 return (EINVAL); 1164 1165 sbytes = 0; 1166 hdr_uio = trl_uio = NULL; 1167 1168 if (uap->hdtr != NULL) { 1169 error = copyin(uap->hdtr, &hdtr, sizeof(hdtr)); 1170 if (error != 0) 1171 goto out; 1172 if (hdtr.headers != NULL) { 1173 error = copyinuio(hdtr.headers, hdtr.hdr_cnt, 1174 &hdr_uio); 1175 if (error != 0) 1176 goto out; 1177 #ifdef COMPAT_FREEBSD4 1178 /* 1179 * In FreeBSD < 5.0 the nbytes to send also included 1180 * the header. If compat is specified subtract the 1181 * header size from nbytes. 1182 */ 1183 if (compat) { 1184 if (uap->nbytes > hdr_uio->uio_resid) 1185 uap->nbytes -= hdr_uio->uio_resid; 1186 else 1187 uap->nbytes = 0; 1188 } 1189 #endif 1190 } 1191 if (hdtr.trailers != NULL) { 1192 error = copyinuio(hdtr.trailers, hdtr.trl_cnt, 1193 &trl_uio); 1194 if (error != 0) 1195 goto out; 1196 } 1197 } 1198 1199 AUDIT_ARG_FD(uap->fd); 1200 1201 /* 1202 * sendfile(2) can start at any offset within a file so we require 1203 * CAP_READ+CAP_SEEK = CAP_PREAD. 1204 */ 1205 if ((error = fget_read(td, uap->fd, &cap_pread_rights, &fp)) != 0) 1206 goto out; 1207 1208 error = fo_sendfile(fp, uap->s, hdr_uio, trl_uio, uap->offset, 1209 uap->nbytes, &sbytes, uap->flags, td); 1210 fdrop(fp, td); 1211 1212 if (uap->sbytes != NULL) 1213 copyout(&sbytes, uap->sbytes, sizeof(off_t)); 1214 1215 out: 1216 free(hdr_uio, M_IOV); 1217 free(trl_uio, M_IOV); 1218 return (error); 1219 } 1220 1221 /* 1222 * sendfile(2) 1223 * 1224 * int sendfile(int fd, int s, off_t offset, size_t nbytes, 1225 * struct sf_hdtr *hdtr, off_t *sbytes, int flags) 1226 * 1227 * Send a file specified by 'fd' and starting at 'offset' to a socket 1228 * specified by 's'. Send only 'nbytes' of the file or until EOF if nbytes == 1229 * 0. Optionally add a header and/or trailer to the socket output. If 1230 * specified, write the total number of bytes sent into *sbytes. 1231 */ 1232 int 1233 sys_sendfile(struct thread *td, struct sendfile_args *uap) 1234 { 1235 1236 return (sendfile(td, uap, 0)); 1237 } 1238 1239 #ifdef COMPAT_FREEBSD4 1240 int 1241 freebsd4_sendfile(struct thread *td, struct freebsd4_sendfile_args *uap) 1242 { 1243 struct sendfile_args args; 1244 1245 args.fd = uap->fd; 1246 args.s = uap->s; 1247 args.offset = uap->offset; 1248 args.nbytes = uap->nbytes; 1249 args.hdtr = uap->hdtr; 1250 args.sbytes = uap->sbytes; 1251 args.flags = uap->flags; 1252 1253 return (sendfile(td, &args, 1)); 1254 } 1255 #endif /* COMPAT_FREEBSD4 */ 1256