1 /*- 2 * Copyright (c) 2013-2015 Gleb Smirnoff <glebius@FreeBSD.org> 3 * Copyright (c) 1998, David Greenman. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the University nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include "opt_kern_tls.h" 34 35 #include <sys/param.h> 36 #include <sys/systm.h> 37 #include <sys/capsicum.h> 38 #include <sys/kernel.h> 39 #include <sys/lock.h> 40 #include <sys/ktls.h> 41 #include <sys/mutex.h> 42 #include <sys/malloc.h> 43 #include <sys/mman.h> 44 #include <sys/mount.h> 45 #include <sys/mbuf.h> 46 #include <sys/proc.h> 47 #include <sys/protosw.h> 48 #include <sys/rwlock.h> 49 #include <sys/sf_buf.h> 50 #include <sys/socket.h> 51 #include <sys/socketvar.h> 52 #include <sys/syscallsubr.h> 53 #include <sys/sysctl.h> 54 #include <sys/sysproto.h> 55 #include <sys/vnode.h> 56 57 #include <net/vnet.h> 58 #include <netinet/in.h> 59 #include <netinet/tcp.h> 60 61 #include <security/audit/audit.h> 62 #include <security/mac/mac_framework.h> 63 64 #include <vm/vm.h> 65 #include <vm/vm_object.h> 66 #include <vm/vm_pager.h> 67 68 static MALLOC_DEFINE(M_SENDFILE, "sendfile", "sendfile dynamic memory"); 69 70 #define EXT_FLAG_SYNC EXT_FLAG_VENDOR1 71 #define EXT_FLAG_NOCACHE EXT_FLAG_VENDOR2 72 #define EXT_FLAG_CACHE_LAST EXT_FLAG_VENDOR3 73 74 /* 75 * Structure describing a single sendfile(2) I/O, which may consist of 76 * several underlying pager I/Os. 77 * 78 * The syscall context allocates the structure and initializes 'nios' 79 * to 1. As sendfile_swapin() runs through pages and starts asynchronous 80 * paging operations, it increments 'nios'. 81 * 82 * Every I/O completion calls sendfile_iodone(), which decrements the 'nios', 83 * and the syscall also calls sendfile_iodone() after allocating all mbufs, 84 * linking them and sending to socket. Whoever reaches zero 'nios' is 85 * responsible to * call pru_ready on the socket, to notify it of readyness 86 * of the data. 87 */ 88 struct sf_io { 89 volatile u_int nios; 90 u_int error; 91 int npages; 92 struct socket *so; 93 struct mbuf *m; 94 vm_object_t obj; 95 vm_pindex_t pindex0; 96 #ifdef KERN_TLS 97 struct ktls_session *tls; 98 #endif 99 vm_page_t pa[]; 100 }; 101 102 /* 103 * Structure used to track requests with SF_SYNC flag. 104 */ 105 struct sendfile_sync { 106 struct mtx mtx; 107 struct cv cv; 108 unsigned count; 109 bool waiting; 110 }; 111 112 static void 113 sendfile_sync_destroy(struct sendfile_sync *sfs) 114 { 115 KASSERT(sfs->count == 0, ("sendfile sync %p still busy", sfs)); 116 117 cv_destroy(&sfs->cv); 118 mtx_destroy(&sfs->mtx); 119 free(sfs, M_SENDFILE); 120 } 121 122 static void 123 sendfile_sync_signal(struct sendfile_sync *sfs) 124 { 125 mtx_lock(&sfs->mtx); 126 KASSERT(sfs->count > 0, ("sendfile sync %p not busy", sfs)); 127 if (--sfs->count == 0) { 128 if (!sfs->waiting) { 129 /* The sendfile() waiter was interrupted by a signal. */ 130 sendfile_sync_destroy(sfs); 131 return; 132 } else { 133 cv_signal(&sfs->cv); 134 } 135 } 136 mtx_unlock(&sfs->mtx); 137 } 138 139 counter_u64_t sfstat[sizeof(struct sfstat) / sizeof(uint64_t)]; 140 141 static void 142 sfstat_init(const void *unused) 143 { 144 145 COUNTER_ARRAY_ALLOC(sfstat, sizeof(struct sfstat) / sizeof(uint64_t), 146 M_WAITOK); 147 } 148 SYSINIT(sfstat, SI_SUB_MBUF, SI_ORDER_FIRST, sfstat_init, NULL); 149 150 static int 151 sfstat_sysctl(SYSCTL_HANDLER_ARGS) 152 { 153 struct sfstat s; 154 155 COUNTER_ARRAY_COPY(sfstat, &s, sizeof(s) / sizeof(uint64_t)); 156 if (req->newptr) 157 COUNTER_ARRAY_ZERO(sfstat, sizeof(s) / sizeof(uint64_t)); 158 return (SYSCTL_OUT(req, &s, sizeof(s))); 159 } 160 SYSCTL_PROC(_kern_ipc, OID_AUTO, sfstat, 161 CTLTYPE_OPAQUE | CTLFLAG_RW | CTLFLAG_NEEDGIANT, NULL, 0, 162 sfstat_sysctl, "I", 163 "sendfile statistics"); 164 165 static void 166 sendfile_free_mext(struct mbuf *m) 167 { 168 struct sf_buf *sf; 169 vm_page_t pg; 170 int flags; 171 172 KASSERT(m->m_flags & M_EXT && m->m_ext.ext_type == EXT_SFBUF, 173 ("%s: m %p !M_EXT or !EXT_SFBUF", __func__, m)); 174 175 sf = m->m_ext.ext_arg1; 176 pg = sf_buf_page(sf); 177 flags = (m->m_ext.ext_flags & EXT_FLAG_NOCACHE) != 0 ? VPR_TRYFREE : 0; 178 179 sf_buf_free(sf); 180 vm_page_release(pg, flags); 181 182 if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { 183 struct sendfile_sync *sfs = m->m_ext.ext_arg2; 184 sendfile_sync_signal(sfs); 185 } 186 } 187 188 static void 189 sendfile_free_mext_pg(struct mbuf *m) 190 { 191 vm_page_t pg; 192 int flags, i; 193 bool cache_last; 194 195 M_ASSERTEXTPG(m); 196 197 cache_last = m->m_ext.ext_flags & EXT_FLAG_CACHE_LAST; 198 flags = (m->m_ext.ext_flags & EXT_FLAG_NOCACHE) != 0 ? VPR_TRYFREE : 0; 199 200 for (i = 0; i < m->m_epg_npgs; i++) { 201 if (cache_last && i == m->m_epg_npgs - 1) 202 flags = 0; 203 pg = PHYS_TO_VM_PAGE(m->m_epg_pa[i]); 204 vm_page_release(pg, flags); 205 } 206 207 if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { 208 struct sendfile_sync *sfs = m->m_ext.ext_arg1; 209 sendfile_sync_signal(sfs); 210 } 211 } 212 213 /* 214 * Helper function to calculate how much data to put into page i of n. 215 * Only first and last pages are special. 