1 /*- 2 * Copyright (c) 2013-2015 Gleb Smirnoff <glebius@FreeBSD.org> 3 * Copyright (c) 1998, David Greenman. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the University nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include "opt_compat.h" 34 35 #include <sys/param.h> 36 #include <sys/systm.h> 37 #include <sys/capsicum.h> 38 #include <sys/kernel.h> 39 #include <sys/lock.h> 40 #include <sys/mutex.h> 41 #include <sys/sysproto.h> 42 #include <sys/malloc.h> 43 #include <sys/proc.h> 44 #include <sys/mman.h> 45 #include <sys/mount.h> 46 #include <sys/mbuf.h> 47 #include <sys/protosw.h> 48 #include <sys/rwlock.h> 49 #include <sys/sf_buf.h> 50 #include <sys/socket.h> 51 #include <sys/socketvar.h> 52 #include <sys/syscallsubr.h> 53 #include <sys/sysctl.h> 54 #include <sys/vnode.h> 55 56 #include <net/vnet.h> 57 58 #include <security/audit/audit.h> 59 #include <security/mac/mac_framework.h> 60 61 #include <vm/vm.h> 62 #include <vm/vm_object.h> 63 #include <vm/vm_pager.h> 64 65 /* 66 * Structure describing a single sendfile(2) I/O, which may consist of 67 * several underlying pager I/Os. 68 * 69 * The syscall context allocates the structure and initializes 'nios' 70 * to 1. As sendfile_swapin() runs through pages and starts asynchronous 71 * paging operations, it increments 'nios'. 72 * 73 * Every I/O completion calls sendfile_iodone(), which decrements the 'nios', 74 * and the syscall also calls sendfile_iodone() after allocating all mbufs, 75 * linking them and sending to socket. Whoever reaches zero 'nios' is 76 * responsible to * call pru_ready on the socket, to notify it of readyness 77 * of the data. 78 */ 79 struct sf_io { 80 volatile u_int nios; 81 u_int error; 82 int npages; 83 struct file *sock_fp; 84 struct mbuf *m; 85 vm_page_t pa[]; 86 }; 87 88 /* 89 * Structure used to track requests with SF_SYNC flag. 90 */ 91 struct sendfile_sync { 92 struct mtx mtx; 93 struct cv cv; 94 unsigned count; 95 }; 96 97 counter_u64_t sfstat[sizeof(struct sfstat) / sizeof(uint64_t)]; 98 99 static void 100 sfstat_init(const void *unused) 101 { 102 103 COUNTER_ARRAY_ALLOC(sfstat, sizeof(struct sfstat) / sizeof(uint64_t), 104 M_WAITOK); 105 } 106 SYSINIT(sfstat, SI_SUB_MBUF, SI_ORDER_FIRST, sfstat_init, NULL); 107 108 static int 109 sfstat_sysctl(SYSCTL_HANDLER_ARGS) 110 { 111 struct sfstat s; 112 113 COUNTER_ARRAY_COPY(sfstat, &s, sizeof(s) / sizeof(uint64_t)); 114 if (req->newptr) 115 COUNTER_ARRAY_ZERO(sfstat, sizeof(s) / sizeof(uint64_t)); 116 return (SYSCTL_OUT(req, &s, sizeof(s))); 117 } 118 SYSCTL_PROC(_kern_ipc, OID_AUTO, sfstat, CTLTYPE_OPAQUE | CTLFLAG_RW, 119 NULL, 0, sfstat_sysctl, "I", "sendfile statistics"); 120 121 /* 122 * Detach mapped page and release resources back to the system. Called 123 * by mbuf(9) code when last reference to a page is freed. 124 */ 125 void 126 sf_ext_free(void *arg1, void *arg2) 127 { 128 struct sf_buf *sf = arg1; 129 struct sendfile_sync *sfs = arg2; 130 vm_page_t pg = sf_buf_page(sf); 131 132 sf_buf_free(sf); 133 134 vm_page_lock(pg); 135 /* 136 * Check for the object going away on us. This can 137 * happen since we don't hold a reference to it. 138 * If so, we're responsible for freeing the page. 139 */ 140 if (vm_page_unwire(pg, PQ_INACTIVE) && pg->object == NULL) 141 vm_page_free(pg); 142 vm_page_unlock(pg); 143 144 if (sfs != NULL) { 145 