1 /*- 2 * Copyright (c) 2013-2015 Gleb Smirnoff <glebius@FreeBSD.org> 3 * Copyright (c) 1998, David Greenman. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the University nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include "opt_kern_tls.h" 34 35 #include <sys/param.h> 36 #include <sys/systm.h> 37 #include <sys/capsicum.h> 38 #include <sys/kernel.h> 39 #include <netinet/in.h> 40 #include <sys/lock.h> 41 #include <sys/ktls.h> 42 #include <sys/mutex.h> 43 #include <sys/sysproto.h> 44 #include <sys/malloc.h> 45 #include <sys/proc.h> 46 #include <sys/mman.h> 47 #include <sys/mount.h> 48 #include <sys/mbuf.h> 49 #include <sys/protosw.h> 50 #include <sys/rwlock.h> 51 #include <sys/sf_buf.h> 52 #include <sys/socket.h> 53 #include <sys/socketvar.h> 54 #include <sys/syscallsubr.h> 55 #include <sys/sysctl.h> 56 #include <sys/vnode.h> 57 58 #include <net/vnet.h> 59 #include <netinet/tcp.h> 60 61 #include <security/audit/audit.h> 62 #include <security/mac/mac_framework.h> 63 64 #include <vm/vm.h> 65 #include <vm/vm_object.h> 66 #include <vm/vm_pager.h> 67 68 #define EXT_FLAG_SYNC EXT_FLAG_VENDOR1 69 #define EXT_FLAG_NOCACHE EXT_FLAG_VENDOR2 70 #define EXT_FLAG_CACHE_LAST EXT_FLAG_VENDOR3 71 72 /* 73 * Structure describing a single sendfile(2) I/O, which may consist of 74 * several underlying pager I/Os. 75 * 76 * The syscall context allocates the structure and initializes 'nios' 77 * to 1. As sendfile_swapin() runs through pages and starts asynchronous 78 * paging operations, it increments 'nios'. 79 * 80 * Every I/O completion calls sendfile_iodone(), which decrements the 'nios', 81 * and the syscall also calls sendfile_iodone() after allocating all mbufs, 82 * linking them and sending to socket. Whoever reaches zero 'nios' is 83 * responsible to * call pru_ready on the socket, to notify it of readyness 84 * of the data. 85 */ 86 struct sf_io { 87 volatile u_int nios; 88 u_int error; 89 int npages; 90 struct socket *so; 91 struct mbuf *m; 92 vm_object_t obj; 93 #ifdef KERN_TLS 94 struct ktls_session *tls; 95 #endif 96 vm_page_t pa[]; 97 }; 98 99 /* 100 * Structure used to track requests with SF_SYNC flag. 101 */ 102 struct sendfile_sync { 103 struct mtx mtx; 104 struct cv cv; 105 unsigned count; 106 }; 107 108 counter_u64_t sfstat[sizeof(struct sfstat) / sizeof(uint64_t)]; 109 110 static void 111 sfstat_init(const void *unused) 112 { 113 114 COUNTER_ARRAY_ALLOC(sfstat, sizeof(struct sfstat) / sizeof(uint64_t), 115 M_WAITOK); 116 } 117 SYSINIT(sfstat, SI_SUB_MBUF, SI_ORDER_FIRST, sfstat_init, NULL); 118 119 static int 120 sfstat_sysctl(SYSCTL_HANDLER_ARGS) 121 { 122 struct sfstat s; 123 124 COUNTER_ARRAY_COPY(sfstat, &s, sizeof(s) / sizeof(uint64_t)); 125 if (req->newptr) 126 COUNTER_ARRAY_ZERO(sfstat, sizeof(s) / sizeof(uint64_t)); 127 return (SYSCTL_OUT(req, &s, sizeof(s))); 128 } 129 SYSCTL_PROC(_kern_ipc, OID_AUTO, sfstat, 130 CTLTYPE_OPAQUE | CTLFLAG_RW | CTLFLAG_NEEDGIANT, NULL, 0, 131 sfstat_sysctl, "I", 132 "sendfile statistics"); 133 134 static void 135 sendfile_free_mext(struct mbuf *m) 136 { 137 struct sf_buf *sf; 138 vm_page_t pg; 139 int flags; 140 141 KASSERT(m->m_flags & M_EXT && m->m_ext.ext_type == EXT_SFBUF, 142 ("%s: m %p !M_EXT or !EXT_SFBUF", __func__, m)); 143 144 sf = m->m_ext.ext_arg1; 145 pg = sf_buf_page(sf); 146 flags = (m->m_ext.ext_flags & EXT_FLAG_NOCACHE) != 0 ? VPR_TRYFREE : 0; 147 148 sf_buf_free(sf); 149 vm_page_release(pg, flags); 150 151 if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { 152 struct sendfile_sync *sfs = m->m_ext.ext_arg2; 153 154 mtx_lock(&sfs->mtx); 155 KASSERT(sfs->count > 0, ("Sendfile sync botchup count == 0")); 156 if (--sfs->count == 0) 157 cv_signal(&sfs->cv); 158 mtx_unlock(&sfs->mtx); 159 } 160 } 161 162 static void 163 sendfile_free_mext_pg(struct mbuf *m) 164 { 165 struct mbuf_ext_pgs *ext_pgs; 166 vm_page_t pg; 167 int flags, i; 168 bool cache_last; 169 170 KASSERT(m->m_flags & M_EXT && m->m_ext.ext_type == EXT_PGS, 171 ("%s: m %p !M_EXT or !EXT_PGS", __func__, m)); 172 173 cache_last = m->m_ext.ext_flags & EXT_FLAG_CACHE_LAST; 174 ext_pgs = m->m_ext.ext_pgs; 175 