216 */ 217 static inline off_t 218 xfsize(int i, int n, off_t off, off_t len) 219 { 220 221 if (i == 0) 222 return (omin(PAGE_SIZE - (off & PAGE_MASK), len)); 223 224 if (i == n - 1 && ((off + len) & PAGE_MASK) > 0) 225 return ((off + len) & PAGE_MASK); 226 227 return (PAGE_SIZE); 228 } 229 230 /* 231 * Helper function to get offset within object for i page. 232 */ 233 static inline vm_ooffset_t 234 vmoff(int i, off_t off) 235 { 236 237 if (i == 0) 238 return ((vm_ooffset_t)off); 239 240 return (trunc_page(off + i * PAGE_SIZE)); 241 } 242 243 /* 244 * Helper function used when allocation of a page or sf_buf failed. 245 * Pretend as if we don't have enough space, subtract xfsize() of 246 * all pages that failed. 247 */ 248 static inline void 249 fixspace(int old, int new, off_t off, int *space) 250 { 251 252 KASSERT(old > new, ("%s: old %d new %d", __func__, old, new)); 253 254 /* Subtract last one. */ 255 *space -= xfsize(old - 1, old, off, *space); 256 old--; 257 258 if (new == old) 259 /* There was only one page. */ 260 return; 261 262 /* Subtract first one. */ 263 if (new == 0) { 264 *space -= xfsize(0, old, off, *space); 265 new++; 266 } 267 268 /* Rest of pages are full sized. */ 269 *space -= (old - new) * PAGE_SIZE; 270 271 KASSERT(*space >= 0, ("%s: space went backwards", __func__)); 272 } 273 274 /* 275 * Wait for all in-flight ios to complete, we must not unwire pages 276 * under them. 277 */ 278 static void 279 sendfile_iowait(struct sf_io *sfio, const char *wmesg) 280 { 281 while (atomic_load_int(&sfio->nios) != 1) 282 pause(wmesg, 1); 283 } 284 285 /* 286 * I/O completion callback. 287 */ 288 static void 289 sendfile_iodone(void *arg, vm_page_t *pa, int count, int error) 290 { 291 struct sf_io *sfio = arg; 292 struct socket *so; 293 int i; 294 295 if (error != 0) 296 sfio->error = error; 297 298 /* 299 * Restore the valid page pointers. They are already 300 * unbusied, but still wired. 301 * 302 * XXXKIB since pages are only wired, and we do not 303 * own the object lock, other users might have 304 * invalidated them in meantime. Similarly, after we 305 * unbusied the swapped-in pages, they can become 306 * invalid under us. 307 */ 308 MPASS(count == 0 || pa[0] != bogus_page); 309 for (i = 0; i < count; i++) { 310 if (pa[i] == bogus_page) { 311 sfio->pa[(pa[0]->pindex - sfio->pindex0) + i] = 312 pa[i] = vm_page_relookup(sfio->obj, 313 pa[0]->pindex + i); 314 KASSERT(pa[i] != NULL, 315 ("%s: page %p[%d] disappeared", 316 __func__, pa, i)); 317 } else { 318 vm_page_xunbusy_unchecked(pa[i]); 319 } 320 } 321 322 if (!refcount_release(&sfio->nios)) 323 return; 324 325 #ifdef INVARIANTS 326 for (i = 1; i < sfio->npages; i++) { 327 if (sfio->pa[i] == NULL) 328 break; 329 KASSERT(vm_page_wired(sfio->pa[i]), 330 ("sfio %p page %d %p not wired", sfio, i, sfio->pa[i])); 331 if (i == 0) 332 continue; 333 KASSERT(sfio->pa[0]->object == sfio->pa[i]->object, 334 ("sfio %p page %d %p wrong owner %p %p", sfio, i, 335 sfio->pa[i], sfio->pa[0]->object, sfio->pa[i]->object)); 336 KASSERT(sfio->pa[0]->pindex + i == sfio->pa[i]->pindex, 337 ("sfio %p page %d %p wrong index %jx %jx", sfio, i, 338 sfio->pa[i], (uintmax_t)sfio->pa[0]->pindex, 339 (uintmax_t)sfio->pa[i]->pindex)); 340 } 341 #endif 342 343 vm_object_pip_wakeup(sfio->obj); 344 345 if (sfio->m == NULL) { 346 /* 347 * Either I/O operation failed, or we failed to allocate 348 * buffers, or we bailed out on first busy page, or we 349 * succeeded filling the request without any I/Os. Anyway, 350 * pru_send hadn't been executed - nothing had been sent 351 * to the socket yet. 352 */ 353 MPASS((curthread->td_pflags & TDP_KTHREAD) == 0); 354 free(sfio, M_SENDFILE); 355 return; 356 } 357 358 #if defined(KERN_TLS) && defined(INVARIANTS) 359 if ((sfio->m->m_flags & M_EXTPG) != 0) 360 KASSERT(sfio->tls == sfio->m->m_epg_tls, 361 ("TLS session mismatch")); 362 else 363 KASSERT(sfio->tls == NULL, 364 ("non-ext_pgs mbuf with TLS session")); 365 #endif 366 so = sfio->so; 367 CURVNET_SET(so->so_vnet); 368 if (__predict_false(sfio->error)) { 369 /* 370 * I/O operation failed. The state of data in the socket 371 * is now inconsistent, and all what we can do is to tear 372 * it down. Protocol abort method would tear down protocol 373 * state, free all ready mbufs and detach not ready ones. 374 * We will free the mbufs corresponding to this I/O manually. 