1 /* $NetBSD: kern_ntptime.c,v 1.44 2007/10/19 12:16:43 ad Exp $ */ 2 #include <sys/types.h> /* XXX to get __HAVE_TIMECOUNTER, remove 3 after all ports are converted. */ 4 #ifdef __HAVE_TIMECOUNTER 5 6 /*- 7 *********************************************************************** 8 * * 9 * Copyright (c) David L. Mills 1993-2001 * 10 * * 11 * Permission to use, copy, modify, and distribute this software and * 12 * its documentation for any purpose and without fee is hereby * 13 * granted, provided that the above copyright notice appears in all * 14 * copies and that both the copyright notice and this permission * 15 * notice appear in supporting documentation, and that the name * 16 * University of Delaware not be used in advertising or publicity * 17 * pertaining to distribution of the software without specific, * 18 * written prior permission. The University of Delaware makes no * 19 * representations about the suitability this software for any * 20 * purpose. It is provided "as is" without express or implied * 21 * warranty. * 22 * * 23 **********************************************************************/ 24 25 /* 26 * Adapted from the original sources for FreeBSD and timecounters by: 27 * Poul-Henning Kamp <phk@FreeBSD.org>. 28 * 29 * The 32bit version of the "LP" macros seems a bit past its "sell by" 30 * date so I have retained only the 64bit version and included it directly 31 * in this file. 32 * 33 * Only minor changes done to interface with the timecounters over in 34 * sys/kern/kern_clock.c. Some of the comments below may be (even more) 35 * confusing and/or plain wrong in that context. 36 */ 37 38 #include <sys/cdefs.h> 39 /* __FBSDID("$FreeBSD: src/sys/kern/kern_ntptime.c,v 1.59 2005/05/28 14:34:41 rwatson Exp $"); */ 40 __KERNEL_RCSID(0, "$NetBSD: kern_ntptime.c,v 1.44 2007/10/19 12:16:43 ad Exp $"); 41 42 #include "opt_ntp.h" 43 #include "opt_compat_netbsd.h" 44 45 #include <sys/param.h> 46 #include <sys/resourcevar.h> 47 #include <sys/systm.h> 48 #include <sys/kernel.h> 49 #include <sys/proc.h> 50 #include <sys/sysctl.h> 51 #include <sys/timex.h> 52 #ifdef COMPAT_30 53 #include <compat/sys/timex.h> 54 #endif 55 #include <sys/vnode.h> 56 #include <sys/kauth.h> 57 58 #include <sys/mount.h> 59 #include <sys/syscallargs.h> 60 61 #include <sys/cpu.h> 62 63 /* 64 * Single-precision macros for 64-bit machines 65 */ 66 typedef int64_t l_fp; 67 #define L_ADD(v, u) ((v) += (u)) 68 #define L_SUB(v, u) ((v) -= (u)) 69 #define L_ADDHI(v, a) ((v) += (int64_t)(a) << 32) 70 #define L_NEG(v) ((v) = -(v)) 71 #define L_RSHIFT(v, n) \ 72 do { \ 73 if ((v) < 0) \ 74 (v) = -(-(v) >> (n)); \ 75 else \ 76 (v) = (v) >> (n); \ 77 } while (0) 78 #define L_MPY(v, a) ((v) *= (a)) 79 #define L_CLR(v) ((v) = 0) 80 #define L_ISNEG(v) ((v) < 0) 81 #define L_LINT(v, a) ((v) = (int64_t)(a) << 32) 82 #define L_GINT(v) ((v) < 0 ? -(-(v) >> 32) : (v) >> 32) 83 84 #ifdef NTP 85 /* 86 * Generic NTP kernel interface 87 * 88 * These routines constitute the Network Time Protocol (NTP) interfaces 89 * for user and daemon application programs. The ntp_gettime() routine 90 * provides the time, maximum error (synch distance) and estimated error 91 * (dispersion) to client user application programs. The ntp_adjtime() 92 * routine is used by the NTP daemon to adjust the system clock to an 93 * externally derived time. The time offset and related variables set by 94 * this routine are used by other routines in this module to adjust the 95 * phase and frequency of the clock discipline loop which controls the 96 * system clock. 