1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  24  * Use is subject to license terms.
  25  */
  26 
  27 /*
  28  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  29  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
  30  */
  31 
  32 #include <sys/timer.h>
  33 #include <sys/systm.h>
  34 #include <sys/param.h>
  35 #include <sys/kmem.h>
  36 #include <sys/debug.h>
  37 #include <sys/policy.h>
  38 #include <sys/port_impl.h>
  39 #include <sys/port_kernel.h>
  40 #include <sys/contract/process_impl.h>
  41 
  42 static kmem_cache_t *clock_timer_cache;
  43 static clock_backend_t *clock_backend[CLOCK_MAX];
  44 static int timer_port_callback(void *, int *, pid_t, int, void *);
  45 static void timer_close_port(void *, int, pid_t, int);
  46 
  47 #define CLOCK_BACKEND(clk) \
  48         ((clk) < CLOCK_MAX && (clk) >= 0 ? clock_backend[(clk)] : NULL)
  49 
  50 /*
  51  * Tunable to increase the maximum number of POSIX timers per-process.  This
  52  * may _only_ be tuned in /etc/system or by patching the kernel binary; it
  53  * _cannot_ be tuned on a running system.
  54  */
  55 volatile int timer_max = _TIMER_MAX;
  56 
  57 /*
  58  * timer_lock() locks the specified interval timer.  It doesn't look at the
  59  * ITLK_REMOVE bit; it's up to callers to look at this if they need to
  60  * care.  p_lock must be held on entry; it may be dropped and reaquired,
  61  * but timer_lock() will always return with p_lock held.
  62  *
  63  * Note that timer_create() doesn't call timer_lock(); it creates timers
  64  * with the ITLK_LOCKED bit explictly set.
  65  */
  66 static void
  67 timer_lock(proc_t *p, itimer_t *it)
  68 {
  69         ASSERT(MUTEX_HELD(&p->p_lock));
  70 
  71         while (it->it_lock & ITLK_LOCKED) {
  72                 it->it_blockers++;
  73                 cv_wait(&it->it_cv, &p->p_lock);
  74                 it->it_blockers--;
  75         }
  76 
  77         it->it_lock |= ITLK_LOCKED;
  78 }
  79 
  80 /*
  81  * timer_unlock() unlocks the specified interval timer, waking up any
  82  * waiters.  p_lock must be held on entry; it will not be dropped by
  83  * timer_unlock().
  84  */
  85 static void
  86 timer_unlock(proc_t *p, itimer_t *it)
  87 {
  88         ASSERT(MUTEX_HELD(&p->p_lock));
  89         ASSERT(it->it_lock & ITLK_LOCKED);
  90         it->it_lock &= ~ITLK_LOCKED;
  91         cv_signal(&it->it_cv);
  92 }
  93 
  94 /*
  95  * timer_delete_locked() takes a proc pointer, timer ID and locked interval
  96  * timer, and deletes the specified timer.  It must be called with p_lock
  97  * held, and cannot be called on a timer which already has ITLK_REMOVE set;
  98  * the caller must check this.  timer_delete_locked() will set the ITLK_REMOVE
  99  * bit and will iteratively unlock and lock the interval timer until all
 100  * blockers have seen the ITLK_REMOVE and cleared out.  It will then zero
 101  * out the specified entry in the p_itimer array, and call into the clock
 102  * backend to complete the deletion.
 103  *
 104  * This function will always return with p_lock held.
 105  */
 106 static void
 107 timer_delete_locked(proc_t *p, timer_t tid, itimer_t *it)
 108 {
 109         ASSERT(MUTEX_HELD(&p->p_lock));
 110         ASSERT(!(it->it_lock & ITLK_REMOVE));
 111         ASSERT(it->it_lock & ITLK_LOCKED);
 112 
 113         it->it_lock |= ITLK_REMOVE;
 114 
 115         /*
 116          * If there are threads waiting to lock this timer, we'll unlock
 117          * the timer, and block on the cv.  Threads blocking our removal will
 118          * have the opportunity to run; when they see the ITLK_REMOVE flag
 119          * set, they will immediately unlock the timer.
 120          */
 121         while (it->it_blockers) {
 122                 timer_unlock(p, it);
 123                 cv_wait(&it->it_cv, &p->p_lock);
 124                 timer_lock(p, it);
 125         }
 126 
 127         ASSERT(p->p_itimer[tid] == it);
 128         p->p_itimer[tid] = NULL;
 129 
 130         /*
 131          * No one is blocked on this timer, and no one will be (we've set
 132          * p_itimer[tid] to be NULL; no one can find it).  Now we call into
 133          * the clock backend to delete the timer; it is up to the backend to
 134          * guarantee that timer_fire() has completed (and will never again
 135          * be called) for this timer.
