xref: /freebsd/sys/kern/vfs_aio.c (revision 25ecdc7d52770caf1c9b44b5ec11f468f6b636f3)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 1997 John S. Dyson.  All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. John S. Dyson's name may not be used to endorse or promote products
12  *    derived from this software without specific prior written permission.
13  *
14  * DISCLAIMER:  This code isn't warranted to do anything useful.  Anything
15  * bad that happens because of using this software isn't the responsibility
16  * of the author.  This software is distributed AS-IS.
17  */
18 
19 /*
20  * This file contains support for the POSIX 1003.1B AIO/LIO facility.
21  */
22 
23 #include <sys/cdefs.h>
24 __FBSDID("$FreeBSD$");
25 
26 #include <sys/param.h>
27 #include <sys/systm.h>
28 #include <sys/malloc.h>
29 #include <sys/bio.h>
30 #include <sys/buf.h>
31 #include <sys/capsicum.h>
32 #include <sys/eventhandler.h>
33 #include <sys/sysproto.h>
34 #include <sys/filedesc.h>
35 #include <sys/kernel.h>
36 #include <sys/module.h>
37 #include <sys/kthread.h>
38 #include <sys/fcntl.h>
39 #include <sys/file.h>
40 #include <sys/limits.h>
41 #include <sys/lock.h>
42 #include <sys/mutex.h>
43 #include <sys/unistd.h>
44 #include <sys/posix4.h>
45 #include <sys/proc.h>
46 #include <sys/resourcevar.h>
47 #include <sys/signalvar.h>
48 #include <sys/syscallsubr.h>
49 #include <sys/protosw.h>
50 #include <sys/rwlock.h>
51 #include <sys/sema.h>
52 #include <sys/socket.h>
53 #include <sys/socketvar.h>
54 #include <sys/syscall.h>
55 #include <sys/sysent.h>
56 #include <sys/sysctl.h>
57 #include <sys/syslog.h>
58 #include <sys/sx.h>
59 #include <sys/taskqueue.h>
60 #include <sys/vnode.h>
61 #include <sys/conf.h>
62 #include <sys/event.h>
63 #include <sys/mount.h>
64 #include <geom/geom.h>
65 
66 #include <machine/atomic.h>
67 
68 #include <vm/vm.h>
69 #include <vm/vm_page.h>
70 #include <vm/vm_extern.h>
71 #include <vm/pmap.h>
72 #include <vm/vm_map.h>
73 #include <vm/vm_object.h>
74 #include <vm/uma.h>
75 #include <sys/aio.h>
76 
77 /*
78  * Counter for allocating reference ids to new jobs.  Wrapped to 1 on
79  * overflow. (XXX will be removed soon.)
80  */
81 static u_long jobrefid;
82 
83 /*
84  * Counter for aio_fsync.
85  */
86 static uint64_t jobseqno;
87 
88 #ifndef MAX_AIO_PER_PROC
89 #define MAX_AIO_PER_PROC	32
90 #endif
91 
92 #ifndef MAX_AIO_QUEUE_PER_PROC
93 #define MAX_AIO_QUEUE_PER_PROC	256
94 #endif
95 
96 #ifndef MAX_AIO_QUEUE
97 #define MAX_AIO_QUEUE		1024 /* Bigger than MAX_AIO_QUEUE_PER_PROC */
98 #endif
99 
100 #ifndef MAX_BUF_AIO
101 #define MAX_BUF_AIO		16
102 #endif
103 
104 FEATURE(aio, "Asynchronous I/O");
105 SYSCTL_DECL(_p1003_1b);
106 
107 static MALLOC_DEFINE(M_LIO, "lio", "listio aio control block list");
108 static MALLOC_DEFINE(M_AIOS, "aios", "aio_suspend aio control block list");
109 
110 static SYSCTL_NODE(_vfs, OID_AUTO, aio, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
111     "Async IO management");
112 
113 static int enable_aio_unsafe = 0;
114 SYSCTL_INT(_vfs_aio, OID_AUTO, enable_unsafe, CTLFLAG_RW, &enable_aio_unsafe, 0,
115     "Permit asynchronous IO on all file types, not just known-safe types");
116 
117 static unsigned int unsafe_warningcnt = 1;
118 SYSCTL_UINT(_vfs_aio, OID_AUTO, unsafe_warningcnt, CTLFLAG_RW,
119     &unsafe_warningcnt, 0,
120     "Warnings that will be triggered upon failed IO requests on unsafe files");
121 
122 static int max_aio_procs = MAX_AIO_PROCS;
123 SYSCTL_INT(_vfs_aio, OID_AUTO, max_aio_procs, CTLFLAG_RW, &max_aio_procs, 0,
124     "Maximum number of kernel processes to use for handling async IO ");
125 
126 static int num_aio_procs = 0;
127 SYSCTL_INT(_vfs_aio, OID_AUTO, num_aio_procs, CTLFLAG_RD, &num_aio_procs, 0,
128     "Number of presently active kernel processes for async IO");
129 
130 /*
131  * The code will adjust the actual number of AIO processes towards this
132  * number when it gets a chance.
133  */
134 static int target_aio_procs = TARGET_AIO_PROCS;
135 SYSCTL_INT(_vfs_aio, OID_AUTO, target_aio_procs, CTLFLAG_RW, &target_aio_procs,
136     0,
137     "Preferred number of ready kernel processes for async IO");
138 
139 static int max_queue_count = MAX_AIO_QUEUE;
140 SYSCTL_INT(_vfs_aio, OID_AUTO, max_aio_queue, CTLFLAG_RW, &max_queue_count, 0,
141     "Maximum number of aio requests to queue, globally");
142 
143 static int num_queue_count = 0;
144 SYSCTL_INT(_vfs_aio, OID_AUTO, num_queue_count, CTLFLAG_RD, &num_queue_count, 0,
145     "Number of queued aio requests");
146 
147 static int num_buf_aio = 0;
148 SYSCTL_INT(_vfs_aio, OID_AUTO, num_buf_aio, CTLFLAG_RD, &num_buf_aio, 0,
149     "Number of aio requests presently handled by the buf subsystem");
150 
151 static int num_unmapped_aio = 0;
152 SYSCTL_INT(_vfs_aio, OID_AUTO, num_unmapped_aio, CTLFLAG_RD, &num_unmapped_aio,
153     0,
154     "Number of aio requests presently handled by unmapped I/O buffers");
155 
156 /* Number of async I/O processes in the process of being started */
157 /* XXX This should be local to aio_aqueue() */
158 static int num_aio_resv_start = 0;
159 
160 static int aiod_lifetime;
161 SYSCTL_INT(_vfs_aio, OID_AUTO, aiod_lifetime, CTLFLAG_RW, &aiod_lifetime, 0,
162     "Maximum lifetime for idle aiod");
163 
164 static int max_aio_per_proc = MAX_AIO_PER_PROC;
165 SYSCTL_INT(_vfs_aio, OID_AUTO, max_aio_per_proc, CTLFLAG_RW, &max_aio_per_proc,
166     0,
167     "Maximum active aio requests per process");
168 
169 static int max_aio_queue_per_proc = MAX_AIO_QUEUE_PER_PROC;
170 SYSCTL_INT(_vfs_aio, OID_AUTO, max_aio_queue_per_proc, CTLFLAG_RW,
171     &max_aio_queue_per_proc, 0,
172     "Maximum queued aio requests per process");
173 
174 static int max_buf_aio = MAX_BUF_AIO;
175 SYSCTL_INT(_vfs_aio, OID_AUTO, max_buf_aio, CTLFLAG_RW, &max_buf_aio, 0,
176     "Maximum buf aio requests per process");
177 
178 /*
179  * Though redundant with vfs.aio.max_aio_queue_per_proc, POSIX requires
180  * sysconf(3) to support AIO_LISTIO_MAX, and we implement that with
181  * vfs.aio.aio_listio_max.
182  */
183 SYSCTL_INT(_p1003_1b, CTL_P1003_1B_AIO_LISTIO_MAX, aio_listio_max,
184     CTLFLAG_RD | CTLFLAG_CAPRD, &max_aio_queue_per_proc,
185     0, "Maximum aio requests for a single lio_listio call");
186 
187 #ifdef COMPAT_FREEBSD6
188 typedef struct oaiocb {
189 	int	aio_fildes;		/* File descriptor */
190 	off_t	aio_offset;		/* File offset for I/O */
191 	volatile void *aio_buf;         /* I/O buffer in process space */
192 	size_t	aio_nbytes;		/* Number of bytes for I/O */
193 	struct	osigevent aio_sigevent;	/* Signal to deliver */
194 	int	aio_lio_opcode;		/* LIO opcode */
195 	int	aio_reqprio;		/* Request priority -- ignored */
196 	struct	__aiocb_private	_aiocb_private;
197 } oaiocb_t;
198 #endif
199 
200 /*
201  * Below is a key of locks used to protect each member of struct kaiocb
202  * aioliojob and kaioinfo and any backends.
203  *
204  * * - need not protected
205  * a - locked by kaioinfo lock
206  * b - locked by backend lock, the backend lock can be null in some cases,
207  *     for example, BIO belongs to this type, in this case, proc lock is
208  *     reused.
209  * c - locked by aio_job_mtx, the lock for the generic file I/O backend.
210  */
211 
212 /*
213  * If the routine that services an AIO request blocks while running in an
214  * AIO kernel process it can starve other I/O requests.  BIO requests
215  * queued via aio_qbio() complete asynchronously and do not use AIO kernel
216  * processes at all.  Socket I/O requests use a separate pool of
217  * kprocs and also force non-blocking I/O.  Other file I/O requests
218  * use the generic fo_read/fo_write operations which can block.  The
219  * fsync and mlock operations can also block while executing.  Ideally
220  * none of these requests would block while executing.
221  *
222  * Note that the service routines cannot toggle O_NONBLOCK in the file
223  * structure directly while handling a request due to races with
224  * userland threads.
225  */
226 
227 /* jobflags */
228 #define	KAIOCB_QUEUEING		0x01
229 #define	KAIOCB_CANCELLED	0x02
230 #define	KAIOCB_CANCELLING	0x04
231 #define	KAIOCB_CHECKSYNC	0x08
232 #define	KAIOCB_CLEARED		0x10
233 #define	KAIOCB_FINISHED		0x20
234 
235 /*
236  * AIO process info
237  */
238 #define AIOP_FREE	0x1			/* proc on free queue */
239 
240 struct aioproc {
241 	int	aioprocflags;			/* (c) AIO proc flags */
242 	TAILQ_ENTRY(aioproc) list;		/* (c) list of processes */
243 	struct	proc *aioproc;			/* (*) the AIO proc */
244 };
245 
246 /*
247  * data-structure for lio signal management
248  */
249 struct aioliojob {
250 	int	lioj_flags;			/* (a) listio flags */
251 	int	lioj_count;			/* (a) count of jobs */
252 	int	lioj_finished_count;		/* (a) count of finished jobs */
253 	struct	sigevent lioj_signal;		/* (a) signal on all I/O done */
254 	TAILQ_ENTRY(aioliojob) lioj_list;	/* (a) lio list */
255 	struct	knlist klist;			/* (a) list of knotes */
256 	ksiginfo_t lioj_ksi;			/* (a) Realtime signal info */
257 };
258 
259 #define	LIOJ_SIGNAL		0x1	/* signal on all done (lio) */
260 #define	LIOJ_SIGNAL_POSTED	0x2	/* signal has been posted */
261 #define LIOJ_KEVENT_POSTED	0x4	/* kevent triggered */
262 
263 /*
264  * per process aio data structure
265  */
266 struct kaioinfo {
267 	struct	mtx kaio_mtx;		/* the lock to protect this struct */
268 	int	kaio_flags;		/* (a) per process kaio flags */
269 	int	kaio_active_count;	/* (c) number of currently used AIOs */
270 	int	kaio_count;		/* (a) size of AIO queue */
271 	int	kaio_buffer_count;	/* (a) number of bio buffers */
272 	TAILQ_HEAD(,kaiocb) kaio_all;	/* (a) all AIOs in a process */
273 	TAILQ_HEAD(,kaiocb) kaio_done;	/* (a) done queue for process */
274 	TAILQ_HEAD(,aioliojob) kaio_liojoblist; /* (a) list of lio jobs */
275 	TAILQ_HEAD(,kaiocb) kaio_jobqueue;	/* (a) job queue for process */
276 	TAILQ_HEAD(,kaiocb) kaio_syncqueue;	/* (a) queue for aio_fsync */
277 	TAILQ_HEAD(,kaiocb) kaio_syncready;  /* (a) second q for aio_fsync */
278 	struct	task kaio_task;		/* (*) task to kick aio processes */
279 	struct	task kaio_sync_task;	/* (*) task to schedule fsync jobs */
280 };
281 
282 #define AIO_LOCK(ki)		mtx_lock(&(ki)->kaio_mtx)
283 #define AIO_UNLOCK(ki)		mtx_unlock(&(ki)->kaio_mtx)
284 #define AIO_LOCK_ASSERT(ki, f)	mtx_assert(&(ki)->kaio_mtx, (f))
285 #define AIO_MTX(ki)		(&(ki)->kaio_mtx)
286 
287 #define KAIO_RUNDOWN	0x1	/* process is being run down */
288 #define KAIO_WAKEUP	0x2	/* wakeup process when AIO completes */
289 
290 /*
291  * Operations used to interact with userland aio control blocks.
292  * Different ABIs provide their own operations.
293  */
294 struct aiocb_ops {
295 	int	(*aio_copyin)(struct aiocb *ujob, struct kaiocb *kjob, int ty);
296 	long	(*fetch_status)(struct aiocb *ujob);
297 	long	(*fetch_error)(struct aiocb *ujob);
298 	int	(*store_status)(struct aiocb *ujob, long status);
299 	int	(*store_error)(struct aiocb *ujob, long error);
300 	int	(*store_kernelinfo)(struct aiocb *ujob, long jobref);
301 	int	(*store_aiocb)(struct aiocb **ujobp, struct aiocb *ujob);
302 };
303 
304 static TAILQ_HEAD(,aioproc) aio_freeproc;		/* (c) Idle daemons */
305 static struct sema aio_newproc_sem;
306 static struct mtx aio_job_mtx;
307 static TAILQ_HEAD(,kaiocb) aio_jobs;			/* (c) Async job list */
308 static struct unrhdr *aiod_unr;
309 
310 static void	aio_biocleanup(struct bio *bp);
311 void		aio_init_aioinfo(struct proc *p);
312 static int	aio_onceonly(void);
313 static int	aio_free_entry(struct kaiocb *job);
314 static void	aio_process_rw(struct kaiocb *job);
315 static void	aio_process_sync(struct kaiocb *job);
316 static void	aio_process_mlock(struct kaiocb *job);
317 static void	aio_schedule_fsync(void *context, int pending);
318 static int	aio_newproc(int *);
319 int		aio_aqueue(struct thread *td, struct aiocb *ujob,
320 		    struct aioliojob *lio, int type, struct aiocb_ops *ops);
321 static int	aio_queue_file(struct file *fp, struct kaiocb *job);
322 static void	aio_biowakeup(struct bio *bp);
323 static void	aio_proc_rundown(void *arg, struct proc *p);
324 static void	aio_proc_rundown_exec(void *arg, struct proc *p,
325 		    struct image_params *imgp);
326 static int	aio_qbio(struct proc *p, struct kaiocb *job);
327 static void	aio_daemon(void *param);
328 static void	aio_bio_done_notify(struct proc *userp, struct kaiocb *job);
329 static bool	aio_clear_cancel_function_locked(struct kaiocb *job);
330 static int	aio_kick(struct proc *userp);
331 static void	aio_kick_nowait(struct proc *userp);
332 static void	aio_kick_helper(void *context, int pending);
333 static int	filt_aioattach(struct knote *kn);
334 static void	filt_aiodetach(struct knote *kn);
335 static int	filt_aio(struct knote *kn, long hint);
336 static int	filt_lioattach(struct knote *kn);
337 static void	filt_liodetach(struct knote *kn);
338 static int	filt_lio(struct knote *kn, long hint);
339 
340 /*
341  * Zones for:
342  * 	kaio	Per process async io info
343  *	aiop	async io process data
344  *	aiocb	async io jobs
345  *	aiolio	list io jobs
346  */
347 static uma_zone_t kaio_zone, aiop_zone, aiocb_zone, aiolio_zone;
348 
349 /* kqueue filters for aio */
350 static struct filterops aio_filtops = {
351 	.f_isfd = 0,
352 	.f_attach = filt_aioattach,
353 	.f_detach = filt_aiodetach,
354 	.f_event = filt_aio,
355 };
356 static struct filterops lio_filtops = {
357 	.f_isfd = 0,
358 	.f_attach = filt_lioattach,
359 	.f_detach = filt_liodetach,
360 	.f_event = filt_lio
361 };
362 
363 static eventhandler_tag exit_tag, exec_tag;
364 
365 TASKQUEUE_DEFINE_THREAD(aiod_kick);
366 
367 /*
368  * Main operations function for use as a kernel module.
