1 /*- 2 * Copyright (c) 2013-2015 Gleb Smirnoff <glebius@FreeBSD.org> 3 * Copyright (c) 1998, David Greenman. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the University nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include <sys/param.h> 34 #include <sys/systm.h> 35 #include <sys/capsicum.h> 36 #include <sys/kernel.h> 37 #include <netinet/in.h> 38 #include <sys/lock.h> 39 #include <sys/mutex.h> 40 #include <sys/sysproto.h> 41 #include <sys/malloc.h> 42 #include <sys/proc.h> 43 #include <sys/mman.h> 44 #include <sys/mount.h> 45 #include <sys/mbuf.h> 46 #include <sys/protosw.h> 47 #include <sys/rwlock.h> 48 #include <sys/sf_buf.h> 49 #include <sys/socket.h> 50 #include <sys/socketvar.h> 51 #include <sys/syscallsubr.h> 52 #include <sys/sysctl.h> 53 #include <sys/vnode.h> 54 55 #include <net/vnet.h> 56 57 #include <security/audit/audit.h> 58 #include <security/mac/mac_framework.h> 59 60 #include <vm/vm.h> 61 #include <vm/vm_object.h> 62 #include <vm/vm_pager.h> 63 64 #define EXT_FLAG_SYNC EXT_FLAG_VENDOR1 65 #define EXT_FLAG_NOCACHE EXT_FLAG_VENDOR2 66 #define EXT_FLAG_CACHE_LAST EXT_FLAG_VENDOR3 67 68 /* 69 * Structure describing a single sendfile(2) I/O, which may consist of 70 * several underlying pager I/Os. 71 * 72 * The syscall context allocates the structure and initializes 'nios' 73 * to 1. As sendfile_swapin() runs through pages and starts asynchronous 74 * paging operations, it increments 'nios'. 75 * 76 * Every I/O completion calls sendfile_iodone(), which decrements the 'nios', 77 * and the syscall also calls sendfile_iodone() after allocating all mbufs, 78 * linking them and sending to socket. Whoever reaches zero 'nios' is 79 * responsible to * call pru_ready on the socket, to notify it of readyness 80 * of the data. 81 */ 82 struct sf_io { 83 volatile u_int nios; 84 u_int error; 85 int npages; 86 struct socket *so; 87 struct mbuf *m; 88 vm_page_t pa[]; 89 }; 90 91 /* 92 * Structure used to track requests with SF_SYNC flag. 93 */ 94 struct sendfile_sync { 95 struct mtx mtx; 96 struct cv cv; 97 unsigned count; 98 }; 99 100 counter_u64_t sfstat[sizeof(struct sfstat) / sizeof(uint64_t)]; 101 102 static void 103 sfstat_init(const void *unused) 104 { 105 106 COUNTER_ARRAY_ALLOC(sfstat, sizeof(struct sfstat) / sizeof(uint64_t), 107 M_WAITOK); 108 } 109 SYSINIT(sfstat, SI_SUB_MBUF, SI_ORDER_FIRST, sfstat_init, NULL); 110 111 static int 112 sfstat_sysctl(SYSCTL_HANDLER_ARGS) 113 { 114 struct sfstat s; 115 116 COUNTER_ARRAY_COPY(sfstat, &s, sizeof(s) / sizeof(uint64_t)); 117 if (req->newptr) 118 COUNTER_ARRAY_ZERO(sfstat, sizeof(s) / sizeof(uint64_t)); 119 return (SYSCTL_OUT(req, &s, sizeof(s))); 120 } 121 SYSCTL_PROC(_kern_ipc, OID_AUTO, sfstat, CTLTYPE_OPAQUE | CTLFLAG_RW, 122 NULL, 0, sfstat_sysctl, "I", "sendfile statistics"); 123 124 static void 125 sendfile_free_mext(struct mbuf *m) 126 { 127 struct sf_buf *sf; 128 vm_page_t pg; 129 int flags; 130 131 KASSERT(m->m_flags & M_EXT && m->m_ext.ext_type == EXT_SFBUF, 132 ("%s: m %p !M_EXT or !EXT_SFBUF", __func__, m)); 133 134 sf = m->m_ext.ext_arg1; 135 pg = sf_buf_page(sf); 136 flags = (m->m_ext.ext_flags & EXT_FLAG_NOCACHE) != 0 ? VPR_TRYFREE : 0; 137 138 sf_buf_free(sf); 139 vm_page_release(pg, flags); 140 141 if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { 142 struct sendfile_sync *sfs = m->m_ext.ext_arg2; 143 144 mtx_lock(&sfs->mtx); 145 KASSERT(sfs->count > 0, ("Sendfile sync botchup count == 0")); 146 if (--sfs->count == 0) 147 cv_signal(&sfs->cv); 148 mtx_unlock(&sfs->mtx); 149 } 150 } 151 152 static void 153 sendfile_free_mext_pg(struct mbuf *m) 154 { 155 struct mbuf_ext_pgs *ext_pgs; 156 vm_page_t pg; 157 int flags, i; 158 