1 /*
2 * fs/timerfd.c
3 *
4 * Copyright (C) 2007 Davide Libenzi <davidel@xmailserver.org>
5 *
6 *
7 * Thanks to Thomas Gleixner for code reviews and useful comments.
8 *
9 */
10
11 #include <linux/alarmtimer.h>
12 #include <linux/file.h>
13 #include <linux/poll.h>
14 #include <linux/init.h>
15 #include <linux/fs.h>
16 #include <linux/sched.h>
17 #include <linux/kernel.h>
18 #include <linux/slab.h>
19 #include <linux/list.h>
20 #include <linux/spinlock.h>
21 #include <linux/time.h>
22 #include <linux/hrtimer.h>
23 #include <linux/anon_inodes.h>
24 #include <linux/timerfd.h>
25 #include <linux/syscalls.h>
26 #include <linux/compat.h>
27 #include <linux/rcupdate.h>
28
29 struct timerfd_ctx {
30 union {
31 struct hrtimer tmr;
32 struct alarm alarm;
33 } t;
34 ktime_t tintv;
35 ktime_t moffs;
36 wait_queue_head_t wqh;
37 u64 ticks;
38 int expired;
39 int clockid;
40 struct rcu_head rcu;
41 struct list_head clist;
42 spinlock_t cancel_lock;
43 bool might_cancel;
44 };
45
46 static LIST_HEAD(cancel_list);
47 static DEFINE_SPINLOCK(cancel_lock);
48
isalarm(struct timerfd_ctx * ctx)49 static inline bool isalarm(struct timerfd_ctx *ctx)
50 {
51 return ctx->clockid == CLOCK_REALTIME_ALARM ||
52 ctx->clockid == CLOCK_BOOTTIME_ALARM;
53 }
54
55 /*
56 * This gets called when the timer event triggers. We set the "expired"
57 * flag, but we do not re-arm the timer (in case it's necessary,
58 * tintv.tv64 != 0) until the timer is accessed.
59 */
timerfd_triggered(struct timerfd_ctx * ctx)60 static void timerfd_triggered(struct timerfd_ctx *ctx)
61 {
62 unsigned long flags;
63
64 spin_lock_irqsave(&ctx->wqh.lock, flags);
65 ctx->expired = 1;
66 ctx->ticks++;
67 wake_up_locked(&ctx->wqh);
68 spin_unlock_irqrestore(&ctx->wqh.lock, flags);
69 }
70
timerfd_tmrproc(struct hrtimer * htmr)71 static enum hrtimer_restart timerfd_tmrproc(struct hrtimer *htmr)
72 {
73 struct timerfd_ctx *ctx = container_of(htmr, struct timerfd_ctx,
74 t.tmr);
75 timerfd_triggered(ctx);
76 return HRTIMER_NORESTART;
77 }
78
timerfd_alarmproc(struct alarm * alarm,ktime_t now)79 static enum alarmtimer_restart timerfd_alarmproc(struct alarm *alarm,
80 ktime_t now)
81 {
82 struct timerfd_ctx *ctx = container_of(alarm, struct timerfd_ctx,
83 t.alarm);
84 timerfd_triggered(ctx);
85 return ALARMTIMER_NORESTART;
86 }
87
88 /*
89 * Called when the clock was set to cancel the timers in the cancel
90 * list. This will wake up processes waiting on these timers. The
91 * wake-up requires ctx->ticks to be non zero, therefore we increment
92 * it before calling wake_up_locked().