375 * 376 * The socket would be marked with EIO and made available 377 * for read, so that application receives EIO on next 378 * syscall and eventually closes the socket. 379 */ 380 so->so_proto->pr_usrreqs->pru_abort(so); 381 so->so_error = EIO; 382 383 mb_free_notready(sfio->m, sfio->npages); 384 #ifdef KERN_TLS 385 } else if (sfio->tls != NULL && sfio->tls->mode == TCP_TLS_MODE_SW) { 386 /* 387 * I/O operation is complete, but we still need to 388 * encrypt. We cannot do this in the interrupt thread 389 * of the disk controller, so forward the mbufs to a 390 * different thread. 391 * 392 * Donate the socket reference from sfio to rather 393 * than explicitly invoking soref(). 394 */ 395 ktls_enqueue(sfio->m, so, sfio->npages); 396 goto out_with_ref; 397 #endif 398 } else 399 (void)(so->so_proto->pr_usrreqs->pru_ready)(so, sfio->m, 400 sfio->npages); 401 402 sorele(so); 403 #ifdef KERN_TLS 404 out_with_ref: 405 #endif 406 CURVNET_RESTORE(); 407 free(sfio, M_SENDFILE); 408 } 409 410 /* 411 * Iterate through pages vector and request paging for non-valid pages. 412 */ 413 static int 414 sendfile_swapin(vm_object_t obj, struct sf_io *sfio, int *nios, off_t off, 415 off_t len, int rhpages, int flags) 416 { 417 vm_page_t *pa; 418 int a, count, count1, grabbed, i, j, npages, rv; 419 420 pa = sfio->pa; 421 npages = sfio->npages; 422 *nios = 0; 423 flags = (flags & SF_NODISKIO) ? VM_ALLOC_NOWAIT : 0; 424 sfio->pindex0 = OFF_TO_IDX(off); 425 426 /* 427 * First grab all the pages and wire them. Note that we grab 428 * only required pages. Readahead pages are dealt with later. 429 */ 430 grabbed = vm_page_grab_pages_unlocked(obj, OFF_TO_IDX(off), 431 VM_ALLOC_NORMAL | VM_ALLOC_WIRED | flags, pa, npages); 432 if (grabbed < npages) { 433 for (int i = grabbed; i < npages; i++) 434 pa[i] = NULL; 435 npages = grabbed; 436 rhpages = 0; 437 } 438 439 for (i = 0; i < npages;) { 440 /* Skip valid pages. */ 441 if (vm_page_is_valid(pa[i], vmoff(i, off) & PAGE_MASK, 442 xfsize(i, npages, off, len))) { 443 vm_page_xunbusy(pa[i]); 444 SFSTAT_INC(sf_pages_valid); 445 i++; 446 continue; 447 } 448 449 /* 450 * Next page is invalid. Check if it belongs to pager. It 451 * may not be there, which is a regular situation for shmem 452 * pager. For vnode pager this happens only in case of 453 * a sparse file. 454 * 455 * Important feature of vm_pager_has_page() is the hint 456 * stored in 'a', about how many pages we can pagein after 457 * this page in a single I/O. 458 */ 459 VM_OBJECT_RLOCK(obj); 460 if (!vm_pager_has_page(obj, OFF_TO_IDX(vmoff(i, off)), NULL, 461 &a)) { 462 VM_OBJECT_RUNLOCK(obj); 463 pmap_zero_page(pa[i]); 464 vm_page_valid(pa[i]); 465 MPASS(pa[i]->dirty == 0); 466 vm_page_xunbusy(pa[i]); 467 i++; 468 continue; 469 } 470 VM_OBJECT_RUNLOCK(obj); 471 472 /* 473 * We want to pagein as many pages as possible, limited only 474 * by the 'a' hint and actual request. 475 */ 476 count = min(a + 1, npages - i); 477 478 /* 479 * We should not pagein into a valid page because 480 * there might be still unfinished write tracked by 481 * e.g. a buffer, thus we substitute any valid pages 482 * with the bogus one. 483 * 484 * We must not leave around xbusy pages which are not 485 * part of the run passed to vm_pager_getpages(), 486 * otherwise pager might deadlock waiting for the busy 487 * status of the page, e.g. if it constitues the 488 * buffer needed to validate other page. 489 * 490 * First trim the end of the run consisting of the 491 * valid pages, then replace the rest of the valid 492 * with bogus. 493 */ 494 count1 = count; 495 for (j = i + count - 1; j > i; j--) { 496 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 497 xfsize(j, npages, off, len))) { 498 vm_page_xunbusy(pa[j]); 499 SFSTAT_INC(sf_pages_valid); 500 count--; 501 } else { 502 break; 503 } 504 } 505 506 /* 507 * The last page in the run pa[i + count - 1] is 508 * guaranteed to be invalid by the trim above, so it 509 * is not replaced with bogus, thus -1 in the loop end 510 * condition. 