vfs_aio.c revision 175642
1/*-
2 * Copyright (c) 1997 John S. Dyson.  All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 *    notice, this list of conditions and the following disclaimer.
9 * 2. John S. Dyson's name may not be used to endorse or promote products
10 *    derived from this software without specific prior written permission.
11 *
12 * DISCLAIMER:  This code isn't warranted to do anything useful.  Anything
13 * bad that happens because of using this software isn't the responsibility
14 * of the author.  This software is distributed AS-IS.
15 */
16
17/*
18 * This file contains support for the POSIX 1003.1B AIO/LIO facility.
19 */
20
21#include <sys/cdefs.h>
22__FBSDID("$FreeBSD: head/sys/kern/vfs_aio.c 175642 2008-01-24 17:10:19Z dumbbell $");
23
24#include <sys/param.h>
25#include <sys/systm.h>
26#include <sys/malloc.h>
27#include <sys/bio.h>
28#include <sys/buf.h>
29#include <sys/eventhandler.h>
30#include <sys/sysproto.h>
31#include <sys/filedesc.h>
32#include <sys/kernel.h>
33#include <sys/module.h>
34#include <sys/kthread.h>
35#include <sys/fcntl.h>
36#include <sys/file.h>
37#include <sys/limits.h>
38#include <sys/lock.h>
39#include <sys/mutex.h>
40#include <sys/unistd.h>
41#include <sys/posix4.h>
42#include <sys/proc.h>
43#include <sys/resourcevar.h>
44#include <sys/signalvar.h>
45#include <sys/protosw.h>
46#include <sys/sema.h>
47#include <sys/socket.h>
48#include <sys/socketvar.h>
49#include <sys/syscall.h>
50#include <sys/sysent.h>
51#include <sys/sysctl.h>
52#include <sys/sx.h>
53#include <sys/taskqueue.h>
54#include <sys/vnode.h>
55#include <sys/conf.h>
56#include <sys/event.h>
57#include <sys/mount.h>
58
59#include <machine/atomic.h>
60
61#include <vm/vm.h>
62#include <vm/vm_extern.h>
63#include <vm/pmap.h>
64#include <vm/vm_map.h>
65#include <vm/vm_object.h>
66#include <vm/uma.h>
67#include <sys/aio.h>
68
69#include "opt_vfs_aio.h"
70
71/*
72 * Counter for allocating reference ids to new jobs.  Wrapped to 1 on
73 * overflow. (XXX will be removed soon.)
74 */
75static u_long jobrefid;
76
77/*
78 * Counter for aio_fsync.
79 */
80static uint64_t jobseqno;
81
82#define JOBST_NULL		0
83#define JOBST_JOBQSOCK		1
84#define JOBST_JOBQGLOBAL	2
85#define JOBST_JOBRUNNING	3
86#define JOBST_JOBFINISHED	4
87#define JOBST_JOBQBUF		5
88#define JOBST_JOBQSYNC		6
89
90#ifndef MAX_AIO_PER_PROC
91#define MAX_AIO_PER_PROC	32
92#endif
93
94#ifndef MAX_AIO_QUEUE_PER_PROC
95#define MAX_AIO_QUEUE_PER_PROC	256 /* Bigger than AIO_LISTIO_MAX */
96#endif
97
98#ifndef MAX_AIO_PROCS
99#define MAX_AIO_PROCS		32
100#endif
101
102#ifndef MAX_AIO_QUEUE
103#define	MAX_AIO_QUEUE		1024 /* Bigger than AIO_LISTIO_MAX */
104#endif
105
106#ifndef TARGET_AIO_PROCS
107#define TARGET_AIO_PROCS	4
108#endif
109
110#ifndef MAX_BUF_AIO
111#define MAX_BUF_AIO		16
112#endif
113
114#ifndef AIOD_TIMEOUT_DEFAULT
115#define	AIOD_TIMEOUT_DEFAULT	(10 * hz)
116#endif
117
118#ifndef AIOD_LIFETIME_DEFAULT
119#define AIOD_LIFETIME_DEFAULT	(30 * hz)
120#endif
121
122static SYSCTL_NODE(_vfs, OID_AUTO, aio, CTLFLAG_RW, 0, "Async IO management");
123
124static int max_aio_procs = MAX_AIO_PROCS;
125SYSCTL_INT(_vfs_aio, OID_AUTO, max_aio_procs,
126	CTLFLAG_RW, &max_aio_procs, 0,
127	"Maximum number of kernel threads to use for handling async IO ");
128
129static int num_aio_procs = 0;
130SYSCTL_INT(_vfs_aio, OID_AUTO, num_aio_procs,
131	CTLFLAG_RD, &num_aio_procs, 0,
132	"Number of presently active kernel threads for async IO");
133
134/*
135 * The code will adjust the actual number of AIO processes towards this
136 * number when it gets a chance.
137 */
138static int target_aio_procs = TARGET_AIO_PROCS;
139SYSCTL_INT(_vfs_aio, OID_AUTO, target_aio_procs, CTLFLAG_RW, &target_aio_procs,
140	0, "Preferred number of ready kernel threads for async IO");
141
142static int max_queue_count = MAX_AIO_QUEUE;
143SYSCTL_INT(_vfs_aio, OID_AUTO, max_aio_queue, CTLFLAG_RW, &max_queue_count, 0,
144    "Maximum number of aio requests to queue, globally");
145
146static int num_queue_count = 0;
147SYSCTL_INT(_vfs_aio, OID_AUTO, num_queue_count, CTLFLAG_RD, &num_queue_count, 0,
148    "Number of queued aio requests");
149
150static int num_buf_aio = 0;
151SYSCTL_INT(_vfs_aio, OID_AUTO, num_buf_aio, CTLFLAG_RD, &num_buf_aio, 0,
152    "Number of aio requests presently handled by the buf subsystem");
153
154/* Number of async I/O thread in the process of being started */
155/* XXX This should be local to aio_aqueue() */
156static int num_aio_resv_start = 0;
157
158static int aiod_timeout;
159SYSCTL_INT(_vfs_aio, OID_AUTO, aiod_timeout, CTLFLAG_RW, &aiod_timeout, 0,
160    "Timeout value for synchronous aio operations");
161
162static int aiod_lifetime;
163SYSCTL_INT(_vfs_aio, OID_AUTO, aiod_lifetime, CTLFLAG_RW, &aiod_lifetime, 0,
164    "Maximum lifetime for idle aiod");
165
166static int unloadable = 0;
167SYSCTL_INT(_vfs_aio, OID_AUTO, unloadable, CTLFLAG_RW, &unloadable, 0,
168    "Allow unload of aio (not recommended)");
169
170
171static int max_aio_per_proc = MAX_AIO_PER_PROC;
172SYSCTL_INT(_vfs_aio, OID_AUTO, max_aio_per_proc, CTLFLAG_RW, &max_aio_per_proc,
173    0, "Maximum active aio requests per process (stored in the process)");
174
175static int max_aio_queue_per_proc = MAX_AIO_QUEUE_PER_PROC;
176SYSCTL_INT(_vfs_aio, OID_AUTO, max_aio_queue_per_proc, CTLFLAG_RW,
177    &max_aio_queue_per_proc, 0,
178    "Maximum queued aio requests per process (stored in the process)");
179
180static int max_buf_aio = MAX_BUF_AIO;
181SYSCTL_INT(_vfs_aio, OID_AUTO, max_buf_aio, CTLFLAG_RW, &max_buf_aio, 0,
182    "Maximum buf aio requests per process (stored in the process)");
183
184typedef struct oaiocb {
185	int	aio_fildes;		/* File descriptor */
186	off_t	aio_offset;		/* File offset for I/O */
187	volatile void *aio_buf;         /* I/O buffer in process space */
188	size_t	aio_nbytes;		/* Number of bytes for I/O */
189	struct	osigevent aio_sigevent;	/* Signal to deliver */
190	int	aio_lio_opcode;		/* LIO opcode */
191	int	aio_reqprio;		/* Request priority -- ignored */
192	struct	__aiocb_private	_aiocb_private;
193} oaiocb_t;
194
195/*
196 * Below is a key of locks used to protect each member of struct aiocblist
197 * aioliojob and kaioinfo and any backends.
198 *
199 * * - need not protected
200 * a - locked by kaioinfo lock
201 * b - locked by backend lock, the backend lock can be null in some cases,
202 *     for example, BIO belongs to this type, in this case, proc lock is
203 *     reused.
204 * c - locked by aio_job_mtx, the lock for the generic file I/O backend.
205 */
206
207/*
208 * Current, there is only two backends: BIO and generic file I/O.
209 * socket I/O is served by generic file I/O, this is not a good idea, since
210 * disk file I/O and any other types without O_NONBLOCK flag can block daemon
211 * threads, if there is no thread to serve socket I/O, the socket I/O will be
212 * delayed too long or starved, we should create some threads dedicated to
213 * sockets to do non-blocking I/O, same for pipe and fifo, for these I/O
214 * systems we really need non-blocking interface, fiddling O_NONBLOCK in file
215 * structure is not safe because there is race between userland and aio
216 * daemons.
217 */
218
219struct aiocblist {
220	TAILQ_ENTRY(aiocblist) list;	/* (b) internal list of for backend */
221	TAILQ_ENTRY(aiocblist) plist;	/* (a) list of jobs for each backend */
222	TAILQ_ENTRY(aiocblist) allist;  /* (a) list of all jobs in proc */
223	int	jobflags;		/* (a) job flags */
224	int	jobstate;		/* (b) job state */
225	int	inputcharge;		/* (*) input blockes */
226	int	outputcharge;		/* (*) output blockes */
227	struct	buf *bp;		/* (*) private to BIO backend,
228				  	 * buffer pointer
229					 */
230	struct	proc *userproc;		/* (*) user process */
231	struct  ucred *cred;		/* (*) active credential when created */
232	struct	file *fd_file;		/* (*) pointer to file structure */
233	struct	aioliojob *lio;		/* (*) optional lio job */
234	struct	aiocb *uuaiocb;		/* (*) pointer in userspace of aiocb */
235	struct	knlist klist;		/* (a) list of knotes */
236	struct	aiocb uaiocb;		/* (*) kernel I/O control block */
237	ksiginfo_t ksi;			/* (a) realtime signal info */
238	struct	task biotask;		/* (*) private to BIO backend */
239	uint64_t seqno;			/* (*) job number */
240	int	pending;		/* (a) number of pending I/O, aio_fsync only */
241};
242
243/* jobflags */
244#define AIOCBLIST_DONE		0x01
245#define AIOCBLIST_BUFDONE	0x02
246#define AIOCBLIST_RUNDOWN	0x04
247#define AIOCBLIST_CHECKSYNC	0x08
248
249/*
250 * AIO process info
251 */
252#define AIOP_FREE	0x1			/* proc on free queue */
253
254struct aiothreadlist {
255	int aiothreadflags;			/* (c) AIO proc flags */
256	TAILQ_ENTRY(aiothreadlist) list;	/* (c) list of processes */
257	struct thread *aiothread;		/* (*) the AIO thread */
258};
259
260/*
261 * data-structure for lio signal management
262 */
263struct aioliojob {
264	int	lioj_flags;			/* (a) listio flags */
265	int	lioj_count;			/* (a) listio flags */
266	int	lioj_finished_count;		/* (a) listio flags */
267	struct	sigevent lioj_signal;		/* (a) signal on all I/O done */
268	TAILQ_ENTRY(aioliojob) lioj_list;	/* (a) lio list */
269	struct  knlist klist;			/* (a) list of knotes */
270	ksiginfo_t lioj_ksi;			/* (a) Realtime signal info */
271};
272
273#define	LIOJ_SIGNAL		0x1	/* signal on all done (lio) */
274#define	LIOJ_SIGNAL_POSTED	0x2	/* signal has been posted */
275#define LIOJ_KEVENT_POSTED	0x4	/* kevent triggered */
276
277/*
278 * per process aio data structure
279 */
280struct kaioinfo {
281	struct mtx	kaio_mtx;	/* the lock to protect this struct */
282	int	kaio_flags;		/* (a) per process kaio flags */
283	int	kaio_maxactive_count;	/* (*) maximum number of AIOs */
284	int	kaio_active_count;	/* (c) number of currently used AIOs */
285	int	kaio_qallowed_count;	/* (*) maxiumu size of AIO queue */
286	int	kaio_count;		/* (a) size of AIO queue */
287	int	kaio_ballowed_count;	/* (*) maximum number of buffers */
288	int	kaio_buffer_count;	/* (a) number of physio buffers */
289	TAILQ_HEAD(,aiocblist) kaio_all;	/* (a) all AIOs in the process */
290	TAILQ_HEAD(,aiocblist) kaio_done;	/* (a) done queue for process */
291	TAILQ_HEAD(,aioliojob) kaio_liojoblist; /* (a) list of lio jobs */
292	TAILQ_HEAD(,aiocblist) kaio_jobqueue;	/* (a) job queue for process */
293	TAILQ_HEAD(,aiocblist) kaio_bufqueue;	/* (a) buffer job queue for process */
294	TAILQ_HEAD(,aiocblist) kaio_sockqueue;  /* (a) queue for aios waiting on sockets,
295						 *  NOT USED YET.