97 * 98 * When the kernel time is reckoned directly in nanoseconds (NTP_NANO 99 * defined), the time at each tick interrupt is derived directly from 100 * the kernel time variable. When the kernel time is reckoned in 101 * microseconds, (NTP_NANO undefined), the time is derived from the 102 * kernel time variable together with a variable representing the 103 * leftover nanoseconds at the last tick interrupt. In either case, the 104 * current nanosecond time is reckoned from these values plus an 105 * interpolated value derived by the clock routines in another 106 * architecture-specific module. The interpolation can use either a 107 * dedicated counter or a processor cycle counter (PCC) implemented in 108 * some architectures. 109 * 110 * Note that all routines must run at priority splclock or higher. 111 */ 112 /* 113 * Phase/frequency-lock loop (PLL/FLL) definitions 114 * 115 * The nanosecond clock discipline uses two variable types, time 116 * variables and frequency variables. Both types are represented as 64- 117 * bit fixed-point quantities with the decimal point between two 32-bit 118 * halves. On a 32-bit machine, each half is represented as a single 119 * word and mathematical operations are done using multiple-precision 120 * arithmetic. On a 64-bit machine, ordinary computer arithmetic is 121 * used. 122 * 123 * A time variable is a signed 64-bit fixed-point number in ns and 124 * fraction. It represents the remaining time offset to be amortized 125 * over succeeding tick interrupts. The maximum time offset is about 126 * 0.5 s and the resolution is about 2.3e-10 ns. 127 * 128 * 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 129 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 130 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 131 * |s s s| ns | 132 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 133 * | fraction | 134 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 135 * 136 * A frequency variable is a signed 64-bit fixed-point number in ns/s 137 * and fraction. It represents the ns and fraction to be added to the 138 * kernel time variable at each second. The maximum frequency offset is 139 * about +-500000 ns/s and the resolution is about 2.3e-10 ns/s. 140 * 141 * 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 142 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 143 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 144 * |s s s s s s s s s s s s s| ns/s | 145 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 146 * | fraction | 147 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 148 */ 149 /* 150 * The following variables establish the state of the PLL/FLL and the 151 * residual time and frequency offset of the local clock. 152 */ 153 #define SHIFT_PLL 4 /* PLL loop gain (shift) */ 154 #define SHIFT_FLL 2 /* FLL loop gain (shift) */ 155 156 static int time_state = TIME_OK; /* clock state */ 157 static int time_status = STA_UNSYNC; /* clock status bits */ 158 static long time_tai; /* TAI offset (s) */ 159 static long time_monitor; /* last time offset scaled (ns) */ 160 static long time_constant; /* poll interval (shift) (s) */ 161 static long time_precision = 1; /* clock precision (ns) */ 162 static long time_maxerror = MAXPHASE / 1000; /* maximum error (us) */ 163 static long time_esterror = MAXPHASE / 1000; /* estimated error (us) */ 164 static long time_reftime; /* time at last adjustment (s) */ 165 static l_fp time_offset; /* time offset (ns) */ 166 static l_fp time_freq; /* frequency offset (ns/s) */ 167 #endif /* NTP */ 168 169 static l_fp time_adj; /* tick adjust (ns/s) */ 170 int64_t time_adjtime; /* correction from adjtime(2) (usec) */ 171 172 extern int time_adjusted; /* ntp might have changed the system time */ 173 174 #ifdef NTP 175 #ifdef PPS_SYNC 176 /* 177 * The following variables are used when a pulse-per-second (PPS) signal 178 * is available and connected via a modem control lead. They establish 179 * the engineering parameters of the clock discipline loop when 180 * controlled by the PPS signal. 