511 */ 512 MPASS(pa[i + count - 1]->valid != VM_PAGE_BITS_ALL); 513 for (j = i + 1; j < i + count - 1; j++) { 514 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 515 xfsize(j, npages, off, len))) { 516 vm_page_xunbusy(pa[j]); 517 SFSTAT_INC(sf_pages_valid); 518 SFSTAT_INC(sf_pages_bogus); 519 pa[j] = bogus_page; 520 } 521 } 522 523 refcount_acquire(&sfio->nios); 524 rv = vm_pager_get_pages_async(obj, pa + i, count, NULL, 525 i + count == npages ? &rhpages : NULL, 526 &sendfile_iodone, sfio); 527 if (__predict_false(rv != VM_PAGER_OK)) { 528 sendfile_iowait(sfio, "sferrio"); 529 530 /* 531 * Do remaining pages recovery before returning EIO. 532 * Pages from 0 to npages are wired. 533 * Pages from (i + count1) to npages are busied. 534 */ 535 for (j = 0; j < npages; j++) { 536 if (j >= i + count1) 537 vm_page_xunbusy(pa[j]); 538 KASSERT(pa[j] != NULL && pa[j] != bogus_page, 539 ("%s: page %p[%d] I/O recovery failure", 540 __func__, pa, j)); 541 vm_page_unwire(pa[j], PQ_INACTIVE); 542 pa[j] = NULL; 543 } 544 return (EIO); 545 } 546 547 SFSTAT_INC(sf_iocnt); 548 SFSTAT_ADD(sf_pages_read, count); 549 if (i + count == npages) 550 SFSTAT_ADD(sf_rhpages_read, rhpages); 551 552 i += count1; 553 (*nios)++; 554 } 555 556 if (*nios == 0 && npages != 0) 557 SFSTAT_INC(sf_noiocnt); 558 559 return (0); 560 } 561 562 static int 563 sendfile_getobj(struct thread *td, struct file *fp, vm_object_t *obj_res, 564 struct vnode **vp_res, struct shmfd **shmfd_res, off_t *obj_size, 565 int *bsize) 566 { 567 struct vattr va; 568 vm_object_t obj; 569 struct vnode *vp; 570 struct shmfd *shmfd; 571 int error; 572 573 error = 0; 574 vp = *vp_res = NULL; 575 obj = NULL; 576 shmfd = *shmfd_res = NULL; 577 *bsize = 0; 578 579 /* 580 * The file descriptor must be a regular file and have a 581 * backing VM object. 582 */ 583 if (fp->f_type == DTYPE_VNODE) { 584 vp = fp->f_vnode; 585 vn_lock(vp, LK_SHARED | LK_RETRY); 586 if (vp->v_type != VREG) { 587 error = EINVAL; 588 goto out; 589 } 590 *bsize = vp->v_mount->mnt_stat.f_iosize; 591 obj = vp->v_object; 592 if (obj == NULL) { 593 error = EINVAL; 594 goto out; 595 } 596 597 /* 598 * Use the pager size when available to simplify synchronization 599 * with filesystems, which otherwise must atomically update both 600 * the vnode pager size and file size. 601 */ 602 if (obj->type == OBJT_VNODE) { 603 VM_OBJECT_RLOCK(obj); 604 *obj_size = obj->un_pager.vnp.vnp_size; 605 } else { 606 error = VOP_GETATTR(vp, &va, td->td_ucred); 607 if (error != 0) 608 goto out; 609 *obj_size = va.va_size; 610 VM_OBJECT_RLOCK(obj); 611 } 612 } else if (fp->f_type == DTYPE_SHM) { 613 shmfd = fp->f_data; 614 obj = shmfd->shm_object; 615 VM_OBJECT_RLOCK(obj); 616 *obj_size = shmfd->shm_size; 617 } else { 618 error = EINVAL; 619 goto out; 620 } 621 622 if ((obj->flags & OBJ_DEAD) != 0) { 623 VM_OBJECT_RUNLOCK(obj); 624 error = EBADF; 625 goto out; 626 } 627 628 /* 629 * Temporarily increase the backing VM object's reference 630 * count so that a forced reclamation of its vnode does not 631 * immediately destroy it. 632 */ 633 vm_object_reference_locked(obj); 634 VM_OBJECT_RUNLOCK(obj); 635 *obj_res = obj; 636 *vp_res = vp; 637 *shmfd_res = shmfd; 638 639 out: 640 if (vp != NULL) 641 VOP_UNLOCK(vp); 642 return (error); 643 } 644 645 static int 646 sendfile_getsock(struct thread *td, int s, struct file **sock_fp, 647 struct socket **so) 648 { 649 int error; 650 651 *sock_fp = NULL; 652 *so = NULL; 653 654 /* 655 * The socket must be a stream socket and connected. 656 */ 657 error = getsock_cap(td, s, &cap_send_rights, 658 sock_fp, NULL, NULL); 659 if (error != 0) 660 return (error); 661 *so = (*sock_fp)->f_data; 662 if ((*so)->so_type != SOCK_STREAM) 663 return (EINVAL); 664 /* 665 * SCTP one-to-one style sockets currently don't work with 666 * sendfile(). So indicate EINVAL for now. 667 */ 668 if ((*so)->so_proto->pr_protocol == IPPROTO_SCTP) 669 return (EINVAL); 670 return (0); 671 } 672 673 int 674 vn_sendfile(struct file *fp, int sockfd, struct uio *hdr_uio, 675 struct uio *trl_uio, off_t offset, size_t nbytes, off_t *sent, int flags, 676 struct thread *td) 677 { 678 struct file *sock_fp; 679 struct vnode *vp; 680 struct vm_object *obj; 681 vm_page_t pga; 682 struct socket *so; 683 #ifdef KERN_TLS 684 struct ktls_session *tls; 685 #endif 686 struct mbuf *m, *mh, *mhtail; 687 struct sf_buf *sf; 688 struct shmfd *shmfd; 689 struct sendfile_sync *sfs; 690 struct vattr va; 691 off_t off, sbytes, rem, obj_size, nobj_size; 692 int bsize, error, ext_pgs_idx, hdrlen, max_pgs, softerr; 