 136          */
 137         mutex_exit(&p->p_lock);
 138 
 139         it->it_backend->clk_timer_delete(it);
 140 
 141         if (it->it_portev) {
 142                 mutex_enter(&it->it_mutex);
 143                 if (it->it_portev) {
 144                         port_kevent_t   *pev;
 145                         /* dissociate timer from the event port */
 146                         (void) port_dissociate_ksource(it->it_portfd,
 147                             PORT_SOURCE_TIMER, (port_source_t *)it->it_portsrc);
 148                         pev = (port_kevent_t *)it->it_portev;
 149                         it->it_portev = NULL;
 150                         it->it_flags &= ~IT_PORT;
 151                         it->it_pending = 0;
 152                         mutex_exit(&it->it_mutex);
 153                         (void) port_remove_done_event(pev);
 154                         port_free_event(pev);
 155                 } else {
 156                         mutex_exit(&it->it_mutex);
 157                 }
 158         }
 159 
 160         mutex_enter(&p->p_lock);
 161 
 162         /*
 163          * We need to be careful freeing the sigqueue for this timer;
 164          * if a signal is pending, the sigqueue needs to be freed
 165          * synchronously in siginfofree().  The need to free the sigqueue
 166          * in siginfofree() is indicated by setting sq_func to NULL.
 167          */
 168         if (it->it_pending > 0) {
 169                 it->it_sigq->sq_func = NULL;
 170         } else {
 171                 kmem_free(it->it_sigq, sizeof (sigqueue_t));
 172         }
 173 
 174         ASSERT(it->it_blockers == 0);
 175         kmem_cache_free(clock_timer_cache, it);
 176 }
 177 
 178 /*
 179  * timer_grab() and its companion routine, timer_release(), are wrappers
 180  * around timer_lock()/_unlock() which allow the timer_*(3R) routines to
 181  * (a) share error handling code and (b) not grab p_lock themselves.  Routines
 182  * which are called with p_lock held (e.g. timer_lwpbind(), timer_lwpexit())
 183  * must call timer_lock()/_unlock() explictly.
 184  *
 185  * timer_grab() takes a proc and a timer ID, and returns a pointer to a
 186  * locked interval timer.  p_lock must _not_ be held on entry; timer_grab()
 187  * may acquire p_lock, but will always return with p_lock dropped.
 188  *
 189  * If timer_grab() fails, it will return NULL.  timer_grab() will fail if
 190  * one or more of the following is true:
 191  *
 192  *  (a) The specified timer ID is out of range.
 193  *
 194  *  (b) The specified timer ID does not correspond to a timer ID returned
 195  *      from timer_create(3R).
 196  *
 197  *  (c) The specified timer ID is currently being removed.
 198  *
 199  */
 200 static itimer_t *
 201 timer_grab(proc_t *p, timer_t tid)
 202 {
 203         itimer_t **itp, *it;
 204 
 205         if (tid >= timer_max || tid < 0)
 206                 return (NULL);
 207 
 208         mutex_enter(&p->p_lock);
 209 
 210         if ((itp = p->p_itimer) == NULL || (it = itp[tid]) == NULL) {
 211                 mutex_exit(&p->p_lock);
 212                 return (NULL);
 213         }
 214 
 215         timer_lock(p, it);
 216 
 217         if (it->it_lock & ITLK_REMOVE) {
 218                 /*
 219                  * Someone is removing this timer; it will soon be invalid.
 220                  */
 221                 timer_unlock(p, it);
 222                 mutex_exit(&p->p_lock);
 223                 return (NULL);
 224         }
 225 
 226         mutex_exit(&p->p_lock);
 227 
 228         return (it);
 229 }
 230 
 231 /*
 232  * timer_release() releases a timer acquired with timer_grab().  p_lock
 233  * should not be held on entry; timer_release() will acquire p_lock but
 234  * will drop it before returning.
 235  */
 236 static void
 237 timer_release(proc_t *p, itimer_t *it)
 238 {
 239         mutex_enter(&p->p_lock);
 240         timer_unlock(p, it);
 241         mutex_exit(&p->p_lock);
 242 }
 243 
 244 /*
 245  * timer_delete_grabbed() deletes a timer acquired with timer_grab().
 246  * p_lock should not be held on entry; timer_delete_grabbed() will acquire
 247  * p_lock, but will drop it before returning.
