1 /*- 2 * Copyright (c) 2013-2015 Gleb Smirnoff <glebius@FreeBSD.org> 3 * Copyright (c) 1998, David Greenman. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the University nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include "opt_compat.h" 34 35 #include <sys/param.h> 36 #include <sys/systm.h> 37 #include <sys/capsicum.h> 38 #include <sys/kernel.h> 39 #include <sys/lock.h> 40 #include <sys/mutex.h> 41 #include <sys/sysproto.h> 42 #include <sys/malloc.h> 43 #include <sys/proc.h> 44 #include <sys/mman.h> 45 #include <sys/mount.h> 46 #include <sys/mbuf.h> 47 #include <sys/protosw.h> 48 #include <sys/rwlock.h> 49 #include <sys/sf_buf.h> 50 #include <sys/socket.h> 51 #include <sys/socketvar.h> 52 #include <sys/syscallsubr.h> 53 #include <sys/sysctl.h> 54 #include <sys/vnode.h> 55 56 #include <net/vnet.h> 57 58 #include <security/audit/audit.h> 59 #include <security/mac/mac_framework.h> 60 61 #include <vm/vm.h> 62 #include <vm/vm_object.h> 63 #include <vm/vm_pager.h> 64 65 #define EXT_FLAG_SYNC EXT_FLAG_VENDOR1 66 #define EXT_FLAG_NOCACHE EXT_FLAG_VENDOR2 67 68 /* 69 * Structure describing a single sendfile(2) I/O, which may consist of 70 * several underlying pager I/Os. 71 * 72 * The syscall context allocates the structure and initializes 'nios' 73 * to 1. As sendfile_swapin() runs through pages and starts asynchronous 74 * paging operations, it increments 'nios'. 75 * 76 * Every I/O completion calls sendfile_iodone(), which decrements the 'nios', 77 * and the syscall also calls sendfile_iodone() after allocating all mbufs, 78 * linking them and sending to socket. Whoever reaches zero 'nios' is 79 * responsible to * call pru_ready on the socket, to notify it of readyness 80 * of the data. 81 */ 82 struct sf_io { 83 volatile u_int nios; 84 u_int error; 85 int npages; 86 struct socket *so; 87 struct mbuf *m; 88 vm_page_t pa[]; 89 }; 90 91 /* 92 * Structure used to track requests with SF_SYNC flag. 93 */ 94 struct sendfile_sync { 95 struct mtx mtx; 96 struct cv cv; 97 unsigned count; 98 }; 99 100 counter_u64_t sfstat[sizeof(struct sfstat) / sizeof(uint64_t)]; 101 102 static void 103 sfstat_init(const void *unused) 104 { 105 106 COUNTER_ARRAY_ALLOC(sfstat, sizeof(struct sfstat) / sizeof(uint64_t), 107 M_WAITOK); 108 } 109 SYSINIT(sfstat, SI_SUB_MBUF, SI_ORDER_FIRST, sfstat_init, NULL); 110 111 static int 112 sfstat_sysctl(SYSCTL_HANDLER_ARGS) 113 { 114 struct sfstat s; 115 116 COUNTER_ARRAY_COPY(sfstat, &s, sizeof(s) / sizeof(uint64_t)); 117 if (req->newptr) 118 COUNTER_ARRAY_ZERO(sfstat, sizeof(s) / sizeof(uint64_t)); 119 return (SYSCTL_OUT(req, &s, sizeof(s))); 120 } 121 SYSCTL_PROC(_kern_ipc, OID_AUTO, sfstat, CTLTYPE_OPAQUE | CTLFLAG_RW, 122 NULL, 0, sfstat_sysctl, "I", "sendfile statistics"); 123 124 /* 125 * Detach mapped page and release resources back to the system. Called 126 * by mbuf(9) code when last reference to a page is freed. 127 */ 128 static void 129 sendfile_free_page(vm_page_t pg, bool nocache) 130 { 131 bool freed; 132 133 vm_page_lock(pg); 134 /* 135 * In either case check for the object going away on us. This can 136 * happen since we don't hold a reference to it. If so, we're 137 * responsible for freeing the page. In 'noncache' case try to free 138 * the page, but only if it is cheap to. 139 */ 140 if (vm_page_unwire_noq(pg)) { 141 vm_object_t obj; 142 143 if ((obj = pg->object) == NULL) 144 vm_page_free(pg); 145 else { 146 freed = false; 147 if (nocache && !vm_page_xbusied(pg) && 148 VM_OBJECT_TRYWLOCK(obj)) { 149 /* Only free unmapped pages. */ 150 if (obj->ref_count == 0 || 151 !pmap_page_is_mapped(pg)) 152 /* 153 * The busy test before the object is 154 * locked cannot be relied upon. 155 */ 156 freed = vm_page_try_to_free(pg); 157 VM_OBJECT_WUNLOCK(obj); 158 } 159 if (!freed) { 160 /* 161 * If we were asked to not cache the page, place 162 * it near the head of the inactive queue so 163 * that it is reclaimed sooner. Otherwise, 164 * maintain LRU. 165 */ 166 if (nocache) 167 vm_page_deactivate_noreuse(pg); 168 else if (pg->queue == PQ_ACTIVE) 169 vm_page_reference(pg); 170 else if (pg->queue != PQ_INACTIVE) 171 vm_page_deactivate(pg); 172 else 173 vm_page_requeue(pg); 174 } 175 } 176 } 177 vm_page_unlock(pg); 178 } 179 180 static void 181 sendfile_free_mext(struct mbuf *m) 182 { 183 struct sf_buf *sf; 184 vm_page_t pg; 185 bool nocache; 186 187 KASSERT(m->m_flags & M_EXT && m->m_ext.ext_type == EXT_SFBUF, 188 ("%s: m %p !M_EXT or !EXT_SFBUF", __func__, m)); 189 190 sf = m->m_ext.ext_arg1; 191 pg = sf_buf_page(sf); 192 nocache = m->m_ext.ext_flags & EXT_FLAG_NOCACHE; 193 194 sf_buf_free(sf); 195 sendfile_free_page(pg, nocache); 196 197 if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { 198 struct sendfile_sync *sfs = m->m_ext.ext_arg2; 199 200 mtx_lock(&sfs->mtx); 201 KASSERT(sfs->count > 0, ("Sendfile sync botchup count == 0")); 202 if (--sfs->count == 0) 203 cv_signal(&sfs->cv); 204 mtx_unlock(&sfs->mtx); 205 } 206 } 207 208 /* 209 * Helper function to calculate how much data to put into page i of n. 210 * Only first and last pages are special. 211 */ 212 static inline off_t 213 xfsize(int i, int n, off_t off, off_t len) 214 { 215 216 if (i == 0) 217 return (omin(PAGE_SIZE - (off & PAGE_MASK), len)); 218 219 if (i == n - 1 && ((off + len) & PAGE_MASK) > 0) 220 return ((off + len) & PAGE_MASK); 221 222 return (PAGE_SIZE); 223 } 224 225 /* 226 * Helper function to get offset within object for i page. 227 */ 228 static inline vm_ooffset_t 229 vmoff(int i, off_t off) 230 { 231 232 if (i == 0) 233 return ((vm_ooffset_t)off); 234 235 return (trunc_page(off + i * PAGE_SIZE)); 236 } 237 238 /* 239 * Helper function used when allocation of a page or sf_buf failed. 240 * Pretend as if we don't have enough space, subtract xfsize() of 241 * all pages that failed. 242 */ 243 static inline void 244 fixspace(int old, int new, off_t off, int *space) 245 { 246 247 KASSERT(old > new, ("%s: old %d new %d", __func__, old, new)); 248 249 /* Subtract last one. */ 250 *space -= xfsize(old - 1, old, off, *space); 251 old--; 252 253 if (new == old) 254 /* There was only one page. */ 255 return; 256 257 /* Subtract first one. */ 258 if (new == 0) { 259 *space -= xfsize(0, old, off, *space); 260 new++; 261 } 262 263 /* Rest of pages are full sized. */ 264 *space -= (old - new) * PAGE_SIZE; 265 266 KASSERT(*space >= 0, ("%s: space went backwards", __func__)); 267 } 268 269 /* 270 * I/O completion callback. 271 */ 272 static void 273 sendfile_iodone(void *arg, vm_page_t *pg, int count, int error) 274 { 275 struct sf_io *sfio = arg; 276 struct socket *so = sfio->so; 277 278 for (int i = 0; i < count; i++) 279 if (pg[i] != bogus_page) 280 vm_page_xunbusy(pg[i]); 281 282 if (error) 283 sfio->error = error; 284 285 if (!refcount_release(&sfio->nios)) 286 return; 287 288 CURVNET_SET(so->so_vnet); 289 if (sfio->error) { 290 struct mbuf *m; 291 292 /* 293 * I/O operation failed. The state of data in the socket 294 * is now inconsistent, and all what we can do is to tear 295 * it down. Protocol abort method would tear down protocol 296 * state, free all ready mbufs and detach not ready ones. 297 * We will free the mbufs corresponding to this I/O manually. 