/*-
 * SPDX-License-Identifier: BSD-2-Clause
 *
 * Copyright (c) 2014 Dmitry Chagin <dchagin@FreeBSD.org>
 * Copyright (c) 2023 Jake Freeland <jfree@FreeBSD.org>
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/callout.h>
#include <sys/fcntl.h>
#include <sys/file.h>
#include <sys/filedesc.h>
#include <sys/filio.h>
#include <sys/kernel.h>
#include <sys/lock.h>
#include <sys/malloc.h>
#include <sys/mount.h>
#include <sys/mutex.h>
#include <sys/poll.h>
#include <sys/proc.h>
#include <sys/queue.h>
#include <sys/selinfo.h>
#include <sys/stat.h>
#include <sys/sx.h>
#include <sys/syscallsubr.h>
#include <sys/sysctl.h>
#include <sys/sysent.h>
#include <sys/sysproto.h>
#include <sys/timerfd.h>
#include <sys/timespec.h>
#include <sys/uio.h>
#include <sys/user.h>

#include <security/audit/audit.h>

static MALLOC_DEFINE(M_TIMERFD, "timerfd", "timerfd structures");

static struct mtx timerfd_list_lock;
static LIST_HEAD(, timerfd) timerfd_list;
MTX_SYSINIT(timerfd, &timerfd_list_lock, "timerfd_list_lock", MTX_DEF);

static struct unrhdr64 tfdino_unr;

#define TFD_NOJUMP      0       /* Realtime clock has not jumped. */
#define TFD_READ        1       /* Jumped, tfd has been read since. */
#define TFD_ZREAD       2       /* Jumped backwards, CANCEL_ON_SET=false. */
#define TFD_CANCELED    4       /* Jumped, CANCEL_ON_SET=true. */
#define TFD_JUMPED      (TFD_ZREAD | TFD_CANCELED)

/*
 * One structure allocated per timerfd descriptor.
 *
 * Locking semantics:
 * (t)  locked by tfd_lock mtx
 * (l)  locked by timerfd_list_lock sx
 * (c)  const until freeing
 */
struct timerfd {
        /* User specified. */
        struct itimerspec tfd_time;     /* (t) tfd timer */
        clockid_t       tfd_clockid;    /* (c) timing base */
        int             tfd_flags;      /* (c) creation flags */
        int             tfd_timflags;   /* (t) timer flags */

        /* Used internally. */
        timerfd_t       tfd_count;      /* (t) expiration count since read */
        bool            tfd_expired;    /* (t) true upon initial expiration */
        struct mtx      tfd_lock;       /* tfd mtx lock */
        struct callout  tfd_callout;    /* (t) expiration notification */
        struct selinfo  tfd_sel;        /* (t) I/O alerts */
        struct timespec tfd_boottim;    /* (t) cached boottime */
        int             tfd_jumped;     /* (t) timer jump status */
        LIST_ENTRY(timerfd) entry;      /* (l) entry in list */

        /* For stat(2). */
        ino_t           tfd_ino;        /* (c) inode number */
        struct timespec tfd_atim;       /* (t) time of last read */
        struct timespec tfd_mtim;       /* (t) time of last settime */
        struct timespec tfd_birthtim;   /* (c) creation time */
};

static void
timerfd_init(void *data)
{
        new_unrhdr64(&tfdino_unr, 1);
}

SYSINIT(timerfd, SI_SUB_VFS, SI_ORDER_ANY, timerfd_init, NULL);

static inline void
timerfd_getboottime(struct timespec *ts)
{
        struct timeval tv;

        getboottime(&tv);
        TIMEVAL_TO_TIMESPEC(&tv, ts);
}

static void
timerfd_wakeup(struct timerfd *tfd)
{
        wakeup(&tfd->tfd_count);
        selwakeup(&tfd->tfd_sel);
        KNOTE_LOCKED(&tfd->tfd_sel.si_note, 0);
}