flags = (m->m_ext.ext_flags & EXT_FLAG_NOCACHE) != 0 ? VPR_TRYFREE : 0; 176 177 for (i = 0; i < ext_pgs->npgs; i++) { 178 if (cache_last && i == ext_pgs->npgs - 1) 179 flags = 0; 180 pg = PHYS_TO_VM_PAGE(ext_pgs->pa[i]); 181 vm_page_release(pg, flags); 182 } 183 184 if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { 185 struct sendfile_sync *sfs = m->m_ext.ext_arg2; 186 187 mtx_lock(&sfs->mtx); 188 KASSERT(sfs->count > 0, ("Sendfile sync botchup count == 0")); 189 if (--sfs->count == 0) 190 cv_signal(&sfs->cv); 191 mtx_unlock(&sfs->mtx); 192 } 193 } 194 195 /* 196 * Helper function to calculate how much data to put into page i of n. 197 * Only first and last pages are special. 198 */ 199 static inline off_t 200 xfsize(int i, int n, off_t off, off_t len) 201 { 202 203 if (i == 0) 204 return (omin(PAGE_SIZE - (off & PAGE_MASK), len)); 205 206 if (i == n - 1 && ((off + len) & PAGE_MASK) > 0) 207 return ((off + len) & PAGE_MASK); 208 209 return (PAGE_SIZE); 210 } 211 212 /* 213 * Helper function to get offset within object for i page. 214 */ 215 static inline vm_ooffset_t 216 vmoff(int i, off_t off) 217 { 218 219 if (i == 0) 220 return ((vm_ooffset_t)off); 221 222 return (trunc_page(off + i * PAGE_SIZE)); 223 } 224 225 /* 226 * Helper function used when allocation of a page or sf_buf failed. 227 * Pretend as if we don't have enough space, subtract xfsize() of 228 * all pages that failed. 229 */ 230 static inline void 231 fixspace(int old, int new, off_t off, int *space) 232 { 233 234 KASSERT(old > new, ("%s: old %d new %d", __func__, old, new)); 235 236 /* Subtract last one. */ 237 *space -= xfsize(old - 1, old, off, *space); 238 old--; 239 240 if (new == old) 241 /* There was only one page. */ 242 return; 243 244 /* Subtract first one. */ 245 if (new == 0) { 246 *space -= xfsize(0, old, off, *space); 247 new++; 248 } 249 250 /* Rest of pages are full sized. */ 251 *space -= (old - new) * PAGE_SIZE; 252 253 KASSERT(*space >= 0, ("%s: space went backwards", __func__)); 254 } 255 256 /* 257 * I/O completion callback. 258 */ 259 static void 260 sendfile_iodone(void *arg, vm_page_t *pg, int count, int error) 261 { 262 struct sf_io *sfio = arg; 263 struct socket *so; 264 265 for (int i = 0; i < count; i++) 266 if (pg[i] != bogus_page) 267 vm_page_xunbusy_unchecked(pg[i]); 268 269 if (error) 270 sfio->error = error; 271 272 if (!refcount_release(&sfio->nios)) 273 return; 274 275 vm_object_pip_wakeup(sfio->obj); 276 277 if (sfio->m == NULL) { 278 /* 279 * Either I/O operation failed, or we failed to allocate 280 * buffers, or we bailed out on first busy page, or we 281 * succeeded filling the request without any I/Os. Anyway, 282 * pru_send hadn't been executed - nothing had been sent 283 * to the socket yet. 284 */ 285 MPASS((curthread->td_pflags & TDP_KTHREAD) == 0); 286 free(sfio, M_TEMP); 287 return; 288 } 289 290 #if defined(KERN_TLS) && defined(INVARIANTS) 291 if ((sfio->m->m_flags & M_EXT) != 0 && 292 sfio->m->m_ext.ext_type == EXT_PGS) 293 KASSERT(sfio->tls == sfio->m->m_ext.ext_pgs->tls, 294 ("TLS session mismatch")); 295 else 296 KASSERT(sfio->tls == NULL, 297 ("non-ext_pgs mbuf with TLS session")); 298 #endif 299 so = sfio->so; 300 CURVNET_SET(so->so_vnet); 301 if (__predict_false(sfio->error)) { 302 /* 303 * I/O operation failed. The state of data in the socket 304 * is now inconsistent, and all what we can do is to tear 305 * it down. Protocol abort method would tear down protocol 306 * state, free all ready mbufs and detach not ready ones. 307 * We will free the mbufs corresponding to this I/O manually. 308 * 309 * The socket would be marked with EIO and made available 310 * for read, so that application receives EIO on next 311 * syscall and eventually closes the socket. 312 */ 313 so->so_proto->pr_usrreqs->pru_abort(so); 314 so->so_error = EIO; 315 316 mb_free_notready(sfio->m, sfio->npages); 317 #ifdef KERN_TLS 318 } else if (sfio->tls != NULL && sfio->tls->mode == TCP_TLS_MODE_SW) { 319 /* 320 * I/O operation is complete, but we still need to 321 * encrypt. We cannot do this in the interrupt thread 322 * of the disk controller, so forward the mbufs to a 323 * different thread. 