1 /*- 2 * Copyright (c) 2013-2015 Gleb Smirnoff <glebius@FreeBSD.org> 3 * Copyright (c) 1998, David Greenman. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the University nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include "opt_compat.h" 34 35 #include <sys/param.h> 36 #include <sys/systm.h> 37 #include <sys/capsicum.h> 38 #include <sys/kernel.h> 39 #include <sys/lock.h> 40 #include <sys/mutex.h> 41 #include <sys/sysproto.h> 42 #include <sys/malloc.h> 43 #include <sys/proc.h> 44 #include <sys/mman.h> 45 #include <sys/mount.h> 46 #include <sys/mbuf.h> 47 #include <sys/protosw.h> 48 #include <sys/rwlock.h> 49 #include <sys/sf_buf.h> 50 #include <sys/socket.h> 51 #include <sys/socketvar.h> 52 #include <sys/syscallsubr.h> 53 #include <sys/sysctl.h> 54 #include <sys/vnode.h> 55 56 #include <net/vnet.h> 57 58 #include <security/audit/audit.h> 59 #include <security/mac/mac_framework.h> 60 61 #include <vm/vm.h> 62 #include <vm/vm_object.h> 63 #include <vm/vm_pager.h> 64 65 #define EXT_FLAG_SYNC EXT_FLAG_VENDOR1 66 #define EXT_FLAG_NOCACHE EXT_FLAG_VENDOR2 67 68 /* 69 * Structure describing a single sendfile(2) I/O, which may consist of 70 * several underlying pager I/Os. 71 * 72 * The syscall context allocates the structure and initializes 'nios' 73 * to 1. As sendfile_swapin() runs through pages and starts asynchronous 74 * paging operations, it increments 'nios'. 75 * 76 * Every I/O completion calls sendfile_iodone(), which decrements the 'nios', 77 * and the syscall also calls sendfile_iodone() after allocating all mbufs, 78 * linking them and sending to socket. Whoever reaches zero 'nios' is 79 * responsible to * call pru_ready on the socket, to notify it of readyness 80 * of the data. 81 */ 82 struct sf_io { 83 volatile u_int nios; 84 u_int error; 85 int npages; 86 struct socket *so; 87 struct mbuf *m; 88 vm_page_t pa[]; 89 }; 90 91 /* 92 * Structure used to track requests with SF_SYNC flag. 93 */ 94 struct sendfile_sync { 95 struct mtx mtx; 96 struct cv cv; 97 unsigned count; 98 }; 99 100 counter_u64_t sfstat[sizeof(struct sfstat) / sizeof(uint64_t)]; 101 102 static void 103 sfstat_init(const void *unused) 104 { 105 106 COUNTER_ARRAY_ALLOC(sfstat, sizeof(struct sfstat) / sizeof(uint64_t), 107 M_WAITOK); 108 } 109 SYSINIT(sfstat, SI_SUB_MBUF, SI_ORDER_FIRST, sfstat_init, NULL); 110 111 static int 112 sfstat_sysctl(SYSCTL_HANDLER_ARGS) 113 { 114 struct sfstat s; 115 116 COUNTER_ARRAY_COPY(sfstat, &s, sizeof(s) / sizeof(uint64_t)); 117 if (req->newptr) 118 COUNTER_ARRAY_ZERO(sfstat, sizeof(s) / sizeof(uint64_t)); 119 return (SYSCTL_OUT(req, &s, sizeof(s))); 120 } 121 SYSCTL_PROC(_kern_ipc, OID_AUTO, sfstat, CTLTYPE_OPAQUE | CTLFLAG_RW, 122 NULL, 0, sfstat_sysctl, "I", "sendfile statistics"); 123 124 /* 125 * Detach mapped page and release resources back to the system. Called 126 * by mbuf(9) code when last reference to a page is freed. 