/*
 * Call when a discontinuous jump has occured in CLOCK_REALTIME and
 * update timerfd's cached boottime. A jump can be triggered using
 * functions like clock_settime(2) or settimeofday(2).
 *
 * Timer is marked TFD_CANCELED if TFD_TIMER_CANCEL_ON_SET is set
 * and the realtime clock jumps.
 * Timer is marked TFD_ZREAD if TFD_TIMER_CANCEL_ON_SET is not set,
 * but the realtime clock jumps backwards.
 */
void
timerfd_jumped(void)
{
        struct timerfd *tfd;
        struct timespec boottime, diff;

        if (LIST_EMPTY(&timerfd_list))
                return;

        timerfd_getboottime(&boottime);
        mtx_lock(&timerfd_list_lock);
        LIST_FOREACH(tfd, &timerfd_list, entry) {
                mtx_lock(&tfd->tfd_lock);
                if (tfd->tfd_clockid != CLOCK_REALTIME ||
                    (tfd->tfd_timflags & TFD_TIMER_ABSTIME) == 0 ||
                    timespeccmp(&boottime, &tfd->tfd_boottim, ==)) {
                        mtx_unlock(&tfd->tfd_lock);
                        continue;
                }

                if (callout_active(&tfd->tfd_callout)) {
                        if ((tfd->tfd_timflags & TFD_TIMER_CANCEL_ON_SET) != 0)
                                tfd->tfd_jumped = TFD_CANCELED;
                        else if (timespeccmp(&boottime, &tfd->tfd_boottim, <))
                                tfd->tfd_jumped = TFD_ZREAD;

                        /*
                         * Do not reschedule callout when
                         * inside interval time loop.
                         */
                        if (!tfd->tfd_expired) {
                                timespecsub(&boottime,
                                    &tfd->tfd_boottim, &diff);
                                timespecsub(&tfd->tfd_time.it_value,
                                    &diff, &tfd->tfd_time.it_value);
                                if (callout_stop(&tfd->tfd_callout) == 1) {
                                        callout_schedule_sbt(&tfd->tfd_callout,
                                            tstosbt_sat(tfd->tfd_time.it_value),
                                            0, C_ABSOLUTE);
                                }
                        }
                }

                tfd->tfd_boottim = boottime;
                if ((tfd->tfd_jumped & TFD_JUMPED) != 0)
                        timerfd_wakeup(tfd);
                mtx_unlock(&tfd->tfd_lock);
        }
        mtx_unlock(&timerfd_list_lock);
}

static int
timerfd_read(struct file *fp, struct uio *uio, struct ucred *active_cred,
    int flags, struct thread *td)
{
        struct timerfd *tfd = fp->f_data;
        timerfd_t count;
        int error = 0;

        if (uio->uio_resid < sizeof(timerfd_t))
                return (EINVAL);

        mtx_lock(&tfd->tfd_lock);
retry:
        getnanotime(&tfd->tfd_atim);
        if ((tfd->tfd_jumped & TFD_JUMPED) != 0) {
                if (tfd->tfd_jumped == TFD_CANCELED)
                        error = ECANCELED;
                tfd->tfd_jumped = TFD_READ;
                tfd->tfd_count = 0;
                mtx_unlock(&tfd->tfd_lock);
                return (error);
        } else {
                tfd->tfd_jumped = TFD_NOJUMP;
        }
        if (tfd->tfd_count == 0) {
                if ((fp->f_flag & FNONBLOCK) != 0) {
                        mtx_unlock(&tfd->tfd_lock);
                        return (EAGAIN);
                }
                error = mtx_sleep(&tfd->tfd_count, &tfd->tfd_lock,
                    PCATCH, "tfdrd", 0);
                if (error == 0) {
                        goto retry;
                } else {
                        mtx_unlock(&tfd->tfd_lock);
                        return (error);
                }
        }

        count = tfd->tfd_count;
        tfd->tfd_count = 0;
        mtx_unlock(&tfd->tfd_lock);
        error = uiomove(&count, sizeof(timerfd_t), uio);

        return (error);
}

static int
timerfd_ioctl(struct file *fp, u_long cmd, void *data,
    struct ucred *active_cred, struct thread *td)
{
        switch (cmd) {
        case FIOASYNC:
                if (*(int *)data != 0)
                        atomic_set_int(&fp->f_flag, FASYNC);
                else
                        atomic_clear_int(&fp->f_flag, FASYNC);
                return (0);
        case FIONBIO:
                if (*(int *)data != 0)
                        atomic_set_int(&fp->f_flag, FNONBLOCK);
                else
                        atomic_clear_int(&fp->f_flag, FNONBLOCK);
                return (0);
        }
        return (ENOTTY);
}

