1/*- 2 * Copyright (c) 2013-2015 Gleb Smirnoff <glebius@FreeBSD.org> 3 * Copyright (c) 1998, David Greenman. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the University nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30#include <sys/cdefs.h> 31#include "opt_kern_tls.h" 32 33#include <sys/param.h> 34#include <sys/systm.h> 35#include <sys/capsicum.h> 36#include <sys/kernel.h> 37#include <sys/lock.h> 38#include <sys/ktls.h> 39#include <sys/mutex.h> 40#include <sys/malloc.h> 41#include <sys/mman.h> 42#include <sys/mount.h> 43#include <sys/mbuf.h> 44#include <sys/proc.h> 45#include <sys/protosw.h> 46#include <sys/rwlock.h> 47#include <sys/sf_buf.h> 48#include <sys/socket.h> 49#include <sys/socketvar.h> 50#include <sys/syscallsubr.h> 51#include <sys/sysctl.h> 52#include <sys/sysproto.h> 53#include <sys/vnode.h> 54 55#include <net/vnet.h> 56#include <netinet/in.h> 57#include <netinet/tcp.h> 58#include <netinet/in_pcb.h> 59#include <netinet/tcp_var.h> 60#include <netinet/tcp_log_buf.h> 61 62#include <security/audit/audit.h> 63#include <security/mac/mac_framework.h> 64 65#include <vm/vm.h> 66#include <vm/vm_object.h> 67#include <vm/vm_pager.h> 68 69static MALLOC_DEFINE(M_SENDFILE, "sendfile", "sendfile dynamic memory"); 70 71#define EXT_FLAG_SYNC EXT_FLAG_VENDOR1 72#define EXT_FLAG_NOCACHE EXT_FLAG_VENDOR2 73#define EXT_FLAG_CACHE_LAST EXT_FLAG_VENDOR3 74 75/* 76 * Structure describing a single sendfile(2) I/O, which may consist of 77 * several underlying pager I/Os. 78 * 79 * The syscall context allocates the structure and initializes 'nios' 80 * to 1. As sendfile_swapin() runs through pages and starts asynchronous 81 * paging operations, it increments 'nios'. 82 * 83 * Every I/O completion calls sendfile_iodone(), which decrements the 'nios', 84 * and the syscall also calls sendfile_iodone() after allocating all mbufs, 85 * linking them and sending to socket. Whoever reaches zero 'nios' is 86 * responsible to * call pru_ready on the socket, to notify it of readyness 87 * of the data. 88 */ 89struct sf_io { 90 volatile u_int nios; 91 u_int error; 92 int npages; 93 struct socket *so; 94 struct mbuf *m; 95 vm_object_t obj; 96 vm_pindex_t pindex0; 97#ifdef KERN_TLS 98 struct ktls_session *tls; 99#endif 100 vm_page_t pa[]; 101}; 102 103/* 104 * Structure used to track requests with SF_SYNC flag. 105 */ 106struct sendfile_sync { 107 struct mtx mtx; 108 struct cv cv; 109 unsigned count; 110 bool waiting; 111}; 112 113static void 114sendfile_sync_destroy(struct sendfile_sync *sfs) 115{ 116 KASSERT(sfs->count == 0, ("sendfile sync %p still busy", sfs)); 117 118 cv_destroy(&sfs->cv); 119 mtx_destroy(&sfs->mtx); 120 free(sfs, M_SENDFILE); 121} 122 123static void 124sendfile_sync_signal(struct sendfile_sync *sfs) 125{ 126 mtx_lock(&sfs->mtx); 127 KASSERT(sfs->count > 0, ("sendfile sync %p not busy", sfs)); 128 if (--sfs->count == 0) { 129 if (!sfs->waiting) { 130 /* The sendfile() waiter was interrupted by a signal. */ 131 sendfile_sync_destroy(sfs); 132 return; 133 } else { 134 cv_signal(&sfs->cv); 135 } 136 } 137 mtx_unlock(&sfs->mtx); 138} 139 140counter_u64_t sfstat[sizeof(struct sfstat) / sizeof(uint64_t)]; 141 142static void 143sfstat_init(const void *unused) 144{ 145 146 COUNTER_ARRAY_ALLOC(sfstat, sizeof(struct sfstat) / sizeof(uint64_t), 147 M_WAITOK); 148} 149SYSINIT(sfstat, SI_SUB_MBUF, SI_ORDER_FIRST, sfstat_init, NULL); 150 151static int 152sfstat_sysctl(SYSCTL_HANDLER_ARGS) 153{ 154 struct sfstat s; 155 156 COUNTER_ARRAY_COPY(sfstat, &s, sizeof(s) / sizeof(uint64_t)); 157 if (req->newptr) 158 COUNTER_ARRAY_ZERO(sfstat, sizeof(s) / sizeof(uint64_t)); 159 return (SYSCTL_OUT(req, &s, sizeof(s))); 160} 161SYSCTL_PROC(_kern_ipc, OID_AUTO, sfstat, 162 CTLTYPE_OPAQUE | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, 0, 163 sfstat_sysctl, "I", 164 "sendfile statistics"); 165 166static void 167sendfile_free_mext(struct mbuf *m) 168{ 169 struct sf_buf *sf; 170 vm_page_t pg; 171 int flags; 172 173 KASSERT(m->m_flags & M_EXT && m->m_ext.ext_type == EXT_SFBUF, 174 ("%s: m %p !M_EXT or !EXT_SFBUF", __func__, m)); 175 176 sf = m->m_ext.ext_arg1; 177 pg = sf_buf_page(sf); 178 flags = (m->m_ext.ext_flags & EXT_FLAG_NOCACHE) != 0 ? VPR_TRYFREE : 0; 179 180 sf_buf_free(sf); 181 vm_page_release(pg, flags); 182 183 if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { 184 struct sendfile_sync *sfs = m->m_ext.ext_arg2; 185 sendfile_sync_signal(sfs); 186 } 187} 188 189static void 190sendfile_free_mext_pg(struct mbuf *m) 191{ 192 vm_page_t