181 */ 182 #define PPS_FAVG 2 /* min freq avg interval (s) (shift) */ 183 #define PPS_FAVGDEF 8 /* default freq avg int (s) (shift) */ 184 #define PPS_FAVGMAX 15 /* max freq avg interval (s) (shift) */ 185 #define PPS_PAVG 4 /* phase avg interval (s) (shift) */ 186 #define PPS_VALID 120 /* PPS signal watchdog max (s) */ 187 #define PPS_MAXWANDER 100000 /* max PPS wander (ns/s) */ 188 #define PPS_POPCORN 2 /* popcorn spike threshold (shift) */ 189 190 static struct timespec pps_tf[3]; /* phase median filter */ 191 static l_fp pps_freq; /* scaled frequency offset (ns/s) */ 192 static long pps_fcount; /* frequency accumulator */ 193 static long pps_jitter; /* nominal jitter (ns) */ 194 static long pps_stabil; /* nominal stability (scaled ns/s) */ 195 static long pps_lastsec; /* time at last calibration (s) */ 196 static int pps_valid; /* signal watchdog counter */ 197 static int pps_shift = PPS_FAVG; /* interval duration (s) (shift) */ 198 static int pps_shiftmax = PPS_FAVGDEF; /* max interval duration (s) (shift) */ 199 static int pps_intcnt; /* wander counter */ 200 201 /* 202 * PPS signal quality monitors 203 */ 204 static long pps_calcnt; /* calibration intervals */ 205 static long pps_jitcnt; /* jitter limit exceeded */ 206 static long pps_stbcnt; /* stability limit exceeded */ 207 static long pps_errcnt; /* calibration errors */ 208 #endif /* PPS_SYNC */ 209 /* 210 * End of phase/frequency-lock loop (PLL/FLL) definitions 211 */ 212 213 static void hardupdate(long offset); 214 215 /* 216 * ntp_gettime() - NTP user application interface 217 */ 218 void 219 ntp_gettime(ntv) 220 struct ntptimeval *ntv; 221 { 222 nanotime(&ntv->time); 223 ntv->maxerror = time_maxerror; 224 ntv->esterror = time_esterror; 225 ntv->tai = time_tai; 226 ntv->time_state = time_state; 227 } 228 229 /* ARGSUSED */ 230 /* 231 * ntp_adjtime() - NTP daemon application interface 232 */ 233 int 234 sys_ntp_adjtime(l, v, retval) 235 struct lwp *l; 236 void *v; 237 register_t *retval; 238 { 239 struct sys_ntp_adjtime_args /* { 240 syscallarg(struct timex *) tp; 241 } */ *uap = v; 242 struct timex ntv; 243 int error = 0; 244 245 error = copyin((void *)SCARG(uap, tp), (void *)&ntv, sizeof(ntv)); 246 if (error != 0) 247 return (error); 248 249 if (ntv.modes != 0 && (error = kauth_authorize_system(l->l_cred, 250 KAUTH_SYSTEM_TIME, KAUTH_REQ_SYSTEM_TIME_NTPADJTIME, NULL, 251 NULL, NULL)) != 0) 252 return (error); 253 254 ntp_adjtime1(&ntv); 255 256 error = copyout((void *)&ntv, (void *)SCARG(uap, tp), sizeof(ntv)); 257 if (!error) 258 *retval = ntp_timestatus(); 259 260 return error; 261 } 262 263 void 264 ntp_adjtime1(ntv) 265 struct timex *ntv; 266 { 267 long freq; 268 int modes; 269 int s; 270 271 /* 272 * Update selected clock variables - only the superuser can 273 * change anything. Note that there is no error checking here on 274 * the assumption the superuser should know what it is doing. 275 * Note that either the time constant or TAI offset are loaded 276 * from the ntv.constant member, depending on the mode bits. If 277 * the STA_PLL bit in the status word is cleared, the state and 278 * status words are reset to the initial values at boot. 279 */ 280 modes = ntv->modes; 281 if (modes != 0) 282 /* We need to save the system time during shutdown */ 283 time_adjusted |= 2; 284 s = splclock(); 285 if (modes & MOD_MAXERROR) 286 time_maxerror = ntv->maxerror; 287 if (modes & MOD_ESTERROR) 288 time_esterror = ntv->esterror; 289 if (modes & MOD_STATUS) { 290 if (time_status & STA_PLL && !