 248  */
 249 static void
 250 timer_delete_grabbed(proc_t *p, timer_t tid, itimer_t *it)
 251 {
 252         mutex_enter(&p->p_lock);
 253         timer_delete_locked(p, tid, it);
 254         mutex_exit(&p->p_lock);
 255 }
 256 
 257 void
 258 clock_timer_init()
 259 {
 260         clock_timer_cache = kmem_cache_create("timer_cache",
 261             sizeof (itimer_t), 0, NULL, NULL, NULL, NULL, NULL, 0);
 262 }
 263 
 264 void
 265 clock_add_backend(clockid_t clock, clock_backend_t *backend)
 266 {
 267         ASSERT(clock >= 0 && clock < CLOCK_MAX);
 268         ASSERT(clock_backend[clock] == NULL);
 269 
 270         clock_backend[clock] = backend;
 271 }
 272 
 273 clock_backend_t *
 274 clock_get_backend(clockid_t clock)
 275 {
 276         if (clock < 0 || clock >= CLOCK_MAX)
 277                 return (NULL);
 278 
 279         return (clock_backend[clock]);
 280 }
 281 
 282 int
 283 clock_settime(clockid_t clock, timespec_t *tp)
 284 {
 285         timespec_t t;
 286         clock_backend_t *backend;
 287         int error;
 288 
 289         if ((backend = CLOCK_BACKEND(clock)) == NULL)
 290                 return (set_errno(EINVAL));
 291 
 292         if (secpolicy_settime(CRED()) != 0)
 293                 return (set_errno(EPERM));
 294 
 295         if (get_udatamodel() == DATAMODEL_NATIVE) {
 296                 if (copyin(tp, &t, sizeof (timespec_t)) != 0)
 297                         return (set_errno(EFAULT));
 298         } else {
 299                 timespec32_t t32;
 300 
 301                 if (copyin(tp, &t32, sizeof (timespec32_t)) != 0)
 302                         return (set_errno(EFAULT));
 303 
 304                 TIMESPEC32_TO_TIMESPEC(&t, &t32);
 305         }
 306 
 307         if (itimerspecfix(&t))
 308                 return (set_errno(EINVAL));
 309 
 310         error = backend->clk_clock_settime(&t);
 311 
 312         if (error)
 313                 return (set_errno(error));
 314 
 315         return (0);
 316 }
 317 
 318 int
 319 clock_gettime(clockid_t clock, timespec_t *tp)
 320 {
 321         timespec_t t;
 322         clock_backend_t *backend;
 323         int error;
 324 
 325         if ((backend = CLOCK_BACKEND(clock)) == NULL)
 326                 return (set_errno(EINVAL));
 327 
 328         error = backend->clk_clock_gettime(&t);
 329 
 330         if (error)
 331                 return (set_errno(error));
 332 
 333         if (get_udatamodel() == DATAMODEL_NATIVE) {
 334                 if (copyout(&t, tp, sizeof (timespec_t)) != 0)
 335                         return (set_errno(EFAULT));
 336         } else {
 337                 timespec32_t t32;
 338 
 339                 if (TIMESPEC_OVERFLOW(&t))
 340                         return (set_errno(EOVERFLOW));
 341                 TIMESPEC_TO_TIMESPEC32(&t32, &t);
 342 
 343                 if (copyout(&t32, tp, sizeof (timespec32_t)) != 0)
 344                         return (set_errno(EFAULT));
 345         }
 346 
 347         return (0);
 348 }
 349 
 350 int
 351 clock_getres(clockid_t clock, timespec_t *tp)
 352 {
 353         timespec_t t;
 354         clock_backend_t *backend;
 355         int error;
 356 
 357         /*
 358          * Strangely, the standard defines clock_getres() with a NULL tp
 359          * to do nothing (regardless of the validity of the specified
 360          * clock_id).  Go figure.
 361          */
 362         if (tp == NULL)
 363                 return (0);
 364 
 365         if ((backend = CLOCK_BACKEND(clock)) == NULL)
 366                 return (set_errno(EINVAL));
 367 
 368         error = backend->clk_clock_getres(&t);
 369 
 370         if (error)
 371                 return (set_errno(error));
 372 
 373         if (get_udatamodel() == DATAMODEL_NATIVE) {
 374                 if (copyout(&t, tp, sizeof (timespec_t)) != 0)
 375                         return (set_errno(EFAULT));
 376         } else {
 377                 timespec32_t t32;
 378 
 379                 if (TIMESPEC_OVERFLOW(&t))
 380                         return (set_errno(EOVERFLOW));
 381                 TIMESPEC_TO_TIMESPEC32(&t32, &t);
 382 
 383                 if (copyout(&t32, tp, sizeof (timespec32_t)) != 0)
 384                         return (set_errno(EFAULT));
 385         }
 386 
 387         return (0);
 388 }
 389 
 390 void
 391 timer_signal(sigqueue_t *sigq)
 392 {
 393         itimer_t *it = (itimer_t *)sigq->sq_backptr;
 394 
 395         /*
 396          * There are some conditions during a fork or an exit when we can
 397          * call siginfofree() without p_lock held.  To prevent a race
 398          * between timer_signal() and timer_fire() with regard to it_pending,
 399          * we therefore acquire it_mutex in both paths.