93 */
timerfd_clock_was_set(void)94 void timerfd_clock_was_set(void)
95 {
96 ktime_t moffs = ktime_get_monotonic_offset();
97 struct timerfd_ctx *ctx;
98 unsigned long flags;
99
100 rcu_read_lock();
101 list_for_each_entry_rcu(ctx, &cancel_list, clist) {
102 if (!ctx->might_cancel)
103 continue;
104 spin_lock_irqsave(&ctx->wqh.lock, flags);
105 if (ctx->moffs.tv64 != moffs.tv64) {
106 ctx->moffs.tv64 = KTIME_MAX;
107 ctx->ticks++;
108 wake_up_locked(&ctx->wqh);
109 }
110 spin_unlock_irqrestore(&ctx->wqh.lock, flags);
111 }
112 rcu_read_unlock();
113 }
114
__timerfd_remove_cancel(struct timerfd_ctx * ctx)115 static void __timerfd_remove_cancel(struct timerfd_ctx *ctx)
116 {
117 if (ctx->might_cancel) {
118 ctx->might_cancel = false;
119 spin_lock(&cancel_lock);
120 list_del_rcu(&ctx->clist);
121 spin_unlock(&cancel_lock);
122 }
123 }
124
timerfd_remove_cancel(struct timerfd_ctx * ctx)125 static void timerfd_remove_cancel(struct timerfd_ctx *ctx)
126 {
127 spin_lock(&ctx->cancel_lock);
128 __timerfd_remove_cancel(ctx);
129 spin_unlock(&ctx->cancel_lock);
130 }
131
timerfd_canceled(struct timerfd_ctx * ctx)132 static bool timerfd_canceled(struct timerfd_ctx *ctx)
133 {
134 if (!ctx->might_cancel || ctx->moffs.tv64 != KTIME_MAX)
135 return false;
136 ctx->moffs = ktime_get_monotonic_offset();
137 return true;
138 }
139
timerfd_setup_cancel(struct timerfd_ctx * ctx,int flags)140 static void timerfd_setup_cancel(struct timerfd_ctx *ctx, int flags)
141 {
142 spin_lock(&ctx->cancel_lock);
143 if ((ctx->clockid == CLOCK_REALTIME ||
144 ctx->clockid == CLOCK_REALTIME_ALARM) &&
145 (flags & TFD_TIMER_ABSTIME) && (flags & TFD_TIMER_CANCEL_ON_SET)) {
146 if (!ctx->might_cancel) {
147 ctx->might_cancel = true;
148 spin_lock(&cancel_lock);
149 list_add_rcu(&ctx->clist, &cancel_list);
150 spin_unlock(&cancel_lock);
151 }
152 } else {
153 __timerfd_remove_cancel(ctx);
154 }
155 spin_unlock(&ctx->cancel_lock);
156 }
157
timerfd_get_remaining(struct timerfd_ctx * ctx)158 static ktime_t timerfd_get_remaining(struct timerfd_ctx *ctx)
159 {
160 ktime_t remaining;
161
162 if (isalarm(ctx))
163 remaining = alarm_expires_remaining(&ctx->t.alarm);
164 else
165 remaining = hrtimer_expires_remaining(&ctx->t.tmr);
166
167 return remaining.tv64 < 0 ? ktime_set(0, 0): remaining;
168 }
169
timerfd_setup(struct timerfd_ctx * ctx,int flags,const struct itimerspec * ktmr)170 static int timerfd_setup(struct timerfd_ctx *ctx, int flags,
171 const struct itimerspec *ktmr)
172 {
173 enum hrtimer_mode htmode;
174 ktime_t texp;
175 int clockid = ctx->clockid;
176
177 htmode = (flags & TFD_TIMER_ABSTIME) ?
178 HRTIMER_MODE_ABS: HRTIMER_MODE_REL;
179
180 texp = timespec_to_ktime(ktmr->it_value);
181 ctx->expired = 0;
182 ctx->ticks = 0;
183 ctx->tintv = timespec_to_ktime(ktmr->it_interval);
184
185 if (isalarm(ctx)) {
186 alarm_init(&ctx->t.alarm,
187 ctx->clockid == CLOCK_REALTIME_ALARM ?