(ntv->status & STA_PLL)) { 291 time_state = TIME_OK; 292 time_status = STA_UNSYNC; 293 #ifdef PPS_SYNC 294 pps_shift = PPS_FAVG; 295 #endif /* PPS_SYNC */ 296 } 297 time_status &= STA_RONLY; 298 time_status |= ntv->status & ~STA_RONLY; 299 } 300 if (modes & MOD_TIMECONST) { 301 if (ntv->constant < 0) 302 time_constant = 0; 303 else if (ntv->constant > MAXTC) 304 time_constant = MAXTC; 305 else 306 time_constant = ntv->constant; 307 } 308 if (modes & MOD_TAI) { 309 if (ntv->constant > 0) /* XXX zero & negative numbers ? */ 310 time_tai = ntv->constant; 311 } 312 #ifdef PPS_SYNC 313 if (modes & MOD_PPSMAX) { 314 if (ntv->shift < PPS_FAVG) 315 pps_shiftmax = PPS_FAVG; 316 else if (ntv->shift > PPS_FAVGMAX) 317 pps_shiftmax = PPS_FAVGMAX; 318 else 319 pps_shiftmax = ntv->shift; 320 } 321 #endif /* PPS_SYNC */ 322 if (modes & MOD_NANO) 323 time_status |= STA_NANO; 324 if (modes & MOD_MICRO) 325 time_status &= ~STA_NANO; 326 if (modes & MOD_CLKB) 327 time_status |= STA_CLK; 328 if (modes & MOD_CLKA) 329 time_status &= ~STA_CLK; 330 if (modes & MOD_FREQUENCY) { 331 freq = (ntv->freq * 1000LL) >> 16; 332 if (freq > MAXFREQ) 333 L_LINT(time_freq, MAXFREQ); 334 else if (freq < -MAXFREQ) 335 L_LINT(time_freq, -MAXFREQ); 336 else { 337 /* 338 * ntv.freq is [PPM * 2^16] = [us/s * 2^16] 339 * time_freq is [ns/s * 2^32] 340 */ 341 time_freq = ntv->freq * 1000LL * 65536LL; 342 } 343 #ifdef PPS_SYNC 344 pps_freq = time_freq; 345 #endif /* PPS_SYNC */ 346 } 347 if (modes & MOD_OFFSET) { 348 if (time_status & STA_NANO) 349 hardupdate(ntv->offset); 350 else 351 hardupdate(ntv->offset * 1000); 352 } 353 354 /* 355 * Retrieve all clock variables. Note that the TAI offset is 356 * returned only by ntp_gettime(); 357 */ 358 if (time_status & STA_NANO) 359 ntv->offset = L_GINT(time_offset); 360 else 361 ntv->offset = L_GINT(time_offset) / 1000; /* XXX rounding ? */ 362 ntv->freq = L_GINT((time_freq / 1000LL) << 16); 363 ntv->maxerror = time_maxerror; 364 ntv->esterror = time_esterror; 365 ntv->status = time_status; 366 ntv->constant = time_constant; 367 if (time_status & STA_NANO) 368 ntv->precision = time_precision; 369 else 370 ntv->precision = time_precision / 1000; 371 ntv->tolerance = MAXFREQ * SCALE_PPM; 372 #ifdef PPS_SYNC 373 ntv->shift = pps_shift; 374 ntv->ppsfreq = L_GINT((pps_freq / 1000LL) << 16); 375 if (time_status & STA_NANO) 376 ntv->jitter = pps_jitter; 377 else 378 ntv->jitter = pps_jitter / 1000; 379 ntv->stabil = pps_stabil; 380 ntv->calcnt = pps_calcnt; 381 ntv->errcnt = pps_errcnt; 382 ntv->jitcnt = pps_jitcnt; 383 ntv->stbcnt = pps_stbcnt; 384 #endif /* PPS_SYNC */ 385 splx(s); 386 } 387 #endif /* NTP */ 388 389 /* 390 * second_overflow() - called after ntp_tick_adjust() 391 * 392 * This routine is ordinarily called immediately following the above 393 * routine ntp_tick_adjust(). While these two routines are normally 394 * combined, they are separated here only for the purposes of 395 * simulation. 396 */ 397 void 398 ntp_update_second(int64_t *adjustment, time_t *newsec) 399 { 400 int tickrate; 401 l_fp ftemp; /* 32/64-bit temporary */ 402 403 #ifdef NTP 404 405 /* 406 * On rollover of the second both the nanosecond and microsecond 407 * clocks are updated and the state machine cranked as 408 * necessary. The phase adjustment to be used for the next 409 * second is calculated and the maximum error is increased by 410 * the tolerance. 411 */ 412 time_maxerror += MAXFREQ / 1000; 413 414 /* 415 * Leap second processing. If in leap-insert state at 416 * the end of the day, the system clock is set back one 417 * second; if in leap-delete state, the system clock is 418 * set ahead one second. The nano_time() routine or 419 * external clock driver will insure that reported time 420 * is always monotonic. 421 */ 422 switch (time_state) { 423 424 /* 425 * No warning. 426 */ 427 case TIME_OK: 428 if (time_status & STA_INS) 429 time_state = TIME_INS; 430 else if (time_status & STA_DEL) 431 time_state = TIME_DEL; 432 break; 433 434 /* 435 * Insert second 23:59:60 following second 436 * 23:59:59. 437 */ 438 case TIME_INS: 439 if (!