296						 */
297	TAILQ_HEAD(,aiocblist) kaio_syncqueue;	/* (a) queue for aio_fsync */
298	struct	task	kaio_task;	/* (*) task to kick aio threads */
299};
300
301#define AIO_LOCK(ki)		mtx_lock(&(ki)->kaio_mtx)
302#define AIO_UNLOCK(ki)		mtx_unlock(&(ki)->kaio_mtx)
303#define AIO_LOCK_ASSERT(ki, f)	mtx_assert(&(ki)->kaio_mtx, (f))
304#define AIO_MTX(ki)		(&(ki)->kaio_mtx)
305
306#define KAIO_RUNDOWN	0x1	/* process is being run down */
307#define KAIO_WAKEUP	0x2	/* wakeup process when there is a significant event */
308
309static TAILQ_HEAD(,aiothreadlist) aio_freeproc;		/* (c) Idle daemons */
310static struct sema aio_newproc_sem;
311static struct mtx aio_job_mtx;
312static struct mtx aio_sock_mtx;
313static TAILQ_HEAD(,aiocblist) aio_jobs;			/* (c) Async job list */
314static struct unrhdr *aiod_unr;
315
316void		aio_init_aioinfo(struct proc *p);
317static void	aio_onceonly(void);
318static int	aio_free_entry(struct aiocblist *aiocbe);
319static void	aio_process(struct aiocblist *aiocbe);
320static int	aio_newproc(int *);
321int		aio_aqueue(struct thread *td, struct aiocb *job,
322			struct aioliojob *lio, int type, int osigev);
323static void	aio_physwakeup(struct buf *bp);
324static void	aio_proc_rundown(void *arg, struct proc *p);
325static void	aio_proc_rundown_exec(void *arg, struct proc *p, struct image_params *imgp);
326static int	aio_qphysio(struct proc *p, struct aiocblist *iocb);
327static void	biohelper(void *, int);
328static void	aio_daemon(void *param);
329static void	aio_swake_cb(struct socket *, struct sockbuf *);
330static int	aio_unload(void);
331static void	aio_bio_done_notify(struct proc *userp, struct aiocblist *aiocbe, int type);
332#define DONE_BUF	1
333#define DONE_QUEUE	2
334static int	do_lio_listio(struct thread *td, struct lio_listio_args *uap, int oldsigev);
335static int	aio_kick(struct proc *userp);
336static void	aio_kick_nowait(struct proc *userp);
337static void	aio_kick_helper(void *context, int pending);
338static int	filt_aioattach(struct knote *kn);
339static void	filt_aiodetach(struct knote *kn);
340static int	filt_aio(struct knote *kn, long hint);
341static int	filt_lioattach(struct knote *kn);
342static void	filt_liodetach(struct knote *kn);
343static int	filt_lio(struct knote *kn, long hint);
344
345/*
346 * Zones for:
347 * 	kaio	Per process async io info
348 *	aiop	async io thread data
349 *	aiocb	async io jobs
350 *	aiol	list io job pointer - internal to aio_suspend XXX
351 *	aiolio	list io jobs
352 */
353static uma_zone_t kaio_zone, aiop_zone, aiocb_zone, aiol_zone, aiolio_zone;
354
355/* kqueue filters for aio */
356static struct filterops aio_filtops =
357	{ 0, filt_aioattach, filt_aiodetach, filt_aio };
358static struct filterops lio_filtops =
359	{ 0, filt_lioattach, filt_liodetach, filt_lio };
360
361static eventhandler_tag exit_tag, exec_tag;
362
363TASKQUEUE_DEFINE_THREAD(aiod_bio);
364
365/*
366 * Main operations function for use as a kernel module.
367 */
368static int
369aio_modload(struct module *module, int cmd, void *arg)
370{
371	int error = 0;
372
373	switch (cmd) {
374	case MOD_LOAD:
375		aio_onceonly();
376		break;
377	case MOD_UNLOAD:
378		error = aio_unload();
379		break;
380	case MOD_SHUTDOWN:
381		break;
382	default:
383		error = EINVAL;
384		break;
385	}
386	return (error);
387}
388
389static moduledata_t aio_mod = {
390	"aio",
391	&aio_modload,
392	NULL
393};
394
395SYSCALL_MODULE_HELPER(aio_cancel);
396SYSCALL_MODULE_HELPER(aio_error);
397SYSCALL_MODULE_HELPER(aio_fsync);
398SYSCALL_MODULE_HELPER(aio_read);
399SYSCALL_MODULE_HELPER(aio_return);
400SYSCALL_MODULE_HELPER(aio_suspend);
401SYSCALL_MODULE_HELPER(aio_waitcomplete);
402SYSCALL_MODULE_HELPER(aio_write);
403SYSCALL_MODULE_HELPER(lio_listio);
404SYSCALL_MODULE_HELPER(oaio_read);
405SYSCALL_MODULE_HELPER(oaio_write);
406SYSCALL_MODULE_HELPER(olio_listio);
407
408DECLARE_MODULE(aio, aio_mod,
409	SI_SUB_VFS, SI_ORDER_ANY);
410MODULE_VERSION(aio, 1);
411
412/*
413 * Startup initialization
414 */
415static void
416aio_onceonly(void)
417{
418
419	/* XXX: should probably just use so->callback */
420	aio_swake = &aio_swake_cb;
421	exit_tag = EVENTHANDLER_REGISTER(process_exit, aio_proc_rundown, NULL,
422	    EVENTHANDLER_PRI_ANY);
423	exec_tag = EVENTHANDLER_REGISTER(process_exec, aio_proc_rundown_exec, NULL,
424	    EVENTHANDLER_PRI_ANY);
425	kqueue_add_filteropts(EVFILT_AIO, &aio_filtops);
426	kqueue_add_filteropts(EVFILT_LIO, &lio_filtops);
427	TAILQ_INIT(&aio_freeproc);
428	sema_init(&aio_newproc_sem, 0, "aio_new_proc");
429	mtx_init(&aio_job_mtx, "aio_job", NULL, MTX_DEF);
430	mtx_init(&aio_sock_mtx, "aio_sock", NULL, MTX_DEF);
431	TAILQ_INIT(&aio_jobs);
432	aiod_unr = new_unrhdr(1, INT_MAX, NULL);
433	kaio_zone = uma_zcreate("AIO", sizeof(struct kaioinfo), NULL, NULL,
434	    NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
435	aiop_zone = uma_zcreate("AIOP", sizeof(struct aiothreadlist), NULL,
436	    NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
437	aiocb_zone = uma_zcreate("AIOCB", sizeof(struct aiocblist), NULL, NULL,
438	    NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
439	aiol_zone = uma_zcreate("AIOL", AIO_LISTIO_MAX*sizeof(intptr_t) , NULL,
440	    NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
441	aiolio_zone = uma_zcreate("AIOLIO", sizeof(struct aioliojob), NULL,
442	    NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
443	aiod_timeout = AIOD_TIMEOUT_DEFAULT;
444	aiod_lifetime = AIOD_LIFETIME_DEFAULT;
445	jobrefid = 1;
446	async_io_version = _POSIX_VERSION;
447	p31b_setcfg(CTL_P1003_1B_AIO_LISTIO_MAX, AIO_LISTIO_MAX);
448	p31b_setcfg(CTL_P1003_1B_AIO_MAX, MAX_AIO_QUEUE);
449	p31b_setcfg(CTL_P1003_1B_AIO_PRIO_DELTA_MAX, 0);
450}
451
452/*
453 * Callback for unload of AIO when used as a module.
454 */
455static int
456aio_unload(void)
457{
458	int error;
459
460	/*
461	 * XXX: no unloads by default, it's too dangerous.
462	 * perhaps we could do it if locked out callers and then
463	 * did an aio_proc_rundown() on each process.
464	 *
465	 * jhb: aio_proc_rundown() needs to run on curproc though,
466	 * so I don't think that would fly.
467	 */
468	if (!unloadable)
469		return (EOPNOTSUPP);
470
471	error = kqueue_del_filteropts(EVFILT_AIO);
472	if (error)
473		return error;
474	error = kqueue_del_filteropts(EVFILT_LIO);
475	if (error)
476		return error;
477	async_io_version = 0;
478	aio_swake = NULL;
479	taskqueue_free(taskqueue_aiod_bio);
480	delete_unrhdr(aiod_unr);
481	uma_zdestroy(kaio_zone);
482	uma_zdestroy(aiop_zone);
483	uma_zdestroy(aiocb_zone);
484	uma_zdestroy(aiol_zone);
485	uma_zdestroy(aiolio_zone);
486	EVENTHANDLER_DEREGISTER(process_exit, exit_tag);
487	EVENTHANDLER_DEREGISTER(process_exec, exec_tag);
488	mtx_destroy(&aio_job_mtx);
489	mtx_destroy(&aio_sock_mtx);
490	sema_destroy(&aio_newproc_sem);
491	p31b_setcfg(CTL_P1003_1B_AIO_LISTIO_MAX, -1);
492	p31b_setcfg(CTL_P1003_1B_AIO_MAX, -1);
493	p31b_setcfg(CTL_P1003_1B_AIO_PRIO_DELTA_MAX, -1);
494	return (0);
495}
496
497/*
498 * Init the per-process aioinfo structure.  The aioinfo limits are set
499 * per-process for user limit (resource) management.