static int
timerfd_poll(struct file *fp, int events, struct ucred *active_cred,
    struct thread *td)
{
        struct timerfd *tfd = fp->f_data;
        int revents = 0;

        mtx_lock(&tfd->tfd_lock);
        if ((events & (POLLIN | POLLRDNORM)) != 0 &&
            tfd->tfd_count > 0 && tfd->tfd_jumped != TFD_READ)
                revents |= events & (POLLIN | POLLRDNORM);
        if (revents == 0)
                selrecord(td, &tfd->tfd_sel);
        mtx_unlock(&tfd->tfd_lock);

        return (revents);
}

static void
filt_timerfddetach(struct knote *kn)
{
        struct timerfd *tfd = kn->kn_hook;

        mtx_lock(&tfd->tfd_lock);
        knlist_remove(&tfd->tfd_sel.si_note, kn, 1);
        mtx_unlock(&tfd->tfd_lock);
}

static int
filt_timerfdread(struct knote *kn, long hint)
{
        struct timerfd *tfd = kn->kn_hook;

        mtx_assert(&tfd->tfd_lock, MA_OWNED);
        kn->kn_data = (int64_t)tfd->tfd_count;
        return (tfd->tfd_count > 0 && tfd->tfd_jumped != TFD_READ);
}

static const struct filterops timerfd_rfiltops = {
        .f_isfd = 1,
        .f_detach = filt_timerfddetach,
        .f_event = filt_timerfdread,
};

static int
timerfd_kqfilter(struct file *fp, struct knote *kn)
{
        struct timerfd *tfd = fp->f_data;

        if (kn->kn_filter != EVFILT_READ)
                return (EINVAL);

        kn->kn_fop = &timerfd_rfiltops;
        kn->kn_hook = tfd;
        knlist_add(&tfd->tfd_sel.si_note, kn, 0);

        return (0);
}

static int
timerfd_stat(struct file *fp, struct stat *sb, struct ucred *active_cred)
{
        struct timerfd *tfd = fp->f_data;

        bzero(sb, sizeof(*sb));
        sb->st_nlink = fp->f_count - 1;
        sb->st_uid = fp->f_cred->cr_uid;
        sb->st_gid = fp->f_cred->cr_gid;
        sb->st_blksize = PAGE_SIZE;
        mtx_lock(&tfd->tfd_lock);
        sb->st_atim = tfd->tfd_atim;
        sb->st_mtim = tfd->tfd_mtim;
        mtx_unlock(&tfd->tfd_lock);
        sb->st_ctim = sb->st_mtim;
        sb->st_ino = tfd->tfd_ino;
        sb->st_birthtim = tfd->tfd_birthtim;

        return (0);
}

static int
timerfd_close(struct file *fp, struct thread *td)
{
        struct timerfd *tfd = fp->f_data;

        mtx_lock(&timerfd_list_lock);
        LIST_REMOVE(tfd, entry);
        mtx_unlock(&timerfd_list_lock);

        callout_drain(&tfd->tfd_callout);
        seldrain(&tfd->tfd_sel);
        knlist_destroy(&tfd->tfd_sel.si_note);
        mtx_destroy(&tfd->tfd_lock);
        free(tfd, M_TIMERFD);
        fp->f_ops = &badfileops;

        return (0);
}

static int
timerfd_fill_kinfo(struct file *fp, struct kinfo_file *kif,
    struct filedesc *fdp)
{
        struct timerfd *tfd = fp->f_data;

        kif->kf_type = KF_TYPE_TIMERFD;
        kif->kf_un.kf_timerfd.kf_timerfd_clockid = tfd->tfd_clockid;
        kif->kf_un.kf_timerfd.kf_timerfd_flags = tfd->tfd_flags;
        kif->kf_un.kf_timerfd.kf_timerfd_addr = (uintptr_t)tfd;