369  */
370 static int
371 aio_modload(struct module *module, int cmd, void *arg)
372 {
373 	int error = 0;
374 
375 	switch (cmd) {
376 	case MOD_LOAD:
377 		aio_onceonly();
378 		break;
379 	case MOD_SHUTDOWN:
380 		break;
381 	default:
382 		error = EOPNOTSUPP;
383 		break;
384 	}
385 	return (error);
386 }
387 
388 static moduledata_t aio_mod = {
389 	"aio",
390 	&aio_modload,
391 	NULL
392 };
393 
394 DECLARE_MODULE(aio, aio_mod, SI_SUB_VFS, SI_ORDER_ANY);
395 MODULE_VERSION(aio, 1);
396 
397 /*
398  * Startup initialization
399  */
400 static int
401 aio_onceonly(void)
402 {
403 
404 	exit_tag = EVENTHANDLER_REGISTER(process_exit, aio_proc_rundown, NULL,
405 	    EVENTHANDLER_PRI_ANY);
406 	exec_tag = EVENTHANDLER_REGISTER(process_exec, aio_proc_rundown_exec,
407 	    NULL, EVENTHANDLER_PRI_ANY);
408 	kqueue_add_filteropts(EVFILT_AIO, &aio_filtops);
409 	kqueue_add_filteropts(EVFILT_LIO, &lio_filtops);
410 	TAILQ_INIT(&aio_freeproc);
411 	sema_init(&aio_newproc_sem, 0, "aio_new_proc");
412 	mtx_init(&aio_job_mtx, "aio_job", NULL, MTX_DEF);
413 	TAILQ_INIT(&aio_jobs);
414 	aiod_unr = new_unrhdr(1, INT_MAX, NULL);
415 	kaio_zone = uma_zcreate("AIO", sizeof(struct kaioinfo), NULL, NULL,
416 	    NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
417 	aiop_zone = uma_zcreate("AIOP", sizeof(struct aioproc), NULL,
418 	    NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
419 	aiocb_zone = uma_zcreate("AIOCB", sizeof(struct kaiocb), NULL, NULL,
420 	    NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
421 	aiolio_zone = uma_zcreate("AIOLIO", sizeof(struct aioliojob), NULL,
422 	    NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
423 	aiod_lifetime = AIOD_LIFETIME_DEFAULT;
424 	jobrefid = 1;
425 	p31b_setcfg(CTL_P1003_1B_ASYNCHRONOUS_IO, _POSIX_ASYNCHRONOUS_IO);
426 	p31b_setcfg(CTL_P1003_1B_AIO_MAX, MAX_AIO_QUEUE);
427 	p31b_setcfg(CTL_P1003_1B_AIO_PRIO_DELTA_MAX, 0);
428 
429 	return (0);
430 }
431 
432 /*
433  * Init the per-process aioinfo structure.  The aioinfo limits are set
434  * per-process for user limit (resource) management.
435  */
436 void
437 aio_init_aioinfo(struct proc *p)
438 {
439 	struct kaioinfo *ki;
440 
441 	ki = uma_zalloc(kaio_zone, M_WAITOK);
442 	mtx_init(&ki->kaio_mtx, "aiomtx", NULL, MTX_DEF | MTX_NEW);
443 	ki->kaio_flags = 0;
444 	ki->kaio_active_count = 0;
445 	ki->kaio_count = 0;
446 	ki->kaio_buffer_count = 0;
447 	TAILQ_INIT(&ki->kaio_all);
448 	TAILQ_INIT(&ki->kaio_done);
449 	TAILQ_INIT(&ki->kaio_jobqueue);
450 	TAILQ_INIT(&ki->kaio_liojoblist);
451 	TAILQ_INIT(&ki->kaio_syncqueue);
452 	TAILQ_INIT(&ki->kaio_syncready);
453 	TASK_INIT(&ki->kaio_task, 0, aio_kick_helper, p);
454 	TASK_INIT(&ki->kaio_sync_task, 0, aio_schedule_fsync, ki);
455 	PROC_LOCK(p);
456 	if (p->p_aioinfo == NULL) {
457 		p->p_aioinfo = ki;
458 		PROC_UNLOCK(p);
459 	} else {
460 		PROC_UNLOCK(p);
461 		mtx_destroy(&ki->kaio_mtx);
462 		uma_zfree(kaio_zone, ki);
463 	}
464 
465 	while (num_aio_procs < MIN(target_aio_procs, max_aio_procs))
466 		aio_newproc(NULL);
467 }
468 
469 static int
470 aio_sendsig(struct proc *p, struct sigevent *sigev, ksiginfo_t *ksi, bool ext)
471 {
472 	struct thread *td;
473 	int error;
474 
475 	error = sigev_findtd(p, sigev, &td);
476 	if (error)
477 		return (error);
478 	if (!KSI_ONQ(ksi)) {
479 		ksiginfo_set_sigev(ksi, sigev);
480 		ksi->ksi_code = SI_ASYNCIO;
481 		ksi->ksi_flags |= ext ? (KSI_EXT | KSI_INS) : 0;
482 		tdsendsignal(p, td, ksi->ksi_signo, ksi);
483 	}
484 	PROC_UNLOCK(p);
485 	return (error);
486 }
487 
488 /*
489  * Free a job entry.  Wait for completion if it is currently active, but don't
490  * delay forever.  If we delay, we return a flag that says that we have to
491  * restart the queue scan.
492  */
493 static int
494 aio_free_entry(struct kaiocb *job)
495 {
496 	struct kaioinfo *ki;
497 	struct aioliojob *lj;
498 	struct proc *p;
499 
500 	p = job->userproc;
501 	MPASS(curproc == p);
502 	ki = p->p_aioinfo;
503 	MPASS(ki != NULL);
504 
505 	AIO_LOCK_ASSERT(ki, MA_OWNED);
506 	MPASS(job->jobflags & KAIOCB_FINISHED);
507 
508 	atomic_subtract_int(&num_queue_count, 1);
509 
510 	ki->kaio_count--;
511 	MPASS(ki->kaio_count >= 0);
512 
513 	TAILQ_REMOVE(&ki->kaio_done, job, plist);
514 	TAILQ_REMOVE(&ki->kaio_all, job, allist);
515 
516 	lj = job->lio;
517 	if (lj) {
518 		lj->lioj_count--;
519 		lj->lioj_finished_count--;
520 
521 		if (lj->lioj_count == 0) {
522 			TAILQ_REMOVE(&ki->kaio_liojoblist, lj, lioj_list);
523 			/* lio is going away, we need to destroy any knotes */
524 			knlist_delete(&lj->klist, curthread, 1);
525 			PROC_LOCK(p);
526 			sigqueue_take(&lj->lioj_ksi);
527 			PROC_UNLOCK(p);
528 			uma_zfree(aiolio_zone, lj);
529 		}
530 	}
531 
532 	/* job is going away, we need to destroy any knotes */
533 	knlist_delete(&job->klist, curthread, 1);
534 	PROC_LOCK(p);
535 	sigqueue_take(&job->ksi);
536 	PROC_UNLOCK(p);
537 
538 	AIO_UNLOCK(ki);
539 
540 	/*
541 	 * The thread argument here is used to find the owning process
542 	 * and is also passed to fo_close() which may pass it to various
543 	 * places such as devsw close() routines.  Because of that, we
544 	 * need a thread pointer from the process owning the job that is
545 	 * persistent and won't disappear out from under us or move to
546 	 * another process.
547 	 *
548 	 * Currently, all the callers of this function call it to remove
549 	 * a kaiocb from the current process' job list either via a
550 	 * syscall or due to the current process calling exit() or
551 	 * execve().  Thus, we know that p == curproc.  We also know that
552 	 * curthread can't exit since we are curthread.
553 	 *
554 	 * Therefore, we use curthread as the thread to pass to
555 	 * knlist_delete().  This does mean that it is possible for the
556 	 * thread pointer at close time to differ from the thread pointer
557 	 * at open time, but this is already true of file descriptors in
558 	 * a multithreaded process.
559 	 */
560 	if (job->fd_file)
561 		fdrop(job->fd_file, curthread);
562 	crfree(job->cred);
563 	if (job->uiop != &job->uio)
564 		free(job->uiop, M_IOV);
565 	uma_zfree(aiocb_zone, job);
566 	AIO_LOCK(ki);
567 
568 	return (0);
569 }
570 
571 static void
572 aio_proc_rundown_exec(void *arg, struct proc *p,
573     struct image_params *imgp __unused)
574 {
575    	aio_proc_rundown(arg, p);
576 }
577 
578 static int
579 aio_cancel_job(struct proc *p, struct kaioinfo *ki, struct kaiocb *job)
580 {
581 	aio_cancel_fn_t *func;
582 	int cancelled;
583 
584 	AIO_LOCK_ASSERT(ki, MA_OWNED);
585 	if (job->jobflags & (KAIOCB_CANCELLED | KAIOCB_FINISHED))
586 		return (0);
587 	MPASS((job->jobflags & KAIOCB_CANCELLING) == 0);
588 	job->jobflags |= KAIOCB_CANCELLED;
589 
590 	func = job->cancel_fn;
591 
592 	/*
593 	 * If there is no cancel routine, just leave the job marked as
594 	 * cancelled.  The job should be in active use by a caller who
595 	 * should complete it normally or when it fails to install a
596 	 * cancel routine.
597 	 */
598 	if (func == NULL)
599 		return (0);
600 
601 	/*
602 	 * Set the CANCELLING flag so that aio_complete() will defer
603 	 * completions of this job.  This prevents the job from being
604 	 * freed out from under the cancel callback.  After the
605 	 * callback any deferred completion (whether from the callback
606 	 * or any other source) will be completed.
607 	 */
608 	job->jobflags |= KAIOCB_CANCELLING;
609 	AIO_UNLOCK(ki);
610 	func(job);
611 	AIO_LOCK(ki);
612 	job->jobflags &= ~KAIOCB_CANCELLING;
613 	if (job->jobflags & KAIOCB_FINISHED) {
614 		cancelled = job->uaiocb._aiocb_private.error == ECANCELED;
615 		TAILQ_REMOVE(&ki->kaio_jobqueue, job, plist);
616 		aio_bio_done_notify(p, job);
617 	} else {
618 		/*
619 		 * The cancel callback might have scheduled an
620 		 * operation to cancel this request, but it is
621 		 * only counted as cancelled if the request is
622 		 * cancelled when the callback returns.
623 		 */
624 		cancelled = 0;
625 	}
626 	return (cancelled);
627 }
628 
629 /*
630  * Rundown the jobs for a given process.
631  */
632 static void
633 aio_proc_rundown(void *arg, struct proc *p)
634 {
635 	struct kaioinfo *ki;
636 	struct aioliojob *lj;
637 	struct kaiocb *job, *jobn;
638 
639 	KASSERT(curthread->td_proc == p,
640 	    ("%s: called on non-curproc", __func__));
641 	ki = p->p_aioinfo;
642 	if (ki == NULL)
643 		return;
644 
645 	AIO_LOCK(ki);
646 	ki->kaio_flags |= KAIO_RUNDOWN;
647 
648 restart:
649 
650 	/*
651 	 * Try to cancel all pending requests. This code simulates
652 	 * aio_cancel on all pending I/O requests.
653 	 */
654 	TAILQ_FOREACH_SAFE(job, &ki->kaio_jobqueue, plist, jobn) {
655 		aio_cancel_job(p, ki, job);
656 	}
657 
658 	/* Wait for all running I/O to be finished */
659 	if (TAILQ_FIRST(&ki->kaio_jobqueue) || ki->kaio_active_count != 0) {
660 		ki->kaio_flags |= KAIO_WAKEUP;
661 		msleep(&p->p_aioinfo, AIO_MTX(ki), PRIBIO, "aioprn", hz);
662 		goto restart;
663 	}
664 
665 	/* Free all completed I/O requests. */
666 	while ((job = TAILQ_FIRST(&ki->kaio_done)) != NULL)
667 		aio_free_entry(job);
668 
669 	while ((lj = TAILQ_FIRST(&ki->kaio_liojoblist)) != NULL) {
670 		if (lj->lioj_count == 0) {
671 			TAILQ_REMOVE(&ki->kaio_liojoblist, lj, lioj_list);
672 			knlist_delete(&lj->klist, curthread, 1);
673 			PROC_LOCK(p);
674 			sigqueue_take(&lj->lioj_ksi);
675 			PROC_UNLOCK(p);
676 			uma_zfree(aiolio_zone, lj);
677 		} else {
678 			panic("LIO job not cleaned up: C:%d, FC:%d\n",
679 			    lj->lioj_count, lj->lioj_finished_count);
680 		}
681 	}
682 	AIO_UNLOCK(ki);
683 	taskqueue_drain(taskqueue_aiod_kick, &ki->kaio_task);
684 	taskqueue_drain(taskqueue_aiod_kick, &ki->kaio_sync_task);
685 	mtx_destroy(&ki->kaio_mtx);
686 	uma_zfree(kaio_zone, ki);
687 	p->p_aioinfo = NULL;
688 }
689 
690 /*
691  * Select a job to run (called by an AIO daemon).
692  */
693 static struct kaiocb *
694 aio_selectjob(struct aioproc *aiop)
695 {
696 	struct kaiocb *job;
697 	struct kaioinfo *ki;
698 	struct proc *userp;
699 
700 	mtx_assert(&aio_job_mtx, MA_OWNED);
701 restart:
702 	TAILQ_FOREACH(job, &aio_jobs, list) {
703 		userp = job->userproc;
704 		ki = userp->p_aioinfo;
705 
706 		if (ki->kaio_active_count < max_aio_per_proc) {
707 			TAILQ_REMOVE(&aio_jobs, job, list);
708 			if (!aio_clear_cancel_function(job))
709 				goto restart;
710 
711 			/* Account for currently active jobs. */
712 			ki->kaio_active_count++;
713 			break;
714 		}
715 	}
716 	return (job);
717 }
718 
719 /*
720  * Move all data to a permanent storage device.  This code
721  * simulates the fsync and fdatasync syscalls.
722  */
723 static int
724 aio_fsync_vnode(struct thread *td, struct vnode *vp, int op)
725 {
726 	struct mount *mp;
727 	int error;
728 
729 	if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0)
730 		goto drop;
731 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
732 	if (vp->v_object != NULL) {
733 		VM_OBJECT_WLOCK(vp->v_object);
734 		vm_object_page_clean(vp->v_object, 0, 0, 0);
735 		VM_OBJECT_WUNLOCK(vp->v_object);
736 	}
737 	if (op == LIO_DSYNC)
738 		error = VOP_FDATASYNC(vp, td);
739 	else
740 		error = VOP_FSYNC(vp, MNT_WAIT, td);
741 
742 	VOP_UNLOCK(vp);
743 	vn_finished_write(mp);
744 drop:
745 	return (error);
746 }
747 
748 /*
749  * The AIO processing activity for LIO_READ/LIO_WRITE.  This is the code that
750  * does the I/O request for the non-bio version of the operations.  The normal
751  * vn operations are used, and this code should work in all instances for every
752  * type of file, including pipes, sockets, fifos, and regular files.