(time_status & STA_INS)) 440 time_state = TIME_OK; 441 else if ((*newsec) % 86400 == 0) { 442 (*newsec)--; 443 time_state = TIME_OOP; 444 time_tai++; 445 } 446 break; 447 448 /* 449 * Delete second 23:59:59. 450 */ 451 case TIME_DEL: 452 if (!(time_status & STA_DEL)) 453 time_state = TIME_OK; 454 else if (((*newsec) + 1) % 86400 == 0) { 455 (*newsec)++; 456 time_tai--; 457 time_state = TIME_WAIT; 458 } 459 break; 460 461 /* 462 * Insert second in progress. 463 */ 464 case TIME_OOP: 465 time_state = TIME_WAIT; 466 break; 467 468 /* 469 * Wait for status bits to clear. 470 */ 471 case TIME_WAIT: 472 if (!(time_status & (STA_INS | STA_DEL))) 473 time_state = TIME_OK; 474 } 475 476 /* 477 * Compute the total time adjustment for the next second 478 * in ns. The offset is reduced by a factor depending on 479 * whether the PPS signal is operating. Note that the 480 * value is in effect scaled by the clock frequency, 481 * since the adjustment is added at each tick interrupt. 482 */ 483 ftemp = time_offset; 484 #ifdef PPS_SYNC 485 /* XXX even if PPS signal dies we should finish adjustment ? */ 486 if (time_status & STA_PPSTIME && time_status & 487 STA_PPSSIGNAL) 488 L_RSHIFT(ftemp, pps_shift); 489 else 490 L_RSHIFT(ftemp, SHIFT_PLL + time_constant); 491 #else 492 L_RSHIFT(ftemp, SHIFT_PLL + time_constant); 493 #endif /* PPS_SYNC */ 494 time_adj = ftemp; 495 L_SUB(time_offset, ftemp); 496 L_ADD(time_adj, time_freq); 497 498 #ifdef PPS_SYNC 499 if (pps_valid > 0) 500 pps_valid--; 501 else 502 time_status &= ~STA_PPSSIGNAL; 503 #endif /* PPS_SYNC */ 504 #else /* !NTP */ 505 L_CLR(time_adj); 506 #endif /* !NTP */ 507 508 /* 509 * Apply any correction from adjtime(2). If more than one second 510 * off we slew at a rate of 5ms/s (5000 PPM) else 500us/s (500PPM) 511 * until the last second is slewed the final < 500 usecs. 512 */ 513 if (time_adjtime != 0) { 514 if (time_adjtime > 1000000) 515 tickrate = 5000; 516 else if (time_adjtime < -1000000) 517 tickrate = -5000; 518 else if (time_adjtime > 500) 519 tickrate = 500; 520 else if (time_adjtime < -500) 521 tickrate = -500; 522 else 523 tickrate = time_adjtime; 524 time_adjtime -= tickrate; 525 L_LINT(ftemp, tickrate * 1000); 526 L_ADD(time_adj, ftemp); 527 } 528 *adjustment = time_adj; 529 } 530 531 /* 532 * ntp_init() - initialize variables and structures 533 * 534 * This routine must be called after the kernel variables hz and tick 535 * are set or changed and before the next tick interrupt. In this 536 * particular implementation, these values are assumed set elsewhere in 537 * the kernel. The design allows the clock frequency and tick interval 538 * to be changed while the system is running. So, this routine should 539 * probably be integrated with the code that does that. 540 */ 541 void 542 ntp_init(void) 543 { 544 545 /* 546 * The following variables are initialized only at startup. Only 547 * those structures not cleared by the compiler need to be 548 * initialized, and these only in the simulator. In the actual 549 * kernel, any nonzero values here will quickly evaporate. 550 */ 551 L_CLR(time_adj); 552 #ifdef NTP 553 L_CLR(time_offset); 554 L_CLR(time_freq); 555 #ifdef PPS_SYNC 556 pps_tf[0].tv_sec = pps_tf[0].tv_nsec = 0; 557 pps_tf[1].tv_sec = pps_tf[1].tv_nsec = 0; 558 pps_tf[2].tv_sec = pps_tf[2].tv_nsec = 0; 559 pps_fcount = 0; 560 L_CLR(pps_freq); 561 #endif /* PPS_SYNC */ 562 #endif 563 } 564 565 #ifdef NTP 566 /* 567 * hardupdate() - local clock update 568 * 569 * This routine is called by ntp_adjtime() to update the local clock 570 * phase and frequency. The implementation is of an adaptive-parameter, 571 * hybrid phase/frequency-lock loop (PLL/FLL). The routine computes new 572 * time and frequency offset estimates for each call. If the kernel PPS 573 * discipline code is configured (PPS_SYNC), the PPS signal itself 574 * determines the new time offset, instead of the calling argument. 