mtx_lock(&sfs->mtx); 146 KASSERT(sfs->count > 0, ("Sendfile sync botchup count == 0")); 147 if (--sfs->count == 0) 148 cv_signal(&sfs->cv); 149 mtx_unlock(&sfs->mtx); 150 } 151 } 152 153 /* 154 * Same as above, but forces the page to be detached from the object 155 * and go into free pool. 156 */ 157 void 158 sf_ext_free_nocache(void *arg1, void *arg2) 159 { 160 struct sf_buf *sf = arg1; 161 struct sendfile_sync *sfs = arg2; 162 vm_page_t pg = sf_buf_page(sf); 163 164 sf_buf_free(sf); 165 166 vm_page_lock(pg); 167 if (vm_page_unwire(pg, PQ_NONE)) { 168 vm_object_t obj; 169 170 /* Try to free the page, but only if it is cheap to. */ 171 if ((obj = pg->object) == NULL) 172 vm_page_free(pg); 173 else if (!vm_page_xbusied(pg) && VM_OBJECT_TRYWLOCK(obj)) { 174 vm_page_free(pg); 175 VM_OBJECT_WUNLOCK(obj); 176 } else 177 vm_page_deactivate(pg); 178 } 179 vm_page_unlock(pg); 180 181 if (sfs != NULL) { 182 mtx_lock(&sfs->mtx); 183 KASSERT(sfs->count > 0, ("Sendfile sync botchup count == 0")); 184 if (--sfs->count == 0) 185 cv_signal(&sfs->cv); 186 mtx_unlock(&sfs->mtx); 187 } 188 } 189 190 /* 191 * Helper function to calculate how much data to put into page i of n. 192 * Only first and last pages are special. 193 */ 194 static inline off_t 195 xfsize(int i, int n, off_t off, off_t len) 196 { 197 198 if (i == 0) 199 return (omin(PAGE_SIZE - (off & PAGE_MASK), len)); 200 201 if (i == n - 1 && ((off + len) & PAGE_MASK) > 0) 202 return ((off + len) & PAGE_MASK); 203 204 return (PAGE_SIZE); 205 } 206 207 /* 208 * Helper function to get offset within object for i page. 209 */ 210 static inline vm_ooffset_t 211 vmoff(int i, off_t off) 212 { 213 214 if (i == 0) 215 return ((vm_ooffset_t)off); 216 217 return (trunc_page(off + i * PAGE_SIZE)); 218 } 219 220 /* 221 * Helper function used when allocation of a page or sf_buf failed. 222 * Pretend as if we don't have enough space, subtract xfsize() of 223 * all pages that failed. 224 */ 225 static inline void 226 fixspace(int old, int new, off_t off, int *space) 227 { 228 229 KASSERT(old > new, ("%s: old %d new %d", __func__, old, new)); 230 231 /* Subtract last one. */ 232 *space -= xfsize(old - 1, old, off, *space); 233 old--; 234 235 if (new == old) 236 /* There was only one page. */ 237 return; 238 239 /* Subtract first one. */ 240 if (new == 0) { 241 *space -= xfsize(0, old, off, *space); 242 new++; 243 } 244 245 /* Rest of pages are full sized. */ 246 *space -= (old - new) * PAGE_SIZE; 247 248 KASSERT(*space >= 0, ("%s: space went backwards", __func__)); 249 } 250 251 /* 252 * I/O completion callback. 253 */ 254 static void 255 sendfile_iodone(void *arg, vm_page_t *pg, int count, int error) 256 { 257 struct sf_io *sfio = arg; 258 struct socket *so; 259 260 for (int i = 0; i < count; i++) 261 if (pg[i] != bogus_page) 262 vm_page_xunbusy(pg[i]); 263 264 if (error) 265 sfio->error = error; 266 267 if (!refcount_release(&sfio->nios)) 268 return; 269 270 so = sfio->sock_fp->f_data; 271 272 if (sfio->error) { 273 struct mbuf *m; 274 275 /* 276 * I/O operation failed. The state of data in the socket 277 * is now inconsistent, and all what we can do is to tear 278 * it down. Protocol abort method would tear down protocol 279 * state, free all ready mbufs and detach not ready ones. 280 * We will free the mbufs corresponding to this I/O manually. 