 400          */
 401         mutex_enter(&it->it_mutex);
 402         ASSERT(it->it_pending > 0);
 403         it->it_overrun = it->it_pending - 1;
 404         it->it_pending = 0;
 405         mutex_exit(&it->it_mutex);
 406 }
 407 
 408 /*
 409  * This routine is called from the clock backend.
 410  */
 411 static void
 412 timer_fire(itimer_t *it)
 413 {
 414         proc_t *p;
 415         int proc_lock_held;
 416 
 417         if (it->it_flags & IT_SIGNAL) {
 418                 /*
 419                  * See the comment in timer_signal() for why it is not
 420                  * sufficient to only grab p_lock here. Because p_lock can be
 421                  * held on entry to timer_signal(), the lock ordering is
 422                  * necessarily p_lock before it_mutex.
 423                  */
 424 
 425                 p = it->it_proc;
 426                 proc_lock_held = 1;
 427                 mutex_enter(&p->p_lock);
 428         } else {
 429                 /*
 430                  * IT_PORT:
 431                  * If a timer was ever programmed to send events to a port,
 432                  * the IT_PORT flag will remain set until:
 433                  * a) the timer is deleted (see timer_delete_locked()) or
 434                  * b) the port is being closed (see timer_close_port()).
 435                  * Both cases are synchronized with the it_mutex.
 436                  * We don't need to use the p_lock because it is only
 437                  * required in the IT_SIGNAL case.
 438                  * If IT_PORT was set and the port is being closed then
 439                  * the timer notification is set to NONE. In such a case
 440                  * the timer itself and the it_pending counter remain active
 441                  * until the application deletes the counter or the process
 442                  * exits.
 443                  */
 444                 proc_lock_held = 0;
 445         }
 446         mutex_enter(&it->it_mutex);
 447 
 448         if (it->it_pending > 0) {
 449                 if (it->it_pending < INT_MAX)
 450                         it->it_pending++;
 451                 mutex_exit(&it->it_mutex);
 452         } else {
 453                 if (it->it_flags & IT_PORT) {
 454                         it->it_pending = 1;
 455                         port_send_event((port_kevent_t *)it->it_portev);
 456                         mutex_exit(&it->it_mutex);
 457                 } else if (it->it_flags & IT_SIGNAL) {
 458                         it->it_pending = 1;
 459                         mutex_exit(&it->it_mutex);
 460                         sigaddqa(p, NULL, it->it_sigq);
 461                 } else {
 462                         mutex_exit(&it->it_mutex);
 463                 }
 464         }
 465 
 466         if (proc_lock_held)
 467                 mutex_exit(&p->p_lock);
 468 }
 469 
 470 int
 471 timer_create(clockid_t clock, struct sigevent *evp, timer_t *tid)
 472 {
 473         struct sigevent ev;
 474         proc_t *p = curproc;
 475         clock_backend_t *backend;
 476         itimer_t *it, **itp;
 477         sigqueue_t *sigq;
 478         cred_t *cr = CRED();
 479         int error = 0;
 480         timer_t i;
 481         port_notify_t tim_pnevp;
 482         port_kevent_t *pkevp = NULL;
 483 
 484         if ((backend = CLOCK_BACKEND(clock)) == NULL)
 485                 return (set_errno(EINVAL));
 486 
 487         if (evp != NULL) {
 488                 /*
 489                  * short copyin() for binary compatibility
 490                  * fetch oldsigevent to determine how much to copy in.
 491                  */
 492                 if (get_udatamodel() == DATAMODEL_NATIVE) {
 493                         if (copyin(evp, &ev, sizeof (struct oldsigevent)))
 494                                 return (set_errno(EFAULT));
 495 
 496                         if (ev.sigev_notify == SIGEV_PORT ||
 497                             ev.sigev_notify == SIGEV_THREAD) {
 498                                 if (copyin(ev.sigev_value.sival_ptr, &tim_pnevp,
 499                                     sizeof (port_notify_t)))
 500                                         return (set_errno(EFAULT));
 501                         }
 502 #ifdef  _SYSCALL32_IMPL
 503                 } else {
 504                         struct sigevent32 ev32;
 505                         port_notify32_t tim_pnevp32;
 506 
 507                         if (copyin(evp, &ev32, sizeof (struct oldsigevent32)))
 508                                 return (set_errno(EFAULT));
 509                         ev.sigev_notify = ev32.sigev_notify;
 510                         ev.sigev_signo = ev32.sigev_signo;
 511                         /*
 512                          * See comment in sigqueue32() on handling of 32-bit
 513                          * sigvals in a 64-bit kernel.