324 * 325 * Donate the socket reference from sfio to rather 326 * than explicitly invoking soref(). 327 */ 328 ktls_enqueue(sfio->m, so, sfio->npages); 329 goto out_with_ref; 330 #endif 331 } else 332 (void)(so->so_proto->pr_usrreqs->pru_ready)(so, sfio->m, 333 sfio->npages); 334 335 SOCK_LOCK(so); 336 sorele(so); 337 #ifdef KERN_TLS 338 out_with_ref: 339 #endif 340 CURVNET_RESTORE(); 341 free(sfio, M_TEMP); 342 } 343 344 /* 345 * Iterate through pages vector and request paging for non-valid pages. 346 */ 347 static int 348 sendfile_swapin(vm_object_t obj, struct sf_io *sfio, int *nios, off_t off, 349 off_t len, int npages, int rhpages, int flags) 350 { 351 vm_page_t *pa = sfio->pa; 352 int grabbed; 353 354 *nios = 0; 355 flags = (flags & SF_NODISKIO) ? VM_ALLOC_NOWAIT : 0; 356 357 /* 358 * First grab all the pages and wire them. Note that we grab 359 * only required pages. Readahead pages are dealt with later. 360 */ 361 grabbed = vm_page_grab_pages_unlocked(obj, OFF_TO_IDX(off), 362 VM_ALLOC_NORMAL | VM_ALLOC_WIRED | flags, pa, npages); 363 if (grabbed < npages) { 364 for (int i = grabbed; i < npages; i++) 365 pa[i] = NULL; 366 npages = grabbed; 367 rhpages = 0; 368 } 369 370 for (int i = 0; i < npages;) { 371 int j, a, count, rv; 372 373 /* Skip valid pages. */ 374 if (vm_page_is_valid(pa[i], vmoff(i, off) & PAGE_MASK, 375 xfsize(i, npages, off, len))) { 376 vm_page_xunbusy(pa[i]); 377 SFSTAT_INC(sf_pages_valid); 378 i++; 379 continue; 380 } 381 382 /* 383 * Next page is invalid. Check if it belongs to pager. It 384 * may not be there, which is a regular situation for shmem 385 * pager. For vnode pager this happens only in case of 386 * a sparse file. 387 * 388 * Important feature of vm_pager_has_page() is the hint 389 * stored in 'a', about how many pages we can pagein after 390 * this page in a single I/O. 391 */ 392 VM_OBJECT_RLOCK(obj); 393 if (!vm_pager_has_page(obj, OFF_TO_IDX(vmoff(i, off)), NULL, 394 &a)) { 395 VM_OBJECT_RUNLOCK(obj); 396 pmap_zero_page(pa[i]); 397 vm_page_valid(pa[i]); 398 MPASS(pa[i]->dirty == 0); 399 vm_page_xunbusy(pa[i]); 400 i++; 401 continue; 402 } 403 VM_OBJECT_RUNLOCK(obj); 404 405 /* 406 * We want to pagein as many pages as possible, limited only 407 * by the 'a' hint and actual request. 408 */ 409 count = min(a + 1, npages - i); 410 411 /* 412 * We should not pagein into a valid page, thus we first trim 413 * any valid pages off the end of request, and substitute 414 * to bogus_page those, that are in the middle. 415 */ 416 for (j = i + count - 1; j > i; j--) { 417 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 418 xfsize(j, npages, off, len))) { 419 count--; 420 rhpages = 0; 421 } else 422 break; 423 } 424 for (j = i + 1; j < i + count - 1; j++) 425 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 426 xfsize(j, npages, off, len))) { 427 vm_page_xunbusy(pa[j]); 428 SFSTAT_INC(sf_pages_valid); 429 SFSTAT_INC(sf_pages_bogus); 430 pa[j] = bogus_page; 431 } 432 433 refcount_acquire(&sfio->nios); 434 rv = vm_pager_get_pages_async(obj, pa + i, count, NULL, 435 i + count == npages ? &rhpages : NULL, 436 &sendfile_iodone, sfio); 437 if (__predict_false(rv != VM_PAGER_OK)) { 438 /* 439 * Perform full pages recovery before returning EIO. 440 * Pages from 0 to npages are wired. 441 * Pages from i to npages are also busied. 442 * Pages from (i + 1) to (i + count - 1) may be 443 * substituted to bogus page, and not busied. 444 */ 445 for (j = 0; j < npages; j++) { 446 if (j > i && j < i + count - 1 && 447 pa[j] == bogus_page) 448 pa[j] = vm_page_relookup(obj, 449 OFF_TO_IDX(vmoff(j, off))); 450 else if (j >= i) 451 vm_page_xunbusy(pa[j]); 452 KASSERT(pa[j] != NULL && pa[j] != bogus_page, 453 ("%s: page %p[%d] I/O recovery failure", 454 __func__, pa, j)); 455 vm_page_unwire(pa[j], PQ_INACTIVE); 456 } 457 refcount_release(&sfio->nios); 458 return (EIO); 459 } 460 461 SFSTAT_INC(sf_iocnt); 462 SFSTAT_ADD(sf_pages_read, count); 463 if (i + count == npages) 464 SFSTAT_ADD(sf_rhpages_read, rhpages); 465 466 /* 467 * Restore the valid page pointers. They are already 468 * unbusied, but still wired. 