281 * 282 * The socket would be marked with EIO and made available 283 * for read, so that application receives EIO on next 284 * syscall and eventually closes the socket. 285 */ 286 so->so_proto->pr_usrreqs->pru_abort(so); 287 so->so_error = EIO; 288 289 m = sfio->m; 290 for (int i = 0; i < sfio->npages; i++) 291 m = m_free(m); 292 } else { 293 CURVNET_SET(so->so_vnet); 294 (void )(so->so_proto->pr_usrreqs->pru_ready)(so, sfio->m, 295 sfio->npages); 296 CURVNET_RESTORE(); 297 } 298 299 /* XXXGL: curthread */ 300 fdrop(sfio->sock_fp, curthread); 301 free(sfio, M_TEMP); 302 } 303 304 /* 305 * Iterate through pages vector and request paging for non-valid pages. 306 */ 307 static int 308 sendfile_swapin(vm_object_t obj, struct sf_io *sfio, off_t off, off_t len, 309 int npages, int rhpages, int flags) 310 { 311 vm_page_t *pa = sfio->pa; 312 int nios; 313 314 nios = 0; 315 flags = (flags & SF_NODISKIO) ? VM_ALLOC_NOWAIT : 0; 316 317 /* 318 * First grab all the pages and wire them. Note that we grab 319 * only required pages. Readahead pages are dealt with later. 320 */ 321 VM_OBJECT_WLOCK(obj); 322 for (int i = 0; i < npages; i++) { 323 pa[i] = vm_page_grab(obj, OFF_TO_IDX(vmoff(i, off)), 324 VM_ALLOC_WIRED | VM_ALLOC_NORMAL | flags); 325 if (pa[i] == NULL) { 326 npages = i; 327 rhpages = 0; 328 break; 329 } 330 } 331 332 for (int i = 0; i < npages;) { 333 int j, a, count, rv; 334 335 /* Skip valid pages. */ 336 if (vm_page_is_valid(pa[i], vmoff(i, off) & PAGE_MASK, 337 xfsize(i, npages, off, len))) { 338 vm_page_xunbusy(pa[i]); 339 SFSTAT_INC(sf_pages_valid); 340 i++; 341 continue; 342 } 343 344 /* 345 * Next page is invalid. Check if it belongs to pager. It 346 * may not be there, which is a regular situation for shmem 347 * pager. For vnode pager this happens only in case of 348 * a sparse file. 349 * 350 * Important feature of vm_pager_has_page() is the hint 351 * stored in 'a', about how many pages we can pagein after 352 * this page in a single I/O. 353 */ 354 if (!vm_pager_has_page(obj, OFF_TO_IDX(vmoff(i, off)), NULL, 355 &a)) { 356 pmap_zero_page(pa[i]); 357 pa[i]->valid = VM_PAGE_BITS_ALL; 358 pa[i]->dirty = 0; 359 vm_page_xunbusy(pa[i]); 360 i++; 361 continue; 362 } 363 364 /* 365 * We want to pagein as many pages as possible, limited only 366 * by the 'a' hint and actual request. 367 */ 368 count = min(a + 1, npages - i); 369 370 /* 371 * We should not pagein into a valid page, thus we first trim 372 * any valid pages off the end of request, and substitute 373 * to bogus_page those, that are in the middle. 374 */ 375 for (j = i + count - 1; j > i; j--) { 376 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 377 xfsize(j, npages, off, len))) { 378 count--; 379 rhpages = 0; 380 } else 381 break; 382 } 383 for (j = i + 1; j < i + count - 1; j++) 384 if (vm_page_is_valid(pa[j], vmoff(j, off) & PAGE_MASK, 385 xfsize(j, npages, off, len))) { 386 vm_page_xunbusy(pa[j]); 387 SFSTAT_INC(sf_pages_valid); 388 SFSTAT_INC(sf_pages_bogus); 389 pa[j] = bogus_page; 390 } 391 392 refcount_acquire(&sfio->nios); 393 rv = vm_pager_get_pages_async(obj, pa + i, count, NULL, 394 i + count == npages ? &rhpages : NULL, 395 &sendfile_iodone, sfio); 396 KASSERT(rv == VM_PAGER_OK, ("%s: pager fail obj %p page %p", 397 __func__, obj, pa[i])); 398 399 SFSTAT_INC(sf_iocnt); 400 SFSTAT_ADD(sf_pages_read, count); 401 if (i + count == npages) 402 SFSTAT_ADD(sf_rhpages_read, rhpages); 403 404 /* 405 * Restore the valid page pointers. They are already 406 * unbusied, but still wired. 