127 */ 128 static void 129 sendfile_free_page(vm_page_t pg, bool nocache) 130 { 131 132 vm_page_lock(pg); 133 /* 134 * In either case check for the object going away on us. This can 135 * happen since we don't hold a reference to it. If so, we're 136 * responsible for freeing the page. In 'noncache' case try to free 137 * the page, but only if it is cheap to. 138 */ 139 if (vm_page_unwire(pg, nocache ? PQ_NONE : PQ_INACTIVE)) { 140 vm_object_t obj; 141 142 if ((obj = pg->object) == NULL) 143 vm_page_free(pg); 144 else if (nocache) { 145 if (!vm_page_xbusied(pg) && VM_OBJECT_TRYWLOCK(obj)) { 146 bool freed; 147 148 /* Only free unmapped pages. */ 149 if (obj->ref_count == 0 || 150 !pmap_page_is_mapped(pg)) 151 /* 152 * The busy test before the object is 153 * locked cannot be relied upon. 154 */ 155 freed = vm_page_try_to_free(pg); 156 else 157 freed = false; 158 VM_OBJECT_WUNLOCK(obj); 159 if (!freed) 160 vm_page_deactivate_noreuse(pg); 161 } else 162 vm_page_deactivate_noreuse(pg); 163 } 164 } 165 vm_page_unlock(pg); 166 } 167 168 static void 169 sendfile_free_mext(struct mbuf *m) 170 { 171 struct sf_buf *sf; 172 vm_page_t pg; 173 bool nocache; 174 175 KASSERT(m->m_flags & M_EXT && m->m_ext.ext_type == EXT_SFBUF, 176 ("%s: m %p !M_EXT or !EXT_SFBUF", __func__, m)); 177 178 sf = m->m_ext.ext_arg1; 179 pg = sf_buf_page(sf); 180 nocache = m->m_ext.ext_flags & EXT_FLAG_NOCACHE; 181 182 sf_buf_free(sf); 183 sendfile_free_page(pg, nocache); 184 185 if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { 186 struct sendfile_sync *sfs = m->m_ext.ext_arg2; 187 188 mtx_lock(&sfs->mtx); 189 KASSERT(sfs->count > 0, ("Sendfile sync botchup count == 0")); 190 if (--sfs->count == 0) 191 cv_signal(&sfs->cv); 192 mtx_unlock(&sfs->mtx); 193 } 194 } 195 196 /* 197 * Helper function to calculate how much data to put into page i of n. 198 * Only first and last pages are special. 199 */ 200 static inline off_t 201 xfsize(int i, int n, off_t off, off_t len) 202 { 203 204 if (i == 0) 205 return (omin(PAGE_SIZE - (off & PAGE_MASK), len)); 206 207 if (i == n - 1 && ((off + len) & PAGE_MASK) > 0) 208 return ((off + len) & PAGE_MASK); 209 210 return (PAGE_SIZE); 211 } 212 213 /* 214 * Helper function to get offset within object for i page. 215 */ 216 static inline vm_ooffset_t 217 vmoff(int i, off_t off) 218 { 219 220 if (i == 0) 221 return ((vm_ooffset_t)off); 222 223 return (trunc_page(off + i * PAGE_SIZE)); 224 } 225 226 /* 227 * Helper function used when allocation of a page or sf_buf failed. 228 * Pretend as if we don't have enough space, subtract xfsize() of 229 * all pages that failed. 230 */ 231 static inline void 232 fixspace(int old, int new, off_t off, int *space) 233 { 234 235 KASSERT(old > new, ("%s: old %d new %d", __func__, old, new)); 236 237 /* Subtract last one. */ 238 *space -= xfsize(old - 1, old, off, *space); 239 old--; 240 241 if (new == old) 242 /* There was only one page. */ 243 return; 244 245 /* Subtract first one. */ 246 if (new == 0) { 247 *space -= xfsize(0, old, off, *space); 248 new++; 249 } 250 251 /* Rest of pages are full sized. */ 252 *space -= (old - new) * PAGE_SIZE; 253 254 KASSERT(*space >= 0, ("%s: space went backwards", __func__)); 255 } 256 257 /* 258 * I/O completion callback. 259 */ 260 static void 261 sendfile_iodone(void *arg, vm_page_t *pg, int count, int error) 262 { 263 struct sf_io *sfio = arg; 264 struct socket *so = sfio->so; 265 266 for (int i = 0; i < count; i++) 267 if (pg[i] != bogus_page) 268 vm_page_xunbusy(pg[i]); 269 270 if (error) 271 sfio->error = error; 272 273 if (!refcount_release(&sfio->nios)) 274 return; 275 276 if (sfio->error) { 277 struct mbuf *m; 278 279 /* 280 * I/O operation failed. The state of data in the socket 281 * is now inconsistent, and all what we can do is to tear 282 * it down. Protocol abort method would tear down protocol 283 * state, free all ready mbufs and detach not ready ones. 284 * We will free the mbufs corresponding to this I/O manually. 