469 */ 470 for (j = i + 1; j < i + count - 1; j++) 471 if (pa[j] == bogus_page) { 472 pa[j] = vm_page_relookup(obj, 473 OFF_TO_IDX(vmoff(j, off))); 474 KASSERT(pa[j], ("%s: page %p[%d] disappeared", 475 __func__, pa, j)); 476 477 } 478 i += count; 479 (*nios)++; 480 } 481 482 if (*nios == 0 && npages != 0) 483 SFSTAT_INC(sf_noiocnt); 484 485 return (0); 486 } 487 488 static int 489 sendfile_getobj(struct thread *td, struct file *fp, vm_object_t *obj_res, 490 struct vnode **vp_res, struct shmfd **shmfd_res, off_t *obj_size, 491 int *bsize) 492 { 493 struct vattr va; 494 vm_object_t obj; 495 struct vnode *vp; 496 struct shmfd *shmfd; 497 int error; 498 499 vp = *vp_res = NULL; 500 obj = NULL; 501 shmfd = *shmfd_res = NULL; 502 *bsize = 0; 503 504 /* 505 * The file descriptor must be a regular file and have a 506 * backing VM object. 507 */ 508 if (fp->f_type == DTYPE_VNODE) { 509 vp = fp->f_vnode; 510 vn_lock(vp, LK_SHARED | LK_RETRY); 511 if (vp->v_type != VREG) { 512 error = EINVAL; 513 goto out; 514 } 515 *bsize = vp->v_mount->mnt_stat.f_iosize; 516 error = VOP_GETATTR(vp, &va, td->td_ucred); 517 if (error != 0) 518 goto out; 519 *obj_size = va.va_size; 520 obj = vp->v_object; 521 if (obj == NULL) { 522 error = EINVAL; 523 goto out; 524 } 525 } else if (fp->f_type == DTYPE_SHM) { 526 error = 0; 527 shmfd = fp->f_data; 528 obj = shmfd->shm_object; 529 *obj_size = shmfd->shm_size; 530 } else { 531 error = EINVAL; 532 goto out; 533 } 534 535 VM_OBJECT_WLOCK(obj); 536 if ((obj->flags & OBJ_DEAD) != 0) { 537 VM_OBJECT_WUNLOCK(obj); 538 error = EBADF; 539 goto out; 540 } 541 542 /* 543 * Temporarily increase the backing VM object's reference 544 * count so that a forced reclamation of its vnode does not 545 * immediately destroy it. 546 */ 547 vm_object_reference_locked(obj); 548 VM_OBJECT_WUNLOCK(obj); 549 *obj_res = obj; 550 *vp_res = vp; 551 *shmfd_res = shmfd; 552 553 out: 554 if (vp != NULL) 555 VOP_UNLOCK(vp); 556 return (error); 557 } 558 559 static int 560 sendfile_getsock(struct thread *td, int s, struct file **sock_fp, 561 struct socket **so) 562 { 563 int error; 564 565 *sock_fp = NULL; 566 *so = NULL; 567 568 /* 569 * The socket must be a stream socket and connected. 570 */ 571 error = getsock_cap(td, s, &cap_send_rights, 572 sock_fp, NULL, NULL); 573 if (error != 0) 574 return (error); 575 *so = (*sock_fp)->f_data; 576 if ((*so)->so_type != SOCK_STREAM) 577 return (EINVAL); 578 if (SOLISTENING(*so)) 579 return (ENOTCONN); 580 return (0); 581 } 582 583 int 584 vn_sendfile(struct file *fp, int sockfd, struct uio *hdr_uio, 585 struct uio *trl_uio, off_t offset, size_t nbytes, off_t *sent, int flags, 586 struct thread *td) 587 { 588 struct file *sock_fp; 589 struct vnode *vp; 590 struct vm_object *obj; 591 struct socket *so; 592 #ifdef KERN_TLS 593 struct ktls_session *tls; 594 #endif 595 struct mbuf_ext_pgs *ext_pgs; 596 struct mbuf *m, *mh, *mhtail; 597 struct sf_buf *sf; 598 struct shmfd *shmfd; 599 struct sendfile_sync *sfs; 600 struct vattr va; 601 off_t off, sbytes, rem, obj_size; 602 int bsize, error, ext_pgs_idx, hdrlen, max_pgs, softerr; 603 #ifdef KERN_TLS 604 int tls_enq_cnt; 605 #endif 606 bool use_ext_pgs; 607 608 obj = NULL; 609 so = NULL; 610 m = mh = NULL; 611 sfs = NULL; 612 #ifdef KERN_TLS 613 tls = NULL; 614 #endif 615 hdrlen = sbytes = 0; 616 softerr = 0; 617 use_ext_pgs = false; 618 619 error = sendfile_getobj(td, fp, &obj, &vp, &shmfd, &obj_size, &bsize); 620 if (error != 0) 621 return (error); 622 623 error = sendfile_getsock(td, sockfd, &sock_fp, &so); 624 if (error != 0) 625 goto out; 626 627 #ifdef MAC 628 error = mac_socket_check_send(td->td_ucred, so); 629 if (error != 0) 630 goto out; 631 #endif 632 633 SFSTAT_INC(sf_syscalls); 634 SFSTAT_ADD(sf_rhpages_requested, SF_READAHEAD(flags)); 635 636 if (flags & SF_SYNC) { 637 sfs = malloc(sizeof *sfs, M_TEMP, M_WAITOK | M_ZERO); 638 mtx_init(&sfs->mtx, "sendfile", NULL, MTX_DEF); 639 cv_init(&sfs->cv, "sendfile"); 640 } 641 642 rem = nbytes ? omin(nbytes, obj_size - offset) : obj_size - offset; 643 644 /* 645 * Protect against multiple writers to the socket. 