753  *
754  * XXX I don't think it works well for socket, pipe, and fifo.
755  */
756 static void
757 aio_process_rw(struct kaiocb *job)
758 {
759 	struct ucred *td_savedcred;
760 	struct thread *td;
761 	struct aiocb *cb;
762 	struct file *fp;
763 	ssize_t cnt;
764 	long msgsnd_st, msgsnd_end;
765 	long msgrcv_st, msgrcv_end;
766 	long oublock_st, oublock_end;
767 	long inblock_st, inblock_end;
768 	int error, opcode;
769 
770 	KASSERT(job->uaiocb.aio_lio_opcode == LIO_READ ||
771 	    job->uaiocb.aio_lio_opcode == LIO_READV ||
772 	    job->uaiocb.aio_lio_opcode == LIO_WRITE ||
773 	    job->uaiocb.aio_lio_opcode == LIO_WRITEV,
774 	    ("%s: opcode %d", __func__, job->uaiocb.aio_lio_opcode));
775 
776 	aio_switch_vmspace(job);
777 	td = curthread;
778 	td_savedcred = td->td_ucred;
779 	td->td_ucred = job->cred;
780 	job->uiop->uio_td = td;
781 	cb = &job->uaiocb;
782 	fp = job->fd_file;
783 
784 	opcode = job->uaiocb.aio_lio_opcode;
785 	cnt = job->uiop->uio_resid;
786 
787 	msgrcv_st = td->td_ru.ru_msgrcv;
788 	msgsnd_st = td->td_ru.ru_msgsnd;
789 	inblock_st = td->td_ru.ru_inblock;
790 	oublock_st = td->td_ru.ru_oublock;
791 
792 	/*
793 	 * aio_aqueue() acquires a reference to the file that is
794 	 * released in aio_free_entry().
795 	 */
796 	if (opcode == LIO_READ || opcode == LIO_READV) {
797 		if (job->uiop->uio_resid == 0)
798 			error = 0;
799 		else
800 			error = fo_read(fp, job->uiop, fp->f_cred, FOF_OFFSET,
801 			    td);
802 	} else {
803 		if (fp->f_type == DTYPE_VNODE)
804 			bwillwrite();
805 		error = fo_write(fp, job->uiop, fp->f_cred, FOF_OFFSET, td);
806 	}
807 	msgrcv_end = td->td_ru.ru_msgrcv;
808 	msgsnd_end = td->td_ru.ru_msgsnd;
809 	inblock_end = td->td_ru.ru_inblock;
810 	oublock_end = td->td_ru.ru_oublock;
811 
812 	job->msgrcv = msgrcv_end - msgrcv_st;
813 	job->msgsnd = msgsnd_end - msgsnd_st;
814 	job->inblock = inblock_end - inblock_st;
815 	job->outblock = oublock_end - oublock_st;
816 
817 	if (error != 0 && job->uiop->uio_resid != cnt) {
818 		if (error == ERESTART || error == EINTR || error == EWOULDBLOCK)
819 			error = 0;
820 		if (error == EPIPE && (opcode & LIO_WRITE)) {
821 			PROC_LOCK(job->userproc);
822 			kern_psignal(job->userproc, SIGPIPE);
823 			PROC_UNLOCK(job->userproc);
824 		}
825 	}
826 
827 	cnt -= job->uiop->uio_resid;
828 	td->td_ucred = td_savedcred;
829 	if (error)
830 		aio_complete(job, -1, error);
831 	else
832 		aio_complete(job, cnt, 0);
833 }
834 
835 static void
836 aio_process_sync(struct kaiocb *job)
837 {
838 	struct thread *td = curthread;
839 	struct ucred *td_savedcred = td->td_ucred;
840 	struct file *fp = job->fd_file;
841 	int error = 0;
842 
843 	KASSERT(job->uaiocb.aio_lio_opcode & LIO_SYNC,
844 	    ("%s: opcode %d", __func__, job->uaiocb.aio_lio_opcode));
845 
846 	td->td_ucred = job->cred;
847 	if (fp->f_vnode != NULL) {
848 		error = aio_fsync_vnode(td, fp->f_vnode,
849 		    job->uaiocb.aio_lio_opcode);
850 	}
851 	td->td_ucred = td_savedcred;
852 	if (error)
853 		aio_complete(job, -1, error);
854 	else
855 		aio_complete(job, 0, 0);
856 }
857 
858 static void
859 aio_process_mlock(struct kaiocb *job)
860 {
861 	struct aiocb *cb = &job->uaiocb;
862 	int error;
863 
864 	KASSERT(job->uaiocb.aio_lio_opcode == LIO_MLOCK,
865 	    ("%s: opcode %d", __func__, job->uaiocb.aio_lio_opcode));
866 
867 	aio_switch_vmspace(job);
868 	error = kern_mlock(job->userproc, job->cred,
869 	    __DEVOLATILE(uintptr_t, cb->aio_buf), cb->aio_nbytes);
870 	aio_complete(job, error != 0 ? -1 : 0, error);
871 }
872 
873 static void
874 aio_bio_done_notify(struct proc *userp, struct kaiocb *job)
875 {
876 	struct aioliojob *lj;
877 	struct kaioinfo *ki;
878 	struct kaiocb *sjob, *sjobn;
879 	int lj_done;
880 	bool schedule_fsync;
881 
882 	ki = userp->p_aioinfo;
883 	AIO_LOCK_ASSERT(ki, MA_OWNED);
884 	lj = job->lio;
885 	lj_done = 0;
886 	if (lj) {
887 		lj->lioj_finished_count++;
888 		if (lj->lioj_count == lj->lioj_finished_count)
889 			lj_done = 1;
890 	}
891 	TAILQ_INSERT_TAIL(&ki->kaio_done, job, plist);
892 	MPASS(job->jobflags & KAIOCB_FINISHED);
893 
894 	if (ki->kaio_flags & KAIO_RUNDOWN)
895 		goto notification_done;
896 
897 	if (job->uaiocb.aio_sigevent.sigev_notify == SIGEV_SIGNAL ||
898 	    job->uaiocb.aio_sigevent.sigev_notify == SIGEV_THREAD_ID)
899 		aio_sendsig(userp, &job->uaiocb.aio_sigevent, &job->ksi, true);
900 
901 	KNOTE_LOCKED(&job->klist, 1);
902 
903 	if (lj_done) {
904 		if (lj->lioj_signal.sigev_notify == SIGEV_KEVENT) {
905 			lj->lioj_flags |= LIOJ_KEVENT_POSTED;
906 			KNOTE_LOCKED(&lj->klist, 1);
907 		}
908 		if ((lj->lioj_flags & (LIOJ_SIGNAL | LIOJ_SIGNAL_POSTED))
909 		    == LIOJ_SIGNAL &&
910 		    (lj->lioj_signal.sigev_notify == SIGEV_SIGNAL ||
911 		    lj->lioj_signal.sigev_notify == SIGEV_THREAD_ID)) {
912 			aio_sendsig(userp, &lj->lioj_signal, &lj->lioj_ksi,
913 			    true);
914 			lj->lioj_flags |= LIOJ_SIGNAL_POSTED;
915 		}
916 	}
917 
918 notification_done:
919 	if (job->jobflags & KAIOCB_CHECKSYNC) {
920 		schedule_fsync = false;
921 		TAILQ_FOREACH_SAFE(sjob, &ki->kaio_syncqueue, list, sjobn) {
922 			if (job->fd_file != sjob->fd_file ||
923 			    job->seqno >= sjob->seqno)
924 				continue;
925 			if (--sjob->pending > 0)
926 				continue;
927 			TAILQ_REMOVE(&ki->kaio_syncqueue, sjob, list);
928 			if (!aio_clear_cancel_function_locked(sjob))
929 				continue;
930 			TAILQ_INSERT_TAIL(&ki->kaio_syncready, sjob, list);
931 			schedule_fsync = true;
932 		}
933 		if (schedule_fsync)
934 			taskqueue_enqueue(taskqueue_aiod_kick,
935 			    &ki->kaio_sync_task);
936 	}
937 	if (ki->kaio_flags & KAIO_WAKEUP) {
938 		ki->kaio_flags &= ~KAIO_WAKEUP;
939 		wakeup(&userp->p_aioinfo);
940 	}
941 }
942 
943 static void
944 aio_schedule_fsync(void *context, int pending)
945 {
946 	struct kaioinfo *ki;
947 	struct kaiocb *job;
948 
949 	ki = context;
950 	AIO_LOCK(ki);
951 	while (!TAILQ_EMPTY(&ki->kaio_syncready)) {
952 		job = TAILQ_FIRST(&ki->kaio_syncready);
953 		TAILQ_REMOVE(&ki->kaio_syncready, job, list);
954 		AIO_UNLOCK(ki);
955 		aio_schedule(job, aio_process_sync);
956 		AIO_LOCK(ki);
957 	}
958 	AIO_UNLOCK(ki);
959 }
960 
961 bool
962 aio_cancel_cleared(struct kaiocb *job)
963 {
964 
965 	/*
966 	 * The caller should hold the same queue lock held when
967 	 * aio_clear_cancel_function() was called and set this flag
968 	 * ensuring this check sees an up-to-date value.  However,
969 	 * there is no way to assert that.
970 	 */
971 	return ((job->jobflags & KAIOCB_CLEARED) != 0);
972 }
973 
974 static bool
975 aio_clear_cancel_function_locked(struct kaiocb *job)
976 {
977 
978 	AIO_LOCK_ASSERT(job->userproc->p_aioinfo, MA_OWNED);
979 	MPASS(job->cancel_fn != NULL);
980 	if (job->jobflags & KAIOCB_CANCELLING) {
981 		job->jobflags |= KAIOCB_CLEARED;
982 		return (false);
983 	}
984 	job->cancel_fn = NULL;
985 	return (true);
986 }
987 
988 bool
989 aio_clear_cancel_function(struct kaiocb *job)
990 {
991 	struct kaioinfo *ki;
992 	bool ret;
993 
994 	ki = job->userproc->p_aioinfo;
995 	AIO_LOCK(ki);
996 	ret = aio_clear_cancel_function_locked(job);
997 	AIO_UNLOCK(ki);
998 	return (ret);
999 }
1000 
1001 static bool
1002 aio_set_cancel_function_locked(struct kaiocb *job, aio_cancel_fn_t *func)
1003 {
1004 
1005 	AIO_LOCK_ASSERT(job->userproc->p_aioinfo, MA_OWNED);
1006 	if (job->jobflags & KAIOCB_CANCELLED)
1007 		return (false);
1008 	job->cancel_fn = func;
1009 	return (true);
1010 }
1011 
1012 bool
1013 aio_set_cancel_function(struct kaiocb *job, aio_cancel_fn_t *func)
1014 {
1015 	struct kaioinfo *ki;
1016 	bool ret;
1017 
1018 	ki = job->userproc->p_aioinfo;
1019 	AIO_LOCK(ki);
1020 	ret = aio_set_cancel_function_locked(job, func);
1021 	AIO_UNLOCK(ki);
1022 	return (ret);
1023 }
1024 
1025 void
1026 aio_complete(struct kaiocb *job, long status, int error)
1027 {
1028 	struct kaioinfo *ki;
1029 	struct proc *userp;
1030 
1031 	job->uaiocb._aiocb_private.error = error;
1032 	job->uaiocb._aiocb_private.status = status;
1033 
1034 	userp = job->userproc;
1035 	ki = userp->p_aioinfo;
1036 
1037 	AIO_LOCK(ki);
1038 	KASSERT(!(job->jobflags & KAIOCB_FINISHED),
1039 	    ("duplicate aio_complete"));
1040 	job->jobflags |= KAIOCB_FINISHED;
1041 	if ((job->jobflags & (KAIOCB_QUEUEING | KAIOCB_CANCELLING)) == 0) {
1042 		TAILQ_REMOVE(&ki->kaio_jobqueue, job, plist);
1043 		aio_bio_done_notify(userp, job);
1044 	}
1045 	AIO_UNLOCK(ki);
1046 }
1047 
1048 void
1049 aio_cancel(struct kaiocb *job)
1050 {
1051 
1052 	aio_complete(job, -1, ECANCELED);
1053 }
1054 
1055 void
1056 aio_switch_vmspace(struct kaiocb *job)
1057 {
1058 
1059 	vmspace_switch_aio(job->userproc->p_vmspace);
1060 }
1061 
1062 /*
1063  * The AIO daemon, most of the actual work is done in aio_process_*,
1064  * but the setup (and address space mgmt) is done in this routine.
1065  */
1066 static void
1067 aio_daemon(void *_id)
1068 {
1069 	struct kaiocb *job;
1070 	struct aioproc *aiop;
1071 	struct kaioinfo *ki;
1072 	struct proc *p;
1073 	struct vmspace *myvm;
1074 	struct thread *td = curthread;
1075 	int id = (intptr_t)_id;
1076 
1077 	/*
1078 	 * Grab an extra reference on the daemon's vmspace so that it
1079 	 * doesn't get freed by jobs that switch to a different
1080 	 * vmspace.
1081 	 */
1082 	p = td->td_proc;
1083 	myvm = vmspace_acquire_ref(p);
1084 
1085 	KASSERT(p->p_textvp == NULL, ("kthread has a textvp"));
1086 
1087 	/*
1088 	 * Allocate and ready the aio control info.  There is one aiop structure
1089 	 * per daemon.
1090 	 */
1091 	aiop = uma_zalloc(aiop_zone, M_WAITOK);
1092 	aiop->aioproc = p;
1093 	aiop->aioprocflags = 0;
1094 
1095 	/*
1096 	 * Wakeup parent process.  (Parent sleeps to keep from blasting away
1097 	 * and creating too many daemons.)
1098 	 */
1099 	sema_post(&aio_newproc_sem);
1100 
1101 	mtx_lock(&aio_job_mtx);
1102 	for (;;) {
1103 		/*
1104 		 * Take daemon off of free queue
1105 		 */
1106 		if (aiop->aioprocflags & AIOP_FREE) {
1107 			TAILQ_REMOVE(&aio_freeproc, aiop, list);
1108 			aiop->aioprocflags &= ~AIOP_FREE;
1109 		}
1110 
1111 		/*
1112 		 * Check for jobs.
1113 		 */
1114 		while ((job = aio_selectjob(aiop)) != NULL) {
1115 			mtx_unlock(&aio_job_mtx);
1116 
1117 			ki = job->userproc->p_aioinfo;
1118 			job->handle_fn(job);
1119 
1120 			mtx_lock(&aio_job_mtx);
1121 			/* Decrement the active job count. */
1122 			ki->kaio_active_count--;
1123 		}
1124 
1125 		/*
1126 		 * Disconnect from user address space.
1127 		 */
1128 		if (p->p_vmspace != myvm) {
1129 			mtx_unlock(&aio_job_mtx);
1130 			vmspace_switch_aio(myvm);
1131 			mtx_lock(&aio_job_mtx);
1132 			/*
1133 			 * We have to restart to avoid race, we only sleep if
1134 			 * no job can be selected.
1135 			 */
1136 			continue;
1137 		}
1138 
1139 		mtx_assert(&aio_job_mtx, MA_OWNED);
1140 
1141 		TAILQ_INSERT_HEAD(&aio_freeproc, aiop, list);
1142 		aiop->aioprocflags |= AIOP_FREE;
1143 
1144 		/*
1145 		 * If daemon is inactive for a long time, allow it to exit,
1146 		 * thereby freeing resources.