 514                          */
 515                         ev.sigev_value.sival_int = ev32.sigev_value.sival_int;
 516                         if (ev.sigev_notify == SIGEV_PORT ||
 517                             ev.sigev_notify == SIGEV_THREAD) {
 518                                 if (copyin((void *)(uintptr_t)
 519                                     ev32.sigev_value.sival_ptr,
 520                                     (void *)&tim_pnevp32,
 521                                     sizeof (port_notify32_t)))
 522                                         return (set_errno(EFAULT));
 523                                 tim_pnevp.portnfy_port =
 524                                     tim_pnevp32.portnfy_port;
 525                                 tim_pnevp.portnfy_user =
 526                                     (void *)(uintptr_t)tim_pnevp32.portnfy_user;
 527                         }
 528 #endif
 529                 }
 530                 switch (ev.sigev_notify) {
 531                 case SIGEV_NONE:
 532                         break;
 533                 case SIGEV_SIGNAL:
 534                         if (ev.sigev_signo < 1 || ev.sigev_signo >= NSIG)
 535                                 return (set_errno(EINVAL));
 536                         break;
 537                 case SIGEV_THREAD:
 538                 case SIGEV_PORT:
 539                         break;
 540                 default:
 541                         return (set_errno(EINVAL));
 542                 }
 543         } else {
 544                 /*
 545                  * Use the clock's default sigevent (this is a structure copy).
 546                  */
 547                 ev = backend->clk_default;
 548         }
 549 
 550         /*
 551          * We'll allocate our timer and sigqueue now, before we grab p_lock.
 552          * If we can't find an empty slot, we'll free them before returning.
 553          */
 554         it = kmem_cache_alloc(clock_timer_cache, KM_SLEEP);
 555         bzero(it, sizeof (itimer_t));
 556         mutex_init(&it->it_mutex, NULL, MUTEX_DEFAULT, NULL);
 557         sigq = kmem_zalloc(sizeof (sigqueue_t), KM_SLEEP);
 558 
 559         mutex_enter(&p->p_lock);
 560 
 561         /*
 562          * If this is this process' first timer, we need to attempt to allocate
 563          * an array of timerstr_t pointers.  We drop p_lock to perform the
 564          * allocation; if we return to discover that p_itimer is non-NULL,
 565          * we will free our allocation and drive on.
 566          */
 567         if ((itp = p->p_itimer) == NULL) {
 568                 mutex_exit(&p->p_lock);
 569                 itp = kmem_zalloc(timer_max * sizeof (itimer_t *), KM_SLEEP);
 570                 mutex_enter(&p->p_lock);
 571 
 572                 if (p->p_itimer == NULL)
 573                         p->p_itimer = itp;
 574                 else {
 575                         kmem_free(itp, timer_max * sizeof (itimer_t *));
 576                         itp = p->p_itimer;
 577                 }
 578         }
 579 
 580         for (i = 0; i < timer_max && itp[i] != NULL; i++)
 581                 continue;
 582 
 583         if (i == timer_max) {
 584                 /*
 585                  * We couldn't find a slot.  Drop p_lock, free the preallocated
 586                  * timer and sigqueue, and return an error.
 587                  */
 588                 mutex_exit(&p->p_lock);
 589                 kmem_cache_free(clock_timer_cache, it);
 590                 kmem_free(sigq, sizeof (sigqueue_t));
 591 
 592                 return (set_errno(EAGAIN));
 593         }
 594 
 595         ASSERT(i < timer_max && itp[i] == NULL);
 596 
 597         /*
 598          * If we develop other notification mechanisms, this will need
 599          * to call into (yet another) backend.