bool cache_last; 159 160 KASSERT(m->m_flags & M_EXT && m->m_ext.ext_type == EXT_PGS, 161 ("%s: m %p !M_EXT or !EXT_PGS", __func__, m)); 162 163 cache_last = m->m_ext.ext_flags & EXT_FLAG_CACHE_LAST; 164 ext_pgs = m->m_ext.ext_pgs; 165 flags = (m->m_ext.ext_flags & EXT_FLAG_NOCACHE) != 0 ? VPR_TRYFREE : 0; 166 167 for (i = 0; i < ext_pgs->npgs; i++) { 168 if (cache_last && i == ext_pgs->npgs - 1) 169 flags = 0; 170 pg = PHYS_TO_VM_PAGE(ext_pgs->pa[i]); 171 vm_page_release(pg, flags); 172 } 173 174 if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { 175 struct sendfile_sync *sfs = m->m_ext.ext_arg2; 176 177 mtx_lock(&sfs->mtx); 178 KASSERT(sfs->count > 0, ("Sendfile sync botchup count == 0")); 179 if (--sfs->count == 0) 180 cv_signal(&sfs->cv); 181 mtx_unlock(&sfs->mtx); 182 } 183 } 184 185 /* 186 * Helper function to calculate how much data to put into page i of n. 187 * Only first and last pages are special. 188 */ 189 static inline off_t 190 xfsize(int i, int n, off_t off, off_t len) 191 { 192 193 if (i == 0) 194 return (omin(PAGE_SIZE - (off & PAGE_MASK), len)); 195 196 if (i == n - 1 && ((off + len) & PAGE_MASK) > 0) 197 return ((off + len) & PAGE_MASK); 198 199 return (PAGE_SIZE); 200 } 201 202 /* 203 * Helper function to get offset within object for i page. 204 */ 205 static inline vm_ooffset_t 206 vmoff(int i, off_t off) 207 { 208 209 if (i == 0) 210 return ((vm_ooffset_t)off); 211 212 return (trunc_page(off + i * PAGE_SIZE)); 213 } 214 215 /* 216 * Helper function used when allocation of a page or sf_buf failed. 217 * Pretend as if we don't have enough space, subtract xfsize() of 218 * all pages that failed. 219 */ 220 static inline void 221 fixspace(int old, int new, off_t off, int *space) 222 { 223 224 KASSERT(old > new, ("%s: old %d new %d", __func__, old, new)); 225 226 /* Subtract last one. */ 227 *space -= xfsize(old - 1, old, off, *space); 228 old--; 229 230 if (new == old) 231 /* There was only one page. */ 232 return; 233 234 /* Subtract first one. */ 235 if (new == 0) { 236 *space -= xfsize(0, old, off, *space); 237 new++; 238 } 239 240 /* Rest of pages are full sized. */ 241 *space -= (old - new) * PAGE_SIZE; 242 243 KASSERT(*space >= 0, ("%s: space went backwards", __func__)); 244 } 245 246 /* 247 * I/O completion callback. 248 */ 249 static void 250 sendfile_iodone(void *arg, vm_page_t *pg, int count, int error) 251 { 252 struct sf_io *sfio = arg; 253 struct socket *so = sfio->so; 254 255 for (int i = 0; i < count; i++) 256 if (pg[i] != bogus_page) 257 vm_page_xunbusy(pg[i]); 258 259 if (error) 260 sfio->error = error; 261 262 if (!refcount_release(&sfio->nios)) 263 return; 264 265 CURVNET_SET(so->so_vnet); 266 if (sfio->error) { 267 /* 268 * I/O operation failed. The state of data in the socket 269 * is now inconsistent, and all what we can do is to tear 270 * it down. Protocol abort method would tear down protocol 271 * state, free all ready mbufs and detach not ready ones. 272 * We will free the mbufs corresponding to this I/O manually. 273 * 274 * The socket would be marked with EIO and made available 275 * for read, so that application receives EIO on next 276 * syscall and eventually closes the socket. 277 */ 278 so->so_proto->pr_usrreqs->pru_abort(so); 279 so->so_error = EIO; 280 281 mb_free_notready(sfio->m, sfio->npages); 282 } else 283 (void)(so->so_proto->pr_usrreqs->pru_ready)(so, sfio->m, 284 sfio->npages); 285 286 SOCK_LOCK(so); 287 sorele(so); 288 CURVNET_RESTORE(); 289 free(sfio, M_TEMP); 290 } 291 292 /* 293 * Iterate through pages vector and request paging for non-valid pages. 