1147 		 */
1148 		if (msleep(p, &aio_job_mtx, PRIBIO, "aiordy",
1149 		    aiod_lifetime) == EWOULDBLOCK && TAILQ_EMPTY(&aio_jobs) &&
1150 		    (aiop->aioprocflags & AIOP_FREE) &&
1151 		    num_aio_procs > target_aio_procs)
1152 			break;
1153 	}
1154 	TAILQ_REMOVE(&aio_freeproc, aiop, list);
1155 	num_aio_procs--;
1156 	mtx_unlock(&aio_job_mtx);
1157 	uma_zfree(aiop_zone, aiop);
1158 	free_unr(aiod_unr, id);
1159 	vmspace_free(myvm);
1160 
1161 	KASSERT(p->p_vmspace == myvm,
1162 	    ("AIOD: bad vmspace for exiting daemon"));
1163 	KASSERT(refcount_load(&myvm->vm_refcnt) > 1,
1164 	    ("AIOD: bad vm refcnt for exiting daemon: %d",
1165 	    refcount_load(&myvm->vm_refcnt)));
1166 	kproc_exit(0);
1167 }
1168 
1169 /*
1170  * Create a new AIO daemon. This is mostly a kernel-thread fork routine. The
1171  * AIO daemon modifies its environment itself.
1172  */
1173 static int
1174 aio_newproc(int *start)
1175 {
1176 	int error;
1177 	struct proc *p;
1178 	int id;
1179 
1180 	id = alloc_unr(aiod_unr);
1181 	error = kproc_create(aio_daemon, (void *)(intptr_t)id, &p,
1182 		RFNOWAIT, 0, "aiod%d", id);
1183 	if (error == 0) {
1184 		/*
1185 		 * Wait until daemon is started.
1186 		 */
1187 		sema_wait(&aio_newproc_sem);
1188 		mtx_lock(&aio_job_mtx);
1189 		num_aio_procs++;
1190 		if (start != NULL)
1191 			(*start)--;
1192 		mtx_unlock(&aio_job_mtx);
1193 	} else {
1194 		free_unr(aiod_unr, id);
1195 	}
1196 	return (error);
1197 }
1198 
1199 /*
1200  * Try the high-performance, low-overhead bio method for eligible
1201  * VCHR devices.  This method doesn't use an aio helper thread, and
1202  * thus has very low overhead.
1203  *
1204  * Assumes that the caller, aio_aqueue(), has incremented the file
1205  * structure's reference count, preventing its deallocation for the
1206  * duration of this call.
1207  */
1208 static int
1209 aio_qbio(struct proc *p, struct kaiocb *job)
1210 {
1211 	struct aiocb *cb;
1212 	struct file *fp;
1213 	struct buf *pbuf;
1214 	struct vnode *vp;
1215 	struct cdevsw *csw;
1216 	struct cdev *dev;
1217 	struct kaioinfo *ki;
1218 	struct bio **bios = NULL;
1219 	off_t offset;
1220 	int bio_cmd, error, i, iovcnt, opcode, poff, ref;
1221 	vm_prot_t prot;
1222 	bool use_unmapped;
1223 
1224 	cb = &job->uaiocb;
1225 	fp = job->fd_file;
1226 	opcode = cb->aio_lio_opcode;
1227 
1228 	if (!(opcode == LIO_WRITE || opcode == LIO_WRITEV ||
1229 	    opcode == LIO_READ || opcode == LIO_READV))
1230 		return (-1);
1231 	if (fp == NULL || fp->f_type != DTYPE_VNODE)
1232 		return (-1);
1233 
1234 	vp = fp->f_vnode;
1235 	if (vp->v_type != VCHR)
1236 		return (-1);
1237 	if (vp->v_bufobj.bo_bsize == 0)
1238 		return (-1);
1239 
1240 	bio_cmd = (opcode & LIO_WRITE) ? BIO_WRITE : BIO_READ;
1241 	iovcnt = job->uiop->uio_iovcnt;
1242 	if (iovcnt > max_buf_aio)
1243 		return (-1);
1244 	for (i = 0; i < iovcnt; i++) {
1245 		if (job->uiop->uio_iov[i].iov_len % vp->v_bufobj.bo_bsize != 0)
1246 			return (-1);
1247 		if (job->uiop->uio_iov[i].iov_len > maxphys) {
1248 			error = -1;
1249 			return (-1);
1250 		}
1251 	}
1252 	offset = cb->aio_offset;
1253 
1254 	ref = 0;
1255 	csw = devvn_refthread(vp, &dev, &ref);
1256 	if (csw == NULL)
1257 		return (ENXIO);
1258 
1259 	if ((csw->d_flags & D_DISK) == 0) {
1260 		error = -1;
1261 		goto unref;
1262 	}
1263 	if (job->uiop->uio_resid > dev->si_iosize_max) {
1264 		error = -1;
1265 		goto unref;
1266 	}
1267 
1268 	ki = p->p_aioinfo;
1269 	job->error = 0;
1270 
1271 	use_unmapped = (dev->si_flags & SI_UNMAPPED) && unmapped_buf_allowed;
1272 	if (!use_unmapped) {
1273 		AIO_LOCK(ki);
1274 		if (ki->kaio_buffer_count + iovcnt > max_buf_aio) {
1275 			AIO_UNLOCK(ki);
1276 			error = EAGAIN;
1277 			goto unref;
1278 		}
1279 		ki->kaio_buffer_count += iovcnt;
1280 		AIO_UNLOCK(ki);
1281 	}
1282 
1283 	bios = malloc(sizeof(struct bio *) * iovcnt, M_TEMP, M_WAITOK);
1284 	atomic_store_int(&job->nbio, iovcnt);
1285 	for (i = 0; i < iovcnt; i++) {
1286 		struct vm_page** pages;
1287 		struct bio *bp;
1288 		void *buf;
1289 		size_t nbytes;
1290 		int npages;
1291 
1292 		buf = job->uiop->uio_iov[i].iov_base;
1293 		nbytes = job->uiop->uio_iov[i].iov_len;
1294 
1295 		bios[i] = g_alloc_bio();
1296 		bp = bios[i];
1297 
1298 		poff = (vm_offset_t)buf & PAGE_MASK;
1299 		if (use_unmapped) {
1300 			pbuf = NULL;
1301 			pages = malloc(sizeof(vm_page_t) * (atop(round_page(
1302 			    nbytes)) + 1), M_TEMP, M_WAITOK | M_ZERO);
1303 		} else {
1304 			pbuf = uma_zalloc(pbuf_zone, M_WAITOK);
1305 			BUF_KERNPROC(pbuf);
1306 			pages = pbuf->b_pages;
1307 		}
1308 
1309 		bp->bio_length = nbytes;
1310 		bp->bio_bcount = nbytes;
1311 		bp->bio_done = aio_biowakeup;
1312 		bp->bio_offset = offset;
1313 		bp->bio_cmd = bio_cmd;
1314 		bp->bio_dev = dev;
1315 		bp->bio_caller1 = job;
1316 		bp->bio_caller2 = pbuf;
1317 
1318 		prot = VM_PROT_READ;
1319 		if (opcode == LIO_READ || opcode == LIO_READV)
1320 			prot |= VM_PROT_WRITE;	/* Less backwards than it looks */
1321 		npages = vm_fault_quick_hold_pages(&curproc->p_vmspace->vm_map,
1322 		    (vm_offset_t)buf, bp->bio_length, prot, pages,
1323 		    atop(maxphys) + 1);
1324 		if (npages < 0) {
1325 			if (pbuf != NULL)
1326 				uma_zfree(pbuf_zone, pbuf);
1327 			else
1328 				free(pages, M_TEMP);
1329 			error = EFAULT;
1330 			g_destroy_bio(bp);
1331 			i--;
1332 			goto destroy_bios;
1333 		}
1334 		if (pbuf != NULL) {
1335 			pmap_qenter((vm_offset_t)pbuf->b_data, pages, npages);
1336 			bp->bio_data = pbuf->b_data + poff;
1337 			pbuf->b_npages = npages;
1338 			atomic_add_int(&num_buf_aio, 1);
1339 		} else {
1340 			bp->bio_ma = pages;
1341 			bp->bio_ma_n = npages;
1342 			bp->bio_ma_offset = poff;
1343 			bp->bio_data = unmapped_buf;
1344 			bp->bio_flags |= BIO_UNMAPPED;
1345 			atomic_add_int(&num_unmapped_aio, 1);
1346 		}
1347 
1348 		offset += nbytes;
1349 	}
1350 
1351 	/* Perform transfer. */
1352 	for (i = 0; i < iovcnt; i++)
1353 		csw->d_strategy(bios[i]);
1354 	free(bios, M_TEMP);
1355 
1356 	dev_relthread(dev, ref);
1357 	return (0);
1358 
1359 destroy_bios:
1360 	for (; i >= 0; i--)
1361 		aio_biocleanup(bios[i]);
1362 	free(bios, M_TEMP);
1363 unref:
1364 	dev_relthread(dev, ref);
1365 	return (error);
1366 }
1367 
1368 #ifdef COMPAT_FREEBSD6
1369 static int
1370 convert_old_sigevent(struct osigevent *osig, struct sigevent *nsig)
1371 {
1372 
1373 	/*
1374 	 * Only SIGEV_NONE, SIGEV_SIGNAL, and SIGEV_KEVENT are
1375 	 * supported by AIO with the old sigevent structure.
1376 	 */
1377 	nsig->sigev_notify = osig->sigev_notify;
1378 	switch (nsig->sigev_notify) {
1379 	case SIGEV_NONE:
1380 		break;
1381 	case SIGEV_SIGNAL:
1382 		nsig->sigev_signo = osig->__sigev_u.__sigev_signo;
1383 		break;
1384 	case SIGEV_KEVENT:
1385 		nsig->sigev_notify_kqueue =
1386 		    osig->__sigev_u.__sigev_notify_kqueue;
1387 		nsig->sigev_value.sival_ptr = osig->sigev_value.sival_ptr;
1388 		break;
1389 	default:
1390 		return (EINVAL);
1391 	}
1392 	return (0);
1393 }
1394 
1395 static int
1396 aiocb_copyin_old_sigevent(struct aiocb *ujob, struct kaiocb *kjob,
1397     int type __unused)
1398 {
1399 	struct oaiocb *ojob;
1400 	struct aiocb *kcb = &kjob->uaiocb;
1401 	int error;
1402 
1403 	bzero(kcb, sizeof(struct aiocb));
1404 	error = copyin(ujob, kcb, sizeof(struct oaiocb));
1405 	if (error)
1406 		return (error);
1407 	/* No need to copyin aio_iov, because it did not exist in FreeBSD 6 */
1408 	ojob = (struct oaiocb *)kcb;
1409 	return (convert_old_sigevent(&ojob->aio_sigevent, &kcb->aio_sigevent));
1410 }
1411 #endif
1412 
1413 static int
1414 aiocb_copyin(struct aiocb *ujob, struct kaiocb *kjob, int type)
1415 {
1416 	struct aiocb *kcb = &kjob->uaiocb;
1417 	int error;
1418 
1419 	error = copyin(ujob, kcb, sizeof(struct aiocb));
1420 	if (error)
1421 		return (error);
1422 	if (type & LIO_VECTORED) {
1423 		/* malloc a uio and copy in the iovec */
1424 		error = copyinuio(__DEVOLATILE(struct iovec*, kcb->aio_iov),
1425 		    kcb->aio_iovcnt, &kjob->uiop);
1426 	}
1427 
1428 	return (error);
1429 }
1430 
1431 static long
1432 aiocb_fetch_status(struct aiocb *ujob)
1433 {
1434 
1435 	return (fuword(&ujob->_aiocb_private.status));
1436 }
1437 
1438 static long
1439 aiocb_fetch_error(struct aiocb *ujob)
1440 {
1441 
1442 	return (fuword(&ujob->_aiocb_private.error));
1443 }
1444 
1445 static int
1446 aiocb_store_status(struct aiocb *ujob, long status)
1447 {
1448 
1449 	return (suword(&ujob->_aiocb_private.status, status));
1450 }
1451 
1452 static int
1453 aiocb_store_error(struct aiocb *ujob, long error)
1454 {
1455 
1456 	return (suword(&ujob->_aiocb_private.error, error));
1457 }
1458 
1459 static int
1460 aiocb_store_kernelinfo(struct aiocb *ujob, long jobref)
1461 {
1462 
1463 	return (suword(&ujob->_aiocb_private.kernelinfo, jobref));
1464 }
1465 
1466 static int
1467 aiocb_store_aiocb(struct aiocb **ujobp, struct aiocb *ujob)
1468 {
1469 
1470 	return (suword(ujobp, (long)ujob));
1471 }
1472 
1473 static struct aiocb_ops aiocb_ops = {
1474 	.aio_copyin = aiocb_copyin,
1475 	.fetch_status = aiocb_fetch_status,
1476 	.fetch_error = aiocb_fetch_error,
1477 	.store_status = aiocb_store_status,
1478 	.store_error = aiocb_store_error,
1479 	.store_kernelinfo = aiocb_store_kernelinfo,
1480 	.store_aiocb = aiocb_store_aiocb,
1481 };
1482 
1483 #ifdef COMPAT_FREEBSD6
1484 static struct aiocb_ops aiocb_ops_osigevent = {
1485 	.aio_copyin = aiocb_copyin_old_sigevent,
1486 	.fetch_status = aiocb_fetch_status,
1487 	.fetch_error = aiocb_fetch_error,
1488 	.store_status = aiocb_store_status,
1489 	.store_error = aiocb_store_error,
1490 	.store_kernelinfo = aiocb_store_kernelinfo,
1491 	.store_aiocb = aiocb_store_aiocb,
1492 };
1493 #endif
1494 
1495 /*
1496  * Queue a new AIO request.  Choosing either the threaded or direct bio VCHR
1497  * technique is done in this code.
1498  */
1499 int
1500 aio_aqueue(struct thread *td, struct aiocb *ujob, struct aioliojob *lj,
1501     int type, struct aiocb_ops *ops)
1502 {
1503 	struct proc *p = td->td_proc;
1504 	struct file *fp = NULL;
1505 	struct kaiocb *job;
1506 	struct kaioinfo *ki;
1507 	struct kevent kev;
1508 	int opcode;
1509 	int error;
1510 	int fd, kqfd;
1511 	int jid;
1512 	u_short evflags;
1513 
1514 	if (p->p_aioinfo == NULL)
1515 		aio_init_aioinfo(p);
1516 
1517 	ki = p->p_aioinfo;
1518 
1519 	ops->store_status(ujob, -1);
1520 	ops->store_error(ujob, 0);
1521 	ops->store_kernelinfo(ujob, -1);
1522 
1523 	if (num_queue_count >= max_queue_count ||
1524 	    ki->kaio_count >= max_aio_queue_per_proc) {
1525 		error = EAGAIN;
1526 		goto err1;
1527 	}
1528 
1529 	job = uma_zalloc(aiocb_zone, M_WAITOK | M_ZERO);
1530 	knlist_init_mtx(&job->klist, AIO_MTX(ki));
1531 
1532 	error = ops->aio_copyin(ujob, job, type);
1533 	if (error)
1534 		goto err2;
1535 
1536 	if (job->uaiocb.aio_nbytes > IOSIZE_MAX) {
1537 		error = EINVAL;
1538 		goto err2;
1539 	}
1540 
1541 	if (job->uaiocb.aio_sigevent.sigev_notify != SIGEV_KEVENT &&
1542 	    job->uaiocb.aio_sigevent.sigev_notify != SIGEV_SIGNAL &&
1543 	    job->uaiocb.aio_sigevent.sigev_notify != SIGEV_THREAD_ID &&
1544 	    job->uaiocb.aio_sigevent.sigev_notify != SIGEV_NONE) {
1545 		error = EINVAL;
1546 		goto err2;
1547 	}
1548 
1549 	if ((job->uaiocb.aio_sigevent.sigev_notify == SIGEV_SIGNAL ||
1550 	     job->uaiocb.aio_sigevent.sigev_notify == SIGEV_THREAD_ID) &&
1551 		!_SIG_VALID(job->uaiocb.aio_sigevent.sigev_signo)) {
1552 		error = EINVAL;
1553 		goto err2;
1554 	}
1555 
1556 	/* Get the opcode. */
1557 	if (type == LIO_NOP) {
1558 		switch (job->uaiocb.aio_lio_opcode) {
1559 		case LIO_WRITE:
1560 		case LIO_NOP:
1561 		case LIO_READ:
1562 			opcode = job->uaiocb.aio_lio_opcode;
1563 			break;
1564 		default:
1565 			error = EINVAL;
1566 			goto err2;
1567 		}
1568 	} else
1569 		opcode = job->uaiocb.aio_lio_opcode = type;
1570 
1571 	ksiginfo_init(&job->ksi);
1572 
1573 	/* Save userspace address of the job info. */
1574 	job->ujob = ujob;
1575 
1576 	/*
1577 	 * Validate the opcode and fetch the file object for the specified
1578 	 * file descriptor.