407 */ 408 for (j = i; j < i + count; j++) 409 if (pa[j] == bogus_page) { 410 pa[j] = vm_page_lookup(obj, 411 OFF_TO_IDX(vmoff(j, off))); 412 KASSERT(pa[j], ("%s: page %p[%d] disappeared", 413 __func__, pa, j)); 414 415 } 416 i += count; 417 nios++; 418 } 419 420 VM_OBJECT_WUNLOCK(obj); 421 422 if (nios == 0 && npages != 0) 423 SFSTAT_INC(sf_noiocnt); 424 425 return (nios); 426 } 427 428 static int 429 sendfile_getobj(struct thread *td, struct file *fp, vm_object_t *obj_res, 430 struct vnode **vp_res, struct shmfd **shmfd_res, off_t *obj_size, 431 int *bsize) 432 { 433 struct vattr va; 434 vm_object_t obj; 435 struct vnode *vp; 436 struct shmfd *shmfd; 437 int error; 438 439 vp = *vp_res = NULL; 440 obj = NULL; 441 shmfd = *shmfd_res = NULL; 442 *bsize = 0; 443 444 /* 445 * The file descriptor must be a regular file and have a 446 * backing VM object. 447 */ 448 if (fp->f_type == DTYPE_VNODE) { 449 vp = fp->f_vnode; 450 vn_lock(vp, LK_SHARED | LK_RETRY); 451 if (vp->v_type != VREG) { 452 error = EINVAL; 453 goto out; 454 } 455 *bsize = vp->v_mount->mnt_stat.f_iosize; 456 error = VOP_GETATTR(vp, &va, td->td_ucred); 457 if (error != 0) 458 goto out; 459 *obj_size = va.va_size; 460 obj = vp->v_object; 461 if (obj == NULL) { 462 error = EINVAL; 463 goto out; 464 } 465 } else if (fp->f_type == DTYPE_SHM) { 466 error = 0; 467 shmfd = fp->f_data; 468 obj = shmfd->shm_object; 469 *obj_size = shmfd->shm_size; 470 } else { 471 error = EINVAL; 472 goto out; 473 } 474 475 VM_OBJECT_WLOCK(obj); 476 if ((obj->flags & OBJ_DEAD) != 0) { 477 VM_OBJECT_WUNLOCK(obj); 478 error = EBADF; 479 goto out; 480 } 481 482 /* 483 * Temporarily increase the backing VM object's reference 484 * count so that a forced reclamation of its vnode does not 485 * immediately destroy it. 486 */ 487 vm_object_reference_locked(obj); 488 VM_OBJECT_WUNLOCK(obj); 489 *obj_res = obj; 490 *vp_res = vp; 491 *shmfd_res = shmfd; 492 493 out: 494 if (vp != NULL) 495 VOP_UNLOCK(vp, 0); 496 return (error); 497 } 498 499 static int 500 sendfile_getsock(struct thread *td, int s, struct file **sock_fp, 501 struct socket **so) 502 { 503 cap_rights_t rights; 504 int error; 505 506 *sock_fp = NULL; 507 *so = NULL; 508 509 /* 510 * The socket must be a stream socket and connected. 511 */ 512 error = getsock_cap(td, s, cap_rights_init(&rights, CAP_SEND), 513 sock_fp, NULL, NULL); 514 if (error != 0) 515 return (error); 516 *so = (*sock_fp)->f_data; 517 if ((*so)->so_type != SOCK_STREAM) 518 return (EINVAL); 519 if (((*so)->so_state & SS_ISCONNECTED) == 0) 520 return (ENOTCONN); 521 return (0); 522 } 523 524 int 525 vn_sendfile(struct file *fp, int sockfd, struct uio *hdr_uio, 526 struct uio *trl_uio, off_t offset, size_t nbytes, off_t *sent, int flags, 527 struct thread *td) 528 { 529 struct file *sock_fp; 530 struct vnode *vp; 531 struct vm_object *obj; 532 struct socket *so; 533 struct mbuf *m, *mh, *mhtail; 534 struct sf_buf *sf; 535 struct shmfd *shmfd; 536 struct sendfile_sync *sfs; 537 struct vattr va; 538 off_t off, sbytes, rem, obj_size; 539 int error, softerr, bsize, hdrlen; 540 541 obj = NULL; 542 so = NULL; 543 m = mh = NULL; 544 sfs = NULL; 545 hdrlen = sbytes = 