298 * 299 * The socket would be marked with EIO and made available 300 * for read, so that application receives EIO on next 301 * syscall and eventually closes the socket. 302 */ 303 so->so_proto->pr_usrreqs->pru_abort(so); 304 so->so_error = EIO; 305 306 m = sfio->m; 307 for (int i = 0; i < sfio->npages; i++) 308 m = m_free(m); 309 } else 310 (void )(so->so_proto->pr_usrreqs->pru_ready)(so, sfio->m, 311 sfio->npages); 312 313 SOCK_LOCK(so); 314 sorele(so); 315 CURVNET_RESTORE(); 316 free(sfio, M_TEMP); 317 } 318 319 /* 320 * Iterate through pages vector and request paging for non-valid pages. 321 */ 322 static int 323 sendfile_swapin(vm_object_t obj, struct sf_io *sfio, off_t off, off_t len, 324 int npages, int rhpages, int flags) 325 { 326 vm_page_t *pa = sfio->pa; 327 int grabbed, nios; 328 329 nios = 0; 330 flags = (flags & SF_NODISKIO) ? VM_ALLOC_NOWAIT : 0; 331 332 /* 333 * First grab all the pages and wire them. Note that we grab 334 * only required pages. Readahead pages are dealt with later. 335 */ 336 VM_OBJECT_WLOCK(obj); 337 338 grabbed = vm_page_grab_pages(obj, OFF_TO_IDX(off), 339 VM_ALLOC_NORMAL | VM_ALLOC_WIRED | flags, pa, npages); 340 if (grabbed < npages) { 341 for (int i = grabbed; i < npages; i++) 342 pa[i] = NULL; 343 npages = grabbed; 344 rhpages = 0; 345 } 346 347 for (int i = 0; i < npages;) { 348 int j, a, count, rv; 349 350 /* Skip valid pages. */ 351 if (vm_page_is_valid(pa[i], vmoff(i, off) & PAGE_MASK, 352 xfsize(i, npages, off, len))) { 353 vm_page_xunbusy(pa[i]); 354 SFSTAT_INC(sf_pages_valid); 355 i++; 356 continue; 357 } 358 359 /* 360 * Next page is invalid. Check if it belongs to pager. It 361 * may not be there, which is a regular situation for shmem 362 * pager. For vnode pager this happens only in case of 363 * a sparse file. 364 * 365 * Important feature of vm_pager_has_page() is the hint 366 * stored in 'a', about how many pages we can pagein after 367 * this page in a single I/O. 368 */ 369 if (!vm_pager_has_page(obj, OFF_TO_IDX(vmoff(i, off)), NULL, 370 &a)) { 371 pmap_zero_page(pa[i]); 372 pa[i]->valid = VM_PAGE_BITS_ALL; 373 MPASS(pa[i]->dirty == 0); 374 vm_page_xunbusy(pa[i]); 375 i++; 376 continue; 377 } 378 379 /* 380 * We want to pagein as many pages as possible, limited only 381 * by the 'a' hint and actual request. 382 */ 383 count = min(a + 1, npages - i); 384 385 /* 386 * We should not pagein into a valid page, thus we first trim 387 * any valid pages off the end of request, and substitute 388 * to bogus_page those, that are in the middle. 389 */ 390 for (j = i + count - 1; j > i; j--) { 391 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 392 xfsize(j, npages, off, len))) { 393 count--; 394 rhpages = 0; 395 } else 396 break; 397 } 398 for (j = i + 1; j < i + count - 1; j++) 399 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 400 xfsize(j, npages, off, len))) { 401 vm_page_xunbusy(pa[j]); 402 SFSTAT_INC(sf_pages_valid); 403 SFSTAT_INC(sf_pages_bogus); 404 pa[j] = bogus_page; 405 } 406 407 refcount_acquire(&sfio->nios); 408 rv = vm_pager_get_pages_async(obj, pa + i, count, NULL, 409 i + count == npages ? &rhpages : NULL, 410 &sendfile_iodone, sfio); 411 KASSERT(rv == VM_PAGER_OK, ("%s: pager fail obj %p page %p", 412 __func__, obj, pa[i])); 413 414 SFSTAT_INC(sf_iocnt); 415 SFSTAT_ADD(sf_pages_read, count); 416 if (i + count == npages) 417 SFSTAT_ADD(sf_rhpages_read, rhpages); 418 419 /* 420 * Restore the valid page pointers. They are already 421 * unbusied, but still wired. 