693 #ifdef KERN_TLS 694 int tls_enq_cnt; 695 #endif 696 bool use_ext_pgs; 697 698 obj = NULL; 699 so = NULL; 700 m = mh = NULL; 701 sfs = NULL; 702 #ifdef KERN_TLS 703 tls = NULL; 704 #endif 705 hdrlen = sbytes = 0; 706 softerr = 0; 707 use_ext_pgs = false; 708 709 error = sendfile_getobj(td, fp, &obj, &vp, &shmfd, &obj_size, &bsize); 710 if (error != 0) 711 return (error); 712 713 error = sendfile_getsock(td, sockfd, &sock_fp, &so); 714 if (error != 0) 715 goto out; 716 717 #ifdef MAC 718 error = mac_socket_check_send(td->td_ucred, so); 719 if (error != 0) 720 goto out; 721 #endif 722 723 SFSTAT_INC(sf_syscalls); 724 SFSTAT_ADD(sf_rhpages_requested, SF_READAHEAD(flags)); 725 726 if (flags & SF_SYNC) { 727 sfs = malloc(sizeof(*sfs), M_SENDFILE, M_WAITOK | M_ZERO); 728 mtx_init(&sfs->mtx, "sendfile", NULL, MTX_DEF); 729 cv_init(&sfs->cv, "sendfile"); 730 sfs->waiting = true; 731 } 732 733 rem = nbytes ? omin(nbytes, obj_size - offset) : obj_size - offset; 734 735 /* 736 * Protect against multiple writers to the socket. 737 * 738 * XXXRW: Historically this has assumed non-interruptibility, so now 739 * we implement that, but possibly shouldn't. 740 */ 741 error = SOCK_IO_SEND_LOCK(so, SBL_WAIT | SBL_NOINTR); 742 if (error != 0) 743 goto out; 744 #ifdef KERN_TLS 745 tls = ktls_hold(so->so_snd.sb_tls_info); 746 #endif 747 748 /* 749 * Loop through the pages of the file, starting with the requested 750 * offset. Get a file page (do I/O if necessary), map the file page 751 * into an sf_buf, attach an mbuf header to the sf_buf, and queue 752 * it on the socket. 753 * This is done in two loops. The inner loop turns as many pages 754 * as it can, up to available socket buffer space, without blocking 755 * into mbufs to have it bulk delivered into the socket send buffer. 756 * The outer loop checks the state and available space of the socket 757 * and takes care of the overall progress. 758 */ 759 for (off = offset; rem > 0; ) { 760 struct sf_io *sfio; 761 vm_page_t *pa; 762 struct mbuf *m0, *mtail; 763 int nios, space, npages, rhpages; 764 765 mtail = NULL; 766 /* 767 * Check the socket state for ongoing connection, 768 * no errors and space in socket buffer. 769 * If space is low allow for the remainder of the 770 * file to be processed if it fits the socket buffer. 771 * Otherwise block in waiting for sufficient space 772 * to proceed, or if the socket is nonblocking, return 773 * to userland with EAGAIN while reporting how far 774 * we've come. 775 * We wait until the socket buffer has significant free 776 * space to do bulk sends. This makes good use of file 777 * system read ahead and allows packet segmentation 778 * offloading hardware to take over lots of work. If 779 * we were not careful here we would send off only one 780 * sfbuf at a time. 781 */ 782 SOCKBUF_LOCK(&so->so_snd); 783 if (so->so_snd.sb_lowat < so->so_snd.sb_hiwat / 2) 784 so->so_snd.sb_lowat = so->so_snd.sb_hiwat / 2; 785 retry_space: 786 if (so->so_snd.sb_state & SBS_CANTSENDMORE) { 787 error = EPIPE; 788 SOCKBUF_UNLOCK(&so->so_snd); 789 goto done; 790 } else if (so->so_error) { 791 error = so->so_error; 792 so->so_error = 0; 793 SOCKBUF_UNLOCK(&so->so_snd); 794 goto done; 795 } 796 if ((so->so_state & SS_ISCONNECTED) == 0) { 797 SOCKBUF_UNLOCK(&so->so_snd); 798 error = ENOTCONN; 799 goto done; 800 } 801 802 space = sbspace(&so->so_snd); 803 if (space < rem && 804 (space <= 0 || 805 space < so->so_snd.sb_lowat)) { 806 if (so->so_state & SS_NBIO) { 807 SOCKBUF_UNLOCK(&so->so_snd); 808 error = EAGAIN; 809 goto done; 810 } 811 /* 812 * sbwait drops the lock while sleeping. 813 * When we loop back to retry_space the 814 * state may have changed and we retest 815 * for it. 816 */ 817 error = sbwait(&so->so_snd); 818 /* 819 * An error from sbwait usually indicates that we've 820 * been interrupted by a signal. If we've sent anything 821 * then return bytes sent, otherwise return the error. 822 */ 823 if (error != 0) { 824 SOCKBUF_UNLOCK(&so->so_snd); 825 goto done; 826 } 827 goto retry_space; 828 } 829 SOCKBUF_UNLOCK(&so->so_snd); 830 831 /* 832 * At the beginning of the first loop check if any headers 833 * are specified and copy them into mbufs. Reduce space in 834 * the socket buffer by the size of the header mbuf chain. 