646 * 647 * XXXRW: Historically this has assumed non-interruptibility, so now 648 * we implement that, but possibly shouldn't. 649 */ 650 (void)sblock(&so->so_snd, SBL_WAIT | SBL_NOINTR); 651 #ifdef KERN_TLS 652 tls = ktls_hold(so->so_snd.sb_tls_info); 653 #endif 654 655 /* 656 * Loop through the pages of the file, starting with the requested 657 * offset. Get a file page (do I/O if necessary), map the file page 658 * into an sf_buf, attach an mbuf header to the sf_buf, and queue 659 * it on the socket. 660 * This is done in two loops. The inner loop turns as many pages 661 * as it can, up to available socket buffer space, without blocking 662 * into mbufs to have it bulk delivered into the socket send buffer. 663 * The outer loop checks the state and available space of the socket 664 * and takes care of the overall progress. 665 */ 666 for (off = offset; rem > 0; ) { 667 struct sf_io *sfio; 668 vm_page_t *pa; 669 struct mbuf *m0, *mtail; 670 int nios, space, npages, rhpages; 671 672 mtail = NULL; 673 /* 674 * Check the socket state for ongoing connection, 675 * no errors and space in socket buffer. 676 * If space is low allow for the remainder of the 677 * file to be processed if it fits the socket buffer. 678 * Otherwise block in waiting for sufficient space 679 * to proceed, or if the socket is nonblocking, return 680 * to userland with EAGAIN while reporting how far 681 * we've come. 682 * We wait until the socket buffer has significant free 683 * space to do bulk sends. This makes good use of file 684 * system read ahead and allows packet segmentation 685 * offloading hardware to take over lots of work. If 686 * we were not careful here we would send off only one 687 * sfbuf at a time. 688 */ 689 SOCKBUF_LOCK(&so->so_snd); 690 if (so->so_snd.sb_lowat < so->so_snd.sb_hiwat / 2) 691 so->so_snd.sb_lowat = so->so_snd.sb_hiwat / 2; 692 retry_space: 693 if (so->so_snd.sb_state & SBS_CANTSENDMORE) { 694 error = EPIPE; 695 SOCKBUF_UNLOCK(&so->so_snd); 696 goto done; 697 } else if (so->so_error) { 698 error = so->so_error; 699 so->so_error = 0; 700 SOCKBUF_UNLOCK(&so->so_snd); 701 goto done; 702 } 703 if ((so->so_state & SS_ISCONNECTED) == 0) { 704 SOCKBUF_UNLOCK(&so->so_snd); 705 error = ENOTCONN; 706 goto done; 707 } 708 709 space = sbspace(&so->so_snd); 710 if (space < rem && 711 (space <= 0 || 712 space < so->so_snd.sb_lowat)) { 713 if (so->so_state & SS_NBIO) { 714 SOCKBUF_UNLOCK(&so->so_snd); 715 error = EAGAIN; 716 goto done; 717 } 718 /* 719 * sbwait drops the lock while sleeping. 720 * When we loop back to retry_space the 721 * state may have changed and we retest 722 * for it. 723 */ 724 error = sbwait(&so->so_snd); 725 /* 726 * An error from sbwait usually indicates that we've 727 * been interrupted by a signal. If we've sent anything 728 * then return bytes sent, otherwise return the error. 729 */ 730 if (error != 0) { 731 SOCKBUF_UNLOCK(&so->so_snd); 732 goto done; 733 } 734 goto retry_space; 735 } 736 SOCKBUF_UNLOCK(&so->so_snd); 737 738 /* 739 * At the beginning of the first loop check if any headers 740 * are specified and copy them into mbufs. Reduce space in 741 * the socket buffer by the size of the header mbuf chain. 742 * Clear hdr_uio here and hdrlen at the end of the first loop. 743 */ 744 if (hdr_uio != NULL && hdr_uio->uio_resid > 0) { 745 hdr_uio->uio_td = td; 746 hdr_uio->uio_rw = UIO_WRITE; 747 #ifdef KERN_TLS 748 if (tls != NULL) 749 mh = m_uiotombuf(hdr_uio, M_WAITOK, space, 750 tls->params.max_frame_len, M_NOMAP); 751 else 752 #endif 753 mh = m_uiotombuf(hdr_uio, M_WAITOK, 754 space, 0, 0); 755 hdrlen = m_length(mh, &mhtail); 756 space -= hdrlen; 757 /* 758 * If header consumed all the socket buffer space, 759 * don't waste CPU cycles and jump to the end. 760 */ 761 if (space == 0) { 762 sfio = NULL; 763 nios = 0; 764 goto prepend_header; 765 } 766 hdr_uio = NULL; 767 } 768 769 if (vp != NULL) { 770 error = vn_lock(vp, LK_SHARED); 771 if (error != 0) 772 goto done; 773 error = VOP_GETATTR(vp, &va, td->td_ucred); 774 if (error != 0 || off >= va.va_size) { 775 VOP_UNLOCK(vp); 776 goto done; 777 } 778 if (va.va_size != obj_size) { 779 obj_size = va.va_size; 780 rem = nbytes ? 