188 ALARM_REALTIME : ALARM_BOOTTIME,
189 timerfd_alarmproc);
190 } else {
191 hrtimer_init(&ctx->t.tmr, clockid, htmode);
192 hrtimer_set_expires(&ctx->t.tmr, texp);
193 ctx->t.tmr.function = timerfd_tmrproc;
194 }
195
196 if (texp.tv64 != 0) {
197 if (isalarm(ctx)) {
198 if (flags & TFD_TIMER_ABSTIME)
199 alarm_start(&ctx->t.alarm, texp);
200 else
201 alarm_start_relative(&ctx->t.alarm, texp);
202 } else {
203 hrtimer_start(&ctx->t.tmr, texp, htmode);
204 }
205
206 if (timerfd_canceled(ctx))
207 return -ECANCELED;
208 }
209 return 0;
210 }
211
timerfd_release(struct inode * inode,struct file * file)212 static int timerfd_release(struct inode *inode, struct file *file)
213 {
214 struct timerfd_ctx *ctx = file->private_data;
215
216 timerfd_remove_cancel(ctx);
217
218 if (isalarm(ctx))
219 alarm_cancel(&ctx->t.alarm);
220 else
221 hrtimer_cancel(&ctx->t.tmr);
222 kfree_rcu(ctx, rcu);
223 return 0;
224 }
225
timerfd_poll(struct file * file,poll_table * wait)226 static unsigned int timerfd_poll(struct file *file, poll_table *wait)
227 {
228 struct timerfd_ctx *ctx = file->private_data;
229 unsigned int events = 0;
230 unsigned long flags;
231
232 poll_wait(file, &ctx->wqh, wait);
233
234 spin_lock_irqsave(&ctx->wqh.lock, flags);
235 if (ctx->ticks)
236 events |= POLLIN;
237 spin_unlock_irqrestore(&ctx->wqh.lock, flags);
238
239 return events;
240 }
241
timerfd_read(struct file * file,char __user * buf,size_t count,loff_t * ppos)242 static ssize_t timerfd_read(struct file *file, char __user *buf, size_t count,
243 loff_t *ppos)
244 {
245 struct timerfd_ctx *ctx = file->private_data;
246 ssize_t res;
247 u64 ticks = 0;
248
249 if (count < sizeof(ticks))
250 return -EINVAL;
251 spin_lock_irq(&ctx->wqh.lock);
252 if (file->f_flags & O_NONBLOCK)
253 res = -EAGAIN;
254 else
255 res = wait_event_interruptible_locked_irq(ctx->wqh, ctx->ticks);
256
257 /*
258 * If clock has changed, we do not care about the
259 * ticks and we do not rearm the timer. Userspace must
260 * reevaluate anyway.
261 */
262 if (timerfd_canceled(ctx)) {
263 ctx->ticks = 0;
264 ctx->expired = 0;
265 res = -ECANCELED;
266 }
267
268 if (ctx->ticks) {
269 ticks = ctx->ticks;
270
271 if (ctx->expired && ctx->tintv.tv64) {
272 /*
273 * If tintv.tv64 != 0, this is a periodic timer that
274 * needs to be re-armed. We avoid doing it in the timer
275 * callback to avoid DoS attacks specifying a very
276 * short timer period.