835 * Clear hdr_uio here and hdrlen at the end of the first loop. 836 */ 837 if (hdr_uio != NULL && hdr_uio->uio_resid > 0) { 838 hdr_uio->uio_td = td; 839 hdr_uio->uio_rw = UIO_WRITE; 840 #ifdef KERN_TLS 841 if (tls != NULL) 842 mh = m_uiotombuf(hdr_uio, M_WAITOK, space, 843 tls->params.max_frame_len, M_EXTPG); 844 else 845 #endif 846 mh = m_uiotombuf(hdr_uio, M_WAITOK, 847 space, 0, 0); 848 hdrlen = m_length(mh, &mhtail); 849 space -= hdrlen; 850 /* 851 * If header consumed all the socket buffer space, 852 * don't waste CPU cycles and jump to the end. 853 */ 854 if (space == 0) { 855 sfio = NULL; 856 nios = 0; 857 goto prepend_header; 858 } 859 hdr_uio = NULL; 860 } 861 862 if (vp != NULL) { 863 error = vn_lock(vp, LK_SHARED); 864 if (error != 0) 865 goto done; 866 867 /* 868 * Check to see if the file size has changed. 869 */ 870 if (obj->type == OBJT_VNODE) { 871 VM_OBJECT_RLOCK(obj); 872 nobj_size = obj->un_pager.vnp.vnp_size; 873 VM_OBJECT_RUNLOCK(obj); 874 } else { 875 error = VOP_GETATTR(vp, &va, td->td_ucred); 876 if (error != 0) { 877 VOP_UNLOCK(vp); 878 goto done; 879 } 880 nobj_size = va.va_size; 881 } 882 if (off >= nobj_size) { 883 VOP_UNLOCK(vp); 884 goto done; 885 } 886 if (nobj_size != obj_size) { 887 obj_size = nobj_size; 888 rem = nbytes ? omin(nbytes + offset, obj_size) : 889 obj_size; 890 rem -= off; 891 } 892 } 893 894 if (space > rem) 895 space = rem; 896 else if (space > PAGE_SIZE) { 897 /* 898 * Use page boundaries when possible for large 899 * requests. 900 */ 901 if (off & PAGE_MASK) 902 space -= (PAGE_SIZE - (off & PAGE_MASK)); 903 space = trunc_page(space); 904 if (off & PAGE_MASK) 905 space += (PAGE_SIZE - (off & PAGE_MASK)); 906 } 907 908 npages = howmany(space + (off & PAGE_MASK), PAGE_SIZE); 909 910 /* 911 * Calculate maximum allowed number of pages for readahead 912 * at this iteration. If SF_USER_READAHEAD was set, we don't 913 * do any heuristics and use exactly the value supplied by 914 * application. Otherwise, we allow readahead up to "rem". 915 * If application wants more, let it be, but there is no 916 * reason to go above maxphys. Also check against "obj_size", 917 * since vm_pager_has_page() can hint beyond EOF. 918 */ 919 if (flags & SF_USER_READAHEAD) { 920 rhpages = SF_READAHEAD(flags); 921 } else { 922 rhpages = howmany(rem + (off & PAGE_MASK), PAGE_SIZE) - 923 npages; 924 rhpages += SF_READAHEAD(flags); 925 } 926 rhpages = min(howmany(maxphys, PAGE_SIZE), rhpages); 927 rhpages = min(howmany(obj_size - trunc_page(off), PAGE_SIZE) - 928 npages, rhpages); 929 930 sfio = malloc(sizeof(struct sf_io) + 931 npages * sizeof(vm_page_t), M_SENDFILE, M_WAITOK); 932 refcount_init(&sfio->nios, 1); 933 sfio->obj = obj; 934 sfio->error = 0; 935 sfio->m = NULL; 936 sfio->npages = npages; 937 #ifdef KERN_TLS 938 /* 939 * This doesn't use ktls_hold() because sfio->m will 940 * also have a reference on 'tls' that will be valid 941 * for all of sfio's lifetime. 942 */ 943 sfio->tls = tls; 944 #endif 945 vm_object_pip_add(obj, 1); 946 error = sendfile_swapin(obj, sfio, &nios, off, space, rhpages, 947 flags); 948 if (error != 0) { 949 if (vp != NULL) 950 VOP_UNLOCK(vp); 951 sendfile_iodone(sfio, NULL, 0, error); 952 goto done; 953 } 954 955 /* 956 * Loop and construct maximum sized mbuf chain to be bulk 957 * dumped into socket buffer. 958 */ 959 pa = sfio->pa; 960 961 /* 962 * Use unmapped mbufs if enabled for TCP. Unmapped 963 * bufs are restricted to TCP as that is what has been 964 * tested. In particular, unmapped mbufs have not 965 * been tested with UNIX-domain sockets. 966 * 967 * TLS frames always require unmapped mbufs. 968 */ 969 if ((mb_use_ext_pgs && 970 so->so_proto->pr_protocol == IPPROTO_TCP) 971 #ifdef KERN_TLS 972 || tls != NULL 973 #endif 974 ) { 975 use_ext_pgs = true; 976 #ifdef KERN_TLS 977 if (tls != NULL) 978 max_pgs = num_pages(tls->params.max_frame_len); 979 else 980 #endif 981 max_pgs = MBUF_PEXT_MAX_PGS; 982 983 /* Start at last index, to wrap on first use. */ 984 ext_pgs_idx = max_pgs - 1; 985 } 986 987 for (int i = 0; i < npages; i++) { 988 /* 989 * If a page wasn't grabbed successfully, then 990 * trim the array. Can happen only with SF_NODISKIO. 