1579 	 *
1580 	 * XXXRW: Moved the opcode validation up here so that we don't
1581 	 * retrieve a file descriptor without knowing what the capabiltity
1582 	 * should be.
1583 	 */
1584 	fd = job->uaiocb.aio_fildes;
1585 	switch (opcode) {
1586 	case LIO_WRITE:
1587 	case LIO_WRITEV:
1588 		error = fget_write(td, fd, &cap_pwrite_rights, &fp);
1589 		break;
1590 	case LIO_READ:
1591 	case LIO_READV:
1592 		error = fget_read(td, fd, &cap_pread_rights, &fp);
1593 		break;
1594 	case LIO_SYNC:
1595 	case LIO_DSYNC:
1596 		error = fget(td, fd, &cap_fsync_rights, &fp);
1597 		break;
1598 	case LIO_MLOCK:
1599 		break;
1600 	case LIO_NOP:
1601 		error = fget(td, fd, &cap_no_rights, &fp);
1602 		break;
1603 	default:
1604 		error = EINVAL;
1605 	}
1606 	if (error)
1607 		goto err3;
1608 
1609 	if ((opcode & LIO_SYNC) && fp->f_vnode == NULL) {
1610 		error = EINVAL;
1611 		goto err3;
1612 	}
1613 
1614 	if ((opcode == LIO_READ || opcode == LIO_READV ||
1615 	    opcode == LIO_WRITE || opcode == LIO_WRITEV) &&
1616 	    job->uaiocb.aio_offset < 0 &&
1617 	    (fp->f_vnode == NULL || fp->f_vnode->v_type != VCHR)) {
1618 		error = EINVAL;
1619 		goto err3;
1620 	}
1621 
1622 	if (fp != NULL && fp->f_ops == &path_fileops) {
1623 		error = EBADF;
1624 		goto err3;
1625 	}
1626 
1627 	job->fd_file = fp;
1628 
1629 	mtx_lock(&aio_job_mtx);
1630 	jid = jobrefid++;
1631 	job->seqno = jobseqno++;
1632 	mtx_unlock(&aio_job_mtx);
1633 	error = ops->store_kernelinfo(ujob, jid);
1634 	if (error) {
1635 		error = EINVAL;
1636 		goto err3;
1637 	}
1638 	job->uaiocb._aiocb_private.kernelinfo = (void *)(intptr_t)jid;
1639 
1640 	if (opcode == LIO_NOP) {
1641 		fdrop(fp, td);
1642 		MPASS(job->uiop == &job->uio || job->uiop == NULL);
1643 		uma_zfree(aiocb_zone, job);
1644 		return (0);
1645 	}
1646 
1647 	if (job->uaiocb.aio_sigevent.sigev_notify != SIGEV_KEVENT)
1648 		goto no_kqueue;
1649 	evflags = job->uaiocb.aio_sigevent.sigev_notify_kevent_flags;
1650 	if ((evflags & ~(EV_CLEAR | EV_DISPATCH | EV_ONESHOT)) != 0) {
1651 		error = EINVAL;
1652 		goto err3;
1653 	}
1654 	kqfd = job->uaiocb.aio_sigevent.sigev_notify_kqueue;
1655 	memset(&kev, 0, sizeof(kev));
1656 	kev.ident = (uintptr_t)job->ujob;
1657 	kev.filter = EVFILT_AIO;
1658 	kev.flags = EV_ADD | EV_ENABLE | EV_FLAG1 | evflags;
1659 	kev.data = (intptr_t)job;
1660 	kev.udata = job->uaiocb.aio_sigevent.sigev_value.sival_ptr;
1661 	error = kqfd_register(kqfd, &kev, td, M_WAITOK);
1662 	if (error)
1663 		goto err3;
1664 
1665 no_kqueue:
1666 
1667 	ops->store_error(ujob, EINPROGRESS);
1668 	job->uaiocb._aiocb_private.error = EINPROGRESS;
1669 	job->userproc = p;
1670 	job->cred = crhold(td->td_ucred);
1671 	job->jobflags = KAIOCB_QUEUEING;
1672 	job->lio = lj;
1673 
1674 	if (opcode & LIO_VECTORED) {
1675 		/* Use the uio copied in by aio_copyin */
1676 		MPASS(job->uiop != &job->uio && job->uiop != NULL);
1677 	} else {
1678 		/* Setup the inline uio */
1679 		job->iov[0].iov_base = (void *)(uintptr_t)job->uaiocb.aio_buf;
1680 		job->iov[0].iov_len = job->uaiocb.aio_nbytes;
1681 		job->uio.uio_iov = job->iov;
1682 		job->uio.uio_iovcnt = 1;
1683 		job->uio.uio_resid = job->uaiocb.aio_nbytes;
1684 		job->uio.uio_segflg = UIO_USERSPACE;
1685 		job->uiop = &job->uio;
1686 	}
1687 	switch (opcode & (LIO_READ | LIO_WRITE)) {
1688 	case LIO_READ:
1689 		job->uiop->uio_rw = UIO_READ;
1690 		break;
1691 	case LIO_WRITE:
1692 		job->uiop->uio_rw = UIO_WRITE;
1693 		break;
1694 	}
1695 	job->uiop->uio_offset = job->uaiocb.aio_offset;
1696 	job->uiop->uio_td = td;
1697 
1698 	if (opcode == LIO_MLOCK) {
1699 		aio_schedule(job, aio_process_mlock);
1700 		error = 0;
1701 	} else if (fp->f_ops->fo_aio_queue == NULL)
1702 		error = aio_queue_file(fp, job);
1703 	else
1704 		error = fo_aio_queue(fp, job);
1705 	if (error)
1706 		goto err3;
1707 
1708 	AIO_LOCK(ki);
1709 	job->jobflags &= ~KAIOCB_QUEUEING;
1710 	TAILQ_INSERT_TAIL(&ki->kaio_all, job, allist);
1711 	ki->kaio_count++;
1712 	if (lj)
1713 		lj->lioj_count++;
1714 	atomic_add_int(&num_queue_count, 1);
1715 	if (job->jobflags & KAIOCB_FINISHED) {
1716 		/*
1717 		 * The queue callback completed the request synchronously.
1718 		 * The bulk of the completion is deferred in that case
1719 		 * until this point.
1720 		 */
1721 		aio_bio_done_notify(p, job);
1722 	} else
1723 		TAILQ_INSERT_TAIL(&ki->kaio_jobqueue, job, plist);
1724 	AIO_UNLOCK(ki);
1725 	return (0);
1726 
1727 err3:
1728 	if (fp)
1729 		fdrop(fp, td);
1730 	knlist_delete(&job->klist, curthread, 0);
1731 err2:
1732 	if (job->uiop != &job->uio)
1733 		free(job->uiop, M_IOV);
1734 	uma_zfree(aiocb_zone, job);
1735 err1:
1736 	ops->store_error(ujob, error);
1737 	return (error);
1738 }
1739 
1740 static void
1741 aio_cancel_daemon_job(struct kaiocb *job)
1742 {
1743 
1744 	mtx_lock(&aio_job_mtx);
1745 	if (!aio_cancel_cleared(job))
1746 		TAILQ_REMOVE(&aio_jobs, job, list);
1747 	mtx_unlock(&aio_job_mtx);
1748 	aio_cancel(job);
1749 }
1750 
1751 void
1752 aio_schedule(struct kaiocb *job, aio_handle_fn_t *func)
1753 {
1754 
1755 	mtx_lock(&aio_job_mtx);
1756 	if (!aio_set_cancel_function(job, aio_cancel_daemon_job)) {
1757 		mtx_unlock(&aio_job_mtx);
1758 		aio_cancel(job);
1759 		return;
1760 	}
1761 	job->handle_fn = func;
1762 	TAILQ_INSERT_TAIL(&aio_jobs, job, list);
1763 	aio_kick_nowait(job->userproc);
1764 	mtx_unlock(&aio_job_mtx);
1765 }
1766 
1767 static void
1768 aio_cancel_sync(struct kaiocb *job)
1769 {
1770 	struct kaioinfo *ki;
1771 
1772 	ki = job->userproc->p_aioinfo;
1773 	AIO_LOCK(ki);
1774 	if (!aio_cancel_cleared(job))
1775 		TAILQ_REMOVE(&ki->kaio_syncqueue, job, list);
1776 	AIO_UNLOCK(ki);
1777 	aio_cancel(job);
1778 }
1779 
1780 int
1781 aio_queue_file(struct file *fp, struct kaiocb *job)
1782 {
1783 	struct kaioinfo *ki;
1784 	struct kaiocb *job2;
1785 	struct vnode *vp;
1786 	struct mount *mp;
1787 	int error;
1788 	bool safe;
1789 
1790 	ki = job->userproc->p_aioinfo;
1791 	error = aio_qbio(job->userproc, job);
1792 	if (error >= 0)
1793 		return (error);
1794 	safe = false;
1795 	if (fp->f_type == DTYPE_VNODE) {
1796 		vp = fp->f_vnode;
1797 		if (vp->v_type == VREG || vp->v_type == VDIR) {
1798 			mp = fp->f_vnode->v_mount;
1799 			if (mp == NULL || (mp->mnt_flag & MNT_LOCAL) != 0)
1800 				safe = true;
1801 		}
1802 	}
1803 	if (!(safe || enable_aio_unsafe)) {
1804 		counted_warning(&unsafe_warningcnt,
1805 		    "is attempting to use unsafe AIO requests");
1806 		return (EOPNOTSUPP);
1807 	}
1808 
1809 	if (job->uaiocb.aio_lio_opcode & (LIO_WRITE | LIO_READ)) {
1810 		aio_schedule(job, aio_process_rw);
1811 		error = 0;
1812 	} else if (job->uaiocb.aio_lio_opcode & LIO_SYNC) {
1813 		AIO_LOCK(ki);
1814 		TAILQ_FOREACH(job2, &ki->kaio_jobqueue, plist) {
1815 			if (job2->fd_file == job->fd_file &&
1816 			    ((job2->uaiocb.aio_lio_opcode & LIO_SYNC) == 0) &&
1817 			    job2->seqno < job->seqno) {
1818 				job2->jobflags |= KAIOCB_CHECKSYNC;
1819 				job->pending++;
1820 			}
1821 		}
1822 		if (job->pending != 0) {
1823 			if (!aio_set_cancel_function_locked(job,
1824 				aio_cancel_sync)) {
1825 				AIO_UNLOCK(ki);
1826 				aio_cancel(job);
1827 				return (0);
1828 			}
1829 			TAILQ_INSERT_TAIL(&ki->kaio_syncqueue, job, list);
1830 			AIO_UNLOCK(ki);
1831 			return (0);
1832 		}
1833 		AIO_UNLOCK(ki);
1834 		aio_schedule(job, aio_process_sync);
1835 		error = 0;
1836 	} else {
1837 		error = EINVAL;
1838 	}
1839 	return (error);
1840 }
1841 
1842 static void
1843 aio_kick_nowait(struct proc *userp)
1844 {
1845 	struct kaioinfo *ki = userp->p_aioinfo;
1846 	struct aioproc *aiop;
1847 
1848 	mtx_assert(&aio_job_mtx, MA_OWNED);
1849 	if ((aiop = TAILQ_FIRST(&aio_freeproc)) != NULL) {
1850 		TAILQ_REMOVE(&aio_freeproc, aiop, list);
1851 		aiop->aioprocflags &= ~AIOP_FREE;
1852 		wakeup(aiop->aioproc);
1853 	} else if (num_aio_resv_start + num_aio_procs < max_aio_procs &&
1854 	    ki->kaio_active_count + num_aio_resv_start < max_aio_per_proc) {
1855 		taskqueue_enqueue(taskqueue_aiod_kick, &ki->kaio_task);
1856 	}
1857 }
1858 
1859 static int
1860 aio_kick(struct proc *userp)
1861 {
1862 	struct kaioinfo *ki = userp->p_aioinfo;
1863 	struct aioproc *aiop;
1864 	int error, ret = 0;
1865 
1866 	mtx_assert(&aio_job_mtx, MA_OWNED);
1867 retryproc:
1868 	if ((aiop = TAILQ_FIRST(&aio_freeproc)) != NULL) {
1869 		TAILQ_REMOVE(&aio_freeproc, aiop, list);
1870 		aiop->aioprocflags &= ~AIOP_FREE;
1871 		wakeup(aiop->aioproc);
1872 	} else if (num_aio_resv_start + num_aio_procs < max_aio_procs &&
1873 	    ki->kaio_active_count + num_aio_resv_start < max_aio_per_proc) {
1874 		num_aio_resv_start++;
1875 		mtx_unlock(&aio_job_mtx);
1876 		error = aio_newproc(&num_aio_resv_start);
1877 		mtx_lock(&aio_job_mtx);
1878 		if (error) {
1879 			num_aio_resv_start--;
1880 			goto retryproc;
1881 		}
1882 	} else {
1883 		ret = -1;
1884 	}
1885 	return (ret);
1886 }
1887 
1888 static void
1889 aio_kick_helper(void *context, int pending)
1890 {
1891 	struct proc *userp = context;
1892 
1893 	mtx_lock(&aio_job_mtx);
1894 	while (--pending >= 0) {
1895 		if (aio_kick(userp))
1896 			break;
1897 	}
1898 	mtx_unlock(&aio_job_mtx);
1899 }
1900 
1901 /*
1902  * Support the aio_return system call, as a side-effect, kernel resources are
1903  * released.
1904  */
1905 static int
1906 kern_aio_return(struct thread *td, struct aiocb *ujob, struct aiocb_ops *ops)
1907 {
1908 	struct proc *p = td->td_proc;
1909 	struct kaiocb *job;
1910 	struct kaioinfo *ki;
1911 	long status, error;
1912 
1913 	ki = p->p_aioinfo;
1914 	if (ki == NULL)
1915 		return (EINVAL);
1916 	AIO_LOCK(ki);
1917 	TAILQ_FOREACH(job, &ki->kaio_done, plist) {
1918 		if (job->ujob == ujob)
1919 			break;
1920 	}
1921 	if (job != NULL) {
1922 		MPASS(job->jobflags & KAIOCB_FINISHED);
1923 		status = job->uaiocb._aiocb_private.status;
1924 		error = job->uaiocb._aiocb_private.error;
1925 		td->td_retval[0] = status;
1926 		td->td_ru.ru_oublock += job->outblock;
1927 		td->td_ru.ru_inblock += job->inblock;
1928 		td->td_ru.ru_msgsnd += job->msgsnd;
1929 		td->td_ru.ru_msgrcv += job->msgrcv;
1930 		aio_free_entry(job);
1931 		AIO_UNLOCK(ki);
1932 		ops->store_error(ujob, error);
1933 		ops->store_status(ujob, status);
1934 	} else {
1935 		error = EINVAL;
1936 		AIO_UNLOCK(ki);
1937 	}
1938 	return (error);
1939 }
1940 
1941 int
1942 sys_aio_return(struct thread *td, struct aio_return_args *uap)
1943 {
1944 
1945 	return (kern_aio_return(td, uap->aiocbp, &aiocb_ops));
1946 }
1947 
1948 /*
1949  * Allow a process to wakeup when any of the I/O requests are completed.