277 */
278 if (isalarm(ctx)) {
279 ticks += alarm_forward_now(
280 &ctx->t.alarm, ctx->tintv) - 1;
281 alarm_restart(&ctx->t.alarm);
282 } else {
283 ticks += hrtimer_forward_now(&ctx->t.tmr,
284 ctx->tintv) - 1;
285 hrtimer_restart(&ctx->t.tmr);
286 }
287 }
288 ctx->expired = 0;
289 ctx->ticks = 0;
290 }
291 spin_unlock_irq(&ctx->wqh.lock);
292 if (ticks)
293 res = put_user(ticks, (u64 __user *) buf) ? -EFAULT: sizeof(ticks);
294 return res;
295 }
296
297 static const struct file_operations timerfd_fops = {
298 .release = timerfd_release,
299 .poll = timerfd_poll,
300 .read = timerfd_read,
301 .llseek = noop_llseek,
302 };
303
timerfd_fget(int fd,struct fd * p)304 static int timerfd_fget(int fd, struct fd *p)
305 {
306 struct fd f = fdget(fd);
307 if (!f.file)
308 return -EBADF;
309 if (f.file->f_op != &timerfd_fops) {
310 fdput(f);
311 return -EINVAL;
312 }
313 *p = f;
314 return 0;
315 }
316
SYSCALL_DEFINE2(timerfd_create,int,clockid,int,flags)317 SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
318 {
319 int ufd;
320 struct timerfd_ctx *ctx;
321
322 /* Check the TFD_* constants for consistency. */
323 BUILD_BUG_ON(TFD_CLOEXEC != O_CLOEXEC);
324 BUILD_BUG_ON(TFD_NONBLOCK != O_NONBLOCK);
325
326 if ((flags & ~TFD_CREATE_FLAGS) ||
327 (clockid != CLOCK_MONOTONIC &&
328 clockid != CLOCK_REALTIME &&
329 clockid != CLOCK_REALTIME_ALARM &&
330 clockid != CLOCK_BOOTTIME &&
331 clockid != CLOCK_BOOTTIME_ALARM))
332 return -EINVAL;
333
334 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
335 if (!ctx)
336 return -ENOMEM;
337
338 init_waitqueue_head(&ctx->wqh);
339 spin_lock_init(&ctx->cancel_lock);
340 ctx->clockid = clockid;
341
342 if (isalarm(ctx))
343 alarm_init(&ctx->t.alarm,
344 ctx->clockid == CLOCK_REALTIME_ALARM ?
345 ALARM_REALTIME : ALARM_BOOTTIME,
346 timerfd_alarmproc);
347 else
348 hrtimer_init(&ctx->t.tmr, clockid, HRTIMER_MODE_ABS);
349
350 ctx->moffs = ktime_get_monotonic_offset();
351
352 ufd = anon_inode_getfd("[timerfd]", &timerfd_fops, ctx,
353 O_RDWR | (flags & TFD_SHARED_FCNTL_FLAGS));
354 if (ufd < 0)
355 kfree(ctx);
356
357 return ufd;
358 }
359
do_timerfd_settime(int ufd,int flags,const struct itimerspec * new,struct itimerspec * old)360 static int do_timerfd_settime(int ufd, int flags,
361 const struct itimerspec *new,
362 struct itimerspec *old)
363 {
364 struct fd f;
365 struct timerfd_ctx *ctx;
366 int ret;
367
368 if ((flags & ~TFD_SETTIME_FLAGS) ||
369 !timespec_valid(&new->it_value) ||
370 !timespec_valid(&new->it_interval))
371 return -EINVAL;
372
373 ret = timerfd_fget(ufd, &f);
374 if (ret)
375 return ret;
376 ctx = f.file->private_data;
377
378 timerfd_setup_cancel(ctx, flags);
379
380 /*
381 * We need to stop the existing timer before reprogramming
382 * it to the new values.
383 */
384 for (;;) {
385 spin_lock_irq(&ctx->wqh.lock);
386
387 if (isalarm(ctx)) {
388 if (alarm_try_to_cancel(&ctx->t.alarm) >= 0)
389 break;
390 } else {
391 if (hrtimer_try_to_cancel(&ctx->t.tmr) >= 0)
392 break;
393 }
394 spin_unlock_irq(&ctx->wqh.lock);
395 cpu_relax();
396 }
397
398 /*
399 * If the timer is expired and it's periodic, we need to advance it
400 * because the caller may want to know the previous expiration time.
401 * We do not update "ticks" and "expired" since the timer will be
402 * re-programmed again in the following timerfd_setup() call.
403 */
404 if (ctx->expired && ctx->tintv.tv64) {
405 if (isalarm(ctx))
406 alarm_forward_now(&ctx->t.alarm, ctx->tintv);
407 else
408 hrtimer_forward_now(&ctx->t.tmr, ctx->tintv);
409 }
410
411 old->it_value = ktime_to_timespec(timerfd_get_remaining(ctx));
412 old->it_interval = ktime_to_timespec(ctx->tintv);
413
414 /*
415 * Re-program the timer to the new value ...