500 */
501void
502aio_init_aioinfo(struct proc *p)
503{
504	struct kaioinfo *ki;
505
506	ki = uma_zalloc(kaio_zone, M_WAITOK);
507	mtx_init(&ki->kaio_mtx, "aiomtx", NULL, MTX_DEF);
508	ki->kaio_flags = 0;
509	ki->kaio_maxactive_count = max_aio_per_proc;
510	ki->kaio_active_count = 0;
511	ki->kaio_qallowed_count = max_aio_queue_per_proc;
512	ki->kaio_count = 0;
513	ki->kaio_ballowed_count = max_buf_aio;
514	ki->kaio_buffer_count = 0;
515	TAILQ_INIT(&ki->kaio_all);
516	TAILQ_INIT(&ki->kaio_done);
517	TAILQ_INIT(&ki->kaio_jobqueue);
518	TAILQ_INIT(&ki->kaio_bufqueue);
519	TAILQ_INIT(&ki->kaio_liojoblist);
520	TAILQ_INIT(&ki->kaio_sockqueue);
521	TAILQ_INIT(&ki->kaio_syncqueue);
522	TASK_INIT(&ki->kaio_task, 0, aio_kick_helper, p);
523	PROC_LOCK(p);
524	if (p->p_aioinfo == NULL) {
525		p->p_aioinfo = ki;
526		PROC_UNLOCK(p);
527	} else {
528		PROC_UNLOCK(p);
529		mtx_destroy(&ki->kaio_mtx);
530		uma_zfree(kaio_zone, ki);
531	}
532
533	while (num_aio_procs < target_aio_procs)
534		aio_newproc(NULL);
535}
536
537static int
538aio_sendsig(struct proc *p, struct sigevent *sigev, ksiginfo_t *ksi)
539{
540	int ret = 0;
541
542	PROC_LOCK(p);
543	if (!KSI_ONQ(ksi)) {
544		ksi->ksi_code = SI_ASYNCIO;
545		ksi->ksi_flags |= KSI_EXT | KSI_INS;
546		ret = psignal_event(p, sigev, ksi);
547	}
548	PROC_UNLOCK(p);
549	return (ret);
550}
551
552/*
553 * Free a job entry.  Wait for completion if it is currently active, but don't
554 * delay forever.  If we delay, we return a flag that says that we have to
555 * restart the queue scan.
556 */
557static int
558aio_free_entry(struct aiocblist *aiocbe)
559{
560	struct kaioinfo *ki;
561	struct aioliojob *lj;
562	struct proc *p;
563
564	p = aiocbe->userproc;
565	MPASS(curproc == p);
566	ki = p->p_aioinfo;
567	MPASS(ki != NULL);
568
569	AIO_LOCK_ASSERT(ki, MA_OWNED);
570	MPASS(aiocbe->jobstate == JOBST_JOBFINISHED);
571
572	atomic_subtract_int(&num_queue_count, 1);
573
574	ki->kaio_count--;
575	MPASS(ki->kaio_count >= 0);
576
577	TAILQ_REMOVE(&ki->kaio_done, aiocbe, plist);
578	TAILQ_REMOVE(&ki->kaio_all, aiocbe, allist);
579
580	lj = aiocbe->lio;
581	if (lj) {
582		lj->lioj_count--;
583		lj->lioj_finished_count--;
584
585		if (lj->lioj_count == 0) {
586			TAILQ_REMOVE(&ki->kaio_liojoblist, lj, lioj_list);
587			/* lio is going away, we need to destroy any knotes */
588			knlist_delete(&lj->klist, curthread, 1);
589			PROC_LOCK(p);
590			sigqueue_take(&lj->lioj_ksi);
591			PROC_UNLOCK(p);
592			uma_zfree(aiolio_zone, lj);
593		}
594	}
595
596	/* aiocbe is going away, we need to destroy any knotes */
597	knlist_delete(&aiocbe->klist, curthread, 1);
598	PROC_LOCK(p);
599	sigqueue_take(&aiocbe->ksi);
600	PROC_UNLOCK(p);
601
602	MPASS(aiocbe->bp == NULL);
603	aiocbe->jobstate = JOBST_NULL;
604	AIO_UNLOCK(ki);
605
606	/*
607	 * The thread argument here is used to find the owning process
608	 * and is also passed to fo_close() which may pass it to various
609	 * places such as devsw close() routines.  Because of that, we
610	 * need a thread pointer from the process owning the job that is
611	 * persistent and won't disappear out from under us or move to
612	 * another process.
613	 *
614	 * Currently, all the callers of this function call it to remove
615	 * an aiocblist from the current process' job list either via a
616	 * syscall or due to the current process calling exit() or
617	 * execve().  Thus, we know that p == curproc.  We also know that
618	 * curthread can't exit since we are curthread.
619	 *
620	 * Therefore, we use curthread as the thread to pass to
621	 * knlist_delete().  This does mean that it is possible for the
622	 * thread pointer at close time to differ from the thread pointer
623	 * at open time, but this is already true of file descriptors in
624	 * a multithreaded process.
625	 */
626	fdrop(aiocbe->fd_file, curthread);
627	crfree(aiocbe->cred);
628	uma_zfree(aiocb_zone, aiocbe);
629	AIO_LOCK(ki);
630
631	return (0);
632}
633
634static void
635aio_proc_rundown_exec(void *arg, struct proc *p, struct image_params *imgp __unused)
636{
637   	aio_proc_rundown(arg, p);
638}
639
640/*
641 * Rundown the jobs for a given process.
642 */
643static void
644aio_proc_rundown(void *arg, struct proc *p)
645{
646	struct kaioinfo *ki;
647	struct aioliojob *lj;
648	struct aiocblist *cbe, *cbn;
649	struct file *fp;
650	struct socket *so;
651	int remove;
652
653	KASSERT(curthread->td_proc == p,
654	    ("%s: called on non-curproc", __func__));
655	ki = p->p_aioinfo;
656	if (ki == NULL)
657		return;
658
659	AIO_LOCK(ki);
660	ki->kaio_flags |= KAIO_RUNDOWN;
661
662restart:
663
664	/*
665	 * Try to cancel all pending requests. This code simulates
666	 * aio_cancel on all pending I/O requests.
667	 */
668	TAILQ_FOREACH_SAFE(cbe, &ki->kaio_jobqueue, plist, cbn) {
669		remove = 0;
670		mtx_lock(&aio_job_mtx);
671		if (cbe->jobstate == JOBST_JOBQGLOBAL) {
672			TAILQ_REMOVE(&aio_jobs, cbe, list);
673			remove = 1;
674		} else if (cbe->jobstate == JOBST_JOBQSOCK) {
675			fp = cbe->fd_file;
676			MPASS(fp->f_type == DTYPE_SOCKET);
677			so = fp->f_data;
678			TAILQ_REMOVE(&so->so_aiojobq, cbe, list);
679			remove = 1;
680		} else if (cbe->jobstate == JOBST_JOBQSYNC) {
681			TAILQ_REMOVE(&ki->kaio_syncqueue, cbe, list);
682			remove = 1;
683		}
684		mtx_unlock(&aio_job_mtx);
685
686		if (remove) {
687			cbe->jobstate = JOBST_JOBFINISHED;
688			cbe->uaiocb._aiocb_private.status = -1;
689			cbe->uaiocb._aiocb_private.error = ECANCELED;
690			TAILQ_REMOVE(&ki->kaio_jobqueue, cbe, plist);
691			aio_bio_done_notify(p, cbe, DONE_QUEUE);
692		}
693	}
694
695	/* Wait for all running I/O to be finished */
696	if (TAILQ_FIRST(&ki->kaio_bufqueue) ||
697	    TAILQ_FIRST(&ki->kaio_jobqueue)) {
698		ki->kaio_flags |= KAIO_WAKEUP;
699		msleep(&p->p_aioinfo, AIO_MTX(ki), PRIBIO, "aioprn", hz);
700		goto restart;
701	}
702
703	/* Free all completed I/O requests. */
704	while ((cbe = TAILQ_FIRST(&ki->kaio_done)) != NULL)
705		aio_free_entry(cbe);
706
707	while ((lj = TAILQ_FIRST(&ki->kaio_liojoblist)) != NULL) {
708		if (lj->lioj_count == 0) {
709			TAILQ_REMOVE(&ki->kaio_liojoblist, lj, lioj_list);
710			knlist_delete(&lj->klist, curthread, 1);
711			PROC_LOCK(p);
712			sigqueue_take(&lj->lioj_ksi);
713			PROC_UNLOCK(p);
714			uma_zfree(aiolio_zone, lj);
715		} else {
716			panic("LIO job not cleaned up: C:%d, FC:%d\n",
717			    lj->lioj_count, lj->lioj_finished_count);
718		}
719	}
720	AIO_UNLOCK(ki);
721	taskqueue_drain(taskqueue_aiod_bio, &ki->kaio_task);
722	mtx_destroy(&ki->kaio_mtx);
723	uma_zfree(kaio_zone, ki);
724	p->p_aioinfo = NULL;
725}
726
727/*
728 * Select a job to run (called by an AIO daemon).
729 */
730static struct aiocblist *
731aio_selectjob(struct aiothreadlist *aiop)
732{
733	struct aiocblist *aiocbe;
734	struct kaioinfo *ki;
735	struct proc *userp;
736
737	mtx_assert(&aio_job_mtx, MA_OWNED);
738	TAILQ_FOREACH(aiocbe, &aio_jobs, list) {
739		userp = aiocbe->userproc;
740		ki = userp->p_aioinfo;
741
742		if (ki->kaio_active_count < ki->kaio_maxactive_count) {
743			TAILQ_REMOVE(&aio_jobs, aiocbe, list);
744			/* Account for currently active jobs. */
745			ki->kaio_active_count++;
746			aiocbe->jobstate = JOBST_JOBRUNNING;
747			break;
748		}
749	}
750	return (aiocbe);
751}
752
753/*
754 *  Move all data to a permanent storage device, this code
755 *  simulates fsync syscall.
756 */
757static int
758aio_fsync_vnode(struct thread *td, struct vnode *vp)
759{
760	struct mount *mp;
761	int vfslocked;
762	int error;
763
764	vfslocked = VFS_LOCK_GIANT(vp->v_mount);
765	if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0)
766		goto drop;
767	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
768	if (vp->v_object != NULL) {
769		VM_OBJECT_LOCK(vp->v_object);
770		vm_object_page_clean(vp->v_object, 0, 0, 0);
771		VM_OBJECT_UNLOCK(vp->v_object);
772	}
773	error = VOP_FSYNC(vp, MNT_WAIT, td);
774
775	VOP_UNLOCK(vp, 0);
776	vn_finished_write(mp);
777drop:
778	VFS_UNLOCK_GIANT(vfslocked);
779	return (error);
780}
781
782/*
783 * The AIO processing activity.  This is the code that does the I/O request for
784 * the non-physio version of the operations.  The normal vn operations are used,
785 * and this code should work in all instances for every type of file, including
786 * pipes, sockets, fifos, and regular files.
787 *
788 * XXX I don't think it works well for socket, pipe, and fifo.
789 */
790static void
791aio_process(struct aiocblist *aiocbe)
792{
793	struct ucred *td_savedcred;
794	struct thread *td;
795	struct aiocb *cb;
796	struct file *fp;
797	struct socket *so;
798	struct uio auio;
799	struct iovec aiov;
800	int cnt;
801	int error;
802	int oublock_st, oublock_end;
803	int inblock_st, inblock_end;
804
805	td = curthread;
806	td_savedcred = td->td_ucred;
807	td->td_ucred = aiocbe->cred;
808	cb = &aiocbe->uaiocb;
809	fp = aiocbe->fd_file;
810
811	if (cb->aio_lio_opcode == LIO_SYNC) {
812		error = 0;
813		cnt = 0;
814		if (fp->f_vnode != NULL)
815			error = aio_fsync_vnode(td, fp->f_vnode);
816		cb->_aiocb_private.error = error;
817		cb->_aiocb_private.status = 0;
818		td->td_ucred = td_savedcred;
819		return;
820	}
821
822	aiov.iov_base = (void *)(uintptr_t)cb->aio_buf;
823	aiov.iov_len = cb->aio_nbytes;
824
825	auio.uio_iov = &aiov;
826	auio.uio_iovcnt = 1;
827	auio.uio_offset = cb->aio_offset;
828	auio.uio_resid = cb->aio_nbytes;
829	cnt = cb->aio_nbytes;
830	auio.uio_segflg = UIO_USERSPACE;
831	auio.uio_td = td;
832
833	inblock_st = td->td_ru.ru_inblock;
834	oublock_st = td->td_ru.ru_oublock;
835	/*
836	 * aio_aqueue() acquires a reference to the file that is
837	 * released in aio_free_entry().
