Half-implement io_submit.

We don't have a way to actually tell an FD to run an async I/O operation yet, so that's still TODO'd.

fs/aio.h

@@ -25,7 +25,7 @@ enum aioctx_event_tag {
     AIOCTX_COMPLETE = 2,
 };
 
-enum aioctx_op {
+enum aioctx_op : uint16_t {
     AIOCTX_PREAD = 0,
     AIOCTX_PWRITE = 1,
     AIOCTX_FSYNC = 2,
@@ -45,13 +45,13 @@ struct aioctx_event_pending {
     fd_t fd;
 
     // A guest memory buffer to read to or write from.
-    addr_t buf;
+    uint64_t buf;
 
     // The bounds of the guest memory buffer.
-    size_t size;
+    uint64_t nbytes;
 
     // The current guest memory buffer offset.
-    ssize_t offset;
+    int64_t offset;
 };
 
 // A completed I/O event's information.

kernel/aio.c

@@ -4,6 +4,21 @@
 #include "kernel/aio.h"
 #include "fs/aio.h"
 
+// Guest memory offsets for the IOCB structure.
+// Calculated by a test program compiled and ran in iSH itself.
+const size_t AIO_IOCB_DATA = 0;
+const size_t AIO_IOCB_KEY = 8;
+const size_t AIO_IOCB_RW_FLAGS = 12;
+const size_t AIO_IOCB_LIO_OPCODE = 16;
+const size_t AIO_IOCB_REQPRIO = 18;
+const size_t AIO_IOCB_FILDES = 20;
+const size_t AIO_IOCB_BUF = 24;
+const size_t AIO_IOCB_NBYTES = 32;
+const size_t AIO_IOCB_OFFSET = 40;
+const size_t AIO_IOCB_RESERVED2 = 48;
+const size_t AIO_IOCB_FLAGS = 56;
+const size_t AIO_IOCB_RESFD = 60;
+
 dword_t sys_io_setup(dword_t nr_events, addr_t ctx_idp) {
     STRACE("io_setup(%d, 0x%x)", nr_events, ctx_idp);
 
@@ -44,14 +59,77 @@ dword_t sys_io_getevents(addr_t ctx_id, dword_t min_nr, dword_t nr, addr_t event
     return _ENOSYS;
 }
 
-dword_t sys_io_submit(addr_t ctx_id, dword_t nr, addr_t iocbpp) {
+dword_t sys_io_submit(addr_t ctx_id, dword_t u_nr, addr_t iocbpp) {
+    sdword_t nr = (sdword_t)u_nr;
     STRACE("io_submit(0x%x, %d, 0x%x)", ctx_id, nr, iocbpp);
 
-    return _ENOSYS;
+    if (nr < 0) return _EINVAL;
+
+    struct aioctx *ctx = aioctx_table_get_and_retain(current->aioctx, ctx_id);
+    if (ctx == NULL) return _EINVAL;
+
+    sdword_t i;
+    signed int err;
+    for (i = 0; i < nr; i += 1) {
+        addr_t iocbp = 0;
+        if (user_get(iocbpp + i * sizeof(addr_t), iocbp)) goto fault;
+
+        uint64_t user_data = 0;
+        if (user_get(iocbp + AIO_IOCB_DATA, user_data)) goto fault;
+
+        struct aioctx_event_pending host_iocb;
+        if (user_get(iocbp + AIO_IOCB_LIO_OPCODE, host_iocb.op)) goto fault;
+        if (user_get(iocbp + AIO_IOCB_FILDES, host_iocb.fd)) goto fault;
+        if (user_get(iocbp + AIO_IOCB_BUF, host_iocb.buf)) goto fault;
+        if (user_get(iocbp + AIO_IOCB_NBYTES, host_iocb.nbytes)) goto fault;
+        if (user_get(iocbp + AIO_IOCB_OFFSET, host_iocb.offset)) goto fault;
+
+        lock(&current->files->lock);
+
+        struct fd *fdp = fdtable_get(current->files, host_iocb.fd);
+        if (fdp == NULL) {
+            unlock(&current->files->lock);
+
+            // Linux man pages mention only the FIRST FD is checked (why?).
+            // TODO: It also doesn't say what happens if further IOCBs are
+            // unchecked, so I'm assuming it halts IOCB processing at this
+            // point.
+            if (i == 0) goto badf;
+            break;
+        }
+
+        err = aioctx_submit_pending_event(ctx, user_data, host_iocb);
+        if (err < 0) {
+            // TODO: This assumes the usual pattern of "first IOCB errors, all
+            // others stop processing without erroring"
+            unlock(&current->files->lock);
+
+            if (i == 0) goto err;
+            break;
+        }
+
+        // TODO: Actually submit the event to the FD.
+        unlock(&current->files->lock);
+    }
+
+    aioctx_release(ctx);
+    return i;
+
+fault:
+    aioctx_release(ctx);
+    return _EFAULT;
+
+badf:
+    aioctx_release(ctx);
+    return _EBADF;
+
+err:
+    aioctx_release(ctx);
+    return err;
 }
 
 dword_t sys_io_cancel(addr_t ctx_id, addr_t iocb, addr_t result) {
     STRACE("io_submit(0x%x, 0x%x, 0x%x)", ctx_id, iocb, result);
-    
+
     return _ENOSYS;
 }