285 * 286 * The socket would be marked with EIO and made available 287 * for read, so that application receives EIO on next 288 * syscall and eventually closes the socket. 289 */ 290 so->so_proto->pr_usrreqs->pru_abort(so); 291 so->so_error = EIO; 292 293 m = sfio->m; 294 for (int i = 0; i < sfio->npages; i++) 295 m = m_free(m); 296 } else { 297 CURVNET_SET(so->so_vnet); 298 (void )(so->so_proto->pr_usrreqs->pru_ready)(so, sfio->m, 299 sfio->npages); 300 CURVNET_RESTORE(); 301 } 302 303 SOCK_LOCK(so); 304 sorele(so); 305 free(sfio, M_TEMP); 306 } 307 308 /* 309 * Iterate through pages vector and request paging for non-valid pages. 310 */ 311 static int 312 sendfile_swapin(vm_object_t obj, struct sf_io *sfio, off_t off, off_t len, 313 int npages, int rhpages, int flags) 314 { 315 vm_page_t *pa = sfio->pa; 316 int grabbed, nios; 317 318 nios = 0; 319 flags = (flags & SF_NODISKIO) ? VM_ALLOC_NOWAIT : 0; 320 321 /* 322 * First grab all the pages and wire them. Note that we grab 323 * only required pages. Readahead pages are dealt with later. 324 */ 325 VM_OBJECT_WLOCK(obj); 326 327 grabbed = vm_page_grab_pages(obj, OFF_TO_IDX(off), 328 VM_ALLOC_NORMAL | VM_ALLOC_WIRED | flags, pa, npages); 329 if (grabbed < npages) { 330 for (int i = grabbed; i < npages; i++) 331 pa[i] = NULL; 332 npages = grabbed; 333 rhpages = 0; 334 } 335 336 for (int i = 0; i < npages;) { 337 int j, a, count, rv; 338 339 /* Skip valid pages. */ 340 if (vm_page_is_valid(pa[i], vmoff(i, off) & PAGE_MASK, 341 xfsize(i, npages, off, len))) { 342 vm_page_xunbusy(pa[i]); 343 SFSTAT_INC(sf_pages_valid); 344 i++; 345 continue; 346 } 347 348 /* 349 * Next page is invalid. Check if it belongs to pager. It 350 * may not be there, which is a regular situation for shmem 351 * pager. For vnode pager this happens only in case of 352 * a sparse file. 353 * 354 * Important feature of vm_pager_has_page() is the hint 355 * stored in 'a', about how many pages we can pagein after 356 * this page in a single I/O. 357 */ 358 if (!vm_pager_has_page(obj, OFF_TO_IDX(vmoff(i, off)), NULL, 359 &a)) { 360 pmap_zero_page(pa[i]); 361 pa[i]->valid = VM_PAGE_BITS_ALL; 362 MPASS(pa[i]->dirty == 0); 363 vm_page_xunbusy(pa[i]); 364 i++; 365 continue; 366 } 367 368 /* 369 * We want to pagein as many pages as possible, limited only 370 * by the 'a' hint and actual request. 371 */ 372 count = min(a + 1, npages - i); 373 374 /* 375 * We should not pagein into a valid page, thus we first trim 376 * any valid pages off the end of request, and substitute 377 * to bogus_page those, that are in the middle. 378 */ 379 for (j = i + count - 1; j > i; j--) { 380 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 381 xfsize(j, npages, off, len))) { 382 count--; 383 rhpages = 0; 384 } else 385 break; 386 } 387 for (j = i + 1; j < i + count - 1; j++) 388 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 389 xfsize(j, npages, off, len))) { 390 vm_page_xunbusy(pa[j]); 391 SFSTAT_INC(sf_pages_valid); 392 SFSTAT_INC(sf_pages_bogus); 393 pa[j] = bogus_page; 394 } 395 396 refcount_acquire(&sfio->nios); 397 rv = vm_pager_get_pages_async(obj, pa + i, count, NULL, 398 i + count == npages ? &rhpages : NULL, 399 &sendfile_iodone, sfio); 400 KASSERT(rv == VM_PAGER_OK, ("%s: pager fail obj %p page %p", 401 __func__, obj, pa[i])); 402 403 SFSTAT_INC(sf_iocnt); 404 SFSTAT_ADD(sf_pages_read, count); 405 if (i + count == npages) 406 SFSTAT_ADD(sf_rhpages_read, rhpages); 407 408 /* 409 * Restore the valid page pointers. They are already 410 * unbusied, but still wired. 