0; 546 softerr = 0; 547 548 error = sendfile_getobj(td, fp, &obj, &vp, &shmfd, &obj_size, &bsize); 549 if (error != 0) 550 return (error); 551 552 error = sendfile_getsock(td, sockfd, &sock_fp, &so); 553 if (error != 0) 554 goto out; 555 556 #ifdef MAC 557 error = mac_socket_check_send(td->td_ucred, so); 558 if (error != 0) 559 goto out; 560 #endif 561 562 SFSTAT_INC(sf_syscalls); 563 SFSTAT_ADD(sf_rhpages_requested, SF_READAHEAD(flags)); 564 565 if (flags & SF_SYNC) { 566 sfs = malloc(sizeof *sfs, M_TEMP, M_WAITOK | M_ZERO); 567 mtx_init(&sfs->mtx, "sendfile", NULL, MTX_DEF); 568 cv_init(&sfs->cv, "sendfile"); 569 } 570 571 rem = nbytes ? omin(nbytes, obj_size - offset) : obj_size - offset; 572 573 /* 574 * Protect against multiple writers to the socket. 575 * 576 * XXXRW: Historically this has assumed non-interruptibility, so now 577 * we implement that, but possibly shouldn't. 578 */ 579 (void)sblock(&so->so_snd, SBL_WAIT | SBL_NOINTR); 580 581 /* 582 * Loop through the pages of the file, starting with the requested 583 * offset. Get a file page (do I/O if necessary), map the file page 584 * into an sf_buf, attach an mbuf header to the sf_buf, and queue 585 * it on the socket. 586 * This is done in two loops. The inner loop turns as many pages 587 * as it can, up to available socket buffer space, without blocking 588 * into mbufs to have it bulk delivered into the socket send buffer. 589 * The outer loop checks the state and available space of the socket 590 * and takes care of the overall progress. 591 */ 592 for (off = offset; rem > 0; ) { 593 struct sf_io *sfio; 594 vm_page_t *pa; 595 struct mbuf *mtail; 596 int nios, space, npages, rhpages; 597 598 mtail = NULL; 599 /* 600 * Check the socket state for ongoing connection, 601 * no errors and space in socket buffer. 602 * If space is low allow for the remainder of the 603 * file to be processed if it fits the socket buffer. 604 * Otherwise block in waiting for sufficient space 605 * to proceed, or if the socket is nonblocking, return 606 * to userland with EAGAIN while reporting how far 607 * we've come. 608 * We wait until the socket buffer has significant free 609 * space to do bulk sends. This makes good use of file 610 * system read ahead and allows packet segmentation 611 * offloading hardware to take over lots of work. If 612 * we were not careful here we would send off only one 613 * sfbuf at a time. 614 */ 615 SOCKBUF_LOCK(&so->so_snd); 616 if (so->so_snd.sb_lowat < so->so_snd.sb_hiwat / 2) 617 so->so_snd.sb_lowat = so->so_snd.sb_hiwat / 2; 618 retry_space: 619 if (so->so_snd.sb_state & SBS_CANTSENDMORE) { 620 error = EPIPE; 621 SOCKBUF_UNLOCK(&so->so_snd); 622 goto done; 623 } else if (so->so_error) { 624 error = so->so_error; 625 so->so_error = 0; 626 SOCKBUF_UNLOCK(&so->so_snd); 627 goto done; 628 } 629 space = sbspace(&so->so_snd); 630 if (space < rem && 631 (space <= 0 || 632 space < so->so_snd.sb_lowat)) { 633 if (so->so_state & SS_NBIO) { 634 SOCKBUF_UNLOCK(&so->so_snd); 635 error = EAGAIN; 636 goto done; 637 } 638 /* 639 * sbwait drops the lock while sleeping. 640 * When we loop back to retry_space the 641 * state may have changed and we retest 642 * for it. 643 */ 644 error = sbwait(&so->so_snd); 645 /* 646 * An error from sbwait usually indicates that we've 647 * been interrupted by a signal. If we've sent anything 648 * then return bytes sent, otherwise return the error. 