 600          */
 601         sigq->sq_info.si_signo = ev.sigev_signo;
 602         if (evp == NULL)
 603                 sigq->sq_info.si_value.sival_int = i;
 604         else
 605                 sigq->sq_info.si_value = ev.sigev_value;
 606         sigq->sq_info.si_code = SI_TIMER;
 607         sigq->sq_info.si_pid = p->p_pid;
 608         sigq->sq_info.si_ctid = PRCTID(p);
 609         sigq->sq_info.si_zoneid = getzoneid();
 610         sigq->sq_info.si_uid = crgetruid(cr);
 611         sigq->sq_func = timer_signal;
 612         sigq->sq_next = NULL;
 613         sigq->sq_backptr = it;
 614         it->it_sigq = sigq;
 615         it->it_backend = backend;
 616         it->it_lock = ITLK_LOCKED;
 617         itp[i] = it;
 618 
 619 
 620         if (ev.sigev_notify == SIGEV_THREAD ||
 621             ev.sigev_notify == SIGEV_PORT) {
 622                 int port;
 623 
 624                 /*
 625                  * This timer is programmed to use event port notification when
 626                  * the timer fires:
 627                  * - allocate a port event structure and prepare it to be sent
 628                  *   to the port as soon as the timer fires.
 629                  * - when the timer fires :
 630                  *   - if event structure was already sent to the port then this
 631                  *      is a timer fire overflow => increment overflow counter.
 632                  *   - otherwise send pre-allocated event structure to the port.
 633                  * - the events field of the port_event_t structure counts the
 634                  *   number of timer fired events.
 635                  * - The event structured is allocated using the
 636                  *   PORT_ALLOC_CACHED flag.
 637                  *   This flag indicates that the timer itself will manage and
 638                  *   free the event structure when required.
 639                  */
 640 
 641                 it->it_flags |= IT_PORT;
 642                 port = tim_pnevp.portnfy_port;
 643 
 644                 /* associate timer as event source with the port */
 645                 error = port_associate_ksource(port, PORT_SOURCE_TIMER,
 646                     (port_source_t **)&it->it_portsrc, timer_close_port,
 647                     (void *)it, NULL);
 648                 if (error) {
 649                         itp[i] = NULL;          /* clear slot */
 650                         mutex_exit(&p->p_lock);
 651                         kmem_cache_free(clock_timer_cache, it);
 652                         kmem_free(sigq, sizeof (sigqueue_t));
 653                         return (set_errno(error));
 654                 }
 655 
 656                 /* allocate an event structure/slot */
 657                 error = port_alloc_event(port, PORT_ALLOC_SCACHED,
 658                     PORT_SOURCE_TIMER, &pkevp);
 659                 if (error) {
 660                         (void) port_dissociate_ksource(port, PORT_SOURCE_TIMER,
 661                             (port_source_t *)it->it_portsrc);
 662                         itp[i] = NULL;          /* clear slot */
 663                         mutex_exit(&p->p_lock);
 664                         kmem_cache_free(clock_timer_cache, it);
 665                         kmem_free(sigq, sizeof (sigqueue_t));
 666                         return (set_errno(error));
 667                 }
 668 
 669                 /* initialize event data */
 670                 port_init_event(pkevp, i, tim_pnevp.portnfy_user,
 671                     timer_port_callback, it);
 672                 it->it_portev = pkevp;
 673                 it->it_portfd = port;
 674         } else {
 675                 if (ev.sigev_notify == SIGEV_SIGNAL)
 676                         it->it_flags |= IT_SIGNAL;
 677         }
 678 
 679         mutex_exit(&p->p_lock);
 680 
 681         /*
 682          * Call on the backend to verify the event argument (or return
 683          * EINVAL if this clock type does not support timers).
 684          */
 685         if ((error = backend->clk_timer_create(it, timer_fire)) != 0)
 686                 goto err;
 687 
 688         it->it_lwp = ttolwp(curthread);
 689         it->it_proc = p;
 690 
 691         if (copyout(&i, tid, sizeof (timer_t)) != 0) {
 692                 error = EFAULT;
 693                 goto err;
 694         }
 695 
 696         /*
 697          * If we're here, then we have successfully created the timer; we
 698          * just need to release the timer and return.
 699          */
 700         timer_release(p, it);
 701 
 702         return (0);
 703 
 704 err:
 705         /*
 706          * If we're here, an error has occurred late in the timer creation
 707          * process.  We need to regrab p_lock, and delete the incipient timer.
 708          * Since we never unlocked the timer (it was born locked), it's
 709          * impossible for a removal to be pending.