422 */ 423 for (j = i; j < i + count; j++) 424 if (pa[j] == bogus_page) { 425 pa[j] = vm_page_lookup(obj, 426 OFF_TO_IDX(vmoff(j, off))); 427 KASSERT(pa[j], ("%s: page %p[%d] disappeared", 428 __func__, pa, j)); 429 430 } 431 i += count; 432 nios++; 433 } 434 435 VM_OBJECT_WUNLOCK(obj); 436 437 if (nios == 0 && npages != 0) 438 SFSTAT_INC(sf_noiocnt); 439 440 return (nios); 441 } 442 443 static int 444 sendfile_getobj(struct thread *td, struct file *fp, vm_object_t *obj_res, 445 struct vnode **vp_res, struct shmfd **shmfd_res, off_t *obj_size, 446 int *bsize) 447 { 448 struct vattr va; 449 vm_object_t obj; 450 struct vnode *vp; 451 struct shmfd *shmfd; 452 int error; 453 454 vp = *vp_res = NULL; 455 obj = NULL; 456 shmfd = *shmfd_res = NULL; 457 *bsize = 0; 458 459 /* 460 * The file descriptor must be a regular file and have a 461 * backing VM object. 462 */ 463 if (fp->f_type == DTYPE_VNODE) { 464 vp = fp->f_vnode; 465 vn_lock(vp, LK_SHARED | LK_RETRY); 466 if (vp->v_type != VREG) { 467 error = EINVAL; 468 goto out; 469 } 470 *bsize = vp->v_mount->mnt_stat.f_iosize; 471 error = VOP_GETATTR(vp, &va, td->td_ucred); 472 if (error != 0) 473 goto out; 474 *obj_size = va.va_size; 475 obj = vp->v_object; 476 if (obj == NULL) { 477 error = EINVAL; 478 goto out; 479 } 480 } else if (fp->f_type == DTYPE_SHM) { 481 error = 0; 482 shmfd = fp->f_data; 483 obj = shmfd->shm_object; 484 *obj_size = shmfd->shm_size; 485 } else { 486 error = EINVAL; 487 goto out; 488 } 489 490 VM_OBJECT_WLOCK(obj); 491 if ((obj->flags & OBJ_DEAD) != 0) { 492 VM_OBJECT_WUNLOCK(obj); 493 error = EBADF; 494 goto out; 495 } 496 497 /* 498 * Temporarily increase the backing VM object's reference 499 * count so that a forced reclamation of its vnode does not 500 * immediately destroy it. 501 */ 502 vm_object_reference_locked(obj); 503 VM_OBJECT_WUNLOCK(obj); 504 *obj_res = obj; 505 *vp_res = vp; 506 *shmfd_res = shmfd; 507 508 out: 509 if (vp != NULL) 510 VOP_UNLOCK(vp, 0); 511 return (error); 512 } 513 514 static int 515 sendfile_getsock(struct thread *td, int s, struct file **sock_fp, 516 struct socket **so) 517 { 518 cap_rights_t rights; 519 int error; 520 521 *sock_fp = NULL; 522 *so = NULL; 523 524 /* 525 * The socket must be a stream socket and connected. 526 */ 527 error = getsock_cap(td, s, cap_rights_init(&rights, CAP_SEND), 528 sock_fp, NULL, NULL); 529 if (error != 0) 530 return (error); 531 *so = (*sock_fp)->f_data; 532 if ((*so)->so_type != SOCK_STREAM) 533 return (EINVAL); 534 return (0); 535 } 536 537 int 538 vn_sendfile(struct file *fp, int sockfd, struct uio *hdr_uio, 539 struct uio *trl_uio, off_t offset, size_t nbytes, off_t *sent, int flags, 540 struct thread *td) 541 { 542 struct file *sock_fp; 543 struct vnode *vp; 544 struct vm_object *obj; 545 struct socket *so; 546 struct mbuf *m, *mh, *mhtail; 547 struct sf_buf *sf; 548 struct shmfd *shmfd; 549 struct sendfile_sync *sfs; 550 struct vattr va; 551 off_t off, sbytes, rem, obj_size; 552 int error, softerr, bsize, hdrlen; 