411 */ 412 for (j = i; j < i + count; j++) 413 if (pa[j] == bogus_page) { 414 pa[j] = vm_page_lookup(obj, 415 OFF_TO_IDX(vmoff(j, off))); 416 KASSERT(pa[j], ("%s: page %p[%d] disappeared", 417 __func__, pa, j)); 418 419 } 420 i += count; 421 nios++; 422 } 423 424 VM_OBJECT_WUNLOCK(obj); 425 426 if (nios == 0 && npages != 0) 427 SFSTAT_INC(sf_noiocnt); 428 429 return (nios); 430 } 431 432 static int 433 sendfile_getobj(struct thread *td, struct file *fp, vm_object_t *obj_res, 434 struct vnode **vp_res, struct shmfd **shmfd_res, off_t *obj_size, 435 int *bsize) 436 { 437 struct vattr va; 438 vm_object_t obj; 439 struct vnode *vp; 440 struct shmfd *shmfd; 441 int error; 442 443 vp = *vp_res = NULL; 444 obj = NULL; 445 shmfd = *shmfd_res = NULL; 446 *bsize = 0; 447 448 /* 449 * The file descriptor must be a regular file and have a 450 * backing VM object. 451 */ 452 if (fp->f_type == DTYPE_VNODE) { 453 vp = fp->f_vnode; 454 vn_lock(vp, LK_SHARED | LK_RETRY); 455 if (vp->v_type != VREG) { 456 error = EINVAL; 457 goto out; 458 } 459 *bsize = vp->v_mount->mnt_stat.f_iosize; 460 error = VOP_GETATTR(vp, &va, td->td_ucred); 461 if (error != 0) 462 goto out; 463 *obj_size = va.va_size; 464 obj = vp->v_object; 465 if (obj == NULL) { 466 error = EINVAL; 467 goto out; 468 } 469 } else if (fp->f_type == DTYPE_SHM) { 470 error = 0; 471 shmfd = fp->f_data; 472 obj = shmfd->shm_object; 473 *obj_size = shmfd->shm_size; 474 } else { 475 error = EINVAL; 476 goto out; 477 } 478 479 VM_OBJECT_WLOCK(obj); 480 if ((obj->flags & OBJ_DEAD) != 0) { 481 VM_OBJECT_WUNLOCK(obj); 482 error = EBADF; 483 goto out; 484 } 485 486 /* 487 * Temporarily increase the backing VM object's reference 488 * count so that a forced reclamation of its vnode does not 489 * immediately destroy it. 490 */ 491 vm_object_reference_locked(obj); 492 VM_OBJECT_WUNLOCK(obj); 493 *obj_res = obj; 494 *vp_res = vp; 495 *shmfd_res = shmfd; 496 497 out: 498 if (vp != NULL) 499 VOP_UNLOCK(vp, 0); 500 return (error); 501 } 502 503 static int 504 sendfile_getsock(struct thread *td, int s, struct file **sock_fp, 505 struct socket **so) 506 { 507 cap_rights_t rights; 508 int error; 509 510 *sock_fp = NULL; 511 *so = NULL; 512 513 /* 514 * The socket must be a stream socket and connected. 515 */ 516 error = getsock_cap(td, s, cap_rights_init(&rights, CAP_SEND), 517 sock_fp, NULL, NULL); 518 if (error != 0) 519 return (error); 520 *so = (*sock_fp)->f_data; 521 if ((*so)->so_type != SOCK_STREAM) 522 return (EINVAL); 523 return (0); 524 } 525 526 int 527 vn_sendfile(struct file *fp, int sockfd, struct uio *hdr_uio, 528 struct uio *trl_uio, off_t offset, size_t nbytes, off_t *sent, int flags, 529 struct thread *td) 530 { 531 struct file *sock_fp; 532 struct vnode *vp; 533 struct vm_object *obj; 534 struct socket *so; 535 struct mbuf *m, *mh, *mhtail; 536 struct sf_buf *sf; 537 struct shmfd *shmfd; 538 struct sendfile_sync *sfs; 539 struct vattr va; 540 off_t off, sbytes, rem, obj_size; 541 int error, softerr, bsize, hdrlen; 542 543 obj = NULL; 544 so = NULL; 545 m = mh = NULL; 546 sfs = NULL; 547 hdrlen = sbytes = 0; 548 softerr = 0; 549 550 