781 omin(nbytes + offset, obj_size) : obj_size; 782 rem -= off; 783 } 784 } 785 786 if (space > rem) 787 space = rem; 788 else if (space > PAGE_SIZE) { 789 /* 790 * Use page boundaries when possible for large 791 * requests. 792 */ 793 if (off & PAGE_MASK) 794 space -= (PAGE_SIZE - (off & PAGE_MASK)); 795 space = trunc_page(space); 796 if (off & PAGE_MASK) 797 space += (PAGE_SIZE - (off & PAGE_MASK)); 798 } 799 800 npages = howmany(space + (off & PAGE_MASK), PAGE_SIZE); 801 802 /* 803 * Calculate maximum allowed number of pages for readahead 804 * at this iteration. If SF_USER_READAHEAD was set, we don't 805 * do any heuristics and use exactly the value supplied by 806 * application. Otherwise, we allow readahead up to "rem". 807 * If application wants more, let it be, but there is no 808 * reason to go above MAXPHYS. Also check against "obj_size", 809 * since vm_pager_has_page() can hint beyond EOF. 810 */ 811 if (flags & SF_USER_READAHEAD) { 812 rhpages = SF_READAHEAD(flags); 813 } else { 814 rhpages = howmany(rem + (off & PAGE_MASK), PAGE_SIZE) - 815 npages; 816 rhpages += SF_READAHEAD(flags); 817 } 818 rhpages = min(howmany(MAXPHYS, PAGE_SIZE), rhpages); 819 rhpages = min(howmany(obj_size - trunc_page(off), PAGE_SIZE) - 820 npages, rhpages); 821 822 sfio = malloc(sizeof(struct sf_io) + 823 npages * sizeof(vm_page_t), M_TEMP, M_WAITOK); 824 refcount_init(&sfio->nios, 1); 825 sfio->obj = obj; 826 sfio->error = 0; 827 sfio->m = NULL; 828 #ifdef KERN_TLS 829 /* 830 * This doesn't use ktls_hold() because sfio->m will 831 * also have a reference on 'tls' that will be valid 832 * for all of sfio's lifetime. 833 */ 834 sfio->tls = tls; 835 #endif 836 vm_object_pip_add(obj, 1); 837 error = sendfile_swapin(obj, sfio, &nios, off, space, npages, 838 rhpages, flags); 839 if (error != 0) { 840 if (vp != NULL) 841 VOP_UNLOCK(vp); 842 sendfile_iodone(sfio, NULL, 0, error); 843 goto done; 844 } 845 846 /* 847 * Loop and construct maximum sized mbuf chain to be bulk 848 * dumped into socket buffer. 849 */ 850 pa = sfio->pa; 851 852 /* 853 * Use unmapped mbufs if enabled for TCP. Unmapped 854 * bufs are restricted to TCP as that is what has been 855 * tested. In particular, unmapped mbufs have not 856 * been tested with UNIX-domain sockets. 857 * 858 * TLS frames always require unmapped mbufs. 859 */ 860 if ((mb_use_ext_pgs && 861 so->so_proto->pr_protocol == IPPROTO_TCP) 862 #ifdef KERN_TLS 863 || tls != NULL 864 #endif 865 ) { 866 use_ext_pgs = true; 867 #ifdef KERN_TLS 868 if (tls != NULL) 869 max_pgs = num_pages(tls->params.max_frame_len); 870 else 871 #endif 872 max_pgs = MBUF_PEXT_MAX_PGS; 873 874 /* Start at last index, to wrap on first use. */ 875 ext_pgs_idx = max_pgs - 1; 876 } 877 878 for (int i = 0; i < npages; i++) { 879 /* 880 * If a page wasn't grabbed successfully, then 881 * trim the array. Can happen only with SF_NODISKIO. 882 */ 883 if (pa[i] == NULL) { 884 SFSTAT_INC(sf_busy); 885 fixspace(npages, i, off, &space); 886 npages = i; 887 softerr = EBUSY; 888 break; 889 } 890 891 if (use_ext_pgs) { 892 off_t xfs; 893 894 ext_pgs_idx++; 895 if (ext_pgs_idx == max_pgs) { 896 m0 = mb_alloc_ext_pgs(M_WAITOK, false, 897 sendfile_free_mext_pg); 898 899 if (flags & SF_NOCACHE) { 900 m0->m_ext.ext_flags |= 901 EXT_FLAG_NOCACHE; 902 903 /* 904 * See comment below regarding 905 * ignoring SF_NOCACHE for the 906 * last page. 907 */ 908 if ((npages - i <= max_pgs) && 909 ((off + space) & PAGE_MASK) && 910 (rem > space || rhpages > 0)) 911 m0->m_ext.ext_flags |= 912 EXT_FLAG_CACHE_LAST; 913 } 914 if (sfs != NULL) { 915 m0->m_ext.ext_flags |= 916 EXT_FLAG_SYNC; 917 m0->m_ext.ext_arg2 = sfs; 918 mtx_lock(&sfs->mtx); 919 sfs->count++; 920 mtx_unlock(&sfs->mtx); 921 } 922 ext_pgs = m0->m_ext.ext_pgs; 923 ext_pgs_idx = 0; 924 925 /* Append to mbuf chain. */ 926 if (mtail != NULL) 927 mtail->m_next = m0; 928 else 929 m = m0; 930 mtail = m0; 931 ext_pgs->first_pg_off = 932 vmoff(i, off) & PAGE_MASK; 933 } 934 if (nios) { 935 