294 */ 295 static int 296 sendfile_swapin(vm_object_t obj, struct sf_io *sfio, int *nios, off_t off, 297 off_t len, int npages, int rhpages, int flags) 298 { 299 vm_page_t *pa = sfio->pa; 300 int grabbed; 301 302 *nios = 0; 303 flags = (flags & SF_NODISKIO) ? VM_ALLOC_NOWAIT : 0; 304 305 /* 306 * First grab all the pages and wire them. Note that we grab 307 * only required pages. Readahead pages are dealt with later. 308 */ 309 VM_OBJECT_WLOCK(obj); 310 311 grabbed = vm_page_grab_pages(obj, OFF_TO_IDX(off), 312 VM_ALLOC_NORMAL | VM_ALLOC_WIRED | flags, pa, npages); 313 if (grabbed < npages) { 314 for (int i = grabbed; i < npages; i++) 315 pa[i] = NULL; 316 npages = grabbed; 317 rhpages = 0; 318 } 319 320 for (int i = 0; i < npages;) { 321 int j, a, count, rv; 322 323 /* Skip valid pages. */ 324 if (vm_page_is_valid(pa[i], vmoff(i, off) & PAGE_MASK, 325 xfsize(i, npages, off, len))) { 326 vm_page_xunbusy(pa[i]); 327 SFSTAT_INC(sf_pages_valid); 328 i++; 329 continue; 330 } 331 332 /* 333 * Next page is invalid. Check if it belongs to pager. It 334 * may not be there, which is a regular situation for shmem 335 * pager. For vnode pager this happens only in case of 336 * a sparse file. 337 * 338 * Important feature of vm_pager_has_page() is the hint 339 * stored in 'a', about how many pages we can pagein after 340 * this page in a single I/O. 341 */ 342 if (!vm_pager_has_page(obj, OFF_TO_IDX(vmoff(i, off)), NULL, 343 &a)) { 344 pmap_zero_page(pa[i]); 345 pa[i]->valid = VM_PAGE_BITS_ALL; 346 MPASS(pa[i]->dirty == 0); 347 vm_page_xunbusy(pa[i]); 348 i++; 349 continue; 350 } 351 352 /* 353 * We want to pagein as many pages as possible, limited only 354 * by the 'a' hint and actual request. 355 */ 356 count = min(a + 1, npages - i); 357 358 /* 359 * We should not pagein into a valid page, thus we first trim 360 * any valid pages off the end of request, and substitute 361 * to bogus_page those, that are in the middle. 362 */ 363 for (j = i + count - 1; j > i; j--) { 364 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 365 xfsize(j, npages, off, len))) { 366 count--; 367 rhpages = 0; 368 } else 369 break; 370 } 371 for (j = i + 1; j < i + count - 1; j++) 372 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 373 xfsize(j, npages, off, len))) { 374 vm_page_xunbusy(pa[j]); 375 SFSTAT_INC(sf_pages_valid); 376 SFSTAT_INC(sf_pages_bogus); 377 pa[j] = bogus_page; 378 } 379 380 refcount_acquire(&sfio->nios); 381 rv = vm_pager_get_pages_async(obj, pa + i, count, NULL, 382 i + count == npages ? &rhpages : NULL, 383 &sendfile_iodone, sfio); 384 if (rv != VM_PAGER_OK) { 385 for (j = i; j < i + count; j++) { 386 if (pa[j] != bogus_page) { 387 vm_page_lock(pa[j]); 388 vm_page_unwire(pa[j], PQ_INACTIVE); 389 vm_page_unlock(pa[j]); 390 } 391 } 392 VM_OBJECT_WUNLOCK(obj); 393 return (EIO); 394 } 395 KASSERT(rv == VM_PAGER_OK, ("%s: pager fail obj %p page %p", 396 __func__, obj, pa[i])); 397 398 SFSTAT_INC(sf_iocnt); 399 SFSTAT_ADD(sf_pages_read, count); 400 if (i + count == npages) 401 SFSTAT_ADD(sf_rhpages_read, rhpages); 402 403 /* 404 * Restore the valid page pointers. They are already 405 * unbusied, but still wired. 406 */ 407 for (j = i; j < i + count; j++) 408 if (pa[j] == bogus_page) { 409 pa[j] = vm_page_lookup(obj, 410 OFF_TO_IDX(vmoff(j, off))); 411 KASSERT(pa[j], ("%s: page %p[%d] disappeared", 412 __func__, pa, j)); 413 414 } 415 i += count; 416 (*nios)++; 417 } 418 419 VM_OBJECT_WUNLOCK(obj); 420 421 if (*nios == 0 && npages != 0) 422 SFSTAT_INC(sf_noiocnt); 423 424 return (0); 425 } 426 427 static int 428 sendfile_getobj(struct thread *td, struct file *fp, vm_object_t *obj_res, 429 struct vnode **vp_res, struct shmfd **shmfd_res, off_t *obj_size, 430 int *bsize) 431 { 432 struct vattr va; 433 vm_object_t obj; 434 struct vnode *vp; 435 struct shmfd *shmfd; 436 int error; 437 438 vp = *vp_res = NULL; 439 obj = NULL; 440 shmfd = *shmfd_res = NULL; 441 *bsize = 0; 442 443 /* 444 * The file descriptor must be a regular file and have a 445 * backing VM object. 