pg; 193 int flags, i; 194 bool cache_last; 195 196 M_ASSERTEXTPG(m); 197 198 cache_last = m->m_ext.ext_flags & EXT_FLAG_CACHE_LAST; 199 flags = (m->m_ext.ext_flags & EXT_FLAG_NOCACHE) != 0 ? VPR_TRYFREE : 0; 200 201 for (i = 0; i < m->m_epg_npgs; i++) { 202 if (cache_last && i == m->m_epg_npgs - 1) 203 flags = 0; 204 pg = PHYS_TO_VM_PAGE(m->m_epg_pa[i]); 205 vm_page_release(pg, flags); 206 } 207 208 if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { 209 struct sendfile_sync *sfs = m->m_ext.ext_arg1; 210 sendfile_sync_signal(sfs); 211 } 212} 213 214/* 215 * Helper function to calculate how much data to put into page i of n. 216 * Only first and last pages are special. 217 */ 218static inline off_t 219xfsize(int i, int n, off_t off, off_t len) 220{ 221 222 if (i == 0) 223 return (omin(PAGE_SIZE - (off & PAGE_MASK), len)); 224 225 if (i == n - 1 && ((off + len) & PAGE_MASK) > 0) 226 return ((off + len) & PAGE_MASK); 227 228 return (PAGE_SIZE); 229} 230 231/* 232 * Helper function to get offset within object for i page. 233 */ 234static inline vm_ooffset_t 235vmoff(int i, off_t off) 236{ 237 238 if (i == 0) 239 return ((vm_ooffset_t)off); 240 241 return (trunc_page(off + i * PAGE_SIZE)); 242} 243 244/* 245 * Helper function used when allocation of a page or sf_buf failed. 246 * Pretend as if we don't have enough space, subtract xfsize() of 247 * all pages that failed. 248 */ 249static inline void 250fixspace(int old, int new, off_t off, int *space) 251{ 252 253 KASSERT(old > new, ("%s: old %d new %d", __func__, old, new)); 254 255 /* Subtract last one. */ 256 *space -= xfsize(old - 1, old, off, *space); 257 old--; 258 259 if (new == old) 260 /* There was only one page. */ 261 return; 262 263 /* Subtract first one. */ 264 if (new == 0) { 265 *space -= xfsize(0, old, off, *space); 266 new++; 267 } 268 269 /* Rest of pages are full sized. */ 270 *space -= (old - new) * PAGE_SIZE; 271 272 KASSERT(*space >= 0, ("%s: space went backwards", __func__)); 273} 274 275/* 276 * Wait for all in-flight ios to complete, we must not unwire pages 277 * under them. 278 */ 279static void 280sendfile_iowait(struct sf_io *sfio, const char *wmesg) 281{ 282 while (atomic_load_int(&sfio->nios) != 1) 283 pause(wmesg, 1); 284} 285 286/* 287 * I/O completion callback. 288 */ 289static void 290sendfile_iodone(void *arg, vm_page_t *pa, int count, int error) 291{ 292 struct sf_io *sfio = arg; 293 struct socket *so; 294 int i; 295 296 if (error != 0) 297 sfio->error = error; 298 299 /* 300 * Restore the valid page pointers. They are already 301 * unbusied, but still wired. 302 * 303 * XXXKIB since pages are only wired, and we do not 304 * own the object lock, other users might have 305 * invalidated them in meantime. Similarly, after we 306 * unbusied the swapped-in pages, they can become 307 * invalid under us. 308 */ 309 MPASS(count == 0 || pa[0] != bogus_page); 310 for (i = 0; i < count; i++) { 311 if (pa[i] == bogus_page) { 312 sfio->pa[(pa[0]->pindex - sfio->pindex0) + i] = 313 pa[i] = vm_page_relookup(sfio->obj, 314 pa[0]->pindex + i); 315 KASSERT(pa[i] != NULL, 316 ("%s: page %p[%d] disappeared", 317 __func__, pa, i)); 318 } else { 319 vm_page_xunbusy_unchecked(pa[i]); 320 } 321 } 322 323 if (!refcount_release(&sfio->nios)) 324 return; 325 326#ifdef INVARIANTS 327 for (i = 1; i < sfio->npages; i++) { 328 if (sfio->pa[i] == NULL) 329 break; 330 KASSERT(vm_page_wired(sfio->pa[i]), 331 ("sfio %p page %d %p not wired", sfio, i, sfio->pa[i])); 332 if (i == 0) 333 continue; 334 KASSERT(sfio->pa[0]->object == sfio->pa[i]->object, 335 ("sfio %p page %d %p wrong owner %p %p", sfio, i, 336 sfio->pa[i], sfio->pa[0]->object, sfio->pa[i]->object)); 337 KASSERT(sfio->pa[0]->pindex + i == sfio->pa[i]->pindex, 338 ("sfio %p page %d %p wrong index %jx %jx", sfio, i, 339 sfio->pa[i], (uintmax_t)sfio->pa[0]->pindex, 340 (uintmax_t)sfio->pa[i]->pindex)); 341 } 342#endif 343 344 vm_object_pip_wakeup(sfio->obj); 345 346 if (sfio->m == NULL) { 347 /* 348 * Either I/O operation failed, or we failed to allocate 349 * buffers, or we bailed out on first busy page, or we 350 * succeeded filling the request without any I/Os. Anyway, 351 * pru_send hadn't been executed - nothing had been sent 352 * to the socket yet. 353 */ 354 MPASS((curthread->td_pflags & TDP_KTHREAD) == 0); 355 free(sfio, M_SENDFILE); 356 return; 357 } 358 359#if defined(KERN_TLS) && defined(INVARIANTS) 360 if ((sfio->m->m_flags & M_EXTPG) != 0) 361 KASSERT(sfio->tls == sfio->m->m_epg_tls, 362 ("TLS session mismatch")); 363 else 364 KASSERT(sfio->tls == NULL, 365 ("non-ext_pgs mbuf with TLS session")); 366#endif 367 so = sfio->so; 368 CURVNET_SET(so->so_vnet); 369 if (__predict_false(sfio->error)) { 370 /* 371 * I/O operation failed. The state of data in the socket 372 * is now inconsistent, and all what we can do is to tear 373 * it down. Protocol abort method would tear down protocol 374 * state, free all ready mbufs and detach not ready ones. 375 * We will free the mbufs corresponding to this I/O manually. 