mtail->m_flags |= M_NOTREADY; 936 ext_pgs->nrdy++; 937 } 938 939 ext_pgs->pa[ext_pgs_idx] = VM_PAGE_TO_PHYS(pa[i]); 940 ext_pgs->npgs++; 941 xfs = xfsize(i, npages, off, space); 942 ext_pgs->last_pg_len = xfs; 943 MBUF_EXT_PGS_ASSERT_SANITY(ext_pgs); 944 mtail->m_len += xfs; 945 mtail->m_ext.ext_size += PAGE_SIZE; 946 continue; 947 } 948 949 /* 950 * Get a sendfile buf. When allocating the 951 * first buffer for mbuf chain, we usually 952 * wait as long as necessary, but this wait 953 * can be interrupted. For consequent 954 * buffers, do not sleep, since several 955 * threads might exhaust the buffers and then 956 * deadlock. 957 */ 958 sf = sf_buf_alloc(pa[i], 959 m != NULL ? SFB_NOWAIT : SFB_CATCH); 960 if (sf == NULL) { 961 SFSTAT_INC(sf_allocfail); 962 for (int j = i; j < npages; j++) 963 vm_page_unwire(pa[j], PQ_INACTIVE); 964 if (m == NULL) 965 softerr = ENOBUFS; 966 fixspace(npages, i, off, &space); 967 npages = i; 968 break; 969 } 970 971 m0 = m_get(M_WAITOK, MT_DATA); 972 m0->m_ext.ext_buf = (char *)sf_buf_kva(sf); 973 m0->m_ext.ext_size = PAGE_SIZE; 974 m0->m_ext.ext_arg1 = sf; 975 m0->m_ext.ext_type = EXT_SFBUF; 976 m0->m_ext.ext_flags = EXT_FLAG_EMBREF; 977 m0->m_ext.ext_free = sendfile_free_mext; 978 /* 979 * SF_NOCACHE sets the page as being freed upon send. 980 * However, we ignore it for the last page in 'space', 981 * if the page is truncated, and we got more data to 982 * send (rem > space), or if we have readahead 983 * configured (rhpages > 0). 984 */ 985 if ((flags & SF_NOCACHE) && 986 (i != npages - 1 || 987 !((off + space) & PAGE_MASK) || 988 !(rem > space || rhpages > 0))) 989 m0->m_ext.ext_flags |= EXT_FLAG_NOCACHE; 990 if (sfs != NULL) { 991 m0->m_ext.ext_flags |= EXT_FLAG_SYNC; 992 m0->m_ext.ext_arg2 = sfs; 993 mtx_lock(&sfs->mtx); 994 sfs->count++; 995 mtx_unlock(&sfs->mtx); 996 } 997 m0->m_ext.ext_count = 1; 998 m0->m_flags |= (M_EXT | M_RDONLY); 999 if (nios) 1000 m0->m_flags |= M_NOTREADY; 1001 m0->m_data = (char *)sf_buf_kva(sf) + 1002 (vmoff(i, off) & PAGE_MASK); 1003 m0->m_len = xfsize(i, npages, off, space); 1004 1005 /* Append to mbuf chain. */ 1006 if (mtail != NULL) 1007 mtail->m_next = m0; 1008 else 1009 m = m0; 1010 mtail = m0; 1011 } 1012 1013 if (vp != NULL) 1014 VOP_UNLOCK(vp); 1015 1016 /* Keep track of bytes processed. */ 1017 off += space; 1018 rem -= space; 1019 1020 /* 1021 * Prepend header, if any. Save pointer to first mbuf 1022 * with a page. 1023 */ 1024 if (hdrlen) { 1025 prepend_header: 1026 m0 = mhtail->m_next = m; 1027 m = mh; 1028 mh = NULL; 1029 } else 1030 m0 = m; 1031 1032 if (m == NULL) { 1033 KASSERT(softerr, ("%s: m NULL, no error", __func__)); 1034 error = softerr; 1035 sendfile_iodone(sfio, NULL, 0, 0); 1036 goto done; 1037 } 1038 1039 /* Add the buffer chain to the socket buffer. */ 1040 KASSERT(m_length(m, NULL) == space + hdrlen, 1041 ("%s: mlen %u space %d hdrlen %d", 1042 __func__, m_length(m, NULL), space, hdrlen)); 1043 1044 CURVNET_SET(so->so_vnet); 1045 #ifdef KERN_TLS 1046 if (tls != NULL) 1047 ktls_frame(m, tls, &tls_enq_cnt, TLS_RLTYPE_APP); 1048 #endif 1049 if (nios == 0) { 1050 /* 1051 * If sendfile_swapin() didn't initiate any I/Os, 1052 * which happens if all data is cached in VM, or if 1053 * the header consumed all socket buffer space and 1054 * sfio is NULL, then we can send data right now 1055 * without the PRUS_NOTREADY flag. 1056 */ 1057 if (sfio != NULL) 1058 sendfile_iodone(sfio, NULL, 0, 0); 1059 #ifdef KERN_TLS 1060 if (tls != NULL && tls->mode == TCP_TLS_MODE_SW) { 1061 error = (*so->so_proto->pr_usrreqs->pru_send) 1062 (so, PRUS_NOTREADY, m, NULL, NULL, td); 1063 soref(so); 1064 ktls_enqueue(m, so, tls_enq_cnt); 1065 } else 1066 #endif 1067 error = (*so->so_proto->pr_usrreqs->pru_send) 1068 (so, 0, m, NULL, NULL, td); 1069 } else { 1070 sfio->so = so; 1071 sfio->m = m0; 1072 sfio->npages = npages; 1073 soref(so); 1074 error = (*so->so_proto->pr_usrreqs->pru_send) 1075 (so, PRUS_NOTREADY, m, NULL, NULL, td); 1076 sendfile_iodone(sfio, NULL, 0, 0); 1077 } 1078 CURVNET_RESTORE(); 1079 1080 m = NULL; /* pru_send always consumes */ 1081 if (error) 1082 goto done; 1083 sbytes += space + hdrlen; 1084 if (hdrlen) 1085 hdrlen = 0; 1086 if (softerr) { 1087 error = softerr; 1088 goto done; 1089 } 1090 } 1091 1092 /* 1093 * Send trailers. Wimp out and use writev(2). 