649 */ 650 if (error != 0) { 651 SOCKBUF_UNLOCK(&so->so_snd); 652 goto done; 653 } 654 goto retry_space; 655 } 656 SOCKBUF_UNLOCK(&so->so_snd); 657 658 /* 659 * At the beginning of the first loop check if any headers 660 * are specified and copy them into mbufs. Reduce space in 661 * the socket buffer by the size of the header mbuf chain. 662 * Clear hdr_uio here and hdrlen at the end of the first loop. 663 */ 664 if (hdr_uio != NULL && hdr_uio->uio_resid > 0) { 665 hdr_uio->uio_td = td; 666 hdr_uio->uio_rw = UIO_WRITE; 667 mh = m_uiotombuf(hdr_uio, M_WAITOK, space, 0, 0); 668 hdrlen = m_length(mh, &mhtail); 669 space -= hdrlen; 670 /* 671 * If header consumed all the socket buffer space, 672 * don't waste CPU cycles and jump to the end. 673 */ 674 if (space == 0) { 675 sfio = NULL; 676 nios = 0; 677 goto prepend_header; 678 } 679 hdr_uio = NULL; 680 } 681 682 if (vp != NULL) { 683 error = vn_lock(vp, LK_SHARED); 684 if (error != 0) 685 goto done; 686 error = VOP_GETATTR(vp, &va, td->td_ucred); 687 if (error != 0 || off >= va.va_size) { 688 VOP_UNLOCK(vp, 0); 689 goto done; 690 } 691 if (va.va_size != obj_size) { 692 obj_size = va.va_size; 693 rem = nbytes ? 694 omin(nbytes + offset, obj_size) : obj_size; 695 rem -= off; 696 } 697 } 698 699 if (space > rem) 700 space = rem; 701 702 npages = howmany(space + (off & PAGE_MASK), PAGE_SIZE); 703 704 /* 705 * Calculate maximum allowed number of pages for readahead 706 * at this iteration. If SF_USER_READAHEAD was set, we don't 707 * do any heuristics and use exactly the value supplied by 708 * application. Otherwise, we allow readahead up to "rem". 709 * If application wants more, let it be, but there is no 710 * reason to go above MAXPHYS. Also check against "obj_size", 711 * since vm_pager_has_page() can hint beyond EOF. 712 */ 713 if (flags & SF_USER_READAHEAD) { 714 rhpages = SF_READAHEAD(flags); 715 } else { 716 rhpages = howmany(rem + (off & PAGE_MASK), PAGE_SIZE) - 717 npages; 718 rhpages += SF_READAHEAD(flags); 719 } 720 rhpages = min(howmany(MAXPHYS, PAGE_SIZE), rhpages); 721 rhpages = min(howmany(obj_size - trunc_page(off), PAGE_SIZE) - 722 npages, rhpages); 723 724 sfio = malloc(sizeof(struct sf_io) + 725 npages * sizeof(vm_page_t), M_TEMP, M_WAITOK); 726 refcount_init(&sfio->nios, 1); 727 sfio->error = 0; 728 729 nios = sendfile_swapin(obj, sfio, off, space, npages, rhpages, 730 flags); 731 732 /* 733 * Loop and construct maximum sized mbuf chain to be bulk 734 * dumped into socket buffer. 735 */ 736 pa = sfio->pa; 737 for (int i = 0; i < npages; i++) { 738 struct mbuf *m0; 739 740 /* 741 * If a page wasn't grabbed successfully, then 742 * trim the array. Can happen only with SF_NODISKIO. 743 */ 744 if (pa[i] == NULL) { 745 SFSTAT_INC(sf_busy); 746 fixspace(npages, i, off, &space); 747 npages = i; 748 softerr = EBUSY; 749 break; 750 } 751 752 /* 753 * Get a sendfile buf. When allocating the 754 * first buffer for mbuf chain, we usually 755 * wait as long as necessary, but this wait 756 * can be interrupted. For consequent 757 * buffers, do not sleep, since several 758 * threads might exhaust the buffers and then 759 * deadlock. 