376 * 377 * The socket would be marked with EIO and made available 378 * for read, so that application receives EIO on next 379 * syscall and eventually closes the socket. 380 */ 381 so->so_proto->pr_abort(so); 382 so->so_error = EIO; 383 384 mb_free_notready(sfio->m, sfio->npages); 385#ifdef KERN_TLS 386 } else if (sfio->tls != NULL && sfio->tls->mode == TCP_TLS_MODE_SW) { 387 /* 388 * I/O operation is complete, but we still need to 389 * encrypt. We cannot do this in the interrupt thread 390 * of the disk controller, so forward the mbufs to a 391 * different thread. 392 * 393 * Donate the socket reference from sfio to rather 394 * than explicitly invoking soref(). 395 */ 396 ktls_enqueue(sfio->m, so, sfio->npages); 397 goto out_with_ref; 398#endif 399 } else 400 (void)so->so_proto->pr_ready(so, sfio->m, sfio->npages); 401 402 sorele(so); 403#ifdef KERN_TLS 404out_with_ref: 405#endif 406 CURVNET_RESTORE(); 407 free(sfio, M_SENDFILE); 408} 409 410/* 411 * Iterate through pages vector and request paging for non-valid pages. 412 */ 413static int 414sendfile_swapin(vm_object_t obj, struct sf_io *sfio, int *nios, off_t off, 415 off_t len, int rhpages, int flags) 416{ 417 vm_page_t *pa; 418 int a, count, count1, grabbed, i, j, npages, rv; 419 420 pa = sfio->pa; 421 npages = sfio->npages; 422 *nios = 0; 423 flags = (flags & SF_NODISKIO) ? VM_ALLOC_NOWAIT : 0; 424 sfio->pindex0 = OFF_TO_IDX(off); 425 426 /* 427 * First grab all the pages and wire them. Note that we grab 428 * only required pages. Readahead pages are dealt with later. 429 */ 430 grabbed = vm_page_grab_pages_unlocked(obj, OFF_TO_IDX(off), 431 VM_ALLOC_NORMAL | VM_ALLOC_WIRED | flags, pa, npages); 432 if (grabbed < npages) { 433 for (int i = grabbed; i < npages; i++) 434 pa[i] = NULL; 435 npages = grabbed; 436 rhpages = 0; 437 } 438 439 for (i = 0; i < npages;) { 440 /* Skip valid pages. */ 441 if (vm_page_is_valid(pa[i], vmoff(i, off) & PAGE_MASK, 442 xfsize(i, npages, off, len))) { 443 vm_page_xunbusy(pa[i]); 444 SFSTAT_INC(sf_pages_valid); 445 i++; 446 continue; 447 } 448 449 /* 450 * Next page is invalid. Check if it belongs to pager. It 451 * may not be there, which is a regular situation for shmem 452 * pager. For vnode pager this happens only in case of 453 * a sparse file. 454 * 455 * Important feature of vm_pager_has_page() is the hint 456 * stored in 'a', about how many pages we can pagein after 457 * this page in a single I/O. 458 */ 459 VM_OBJECT_RLOCK(obj); 460 if (!vm_pager_has_page(obj, OFF_TO_IDX(vmoff(i, off)), NULL, 461 &a)) { 462 VM_OBJECT_RUNLOCK(obj); 463 pmap_zero_page(pa[i]); 464 vm_page_valid(pa[i]); 465 MPASS(pa[i]->dirty == 0); 466 vm_page_xunbusy(pa[i]); 467 i++; 468 continue; 469 } 470 VM_OBJECT_RUNLOCK(obj); 471 472 /* 473 * We want to pagein as many pages as possible, limited only 474 * by the 'a' hint and actual request. 475 */ 476 count = min(a + 1, npages - i); 477 478 /* 479 * We should not pagein into a valid page because 480 * there might be still unfinished write tracked by 481 * e.g. a buffer, thus we substitute any valid pages 482 * with the bogus one. 483 * 484 * We must not leave around xbusy pages which are not 485 * part of the run passed to vm_pager_getpages(), 486 * otherwise pager might deadlock waiting for the busy 487 * status of the page, e.g. if it constitues the 488 * buffer needed to validate other page. 489 * 490 * First trim the end of the run consisting of the 491 * valid pages, then replace the rest of the valid 492 * with bogus. 493 */ 494 count1 = count; 495 for (j = i + count - 1; j > i; j--) { 496 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 497 xfsize(j, npages, off, len))) { 498 vm_page_xunbusy(pa[j]); 499 SFSTAT_INC(sf_pages_valid); 500 count--; 501 } else { 502 break; 503 } 504 } 505 506 /* 507 * The last page in the run pa[i + count - 1] is 508 * guaranteed to be invalid by the trim above, so it 509 * is not replaced with bogus, thus -1 in the loop end 510 * condition. 