error = sendfile_getobj(td, fp, &obj, &vp, &shmfd, &obj_size, &bsize); 551 if (error != 0) 552 return (error); 553 554 error = sendfile_getsock(td, sockfd, &sock_fp, &so); 555 if (error != 0) 556 goto out; 557 558 #ifdef MAC 559 error = mac_socket_check_send(td->td_ucred, so); 560 if (error != 0) 561 goto out; 562 #endif 563 564 SFSTAT_INC(sf_syscalls); 565 SFSTAT_ADD(sf_rhpages_requested, SF_READAHEAD(flags)); 566 567 if (flags & SF_SYNC) { 568 sfs = malloc(sizeof *sfs, M_TEMP, M_WAITOK | M_ZERO); 569 mtx_init(&sfs->mtx, "sendfile", NULL, MTX_DEF); 570 cv_init(&sfs->cv, "sendfile"); 571 } 572 573 rem = nbytes ? omin(nbytes, obj_size - offset) : obj_size - offset; 574 575 /* 576 * Protect against multiple writers to the socket. 577 * 578 * XXXRW: Historically this has assumed non-interruptibility, so now 579 * we implement that, but possibly shouldn't. 580 */ 581 (void)sblock(&so->so_snd, SBL_WAIT | SBL_NOINTR); 582 583 /* 584 * Loop through the pages of the file, starting with the requested 585 * offset. Get a file page (do I/O if necessary), map the file page 586 * into an sf_buf, attach an mbuf header to the sf_buf, and queue 587 * it on the socket. 588 * This is done in two loops. The inner loop turns as many pages 589 * as it can, up to available socket buffer space, without blocking 590 * into mbufs to have it bulk delivered into the socket send buffer. 591 * The outer loop checks the state and available space of the socket 592 * and takes care of the overall progress. 593 */ 594 for (off = offset; rem > 0; ) { 595 struct sf_io *sfio; 596 vm_page_t *pa; 597 struct mbuf *mtail; 598 int nios, space, npages, rhpages; 599 600 mtail = NULL; 601 /* 602 * Check the socket state for ongoing connection, 603 * no errors and space in socket buffer. 604 * If space is low allow for the remainder of the 605 * file to be processed if it fits the socket buffer. 606 * Otherwise block in waiting for sufficient space 607 * to proceed, or if the socket is nonblocking, return 608 * to userland with EAGAIN while reporting how far 609 * we've come. 610 * We wait until the socket buffer has significant free 611 * space to do bulk sends. This makes good use of file 612 * system read ahead and allows packet segmentation 613 * offloading hardware to take over lots of work. If 614 * we were not careful here we would send off only one 615 * sfbuf at a time. 616 */ 617 SOCKBUF_LOCK(&so->so_snd); 618 if (so->so_snd.sb_lowat < so->so_snd.sb_hiwat / 2) 619 so->so_snd.sb_lowat = so->so_snd.sb_hiwat / 2; 620 retry_space: 621 if (so->so_snd.sb_state & SBS_CANTSENDMORE) { 622 error = EPIPE; 623 SOCKBUF_UNLOCK(&so->so_snd); 624 goto done; 625 } else if (so->so_error) { 626 error = so->so_error; 627 so->so_error = 0; 628 SOCKBUF_UNLOCK(&so->so_snd); 629 goto done; 630 } 631 if ((so->so_state & SS_ISCONNECTED) == 0) { 632 SOCKBUF_UNLOCK(&so->so_snd); 633 error = ENOTCONN; 634 goto done; 635 } 636 637 space = sbspace(&so->so_snd); 638 if (space < rem && 639 (space <= 0 || 640 space < so->so_snd.sb_lowat)) { 641 if (so->so_state & SS_NBIO) { 642 SOCKBUF_UNLOCK(&so->so_snd); 643 error = EAGAIN; 644 goto done; 645 } 646 /* 647 * sbwait drops the lock while sleeping. 648 * When we loop back to retry_space the 649 * state may have changed and we retest 650 * for it. 651 */ 652 error = sbwait(&so->so_snd); 653 /* 654 * An error from sbwait usually indicates that we've 655 * been interrupted by a signal. If we've sent anything 656 * then return bytes sent, otherwise return the error. 