446 */ 447 if (fp->f_type == DTYPE_VNODE) { 448 vp = fp->f_vnode; 449 vn_lock(vp, LK_SHARED | LK_RETRY); 450 if (vp->v_type != VREG) { 451 error = EINVAL; 452 goto out; 453 } 454 *bsize = vp->v_mount->mnt_stat.f_iosize; 455 error = VOP_GETATTR(vp, &va, td->td_ucred); 456 if (error != 0) 457 goto out; 458 *obj_size = va.va_size; 459 obj = vp->v_object; 460 if (obj == NULL) { 461 error = EINVAL; 462 goto out; 463 } 464 } else if (fp->f_type == DTYPE_SHM) { 465 error = 0; 466 shmfd = fp->f_data; 467 obj = shmfd->shm_object; 468 *obj_size = shmfd->shm_size; 469 } else { 470 error = EINVAL; 471 goto out; 472 } 473 474 VM_OBJECT_WLOCK(obj); 475 if ((obj->flags & OBJ_DEAD) != 0) { 476 VM_OBJECT_WUNLOCK(obj); 477 error = EBADF; 478 goto out; 479 } 480 481 /* 482 * Temporarily increase the backing VM object's reference 483 * count so that a forced reclamation of its vnode does not 484 * immediately destroy it. 485 */ 486 vm_object_reference_locked(obj); 487 VM_OBJECT_WUNLOCK(obj); 488 *obj_res = obj; 489 *vp_res = vp; 490 *shmfd_res = shmfd; 491 492 out: 493 if (vp != NULL) 494 VOP_UNLOCK(vp, 0); 495 return (error); 496 } 497 498 static int 499 sendfile_getsock(struct thread *td, int s, struct file **sock_fp, 500 struct socket **so) 501 { 502 int error; 503 504 *sock_fp = NULL; 505 *so = NULL; 506 507 /* 508 * The socket must be a stream socket and connected. 509 */ 510 error = getsock_cap(td, s, &cap_send_rights, 511 sock_fp, NULL, NULL); 512 if (error != 0) 513 return (error); 514 *so = (*sock_fp)->f_data; 515 if ((*so)->so_type != SOCK_STREAM) 516 return (EINVAL); 517 if (SOLISTENING(*so)) 518 return (ENOTCONN); 519 return (0); 520 } 521 522 int 523 vn_sendfile(struct file *fp, int sockfd, struct uio *hdr_uio, 524 struct uio *trl_uio, off_t offset, size_t nbytes, off_t *sent, int flags, 525 struct thread *td) 526 { 527 struct file *sock_fp; 528 struct vnode *vp; 529 struct vm_object *obj; 530 struct socket *so; 531 struct mbuf_ext_pgs *ext_pgs; 532 struct mbuf *m, *mh, *mhtail; 533 struct sf_buf *sf; 534 struct shmfd *shmfd; 535 struct sendfile_sync *sfs; 536 struct vattr va; 537 off_t off, sbytes, rem, obj_size; 538 int bsize, error, ext_pgs_idx, hdrlen, max_pgs, softerr; 539 bool use_ext_pgs; 540 541 obj = NULL; 542 so = NULL; 543 m = mh = NULL; 544 sfs = NULL; 545 hdrlen = sbytes = 0; 546 softerr = 0; 547 use_ext_pgs = false; 548 549 error = sendfile_getobj(td, fp, &obj, &vp, &shmfd, &obj_size, &bsize); 550 if (error != 0) 551 return (error); 552 553 error = sendfile_getsock(td, sockfd, &sock_fp, &so); 554 if (error != 0) 555 goto out; 556 557 #ifdef MAC 558 error = mac_socket_check_send(td->td_ucred, so); 559 if (error != 0) 560 goto out; 561 #endif 562 563 SFSTAT_INC(sf_syscalls); 564 SFSTAT_ADD(sf_rhpages_requested, SF_READAHEAD(flags)); 565 566 if (flags & SF_SYNC) { 567 sfs = malloc(sizeof *sfs, M_TEMP, M_WAITOK | M_ZERO); 568 mtx_init(&sfs->mtx, "sendfile", NULL, MTX_DEF); 569 cv_init(&sfs->cv, "sendfile"); 570 } 571 572 rem = nbytes ? omin(nbytes, obj_size - offset) : obj_size - offset; 573 574 /* 575 * Protect against multiple writers to the socket. 576 * 577 * XXXRW: Historically this has assumed non-interruptibility, so now 578 * we implement that, but possibly shouldn't. 579 */ 580 (void)sblock(&so->so_snd, SBL_WAIT | SBL_NOINTR); 581 582 /* 583 * Loop through the pages of the file, starting with the requested 584 * offset. Get a file page (do I/O if necessary), map the file page 585 * into an sf_buf, attach an mbuf header to the sf_buf, and queue 586 * it on the socket. 