1950  */
1951 static int
1952 kern_aio_suspend(struct thread *td, int njoblist, struct aiocb **ujoblist,
1953     struct timespec *ts)
1954 {
1955 	struct proc *p = td->td_proc;
1956 	struct timeval atv;
1957 	struct kaioinfo *ki;
1958 	struct kaiocb *firstjob, *job;
1959 	int error, i, timo;
1960 
1961 	timo = 0;
1962 	if (ts) {
1963 		if (ts->tv_nsec < 0 || ts->tv_nsec >= 1000000000)
1964 			return (EINVAL);
1965 
1966 		TIMESPEC_TO_TIMEVAL(&atv, ts);
1967 		if (itimerfix(&atv))
1968 			return (EINVAL);
1969 		timo = tvtohz(&atv);
1970 	}
1971 
1972 	ki = p->p_aioinfo;
1973 	if (ki == NULL)
1974 		return (EAGAIN);
1975 
1976 	if (njoblist == 0)
1977 		return (0);
1978 
1979 	AIO_LOCK(ki);
1980 	for (;;) {
1981 		firstjob = NULL;
1982 		error = 0;
1983 		TAILQ_FOREACH(job, &ki->kaio_all, allist) {
1984 			for (i = 0; i < njoblist; i++) {
1985 				if (job->ujob == ujoblist[i]) {
1986 					if (firstjob == NULL)
1987 						firstjob = job;
1988 					if (job->jobflags & KAIOCB_FINISHED)
1989 						goto RETURN;
1990 				}
1991 			}
1992 		}
1993 		/* All tasks were finished. */
1994 		if (firstjob == NULL)
1995 			break;
1996 
1997 		ki->kaio_flags |= KAIO_WAKEUP;
1998 		error = msleep(&p->p_aioinfo, AIO_MTX(ki), PRIBIO | PCATCH,
1999 		    "aiospn", timo);
2000 		if (error == ERESTART)
2001 			error = EINTR;
2002 		if (error)
2003 			break;
2004 	}
2005 RETURN:
2006 	AIO_UNLOCK(ki);
2007 	return (error);
2008 }
2009 
2010 int
2011 sys_aio_suspend(struct thread *td, struct aio_suspend_args *uap)
2012 {
2013 	struct timespec ts, *tsp;
2014 	struct aiocb **ujoblist;
2015 	int error;
2016 
2017 	if (uap->nent < 0 || uap->nent > max_aio_queue_per_proc)
2018 		return (EINVAL);
2019 
2020 	if (uap->timeout) {
2021 		/* Get timespec struct. */
2022 		if ((error = copyin(uap->timeout, &ts, sizeof(ts))) != 0)
2023 			return (error);
2024 		tsp = &ts;
2025 	} else
2026 		tsp = NULL;
2027 
2028 	ujoblist = malloc(uap->nent * sizeof(ujoblist[0]), M_AIOS, M_WAITOK);
2029 	error = copyin(uap->aiocbp, ujoblist, uap->nent * sizeof(ujoblist[0]));
2030 	if (error == 0)
2031 		error = kern_aio_suspend(td, uap->nent, ujoblist, tsp);
2032 	free(ujoblist, M_AIOS);
2033 	return (error);
2034 }
2035 
2036 /*
2037  * aio_cancel cancels any non-bio aio operations not currently in progress.
2038  */
2039 int
2040 sys_aio_cancel(struct thread *td, struct aio_cancel_args *uap)
2041 {
2042 	struct proc *p = td->td_proc;
2043 	struct kaioinfo *ki;
2044 	struct kaiocb *job, *jobn;
2045 	struct file *fp;
2046 	int error;
2047 	int cancelled = 0;
2048 	int notcancelled = 0;
2049 	struct vnode *vp;
2050 
2051 	/* Lookup file object. */
2052 	error = fget(td, uap->fd, &cap_no_rights, &fp);
2053 	if (error)
2054 		return (error);
2055 
2056 	ki = p->p_aioinfo;
2057 	if (ki == NULL)
2058 		goto done;
2059 
2060 	if (fp->f_type == DTYPE_VNODE) {
2061 		vp = fp->f_vnode;
2062 		if (vn_isdisk(vp)) {
2063 			fdrop(fp, td);
2064 			td->td_retval[0] = AIO_NOTCANCELED;
2065 			return (0);
2066 		}
2067 	}
2068 
2069 	AIO_LOCK(ki);
2070 	TAILQ_FOREACH_SAFE(job, &ki->kaio_jobqueue, plist, jobn) {
2071 		if ((uap->fd == job->uaiocb.aio_fildes) &&
2072 		    ((uap->aiocbp == NULL) ||
2073 		     (uap->aiocbp == job->ujob))) {
2074 			if (aio_cancel_job(p, ki, job)) {
2075 				cancelled++;
2076 			} else {
2077 				notcancelled++;
2078 			}
2079 			if (uap->aiocbp != NULL)
2080 				break;
2081 		}
2082 	}
2083 	AIO_UNLOCK(ki);
2084 
2085 done:
2086 	fdrop(fp, td);
2087 
2088 	if (uap->aiocbp != NULL) {
2089 		if (cancelled) {
2090 			td->td_retval[0] = AIO_CANCELED;
2091 			return (0);
2092 		}
2093 	}
2094 
2095 	if (notcancelled) {
2096 		td->td_retval[0] = AIO_NOTCANCELED;
2097 		return (0);
2098 	}
2099 
2100 	if (cancelled) {
2101 		td->td_retval[0] = AIO_CANCELED;
2102 		return (0);
2103 	}
2104 
2105 	td->td_retval[0] = AIO_ALLDONE;
2106 
2107 	return (0);
2108 }
2109 
2110 /*
2111  * aio_error is implemented in the kernel level for compatibility purposes
2112  * only.  For a user mode async implementation, it would be best to do it in
2113  * a userland subroutine.
2114  */
2115 static int
2116 kern_aio_error(struct thread *td, struct aiocb *ujob, struct aiocb_ops *ops)
2117 {
2118 	struct proc *p = td->td_proc;
2119 	struct kaiocb *job;
2120 	struct kaioinfo *ki;
2121 	int status;
2122 
2123 	ki = p->p_aioinfo;
2124 	if (ki == NULL) {
2125 		td->td_retval[0] = EINVAL;
2126 		return (0);
2127 	}
2128 
2129 	AIO_LOCK(ki);
2130 	TAILQ_FOREACH(job, &ki->kaio_all, allist) {
2131 		if (job->ujob == ujob) {
2132 			if (job->jobflags & KAIOCB_FINISHED)
2133 				td->td_retval[0] =
2134 					job->uaiocb._aiocb_private.error;
2135 			else
2136 				td->td_retval[0] = EINPROGRESS;
2137 			AIO_UNLOCK(ki);
2138 			return (0);
2139 		}
2140 	}
2141 	AIO_UNLOCK(ki);
2142 
2143 	/*
2144 	 * Hack for failure of aio_aqueue.
2145 	 */
2146 	status = ops->fetch_status(ujob);
2147 	if (status == -1) {
2148 		td->td_retval[0] = ops->fetch_error(ujob);
2149 		return (0);
2150 	}
2151 
2152 	td->td_retval[0] = EINVAL;
2153 	return (0);
2154 }
2155 
2156 int
2157 sys_aio_error(struct thread *td, struct aio_error_args *uap)
2158 {
2159 
2160 	return (kern_aio_error(td, uap->aiocbp, &aiocb_ops));
2161 }
2162 
2163 /* syscall - asynchronous read from a file (REALTIME) */
2164 #ifdef COMPAT_FREEBSD6
2165 int
2166 freebsd6_aio_read(struct thread *td, struct freebsd6_aio_read_args *uap)
2167 {
2168 
2169 	return (aio_aqueue(td, (struct aiocb *)uap->aiocbp, NULL, LIO_READ,
2170 	    &aiocb_ops_osigevent));
2171 }
2172 #endif
2173 
2174 int
2175 sys_aio_read(struct thread *td, struct aio_read_args *uap)
2176 {
2177 
2178 	return (aio_aqueue(td, uap->aiocbp, NULL, LIO_READ, &aiocb_ops));
2179 }
2180 
2181 int
2182 sys_aio_readv(struct thread *td, struct aio_readv_args *uap)
2183 {
2184 
2185 	return (aio_aqueue(td, uap->aiocbp, NULL, LIO_READV, &aiocb_ops));
2186 }
2187 
2188 /* syscall - asynchronous write to a file (REALTIME) */
2189 #ifdef COMPAT_FREEBSD6
2190 int
2191 freebsd6_aio_write(struct thread *td, struct freebsd6_aio_write_args *uap)
2192 {
2193 
2194 	return (aio_aqueue(td, (struct aiocb *)uap->aiocbp, NULL, LIO_WRITE,
2195 	    &aiocb_ops_osigevent));
2196 }
2197 #endif
2198 
2199 int
2200 sys_aio_write(struct thread *td, struct aio_write_args *uap)
2201 {
2202 
2203 	return (aio_aqueue(td, uap->aiocbp, NULL, LIO_WRITE, &aiocb_ops));
2204 }
2205 
2206 int
2207 sys_aio_writev(struct thread *td, struct aio_writev_args *uap)
2208 {
2209 
2210 	return (aio_aqueue(td, uap->aiocbp, NULL, LIO_WRITEV, &aiocb_ops));
2211 }
2212 
2213 int
2214 sys_aio_mlock(struct thread *td, struct aio_mlock_args *uap)
2215 {
2216 
2217 	return (aio_aqueue(td, uap->aiocbp, NULL, LIO_MLOCK, &aiocb_ops));
2218 }
2219 
2220 static int
2221 kern_lio_listio(struct thread *td, int mode, struct aiocb * const *uacb_list,
2222     struct aiocb **acb_list, int nent, struct sigevent *sig,
2223     struct aiocb_ops *ops)
2224 {
2225 	struct proc *p = td->td_proc;
2226 	struct aiocb *job;
2227 	struct kaioinfo *ki;
2228 	struct aioliojob *lj;
2229 	struct kevent kev;
2230 	int error;
2231 	int nagain, nerror;
2232 	int i;
2233 
2234 	if ((mode != LIO_NOWAIT) && (mode != LIO_WAIT))
2235 		return (EINVAL);
2236 
2237 	if (nent < 0 || nent > max_aio_queue_per_proc)
2238 		return (EINVAL);
2239 
2240 	if (p->p_aioinfo == NULL)
2241 		aio_init_aioinfo(p);
2242 
2243 	ki = p->p_aioinfo;
2244 
2245 	lj = uma_zalloc(aiolio_zone, M_WAITOK);
2246 	lj->lioj_flags = 0;
2247 	lj->lioj_count = 0;
2248 	lj->lioj_finished_count = 0;
2249 	knlist_init_mtx(&lj->klist, AIO_MTX(ki));
2250 	ksiginfo_init(&lj->lioj_ksi);
2251 
2252 	/*
2253 	 * Setup signal.
2254 	 */
2255 	if (sig && (mode == LIO_NOWAIT)) {
2256 		bcopy(sig, &lj->lioj_signal, sizeof(lj->lioj_signal));
2257 		if (lj->lioj_signal.sigev_notify == SIGEV_KEVENT) {
2258 			/* Assume only new style KEVENT */
2259 			memset(&kev, 0, sizeof(kev));
2260 			kev.filter = EVFILT_LIO;
2261 			kev.flags = EV_ADD | EV_ENABLE | EV_FLAG1;
2262 			kev.ident = (uintptr_t)uacb_list; /* something unique */
2263 			kev.data = (intptr_t)lj;
2264 			/* pass user defined sigval data */
2265 			kev.udata = lj->lioj_signal.sigev_value.sival_ptr;
2266 			error = kqfd_register(
2267 			    lj->lioj_signal.sigev_notify_kqueue, &kev, td,
2268 			    M_WAITOK);
2269 			if (error) {
2270 				uma_zfree(aiolio_zone, lj);
2271 				return (error);
2272 			}
2273 		} else if (lj->lioj_signal.sigev_notify == SIGEV_NONE) {
2274 			;
2275 		} else if (lj->lioj_signal.sigev_notify == SIGEV_SIGNAL ||
2276 			   lj->lioj_signal.sigev_notify == SIGEV_THREAD_ID) {
2277 				if (!_SIG_VALID(lj->lioj_signal.sigev_signo)) {
2278 					uma_zfree(aiolio_zone, lj);
2279 					return EINVAL;
2280 				}
2281 				lj->lioj_flags |= LIOJ_SIGNAL;
2282 		} else {
2283 			uma_zfree(aiolio_zone, lj);
2284 			return EINVAL;
2285 		}
2286 	}
2287 
2288 	AIO_LOCK(ki);
2289 	TAILQ_INSERT_TAIL(&ki->kaio_liojoblist, lj, lioj_list);
2290 	/*
2291 	 * Add extra aiocb count to avoid the lio to be freed
2292 	 * by other threads doing aio_waitcomplete or aio_return,
2293 	 * and prevent event from being sent until we have queued
2294 	 * all tasks.
2295 	 */
2296 	lj->lioj_count = 1;
2297 	AIO_UNLOCK(ki);
2298 
2299 	/*
2300 	 * Get pointers to the list of I/O requests.