511 */ 512 MPASS(pa[i + count - 1]->valid != VM_PAGE_BITS_ALL); 513 for (j = i + 1; j < i + count - 1; j++) { 514 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 515 xfsize(j, npages, off, len))) { 516 vm_page_xunbusy(pa[j]); 517 SFSTAT_INC(sf_pages_valid); 518 SFSTAT_INC(sf_pages_bogus); 519 pa[j] = bogus_page; 520 } 521 } 522 523 refcount_acquire(&sfio->nios); 524 rv = vm_pager_get_pages_async(obj, pa + i, count, NULL, 525 i + count == npages ? &rhpages : NULL, 526 &sendfile_iodone, sfio); 527 if (__predict_false(rv != VM_PAGER_OK)) { 528 sendfile_iowait(sfio, "sferrio"); 529 530 /* 531 * Do remaining pages recovery before returning EIO. 532 * Pages from 0 to npages are wired. 533 * Pages from (i + count1) to npages are busied. 534 */ 535 for (j = 0; j < npages; j++) { 536 if (j >= i + count1) 537 vm_page_xunbusy(pa[j]); 538 KASSERT(pa[j] != NULL && pa[j] != bogus_page, 539 ("%s: page %p[%d] I/O recovery failure", 540 __func__, pa, j)); 541 vm_page_unwire(pa[j], PQ_INACTIVE); 542 pa[j] = NULL; 543 } 544 return (EIO); 545 } 546 547 SFSTAT_INC(sf_iocnt); 548 SFSTAT_ADD(sf_pages_read, count); 549 if (i + count == npages) 550 SFSTAT_ADD(sf_rhpages_read, rhpages); 551 552 i += count1; 553 (*nios)++; 554 } 555 556 if (*nios == 0 && npages != 0) 557 SFSTAT_INC(sf_noiocnt); 558 559 return (0); 560} 561 562static int 563sendfile_getobj(struct thread *td, struct file *fp, vm_object_t *obj_res, 564 struct vnode **vp_res, struct shmfd **shmfd_res, off_t *obj_size, 565 int *bsize) 566{ 567 vm_object_t obj; 568 struct vnode *vp; 569 struct shmfd *shmfd; 570 int error; 571 572 error = 0; 573 vp = *vp_res = NULL; 574 obj = NULL; 575 shmfd = *shmfd_res = NULL; 576 *bsize = 0; 577 578 /* 579 * The file descriptor must be a regular file and have a 580 * backing VM object. 581 */ 582 if (fp->f_type == DTYPE_VNODE) { 583 vp = fp->f_vnode; 584 vn_lock(vp, LK_SHARED | LK_RETRY); 585 if (vp->v_type != VREG) { 586 error = EINVAL; 587 goto out; 588 } 589 *bsize = vp->v_mount->mnt_stat.f_iosize; 590 obj = vp->v_object; 591 if (obj == NULL) { 592 error = EINVAL; 593 goto out; 594 } 595 596 /* 597 * Use the pager size when available to simplify synchronization 598 * with filesystems, which otherwise must atomically update both 599 * the vnode pager size and file size. 600 */ 601 if (obj->type == OBJT_VNODE) { 602 VM_OBJECT_RLOCK(obj); 603 *obj_size = obj->un_pager.vnp.vnp_size; 604 } else { 605 error = vn_getsize_locked(vp, obj_size, td->td_ucred); 606 if (error != 0) 607 goto out; 608 VM_OBJECT_RLOCK(obj); 609 } 610 } else if (fp->f_type == DTYPE_SHM) { 611 shmfd = fp->f_data; 612 obj = shmfd->shm_object; 613 VM_OBJECT_RLOCK(obj); 614 *obj_size = shmfd->shm_size; 615 } else { 616 error = EINVAL; 617 goto out; 618 } 619 620 if ((obj->flags & OBJ_DEAD) != 0) { 621 VM_OBJECT_RUNLOCK(obj); 622 error = EBADF; 623 goto out; 624 } 625 626 /* 627 * Temporarily increase the backing VM object's reference 628 * count so that a forced reclamation of its vnode does not 629 * immediately destroy it. 630 */ 631 vm_object_reference_locked(obj); 632 VM_OBJECT_RUNLOCK(obj); 633 *obj_res = obj; 634 *vp_res = vp; 635 *shmfd_res = shmfd; 636 637out: 638 if (vp != NULL) 639 VOP_UNLOCK(vp); 640 return (error); 641} 642 643static int 644sendfile_getsock(struct thread *td, int s, struct file **sock_fp, 645 struct socket **so) 646{ 647 int error; 648 649 *sock_fp = NULL; 650 *so = NULL; 651 652 /* 653 * The socket must be a stream socket and connected. 654 */ 655 error = getsock(td, s, &cap_send_rights, sock_fp); 656 if (error != 0) 657 return (error); 658 *so = (*sock_fp)->f_data; 659 if ((*so)->so_type != SOCK_STREAM) 660 return (EINVAL); 661 /* 662 * SCTP one-to-one style sockets currently don't work with 663 * sendfile(). So indicate EINVAL for now. 664 */ 665 if ((*so)->so_proto->pr_protocol == IPPROTO_SCTP) 666 return (EINVAL); 667 return (0); 668} 669 670int 671vn_sendfile(struct file *fp, int sockfd, struct uio *hdr_uio, 672 struct uio *trl_uio, off_t offset, size_t nbytes, off_t *sent, int flags, 673 struct thread *td) 674{ 675 struct file *sock_fp; 676 struct vnode *vp; 677 struct vm_object *obj; 678 vm_page_t pga; 679 struct socket *so; 680#ifdef KERN_TLS 681 struct ktls_session *tls; 682#endif 683 struct mbuf *m, *mh, *mhtail; 684 struct sf_buf *sf; 685 struct shmfd *shmfd; 686 struct sendfile_sync *sfs; 687 struct vattr va; 688 off_t off, sbytes, rem, obj_size, nobj_size; 689 int bsize, error, ext_pgs_idx, hdrlen, max_pgs, softerr; 690#ifdef KERN_TLS 691 int tls_enq_cnt; 692#endif 693 bool use_ext_pgs; 