991 */ 992 if (pa[i] == NULL) { 993 SFSTAT_INC(sf_busy); 994 fixspace(npages, i, off, &space); 995 sfio->npages = i; 996 softerr = EBUSY; 997 break; 998 } 999 pga = pa[i]; 1000 if (pga == bogus_page) 1001 pga = vm_page_relookup(obj, sfio->pindex0 + i); 1002 1003 if (use_ext_pgs) { 1004 off_t xfs; 1005 1006 ext_pgs_idx++; 1007 if (ext_pgs_idx == max_pgs) { 1008 m0 = mb_alloc_ext_pgs(M_WAITOK, 1009 sendfile_free_mext_pg); 1010 1011 if (flags & SF_NOCACHE) { 1012 m0->m_ext.ext_flags |= 1013 EXT_FLAG_NOCACHE; 1014 1015 /* 1016 * See comment below regarding 1017 * ignoring SF_NOCACHE for the 1018 * last page. 1019 */ 1020 if ((npages - i <= max_pgs) && 1021 ((off + space) & PAGE_MASK) && 1022 (rem > space || rhpages > 0)) 1023 m0->m_ext.ext_flags |= 1024 EXT_FLAG_CACHE_LAST; 1025 } 1026 if (sfs != NULL) { 1027 m0->m_ext.ext_flags |= 1028 EXT_FLAG_SYNC; 1029 m0->m_ext.ext_arg1 = sfs; 1030 mtx_lock(&sfs->mtx); 1031 sfs->count++; 1032 mtx_unlock(&sfs->mtx); 1033 } 1034 ext_pgs_idx = 0; 1035 1036 /* Append to mbuf chain. */ 1037 if (mtail != NULL) 1038 mtail->m_next = m0; 1039 else 1040 m = m0; 1041 mtail = m0; 1042 m0->m_epg_1st_off = 1043 vmoff(i, off) & PAGE_MASK; 1044 } 1045 if (nios) { 1046 mtail->m_flags |= M_NOTREADY; 1047 m0->m_epg_nrdy++; 1048 } 1049 1050 m0->m_epg_pa[ext_pgs_idx] = VM_PAGE_TO_PHYS(pga); 1051 m0->m_epg_npgs++; 1052 xfs = xfsize(i, npages, off, space); 1053 m0->m_epg_last_len = xfs; 1054 MBUF_EXT_PGS_ASSERT_SANITY(m0); 1055 mtail->m_len += xfs; 1056 mtail->m_ext.ext_size += PAGE_SIZE; 1057 continue; 1058 } 1059 1060 /* 1061 * Get a sendfile buf. When allocating the 1062 * first buffer for mbuf chain, we usually 1063 * wait as long as necessary, but this wait 1064 * can be interrupted. For consequent 1065 * buffers, do not sleep, since several 1066 * threads might exhaust the buffers and then 1067 * deadlock. 1068 */ 1069 sf = sf_buf_alloc(pga, 1070 m != NULL ? SFB_NOWAIT : SFB_CATCH); 1071 if (sf == NULL) { 1072 SFSTAT_INC(sf_allocfail); 1073 sendfile_iowait(sfio, "sfnosf"); 1074 for (int j = i; j < npages; j++) { 1075 vm_page_unwire(pa[j], PQ_INACTIVE); 1076 pa[j] = NULL; 1077 } 1078 if (m == NULL) 1079 softerr = ENOBUFS; 1080 fixspace(npages, i, off, &space); 1081 sfio->npages = i; 1082 break; 1083 } 1084 1085 m0 = m_get(M_WAITOK, MT_DATA); 1086 m0->m_ext.ext_buf = (char *)sf_buf_kva(sf); 1087 m0->m_ext.ext_size = PAGE_SIZE; 1088 m0->m_ext.ext_arg1 = sf; 1089 m0->m_ext.ext_type = EXT_SFBUF; 1090 m0->m_ext.ext_flags = EXT_FLAG_EMBREF; 1091 m0->m_ext.ext_free = sendfile_free_mext; 1092 /* 1093 * SF_NOCACHE sets the page as being freed upon send. 1094 * However, we ignore it for the last page in 'space', 1095 * if the page is truncated, and we got more data to 1096 * send (rem > space), or if we have readahead 1097 * configured (rhpages > 0). 1098 */ 1099 if ((flags & SF_NOCACHE) && 1100 (i != npages - 1 || 1101 !((off + space) & PAGE_MASK) || 1102 !(rem > space || rhpages > 0))) 1103 m0->m_ext.ext_flags |= EXT_FLAG_NOCACHE; 1104 if (sfs != NULL) { 1105 m0->m_ext.ext_flags |= EXT_FLAG_SYNC; 1106 m0->m_ext.ext_arg2 = sfs; 1107 mtx_lock(&sfs->mtx); 1108 sfs->count++; 1109 mtx_unlock(&sfs->mtx); 1110 } 1111 m0->m_ext.ext_count = 1; 1112 m0->m_flags |= (M_EXT | M_RDONLY); 1113 if (nios) 1114 m0->m_flags |= M_NOTREADY; 1115 m0->m_data = (char *)sf_buf_kva(sf) + 1116 (vmoff(i, off) & PAGE_MASK); 1117 m0->m_len = xfsize(i, npages, off, space); 1118 1119 /* Append to mbuf chain. */ 1120 if (mtail != NULL) 1121 mtail->m_next = m0; 1122 else 1123 m = m0; 1124 mtail = m0; 1125 } 1126 1127 if (vp != NULL) 1128 VOP_UNLOCK(vp); 1129 1130 /* Keep track of bytes processed. */ 1131 off += space; 1132 rem -= space; 1133 1134 /* 1135 * Prepend header, if any. Save pointer to first mbuf 1136 * with a page. 1137 */ 1138 if (hdrlen) { 1139 prepend_header: 1140 m0 = mhtail->m_next = m; 1141 m = mh; 1142 mh = NULL; 1143 } else 1144 m0 = m; 1145 1146 if (m == NULL) { 1147 KASSERT(softerr, ("%s: m NULL, no error", __func__)); 1148 error = softerr; 1149 sendfile_iodone(sfio, NULL, 0, 0); 1150 goto done; 1151 } 1152 1153 /* Add the buffer chain to the socket buffer. */ 1154 KASSERT(m_length(m, NULL) == space + hdrlen, 1155 ("%s: mlen %u space %d hdrlen %d", 1156 __func__, m_length(m, NULL), space, hdrlen)); 1157 1158 CURVNET_SET(so->so_vnet); 1159 #ifdef KERN_TLS 1160 if (tls != NULL) 1161 ktls_frame(m, tls, &tls_enq_cnt, TLS_RLTYPE_APP); 1162 #endif 1163 if (nios == 0) { 1164 /* 1165 * If sendfile_swapin() didn't initiate any I/Os, 1166 * which happens if all data is cached in VM, or if 1167 * the header consumed all socket buffer space and 1168 * sfio is NULL, then we can send data right now 1169 * without the PRUS_NOTREADY flag. 1170 */ 1171 if (sfio != NULL) 1172 sendfile_iodone(sfio, NULL, 0, 0); 1173 #ifdef KERN_TLS 1174 if (tls != NULL && tls->mode == TCP_TLS_MODE_SW) { 1175 error = (*so->so_proto->pr_usrreqs->pru_send) 1176 (so, PRUS_NOTREADY, m, NULL, NULL, td); 1177 if (error != 0) { 1178 m_freem(m); 1179 } else { 1180 soref(so); 1181 ktls_enqueue(m, so, tls_enq_cnt); 1182 } 1183 } else 1184 #endif 1185 error = (*so->so_proto->pr_usrreqs->pru_send) 1186 (so, 0, m, NULL, NULL, td); 1187 } else { 1188 sfio->so = so; 1189 sfio->m = m0; 1190 soref(so); 1191 error = (*so->so_proto->pr_usrreqs->pru_send) 1192 (so, PRUS_NOTREADY, m, NULL, NULL, td); 1193 sendfile_iodone(sfio, NULL, 0, error); 1194 } 1195 CURVNET_RESTORE(); 1196 1197 m = NULL; 1198 if (error) 1199 goto done; 1200 sbytes += space + hdrlen; 1201 if (hdrlen) 1202 hdrlen = 0; 1203 if (softerr) { 1204 error = softerr; 1205 goto done; 1206 } 1207 } 1208 1209 /* 1210 * Send trailers. Wimp out and use writev(2). 