2301 	 */
2302 	nagain = 0;
2303 	nerror = 0;
2304 	for (i = 0; i < nent; i++) {
2305 		job = acb_list[i];
2306 		if (job != NULL) {
2307 			error = aio_aqueue(td, job, lj, LIO_NOP, ops);
2308 			if (error == EAGAIN)
2309 				nagain++;
2310 			else if (error != 0)
2311 				nerror++;
2312 		}
2313 	}
2314 
2315 	error = 0;
2316 	AIO_LOCK(ki);
2317 	if (mode == LIO_WAIT) {
2318 		while (lj->lioj_count - 1 != lj->lioj_finished_count) {
2319 			ki->kaio_flags |= KAIO_WAKEUP;
2320 			error = msleep(&p->p_aioinfo, AIO_MTX(ki),
2321 			    PRIBIO | PCATCH, "aiospn", 0);
2322 			if (error == ERESTART)
2323 				error = EINTR;
2324 			if (error)
2325 				break;
2326 		}
2327 	} else {
2328 		if (lj->lioj_count - 1 == lj->lioj_finished_count) {
2329 			if (lj->lioj_signal.sigev_notify == SIGEV_KEVENT) {
2330 				lj->lioj_flags |= LIOJ_KEVENT_POSTED;
2331 				KNOTE_LOCKED(&lj->klist, 1);
2332 			}
2333 			if ((lj->lioj_flags & (LIOJ_SIGNAL |
2334 			    LIOJ_SIGNAL_POSTED)) == LIOJ_SIGNAL &&
2335 			    (lj->lioj_signal.sigev_notify == SIGEV_SIGNAL ||
2336 			    lj->lioj_signal.sigev_notify == SIGEV_THREAD_ID)) {
2337 				aio_sendsig(p, &lj->lioj_signal, &lj->lioj_ksi,
2338 				    lj->lioj_count != 1);
2339 				lj->lioj_flags |= LIOJ_SIGNAL_POSTED;
2340 			}
2341 		}
2342 	}
2343 	lj->lioj_count--;
2344 	if (lj->lioj_count == 0) {
2345 		TAILQ_REMOVE(&ki->kaio_liojoblist, lj, lioj_list);
2346 		knlist_delete(&lj->klist, curthread, 1);
2347 		PROC_LOCK(p);
2348 		sigqueue_take(&lj->lioj_ksi);
2349 		PROC_UNLOCK(p);
2350 		AIO_UNLOCK(ki);
2351 		uma_zfree(aiolio_zone, lj);
2352 	} else
2353 		AIO_UNLOCK(ki);
2354 
2355 	if (nerror)
2356 		return (EIO);
2357 	else if (nagain)
2358 		return (EAGAIN);
2359 	else
2360 		return (error);
2361 }
2362 
2363 /* syscall - list directed I/O (REALTIME) */
2364 #ifdef COMPAT_FREEBSD6
2365 int
2366 freebsd6_lio_listio(struct thread *td, struct freebsd6_lio_listio_args *uap)
2367 {
2368 	struct aiocb **acb_list;
2369 	struct sigevent *sigp, sig;
2370 	struct osigevent osig;
2371 	int error, nent;
2372 
2373 	if ((uap->mode != LIO_NOWAIT) && (uap->mode != LIO_WAIT))
2374 		return (EINVAL);
2375 
2376 	nent = uap->nent;
2377 	if (nent < 0 || nent > max_aio_queue_per_proc)
2378 		return (EINVAL);
2379 
2380 	if (uap->sig && (uap->mode == LIO_NOWAIT)) {
2381 		error = copyin(uap->sig, &osig, sizeof(osig));
2382 		if (error)
2383 			return (error);
2384 		error = convert_old_sigevent(&osig, &sig);
2385 		if (error)
2386 			return (error);
2387 		sigp = &sig;
2388 	} else
2389 		sigp = NULL;
2390 
2391 	acb_list = malloc(sizeof(struct aiocb *) * nent, M_LIO, M_WAITOK);
2392 	error = copyin(uap->acb_list, acb_list, nent * sizeof(acb_list[0]));
2393 	if (error == 0)
2394 		error = kern_lio_listio(td, uap->mode,
2395 		    (struct aiocb * const *)uap->acb_list, acb_list, nent, sigp,
2396 		    &aiocb_ops_osigevent);
2397 	free(acb_list, M_LIO);
2398 	return (error);
2399 }
2400 #endif
2401 
2402 /* syscall - list directed I/O (REALTIME) */
2403 int
2404 sys_lio_listio(struct thread *td, struct lio_listio_args *uap)
2405 {
2406 	struct aiocb **acb_list;
2407 	struct sigevent *sigp, sig;
2408 	int error, nent;
2409 
2410 	if ((uap->mode != LIO_NOWAIT) && (uap->mode != LIO_WAIT))
2411 		return (EINVAL);
2412 
2413 	nent = uap->nent;
2414 	if (nent < 0 || nent > max_aio_queue_per_proc)
2415 		return (EINVAL);
2416 
2417 	if (uap->sig && (uap->mode == LIO_NOWAIT)) {
2418 		error = copyin(uap->sig, &sig, sizeof(sig));
2419 		if (error)
2420 			return (error);
2421 		sigp = &sig;
2422 	} else
2423 		sigp = NULL;
2424 
2425 	acb_list = malloc(sizeof(struct aiocb *) * nent, M_LIO, M_WAITOK);
2426 	error = copyin(uap->acb_list, acb_list, nent * sizeof(acb_list[0]));
2427 	if (error == 0)
2428 		error = kern_lio_listio(td, uap->mode, uap->acb_list, acb_list,
2429 		    nent, sigp, &aiocb_ops);
2430 	free(acb_list, M_LIO);
2431 	return (error);
2432 }
2433 
2434 static void
2435 aio_biocleanup(struct bio *bp)
2436 {
2437 	struct kaiocb *job = (struct kaiocb *)bp->bio_caller1;
2438 	struct kaioinfo *ki;
2439 	struct buf *pbuf = (struct buf *)bp->bio_caller2;
2440 
2441 	/* Release mapping into kernel space. */
2442 	if (pbuf != NULL) {
2443 		MPASS(pbuf->b_npages <= atop(maxphys) + 1);
2444 		pmap_qremove((vm_offset_t)pbuf->b_data, pbuf->b_npages);
2445 		vm_page_unhold_pages(pbuf->b_pages, pbuf->b_npages);
2446 		uma_zfree(pbuf_zone, pbuf);
2447 		atomic_subtract_int(&num_buf_aio, 1);
2448 		ki = job->userproc->p_aioinfo;
2449 		AIO_LOCK(ki);
2450 		ki->kaio_buffer_count--;
2451 		AIO_UNLOCK(ki);
2452 	} else {
2453 		MPASS(bp->bio_ma_n <= atop(maxphys) + 1);
2454 		vm_page_unhold_pages(bp->bio_ma, bp->bio_ma_n);
2455 		free(bp->bio_ma, M_TEMP);
2456 		atomic_subtract_int(&num_unmapped_aio, 1);
2457 	}
2458 	g_destroy_bio(bp);
2459 }
2460 
2461 static void
2462 aio_biowakeup(struct bio *bp)
2463 {
2464 	struct kaiocb *job = (struct kaiocb *)bp->bio_caller1;
2465 	size_t nbytes;
2466 	long bcount = bp->bio_bcount;
2467 	long resid = bp->bio_resid;
2468 	int error, opcode, nblks;
2469 	int bio_error = bp->bio_error;
2470 	uint16_t flags = bp->bio_flags;
2471 
2472 	opcode = job->uaiocb.aio_lio_opcode;
2473 
2474 	aio_biocleanup(bp);
2475 
2476 	nbytes =bcount - resid;
2477 	atomic_add_acq_long(&job->nbytes, nbytes);
2478 	nblks = btodb(nbytes);
2479 	error = 0;
2480 	/*
2481 	 * If multiple bios experienced an error, the job will reflect the
2482 	 * error of whichever failed bio completed last.
2483 	 */
2484 	if (flags & BIO_ERROR)
2485 		atomic_set_int(&job->error, bio_error);
2486 	if (opcode & LIO_WRITE)
2487 		atomic_add_int(&job->outblock, nblks);
2488 	else
2489 		atomic_add_int(&job->inblock, nblks);
2490 	atomic_subtract_int(&job->nbio, 1);
2491 
2492 
2493 	if (atomic_load_int(&job->nbio) == 0) {
2494 		if (atomic_load_int(&job->error))
2495 			aio_complete(job, -1, job->error);
2496 		else
2497 			aio_complete(job, atomic_load_long(&job->nbytes), 0);
2498 	}
2499 }
2500 
2501 /* syscall - wait for the next completion of an aio request */
2502 static int
2503 kern_aio_waitcomplete(struct thread *td, struct aiocb **ujobp,
2504     struct timespec *ts, struct aiocb_ops *ops)
2505 {
2506 	struct proc *p = td->td_proc;
2507 	struct timeval atv;
2508 	struct kaioinfo *ki;
2509 	struct kaiocb *job;
2510 	struct aiocb *ujob;
2511 	long error, status;
2512 	int timo;
2513 
2514 	ops->store_aiocb(ujobp, NULL);
2515 
2516 	if (ts == NULL) {
2517 		timo = 0;
2518 	} else if (ts->tv_sec == 0 && ts->tv_nsec == 0) {
2519 		timo = -1;
2520 	} else {
2521 		if ((ts->tv_nsec < 0) || (ts->tv_nsec >= 1000000000))
2522 			return (EINVAL);
2523 
2524 		TIMESPEC_TO_TIMEVAL(&atv, ts);
2525 		if (itimerfix(&atv))
2526 			return (EINVAL);
2527 		timo = tvtohz(&atv);
2528 	}
2529 
2530 	if (p->p_aioinfo == NULL)
2531 		aio_init_aioinfo(p);
2532 	ki = p->p_aioinfo;
2533 
2534 	error = 0;
2535 	job = NULL;
2536 	AIO_LOCK(ki);
2537 	while ((job = TAILQ_FIRST(&ki->kaio_done)) == NULL) {
2538 		if (timo == -1) {
2539 			error = EWOULDBLOCK;
2540 			break;
2541 		}
2542 		ki->kaio_flags |= KAIO_WAKEUP;
2543 		error = msleep(&p->p_aioinfo, AIO_MTX(ki), PRIBIO | PCATCH,
2544 		    "aiowc", timo);
2545 		if (timo && error == ERESTART)
2546 			error = EINTR;
2547 		if (error)
2548 			break;
2549 	}
2550 
2551 	if (job != NULL) {
2552 		MPASS(job->jobflags & KAIOCB_FINISHED);
2553 		ujob = job->ujob;
2554 		status = job->uaiocb._aiocb_private.status;
2555 		error = job->uaiocb._aiocb_private.error;
2556 		td->td_retval[0] = status;
2557 		td->td_ru.ru_oublock += job->outblock;
2558 		td->td_ru.ru_inblock += job->inblock;
2559 		td->td_ru.ru_msgsnd += job->msgsnd;
2560 		td->td_ru.ru_msgrcv += job->msgrcv;
2561 		aio_free_entry(job);
2562 		AIO_UNLOCK(ki);
2563 		ops->store_aiocb(ujobp, ujob);
2564 		ops->store_error(ujob, error);
2565 		ops->store_status(ujob, status);
2566 	} else
2567 		AIO_UNLOCK(ki);
2568 
2569 	return (error);
2570 }
2571 
2572 int
2573 sys_aio_waitcomplete(struct thread *td, struct aio_waitcomplete_args *uap)
2574 {
2575 	struct timespec ts, *tsp;
2576 	int error;
2577 
2578 	if (uap->timeout) {
2579 		/* Get timespec struct. */
2580 		error = copyin(uap->timeout, &ts, sizeof(ts));
2581 		if (error)
2582 			return (error);
2583 		tsp = &ts;
2584 	} else
2585 		tsp = NULL;
2586 
2587 	return (kern_aio_waitcomplete(td, uap->aiocbp, tsp, &aiocb_ops));
2588 }
2589 
2590 static int
2591 kern_aio_fsync(struct thread *td, int op, struct aiocb *ujob,
2592     struct aiocb_ops *ops)
2593 {
2594 	int listop;
2595 
2596 	switch (op) {
2597 	case O_SYNC:
2598 		listop = LIO_SYNC;
2599 		break;
2600 	case O_DSYNC:
2601 		listop = LIO_DSYNC;
2602 		break;
2603 	default:
2604 		return (EINVAL);
2605 	}
2606 
2607 	return (aio_aqueue(td, ujob, NULL, listop, ops));
2608 }
2609 
2610 int
2611 sys_aio_fsync(struct thread *td, struct aio_fsync_args *uap)
2612 {
2613 
2614 	return (kern_aio_fsync(td, uap->op, uap->aiocbp, &aiocb_ops));
2615 }
2616 
2617 /* kqueue attach function */
2618 static int
2619 filt_aioattach(struct knote *kn)
2620 {
2621 	struct kaiocb *job;
2622 
2623 	job = (struct kaiocb *)(uintptr_t)kn->kn_sdata;
2624 
2625 	/*
2626 	 * The job pointer must be validated before using it, so
2627 	 * registration is restricted to the kernel; the user cannot
2628 	 * set EV_FLAG1.
2629 	 */
2630 	if ((kn->kn_flags & EV_FLAG1) == 0)
2631 		return (EPERM);
2632 	kn->kn_ptr.p_aio = job;
2633 	kn->kn_flags &= ~EV_FLAG1;
2634 
2635 	knlist_add(&job->klist, kn, 0);
2636 
2637 	return (0);
2638 }
2639 
2640 /* kqueue detach function */
2641 static void
2642 filt_aiodetach(struct knote *kn)
2643 {
2644 	struct knlist *knl;
2645 
2646 	knl = &kn->kn_ptr.p_aio->klist;
2647 	knl->kl_lock(knl->kl_lockarg);
2648 	if (!knlist_empty(knl))
2649 		knlist_remove(knl, kn, 1);
2650 	knl->kl_unlock(knl->kl_lockarg);
2651 }
2652 
2653 /* kqueue filter function */
2654 /*ARGSUSED*/
2655 static int
2656 filt_aio(struct knote *kn, long hint)
2657 {
2658 	struct kaiocb *job = kn->kn_ptr.p_aio;
2659 
2660 	kn->kn_data = job->uaiocb._aiocb_private.error;
2661 	if (!(job->jobflags & KAIOCB_FINISHED))
2662 		return (0);
2663 	kn->kn_flags |= EV_EOF;
2664 	return (1);
2665 }
2666 
2667 /* kqueue attach function */
2668 static int
2669 filt_lioattach(struct knote *kn)
2670 {
2671 	struct aioliojob *lj;
2672 
2673 	lj = (struct aioliojob *)(uintptr_t)kn->kn_sdata;
2674 
2675 	/*
2676 	 * The aioliojob pointer must be validated before using it, so
2677 	 * registration is restricted to the kernel; the user cannot
2678 	 * set EV_FLAG1.
2679 	 */
2680 	if ((kn->kn_flags & EV_FLAG1) == 0)
2681 		return (EPERM);
2682 	kn->kn_ptr.p_lio = lj;
2683 	kn->kn_flags &= ~EV_FLAG1;
2684 
2685 	knlist_add(&lj->klist, kn, 0);
2686 
2687 	return (0);
2688 }
2689 
2690 /* kqueue detach function */
2691 static void
2692 filt_liodetach(struct knote *kn)
2693 {
2694 	struct knlist *knl;
2695 
2696 	knl = &kn->kn_ptr.p_lio->klist;
2697 	knl->kl_lock(knl->kl_lockarg);
2698 	if (!knlist_empty(knl))
2699 		knlist_remove(knl, kn, 1);
2700 	knl->kl_unlock(knl->kl_lockarg);
2701 }
2702 
2703 /* kqueue filter function */
2704 /*ARGSUSED*/
2705 static int
2706 filt_lio(struct knote *kn, long hint)
2707 {
2708 	struct aioliojob * lj = kn->kn_ptr.p_lio;
2709 
2710 	return (lj->lioj_flags & LIOJ_KEVENT_POSTED);
2711 }
2712 
2713 #ifdef COMPAT_FREEBSD32
2714 #include <sys/mount.h>
2715 #include <sys/socket.h>
2716 #include <compat/freebsd32/freebsd32.h>
2717 #include <compat/freebsd32/freebsd32_proto.h>
2718 #include <compat/freebsd32/freebsd32_signal.h>
2719 #include <compat/freebsd32/freebsd32_syscall.h>
2720 #include <compat/freebsd32/freebsd32_util.h>
2721 
2722 struct __aiocb_private32 {
2723 	int32_t	status;
2724 	int32_t	error;
2725 	uint32_t kernelinfo;
2726 };
2727 
2728 #ifdef COMPAT_FREEBSD6
2729 typedef struct oaiocb32 {
2730 	int	aio_fildes;		/* File descriptor */
2731 	uint64_t aio_offset __packed;	/* File offset for I/O */
2732 	uint32_t aio_buf;		/* I/O buffer in process space */
2733 	uint32_t aio_nbytes;		/* Number of bytes for I/O */
2734 	struct	osigevent32 aio_sigevent; /* Signal to deliver */
2735 	int	aio_lio_opcode;		/* LIO opcode */
2736 	int	aio_reqprio;		/* Request priority -- ignored */
2737 	struct	__aiocb_private32 _aiocb_private;
2738 } oaiocb32_t;
2739 #endif
2740 
2741 typedef struct aiocb32 {
2742 	int32_t	aio_fildes;		/* File descriptor */
2743 	uint64_t aio_offset __packed;	/* File offset for I/O */
2744 	uint32_t aio_buf;	/* I/O buffer in process space */
2745 	uint32_t aio_nbytes;	/* Number of bytes for I/O */
2746 	int	__spare__[2];
2747 	uint32_t __spare2__;
2748 	int	aio_lio_opcode;		/* LIO opcode */
2749 	int	aio_reqprio;		/* Request priority -- ignored */
2750 	struct	__aiocb_private32 _aiocb_private;
2751 	struct	sigevent32 aio_sigevent;	/* Signal to deliver */
2752 } aiocb32_t;
2753 
2754 #ifdef COMPAT_FREEBSD6
2755 static int
2756 convert_old_sigevent32(struct osigevent32 *osig, struct sigevent *nsig)
2757 {
2758 
2759 	/*
2760 	 * Only SIGEV_NONE, SIGEV_SIGNAL, and SIGEV_KEVENT are
2761 	 * supported by AIO with the old sigevent structure.