694 695 obj = NULL; 696 so = NULL; 697 m = mh = NULL; 698 sfs = NULL; 699#ifdef KERN_TLS 700 tls = NULL; 701#endif 702 hdrlen = sbytes = 0; 703 softerr = 0; 704 use_ext_pgs = false; 705 706 error = sendfile_getobj(td, fp, &obj, &vp, &shmfd, &obj_size, &bsize); 707 if (error != 0) 708 return (error); 709 710 error = sendfile_getsock(td, sockfd, &sock_fp, &so); 711 if (error != 0) 712 goto out; 713 714#ifdef MAC 715 error = mac_socket_check_send(td->td_ucred, so); 716 if (error != 0) 717 goto out; 718#endif 719 720 SFSTAT_INC(sf_syscalls); 721 SFSTAT_ADD(sf_rhpages_requested, SF_READAHEAD(flags)); 722 723 if (flags & SF_SYNC) { 724 sfs = malloc(sizeof(*sfs), M_SENDFILE, M_WAITOK | M_ZERO); 725 mtx_init(&sfs->mtx, "sendfile", NULL, MTX_DEF); 726 cv_init(&sfs->cv, "sendfile"); 727 sfs->waiting = true; 728 } 729 730 rem = nbytes ? omin(nbytes, obj_size - offset) : obj_size - offset; 731 732 /* 733 * Protect against multiple writers to the socket. 734 * 735 * XXXRW: Historically this has assumed non-interruptibility, so now 736 * we implement that, but possibly shouldn't. 737 */ 738 error = SOCK_IO_SEND_LOCK(so, SBL_WAIT | SBL_NOINTR); 739 if (error != 0) 740 goto out; 741#ifdef KERN_TLS 742 tls = ktls_hold(so->so_snd.sb_tls_info); 743#endif 744 745 /* 746 * Loop through the pages of the file, starting with the requested 747 * offset. Get a file page (do I/O if necessary), map the file page 748 * into an sf_buf, attach an mbuf header to the sf_buf, and queue 749 * it on the socket. 750 * This is done in two loops. The inner loop turns as many pages 751 * as it can, up to available socket buffer space, without blocking 752 * into mbufs to have it bulk delivered into the socket send buffer. 753 * The outer loop checks the state and available space of the socket 754 * and takes care of the overall progress. 755 */ 756 for (off = offset; rem > 0; ) { 757 struct sf_io *sfio; 758 vm_page_t *pa; 759 struct mbuf *m0, *mtail; 760 int nios, space, npages, rhpages; 761 762 mtail = NULL; 763 /* 764 * Check the socket state for ongoing connection, 765 * no errors and space in socket buffer. 766 * If space is low allow for the remainder of the 767 * file to be processed if it fits the socket buffer. 768 * Otherwise block in waiting for sufficient space 769 * to proceed, or if the socket is nonblocking, return 770 * to userland with EAGAIN while reporting how far 771 * we've come. 772 * We wait until the socket buffer has significant free 773 * space to do bulk sends. This makes good use of file 774 * system read ahead and allows packet segmentation 775 * offloading hardware to take over lots of work. If 776 * we were not careful here we would send off only one 777 * sfbuf at a time. 778 */ 779 SOCKBUF_LOCK(&so->so_snd); 780 if (so->so_snd.sb_lowat < so->so_snd.sb_hiwat / 2) 781 so->so_snd.sb_lowat = so->so_snd.sb_hiwat / 2; 782retry_space: 783 if (so->so_snd.sb_state & SBS_CANTSENDMORE) { 784 error = EPIPE; 785 SOCKBUF_UNLOCK(&so->so_snd); 786 goto done; 787 } else if (so->so_error) { 788 error = so->so_error; 789 so->so_error = 0; 790 SOCKBUF_UNLOCK(&so->so_snd); 791 goto done; 792 } 793 if ((so->so_state & SS_ISCONNECTED) == 0) { 794 SOCKBUF_UNLOCK(&so->so_snd); 795 error = ENOTCONN; 796 goto done; 797 } 798 799 space = sbspace(&so->so_snd); 800 if (space < rem && 801 (space <= 0 || 802 space < so->so_snd.sb_lowat)) { 803 if (so->so_state & SS_NBIO) { 804 SOCKBUF_UNLOCK(&so->so_snd); 805 error = EAGAIN; 806 goto done; 807 } 808 /* 809 * sbwait drops the lock while sleeping. 810 * When we loop back to retry_space the 811 * state may have changed and we retest 812 * for it. 813 */ 814 error = sbwait(so, SO_SND); 815 /* 816 * An error from sbwait usually indicates that we've 817 * been interrupted by a signal. If we've sent anything 818 * then return bytes sent, otherwise return the error. 819 */ 820 if (error != 0) { 821 SOCKBUF_UNLOCK(&so->so_snd); 822 goto done; 823 } 824 goto retry_space; 825 } 826 SOCKBUF_UNLOCK(&so->so_snd); 827 828 /* 829 * At the beginning of the first loop check if any headers 830 * are specified and copy them into mbufs. Reduce space in 831 * the socket buffer by the size of the header mbuf chain. 