587 * This is done in two loops. The inner loop turns as many pages 588 * as it can, up to available socket buffer space, without blocking 589 * into mbufs to have it bulk delivered into the socket send buffer. 590 * The outer loop checks the state and available space of the socket 591 * and takes care of the overall progress. 592 */ 593 for (off = offset; rem > 0; ) { 594 struct sf_io *sfio; 595 vm_page_t *pa; 596 struct mbuf *mtail; 597 int nios, space, npages, rhpages; 598 599 mtail = NULL; 600 /* 601 * Check the socket state for ongoing connection, 602 * no errors and space in socket buffer. 603 * If space is low allow for the remainder of the 604 * file to be processed if it fits the socket buffer. 605 * Otherwise block in waiting for sufficient space 606 * to proceed, or if the socket is nonblocking, return 607 * to userland with EAGAIN while reporting how far 608 * we've come. 609 * We wait until the socket buffer has significant free 610 * space to do bulk sends. This makes good use of file 611 * system read ahead and allows packet segmentation 612 * offloading hardware to take over lots of work. If 613 * we were not careful here we would send off only one 614 * sfbuf at a time. 615 */ 616 SOCKBUF_LOCK(&so->so_snd); 617 if (so->so_snd.sb_lowat < so->so_snd.sb_hiwat / 2) 618 so->so_snd.sb_lowat = so->so_snd.sb_hiwat / 2; 619 retry_space: 620 if (so->so_snd.sb_state & SBS_CANTSENDMORE) { 621 error = EPIPE; 622 SOCKBUF_UNLOCK(&so->so_snd); 623 goto done; 624 } else if (so->so_error) { 625 error = so->so_error; 626 so->so_error = 0; 627 SOCKBUF_UNLOCK(&so->so_snd); 628 goto done; 629 } 630 if ((so->so_state & SS_ISCONNECTED) == 0) { 631 SOCKBUF_UNLOCK(&so->so_snd); 632 error = ENOTCONN; 633 goto done; 634 } 635 636 space = sbspace(&so->so_snd); 637 if (space < rem && 638 (space <= 0 || 639 space < so->so_snd.sb_lowat)) { 640 if (so->so_state & SS_NBIO) { 641 SOCKBUF_UNLOCK(&so->so_snd); 642 error = EAGAIN; 643 goto done; 644 } 645 /* 646 * sbwait drops the lock while sleeping. 647 * When we loop back to retry_space the 648 * state may have changed and we retest 649 * for it. 650 */ 651 error = sbwait(&so->so_snd); 652 /* 653 * An error from sbwait usually indicates that we've 654 * been interrupted by a signal. If we've sent anything 655 * then return bytes sent, otherwise return the error. 656 */ 657 if (error != 0) { 658 SOCKBUF_UNLOCK(&so->so_snd); 659 goto done; 660 } 661 goto retry_space; 662 } 663 SOCKBUF_UNLOCK(&so->so_snd); 664 665 /* 666 * At the beginning of the first loop check if any headers 667 * are specified and copy them into mbufs. Reduce space in 668 * the socket buffer by the size of the header mbuf chain. 669 * Clear hdr_uio here and hdrlen at the end of the first loop. 670 */ 671 if (hdr_uio != NULL && hdr_uio->uio_resid > 0) { 672 hdr_uio->uio_td = td; 673 hdr_uio->uio_rw = UIO_WRITE; 674 mh = m_uiotombuf(hdr_uio, M_WAITOK, space, 0, 0); 675 hdrlen = m_length(mh, &mhtail); 676 space -= hdrlen; 677 /* 678 * If header consumed all the socket buffer space, 679 * don't waste CPU cycles and jump to the end. 680 */ 681 if (space == 0) { 682 sfio = NULL; 683 nios = 0; 684 goto prepend_header; 685 } 686 hdr_uio = NULL; 687 } 688 689 if (vp != NULL) { 690 error = vn_lock(vp, LK_SHARED); 691 if (error != 0) 692 goto done; 693 error = VOP_GETATTR(vp, &va, td->td_ucred); 694 if (error != 0 || off >= va.va_size) { 695 VOP_UNLOCK(vp, 0); 696 goto done; 697 } 698 if (va.va_size != obj_size) { 699 obj_size = va.va_size; 700 rem = nbytes ? 