575 * Presumably, calls to ntp_adjtime() occur only when the caller 576 * believes the local clock is valid within some bound (+-128 ms with 577 * NTP). If the caller's time is far different than the PPS time, an 578 * argument will ensue, and it's not clear who will lose. 579 * 580 * For uncompensated quartz crystal oscillators and nominal update 581 * intervals less than 256 s, operation should be in phase-lock mode, 582 * where the loop is disciplined to phase. For update intervals greater 583 * than 1024 s, operation should be in frequency-lock mode, where the 584 * loop is disciplined to frequency. Between 256 s and 1024 s, the mode 585 * is selected by the STA_MODE status bit. 586 * 587 * Note: splclock() is in effect. 588 */ 589 void 590 hardupdate(long offset) 591 { 592 long mtemp; 593 l_fp ftemp; 594 595 /* 596 * Select how the phase is to be controlled and from which 597 * source. If the PPS signal is present and enabled to 598 * discipline the time, the PPS offset is used; otherwise, the 599 * argument offset is used. 600 */ 601 if (!(time_status & STA_PLL)) 602 return; 603 if (!(time_status & STA_PPSTIME && time_status & 604 STA_PPSSIGNAL)) { 605 if (offset > MAXPHASE) 606 time_monitor = MAXPHASE; 607 else if (offset < -MAXPHASE) 608 time_monitor = -MAXPHASE; 609 else 610 time_monitor = offset; 611 L_LINT(time_offset, time_monitor); 612 } 613 614 /* 615 * Select how the frequency is to be controlled and in which 616 * mode (PLL or FLL). If the PPS signal is present and enabled 617 * to discipline the frequency, the PPS frequency is used; 618 * otherwise, the argument offset is used to compute it. 619 */ 620 if (time_status & STA_PPSFREQ && time_status & STA_PPSSIGNAL) { 621 time_reftime = time_second; 622 return; 623 } 624 if (time_status & STA_FREQHOLD || time_reftime == 0) 625 time_reftime = time_second; 626 mtemp = time_second - time_reftime; 627 L_LINT(ftemp, time_monitor); 628 L_RSHIFT(ftemp, (SHIFT_PLL + 2 + time_constant) << 1); 629 L_MPY(ftemp, mtemp); 630 L_ADD(time_freq, ftemp); 631 time_status &= ~STA_MODE; 632 if (mtemp >= MINSEC && (time_status & STA_FLL || mtemp > 633 MAXSEC)) { 634 L_LINT(ftemp, (time_monitor << 4) / mtemp); 635 L_RSHIFT(ftemp, SHIFT_FLL + 4); 636 L_ADD(time_freq, ftemp); 637 time_status |= STA_MODE; 638 } 639 time_reftime = time_second; 640 if (L_GINT(time_freq) > MAXFREQ) 641 L_LINT(time_freq, MAXFREQ); 642 else if (L_GINT(time_freq) < -MAXFREQ) 643 L_LINT(time_freq, -MAXFREQ); 644 } 645 646 #ifdef PPS_SYNC 647 /* 648 * hardpps() - discipline CPU clock oscillator to external PPS signal 649 * 650 * This routine is called at each PPS interrupt in order to discipline 651 * the CPU clock oscillator to the PPS signal. It measures the PPS phase 652 * and leaves it in a handy spot for the hardclock() routine. It 653 * integrates successive PPS phase differences and calculates the 654 * frequency offset. This is used in hardclock() to discipline the CPU 655 * clock oscillator so that intrinsic frequency error is cancelled out. 656 * The code requires the caller to capture the time and hardware counter 657 * value at the on-time PPS signal transition. 658 * 659 * Note that, on some Unix systems, this routine runs at an interrupt 660 * priority level higher than the timer interrupt routine hardclock(). 661 * Therefore, the variables used are distinct from the hardclock() 662 * variables, except for certain exceptions: The PPS frequency pps_freq 663 * and phase pps_offset variables are determined by this routine and 664 * updated atomically. The time_tolerance variable can be considered a 665 * constant, since it is infrequently changed, and then only when the 666 * PPS signal is disabled. The watchdog counter pps_valid is updated 667 * once per second by hardclock() and is atomically cleared in this 668 * routine. 