 710          */
 711         ASSERT(!(it->it_lock & ITLK_REMOVE));
 712         timer_delete_grabbed(p, i, it);
 713 
 714         return (set_errno(error));
 715 }
 716 
 717 int
 718 timer_gettime(timer_t tid, itimerspec_t *val)
 719 {
 720         proc_t *p = curproc;
 721         itimer_t *it;
 722         itimerspec_t when;
 723         int error;
 724 
 725         if ((it = timer_grab(p, tid)) == NULL)
 726                 return (set_errno(EINVAL));
 727 
 728         error = it->it_backend->clk_timer_gettime(it, &when);
 729 
 730         timer_release(p, it);
 731 
 732         if (error == 0) {
 733                 if (get_udatamodel() == DATAMODEL_NATIVE) {
 734                         if (copyout(&when, val, sizeof (itimerspec_t)))
 735                                 error = EFAULT;
 736                 } else {
 737                         if (ITIMERSPEC_OVERFLOW(&when))
 738                                 error = EOVERFLOW;
 739                         else {
 740                                 itimerspec32_t w32;
 741 
 742                                 ITIMERSPEC_TO_ITIMERSPEC32(&w32, &when)
 743                                 if (copyout(&w32, val, sizeof (itimerspec32_t)))
 744                                         error = EFAULT;
 745                         }
 746                 }
 747         }
 748 
 749         return (error ? set_errno(error) : 0);
 750 }
 751 
 752 int
 753 timer_settime(timer_t tid, int flags, itimerspec_t *val, itimerspec_t *oval)
 754 {
 755         itimerspec_t when;
 756         itimer_t *it;
 757         proc_t *p = curproc;
 758         int error;
 759 
 760         if (oval != NULL) {
 761                 if ((error = timer_gettime(tid, oval)) != 0)
 762                         return (error);
 763         }
 764 
 765         if (get_udatamodel() == DATAMODEL_NATIVE) {
 766                 if (copyin(val, &when, sizeof (itimerspec_t)))
 767                         return (set_errno(EFAULT));
 768         } else {
 769                 itimerspec32_t w32;
 770 
 771                 if (copyin(val, &w32, sizeof (itimerspec32_t)))
 772                         return (set_errno(EFAULT));
 773 
 774                 ITIMERSPEC32_TO_ITIMERSPEC(&when, &w32);
 775         }
 776 
 777         if (itimerspecfix(&when.it_value) ||
 778             (itimerspecfix(&when.it_interval) &&
 779             timerspecisset(&when.it_value))) {
 780                 return (set_errno(EINVAL));
 781         }
 782 
 783         if ((it = timer_grab(p, tid)) == NULL)
 784                 return (set_errno(EINVAL));
 785 
 786         error = it->it_backend->clk_timer_settime(it, flags, &when);
 787 
 788         timer_release(p, it);
 789 
 790         return (error ? set_errno(error) : 0);
 791 }
 792 
 793 int
 794 timer_delete(timer_t tid)
 795 {
 796         proc_t *p = curproc;
 797         itimer_t *it;
 798 
 799         if ((it = timer_grab(p, tid)) == NULL)
 800                 return (set_errno(EINVAL));
 801 
 802         timer_delete_grabbed(p, tid, it);
 803 
 804         return (0);
 805 }
 806 
 807 int
 808 timer_getoverrun(timer_t tid)
 809 {
 810         int overrun;
 811         proc_t *p = curproc;
 812         itimer_t *it;
 813 
 814         if ((it = timer_grab(p, tid)) == NULL)
 815                 return (set_errno(EINVAL));
 816 
 817         /*
 818          * The it_overrun field is protected by p_lock; we need to acquire
 819          * it before looking at the value.
 820          */
 821         mutex_enter(&p->p_lock);
 822         overrun = it->it_overrun;
 823         mutex_exit(&p->p_lock);
 824 
 825         timer_release(p, it);
 826 
 827         return (overrun);
 828 }
 829 
 830 /*
 831  * Entered/exited with p_lock held, but will repeatedly drop and regrab p_lock.
 832  */
 833 void
 834 timer_lwpexit(void)
 835 {
 836         timer_t i;
 837         proc_t *p = curproc;
 838         klwp_t *lwp = ttolwp(curthread);
 839         itimer_t *it, **itp;
 840 
 841         ASSERT(MUTEX_HELD(&p->p_lock));
 842 
 843         if ((itp = p->p_itimer) == NULL)
 844                 return;
 845 
 846         for (i = 0; i < timer_max; i++) {
 847                 if ((it = itp[i]) == NULL)
 848                         continue;
 849 
 850                 timer_lock(p, it);
 851 
 852                 if ((it->it_lock & ITLK_REMOVE) || it->it_lwp != lwp) {
 853                         /*
 854                          * This timer is either being removed or it isn't
 855                          * associated with this lwp.
 856                          */
 857                         timer_unlock(p, it);
 858                         continue;
 859                 }
 860 
 861                 /*
 862                  * The LWP that created this timer is going away.  To the user,
 863                  * our behavior here is explicitly undefined.  We will simply
 864                  * null out the it_lwp field; if the LWP was bound to a CPU,
 865                  * the cyclic will stay bound to that CPU until the process
 866                  * exits.