701 omin(nbytes + offset, obj_size) : obj_size; 702 rem -= off; 703 } 704 } 705 706 if (space > rem) 707 space = rem; 708 else if (space > PAGE_SIZE) { 709 /* 710 * Use page boundaries when possible for large 711 * requests. 712 */ 713 if (off & PAGE_MASK) 714 space -= (PAGE_SIZE - (off & PAGE_MASK)); 715 space = trunc_page(space); 716 if (off & PAGE_MASK) 717 space += (PAGE_SIZE - (off & PAGE_MASK)); 718 } 719 720 npages = howmany(space + (off & PAGE_MASK), PAGE_SIZE); 721 722 /* 723 * Calculate maximum allowed number of pages for readahead 724 * at this iteration. If SF_USER_READAHEAD was set, we don't 725 * do any heuristics and use exactly the value supplied by 726 * application. Otherwise, we allow readahead up to "rem". 727 * If application wants more, let it be, but there is no 728 * reason to go above MAXPHYS. Also check against "obj_size", 729 * since vm_pager_has_page() can hint beyond EOF. 730 */ 731 if (flags & SF_USER_READAHEAD) { 732 rhpages = SF_READAHEAD(flags); 733 } else { 734 rhpages = howmany(rem + (off & PAGE_MASK), PAGE_SIZE) - 735 npages; 736 rhpages += SF_READAHEAD(flags); 737 } 738 rhpages = min(howmany(MAXPHYS, PAGE_SIZE), rhpages); 739 rhpages = min(howmany(obj_size - trunc_page(off), PAGE_SIZE) - 740 npages, rhpages); 741 742 sfio = malloc(sizeof(struct sf_io) + 743 npages * sizeof(vm_page_t), M_TEMP, M_WAITOK); 744 refcount_init(&sfio->nios, 1); 745 sfio->so = so; 746 sfio->error = 0; 747 748 error = sendfile_swapin(obj, sfio, &nios, off, space, npages, 749 rhpages, flags); 750 if (error != 0) { 751 if (vp != NULL) 752 VOP_UNLOCK(vp, 0); 753 free(sfio, M_TEMP); 754 goto done; 755 } 756 757 /* 758 * Loop and construct maximum sized mbuf chain to be bulk 759 * dumped into socket buffer. 760 */ 761 pa = sfio->pa; 762 763 /* 764 * Use unmapped mbufs if enabled for TCP. Unmapped 765 * bufs are restricted to TCP as that is what has been 766 * tested. In particular, unmapped mbufs have not 767 * been tested with UNIX-domain sockets. 768 */ 769 if (mb_use_ext_pgs && 770 so->so_proto->pr_protocol == IPPROTO_TCP) { 771 use_ext_pgs = true; 772 max_pgs = MBUF_PEXT_MAX_PGS; 773 774 /* Start at last index, to wrap on first use. */ 775 ext_pgs_idx = max_pgs - 1; 776 } 777 778 for (int i = 0; i < npages; i++) { 779 struct mbuf *m0; 780 781 /* 782 * If a page wasn't grabbed successfully, then 783 * trim the array. Can happen only with SF_NODISKIO. 784 */ 785 if (pa[i] == NULL) { 786 SFSTAT_INC(sf_busy); 787 fixspace(npages, i, off, &space); 788 npages = i; 789 softerr = EBUSY; 790 break; 791 } 792 793 if (use_ext_pgs) { 794 off_t xfs; 795 796 ext_pgs_idx++; 797 if (ext_pgs_idx == max_pgs) { 798 m0 = mb_alloc_ext_pgs(M_WAITOK, false, 799 sendfile_free_mext_pg); 800 801 if (flags & SF_NOCACHE) { 802 m0->m_ext.ext_flags |= 803 EXT_FLAG_NOCACHE; 804 805 /* 806 * See comment below regarding 807 * ignoring SF_NOCACHE for the 808 * last page. 809 */ 810 if ((npages - i <= max_pgs) && 811 ((off + space) & PAGE_MASK) && 812 (rem > space || rhpages > 0)) 813 m0->m_ext.ext_flags |= 814 EXT_FLAG_CACHE_LAST; 815 } 816 if (sfs != NULL) { 817 m0->m_ext.ext_flags |= 818 EXT_FLAG_SYNC; 819 m0->m_ext.ext_arg2 = sfs; 820 mtx_lock(&sfs->mtx); 821 sfs->count++; 822 mtx_unlock(&sfs->mtx); 823 } 824 ext_pgs = m0->m_ext.ext_pgs; 825 if (i == 0) 826 sfio->m = m0; 827 ext_pgs_idx = 0; 828 829 /* Append to mbuf chain. */ 830 if (mtail != NULL) 831 mtail->m_next = m0; 832 else 833 m = m0; 834 mtail = m0; 835 ext_pgs->first_pg_off = 836 vmoff(i, off) & PAGE_MASK; 837 } 838 if (nios) { 839 mtail->m_flags |= M_NOTREADY; 840 ext_pgs->nrdy++; 841 } 842 843 ext_pgs->pa[ext_pgs_idx] = VM_PAGE_TO_PHYS(pa[i]); 844 ext_pgs->npgs++; 845 xfs = xfsize(i, npages, off, space); 846 ext_pgs->last_pg_len = xfs; 847 MBUF_EXT_PGS_ASSERT_SANITY(ext_pgs); 848 mtail->m_len += xfs; 849 mtail->m_ext.ext_size += PAGE_SIZE; 850 continue; 851 } 852 853 /* 854 * Get a sendfile buf. When allocating the 855 * first buffer for mbuf chain, we usually 856 * wait as long as necessary, but this wait 857 * can be interrupted. For consequent 858 * buffers, do not sleep, since several 859 * threads might exhaust the buffers and then 860 * deadlock. 