553 554 obj = NULL; 555 so = NULL; 556 m = mh = NULL; 557 sfs = NULL; 558 hdrlen = sbytes = 0; 559 softerr = 0; 560 561 error = sendfile_getobj(td, fp, &obj, &vp, &shmfd, &obj_size, &bsize); 562 if (error != 0) 563 return (error); 564 565 error = sendfile_getsock(td, sockfd, &sock_fp, &so); 566 if (error != 0) 567 goto out; 568 569 #ifdef MAC 570 error = mac_socket_check_send(td->td_ucred, so); 571 if (error != 0) 572 goto out; 573 #endif 574 575 SFSTAT_INC(sf_syscalls); 576 SFSTAT_ADD(sf_rhpages_requested, SF_READAHEAD(flags)); 577 578 if (flags & SF_SYNC) { 579 sfs = malloc(sizeof *sfs, M_TEMP, M_WAITOK | M_ZERO); 580 mtx_init(&sfs->mtx, "sendfile", NULL, MTX_DEF); 581 cv_init(&sfs->cv, "sendfile"); 582 } 583 584 rem = nbytes ? omin(nbytes, obj_size - offset) : obj_size - offset; 585 586 /* 587 * Protect against multiple writers to the socket. 588 * 589 * XXXRW: Historically this has assumed non-interruptibility, so now 590 * we implement that, but possibly shouldn't. 591 */ 592 (void)sblock(&so->so_snd, SBL_WAIT | SBL_NOINTR); 593 594 /* 595 * Loop through the pages of the file, starting with the requested 596 * offset. Get a file page (do I/O if necessary), map the file page 597 * into an sf_buf, attach an mbuf header to the sf_buf, and queue 598 * it on the socket. 599 * This is done in two loops. The inner loop turns as many pages 600 * as it can, up to available socket buffer space, without blocking 601 * into mbufs to have it bulk delivered into the socket send buffer. 602 * The outer loop checks the state and available space of the socket 603 * and takes care of the overall progress. 604 */ 605 for (off = offset; rem > 0; ) { 606 struct sf_io *sfio; 607 vm_page_t *pa; 608 struct mbuf *mtail; 609 int nios, space, npages, rhpages; 610 611 mtail = NULL; 612 /* 613 * Check the socket state for ongoing connection, 614 * no errors and space in socket buffer. 615 * If space is low allow for the remainder of the 616 * file to be processed if it fits the socket buffer. 617 * Otherwise block in waiting for sufficient space 618 * to proceed, or if the socket is nonblocking, return 619 * to userland with EAGAIN while reporting how far 620 * we've come. 621 * We wait until the socket buffer has significant free 622 * space to do bulk sends. This makes good use of file 623 * system read ahead and allows packet segmentation 624 * offloading hardware to take over lots of work. If 625 * we were not careful here we would send off only one 626 * sfbuf at a time. 627 */ 628 SOCKBUF_LOCK(&so->so_snd); 629 if (so->so_snd.sb_lowat < so->so_snd.sb_hiwat / 2) 630 so->so_snd.sb_lowat = so->so_snd.sb_hiwat / 2; 631 retry_space: 632 if (so->so_snd.sb_state & SBS_CANTSENDMORE) { 633 error = EPIPE; 634 SOCKBUF_UNLOCK(&so->so_snd); 635 goto done; 636 } else if (so->so_error) { 637 error = so->so_error; 638 so->so_error = 0; 639 SOCKBUF_UNLOCK(&so->so_snd); 640 goto done; 641 } 642 if ((so->so_state & SS_ISCONNECTED) == 0) { 643 SOCKBUF_UNLOCK(&so->so_snd); 644 error = ENOTCONN; 645 goto done; 646 } 647 648 space = sbspace(&so->so_snd); 649 if (space < rem && 650 (space <= 0 || 651 space < so->so_snd.sb_lowat)) { 652 if (so->so_state & SS_NBIO) { 653 SOCKBUF_UNLOCK(&so->so_snd); 654 error = EAGAIN; 655 goto done; 656 } 657 /* 658 * sbwait drops the lock while sleeping. 