669 */ 670 void 671 hardpps(struct timespec *tsp, /* time at PPS */ 672 long nsec /* hardware counter at PPS */) 673 { 674 long u_sec, u_nsec, v_nsec; /* temps */ 675 l_fp ftemp; 676 677 /* 678 * The signal is first processed by a range gate and frequency 679 * discriminator. The range gate rejects noise spikes outside 680 * the range +-500 us. The frequency discriminator rejects input 681 * signals with apparent frequency outside the range 1 +-500 682 * PPM. If two hits occur in the same second, we ignore the 683 * later hit; if not and a hit occurs outside the range gate, 684 * keep the later hit for later comparison, but do not process 685 * it. 686 */ 687 time_status |= STA_PPSSIGNAL | STA_PPSJITTER; 688 time_status &= ~(STA_PPSWANDER | STA_PPSERROR); 689 pps_valid = PPS_VALID; 690 u_sec = tsp->tv_sec; 691 u_nsec = tsp->tv_nsec; 692 if (u_nsec >= (NANOSECOND >> 1)) { 693 u_nsec -= NANOSECOND; 694 u_sec++; 695 } 696 v_nsec = u_nsec - pps_tf[0].tv_nsec; 697 if (u_sec == pps_tf[0].tv_sec && v_nsec < NANOSECOND - 698 MAXFREQ) 699 return; 700 pps_tf[2] = pps_tf[1]; 701 pps_tf[1] = pps_tf[0]; 702 pps_tf[0].tv_sec = u_sec; 703 pps_tf[0].tv_nsec = u_nsec; 704 705 /* 706 * Compute the difference between the current and previous 707 * counter values. If the difference exceeds 0.5 s, assume it 708 * has wrapped around, so correct 1.0 s. If the result exceeds 709 * the tick interval, the sample point has crossed a tick 710 * boundary during the last second, so correct the tick. Very 711 * intricate. 712 */ 713 u_nsec = nsec; 714 if (u_nsec > (NANOSECOND >> 1)) 715 u_nsec -= NANOSECOND; 716 else if (u_nsec < -(NANOSECOND >> 1)) 717 u_nsec += NANOSECOND; 718 pps_fcount += u_nsec; 719 if (v_nsec > MAXFREQ || v_nsec < -MAXFREQ) 720 return; 721 time_status &= ~STA_PPSJITTER; 722 723 /* 724 * A three-stage median filter is used to help denoise the PPS 725 * time. The median sample becomes the time offset estimate; the 726 * difference between the other two samples becomes the time 727 * dispersion (jitter) estimate. 728 */ 729 if (pps_tf[0].tv_nsec > pps_tf[1].tv_nsec) { 730 if (pps_tf[1].tv_nsec > pps_tf[2].tv_nsec) { 731 v_nsec = pps_tf[1].tv_nsec; /* 0 1 2 */ 732 u_nsec = pps_tf[0].tv_nsec - pps_tf[2].tv_nsec; 733 } else if (pps_tf[2].tv_nsec > pps_tf[0].tv_nsec) { 734 v_nsec = pps_tf[0].tv_nsec; /* 2 0 1 */ 735 u_nsec = pps_tf[2].tv_nsec - pps_tf[1].tv_nsec; 736 } else { 737 v_nsec = pps_tf[2].tv_nsec; /* 0 2 1 */ 738 u_nsec = pps_tf[0].tv_nsec - pps_tf[1].tv_nsec; 739 } 740 } else { 741 if (pps_tf[1].tv_nsec < pps_tf[2].tv_nsec) { 742 v_nsec = pps_tf[1].tv_nsec; /* 2 1 0 */ 743 u_nsec = pps_tf[2].tv_nsec - pps_tf[0].tv_nsec; 744 } else if (pps_tf[2].tv_nsec < pps_tf[0].tv_nsec) { 745 v_nsec = pps_tf[0].tv_nsec; /* 1 0 2 */ 746 u_nsec = pps_tf[1].tv_nsec - pps_tf[2].tv_nsec; 747 } else { 748 v_nsec = pps_tf[2].tv_nsec; /* 1 2 0 */ 749 u_nsec = pps_tf[1].tv_nsec - pps_tf[0].tv_nsec; 750 } 751 } 752 753 /* 754 * Nominal jitter is due to PPS signal noise and interrupt 755 * latency. If it exceeds the popcorn threshold, the sample is 756 * discarded. otherwise, if so enabled, the time offset is 757 * updated. We can tolerate a modest loss of data here without 758 * much degrading time accuracy. 759 */ 760 if (u_nsec > (pps_jitter << PPS_POPCORN)) { 761 time_status |= STA_PPSJITTER; 762 pps_jitcnt++; 763 } else if (time_status & STA_PPSTIME) { 764 time_monitor = -v_nsec; 765 L_LINT(time_offset, time_monitor); 766 } 767 pps_jitter += (u_nsec - pps_jitter) >> PPS_FAVG; 768 u_sec = pps_tf[0].tv_sec - pps_lastsec; 769 if (u_sec < (1 << pps_shift)) 770 return; 771 772 /* 773 * At the end of the calibration interval the difference between 774 * the first and last counter values becomes the scaled 775 * frequency. It will later be divided by the length of the 776 * interval to determine the frequency update. If the frequency 777 * exceeds a sanity threshold, or if the actual calibration 778 * interval is not equal to the expected length, the data are 779 * discarded. We can tolerate a modest loss of data here without 780 * much degrading frequency accuracy. 