838	 */
839	if (cb->aio_lio_opcode == LIO_READ) {
840		auio.uio_rw = UIO_READ;
841		if (auio.uio_resid == 0)
842			error = 0;
843		else
844			error = fo_read(fp, &auio, fp->f_cred, FOF_OFFSET, td);
845	} else {
846		if (fp->f_type == DTYPE_VNODE)
847			bwillwrite();
848		auio.uio_rw = UIO_WRITE;
849		error = fo_write(fp, &auio, fp->f_cred, FOF_OFFSET, td);
850	}
851	inblock_end = td->td_ru.ru_inblock;
852	oublock_end = td->td_ru.ru_oublock;
853
854	aiocbe->inputcharge = inblock_end - inblock_st;
855	aiocbe->outputcharge = oublock_end - oublock_st;
856
857	if ((error) && (auio.uio_resid != cnt)) {
858		if (error == ERESTART || error == EINTR || error == EWOULDBLOCK)
859			error = 0;
860		if ((error == EPIPE) && (cb->aio_lio_opcode == LIO_WRITE)) {
861			int sigpipe = 1;
862			if (fp->f_type == DTYPE_SOCKET) {
863				so = fp->f_data;
864				if (so->so_options & SO_NOSIGPIPE)
865					sigpipe = 0;
866			}
867			if (sigpipe) {
868				PROC_LOCK(aiocbe->userproc);
869				psignal(aiocbe->userproc, SIGPIPE);
870				PROC_UNLOCK(aiocbe->userproc);
871			}
872		}
873	}
874
875	cnt -= auio.uio_resid;
876	cb->_aiocb_private.error = error;
877	cb->_aiocb_private.status = cnt;
878	td->td_ucred = td_savedcred;
879}
880
881static void
882aio_bio_done_notify(struct proc *userp, struct aiocblist *aiocbe, int type)
883{
884	struct aioliojob *lj;
885	struct kaioinfo *ki;
886	struct aiocblist *scb, *scbn;
887	int lj_done;
888
889	ki = userp->p_aioinfo;
890	AIO_LOCK_ASSERT(ki, MA_OWNED);
891	lj = aiocbe->lio;
892	lj_done = 0;
893	if (lj) {
894		lj->lioj_finished_count++;
895		if (lj->lioj_count == lj->lioj_finished_count)
896			lj_done = 1;
897	}
898	if (type == DONE_QUEUE) {
899		aiocbe->jobflags |= AIOCBLIST_DONE;
900	} else {
901		aiocbe->jobflags |= AIOCBLIST_BUFDONE;
902	}
903	TAILQ_INSERT_TAIL(&ki->kaio_done, aiocbe, plist);
904	aiocbe->jobstate = JOBST_JOBFINISHED;
905
906	if (ki->kaio_flags & KAIO_RUNDOWN)
907		goto notification_done;
908
909	if (aiocbe->uaiocb.aio_sigevent.sigev_notify == SIGEV_SIGNAL ||
910	    aiocbe->uaiocb.aio_sigevent.sigev_notify == SIGEV_THREAD_ID)
911		aio_sendsig(userp, &aiocbe->uaiocb.aio_sigevent, &aiocbe->ksi);
912
913	KNOTE_LOCKED(&aiocbe->klist, 1);
914
915	if (lj_done) {
916		if (lj->lioj_signal.sigev_notify == SIGEV_KEVENT) {
917			lj->lioj_flags |= LIOJ_KEVENT_POSTED;
918			KNOTE_LOCKED(&lj->klist, 1);
919		}
920		if ((lj->lioj_flags & (LIOJ_SIGNAL|LIOJ_SIGNAL_POSTED))
921		    == LIOJ_SIGNAL
922		    && (lj->lioj_signal.sigev_notify == SIGEV_SIGNAL ||
923		        lj->lioj_signal.sigev_notify == SIGEV_THREAD_ID)) {
924			aio_sendsig(userp, &lj->lioj_signal, &lj->lioj_ksi);
925			lj->lioj_flags |= LIOJ_SIGNAL_POSTED;
926		}
927	}
928
929notification_done:
930	if (aiocbe->jobflags & AIOCBLIST_CHECKSYNC) {
931		TAILQ_FOREACH_SAFE(scb, &ki->kaio_syncqueue, list, scbn) {
932			if (aiocbe->fd_file == scb->fd_file &&
933			    aiocbe->seqno < scb->seqno) {
934				if (--scb->pending == 0) {
935					mtx_lock(&aio_job_mtx);
936					scb->jobstate = JOBST_JOBQGLOBAL;
937					TAILQ_REMOVE(&ki->kaio_syncqueue, scb, list);
938					TAILQ_INSERT_TAIL(&aio_jobs, scb, list);
939					aio_kick_nowait(userp);
940					mtx_unlock(&aio_job_mtx);
941				}
942			}
943		}
944	}
945	if (ki->kaio_flags & KAIO_WAKEUP) {
946		ki->kaio_flags &= ~KAIO_WAKEUP;
947		wakeup(&userp->p_aioinfo);
948	}
949}
950
951/*
952 * The AIO daemon, most of the actual work is done in aio_process,
953 * but the setup (and address space mgmt) is done in this routine.
954 */
955static void
956aio_daemon(void *_id)
957{
958	struct aiocblist *aiocbe;
959	struct aiothreadlist *aiop;
960	struct kaioinfo *ki;
961	struct proc *curcp, *mycp, *userp;
962	struct vmspace *myvm, *tmpvm;
963	struct thread *td = curthread;
964	int id = (intptr_t)_id;
965
966	/*
967	 * Local copies of curproc (cp) and vmspace (myvm)
968	 */
969	mycp = td->td_proc;
970	myvm = mycp->p_vmspace;
971
972	KASSERT(mycp->p_textvp == NULL, ("kthread has a textvp"));
973
974	/*
975	 * Allocate and ready the aio control info.  There is one aiop structure
976	 * per daemon.
977	 */
978	aiop = uma_zalloc(aiop_zone, M_WAITOK);
979	aiop->aiothread = td;
980	aiop->aiothreadflags = 0;
981
982	/* The daemon resides in its own pgrp. */
983	setsid(td, NULL);
984
985	/*
986	 * Wakeup parent process.  (Parent sleeps to keep from blasting away
987	 * and creating too many daemons.)
988	 */
989	sema_post(&aio_newproc_sem);
990
991	mtx_lock(&aio_job_mtx);
992	for (;;) {
993		/*
994		 * curcp is the current daemon process context.
995		 * userp is the current user process context.
996		 */
997		curcp = mycp;
998
999		/*
1000		 * Take daemon off of free queue
1001		 */
1002		if (aiop->aiothreadflags & AIOP_FREE) {
1003			TAILQ_REMOVE(&aio_freeproc, aiop, list);
1004			aiop->aiothreadflags &= ~AIOP_FREE;
1005		}
1006
1007		/*
1008		 * Check for jobs.
1009		 */
1010		while ((aiocbe = aio_selectjob(aiop)) != NULL) {
1011			mtx_unlock(&aio_job_mtx);
1012			userp = aiocbe->userproc;
1013
1014			/*
1015			 * Connect to process address space for user program.
1016			 */
1017			if (userp != curcp) {
1018				/*
1019				 * Save the current address space that we are
1020				 * connected to.
1021				 */
1022				tmpvm = mycp->p_vmspace;
1023
1024				/*
1025				 * Point to the new user address space, and
1026				 * refer to it.
1027				 */
1028				mycp->p_vmspace = userp->p_vmspace;
1029				atomic_add_int(&mycp->p_vmspace->vm_refcnt, 1);
1030
1031				/* Activate the new mapping. */
1032				pmap_activate(FIRST_THREAD_IN_PROC(mycp));
1033
1034				/*
1035				 * If the old address space wasn't the daemons
1036				 * own address space, then we need to remove the
1037				 * daemon's reference from the other process
1038				 * that it was acting on behalf of.
1039				 */
1040				if (tmpvm != myvm) {
1041					vmspace_free(tmpvm);
1042				}
1043				curcp = userp;
1044			}
1045
1046			ki = userp->p_aioinfo;
1047
1048			/* Do the I/O function. */
1049			aio_process(aiocbe);
1050
1051			mtx_lock(&aio_job_mtx);
1052			/* Decrement the active job count. */
1053			ki->kaio_active_count--;
1054			mtx_unlock(&aio_job_mtx);
1055
1056			AIO_LOCK(ki);
1057			TAILQ_REMOVE(&ki->kaio_jobqueue, aiocbe, plist);
1058			aio_bio_done_notify(userp, aiocbe, DONE_QUEUE);
1059			AIO_UNLOCK(ki);
1060
1061			mtx_lock(&aio_job_mtx);
1062		}
1063
1064		/*
1065		 * Disconnect from user address space.
1066		 */
1067		if (curcp != mycp) {
1068
1069			mtx_unlock(&aio_job_mtx);
1070
1071			/* Get the user address space to disconnect from. */
1072			tmpvm = mycp->p_vmspace;
1073
1074			/* Get original address space for daemon. */
1075			mycp->p_vmspace = myvm;
1076
1077			/* Activate the daemon's address space. */
1078			pmap_activate(FIRST_THREAD_IN_PROC(mycp));
1079#ifdef DIAGNOSTIC
1080			if (tmpvm == myvm) {
1081				printf("AIOD: vmspace problem -- %d\n",
1082				    mycp->p_pid);
1083			}
1084#endif
1085			/* Remove our vmspace reference. */
1086			vmspace_free(tmpvm);
1087
1088			curcp = mycp;
1089
1090			mtx_lock(&aio_job_mtx);
1091			/*
1092			 * We have to restart to avoid race, we only sleep if
1093			 * no job can be selected, that should be
1094			 * curcp == mycp.
1095			 */
1096			continue;
1097		}
1098
1099		mtx_assert(&aio_job_mtx, MA_OWNED);
1100
1101		TAILQ_INSERT_HEAD(&aio_freeproc, aiop, list);
1102		aiop->aiothreadflags |= AIOP_FREE;
1103
1104		/*
1105		 * If daemon is inactive for a long time, allow it to exit,
1106		 * thereby freeing resources.
1107		 */
1108		if (msleep(aiop->aiothread, &aio_job_mtx, PRIBIO, "aiordy",
1109		    aiod_lifetime)) {
1110			if (TAILQ_EMPTY(&aio_jobs)) {
1111				if ((aiop->aiothreadflags & AIOP_FREE) &&
1112				    (num_aio_procs > target_aio_procs)) {
1113					TAILQ_REMOVE(&aio_freeproc, aiop, list);
1114					num_aio_procs--;
1115					mtx_unlock(&aio_job_mtx);
1116					uma_zfree(aiop_zone, aiop);
1117					free_unr(aiod_unr, id);
1118#ifdef DIAGNOSTIC
1119					if (mycp->p_vmspace->vm_refcnt <= 1) {
1120						printf("AIOD: bad vm refcnt for"
1121						    " exiting daemon: %d\n",
1122						    mycp->p_vmspace->vm_refcnt);
1123					}
1124#endif
1125					kproc_exit(0);
1126				}
1127			}
1128		}
1129	}
1130	mtx_unlock(&aio_job_mtx);
1131	panic("shouldn't be here\n");
1132}
1133
1134/*
1135 * Create a new AIO daemon. This is mostly a kernel-thread fork routine. The
1136 * AIO daemon modifies its environment itself.