659 * When we loop back to retry_space the 660 * state may have changed and we retest 661 * for it. 662 */ 663 error = sbwait(&so->so_snd); 664 /* 665 * An error from sbwait usually indicates that we've 666 * been interrupted by a signal. If we've sent anything 667 * then return bytes sent, otherwise return the error. 668 */ 669 if (error != 0) { 670 SOCKBUF_UNLOCK(&so->so_snd); 671 goto done; 672 } 673 goto retry_space; 674 } 675 SOCKBUF_UNLOCK(&so->so_snd); 676 677 /* 678 * At the beginning of the first loop check if any headers 679 * are specified and copy them into mbufs. Reduce space in 680 * the socket buffer by the size of the header mbuf chain. 681 * Clear hdr_uio here and hdrlen at the end of the first loop. 682 */ 683 if (hdr_uio != NULL && hdr_uio->uio_resid > 0) { 684 hdr_uio->uio_td = td; 685 hdr_uio->uio_rw = UIO_WRITE; 686 mh = m_uiotombuf(hdr_uio, M_WAITOK, space, 0, 0); 687 hdrlen = m_length(mh, &mhtail); 688 space -= hdrlen; 689 /* 690 * If header consumed all the socket buffer space, 691 * don't waste CPU cycles and jump to the end. 692 */ 693 if (space == 0) { 694 sfio = NULL; 695 nios = 0; 696 goto prepend_header; 697 } 698 hdr_uio = NULL; 699 } 700 701 if (vp != NULL) { 702 error = vn_lock(vp, LK_SHARED); 703 if (error != 0) 704 goto done; 705 error = VOP_GETATTR(vp, &va, td->td_ucred); 706 if (error != 0 || off >= va.va_size) { 707 VOP_UNLOCK(vp, 0); 708 goto done; 709 } 710 if (va.va_size != obj_size) { 711 obj_size = va.va_size; 712 rem = nbytes ? 713 omin(nbytes + offset, obj_size) : obj_size; 714 rem -= off; 715 } 716 } 717 718 if (space > rem) 719 space = rem; 720 721 npages = howmany(space + (off & PAGE_MASK), PAGE_SIZE); 722 723 /* 724 * Calculate maximum allowed number of pages for readahead 725 * at this iteration. If SF_USER_READAHEAD was set, we don't 726 * do any heuristics and use exactly the value supplied by 727 * application. Otherwise, we allow readahead up to "rem". 728 * If application wants more, let it be, but there is no 729 * reason to go above MAXPHYS. Also check against "obj_size", 730 * since vm_pager_has_page() can hint beyond EOF. 731 */ 732 if (flags & SF_USER_READAHEAD) { 733 rhpages = SF_READAHEAD(flags); 734 } else { 735 rhpages = howmany(rem + (off & PAGE_MASK), PAGE_SIZE) - 736 npages; 737 rhpages += SF_READAHEAD(flags); 738 } 739 rhpages = min(howmany(MAXPHYS, PAGE_SIZE), rhpages); 740 rhpages = min(howmany(obj_size - trunc_page(off), PAGE_SIZE) - 741 npages, rhpages); 742 743 sfio = malloc(sizeof(struct sf_io) + 744 npages * sizeof(vm_page_t), M_TEMP, M_WAITOK); 745 refcount_init(&sfio->nios, 1); 746 sfio->so = so; 747 sfio->error = 0; 748 749 nios = sendfile_swapin(obj, sfio, off, space, npages, rhpages, 750 flags); 751 752 /* 753 * Loop and construct maximum sized mbuf chain to be bulk 754 * dumped into socket buffer. 755 */ 756 pa = sfio->pa; 757 for (int i = 0; i < npages; i++) { 758 struct mbuf *m0; 759 760 /* 761 * If a page wasn't grabbed successfully, then 762 * trim the array. Can happen only with SF_NODISKIO. 763 */ 764 if (pa[i] == NULL) { 765 SFSTAT_INC(sf_busy); 766 fixspace(npages, i, off, &space); 767 npages = i; 768 softerr = EBUSY; 769 break; 770 } 771 772 /* 773 * Get a sendfile buf. When allocating the 774 * first buffer for mbuf chain, we usually 775 * wait as long as necessary, but this wait 776 * can be interrupted. For consequent 777 * buffers, do not sleep, since several 778 * threads might exhaust the buffers and then 779 * deadlock. 