416 */
417 ret = timerfd_setup(ctx, flags, new);
418
419 spin_unlock_irq(&ctx->wqh.lock);
420 fdput(f);
421 return ret;
422 }
423
do_timerfd_gettime(int ufd,struct itimerspec * t)424 static int do_timerfd_gettime(int ufd, struct itimerspec *t)
425 {
426 struct fd f;
427 struct timerfd_ctx *ctx;
428 int ret = timerfd_fget(ufd, &f);
429 if (ret)
430 return ret;
431 ctx = f.file->private_data;
432
433 spin_lock_irq(&ctx->wqh.lock);
434 if (ctx->expired && ctx->tintv.tv64) {
435 ctx->expired = 0;
436
437 if (isalarm(ctx)) {
438 ctx->ticks +=
439 alarm_forward_now(
440 &ctx->t.alarm, ctx->tintv) - 1;
441 alarm_restart(&ctx->t.alarm);
442 } else {
443 ctx->ticks +=
444 hrtimer_forward_now(&ctx->t.tmr, ctx->tintv)
445 - 1;
446 hrtimer_restart(&ctx->t.tmr);
447 }
448 }
449 t->it_value = ktime_to_timespec(timerfd_get_remaining(ctx));
450 t->it_interval = ktime_to_timespec(ctx->tintv);
451 spin_unlock_irq(&ctx->wqh.lock);
452 fdput(f);
453 return 0;
454 }
455
SYSCALL_DEFINE4(timerfd_settime,int,ufd,int,flags,const struct itimerspec __user *,utmr,struct itimerspec __user *,otmr)456 SYSCALL_DEFINE4(timerfd_settime, int, ufd, int, flags,
457 const struct itimerspec __user *, utmr,
458 struct itimerspec __user *, otmr)
459 {
460 struct itimerspec new, old;
461 int ret;
462
463 if (copy_from_user(&new, utmr, sizeof(new)))
464 return -EFAULT;
465 ret = do_timerfd_settime(ufd, flags, &new, &old);
466 if (ret)
467 return ret;
468 if (otmr && copy_to_user(otmr, &old, sizeof(old)))
469 return -EFAULT;
470
471 return ret;
472 }
473
SYSCALL_DEFINE2(timerfd_gettime,int,ufd,struct itimerspec __user *,otmr)474 SYSCALL_DEFINE2(timerfd_gettime, int, ufd, struct itimerspec __user *, otmr)
475 {
476 struct itimerspec kotmr;
477 int ret = do_timerfd_gettime(ufd, &kotmr);
478 if (ret)
479 return ret;
480 return copy_to_user(otmr, &kotmr, sizeof(kotmr)) ? -EFAULT: 0;
481 }
482
483 #ifdef CONFIG_COMPAT
COMPAT_SYSCALL_DEFINE4(timerfd_settime,int,ufd,int,flags,const struct compat_itimerspec __user *,utmr,struct compat_itimerspec __user *,otmr)484 COMPAT_SYSCALL_DEFINE4(timerfd_settime, int, ufd, int, flags,
485 const struct compat_itimerspec __user *, utmr,
486 struct compat_itimerspec __user *, otmr)
487 {
488 struct itimerspec new, old;
489 int ret;
490
491 if (get_compat_itimerspec(&new, utmr))
492 return -EFAULT;
493 ret = do_timerfd_settime(ufd, flags, &new, &old);
494 if (ret)
495 return ret;
496 if (otmr && put_compat_itimerspec(otmr, &old))
497 return -EFAULT;
498 return ret;
499 }
500
COMPAT_SYSCALL_DEFINE2(timerfd_gettime,int,ufd,struct compat_itimerspec __user *,otmr)501 COMPAT_SYSCALL_DEFINE2(timerfd_gettime, int, ufd,
502 struct compat_itimerspec __user *, otmr)
503 {
504 struct itimerspec kotmr;
505 int ret = do_timerfd_gettime(ufd, &kotmr);
506 if (ret)
507 return ret;
508 return put_compat_itimerspec(otmr, &kotmr) ? -EFAULT: 0;
509 }
510 #endif
511