 867                  */
 868                 it->it_lwp = NULL;
 869                 timer_unlock(p, it);
 870         }
 871 }
 872 
 873 /*
 874  * Called to notify of an LWP binding change.  Entered/exited with p_lock
 875  * held, but will repeatedly drop and regrab p_lock.
 876  */
 877 void
 878 timer_lwpbind()
 879 {
 880         timer_t i;
 881         proc_t *p = curproc;
 882         klwp_t *lwp = ttolwp(curthread);
 883         itimer_t *it, **itp;
 884 
 885         ASSERT(MUTEX_HELD(&p->p_lock));
 886 
 887         if ((itp = p->p_itimer) == NULL)
 888                 return;
 889 
 890         for (i = 0; i < timer_max; i++) {
 891                 if ((it = itp[i]) == NULL)
 892                         continue;
 893 
 894                 timer_lock(p, it);
 895 
 896                 if (!(it->it_lock & ITLK_REMOVE) && it->it_lwp == lwp) {
 897                         /*
 898                          * Drop p_lock and jump into the backend.
 899                          */
 900                         mutex_exit(&p->p_lock);
 901                         it->it_backend->clk_timer_lwpbind(it);
 902                         mutex_enter(&p->p_lock);
 903                 }
 904 
 905                 timer_unlock(p, it);
 906         }
 907 }
 908 
 909 /*
 910  * This function should only be called if p_itimer is non-NULL.
 911  */
 912 void
 913 timer_exit(void)
 914 {
 915         timer_t i;
 916         proc_t *p = curproc;
 917 
 918         ASSERT(p->p_itimer != NULL);
 919 
 920         for (i = 0; i < timer_max; i++)
 921                 (void) timer_delete(i);
 922 
 923         kmem_free(p->p_itimer, timer_max * sizeof (itimer_t *));
 924         p->p_itimer = NULL;
 925 }
 926 
 927 /*
 928  * timer_port_callback() is a callback function which is associated with the
 929  * timer event and is activated just before the event is delivered to the user.
 930  * The timer uses this function to update/set the overflow counter and
 931  * to reenable the use of the event structure.
 932  */
 933 
 934 /* ARGSUSED */
 935 static int
 936 timer_port_callback(void *arg, int *events, pid_t pid, int flag, void *evp)
 937 {
 938         itimer_t        *it = arg;
 939 
 940         mutex_enter(&it->it_mutex);
 941         if (curproc != it->it_proc) {
 942                 /* can not deliver timer events to another proc */
 943                 mutex_exit(&it->it_mutex);
 944                 return (EACCES);
 945         }
 946         *events = it->it_pending;    /* 1 = 1 event, >1 # of overflows */
 947         it->it_pending = 0;          /* reinit overflow counter      */
 948         /*
 949          * This function can also be activated when the port is being closed
 950          * and a timer event is already submitted to the port.
 951          * In such a case the event port framework will use the
 952          * close-callback function to notify the events sources.
 953          * The timer close-callback function is timer_close_port() which
 954          * will free all allocated resources (including the allocated
 955          * port event structure).
 956          * For that reason we don't need to check the value of flag here.
 957          */
 958         mutex_exit(&it->it_mutex);
 959         return (0);
 960 }
 961 
 962 /*
 963  * port is being closed ... free all allocated port event structures
 964  * The delivered arg currently correspond to the first timer associated with
 965  * the port and it is not useable in this case.
 966  * We have to scan the list of activated timers in the current proc and
 967  * compare them with the delivered port id.
 968  */
 969 
 970 /* ARGSUSED */
 971 static void
 972 timer_close_port(void *arg, int port, pid_t pid, int lastclose)
 973 {
 974         proc_t          *p = curproc;
 975         timer_t         tid;
 976         itimer_t        *it;
 977 
 978         for (tid = 0; tid < timer_max; tid++) {
 979                 if ((it = timer_grab(p, tid)) == NULL)
 980                         continue;
 981                 if (it->it_portev) {
 982                         mutex_enter(&it->it_mutex);
 983                         if (it->it_portfd == port) {
 984                                 port_kevent_t *pev;
 985                                 pev = (port_kevent_t *)it->it_portev;
 986                                 it->it_portev = NULL;
 987                                 it->it_flags &= ~IT_PORT;
 988                                 mutex_exit(&it->it_mutex);
 989                                 (void) port_remove_done_event(pev);
 990                                 port_free_event(pev);
 991                         } else {
 992                                 mutex_exit(&it->it_mutex);
 993                         }
 994                 }
 995                 timer_release(p, it);
 996         }
 997 }