861 */ 862 sf = sf_buf_alloc(pa[i], 863 m != NULL ? SFB_NOWAIT : SFB_CATCH); 864 if (sf == NULL) { 865 SFSTAT_INC(sf_allocfail); 866 for (int j = i; j < npages; j++) { 867 vm_page_lock(pa[j]); 868 vm_page_unwire(pa[j], PQ_INACTIVE); 869 vm_page_unlock(pa[j]); 870 } 871 if (m == NULL) 872 softerr = ENOBUFS; 873 fixspace(npages, i, off, &space); 874 npages = i; 875 break; 876 } 877 878 m0 = m_get(M_WAITOK, MT_DATA); 879 m0->m_ext.ext_buf = (char *)sf_buf_kva(sf); 880 m0->m_ext.ext_size = PAGE_SIZE; 881 m0->m_ext.ext_arg1 = sf; 882 m0->m_ext.ext_type = EXT_SFBUF; 883 m0->m_ext.ext_flags = EXT_FLAG_EMBREF; 884 m0->m_ext.ext_free = sendfile_free_mext; 885 /* 886 * SF_NOCACHE sets the page as being freed upon send. 887 * However, we ignore it for the last page in 'space', 888 * if the page is truncated, and we got more data to 889 * send (rem > space), or if we have readahead 890 * configured (rhpages > 0). 891 */ 892 if ((flags & SF_NOCACHE) && 893 (i != npages - 1 || 894 !((off + space) & PAGE_MASK) || 895 !(rem > space || rhpages > 0))) 896 m0->m_ext.ext_flags |= EXT_FLAG_NOCACHE; 897 if (sfs != NULL) { 898 m0->m_ext.ext_flags |= EXT_FLAG_SYNC; 899 m0->m_ext.ext_arg2 = sfs; 900 mtx_lock(&sfs->mtx); 901 sfs->count++; 902 mtx_unlock(&sfs->mtx); 903 } 904 m0->m_ext.ext_count = 1; 905 m0->m_flags |= (M_EXT | M_RDONLY); 906 if (nios) 907 m0->m_flags |= M_NOTREADY; 908 m0->m_data = (char *)sf_buf_kva(sf) + 909 (vmoff(i, off) & PAGE_MASK); 910 m0->m_len = xfsize(i, npages, off, space); 911 912 if (i == 0) 913 sfio->m = m0; 914 915 /* Append to mbuf chain. */ 916 if (mtail != NULL) 917 mtail->m_next = m0; 918 else 919 m = m0; 920 mtail = m0; 921 } 922 923 if (vp != NULL) 924 VOP_UNLOCK(vp, 0); 925 926 /* Keep track of bytes processed. */ 927 off += space; 928 rem -= space; 929 930 /* Prepend header, if any. */ 931 if (hdrlen) { 932 prepend_header: 933 mhtail->m_next = m; 934 m = mh; 935 mh = NULL; 936 } 937 938 if (m == NULL) { 939 KASSERT(softerr, ("%s: m NULL, no error", __func__)); 940 error = softerr; 941 free(sfio, M_TEMP); 942 goto done; 943 } 944 945 /* Add the buffer chain to the socket buffer. */ 946 KASSERT(m_length(m, NULL) == space + hdrlen, 947 ("%s: mlen %u space %d hdrlen %d", 948 __func__, m_length(m, NULL), space, hdrlen)); 949 950 CURVNET_SET(so->so_vnet); 951 if (nios == 0) { 952 /* 953 * If sendfile_swapin() didn't initiate any I/Os, 954 * which happens if all data is cached in VM, then 955 * we can send data right now without the 956 * PRUS_NOTREADY flag. 957 */ 958 free(sfio, M_TEMP); 959 error = (*so->so_proto->pr_usrreqs->pru_send) 960 (so, 0, m, NULL, NULL, td); 961 } else { 962 sfio->npages = npages; 963 soref(so); 964 error = (*so->so_proto->pr_usrreqs->pru_send) 965 (so, PRUS_NOTREADY, m, NULL, NULL, td); 966 sendfile_iodone(sfio, NULL, 0, 0); 967 } 968 CURVNET_RESTORE(); 969 970 m = NULL; /* pru_send always consumes */ 971 if (error) 972 goto done; 973 sbytes += space + hdrlen; 974 if (hdrlen) 975 hdrlen = 0; 976 if (softerr) { 977 error = softerr; 978 goto done; 979 } 980 } 981 982 /* 983 * Send trailers. Wimp out and use writev(2). 