1137 */
1138static int
1139aio_newproc(int *start)
1140{
1141	int error;
1142	struct proc *p;
1143	int id;
1144
1145	id = alloc_unr(aiod_unr);
1146	error = kproc_create(aio_daemon, (void *)(intptr_t)id, &p,
1147		RFNOWAIT, 0, "aiod%d", id);
1148	if (error == 0) {
1149		/*
1150		 * Wait until daemon is started.
1151		 */
1152		sema_wait(&aio_newproc_sem);
1153		mtx_lock(&aio_job_mtx);
1154		num_aio_procs++;
1155		if (start != NULL)
1156			(*start)--;
1157		mtx_unlock(&aio_job_mtx);
1158	} else {
1159		free_unr(aiod_unr, id);
1160	}
1161	return (error);
1162}
1163
1164/*
1165 * Try the high-performance, low-overhead physio method for eligible
1166 * VCHR devices.  This method doesn't use an aio helper thread, and
1167 * thus has very low overhead.
1168 *
1169 * Assumes that the caller, aio_aqueue(), has incremented the file
1170 * structure's reference count, preventing its deallocation for the
1171 * duration of this call.
1172 */
1173static int
1174aio_qphysio(struct proc *p, struct aiocblist *aiocbe)
1175{
1176	struct aiocb *cb;
1177	struct file *fp;
1178	struct buf *bp;
1179	struct vnode *vp;
1180	struct kaioinfo *ki;
1181	struct aioliojob *lj;
1182	int error;
1183
1184	cb = &aiocbe->uaiocb;
1185	fp = aiocbe->fd_file;
1186
1187	if (fp->f_type != DTYPE_VNODE)
1188		return (-1);
1189
1190	vp = fp->f_vnode;
1191
1192	/*
1193	 * If its not a disk, we don't want to return a positive error.
1194	 * It causes the aio code to not fall through to try the thread
1195	 * way when you're talking to a regular file.
1196	 */
1197	if (!vn_isdisk(vp, &error)) {
1198		if (error == ENOTBLK)
1199			return (-1);
1200		else
1201			return (error);
1202	}
1203
1204	if (vp->v_bufobj.bo_bsize == 0)
1205		return (-1);
1206
1207 	if (cb->aio_nbytes % vp->v_bufobj.bo_bsize)
1208		return (-1);
1209
1210	if (cb->aio_nbytes > vp->v_rdev->si_iosize_max)
1211		return (-1);
1212
1213	if (cb->aio_nbytes >
1214	    MAXPHYS - (((vm_offset_t) cb->aio_buf) & PAGE_MASK))
1215		return (-1);
1216
1217	ki = p->p_aioinfo;
1218	if (ki->kaio_buffer_count >= ki->kaio_ballowed_count)
1219		return (-1);
1220
1221	/* Create and build a buffer header for a transfer. */
1222	bp = (struct buf *)getpbuf(NULL);
1223	BUF_KERNPROC(bp);
1224
1225	AIO_LOCK(ki);
1226	ki->kaio_count++;
1227	ki->kaio_buffer_count++;
1228	lj = aiocbe->lio;
1229	if (lj)
1230		lj->lioj_count++;
1231	AIO_UNLOCK(ki);
1232
1233	/*
1234	 * Get a copy of the kva from the physical buffer.
1235	 */
1236	error = 0;
1237
1238	bp->b_bcount = cb->aio_nbytes;
1239	bp->b_bufsize = cb->aio_nbytes;
1240	bp->b_iodone = aio_physwakeup;
1241	bp->b_saveaddr = bp->b_data;
1242	bp->b_data = (void *)(uintptr_t)cb->aio_buf;
1243	bp->b_offset = cb->aio_offset;
1244	bp->b_iooffset = cb->aio_offset;
1245	bp->b_blkno = btodb(cb->aio_offset);
1246	bp->b_iocmd = cb->aio_lio_opcode == LIO_WRITE ? BIO_WRITE : BIO_READ;
1247
1248	/*
1249	 * Bring buffer into kernel space.
1250	 */
1251	if (vmapbuf(bp) < 0) {
1252		error = EFAULT;
1253		goto doerror;
1254	}
1255
1256	AIO_LOCK(ki);
1257	aiocbe->bp = bp;
1258	bp->b_caller1 = (void *)aiocbe;
1259	TAILQ_INSERT_TAIL(&ki->kaio_bufqueue, aiocbe, plist);
1260	TAILQ_INSERT_TAIL(&ki->kaio_all, aiocbe, allist);
1261	aiocbe->jobstate = JOBST_JOBQBUF;
1262	cb->_aiocb_private.status = cb->aio_nbytes;
1263	AIO_UNLOCK(ki);
1264
1265	atomic_add_int(&num_queue_count, 1);
1266	atomic_add_int(&num_buf_aio, 1);
1267
1268	bp->b_error = 0;
1269
1270	TASK_INIT(&aiocbe->biotask, 0, biohelper, aiocbe);
1271
1272	/* Perform transfer. */
1273	dev_strategy(vp->v_rdev, bp);
1274	return (0);
1275
1276doerror:
1277	AIO_LOCK(ki);
1278	ki->kaio_count--;
1279	ki->kaio_buffer_count--;
1280	if (lj)
1281		lj->lioj_count--;
1282	aiocbe->bp = NULL;
1283	AIO_UNLOCK(ki);
1284	relpbuf(bp, NULL);
1285	return (error);
1286}
1287
1288/*
1289 * Wake up aio requests that may be serviceable now.
1290 */
1291static void
1292aio_swake_cb(struct socket *so, struct sockbuf *sb)
1293{
1294	struct aiocblist *cb, *cbn;
1295	int opcode;
1296
1297	if (sb == &so->so_snd)
1298		opcode = LIO_WRITE;
1299	else
1300		opcode = LIO_READ;
1301
1302	SOCKBUF_LOCK(sb);
1303	sb->sb_flags &= ~SB_AIO;
1304	mtx_lock(&aio_job_mtx);
1305	TAILQ_FOREACH_SAFE(cb, &so->so_aiojobq, list, cbn) {
1306		if (opcode == cb->uaiocb.aio_lio_opcode) {
1307			if (cb->jobstate != JOBST_JOBQSOCK)
1308				panic("invalid queue value");
1309			/* XXX
1310			 * We don't have actual sockets backend yet,
1311			 * so we simply move the requests to the generic
1312			 * file I/O backend.
1313			 */
1314			TAILQ_REMOVE(&so->so_aiojobq, cb, list);
1315			TAILQ_INSERT_TAIL(&aio_jobs, cb, list);
1316			aio_kick_nowait(cb->userproc);
1317		}
1318	}
1319	mtx_unlock(&aio_job_mtx);
1320	SOCKBUF_UNLOCK(sb);
1321}
1322
1323/*
1324 * Queue a new AIO request.  Choosing either the threaded or direct physio VCHR
1325 * technique is done in this code.
1326 */
1327int
1328aio_aqueue(struct thread *td, struct aiocb *job, struct aioliojob *lj,
1329	int type, int oldsigev)
1330{
1331	struct proc *p = td->td_proc;
1332	struct file *fp;
1333	struct socket *so;
1334	struct aiocblist *aiocbe, *cb;
1335	struct kaioinfo *ki;
1336	struct kevent kev;
1337	struct sockbuf *sb;
1338	int opcode;
1339	int error;
1340	int fd, kqfd;
1341	int jid;
1342
1343	if (p->p_aioinfo == NULL)
1344		aio_init_aioinfo(p);
1345
1346	ki = p->p_aioinfo;
1347
1348	suword(&job->_aiocb_private.status, -1);
1349	suword(&job->_aiocb_private.error, 0);
1350	suword(&job->_aiocb_private.kernelinfo, -1);
1351
1352	if (num_queue_count >= max_queue_count ||
1353	    ki->kaio_count >= ki->kaio_qallowed_count) {
1354		suword(&job->_aiocb_private.error, EAGAIN);
1355		return (EAGAIN);
1356	}
1357
1358	aiocbe = uma_zalloc(aiocb_zone, M_WAITOK | M_ZERO);
1359	aiocbe->inputcharge = 0;
1360	aiocbe->outputcharge = 0;
1361	knlist_init(&aiocbe->klist, AIO_MTX(ki), NULL, NULL, NULL);
1362
1363	if (oldsigev) {
1364		bzero(&aiocbe->uaiocb, sizeof(struct aiocb));
1365		error = copyin(job, &aiocbe->uaiocb, sizeof(struct oaiocb));
1366		bcopy(&aiocbe->uaiocb.__spare__, &aiocbe->uaiocb.aio_sigevent,
1367			sizeof(struct osigevent));
1368	} else {
1369		error = copyin(job, &aiocbe->uaiocb, sizeof(struct aiocb));
1370	}
1371	if (error) {
1372		suword(&job->_aiocb_private.error, error);
1373		uma_zfree(aiocb_zone, aiocbe);
1374		return (error);
1375	}
1376
1377	if (aiocbe->uaiocb.aio_sigevent.sigev_notify != SIGEV_KEVENT &&
1378	    aiocbe->uaiocb.aio_sigevent.sigev_notify != SIGEV_SIGNAL &&
1379	    aiocbe->uaiocb.aio_sigevent.sigev_notify != SIGEV_THREAD_ID &&
1380	    aiocbe->uaiocb.aio_sigevent.sigev_notify != SIGEV_NONE) {
1381		suword(&job->_aiocb_private.error, EINVAL);
1382		uma_zfree(aiocb_zone, aiocbe);
1383		return (EINVAL);
1384	}
1385
1386	if ((aiocbe->uaiocb.aio_sigevent.sigev_notify == SIGEV_SIGNAL ||
1387	     aiocbe->uaiocb.aio_sigevent.sigev_notify == SIGEV_THREAD_ID) &&
1388		!_SIG_VALID(aiocbe->uaiocb.aio_sigevent.sigev_signo)) {
1389		uma_zfree(aiocb_zone, aiocbe);
1390		return (EINVAL);
1391	}
1392
1393	ksiginfo_init(&aiocbe->ksi);
1394
1395	/* Save userspace address of the job info. */
1396	aiocbe->uuaiocb = job;
1397
1398	/* Get the opcode. */
1399	if (type != LIO_NOP)
1400		aiocbe->uaiocb.aio_lio_opcode = type;
1401	opcode = aiocbe->uaiocb.aio_lio_opcode;
1402
1403	/* Fetch the file object for the specified file descriptor. */
1404	fd = aiocbe->uaiocb.aio_fildes;
1405	switch (opcode) {
1406	case LIO_WRITE:
1407		error = fget_write(td, fd, &fp);
1408		break;
1409	case LIO_READ:
1410		error = fget_read(td, fd, &fp);
1411		break;
1412	default:
1413		error = fget(td, fd, &fp);
1414	}
1415	if (error) {
1416		uma_zfree(aiocb_zone, aiocbe);
1417		suword(&job->_aiocb_private.error, error);
1418		return (error);
1419	}
1420
1421	if (opcode == LIO_SYNC && fp->f_vnode == NULL) {
1422		error = EINVAL;
1423		goto aqueue_fail;
1424	}
1425
1426	if (opcode != LIO_SYNC && aiocbe->uaiocb.aio_offset == -1LL) {
1427		error = EINVAL;
1428		goto aqueue_fail;
1429	}
1430
1431	aiocbe->fd_file = fp;
1432
1433	mtx_lock(&aio_job_mtx);
1434	jid = jobrefid++;
1435	aiocbe->seqno = jobseqno++;
1436	mtx_unlock(&aio_job_mtx);
1437	error = suword(&job->_aiocb_private.kernelinfo, jid);
1438	if (error) {
1439		error = EINVAL;
1440		goto aqueue_fail;
1441	}
1442	aiocbe->uaiocb._aiocb_private.kernelinfo = (void *)(intptr_t)jid;
1443
1444	if (opcode == LIO_NOP) {
1445		fdrop(fp, td);
1446		uma_zfree(aiocb_zone, aiocbe);
1447		return (0);
1448	}
1449	if ((opcode != LIO_READ) && (opcode != LIO_WRITE) &&
1450	    (opcode != LIO_SYNC)) {
1451		error = EINVAL;
1452		goto aqueue_fail;
1453	}
1454
1455	if (aiocbe->uaiocb.aio_sigevent.sigev_notify != SIGEV_KEVENT)
1456		goto no_kqueue;
1457	kqfd = aiocbe->uaiocb.aio_sigevent.sigev_notify_kqueue;
1458	kev.ident = (uintptr_t)aiocbe->uuaiocb;
1459	kev.filter = EVFILT_AIO;
1460	kev.flags = EV_ADD | EV_ENABLE | EV_FLAG1;
1461	kev.data = (intptr_t)aiocbe;
1462	kev.udata = aiocbe->uaiocb.aio_sigevent.sigev_value.sival_ptr;
1463	error = kqfd_register(kqfd, &kev, td, 1);
1464aqueue_fail:
1465	if (error) {
1466		fdrop(fp, td);
1467		uma_zfree(aiocb_zone, aiocbe);
1468		suword(&job->_aiocb_private.error, error);
1469		goto done;
1470	}
1471no_kqueue:
1472
1473	suword(&job->_aiocb_private.error, EINPROGRESS);
1474	aiocbe->uaiocb._aiocb_private.error = EINPROGRESS;
1475	aiocbe->userproc = p;
1476	aiocbe->cred = crhold(td->td_ucred);
1477	aiocbe->jobflags = 0;
1478	aiocbe->lio = lj;
1479
1480	if (opcode == LIO_SYNC)
1481		goto queueit;
1482
1483	if (fp->f_type == DTYPE_SOCKET) {
1484		/*
1485		 * Alternate queueing for socket ops: Reach down into the
1486		 * descriptor to get the socket data.  Then check to see if the
1487		 * socket is ready to be read or written (based on the requested
1488		 * operation).