780 */ 781 sf = sf_buf_alloc(pa[i], 782 m != NULL ? SFB_NOWAIT : SFB_CATCH); 783 if (sf == NULL) { 784 SFSTAT_INC(sf_allocfail); 785 for (int j = i; j < npages; j++) { 786 vm_page_lock(pa[j]); 787 vm_page_unwire(pa[j], PQ_INACTIVE); 788 vm_page_unlock(pa[j]); 789 } 790 if (m == NULL) 791 softerr = ENOBUFS; 792 fixspace(npages, i, off, &space); 793 npages = i; 794 break; 795 } 796 797 m0 = m_get(M_WAITOK, MT_DATA); 798 m0->m_ext.ext_buf = (char *)sf_buf_kva(sf); 799 m0->m_ext.ext_size = PAGE_SIZE; 800 m0->m_ext.ext_arg1 = sf; 801 m0->m_ext.ext_type = EXT_SFBUF; 802 m0->m_ext.ext_flags = EXT_FLAG_EMBREF; 803 m0->m_ext.ext_free = sendfile_free_mext; 804 /* 805 * SF_NOCACHE sets the page as being freed upon send. 806 * However, we ignore it for the last page in 'space', 807 * if the page is truncated, and we got more data to 808 * send (rem > space), or if we have readahead 809 * configured (rhpages > 0). 810 */ 811 if ((flags & SF_NOCACHE) && 812 (i != npages - 1 || 813 !((off + space) & PAGE_MASK) || 814 !(rem > space || rhpages > 0))) 815 m0->m_ext.ext_flags |= EXT_FLAG_NOCACHE; 816 if (sfs != NULL) { 817 m0->m_ext.ext_flags |= EXT_FLAG_SYNC; 818 m0->m_ext.ext_arg2 = sfs; 819 mtx_lock(&sfs->mtx); 820 sfs->count++; 821 mtx_unlock(&sfs->mtx); 822 } 823 m0->m_ext.ext_count = 1; 824 m0->m_flags |= (M_EXT | M_RDONLY); 825 if (nios) 826 m0->m_flags |= M_NOTREADY; 827 m0->m_data = (char *)sf_buf_kva(sf) + 828 (vmoff(i, off) & PAGE_MASK); 829 m0->m_len = xfsize(i, npages, off, space); 830 831 if (i == 0) 832 sfio->m = m0; 833 834 /* Append to mbuf chain. */ 835 if (mtail != NULL) 836 mtail->m_next = m0; 837 else 838 m = m0; 839 mtail = m0; 840 } 841 842 if (vp != NULL) 843 VOP_UNLOCK(vp, 0); 844 845 /* Keep track of bytes processed. */ 846 off += space; 847 rem -= space; 848 849 /* Prepend header, if any. */ 850 if (hdrlen) { 851 prepend_header: 852 mhtail->m_next = m; 853 m = mh; 854 mh = NULL; 855 } 856 857 if (m == NULL) { 858 KASSERT(softerr, ("%s: m NULL, no error", __func__)); 859 error = softerr; 860 free(sfio, M_TEMP); 861 goto done; 862 } 863 864 /* Add the buffer chain to the socket buffer. */ 865 KASSERT(m_length(m, NULL) == space + hdrlen, 866 ("%s: mlen %u space %d hdrlen %d", 867 __func__, m_length(m, NULL), space, hdrlen)); 868 869 CURVNET_SET(so->so_vnet); 870 if (nios == 0) { 871 /* 872 * If sendfile_swapin() didn't initiate any I/Os, 873 * which happens if all data is cached in VM, then 874 * we can send data right now without the 875 * PRUS_NOTREADY flag. 876 */ 877 free(sfio, M_TEMP); 878 error = (*so->so_proto->pr_usrreqs->pru_send) 879 (so, 0, m, NULL, NULL, td); 880 } else { 881 sfio->npages = npages; 882 soref(so); 883 error = (*so->so_proto->pr_usrreqs->pru_send) 884 (so, PRUS_NOTREADY, m, NULL, NULL, td); 885 sendfile_iodone(sfio, NULL, 0, 0); 886 } 887 CURVNET_RESTORE(); 888 889 m = NULL; /* pru_send always consumes */ 890 if (error) 891 goto done; 892 sbytes += space + hdrlen; 893 if (hdrlen) 894 hdrlen = 0; 895 if (softerr) { 896 error = softerr; 897 goto done; 898 } 899 } 900 901 /* 902 * Send trailers. Wimp out and use writev(2). 903 */ 904 if (trl_uio != NULL) { 905 sbunlock(&so->so_snd); 906 error = kern_writev(td, sockfd, trl_uio); 907 if (error == 0) 908 sbytes += td->td_retval[0]; 909 goto out; 910 } 911 912 done: 913 sbunlock(&so->so_snd); 914 out: 915 /* 916 * If there was no error we have to clear td->td_retval[0] 917 * because it may have been set by writev. 