832 * Clear hdr_uio here and hdrlen at the end of the first loop. 833 */ 834 if (hdr_uio != NULL && hdr_uio->uio_resid > 0) { 835 hdr_uio->uio_td = td; 836 hdr_uio->uio_rw = UIO_WRITE; 837#ifdef KERN_TLS 838 if (tls != NULL) 839 mh = m_uiotombuf(hdr_uio, M_WAITOK, space, 840 tls->params.max_frame_len, M_EXTPG); 841 else 842#endif 843 mh = m_uiotombuf(hdr_uio, M_WAITOK, 844 space, 0, 0); 845 hdrlen = m_length(mh, &mhtail); 846 space -= hdrlen; 847 /* 848 * If header consumed all the socket buffer space, 849 * don't waste CPU cycles and jump to the end. 850 */ 851 if (space == 0) { 852 sfio = NULL; 853 nios = 0; 854 goto prepend_header; 855 } 856 hdr_uio = NULL; 857 } 858 859 if (vp != NULL) { 860 error = vn_lock(vp, LK_SHARED); 861 if (error != 0) 862 goto done; 863 864 /* 865 * Check to see if the file size has changed. 866 */ 867 if (obj->type == OBJT_VNODE) { 868 VM_OBJECT_RLOCK(obj); 869 nobj_size = obj->un_pager.vnp.vnp_size; 870 VM_OBJECT_RUNLOCK(obj); 871 } else { 872 error = VOP_GETATTR(vp, &va, td->td_ucred); 873 if (error != 0) { 874 VOP_UNLOCK(vp); 875 goto done; 876 } 877 nobj_size = va.va_size; 878 } 879 if (off >= nobj_size) { 880 VOP_UNLOCK(vp); 881 goto done; 882 } 883 if (nobj_size != obj_size) { 884 obj_size = nobj_size; 885 rem = nbytes ? omin(nbytes + offset, obj_size) : 886 obj_size; 887 rem -= off; 888 } 889 } 890 891 if (space > rem) 892 space = rem; 893 else if (space > PAGE_SIZE) { 894 /* 895 * Use page boundaries when possible for large 896 * requests. 897 */ 898 if (off & PAGE_MASK) 899 space -= (PAGE_SIZE - (off & PAGE_MASK)); 900 space = trunc_page(space); 901 if (off & PAGE_MASK) 902 space += (PAGE_SIZE - (off & PAGE_MASK)); 903 } 904 905 npages = howmany(space + (off & PAGE_MASK), PAGE_SIZE); 906 907 /* 908 * Calculate maximum allowed number of pages for readahead 909 * at this iteration. If SF_USER_READAHEAD was set, we don't 910 * do any heuristics and use exactly the value supplied by 911 * application. Otherwise, we allow readahead up to "rem". 912 * If application wants more, let it be, but there is no 913 * reason to go above maxphys. Also check against "obj_size", 914 * since vm_pager_has_page() can hint beyond EOF. 915 */ 916 if (flags & SF_USER_READAHEAD) { 917 rhpages = SF_READAHEAD(flags); 918 } else { 919 rhpages = howmany(rem + (off & PAGE_MASK), PAGE_SIZE) - 920 npages; 921 rhpages += SF_READAHEAD(flags); 922 } 923 rhpages = min(howmany(maxphys, PAGE_SIZE), rhpages); 924 rhpages = min(howmany(obj_size - trunc_page(off), PAGE_SIZE) - 925 npages, rhpages); 926 927 sfio = malloc(sizeof(struct sf_io) + 928 npages * sizeof(vm_page_t), M_SENDFILE, M_WAITOK); 929 refcount_init(&sfio->nios, 1); 930 sfio->obj = obj; 931 sfio->error = 0; 932 sfio->m = NULL; 933 sfio->npages = npages; 934#ifdef KERN_TLS 935 /* 936 * This doesn't use ktls_hold() because sfio->m will 937 * also have a reference on 'tls' that will be valid 938 * for all of sfio's lifetime. 939 */ 940 sfio->tls = tls; 941#endif 942 vm_object_pip_add(obj, 1); 943 error = sendfile_swapin(obj, sfio, &nios, off, space, rhpages, 944 flags); 945 if (error != 0) { 946 if (vp != NULL) 947 VOP_UNLOCK(vp); 948 sendfile_iodone(sfio, NULL, 0, error); 949 goto done; 950 } 951 952 /* 953 * Loop and construct maximum sized mbuf chain to be bulk 954 * dumped into socket buffer. 955 */ 956 pa = sfio->pa; 957 958 /* 959 * Use unmapped mbufs if enabled for TCP. Unmapped 960 * bufs are restricted to TCP as that is what has been 961 * tested. In particular, unmapped mbufs have not 962 * been tested with UNIX-domain sockets. 963 * 964 * TLS frames always require unmapped mbufs. 965 */ 966 if ((mb_use_ext_pgs && 967 so->so_proto->pr_protocol == IPPROTO_TCP) 968#ifdef KERN_TLS 969 || tls != NULL 970#endif 971 ) { 972 use_ext_pgs = true; 973#ifdef KERN_TLS 974 if (tls != NULL) 975 max_pgs = num_pages(tls->params.max_frame_len); 976 else 977#endif 978 max_pgs = MBUF_PEXT_MAX_PGS; 979 980 /* Start at last index, to wrap on first use. */ 981 ext_pgs_idx = max_pgs - 1; 982 } 983 984 for (int i = 0; i < npages; i++) { 985 /* 986 * If a page wasn't grabbed successfully, then 987 * trim the array. Can happen only with SF_NODISKIO. 