        return (0);
}

static const struct fileops timerfdops = {
        .fo_read = timerfd_read,
        .fo_write = invfo_rdwr,
        .fo_truncate = invfo_truncate,
        .fo_ioctl = timerfd_ioctl,
        .fo_poll = timerfd_poll,
        .fo_kqfilter = timerfd_kqfilter,
        .fo_stat = timerfd_stat,
        .fo_close = timerfd_close,
        .fo_chmod = invfo_chmod,
        .fo_chown = invfo_chown,
        .fo_sendfile = invfo_sendfile,
        .fo_fill_kinfo = timerfd_fill_kinfo,
        .fo_cmp = file_kcmp_generic,
        .fo_flags = DFLAG_PASSABLE,
};

static void
timerfd_curval(struct timerfd *tfd, struct itimerspec *old_value)
{
        struct timespec curr_value;

        mtx_assert(&tfd->tfd_lock, MA_OWNED);
        *old_value = tfd->tfd_time;
        if (timespecisset(&tfd->tfd_time.it_value)) {
                nanouptime(&curr_value);
                timespecsub(&tfd->tfd_time.it_value, &curr_value,
                    &old_value->it_value);
        }
}

static void
timerfd_expire(void *arg)
{
        struct timerfd *tfd = (struct timerfd *)arg;
        sbintime_t exp, interval, now, next, diff;

        ++tfd->tfd_count;
        tfd->tfd_expired = true;
        if (timespecisset(&tfd->tfd_time.it_interval)) {
                exp = tstosbt_sat(tfd->tfd_time.it_value);
                interval = tstosbt_sat(tfd->tfd_time.it_interval);
                now = sbinuptime();
                next = now > SBT_MAX - interval ? SBT_MAX : now + interval;

                /* Count missed events. */
                if (now > exp) {
                        diff = now - exp;
                        tfd->tfd_count += diff / interval;
                        next -= diff % interval;
                }

                callout_schedule_sbt(&tfd->tfd_callout, next, 0, C_ABSOLUTE);
                tfd->tfd_time.it_value = sbttots(next);
        } else {
                /* Single shot timer. */
                callout_deactivate(&tfd->tfd_callout);
                timespecclear(&tfd->tfd_time.it_value);
        }

        timerfd_wakeup(tfd);
}

int
kern_timerfd_create(struct thread *td, int clockid, int flags)
{
        struct file *fp;
        struct timerfd *tfd;
        int error, fd, fflags;

        AUDIT_ARG_VALUE(clockid);
        AUDIT_ARG_FFLAGS(flags);

        switch (clockid) {
        case CLOCK_REALTIME:
                /* FALLTHROUGH */
        case CLOCK_MONOTONIC:
                /* FALLTHROUGH */
        case CLOCK_UPTIME:
                /*
                 * CLOCK_BOOTTIME should be added once different from
                 * CLOCK_UPTIME
                 */
                break;
        default:
                return (EINVAL);
        }
        if ((flags & ~(TFD_CLOEXEC | TFD_NONBLOCK)) != 0)
                return (EINVAL);

        fflags = FREAD;
        if ((flags & TFD_CLOEXEC) != 0)
                fflags |= O_CLOEXEC;
        if ((flags & TFD_NONBLOCK) != 0)
                fflags |= FNONBLOCK;

        error = falloc(td, &fp, &fd, fflags);
        if (error != 0)
                return (error);

        tfd = malloc(sizeof(*tfd), M_TIMERFD, M_WAITOK | M_ZERO);
        tfd->tfd_clockid = (clockid_t)clockid;
        tfd->tfd_flags = flags;
        tfd->tfd_ino = alloc_unr64(&tfdino_unr);
        mtx_init(&tfd->tfd_lock, "timerfd", NULL, MTX_DEF);
        callout_init_mtx(&tfd->tfd_callout, &tfd->tfd_lock, 0);
        knlist_init_mtx(&tfd->tfd_sel.si_note, &tfd->tfd_lock);
        timerfd_getboottime(&tfd->tfd_boottim);
        getnanotime(&tfd->tfd_birthtim);
        mtx_lock(&timerfd_list_lock);
        LIST_INSERT_HEAD(&timerfd_list, tfd, entry);
        mtx_unlock(&timerfd_list_lock);

        finit(fp, fflags, DTYPE_TIMERFD, tfd, &timerfdops);

        fdrop(fp, td);