1489		 *
1490		 * If it is not ready for io, then queue the aiocbe on the
1491		 * socket, and set the flags so we get a call when sbnotify()
1492		 * happens.
1493		 *
1494		 * Note if opcode is neither LIO_WRITE nor LIO_READ we lock
1495		 * and unlock the snd sockbuf for no reason.
1496		 */
1497		so = fp->f_data;
1498		sb = (opcode == LIO_READ) ? &so->so_rcv : &so->so_snd;
1499		SOCKBUF_LOCK(sb);
1500		if (((opcode == LIO_READ) && (!soreadable(so))) || ((opcode ==
1501		    LIO_WRITE) && (!sowriteable(so)))) {
1502			sb->sb_flags |= SB_AIO;
1503
1504			mtx_lock(&aio_job_mtx);
1505			TAILQ_INSERT_TAIL(&so->so_aiojobq, aiocbe, list);
1506			mtx_unlock(&aio_job_mtx);
1507
1508			AIO_LOCK(ki);
1509			TAILQ_INSERT_TAIL(&ki->kaio_all, aiocbe, allist);
1510			TAILQ_INSERT_TAIL(&ki->kaio_jobqueue, aiocbe, plist);
1511			aiocbe->jobstate = JOBST_JOBQSOCK;
1512			ki->kaio_count++;
1513			if (lj)
1514				lj->lioj_count++;
1515			AIO_UNLOCK(ki);
1516			SOCKBUF_UNLOCK(sb);
1517			atomic_add_int(&num_queue_count, 1);
1518			error = 0;
1519			goto done;
1520		}
1521		SOCKBUF_UNLOCK(sb);
1522	}
1523
1524	if ((error = aio_qphysio(p, aiocbe)) == 0)
1525		goto done;
1526#if 0
1527	if (error > 0) {
1528		aiocbe->uaiocb._aiocb_private.error = error;
1529		suword(&job->_aiocb_private.error, error);
1530		goto done;
1531	}
1532#endif
1533queueit:
1534	/* No buffer for daemon I/O. */
1535	aiocbe->bp = NULL;
1536	atomic_add_int(&num_queue_count, 1);
1537
1538	AIO_LOCK(ki);
1539	ki->kaio_count++;
1540	if (lj)
1541		lj->lioj_count++;
1542	TAILQ_INSERT_TAIL(&ki->kaio_jobqueue, aiocbe, plist);
1543	TAILQ_INSERT_TAIL(&ki->kaio_all, aiocbe, allist);
1544	if (opcode == LIO_SYNC) {
1545		TAILQ_FOREACH(cb, &ki->kaio_jobqueue, plist) {
1546			if (cb->fd_file == aiocbe->fd_file &&
1547			    cb->uaiocb.aio_lio_opcode != LIO_SYNC &&
1548			    cb->seqno < aiocbe->seqno) {
1549				cb->jobflags |= AIOCBLIST_CHECKSYNC;
1550				aiocbe->pending++;
1551			}
1552		}
1553		TAILQ_FOREACH(cb, &ki->kaio_bufqueue, plist) {
1554			if (cb->fd_file == aiocbe->fd_file &&
1555			    cb->uaiocb.aio_lio_opcode != LIO_SYNC &&
1556			    cb->seqno < aiocbe->seqno) {
1557				cb->jobflags |= AIOCBLIST_CHECKSYNC;
1558				aiocbe->pending++;
1559			}
1560		}
1561		if (aiocbe->pending != 0) {
1562			TAILQ_INSERT_TAIL(&ki->kaio_syncqueue, aiocbe, list);
1563			aiocbe->jobstate = JOBST_JOBQSYNC;
1564			AIO_UNLOCK(ki);
1565			goto done;
1566		}
1567	}
1568	mtx_lock(&aio_job_mtx);
1569	TAILQ_INSERT_TAIL(&aio_jobs, aiocbe, list);
1570	aiocbe->jobstate = JOBST_JOBQGLOBAL;
1571	aio_kick_nowait(p);
1572	mtx_unlock(&aio_job_mtx);
1573	AIO_UNLOCK(ki);
1574	error = 0;
1575done:
1576	return (error);
1577}
1578
1579static void
1580aio_kick_nowait(struct proc *userp)
1581{
1582	struct kaioinfo *ki = userp->p_aioinfo;
1583	struct aiothreadlist *aiop;
1584
1585	mtx_assert(&aio_job_mtx, MA_OWNED);
1586	if ((aiop = TAILQ_FIRST(&aio_freeproc)) != NULL) {
1587		TAILQ_REMOVE(&aio_freeproc, aiop, list);
1588		aiop->aiothreadflags &= ~AIOP_FREE;
1589		wakeup(aiop->aiothread);
1590	} else if (((num_aio_resv_start + num_aio_procs) < max_aio_procs) &&
1591	    ((ki->kaio_active_count + num_aio_resv_start) <
1592	    ki->kaio_maxactive_count)) {
1593		taskqueue_enqueue(taskqueue_aiod_bio, &ki->kaio_task);
1594	}
1595}
1596
1597static int
1598aio_kick(struct proc *userp)
1599{
1600	struct kaioinfo *ki = userp->p_aioinfo;
1601	struct aiothreadlist *aiop;
1602	int error, ret = 0;
1603
1604	mtx_assert(&aio_job_mtx, MA_OWNED);
1605retryproc:
1606	if ((aiop = TAILQ_FIRST(&aio_freeproc)) != NULL) {
1607		TAILQ_REMOVE(&aio_freeproc, aiop, list);
1608		aiop->aiothreadflags &= ~AIOP_FREE;
1609		wakeup(aiop->aiothread);
1610	} else if (((num_aio_resv_start + num_aio_procs) < max_aio_procs) &&
1611	    ((ki->kaio_active_count + num_aio_resv_start) <
1612	    ki->kaio_maxactive_count)) {
1613		num_aio_resv_start++;
1614		mtx_unlock(&aio_job_mtx);
1615		error = aio_newproc(&num_aio_resv_start);
1616		mtx_lock(&aio_job_mtx);
1617		if (error) {
1618			num_aio_resv_start--;
1619			goto retryproc;
1620		}
1621	} else {
1622		ret = -1;
1623	}
1624	return (ret);
1625}
1626
1627static void
1628aio_kick_helper(void *context, int pending)
1629{
1630	struct proc *userp = context;
1631
1632	mtx_lock(&aio_job_mtx);
1633	while (--pending >= 0) {
1634		if (aio_kick(userp))
1635			break;
1636	}
1637	mtx_unlock(&aio_job_mtx);
1638}
1639
1640/*
1641 * Support the aio_return system call, as a side-effect, kernel resources are
1642 * released.
1643 */
1644int
1645aio_return(struct thread *td, struct aio_return_args *uap)
1646{
1647	struct proc *p = td->td_proc;
1648	struct aiocblist *cb;
1649	struct aiocb *uaiocb;
1650	struct kaioinfo *ki;
1651	int status, error;
1652
1653	ki = p->p_aioinfo;
1654	if (ki == NULL)
1655		return (EINVAL);
1656	uaiocb = uap->aiocbp;
1657	AIO_LOCK(ki);
1658	TAILQ_FOREACH(cb, &ki->kaio_done, plist) {
1659		if (cb->uuaiocb == uaiocb)
1660			break;
1661	}
1662	if (cb != NULL) {
1663		MPASS(cb->jobstate == JOBST_JOBFINISHED);
1664		status = cb->uaiocb._aiocb_private.status;
1665		error = cb->uaiocb._aiocb_private.error;
1666		td->td_retval[0] = status;
1667		if (cb->uaiocb.aio_lio_opcode == LIO_WRITE) {
1668			td->td_ru.ru_oublock += cb->outputcharge;
1669			cb->outputcharge = 0;
1670		} else if (cb->uaiocb.aio_lio_opcode == LIO_READ) {
1671			td->td_ru.ru_inblock += cb->inputcharge;
1672			cb->inputcharge = 0;
1673		}
1674		aio_free_entry(cb);
1675		AIO_UNLOCK(ki);
1676		suword(&uaiocb->_aiocb_private.error, error);
1677		suword(&uaiocb->_aiocb_private.status, status);
1678	} else {
1679		error = EINVAL;
1680		AIO_UNLOCK(ki);
1681	}
1682	return (error);
1683}
1684
1685/*
1686 * Allow a process to wakeup when any of the I/O requests are completed.