918 */ 919 if (error == 0) { 920 td->td_retval[0] = 0; 921 } 922 if (sent != NULL) { 923 (*sent) = sbytes; 924 } 925 if (obj != NULL) 926 vm_object_deallocate(obj); 927 if (so) 928 fdrop(sock_fp, td); 929 if (m) 930 m_freem(m); 931 if (mh) 932 m_freem(mh); 933 934 if (sfs != NULL) { 935 mtx_lock(&sfs->mtx); 936 if (sfs->count != 0) 937 cv_wait(&sfs->cv, &sfs->mtx); 938 KASSERT(sfs->count == 0, ("sendfile sync still busy")); 939 cv_destroy(&sfs->cv); 940 mtx_destroy(&sfs->mtx); 941 free(sfs, M_TEMP); 942 } 943 944 if (error == ERESTART) 945 error = EINTR; 946 947 return (error); 948 } 949 950 static int 951 sendfile(struct thread *td, struct sendfile_args *uap, int compat) 952 { 953 struct sf_hdtr hdtr; 954 struct uio *hdr_uio, *trl_uio; 955 struct file *fp; 956 cap_rights_t rights; 957 off_t sbytes; 958 int error; 959 960 /* 961 * File offset must be positive. If it goes beyond EOF 962 * we send only the header/trailer and no payload data. 963 */ 964 if (uap->offset < 0) 965 return (EINVAL); 966 967 sbytes = 0; 968 hdr_uio = trl_uio = NULL; 969 970 if (uap->hdtr != NULL) { 971 error = copyin(uap->hdtr, &hdtr, sizeof(hdtr)); 972 if (error != 0) 973 goto out; 974 if (hdtr.headers != NULL) { 975 error = copyinuio(hdtr.headers, hdtr.hdr_cnt, 976 &hdr_uio); 977 if (error != 0) 978 goto out; 979 #ifdef COMPAT_FREEBSD4 980 /* 981 * In FreeBSD < 5.0 the nbytes to send also included 982 * the header. If compat is specified subtract the 983 * header size from nbytes. 984 */ 985 if (compat) { 986 if (uap->nbytes > hdr_uio->uio_resid) 987 uap->nbytes -= hdr_uio->uio_resid; 988 else 989 uap->nbytes = 0; 990 } 991 #endif 992 } 993 if (hdtr.trailers != NULL) { 994 error = copyinuio(hdtr.trailers, hdtr.trl_cnt, 995 &trl_uio); 996 if (error != 0) 997 goto out; 998 } 999 } 1000 1001 AUDIT_ARG_FD(uap->fd); 1002 1003 /* 1004 * sendfile(2) can start at any offset within a file so we require 1005 * CAP_READ+CAP_SEEK = CAP_PREAD. 1006 */ 1007 if ((error = fget_read(td, uap->fd, 1008 cap_rights_init(&rights, CAP_PREAD), &fp)) != 0) { 1009 goto out; 1010 } 1011 1012 error = fo_sendfile(fp, uap->s, hdr_uio, trl_uio, uap->offset, 1013 uap->nbytes, &sbytes, uap->flags, td); 1014 fdrop(fp, td); 1015 1016 if (uap->sbytes != NULL) 1017 copyout(&sbytes, uap->sbytes, sizeof(off_t)); 1018 1019 out: 1020 free(hdr_uio, M_IOV); 1021 free(trl_uio, M_IOV); 1022 return (error); 1023 } 1024 1025 /* 1026 * sendfile(2) 1027 * 1028 * int sendfile(int fd, int s, off_t offset, size_t nbytes, 1029 * struct sf_hdtr *hdtr, off_t *sbytes, int flags) 1030 * 1031 * Send a file specified by 'fd' and starting at 'offset' to a socket 1032 * specified by 's'. Send only 'nbytes' of the file or until EOF if nbytes == 1033 * 0. Optionally add a header and/or trailer to the socket output. If 1034 * specified, write the total number of bytes sent into *sbytes. 1035 */ 1036 int 1037 sys_sendfile(struct thread *td, struct sendfile_args *uap) 1038 { 1039 1040 return (sendfile(td, uap, 0)); 1041 } 1042 1043 #ifdef COMPAT_FREEBSD4 1044 int 1045 freebsd4_sendfile(struct thread *td, struct freebsd4_sendfile_args *uap) 1046 { 1047 struct sendfile_args args; 1048 1049 args.fd = uap->fd; 1050 args.s = uap->s; 1051 args.offset = uap->offset; 1052 args.nbytes = uap->nbytes; 1053 args.hdtr = uap->hdtr; 1054 args.sbytes = uap->sbytes; 1055 args.flags = uap->flags; 1056 1057 return (sendfile(td, &args, 1)); 1058 } 1059 #endif /* COMPAT_FREEBSD4 */ 1060