        td->td_retval[0] = fd;
        return (0);
}

int
kern_timerfd_gettime(struct thread *td, int fd, struct itimerspec *curr_value)
{
        struct file *fp;
        struct timerfd *tfd;
        int error;

        error = fget(td, fd, &cap_write_rights, &fp);
        if (error != 0)
                return (error);
        if (fp->f_type != DTYPE_TIMERFD) {
                fdrop(fp, td);
                return (EINVAL);
        }
        tfd = fp->f_data;

        mtx_lock(&tfd->tfd_lock);
        timerfd_curval(tfd, curr_value);
        mtx_unlock(&tfd->tfd_lock);

        fdrop(fp, td);
        return (0);
}

int
kern_timerfd_settime(struct thread *td, int fd, int flags,
    const struct itimerspec *new_value, struct itimerspec *old_value)
{
        struct file *fp;
        struct timerfd *tfd;
        struct timespec ts;
        int error = 0;

        if ((flags & ~(TFD_TIMER_ABSTIME | TFD_TIMER_CANCEL_ON_SET)) != 0)
                return (EINVAL);
        if (!timespecvalid_interval(&new_value->it_value) ||
            !timespecvalid_interval(&new_value->it_interval))
                return (EINVAL);

        error = fget(td, fd, &cap_write_rights, &fp);
        if (error != 0)
                return (error);
        if (fp->f_type != DTYPE_TIMERFD) {
                fdrop(fp, td);
                return (EINVAL);
        }
        tfd = fp->f_data;

        mtx_lock(&tfd->tfd_lock);
        getnanotime(&tfd->tfd_mtim);
        tfd->tfd_timflags = flags;

        /* Store old itimerspec, if applicable. */
        if (old_value != NULL)
                timerfd_curval(tfd, old_value);

        /* Set new expiration. */
        tfd->tfd_time = *new_value;
        if (timespecisset(&tfd->tfd_time.it_value)) {
                if ((flags & TFD_TIMER_ABSTIME) == 0) {
                        nanouptime(&ts);
                        timespecadd(&tfd->tfd_time.it_value, &ts,
                            &tfd->tfd_time.it_value);
                } else if (tfd->tfd_clockid == CLOCK_REALTIME) {
                        /* ECANCELED if unread jump is pending. */
                        if (tfd->tfd_jumped == TFD_CANCELED)
                                error = ECANCELED;
                        /* Convert from CLOCK_REALTIME to CLOCK_BOOTTIME. */
                        timespecsub(&tfd->tfd_time.it_value, &tfd->tfd_boottim,
                            &tfd->tfd_time.it_value);
                }
                callout_reset_sbt(&tfd->tfd_callout,
                    tstosbt_sat(tfd->tfd_time.it_value),
                    0, timerfd_expire, tfd, C_ABSOLUTE);
        } else {
                callout_stop(&tfd->tfd_callout);
        }
        tfd->tfd_count = 0;
        tfd->tfd_expired = false;
        tfd->tfd_jumped = TFD_NOJUMP;
        mtx_unlock(&tfd->tfd_lock);

        fdrop(fp, td);
        return (error);
}

int
sys_timerfd_create(struct thread *td, struct timerfd_create_args *uap)
{
        return (kern_timerfd_create(td, uap->clockid, uap->flags));
}

int
sys_timerfd_gettime(struct thread *td, struct timerfd_gettime_args *uap)
{
        struct itimerspec curr_value;
        int error;

        error = kern_timerfd_gettime(td, uap->fd, &curr_value);
        if (error == 0)
                error = copyout(&curr_value, uap->curr_value,
                    sizeof(curr_value));

        return (error);
}

int
sys_timerfd_settime(struct thread *td, struct timerfd_settime_args *uap)
{
        struct itimerspec new_value, old_value;
        int error;

        error = copyin(uap->new_value, &new_value, sizeof(new_value));
        if (error != 0)
                return (error);
        if (uap->old_value == NULL) {
                error = kern_timerfd_settime(td, uap->fd, uap->flags,
                    &new_value, NULL);
        } else {
                error = kern_timerfd_settime(td, uap->fd, uap->flags,
                    &new_value, &old_value);
                if (error == 0)
                        error = copyout(&old_value, uap->old_value,
                            sizeof(old_value));
        }
        return (error);
}