1687 */
1688int
1689aio_suspend(struct thread *td, struct aio_suspend_args *uap)
1690{
1691	struct proc *p = td->td_proc;
1692	struct timeval atv;
1693	struct timespec ts;
1694	struct aiocb *const *cbptr, *cbp;
1695	struct kaioinfo *ki;
1696	struct aiocblist *cb, *cbfirst;
1697	struct aiocb **ujoblist;
1698	int njoblist;
1699	int error;
1700	int timo;
1701	int i;
1702
1703	if (uap->nent < 0 || uap->nent > AIO_LISTIO_MAX)
1704		return (EINVAL);
1705
1706	timo = 0;
1707	if (uap->timeout) {
1708		/* Get timespec struct. */
1709		if ((error = copyin(uap->timeout, &ts, sizeof(ts))) != 0)
1710			return (error);
1711
1712		if (ts.tv_nsec < 0 || ts.tv_nsec >= 1000000000)
1713			return (EINVAL);
1714
1715		TIMESPEC_TO_TIMEVAL(&atv, &ts);
1716		if (itimerfix(&atv))
1717			return (EINVAL);
1718		timo = tvtohz(&atv);
1719	}
1720
1721	ki = p->p_aioinfo;
1722	if (ki == NULL)
1723		return (EAGAIN);
1724
1725	njoblist = 0;
1726	ujoblist = uma_zalloc(aiol_zone, M_WAITOK);
1727	cbptr = uap->aiocbp;
1728
1729	for (i = 0; i < uap->nent; i++) {
1730		cbp = (struct aiocb *)(intptr_t)fuword(&cbptr[i]);
1731		if (cbp == 0)
1732			continue;
1733		ujoblist[njoblist] = cbp;
1734		njoblist++;
1735	}
1736
1737	if (njoblist == 0) {
1738		uma_zfree(aiol_zone, ujoblist);
1739		return (0);
1740	}
1741
1742	AIO_LOCK(ki);
1743	for (;;) {
1744		cbfirst = NULL;
1745		error = 0;
1746		TAILQ_FOREACH(cb, &ki->kaio_all, allist) {
1747			for (i = 0; i < njoblist; i++) {
1748				if (cb->uuaiocb == ujoblist[i]) {
1749					if (cbfirst == NULL)
1750						cbfirst = cb;
1751					if (cb->jobstate == JOBST_JOBFINISHED)
1752						goto RETURN;
1753				}
1754			}
1755		}
1756		/* All tasks were finished. */
1757		if (cbfirst == NULL)
1758			break;
1759
1760		ki->kaio_flags |= KAIO_WAKEUP;
1761		error = msleep(&p->p_aioinfo, AIO_MTX(ki), PRIBIO | PCATCH,
1762		    "aiospn", timo);
1763		if (error == ERESTART)
1764			error = EINTR;
1765		if (error)
1766			break;
1767	}
1768RETURN:
1769	AIO_UNLOCK(ki);
1770	uma_zfree(aiol_zone, ujoblist);
1771	return (error);
1772}
1773
1774/*
1775 * aio_cancel cancels any non-physio aio operations not currently in
1776 * progress.
1777 */
1778int
1779aio_cancel(struct thread *td, struct aio_cancel_args *uap)
1780{
1781	struct proc *p = td->td_proc;
1782	struct kaioinfo *ki;
1783	struct aiocblist *cbe, *cbn;
1784	struct file *fp;
1785	struct socket *so;
1786	int error;
1787	int remove;
1788	int cancelled = 0;
1789	int notcancelled = 0;
1790	struct vnode *vp;
1791
1792	/* Lookup file object. */
1793	error = fget(td, uap->fd, &fp);
1794	if (error)
1795		return (error);
1796
1797	ki = p->p_aioinfo;
1798	if (ki == NULL)
1799		goto done;
1800
1801	if (fp->f_type == DTYPE_VNODE) {
1802		vp = fp->f_vnode;
1803		if (vn_isdisk(vp, &error)) {
1804			fdrop(fp, td);
1805			td->td_retval[0] = AIO_NOTCANCELED;
1806			return (0);
1807		}
1808	}
1809
1810	AIO_LOCK(ki);
1811	TAILQ_FOREACH_SAFE(cbe, &ki->kaio_jobqueue, plist, cbn) {
1812		if ((uap->fd == cbe->uaiocb.aio_fildes) &&
1813		    ((uap->aiocbp == NULL) ||
1814		     (uap->aiocbp == cbe->uuaiocb))) {
1815			remove = 0;
1816
1817			mtx_lock(&aio_job_mtx);
1818			if (cbe->jobstate == JOBST_JOBQGLOBAL) {
1819				TAILQ_REMOVE(&aio_jobs, cbe, list);
1820				remove = 1;
1821			} else if (cbe->jobstate == JOBST_JOBQSOCK) {
1822				MPASS(fp->f_type == DTYPE_SOCKET);
1823				so = fp->f_data;
1824				TAILQ_REMOVE(&so->so_aiojobq, cbe, list);
1825				remove = 1;
1826			} else if (cbe->jobstate == JOBST_JOBQSYNC) {
1827				TAILQ_REMOVE(&ki->kaio_syncqueue, cbe, list);
1828				remove = 1;
1829			}
1830			mtx_unlock(&aio_job_mtx);
1831
1832			if (remove) {
1833				TAILQ_REMOVE(&ki->kaio_jobqueue, cbe, plist);
1834				cbe->uaiocb._aiocb_private.status = -1;
1835				cbe->uaiocb._aiocb_private.error = ECANCELED;
1836				aio_bio_done_notify(p, cbe, DONE_QUEUE);
1837				cancelled++;
1838			} else {
1839				notcancelled++;
1840			}
1841			if (uap->aiocbp != NULL)
1842				break;
1843		}
1844	}
1845	AIO_UNLOCK(ki);
1846
1847done:
1848	fdrop(fp, td);
1849
1850	if (uap->aiocbp != NULL) {
1851		if (cancelled) {
1852			td->td_retval[0] = AIO_CANCELED;
1853			return (0);
1854		}
1855	}
1856
1857	if (notcancelled) {
1858		td->td_retval[0] = AIO_NOTCANCELED;
1859		return (0);
1860	}
1861
1862	if (cancelled) {
1863		td->td_retval[0] = AIO_CANCELED;
1864		return (0);
1865	}
1866
1867	td->td_retval[0] = AIO_ALLDONE;
1868
1869	return (0);
1870}
1871
1872/*
1873 * aio_error is implemented in the kernel level for compatibility purposes
1874 * only.  For a user mode async implementation, it would be best to do it in
1875 * a userland subroutine.
1876 */
1877int
1878aio_error(struct thread *td, struct aio_error_args *uap)
1879{
1880	struct proc *p = td->td_proc;
1881	struct aiocblist *cb;
1882	struct kaioinfo *ki;
1883	int status;
1884
1885	ki = p->p_aioinfo;
1886	if (ki == NULL) {
1887		td->td_retval[0] = EINVAL;
1888		return (0);
1889	}
1890
1891	AIO_LOCK(ki);
1892	TAILQ_FOREACH(cb, &ki->kaio_all, allist) {
1893		if (cb->uuaiocb == uap->aiocbp) {
1894			if (cb->jobstate == JOBST_JOBFINISHED)
1895				td->td_retval[0] =
1896					cb->uaiocb._aiocb_private.error;
1897			else
1898				td->td_retval[0] = EINPROGRESS;
1899			AIO_UNLOCK(ki);
1900			return (0);
1901		}
1902	}
1903	AIO_UNLOCK(ki);
1904
1905	/*
1906	 * Hack for failure of aio_aqueue.
1907	 */
1908	status = fuword(&uap->aiocbp->_aiocb_private.status);
1909	if (status == -1) {
1910		td->td_retval[0] = fuword(&uap->aiocbp->_aiocb_private.error);
1911		return (0);
1912	}
1913
1914	td->td_retval[0] = EINVAL;
1915	return (0);
1916}
1917
1918/* syscall - asynchronous read from a file (REALTIME) */
1919int
1920oaio_read(struct thread *td, struct oaio_read_args *uap)
1921{
1922
1923	return aio_aqueue(td, (struct aiocb *)uap->aiocbp, NULL, LIO_READ, 1);
1924}
1925
1926int
1927aio_read(struct thread *td, struct aio_read_args *uap)
1928{
1929
1930	return aio_aqueue(td, uap->aiocbp, NULL, LIO_READ, 0);
1931}
1932
1933/* syscall - asynchronous write to a file (REALTIME) */
1934int
1935oaio_write(struct thread *td, struct oaio_write_args *uap)
1936{
1937
1938	return aio_aqueue(td, (struct aiocb *)uap->aiocbp, NULL, LIO_WRITE, 1);
1939}
1940
1941int
1942aio_write(struct thread *td, struct aio_write_args *uap)
1943{
1944
1945	return aio_aqueue(td, uap->aiocbp, NULL, LIO_WRITE, 0);
1946}
1947
1948/* syscall - list directed I/O (REALTIME) */
1949int
1950olio_listio(struct thread *td, struct olio_listio_args *uap)
1951{
1952	return do_lio_listio(td, (struct lio_listio_args *)uap, 1);
1953}
1954
1955/* syscall - list directed I/O (REALTIME) */
1956int
1957lio_listio(struct thread *td, struct lio_listio_args *uap)
1958{
1959	return do_lio_listio(td, uap, 0);
1960}
1961
1962static int
1963do_lio_listio(struct thread *td, struct lio_listio_args *uap, int oldsigev)
1964{
1965	struct proc *p = td->td_proc;
1966	struct aiocb *iocb, * const *cbptr;
1967	struct kaioinfo *ki;
1968	struct aioliojob *lj;
1969	struct kevent kev;
1970	int nent;
1971	int error;
1972	int nerror;
1973	int i;
1974
1975	if ((uap->mode != LIO_NOWAIT) && (uap->mode != LIO_WAIT))
1976		return (EINVAL);
1977
1978	nent = uap->nent;
1979	if (nent < 0 || nent > AIO_LISTIO_MAX)
1980		return (EINVAL);
1981
1982	if (p->p_aioinfo == NULL)
1983		aio_init_aioinfo(p);
1984
1985	ki = p->p_aioinfo;
1986
1987	lj = uma_zalloc(aiolio_zone, M_WAITOK);
1988	lj->lioj_flags = 0;
1989	lj->lioj_count = 0;
1990	lj->lioj_finished_count = 0;
1991	knlist_init(&lj->klist, AIO_MTX(ki), NULL, NULL, NULL);
1992	ksiginfo_init(&lj->lioj_ksi);
1993
1994	/*
1995	 * Setup signal.
1996	 */
1997	if (uap->sig && (uap->mode == LIO_NOWAIT)) {
1998		bzero(&lj->lioj_signal, sizeof(&lj->lioj_signal));
1999		error = copyin(uap->sig, &lj->lioj_signal,
2000				oldsigev ? sizeof(struct osigevent) :
2001					   sizeof(struct sigevent));
2002		if (error) {
2003			uma_zfree(aiolio_zone, lj);
2004			return (error);
2005		}
2006
2007		if (lj->lioj_signal.sigev_notify == SIGEV_KEVENT) {
2008			/* Assume only new style KEVENT */
2009			kev.filter = EVFILT_LIO;
2010			kev.flags = EV_ADD | EV_ENABLE | EV_FLAG1;
2011			kev.ident = (uintptr_t)uap->acb_list; /* something unique */
2012			kev.data = (intptr_t)lj;
2013			/* pass user defined sigval data */
2014			kev.udata = lj->lioj_signal.sigev_value.sival_ptr;
2015			error = kqfd_register(
2016			    lj->lioj_signal.sigev_notify_kqueue, &kev, td, 1);
2017			if (error) {
2018				uma_zfree(aiolio_zone, lj);
2019				return (error);
2020			}
2021		} else if (lj->lioj_signal.sigev_notify == SIGEV_NONE) {
2022			;
2023		} else if (lj->lioj_signal.sigev_notify == SIGEV_SIGNAL ||
2024			   lj->lioj_signal.sigev_notify == SIGEV_THREAD_ID) {
2025				if (!_SIG_VALID(lj->lioj_signal.sigev_signo)) {
2026					uma_zfree(aiolio_zone, lj);
2027					return EINVAL;
2028				}
2029				lj->lioj_flags |= LIOJ_SIGNAL;
2030		} else {
2031			uma_zfree(aiolio_zone, lj);
2032			return EINVAL;
2033		}
2034	}
2035
2036	AIO_LOCK(ki);
2037	TAILQ_INSERT_TAIL(&ki->kaio_liojoblist, lj, lioj_list);
2038	/*
2039	 * Add extra aiocb count to avoid the lio to be freed
2040	 * by other threads doing aio_waitcomplete or aio_return,
2041	 * and prevent event from being sent until we have queued
2042	 * all tasks.