657 */ 658 if (error != 0) { 659 SOCKBUF_UNLOCK(&so->so_snd); 660 goto done; 661 } 662 goto retry_space; 663 } 664 SOCKBUF_UNLOCK(&so->so_snd); 665 666 /* 667 * At the beginning of the first loop check if any headers 668 * are specified and copy them into mbufs. Reduce space in 669 * the socket buffer by the size of the header mbuf chain. 670 * Clear hdr_uio here and hdrlen at the end of the first loop. 671 */ 672 if (hdr_uio != NULL && hdr_uio->uio_resid > 0) { 673 hdr_uio->uio_td = td; 674 hdr_uio->uio_rw = UIO_WRITE; 675 mh = m_uiotombuf(hdr_uio, M_WAITOK, space, 0, 0); 676 hdrlen = m_length(mh, &mhtail); 677 space -= hdrlen; 678 /* 679 * If header consumed all the socket buffer space, 680 * don't waste CPU cycles and jump to the end. 681 */ 682 if (space == 0) { 683 sfio = NULL; 684 nios = 0; 685 goto prepend_header; 686 } 687 hdr_uio = NULL; 688 } 689 690 if (vp != NULL) { 691 error = vn_lock(vp, LK_SHARED); 692 if (error != 0) 693 goto done; 694 error = VOP_GETATTR(vp, &va, td->td_ucred); 695 if (error != 0 || off >= va.va_size) { 696 VOP_UNLOCK(vp, 0); 697 goto done; 698 } 699 if (va.va_size != obj_size) { 700 obj_size = va.va_size; 701 rem = nbytes ? 702 omin(nbytes + offset, obj_size) : obj_size; 703 rem -= off; 704 } 705 } 706 707 if (space > rem) 708 space = rem; 709 710 npages = howmany(space + (off & PAGE_MASK), PAGE_SIZE); 711 712 /* 713 * Calculate maximum allowed number of pages for readahead 714 * at this iteration. If SF_USER_READAHEAD was set, we don't 715 * do any heuristics and use exactly the value supplied by 716 * application. Otherwise, we allow readahead up to "rem". 717 * If application wants more, let it be, but there is no 718 * reason to go above MAXPHYS. Also check against "obj_size", 719 * since vm_pager_has_page() can hint beyond EOF. 720 */ 721 if (flags & SF_USER_READAHEAD) { 722 rhpages = SF_READAHEAD(flags); 723 } else { 724 rhpages = howmany(rem + (off & PAGE_MASK), PAGE_SIZE) - 725 npages; 726 rhpages += SF_READAHEAD(flags); 727 } 728 rhpages = min(howmany(MAXPHYS, PAGE_SIZE), rhpages); 729 rhpages = min(howmany(obj_size - trunc_page(off), PAGE_SIZE) - 730 npages, rhpages); 731 732 sfio = malloc(sizeof(struct sf_io) + 733 npages * sizeof(vm_page_t), M_TEMP, M_WAITOK); 734 refcount_init(&sfio->nios, 1); 735 sfio->so = so; 736 sfio->error = 0; 737 738 nios = sendfile_swapin(obj, sfio, off, space, npages, rhpages, 739 flags); 740 741 /* 742 * Loop and construct maximum sized mbuf chain to be bulk 743 * dumped into socket buffer. 744 */ 745 pa = sfio->pa; 746 for (int i = 0; i < npages; i++) { 747 struct mbuf *m0; 748 749 /* 750 * If a page wasn't grabbed successfully, then 751 * trim the array. Can happen only with SF_NODISKIO. 752 */ 753 if (pa[i] == NULL) { 754 SFSTAT_INC(sf_busy); 755 fixspace(npages, i, off, &space); 756 npages = i; 757 softerr = EBUSY; 758 break; 759 } 760 761 /* 762 * Get a sendfile buf. When allocating the 763 * first buffer for mbuf chain, we usually 764 * wait as long as necessary, but this wait 765 * can be interrupted. For consequent 766 * buffers, do not sleep, since several 767 * threads might exhaust the buffers and then 768 * deadlock. 