988 */ 989 if (pa[i] == NULL) { 990 SFSTAT_INC(sf_busy); 991 fixspace(npages, i, off, &space); 992 sfio->npages = i; 993 softerr = EBUSY; 994 break; 995 } 996 pga = pa[i]; 997 if (pga == bogus_page) 998 pga = vm_page_relookup(obj, sfio->pindex0 + i); 999 1000 if (use_ext_pgs) { 1001 off_t xfs; 1002 1003 ext_pgs_idx++; 1004 if (ext_pgs_idx == max_pgs) { 1005 m0 = mb_alloc_ext_pgs(M_WAITOK, 1006 sendfile_free_mext_pg); 1007 1008 if (flags & SF_NOCACHE) { 1009 m0->m_ext.ext_flags |= 1010 EXT_FLAG_NOCACHE; 1011 1012 /* 1013 * See comment below regarding 1014 * ignoring SF_NOCACHE for the 1015 * last page. 1016 */ 1017 if ((npages - i <= max_pgs) && 1018 ((off + space) & PAGE_MASK) && 1019 (rem > space || rhpages > 0)) 1020 m0->m_ext.ext_flags |= 1021 EXT_FLAG_CACHE_LAST; 1022 } 1023 if (sfs != NULL) { 1024 m0->m_ext.ext_flags |= 1025 EXT_FLAG_SYNC; 1026 m0->m_ext.ext_arg1 = sfs; 1027 mtx_lock(&sfs->mtx); 1028 sfs->count++; 1029 mtx_unlock(&sfs->mtx); 1030 } 1031 ext_pgs_idx = 0; 1032 1033 /* Append to mbuf chain. */ 1034 if (mtail != NULL) 1035 mtail->m_next = m0; 1036 else 1037 m = m0; 1038 mtail = m0; 1039 m0->m_epg_1st_off = 1040 vmoff(i, off) & PAGE_MASK; 1041 } 1042 if (nios) { 1043 mtail->m_flags |= M_NOTREADY; 1044 m0->m_epg_nrdy++; 1045 } 1046 1047 m0->m_epg_pa[ext_pgs_idx] = VM_PAGE_TO_PHYS(pga); 1048 m0->m_epg_npgs++; 1049 xfs = xfsize(i, npages, off, space); 1050 m0->m_epg_last_len = xfs; 1051 MBUF_EXT_PGS_ASSERT_SANITY(m0); 1052 mtail->m_len += xfs; 1053 mtail->m_ext.ext_size += PAGE_SIZE; 1054 continue; 1055 } 1056 1057 /* 1058 * Get a sendfile buf. When allocating the 1059 * first buffer for mbuf chain, we usually 1060 * wait as long as necessary, but this wait 1061 * can be interrupted. For consequent 1062 * buffers, do not sleep, since several 1063 * threads might exhaust the buffers and then 1064 * deadlock. 1065 */ 1066 sf = sf_buf_alloc(pga, 1067 m != NULL ? SFB_NOWAIT : SFB_CATCH); 1068 if (sf == NULL) { 1069 SFSTAT_INC(sf_allocfail); 1070 sendfile_iowait(sfio, "sfnosf"); 1071 for (int j = i; j < npages; j++) { 1072 vm_page_unwire(pa[j], PQ_INACTIVE); 1073 pa[j] = NULL; 1074 } 1075 if (m == NULL) 1076 softerr = ENOBUFS; 1077 fixspace(npages, i, off, &space); 1078 sfio->npages = i; 1079 break; 1080 } 1081 1082 m0 = m_get(M_WAITOK, MT_DATA); 1083 m0->m_ext.ext_buf = (char *)sf_buf_kva(sf); 1084 m0->m_ext.ext_size = PAGE_SIZE; 1085 m0->m_ext.ext_arg1 = sf; 1086 m0->m_ext.ext_type = EXT_SFBUF; 1087 m0->m_ext.ext_flags = EXT_FLAG_EMBREF; 1088 m0->m_ext.ext_free = sendfile_free_mext; 1089 /* 1090 * SF_NOCACHE sets the page as being freed upon send. 1091 * However, we ignore it for the last page in 'space', 1092 * if the page is truncated, and we got more data to 1093 * send (rem > space), or if we have readahead 1094 * configured (rhpages > 0). 1095 */ 1096 if ((flags & SF_NOCACHE) && 1097 (i != npages - 1 || 1098 !((off + space) & PAGE_MASK) || 1099 !(rem > space || rhpages > 0))) 1100 m0->m_ext.ext_flags |= EXT_FLAG_NOCACHE; 1101 if (sfs != NULL) { 1102 m0->m_ext.ext_flags |= EXT_FLAG_SYNC; 1103 m0->m_ext.ext_arg2 = sfs; 1104 mtx_lock(&sfs->mtx); 1105 sfs->count++; 1106 mtx_unlock(&sfs->mtx); 1107 } 1108 m0->m_ext.ext_count = 1; 1109 m0->m_flags |= (M_EXT | M_RDONLY); 1110 if (nios) 1111 m0->m_flags |= M_NOTREADY; 1112 m0->m_data = (char *)sf_buf_kva(sf) + 1113 (vmoff(i, off) & PAGE_MASK); 1114 m0->m_len = xfsize(i, npages, off, space); 1115 1116 /* Append to mbuf chain. */ 1117 if (mtail != NULL) 1118 mtail->m_next = m0; 1119 else 1120 m = m0; 1121 mtail = m0; 1122 } 1123 1124 if (vp != NULL) 1125 VOP_UNLOCK(vp); 1126 1127 /* Keep track of bytes processed. */ 1128 off += space; 1129 rem -= space; 1130 1131 /* 1132 * Prepend header, if any. Save pointer to first mbuf 1133 * with a page. 1134 */ 1135 if (hdrlen) { 1136prepend_header: 1137 m0 = mhtail->m_next = m; 1138 m = mh; 1139 mh = NULL; 1140 } else 1141 m0 = m; 1142 1143 if (m == NULL) { 1144 KASSERT(softerr, ("%s: m NULL, no error", __func__)); 1145 error = softerr; 1146 sendfile_iodone(sfio, NULL, 0, 0); 1147 goto done; 1148 } 1149 1150 /* Add the buffer chain to the socket buffer. */ 1151 KASSERT(m_length(m, NULL) == space + hdrlen, 1152 ("%s: mlen %u space %d hdrlen %d", 1153 __func__, m_length(m, NULL), space, hdrlen)); 1154 1155 CURVNET_SET(so->so_vnet); 1156#ifdef KERN_TLS 1157 if (tls != NULL) 1158 ktls_frame(m, tls, &tls_enq_cnt, TLS_RLTYPE_APP); 1159#endif 1160 if (nios == 0) { 1161 /* 1162 * If sendfile_swapin() didn't initiate any I/Os, 1163 * which happens if all data is cached in VM, or if 1164 * the header consumed all socket buffer space and 1165 * sfio is NULL, then we can send data right now 1166 * without the PRUS_NOTREADY flag. 1167 */ 1168 if (sfio != NULL) 1169 sendfile_iodone(sfio, NULL, 0, 0); 1170#ifdef KERN_TLS 1171 if (tls != NULL && tls->mode == TCP_TLS_MODE_SW) { 1172 error = so->so_proto->pr_send(so, 1173 PRUS_NOTREADY, m, NULL, NULL, td); 1174 if (error != 0) { 1175 m_freem(m); 1176 } else { 1177 soref(so); 1178 ktls_enqueue(m, so, tls_enq_cnt); 1179 } 1180 } else 1181#endif 1182 error = so->so_proto->pr_send(so, 0, m, NULL, 1183 NULL, td); 1184 } else { 1185 sfio->so = so; 1186 sfio->m = m0; 1187 soref(so); 1188 error = so->so_proto->pr_send(so, PRUS_NOTREADY, m, 1189 NULL, NULL, td); 1190 sendfile_iodone(sfio, NULL, 0, error); 1191 } 1192#ifdef TCP_REQUEST_TRK 1193 if (so->so_proto->pr_protocol == IPPROTO_TCP) { 1194 /* log the sendfile call to the TCP log, if enabled */ 1195 tcp_log_sendfile(so, offset, nbytes, flags); 1196 } 1197#endif 1198 CURVNET_RESTORE(); 1199 1200 m = NULL; 1201 if (error) 1202 goto done; 1203 sbytes += space + hdrlen; 1204 if (hdrlen) 1205 hdrlen = 0; 1206 if (softerr) { 1207 error = softerr; 1208 goto done; 1209 } 1210 } 1211 1212 /* 1213 * Send trailers. Wimp out and use writev(2). 