1094 */ 1095 if (trl_uio != NULL) { 1096 sbunlock(&so->so_snd); 1097 error = kern_writev(td, sockfd, trl_uio); 1098 if (error == 0) 1099 sbytes += td->td_retval[0]; 1100 goto out; 1101 } 1102 1103 done: 1104 sbunlock(&so->so_snd); 1105 out: 1106 /* 1107 * If there was no error we have to clear td->td_retval[0] 1108 * because it may have been set by writev. 1109 */ 1110 if (error == 0) { 1111 td->td_retval[0] = 0; 1112 } 1113 if (sent != NULL) { 1114 (*sent) = sbytes; 1115 } 1116 if (obj != NULL) 1117 vm_object_deallocate(obj); 1118 if (so) 1119 fdrop(sock_fp, td); 1120 if (m) 1121 m_freem(m); 1122 if (mh) 1123 m_freem(mh); 1124 1125 if (sfs != NULL) { 1126 mtx_lock(&sfs->mtx); 1127 if (sfs->count != 0) 1128 cv_wait(&sfs->cv, &sfs->mtx); 1129 KASSERT(sfs->count == 0, ("sendfile sync still busy")); 1130 cv_destroy(&sfs->cv); 1131 mtx_destroy(&sfs->mtx); 1132 free(sfs, M_TEMP); 1133 } 1134 #ifdef KERN_TLS 1135 if (tls != NULL) 1136 ktls_free(tls); 1137 #endif 1138 1139 if (error == ERESTART) 1140 error = EINTR; 1141 1142 return (error); 1143 } 1144 1145 static int 1146 sendfile(struct thread *td, struct sendfile_args *uap, int compat) 1147 { 1148 struct sf_hdtr hdtr; 1149 struct uio *hdr_uio, *trl_uio; 1150 struct file *fp; 1151 off_t sbytes; 1152 int error; 1153 1154 /* 1155 * File offset must be positive. If it goes beyond EOF 1156 * we send only the header/trailer and no payload data. 1157 */ 1158 if (uap->offset < 0) 1159 return (EINVAL); 1160 1161 sbytes = 0; 1162 hdr_uio = trl_uio = NULL; 1163 1164 if (uap->hdtr != NULL) { 1165 error = copyin(uap->hdtr, &hdtr, sizeof(hdtr)); 1166 if (error != 0) 1167 goto out; 1168 if (hdtr.headers != NULL) { 1169 error = copyinuio(hdtr.headers, hdtr.hdr_cnt, 1170 &hdr_uio); 1171 if (error != 0) 1172 goto out; 1173 #ifdef COMPAT_FREEBSD4 1174 /* 1175 * In FreeBSD < 5.0 the nbytes to send also included 1176 * the header. If compat is specified subtract the 1177 * header size from nbytes. 1178 */ 1179 if (compat) { 1180 if (uap->nbytes > hdr_uio->uio_resid) 1181 uap->nbytes -= hdr_uio->uio_resid; 1182 else 1183 uap->nbytes = 0; 1184 } 1185 #endif 1186 } 1187 if (hdtr.trailers != NULL) { 1188 error = copyinuio(hdtr.trailers, hdtr.trl_cnt, 1189 &trl_uio); 1190 if (error != 0) 1191 goto out; 1192 } 1193 } 1194 1195 AUDIT_ARG_FD(uap->fd); 1196 1197 /* 1198 * sendfile(2) can start at any offset within a file so we require 1199 * CAP_READ+CAP_SEEK = CAP_PREAD. 1200 */ 1201 if ((error = fget_read(td, uap->fd, &cap_pread_rights, &fp)) != 0) 1202 goto out; 1203 1204 error = fo_sendfile(fp, uap->s, hdr_uio, trl_uio, uap->offset, 1205 uap->nbytes, &sbytes, uap->flags, td); 1206 fdrop(fp, td); 1207 1208 if (uap->sbytes != NULL) 1209 copyout(&sbytes, uap->sbytes, sizeof(off_t)); 1210 1211 out: 1212 free(hdr_uio, M_IOV); 1213 free(trl_uio, M_IOV); 1214 return (error); 1215 } 1216 1217 /* 1218 * sendfile(2) 1219 * 1220 * int sendfile(int fd, int s, off_t offset, size_t nbytes, 1221 * struct sf_hdtr *hdtr, off_t *sbytes, int flags) 1222 * 1223 * Send a file specified by 'fd' and starting at 'offset' to a socket 1224 * specified by 's'. Send only 'nbytes' of the file or until EOF if nbytes == 1225 * 0. Optionally add a header and/or trailer to the socket output. If 1226 * specified, write the total number of bytes sent into *sbytes. 1227 */ 1228 int 1229 sys_sendfile(struct thread *td, struct sendfile_args *uap) 1230 { 1231 1232 return (sendfile(td, uap, 0)); 1233 } 1234 1235 #ifdef COMPAT_FREEBSD4 1236 int 1237 freebsd4_sendfile(struct thread *td, struct freebsd4_sendfile_args *uap) 1238 { 1239 struct sendfile_args args; 1240 1241 args.fd = uap->fd; 1242 args.s = uap->s; 1243 args.offset = uap->offset; 1244 args.nbytes = uap->nbytes; 1245 args.hdtr = uap->hdtr; 1246 args.sbytes = uap->sbytes; 1247 args.flags = uap->flags; 1248 1249 return (sendfile(td, &args, 1)); 1250 } 1251 #endif /* COMPAT_FREEBSD4 */ 1252