2762 	 */
2763 	CP(*osig, *nsig, sigev_notify);
2764 	switch (nsig->sigev_notify) {
2765 	case SIGEV_NONE:
2766 		break;
2767 	case SIGEV_SIGNAL:
2768 		nsig->sigev_signo = osig->__sigev_u.__sigev_signo;
2769 		break;
2770 	case SIGEV_KEVENT:
2771 		nsig->sigev_notify_kqueue =
2772 		    osig->__sigev_u.__sigev_notify_kqueue;
2773 		PTRIN_CP(*osig, *nsig, sigev_value.sival_ptr);
2774 		break;
2775 	default:
2776 		return (EINVAL);
2777 	}
2778 	return (0);
2779 }
2780 
2781 static int
2782 aiocb32_copyin_old_sigevent(struct aiocb *ujob, struct kaiocb *kjob,
2783     int type __unused)
2784 {
2785 	struct oaiocb32 job32;
2786 	struct aiocb *kcb = &kjob->uaiocb;
2787 	int error;
2788 
2789 	bzero(kcb, sizeof(struct aiocb));
2790 	error = copyin(ujob, &job32, sizeof(job32));
2791 	if (error)
2792 		return (error);
2793 
2794 	/* No need to copyin aio_iov, because it did not exist in FreeBSD 6 */
2795 
2796 	CP(job32, *kcb, aio_fildes);
2797 	CP(job32, *kcb, aio_offset);
2798 	PTRIN_CP(job32, *kcb, aio_buf);
2799 	CP(job32, *kcb, aio_nbytes);
2800 	CP(job32, *kcb, aio_lio_opcode);
2801 	CP(job32, *kcb, aio_reqprio);
2802 	CP(job32, *kcb, _aiocb_private.status);
2803 	CP(job32, *kcb, _aiocb_private.error);
2804 	PTRIN_CP(job32, *kcb, _aiocb_private.kernelinfo);
2805 	return (convert_old_sigevent32(&job32.aio_sigevent,
2806 	    &kcb->aio_sigevent));
2807 }
2808 #endif
2809 
2810 static int
2811 aiocb32_copyin(struct aiocb *ujob, struct kaiocb *kjob, int type)
2812 {
2813 	struct aiocb32 job32;
2814 	struct aiocb *kcb = &kjob->uaiocb;
2815 	struct iovec32 *iov32;
2816 	int error;
2817 
2818 	error = copyin(ujob, &job32, sizeof(job32));
2819 	if (error)
2820 		return (error);
2821 	CP(job32, *kcb, aio_fildes);
2822 	CP(job32, *kcb, aio_offset);
2823 	CP(job32, *kcb, aio_lio_opcode);
2824 	if (type & LIO_VECTORED) {
2825 		iov32 = PTRIN(job32.aio_iov);
2826 		CP(job32, *kcb, aio_iovcnt);
2827 		/* malloc a uio and copy in the iovec */
2828 		error = freebsd32_copyinuio(iov32,
2829 		    kcb->aio_iovcnt, &kjob->uiop);
2830 		if (error)
2831 			return (error);
2832 	} else {
2833 		PTRIN_CP(job32, *kcb, aio_buf);
2834 		CP(job32, *kcb, aio_nbytes);
2835 	}
2836 	CP(job32, *kcb, aio_reqprio);
2837 	CP(job32, *kcb, _aiocb_private.status);
2838 	CP(job32, *kcb, _aiocb_private.error);
2839 	PTRIN_CP(job32, *kcb, _aiocb_private.kernelinfo);
2840 	error = convert_sigevent32(&job32.aio_sigevent, &kcb->aio_sigevent);
2841 
2842 	return (error);
2843 }
2844 
2845 static long
2846 aiocb32_fetch_status(struct aiocb *ujob)
2847 {
2848 	struct aiocb32 *ujob32;
2849 
2850 	ujob32 = (struct aiocb32 *)ujob;
2851 	return (fuword32(&ujob32->_aiocb_private.status));
2852 }
2853 
2854 static long
2855 aiocb32_fetch_error(struct aiocb *ujob)
2856 {
2857 	struct aiocb32 *ujob32;
2858 
2859 	ujob32 = (struct aiocb32 *)ujob;
2860 	return (fuword32(&ujob32->_aiocb_private.error));
2861 }
2862 
2863 static int
2864 aiocb32_store_status(struct aiocb *ujob, long status)
2865 {
2866 	struct aiocb32 *ujob32;
2867 
2868 	ujob32 = (struct aiocb32 *)ujob;
2869 	return (suword32(&ujob32->_aiocb_private.status, status));
2870 }
2871 
2872 static int
2873 aiocb32_store_error(struct aiocb *ujob, long error)
2874 {
2875 	struct aiocb32 *ujob32;
2876 
2877 	ujob32 = (struct aiocb32 *)ujob;
2878 	return (suword32(&ujob32->_aiocb_private.error, error));
2879 }
2880 
2881 static int
2882 aiocb32_store_kernelinfo(struct aiocb *ujob, long jobref)
2883 {
2884 	struct aiocb32 *ujob32;
2885 
2886 	ujob32 = (struct aiocb32 *)ujob;
2887 	return (suword32(&ujob32->_aiocb_private.kernelinfo, jobref));
2888 }
2889 
2890 static int
2891 aiocb32_store_aiocb(struct aiocb **ujobp, struct aiocb *ujob)
2892 {
2893 
2894 	return (suword32(ujobp, (long)ujob));
2895 }
2896 
2897 static struct aiocb_ops aiocb32_ops = {
2898 	.aio_copyin = aiocb32_copyin,
2899 	.fetch_status = aiocb32_fetch_status,
2900 	.fetch_error = aiocb32_fetch_error,
2901 	.store_status = aiocb32_store_status,
2902 	.store_error = aiocb32_store_error,
2903 	.store_kernelinfo = aiocb32_store_kernelinfo,
2904 	.store_aiocb = aiocb32_store_aiocb,
2905 };
2906 
2907 #ifdef COMPAT_FREEBSD6
2908 static struct aiocb_ops aiocb32_ops_osigevent = {
2909 	.aio_copyin = aiocb32_copyin_old_sigevent,
2910 	.fetch_status = aiocb32_fetch_status,
2911 	.fetch_error = aiocb32_fetch_error,
2912 	.store_status = aiocb32_store_status,
2913 	.store_error = aiocb32_store_error,
2914 	.store_kernelinfo = aiocb32_store_kernelinfo,
2915 	.store_aiocb = aiocb32_store_aiocb,
2916 };
2917 #endif
2918 
2919 int
2920 freebsd32_aio_return(struct thread *td, struct freebsd32_aio_return_args *uap)
2921 {
2922 
2923 	return (kern_aio_return(td, (struct aiocb *)uap->aiocbp, &aiocb32_ops));
2924 }
2925 
2926 int
2927 freebsd32_aio_suspend(struct thread *td, struct freebsd32_aio_suspend_args *uap)
2928 {
2929 	struct timespec32 ts32;
2930 	struct timespec ts, *tsp;
2931 	struct aiocb **ujoblist;
2932 	uint32_t *ujoblist32;
2933 	int error, i;
2934 
2935 	if (uap->nent < 0 || uap->nent > max_aio_queue_per_proc)
2936 		return (EINVAL);
2937 
2938 	if (uap->timeout) {
2939 		/* Get timespec struct. */
2940 		if ((error = copyin(uap->timeout, &ts32, sizeof(ts32))) != 0)
2941 			return (error);
2942 		CP(ts32, ts, tv_sec);
2943 		CP(ts32, ts, tv_nsec);
2944 		tsp = &ts;
2945 	} else
2946 		tsp = NULL;
2947 
2948 	ujoblist = malloc(uap->nent * sizeof(ujoblist[0]), M_AIOS, M_WAITOK);
2949 	ujoblist32 = (uint32_t *)ujoblist;
2950 	error = copyin(uap->aiocbp, ujoblist32, uap->nent *
2951 	    sizeof(ujoblist32[0]));
2952 	if (error == 0) {
2953 		for (i = uap->nent - 1; i >= 0; i--)
2954 			ujoblist[i] = PTRIN(ujoblist32[i]);
2955 
2956 		error = kern_aio_suspend(td, uap->nent, ujoblist, tsp);
2957 	}
2958 	free(ujoblist, M_AIOS);
2959 	return (error);
2960 }
2961 
2962 int
2963 freebsd32_aio_error(struct thread *td, struct freebsd32_aio_error_args *uap)
2964 {
2965 
2966 	return (kern_aio_error(td, (struct aiocb *)uap->aiocbp, &aiocb32_ops));
2967 }
2968 
2969 #ifdef COMPAT_FREEBSD6
2970 int
2971 freebsd6_freebsd32_aio_read(struct thread *td,
2972     struct freebsd6_freebsd32_aio_read_args *uap)
2973 {
2974 
2975 	return (aio_aqueue(td, (struct aiocb *)uap->aiocbp, NULL, LIO_READ,
2976 	    &aiocb32_ops_osigevent));
2977 }
2978 #endif
2979 
2980 int
2981 freebsd32_aio_read(struct thread *td, struct freebsd32_aio_read_args *uap)
2982 {
2983 
2984 	return (aio_aqueue(td, (struct aiocb *)uap->aiocbp, NULL, LIO_READ,
2985 	    &aiocb32_ops));
2986 }
2987 
2988 int
2989 freebsd32_aio_readv(struct thread *td, struct freebsd32_aio_readv_args *uap)
2990 {
2991 
2992 	return (aio_aqueue(td, (struct aiocb *)uap->aiocbp, NULL, LIO_READV,
2993 	    &aiocb32_ops));
2994 }
2995 
2996 #ifdef COMPAT_FREEBSD6
2997 int
2998 freebsd6_freebsd32_aio_write(struct thread *td,
2999     struct freebsd6_freebsd32_aio_write_args *uap)
3000 {
3001 
3002 	return (aio_aqueue(td, (struct aiocb *)uap->aiocbp, NULL, LIO_WRITE,
3003 	    &aiocb32_ops_osigevent));
3004 }
3005 #endif
3006 
3007 int
3008 freebsd32_aio_write(struct thread *td, struct freebsd32_aio_write_args *uap)
3009 {
3010 
3011 	return (aio_aqueue(td, (struct aiocb *)uap->aiocbp, NULL, LIO_WRITE,
3012 	    &aiocb32_ops));
3013 }
3014 
3015 int
3016 freebsd32_aio_writev(struct thread *td, struct freebsd32_aio_writev_args *uap)
3017 {
3018 
3019 	return (aio_aqueue(td, (struct aiocb *)uap->aiocbp, NULL, LIO_WRITEV,
3020 	    &aiocb32_ops));
3021 }
3022 
3023 int
3024 freebsd32_aio_mlock(struct thread *td, struct freebsd32_aio_mlock_args *uap)
3025 {
3026 
3027 	return (aio_aqueue(td, (struct aiocb *)uap->aiocbp, NULL, LIO_MLOCK,
3028 	    &aiocb32_ops));
3029 }
3030 
3031 int
3032 freebsd32_aio_waitcomplete(struct thread *td,
3033     struct freebsd32_aio_waitcomplete_args *uap)
3034 {
3035 	struct timespec32 ts32;
3036 	struct timespec ts, *tsp;
3037 	int error;
3038 
3039 	if (uap->timeout) {
3040 		/* Get timespec struct. */
3041 		error = copyin(uap->timeout, &ts32, sizeof(ts32));
3042 		if (error)
3043 			return (error);
3044 		CP(ts32, ts, tv_sec);
3045 		CP(ts32, ts, tv_nsec);
3046 		tsp = &ts;
3047 	} else
3048 		tsp = NULL;
3049 
3050 	return (kern_aio_waitcomplete(td, (struct aiocb **)uap->aiocbp, tsp,
3051 	    &aiocb32_ops));
3052 }
3053 
3054 int
3055 freebsd32_aio_fsync(struct thread *td, struct freebsd32_aio_fsync_args *uap)
3056 {
3057 
3058 	return (kern_aio_fsync(td, uap->op, (struct aiocb *)uap->aiocbp,
3059 	    &aiocb32_ops));
3060 }
3061 
3062 #ifdef COMPAT_FREEBSD6
3063 int
3064 freebsd6_freebsd32_lio_listio(struct thread *td,
3065     struct freebsd6_freebsd32_lio_listio_args *uap)
3066 {
3067 	struct aiocb **acb_list;
3068 	struct sigevent *sigp, sig;
3069 	struct osigevent32 osig;
3070 	uint32_t *acb_list32;
3071 	int error, i, nent;
3072 
3073 	if ((uap->mode != LIO_NOWAIT) && (uap->mode != LIO_WAIT))
3074 		return (EINVAL);
3075 
3076 	nent = uap->nent;
3077 	if (nent < 0 || nent > max_aio_queue_per_proc)
3078 		return (EINVAL);
3079 
3080 	if (uap->sig && (uap->mode == LIO_NOWAIT)) {
3081 		error = copyin(uap->sig, &osig, sizeof(osig));
3082 		if (error)
3083 			return (error);
3084 		error = convert_old_sigevent32(&osig, &sig);
3085 		if (error)
3086 			return (error);
3087 		sigp = &sig;
3088 	} else
3089 		sigp = NULL;
3090 
3091 	acb_list32 = malloc(sizeof(uint32_t) * nent, M_LIO, M_WAITOK);
3092 	error = copyin(uap->acb_list, acb_list32, nent * sizeof(uint32_t));
3093 	if (error) {
3094 		free(acb_list32, M_LIO);
3095 		return (error);
3096 	}
3097 	acb_list = malloc(sizeof(struct aiocb *) * nent, M_LIO, M_WAITOK);
3098 	for (i = 0; i < nent; i++)
3099 		acb_list[i] = PTRIN(acb_list32[i]);
3100 	free(acb_list32, M_LIO);
3101 
3102 	error = kern_lio_listio(td, uap->mode,
3103 	    (struct aiocb * const *)uap->acb_list, acb_list, nent, sigp,
3104 	    &aiocb32_ops_osigevent);
3105 	free(acb_list, M_LIO);
3106 	return (error);
3107 }
3108 #endif
3109 
3110 int
3111 freebsd32_lio_listio(struct thread *td, struct freebsd32_lio_listio_args *uap)
3112 {
3113 	struct aiocb **acb_list;
3114 	struct sigevent *sigp, sig;
3115 	struct sigevent32 sig32;
3116 	uint32_t *acb_list32;
3117 	int error, i, nent;
3118 
3119 	if ((uap->mode != LIO_NOWAIT) && (uap->mode != LIO_WAIT))
3120 		return (EINVAL);
3121 
3122 	nent = uap->nent;
3123 	if (nent < 0 || nent > max_aio_queue_per_proc)
3124 		return (EINVAL);
3125 
3126 	if (uap->sig && (uap->mode == LIO_NOWAIT)) {
3127 		error = copyin(uap->sig, &sig32, sizeof(sig32));
3128 		if (error)
3129 			return (error);
3130 		error = convert_sigevent32(&sig32, &sig);
3131 		if (error)
3132 			return (error);
3133 		sigp = &sig;
3134 	} else
3135 		sigp = NULL;
3136 
3137 	acb_list32 = malloc(sizeof(uint32_t) * nent, M_LIO, M_WAITOK);
3138 	error = copyin(uap->acb_list, acb_list32, nent * sizeof(uint32_t));
3139 	if (error) {
3140 		free(acb_list32, M_LIO);
3141 		return (error);
3142 	}
3143 	acb_list = malloc(sizeof(struct aiocb *) * nent, M_LIO, M_WAITOK);
3144 	for (i = 0; i < nent; i++)
3145 		acb_list[i] = PTRIN(acb_list32[i]);
3146 	free(acb_list32, M_LIO);
3147 
3148 	error = kern_lio_listio(td, uap->mode,
3149 	    (struct aiocb * const *)uap->acb_list, acb_list, nent, sigp,
3150 	    &aiocb32_ops);
3151 	free(acb_list, M_LIO);
3152 	return (error);
3153 }
3154 
3155 #endif
3156