760 */ 761 sf = sf_buf_alloc(pa[i], 762 m != NULL ? SFB_NOWAIT : SFB_CATCH); 763 if (sf == NULL) { 764 SFSTAT_INC(sf_allocfail); 765 for (int j = i; j < npages; j++) { 766 vm_page_lock(pa[j]); 767 vm_page_unwire(pa[j], PQ_INACTIVE); 768 vm_page_unlock(pa[j]); 769 } 770 if (m == NULL) 771 softerr = ENOBUFS; 772 fixspace(npages, i, off, &space); 773 npages = i; 774 break; 775 } 776 777 m0 = m_get(M_WAITOK, MT_DATA); 778 m0->m_ext.ext_buf = (char *)sf_buf_kva(sf); 779 m0->m_ext.ext_size = PAGE_SIZE; 780 m0->m_ext.ext_arg1 = sf; 781 m0->m_ext.ext_arg2 = sfs; 782 /* 783 * SF_NOCACHE sets the page as being freed upon send. 784 * However, we ignore it for the last page in 'space', 785 * if the page is truncated, and we got more data to 786 * send (rem > space), or if we have readahead 787 * configured (rhpages > 0). 788 */ 789 if ((flags & SF_NOCACHE) == 0 || 790 (i == npages - 1 && 791 ((off + space) & PAGE_MASK) && 792 (rem > space || rhpages > 0))) 793 m0->m_ext.ext_type = EXT_SFBUF; 794 else 795 m0->m_ext.ext_type = EXT_SFBUF_NOCACHE; 796 m0->m_ext.ext_flags = EXT_FLAG_EMBREF; 797 m0->m_ext.ext_count = 1; 798 m0->m_flags |= (M_EXT | M_RDONLY); 799 if (nios) 800 m0->m_flags |= M_NOTREADY; 801 m0->m_data = (char *)sf_buf_kva(sf) + 802 (vmoff(i, off) & PAGE_MASK); 803 m0->m_len = xfsize(i, npages, off, space); 804 805 if (i == 0) 806 sfio->m = m0; 807 808 /* Append to mbuf chain. */ 809 if (mtail != NULL) 810 mtail->m_next = m0; 811 else 812 m = m0; 813 mtail = m0; 814 815 if (sfs != NULL) { 816 mtx_lock(&sfs->mtx); 817 sfs->count++; 818 mtx_unlock(&sfs->mtx); 819 } 820 } 821 822 if (vp != NULL) 823 VOP_UNLOCK(vp, 0); 824 825 /* Keep track of bytes processed. */ 826 off += space; 827 rem -= space; 828 829 /* Prepend header, if any. */ 830 if (hdrlen) { 831 prepend_header: 832 mhtail->m_next = m; 833 m = mh; 834 mh = NULL; 835 } 836 837 if (m == NULL) { 838 KASSERT(softerr, ("%s: m NULL, no error", __func__)); 839 error = softerr; 840 free(sfio, M_TEMP); 841 goto done; 842 } 843 844 /* Add the buffer chain to the socket buffer. */ 845 KASSERT(m_length(m, NULL) == space + hdrlen, 846 ("%s: mlen %u space %d hdrlen %d", 847 __func__, m_length(m, NULL), space, hdrlen)); 848 849 CURVNET_SET(so->so_vnet); 850 if (nios == 0) { 851 /* 852 * If sendfile_swapin() didn't initiate any I/Os, 853 * which happens if all data is cached in VM, then 854 * we can send data right now without the 855 * PRUS_NOTREADY flag. 856 */ 857 free(sfio, M_TEMP); 858 error = (*so->so_proto->pr_usrreqs->pru_send) 859 (so, 0, m, NULL, NULL, td); 860 } else { 861 sfio->sock_fp = sock_fp; 862 sfio->npages = npages; 863 fhold(sock_fp); 864 error = (*so->so_proto->pr_usrreqs->pru_send) 865 (so, PRUS_NOTREADY, m, NULL, NULL, td); 866 sendfile_iodone(sfio, NULL, 0, 0); 867 } 868 CURVNET_RESTORE(); 869 870 m = NULL; /* pru_send always consumes */ 871 if (error) 872 goto done; 873 sbytes += space + hdrlen; 874 if (hdrlen) 875 hdrlen = 0; 876 if (softerr) { 877 error = softerr; 878 goto done; 879 } 880 } 881 882 /* 883 * Send trailers. Wimp out and use writev(2). 884 */ 885 if (trl_uio != NULL) { 886 sbunlock(&so->so_snd); 887 error = kern_writev(td, sockfd, trl_uio); 888 if (error == 0) 889 sbytes += td->td_retval[0]; 890 goto out; 891 } 892 893 done: 894 sbunlock(&so->so_snd); 895 out: 896 /* 897 * If there was no error we have to clear td->td_retval[0] 898 * because it may have been set by writev. 