2043	 */
2044	lj->lioj_count = 1;
2045	AIO_UNLOCK(ki);
2046
2047	/*
2048	 * Get pointers to the list of I/O requests.
2049	 */
2050	nerror = 0;
2051	cbptr = uap->acb_list;
2052	for (i = 0; i < uap->nent; i++) {
2053		iocb = (struct aiocb *)(intptr_t)fuword(&cbptr[i]);
2054		if (((intptr_t)iocb != -1) && ((intptr_t)iocb != 0)) {
2055			error = aio_aqueue(td, iocb, lj, LIO_NOP, oldsigev);
2056			if (error != 0)
2057				nerror++;
2058		}
2059	}
2060
2061	error = 0;
2062	AIO_LOCK(ki);
2063	if (uap->mode == LIO_WAIT) {
2064		while (lj->lioj_count - 1 != lj->lioj_finished_count) {
2065			ki->kaio_flags |= KAIO_WAKEUP;
2066			error = msleep(&p->p_aioinfo, AIO_MTX(ki),
2067			    PRIBIO | PCATCH, "aiospn", 0);
2068			if (error == ERESTART)
2069				error = EINTR;
2070			if (error)
2071				break;
2072		}
2073	} else {
2074		if (lj->lioj_count - 1 == lj->lioj_finished_count) {
2075			if (lj->lioj_signal.sigev_notify == SIGEV_KEVENT) {
2076				lj->lioj_flags |= LIOJ_KEVENT_POSTED;
2077				KNOTE_LOCKED(&lj->klist, 1);
2078			}
2079			if ((lj->lioj_flags & (LIOJ_SIGNAL|LIOJ_SIGNAL_POSTED))
2080			    == LIOJ_SIGNAL
2081			    && (lj->lioj_signal.sigev_notify == SIGEV_SIGNAL ||
2082			    lj->lioj_signal.sigev_notify == SIGEV_THREAD_ID)) {
2083				aio_sendsig(p, &lj->lioj_signal,
2084					    &lj->lioj_ksi);
2085				lj->lioj_flags |= LIOJ_SIGNAL_POSTED;
2086			}
2087		}
2088	}
2089	lj->lioj_count--;
2090	if (lj->lioj_count == 0) {
2091		TAILQ_REMOVE(&ki->kaio_liojoblist, lj, lioj_list);
2092		knlist_delete(&lj->klist, curthread, 1);
2093		PROC_LOCK(p);
2094		sigqueue_take(&lj->lioj_ksi);
2095		PROC_UNLOCK(p);
2096		AIO_UNLOCK(ki);
2097		uma_zfree(aiolio_zone, lj);
2098	} else
2099		AIO_UNLOCK(ki);
2100
2101	if (nerror)
2102		return (EIO);
2103	return (error);
2104}
2105
2106/*
2107 * Called from interrupt thread for physio, we should return as fast
2108 * as possible, so we schedule a biohelper task.
2109 */
2110static void
2111aio_physwakeup(struct buf *bp)
2112{
2113	struct aiocblist *aiocbe;
2114
2115	aiocbe = (struct aiocblist *)bp->b_caller1;
2116	taskqueue_enqueue(taskqueue_aiod_bio, &aiocbe->biotask);
2117}
2118
2119/*
2120 * Task routine to perform heavy tasks, process wakeup, and signals.
2121 */
2122static void
2123biohelper(void *context, int pending)
2124{
2125	struct aiocblist *aiocbe = context;
2126	struct buf *bp;
2127	struct proc *userp;
2128	struct kaioinfo *ki;
2129	int nblks;
2130
2131	bp = aiocbe->bp;
2132	userp = aiocbe->userproc;
2133	ki = userp->p_aioinfo;
2134	AIO_LOCK(ki);
2135	aiocbe->uaiocb._aiocb_private.status -= bp->b_resid;
2136	aiocbe->uaiocb._aiocb_private.error = 0;
2137	if (bp->b_ioflags & BIO_ERROR)
2138		aiocbe->uaiocb._aiocb_private.error = bp->b_error;
2139	nblks = btodb(aiocbe->uaiocb.aio_nbytes);
2140	if (aiocbe->uaiocb.aio_lio_opcode == LIO_WRITE)
2141		aiocbe->outputcharge += nblks;
2142	else
2143		aiocbe->inputcharge += nblks;
2144	aiocbe->bp = NULL;
2145	TAILQ_REMOVE(&userp->p_aioinfo->kaio_bufqueue, aiocbe, plist);
2146	ki->kaio_buffer_count--;
2147	aio_bio_done_notify(userp, aiocbe, DONE_BUF);
2148	AIO_UNLOCK(ki);
2149
2150	/* Release mapping into kernel space. */
2151	vunmapbuf(bp);
2152	relpbuf(bp, NULL);
2153	atomic_subtract_int(&num_buf_aio, 1);
2154}
2155
2156/* syscall - wait for the next completion of an aio request */
2157int
2158aio_waitcomplete(struct thread *td, struct aio_waitcomplete_args *uap)
2159{
2160	struct proc *p = td->td_proc;
2161	struct timeval atv;
2162	struct timespec ts;
2163	struct kaioinfo *ki;
2164	struct aiocblist *cb;
2165	struct aiocb *uuaiocb;
2166	int error, status, timo;
2167
2168	suword(uap->aiocbp, (long)NULL);
2169
2170	timo = 0;
2171	if (uap->timeout) {
2172		/* Get timespec struct. */
2173		error = copyin(uap->timeout, &ts, sizeof(ts));
2174		if (error)
2175			return (error);
2176
2177		if ((ts.tv_nsec < 0) || (ts.tv_nsec >= 1000000000))
2178			return (EINVAL);
2179
2180		TIMESPEC_TO_TIMEVAL(&atv, &ts);
2181		if (itimerfix(&atv))
2182			return (EINVAL);
2183		timo = tvtohz(&atv);
2184	}
2185
2186	if (p->p_aioinfo == NULL)
2187		aio_init_aioinfo(p);
2188	ki = p->p_aioinfo;
2189
2190	error = 0;
2191	cb = NULL;
2192	AIO_LOCK(ki);
2193	while ((cb = TAILQ_FIRST(&ki->kaio_done)) == NULL) {
2194		ki->kaio_flags |= KAIO_WAKEUP;
2195		error = msleep(&p->p_aioinfo, AIO_MTX(ki), PRIBIO | PCATCH,
2196		    "aiowc", timo);
2197		if (timo && error == ERESTART)
2198			error = EINTR;
2199		if (error)
2200			break;
2201	}
2202
2203	if (cb != NULL) {
2204		MPASS(cb->jobstate == JOBST_JOBFINISHED);
2205		uuaiocb = cb->uuaiocb;
2206		status = cb->uaiocb._aiocb_private.status;
2207		error = cb->uaiocb._aiocb_private.error;
2208		td->td_retval[0] = status;
2209		if (cb->uaiocb.aio_lio_opcode == LIO_WRITE) {
2210			td->td_ru.ru_oublock += cb->outputcharge;
2211			cb->outputcharge = 0;
2212		} else if (cb->uaiocb.aio_lio_opcode == LIO_READ) {
2213			td->td_ru.ru_inblock += cb->inputcharge;
2214			cb->inputcharge = 0;
2215		}
2216		aio_free_entry(cb);
2217		AIO_UNLOCK(ki);
2218		suword(uap->aiocbp, (long)uuaiocb);
2219		suword(&uuaiocb->_aiocb_private.error, error);
2220		suword(&uuaiocb->_aiocb_private.status, status);
2221	} else
2222		AIO_UNLOCK(ki);
2223
2224	return (error);
2225}
2226
2227int
2228aio_fsync(struct thread *td, struct aio_fsync_args *uap)
2229{
2230	struct proc *p = td->td_proc;
2231	struct kaioinfo *ki;
2232
2233	if (uap->op != O_SYNC) /* XXX lack of O_DSYNC */
2234		return (EINVAL);
2235	ki = p->p_aioinfo;
2236	if (ki == NULL)
2237		aio_init_aioinfo(p);
2238	return aio_aqueue(td, uap->aiocbp, NULL, LIO_SYNC, 0);
2239}
2240
2241/* kqueue attach function */
2242static int
2243filt_aioattach(struct knote *kn)
2244{
2245	struct aiocblist *aiocbe = (struct aiocblist *)kn->kn_sdata;
2246
2247	/*
2248	 * The aiocbe pointer must be validated before using it, so
2249	 * registration is restricted to the kernel; the user cannot
2250	 * set EV_FLAG1.
2251	 */
2252	if ((kn->kn_flags & EV_FLAG1) == 0)
2253		return (EPERM);
2254	kn->kn_ptr.p_aio = aiocbe;
2255	kn->kn_flags &= ~EV_FLAG1;
2256
2257	knlist_add(&aiocbe->klist, kn, 0);
2258
2259	return (0);
2260}
2261
2262/* kqueue detach function */
2263static void
2264filt_aiodetach(struct knote *kn)
2265{
2266	struct aiocblist *aiocbe = kn->kn_ptr.p_aio;
2267
2268	if (!knlist_empty(&aiocbe->klist))
2269		knlist_remove(&aiocbe->klist, kn, 0);
2270}
2271
2272/* kqueue filter function */
2273/*ARGSUSED*/
2274static int
2275filt_aio(struct knote *kn, long hint)
2276{
2277	struct aiocblist *aiocbe = kn->kn_ptr.p_aio;
2278
2279	kn->kn_data = aiocbe->uaiocb._aiocb_private.error;
2280	if (aiocbe->jobstate != JOBST_JOBFINISHED)
2281		return (0);
2282	kn->kn_flags |= EV_EOF;
2283	return (1);
2284}
2285
2286/* kqueue attach function */
2287static int
2288filt_lioattach(struct knote *kn)
2289{
2290	struct aioliojob * lj = (struct aioliojob *)kn->kn_sdata;
2291
2292	/*
2293	 * The aioliojob pointer must be validated before using it, so
2294	 * registration is restricted to the kernel; the user cannot
2295	 * set EV_FLAG1.
2296	 */
2297	if ((kn->kn_flags & EV_FLAG1) == 0)
2298		return (EPERM);
2299	kn->kn_ptr.p_lio = lj;
2300	kn->kn_flags &= ~EV_FLAG1;
2301
2302	knlist_add(&lj->klist, kn, 0);
2303
2304	return (0);
2305}
2306
2307/* kqueue detach function */
2308static void
2309filt_liodetach(struct knote *kn)
2310{
2311	struct aioliojob * lj = kn->kn_ptr.p_lio;
2312
2313	if (!knlist_empty(&lj->klist))
2314		knlist_remove(&lj->klist, kn, 0);
2315}
2316
2317/* kqueue filter function */
2318/*ARGSUSED*/
2319static int
2320filt_lio(struct knote *kn, long hint)
2321{
2322	struct aioliojob * lj = kn->kn_ptr.p_lio;
2323
2324	return (lj->lioj_flags & LIOJ_KEVENT_POSTED);
2325}
2326