769 */ 770 sf = sf_buf_alloc(pa[i], 771 m != NULL ? SFB_NOWAIT : SFB_CATCH); 772 if (sf == NULL) { 773 SFSTAT_INC(sf_allocfail); 774 for (int j = i; j < npages; j++) { 775 vm_page_lock(pa[j]); 776 vm_page_unwire(pa[j], PQ_INACTIVE); 777 vm_page_unlock(pa[j]); 778 } 779 if (m == NULL) 780 softerr = ENOBUFS; 781 fixspace(npages, i, off, &space); 782 npages = i; 783 break; 784 } 785 786 m0 = m_get(M_WAITOK, MT_DATA); 787 m0->m_ext.ext_buf = (char *)sf_buf_kva(sf); 788 m0->m_ext.ext_size = PAGE_SIZE; 789 m0->m_ext.ext_arg1 = sf; 790 m0->m_ext.ext_type = EXT_SFBUF; 791 m0->m_ext.ext_flags = EXT_FLAG_EMBREF; 792 m0->m_ext.ext_free = sendfile_free_mext; 793 /* 794 * SF_NOCACHE sets the page as being freed upon send. 795 * However, we ignore it for the last page in 'space', 796 * if the page is truncated, and we got more data to 797 * send (rem > space), or if we have readahead 798 * configured (rhpages > 0). 799 */ 800 if ((flags & SF_NOCACHE) && 801 (i != npages - 1 || 802 !((off + space) & PAGE_MASK) || 803 !(rem > space || rhpages > 0))) 804 m0->m_ext.ext_flags |= EXT_FLAG_NOCACHE; 805 if (sfs != NULL) { 806 m0->m_ext.ext_flags |= EXT_FLAG_SYNC; 807 m0->m_ext.ext_arg2 = sfs; 808 mtx_lock(&sfs->mtx); 809 sfs->count++; 810 mtx_unlock(&sfs->mtx); 811 } 812 m0->m_ext.ext_count = 1; 813 m0->m_flags |= (M_EXT | M_RDONLY); 814 if (nios) 815 m0->m_flags |= M_NOTREADY; 816 m0->m_data = (char *)sf_buf_kva(sf) + 817 (vmoff(i, off) & PAGE_MASK); 818 m0->m_len = xfsize(i, npages, off, space); 819 820 if (i == 0) 821 sfio->m = m0; 822 823 /* Append to mbuf chain. */ 824 if (mtail != NULL) 825 mtail->m_next = m0; 826 else 827 m = m0; 828 mtail = m0; 829 } 830 831 if (vp != NULL) 832 VOP_UNLOCK(vp, 0); 833 834 /* Keep track of bytes processed. */ 835 off += space; 836 rem -= space; 837 838 /* Prepend header, if any. */ 839 if (hdrlen) { 840 prepend_header: 841 mhtail->m_next = m; 842 m = mh; 843 mh = NULL; 844 } 845 846 if (m == NULL) { 847 KASSERT(softerr, ("%s: m NULL, no error", __func__)); 848 error = softerr; 849 free(sfio, M_TEMP); 850 goto done; 851 } 852 853 /* Add the buffer chain to the socket buffer. */ 854 KASSERT(m_length(m, NULL) == space + hdrlen, 855 ("%s: mlen %u space %d hdrlen %d", 856 __func__, m_length(m, NULL), space, hdrlen)); 857 858 CURVNET_SET(so->so_vnet); 859 if (nios == 0) { 860 /* 861 * If sendfile_swapin() didn't initiate any I/Os, 862 * which happens if all data is cached in VM, then 863 * we can send data right now without the 864 * PRUS_NOTREADY flag. 865 */ 866 free(sfio, M_TEMP); 867 error = (*so->so_proto->pr_usrreqs->pru_send) 868 (so, 0, m, NULL, NULL, td); 869 } else { 870 sfio->npages = npages; 871 soref(so); 872 error = (*so->so_proto->pr_usrreqs->pru_send) 873 (so, PRUS_NOTREADY, m, NULL, NULL, td); 874 sendfile_iodone(sfio, NULL, 0, 0); 875 } 876 CURVNET_RESTORE(); 877 878 m = NULL; /* pru_send always consumes */ 879 if (error) 880 goto done; 881 sbytes += space + hdrlen; 882 if (hdrlen) 883 hdrlen = 0; 884 if (softerr) { 885 error = softerr; 886 goto done; 887 } 888 } 889 890 /* 891 * Send trailers. Wimp out and use writev(2). 892 */ 893 if (trl_uio != NULL) { 894 sbunlock(&so->so_snd); 895 error = kern_writev(td, sockfd, trl_uio); 896 if (error == 0) 897 sbytes += td->td_retval[0]; 898 goto out; 899 } 900 901 done: 902 sbunlock(&so->so_snd); 903 out: 904 /* 905 * If there was no error we have to clear td->td_retval[0] 906 * because it may have been set by writev. 