1214 */ 1215 if (trl_uio != NULL) { 1216 SOCK_IO_SEND_UNLOCK(so); 1217 error = kern_writev(td, sockfd, trl_uio); 1218 if (error == 0) 1219 sbytes += td->td_retval[0]; 1220 goto out; 1221 } 1222 1223done: 1224 SOCK_IO_SEND_UNLOCK(so); 1225out: 1226 /* 1227 * If there was no error we have to clear td->td_retval[0] 1228 * because it may have been set by writev. 1229 */ 1230 if (error == 0) { 1231 td->td_retval[0] = 0; 1232 } 1233 if (sent != NULL) { 1234 (*sent) = sbytes; 1235 } 1236 if (obj != NULL) 1237 vm_object_deallocate(obj); 1238 if (so) 1239 fdrop(sock_fp, td); 1240 if (m) 1241 m_freem(m); 1242 if (mh) 1243 m_freem(mh); 1244 1245 if (sfs != NULL) { 1246 mtx_lock(&sfs->mtx); 1247 if (sfs->count != 0) 1248 error = cv_wait_sig(&sfs->cv, &sfs->mtx); 1249 if (sfs->count == 0) { 1250 sendfile_sync_destroy(sfs); 1251 } else { 1252 sfs->waiting = false; 1253 mtx_unlock(&sfs->mtx); 1254 } 1255 } 1256#ifdef KERN_TLS 1257 if (tls != NULL) 1258 ktls_free(tls); 1259#endif 1260 1261 if (error == ERESTART) 1262 error = EINTR; 1263 1264 return (error); 1265} 1266 1267static int 1268sendfile(struct thread *td, struct sendfile_args *uap, int compat) 1269{ 1270 struct sf_hdtr hdtr; 1271 struct uio *hdr_uio, *trl_uio; 1272 struct file *fp; 1273 off_t sbytes; 1274 int error; 1275 1276 /* 1277 * File offset must be positive. If it goes beyond EOF 1278 * we send only the header/trailer and no payload data. 1279 */ 1280 if (uap->offset < 0) 1281 return (EINVAL); 1282 1283 sbytes = 0; 1284 hdr_uio = trl_uio = NULL; 1285 1286 if (uap->hdtr != NULL) { 1287 error = copyin(uap->hdtr, &hdtr, sizeof(hdtr)); 1288 if (error != 0) 1289 goto out; 1290 if (hdtr.headers != NULL) { 1291 error = copyinuio(hdtr.headers, hdtr.hdr_cnt, 1292 &hdr_uio); 1293 if (error != 0) 1294 goto out; 1295#ifdef COMPAT_FREEBSD4 1296 /* 1297 * In FreeBSD < 5.0 the nbytes to send also included 1298 * the header. If compat is specified subtract the 1299 * header size from nbytes. 1300 */ 1301 if (compat) { 1302 if (uap->nbytes > hdr_uio->uio_resid) 1303 uap->nbytes -= hdr_uio->uio_resid; 1304 else 1305 uap->nbytes = 0; 1306 } 1307#endif 1308 } 1309 if (hdtr.trailers != NULL) { 1310 error = copyinuio(hdtr.trailers, hdtr.trl_cnt, 1311 &trl_uio); 1312 if (error != 0) 1313 goto out; 1314 } 1315 } 1316 1317 AUDIT_ARG_FD(uap->fd); 1318 1319 /* 1320 * sendfile(2) can start at any offset within a file so we require 1321 * CAP_READ+CAP_SEEK = CAP_PREAD. 1322 */ 1323 if ((error = fget_read(td, uap->fd, &cap_pread_rights, &fp)) != 0) 1324 goto out; 1325 1326 error = fo_sendfile(fp, uap->s, hdr_uio, trl_uio, uap->offset, 1327 uap->nbytes, &sbytes, uap->flags, td); 1328 fdrop(fp, td); 1329 1330 if (uap->sbytes != NULL) 1331 (void)copyout(&sbytes, uap->sbytes, sizeof(off_t)); 1332 1333out: 1334 freeuio(hdr_uio); 1335 freeuio(trl_uio); 1336 return (error); 1337} 1338 1339/* 1340 * sendfile(2) 1341 * 1342 * int sendfile(int fd, int s, off_t offset, size_t nbytes, 1343 * struct sf_hdtr *hdtr, off_t *sbytes, int flags) 1344 * 1345 * Send a file specified by 'fd' and starting at 'offset' to a socket 1346 * specified by 's'. Send only 'nbytes' of the file or until EOF if nbytes == 1347 * 0. Optionally add a header and/or trailer to the socket output. If 1348 * specified, write the total number of bytes sent into *sbytes. 1349 */ 1350int 1351sys_sendfile(struct thread *td, struct sendfile_args *uap) 1352{ 1353 1354 return (sendfile(td, uap, 0)); 1355} 1356 1357#ifdef COMPAT_FREEBSD4 1358int 1359freebsd4_sendfile(struct thread *td, struct freebsd4_sendfile_args *uap) 1360{ 1361 struct sendfile_args args; 1362 1363 args.fd = uap->fd; 1364 args.s = uap->s; 1365 args.offset = uap->offset; 1366 args.nbytes = uap->nbytes; 1367 args.hdtr = uap->hdtr; 1368 args.sbytes = uap->sbytes; 1369 args.flags = uap->flags; 1370 1371 return (sendfile(td, &args, 1)); 1372} 1373#endif /* COMPAT_FREEBSD4 */ 1374