984 */ 985 if (trl_uio != NULL) { 986 sbunlock(&so->so_snd); 987 error = kern_writev(td, sockfd, trl_uio); 988 if (error == 0) 989 sbytes += td->td_retval[0]; 990 goto out; 991 } 992 993 done: 994 sbunlock(&so->so_snd); 995 out: 996 /* 997 * If there was no error we have to clear td->td_retval[0] 998 * because it may have been set by writev. 999 */ 1000 if (error == 0) { 1001 td->td_retval[0] = 0; 1002 } 1003 if (sent != NULL) { 1004 (*sent) = sbytes; 1005 } 1006 if (obj != NULL) 1007 vm_object_deallocate(obj); 1008 if (so) 1009 fdrop(sock_fp, td); 1010 if (m) 1011 m_freem(m); 1012 if (mh) 1013 m_freem(mh); 1014 1015 if (sfs != NULL) { 1016 mtx_lock(&sfs->mtx); 1017 if (sfs->count != 0) 1018 cv_wait(&sfs->cv, &sfs->mtx); 1019 KASSERT(sfs->count == 0, ("sendfile sync still busy")); 1020 cv_destroy(&sfs->cv); 1021 mtx_destroy(&sfs->mtx); 1022 free(sfs, M_TEMP); 1023 } 1024 1025 if (error == ERESTART) 1026 error = EINTR; 1027 1028 return (error); 1029 } 1030 1031 static int 1032 sendfile(struct thread *td, struct sendfile_args *uap, int compat) 1033 { 1034 struct sf_hdtr hdtr; 1035 struct uio *hdr_uio, *trl_uio; 1036 struct file *fp; 1037 off_t sbytes; 1038 int error; 1039 1040 /* 1041 * File offset must be positive. If it goes beyond EOF 1042 * we send only the header/trailer and no payload data. 1043 */ 1044 if (uap->offset < 0) 1045 return (EINVAL); 1046 1047 sbytes = 0; 1048 hdr_uio = trl_uio = NULL; 1049 1050 if (uap->hdtr != NULL) { 1051 error = copyin(uap->hdtr, &hdtr, sizeof(hdtr)); 1052 if (error != 0) 1053 goto out; 1054 if (hdtr.headers != NULL) { 1055 error = copyinuio(hdtr.headers, hdtr.hdr_cnt, 1056 &hdr_uio); 1057 if (error != 0) 1058 goto out; 1059 #ifdef COMPAT_FREEBSD4 1060 /* 1061 * In FreeBSD < 5.0 the nbytes to send also included 1062 * the header. If compat is specified subtract the 1063 * header size from nbytes. 1064 */ 1065 if (compat) { 1066 if (uap->nbytes > hdr_uio->uio_resid) 1067 uap->nbytes -= hdr_uio->uio_resid; 1068 else 1069 uap->nbytes = 0; 1070 } 1071 #endif 1072 } 1073 if (hdtr.trailers != NULL) { 1074 error = copyinuio(hdtr.trailers, hdtr.trl_cnt, 1075 &trl_uio); 1076 if (error != 0) 1077 goto out; 1078 } 1079 } 1080 1081 AUDIT_ARG_FD(uap->fd); 1082 1083 /* 1084 * sendfile(2) can start at any offset within a file so we require 1085 * CAP_READ+CAP_SEEK = CAP_PREAD. 1086 */ 1087 if ((error = fget_read(td, uap->fd, &cap_pread_rights, &fp)) != 0) 1088 goto out; 1089 1090 error = fo_sendfile(fp, uap->s, hdr_uio, trl_uio, uap->offset, 1091 uap->nbytes, &sbytes, uap->flags, td); 1092 fdrop(fp, td); 1093 1094 if (uap->sbytes != NULL) 1095 copyout(&sbytes, uap->sbytes, sizeof(off_t)); 1096 1097 out: 1098 free(hdr_uio, M_IOV); 1099 free(trl_uio, M_IOV); 1100 return (error); 1101 } 1102 1103 /* 1104 * sendfile(2) 1105 * 1106 * int sendfile(int fd, int s, off_t offset, size_t nbytes, 1107 * struct sf_hdtr *hdtr, off_t *sbytes, int flags) 1108 * 1109 * Send a file specified by 'fd' and starting at 'offset' to a socket 1110 * specified by 's'. Send only 'nbytes' of the file or until EOF if nbytes == 1111 * 0. Optionally add a header and/or trailer to the socket output. If 1112 * specified, write the total number of bytes sent into *sbytes. 1113 */ 1114 int 1115 sys_sendfile(struct thread *td, struct sendfile_args *uap) 1116 { 1117 1118 return (sendfile(td, uap, 0)); 1119 } 1120 1121 #ifdef COMPAT_FREEBSD4 1122 int 1123 freebsd4_sendfile(struct thread *td, struct freebsd4_sendfile_args *uap) 1124 { 1125 struct sendfile_args args; 1126 1127 args.fd = uap->fd; 1128 args.s = uap->s; 1129 args.offset = uap->offset; 1130 args.nbytes = uap->nbytes; 1131 args.hdtr = uap->hdtr; 1132 args.sbytes = uap->sbytes; 1133 args.flags = uap->flags; 1134 1135 return (sendfile(td, &args, 1)); 1136 } 1137 #endif /* COMPAT_FREEBSD4 */ 1138