1211 */ 1212 if (trl_uio != NULL) { 1213 SOCK_IO_SEND_UNLOCK(so); 1214 error = kern_writev(td, sockfd, trl_uio); 1215 if (error == 0) 1216 sbytes += td->td_retval[0]; 1217 goto out; 1218 } 1219 1220 done: 1221 SOCK_IO_SEND_UNLOCK(so); 1222 out: 1223 /* 1224 * If there was no error we have to clear td->td_retval[0] 1225 * because it may have been set by writev. 1226 */ 1227 if (error == 0) { 1228 td->td_retval[0] = 0; 1229 } 1230 if (sent != NULL) { 1231 (*sent) = sbytes; 1232 } 1233 if (obj != NULL) 1234 vm_object_deallocate(obj); 1235 if (so) 1236 fdrop(sock_fp, td); 1237 if (m) 1238 m_freem(m); 1239 if (mh) 1240 m_freem(mh); 1241 1242 if (sfs != NULL) { 1243 mtx_lock(&sfs->mtx); 1244 if (sfs->count != 0) 1245 error = cv_wait_sig(&sfs->cv, &sfs->mtx); 1246 if (sfs->count == 0) { 1247 sendfile_sync_destroy(sfs); 1248 } else { 1249 sfs->waiting = false; 1250 mtx_unlock(&sfs->mtx); 1251 } 1252 } 1253 #ifdef KERN_TLS 1254 if (tls != NULL) 1255 ktls_free(tls); 1256 #endif 1257 1258 if (error == ERESTART) 1259 error = EINTR; 1260 1261 return (error); 1262 } 1263 1264 static int 1265 sendfile(struct thread *td, struct sendfile_args *uap, int compat) 1266 { 1267 struct sf_hdtr hdtr; 1268 struct uio *hdr_uio, *trl_uio; 1269 struct file *fp; 1270 off_t sbytes; 1271 int error; 1272 1273 /* 1274 * File offset must be positive. If it goes beyond EOF 1275 * we send only the header/trailer and no payload data. 1276 */ 1277 if (uap->offset < 0) 1278 return (EINVAL); 1279 1280 sbytes = 0; 1281 hdr_uio = trl_uio = NULL; 1282 1283 if (uap->hdtr != NULL) { 1284 error = copyin(uap->hdtr, &hdtr, sizeof(hdtr)); 1285 if (error != 0) 1286 goto out; 1287 if (hdtr.headers != NULL) { 1288 error = copyinuio(hdtr.headers, hdtr.hdr_cnt, 1289 &hdr_uio); 1290 if (error != 0) 1291 goto out; 1292 #ifdef COMPAT_FREEBSD4 1293 /* 1294 * In FreeBSD < 5.0 the nbytes to send also included 1295 * the header. If compat is specified subtract the 1296 * header size from nbytes. 1297 */ 1298 if (compat) { 1299 if (uap->nbytes > hdr_uio->uio_resid) 1300 uap->nbytes -= hdr_uio->uio_resid; 1301 else 1302 uap->nbytes = 0; 1303 } 1304 #endif 1305 } 1306 if (hdtr.trailers != NULL) { 1307 error = copyinuio(hdtr.trailers, hdtr.trl_cnt, 1308 &trl_uio); 1309 if (error != 0) 1310 goto out; 1311 } 1312 } 1313 1314 AUDIT_ARG_FD(uap->fd); 1315 1316 /* 1317 * sendfile(2) can start at any offset within a file so we require 1318 * CAP_READ+CAP_SEEK = CAP_PREAD. 1319 */ 1320 if ((error = fget_read(td, uap->fd, &cap_pread_rights, &fp)) != 0) 1321 goto out; 1322 1323 error = fo_sendfile(fp, uap->s, hdr_uio, trl_uio, uap->offset, 1324 uap->nbytes, &sbytes, uap->flags, td); 1325 fdrop(fp, td); 1326 1327 if (uap->sbytes != NULL) 1328 copyout(&sbytes, uap->sbytes, sizeof(off_t)); 1329 1330 out: 1331 free(hdr_uio, M_IOV); 1332 free(trl_uio, M_IOV); 1333 return (error); 1334 } 1335 1336 /* 1337 * sendfile(2) 1338 * 1339 * int sendfile(int fd, int s, off_t offset, size_t nbytes, 1340 * struct sf_hdtr *hdtr, off_t *sbytes, int flags) 1341 * 1342 * Send a file specified by 'fd' and starting at 'offset' to a socket 1343 * specified by 's'. Send only 'nbytes' of the file or until EOF if nbytes == 1344 * 0. Optionally add a header and/or trailer to the socket output. If 1345 * specified, write the total number of bytes sent into *sbytes. 1346 */ 1347 int 1348 sys_sendfile(struct thread *td, struct sendfile_args *uap) 1349 { 1350 1351 return (sendfile(td, uap, 0)); 1352 } 1353 1354 #ifdef COMPAT_FREEBSD4 1355 int 1356 freebsd4_sendfile(struct thread *td, struct freebsd4_sendfile_args *uap) 1357 { 1358 struct sendfile_args args; 1359 1360 args.fd = uap->fd; 1361 args.s = uap->s; 1362 args.offset = uap->offset; 1363 args.nbytes = uap->nbytes; 1364 args.hdtr = uap->hdtr; 1365 args.sbytes = uap->sbytes; 1366 args.flags = uap->flags; 1367 1368 return (sendfile(td, &args, 1)); 1369 } 1370 #endif /* COMPAT_FREEBSD4 */ 1371