907 */ 908 if (error == 0) { 909 td->td_retval[0] = 0; 910 } 911 if (sent != NULL) { 912 (*sent) = sbytes; 913 } 914 if (obj != NULL) 915 vm_object_deallocate(obj); 916 if (so) 917 fdrop(sock_fp, td); 918 if (m) 919 m_freem(m); 920 if (mh) 921 m_freem(mh); 922 923 if (sfs != NULL) { 924 mtx_lock(&sfs->mtx); 925 if (sfs->count != 0) 926 cv_wait(&sfs->cv, &sfs->mtx); 927 KASSERT(sfs->count == 0, ("sendfile sync still busy")); 928 cv_destroy(&sfs->cv); 929 mtx_destroy(&sfs->mtx); 930 free(sfs, M_TEMP); 931 } 932 933 if (error == ERESTART) 934 error = EINTR; 935 936 return (error); 937 } 938 939 static int 940 sendfile(struct thread *td, struct sendfile_args *uap, int compat) 941 { 942 struct sf_hdtr hdtr; 943 struct uio *hdr_uio, *trl_uio; 944 struct file *fp; 945 cap_rights_t rights; 946 off_t sbytes; 947 int error; 948 949 /* 950 * File offset must be positive. If it goes beyond EOF 951 * we send only the header/trailer and no payload data. 952 */ 953 if (uap->offset < 0) 954 return (EINVAL); 955 956 sbytes = 0; 957 hdr_uio = trl_uio = NULL; 958 959 if (uap->hdtr != NULL) { 960 error = copyin(uap->hdtr, &hdtr, sizeof(hdtr)); 961 if (error != 0) 962 goto out; 963 if (hdtr.headers != NULL) { 964 error = copyinuio(hdtr.headers, hdtr.hdr_cnt, 965 &hdr_uio); 966 if (error != 0) 967 goto out; 968 #ifdef COMPAT_FREEBSD4 969 /* 970 * In FreeBSD < 5.0 the nbytes to send also included 971 * the header. If compat is specified subtract the 972 * header size from nbytes. 973 */ 974 if (compat) { 975 if (uap->nbytes > hdr_uio->uio_resid) 976 uap->nbytes -= hdr_uio->uio_resid; 977 else 978 uap->nbytes = 0; 979 } 980 #endif 981 } 982 if (hdtr.trailers != NULL) { 983 error = copyinuio(hdtr.trailers, hdtr.trl_cnt, 984 &trl_uio); 985 if (error != 0) 986 goto out; 987 } 988 } 989 990 AUDIT_ARG_FD(uap->fd); 991 992 /* 993 * sendfile(2) can start at any offset within a file so we require 994 * CAP_READ+CAP_SEEK = CAP_PREAD. 995 */ 996 if ((error = fget_read(td, uap->fd, 997 cap_rights_init(&rights, CAP_PREAD), &fp)) != 0) { 998 goto out; 999 } 1000 1001 error = fo_sendfile(fp, uap->s, hdr_uio, trl_uio, uap->offset, 1002 uap->nbytes, &sbytes, uap->flags, td); 1003 fdrop(fp, td); 1004 1005 if (uap->sbytes != NULL) 1006 copyout(&sbytes, uap->sbytes, sizeof(off_t)); 1007 1008 out: 1009 free(hdr_uio, M_IOV); 1010 free(trl_uio, M_IOV); 1011 return (error); 1012 } 1013 1014 /* 1015 * sendfile(2) 1016 * 1017 * int sendfile(int fd, int s, off_t offset, size_t nbytes, 1018 * struct sf_hdtr *hdtr, off_t *sbytes, int flags) 1019 * 1020 * Send a file specified by 'fd' and starting at 'offset' to a socket 1021 * specified by 's'. Send only 'nbytes' of the file or until EOF if nbytes == 1022 * 0. Optionally add a header and/or trailer to the socket output. If 1023 * specified, write the total number of bytes sent into *sbytes. 1024 */ 1025 int 1026 sys_sendfile(struct thread *td, struct sendfile_args *uap) 1027 { 1028 1029 return (sendfile(td, uap, 0)); 1030 } 1031 1032 #ifdef COMPAT_FREEBSD4 1033 int 1034 freebsd4_sendfile(struct thread *td, struct freebsd4_sendfile_args *uap) 1035 { 1036 struct sendfile_args args; 1037 1038 args.fd = uap->fd; 1039 args.s = uap->s; 1040 args.offset = uap->offset; 1041 args.nbytes = uap->nbytes; 1042 args.hdtr = uap->hdtr; 1043 args.sbytes = uap->sbytes; 1044 args.flags = uap->flags; 1045 1046 return (sendfile(td, &args, 1)); 1047 } 1048 #endif /* COMPAT_FREEBSD4 */ 1049