899 */ 900 if (error == 0) { 901 td->td_retval[0] = 0; 902 } 903 if (sent != NULL) { 904 (*sent) = sbytes; 905 } 906 if (obj != NULL) 907 vm_object_deallocate(obj); 908 if (so) 909 fdrop(sock_fp, td); 910 if (m) 911 m_freem(m); 912 if (mh) 913 m_freem(mh); 914 915 if (sfs != NULL) { 916 mtx_lock(&sfs->mtx); 917 if (sfs->count != 0) 918 cv_wait(&sfs->cv, &sfs->mtx); 919 KASSERT(sfs->count == 0, ("sendfile sync still busy")); 920 cv_destroy(&sfs->cv); 921 mtx_destroy(&sfs->mtx); 922 free(sfs, M_TEMP); 923 } 924 925 if (error == ERESTART) 926 error = EINTR; 927 928 return (error); 929 } 930 931 static int 932 sendfile(struct thread *td, struct sendfile_args *uap, int compat) 933 { 934 struct sf_hdtr hdtr; 935 struct uio *hdr_uio, *trl_uio; 936 struct file *fp; 937 cap_rights_t rights; 938 off_t sbytes; 939 int error; 940 941 /* 942 * File offset must be positive. If it goes beyond EOF 943 * we send only the header/trailer and no payload data. 944 */ 945 if (uap->offset < 0) 946 return (EINVAL); 947 948 hdr_uio = trl_uio = NULL; 949 950 if (uap->hdtr != NULL) { 951 error = copyin(uap->hdtr, &hdtr, sizeof(hdtr)); 952 if (error != 0) 953 goto out; 954 if (hdtr.headers != NULL) { 955 error = copyinuio(hdtr.headers, hdtr.hdr_cnt, 956 &hdr_uio); 957 if (error != 0) 958 goto out; 959 #ifdef COMPAT_FREEBSD4 960 /* 961 * In FreeBSD < 5.0 the nbytes to send also included 962 * the header. If compat is specified subtract the 963 * header size from nbytes. 964 */ 965 if (compat) { 966 if (uap->nbytes > hdr_uio->uio_resid) 967 uap->nbytes -= hdr_uio->uio_resid; 968 else 969 uap->nbytes = 0; 970 } 971 #endif 972 } 973 if (hdtr.trailers != NULL) { 974 error = copyinuio(hdtr.trailers, hdtr.trl_cnt, 975 &trl_uio); 976 if (error != 0) 977 goto out; 978 } 979 } 980 981 AUDIT_ARG_FD(uap->fd); 982 983 /* 984 * sendfile(2) can start at any offset within a file so we require 985 * CAP_READ+CAP_SEEK = CAP_PREAD. 986 */ 987 if ((error = fget_read(td, uap->fd, 988 cap_rights_init(&rights, CAP_PREAD), &fp)) != 0) { 989 goto out; 990 } 991 992 error = fo_sendfile(fp, uap->s, hdr_uio, trl_uio, uap->offset, 993 uap->nbytes, &sbytes, uap->flags, td); 994 fdrop(fp, td); 995 996 if (uap->sbytes != NULL) 997 copyout(&sbytes, uap->sbytes, sizeof(off_t)); 998 999 out: 1000 free(hdr_uio, M_IOV); 1001 free(trl_uio, M_IOV); 1002 return (error); 1003 } 1004 1005 /* 1006 * sendfile(2) 1007 * 1008 * int sendfile(int fd, int s, off_t offset, size_t nbytes, 1009 * struct sf_hdtr *hdtr, off_t *sbytes, int flags) 1010 * 1011 * Send a file specified by 'fd' and starting at 'offset' to a socket 1012 * specified by 's'. Send only 'nbytes' of the file or until EOF if nbytes == 1013 * 0. Optionally add a header and/or trailer to the socket output. If 1014 * specified, write the total number of bytes sent into *sbytes. 1015 */ 1016 int 1017 sys_sendfile(struct thread *td, struct sendfile_args *uap) 1018 { 1019 1020 return (sendfile(td, uap, 0)); 1021 } 1022 1023 #ifdef COMPAT_FREEBSD4 1024 int 1025 freebsd4_sendfile(struct thread *td, struct freebsd4_sendfile_args *uap) 1026 { 1027 struct sendfile_args args; 1028 1029 args.fd = uap->fd; 1030 args.s = uap->s; 1031 args.offset = uap->offset; 1032 args.nbytes = uap->nbytes; 1033 args.hdtr = uap->hdtr; 1034 args.sbytes = uap->sbytes; 1035 args.flags = uap->flags; 1036 1037 return (sendfile(td, &args, 1)); 1038 } 1039 #endif /* COMPAT_FREEBSD4 */ 1040