781 */ 782 pps_calcnt++; 783 v_nsec = -pps_fcount; 784 pps_lastsec = pps_tf[0].tv_sec; 785 pps_fcount = 0; 786 u_nsec = MAXFREQ << pps_shift; 787 if (v_nsec > u_nsec || v_nsec < -u_nsec || u_sec != (1 << 788 pps_shift)) { 789 time_status |= STA_PPSERROR; 790 pps_errcnt++; 791 return; 792 } 793 794 /* 795 * Here the raw frequency offset and wander (stability) is 796 * calculated. If the wander is less than the wander threshold 797 * for four consecutive averaging intervals, the interval is 798 * doubled; if it is greater than the threshold for four 799 * consecutive intervals, the interval is halved. The scaled 800 * frequency offset is converted to frequency offset. The 801 * stability metric is calculated as the average of recent 802 * frequency changes, but is used only for performance 803 * monitoring. 804 */ 805 L_LINT(ftemp, v_nsec); 806 L_RSHIFT(ftemp, pps_shift); 807 L_SUB(ftemp, pps_freq); 808 u_nsec = L_GINT(ftemp); 809 if (u_nsec > PPS_MAXWANDER) { 810 L_LINT(ftemp, PPS_MAXWANDER); 811 pps_intcnt--; 812 time_status |= STA_PPSWANDER; 813 pps_stbcnt++; 814 } else if (u_nsec < -PPS_MAXWANDER) { 815 L_LINT(ftemp, -PPS_MAXWANDER); 816 pps_intcnt--; 817 time_status |= STA_PPSWANDER; 818 pps_stbcnt++; 819 } else { 820 pps_intcnt++; 821 } 822 if (pps_intcnt >= 4) { 823 pps_intcnt = 4; 824 if (pps_shift < pps_shiftmax) { 825 pps_shift++; 826 pps_intcnt = 0; 827 } 828 } else if (pps_intcnt <= -4 || pps_shift > pps_shiftmax) { 829 pps_intcnt = -4; 830 if (pps_shift > PPS_FAVG) { 831 pps_shift--; 832 pps_intcnt = 0; 833 } 834 } 835 if (u_nsec < 0) 836 u_nsec = -u_nsec; 837 pps_stabil += (u_nsec * SCALE_PPM - pps_stabil) >> PPS_FAVG; 838 839 /* 840 * The PPS frequency is recalculated and clamped to the maximum 841 * MAXFREQ. If enabled, the system clock frequency is updated as 842 * well. 843 */ 844 L_ADD(pps_freq, ftemp); 845 u_nsec = L_GINT(pps_freq); 846 if (u_nsec > MAXFREQ) 847 L_LINT(pps_freq, MAXFREQ); 848 else if (u_nsec < -MAXFREQ) 849 L_LINT(pps_freq, -MAXFREQ); 850 if (time_status & STA_PPSFREQ) 851 time_freq = pps_freq; 852 } 853 #endif /* PPS_SYNC */ 854 #endif /* NTP */ 855 #else /* !__HAVE_TIMECOUNTER */ 856 /****************************************************************************** 857 * * 858 * Copyright (c) David L. Mills 1993, 1994 * 859 * * 860 * Permission to use, copy, modify, and distribute this software and its * 861 * documentation for any purpose and without fee is hereby granted, provided * 862 * that the above copyright notice appears in all copies and that both the * 863 * copyright notice and this permission notice appear in supporting * 864 * documentation, and that the name University of Delaware not be used in * 865 * advertising or publicity pertaining to distribution of the software * 866 * without specific, written prior permission. The University of Delaware * 867 * makes no representations about the suitability this software for any * 868 * purpose. It is provided "as is" without express or implied warranty. * 869 * * 870 ******************************************************************************/ 871 872 /* 873 * Modification history kern_ntptime.c 874 * 875 * 24 Sep 94 David L. Mills 876 * Tightened code at exits. 877 * 878 * 24 Mar 94 David L. Mills 879 * Revised syscall interface to include new variables for PPS 880 * time discipline. 881 * 882 * 14 Feb 94 David L. Mills 883 * Added code for external clock 884 * 885 * 28 Nov 93 David L. Mills 886 * Revised frequency scaling to conform with adjusted parameters 887 * 888 * 17 Sep 93 David L. Mills 889 * Created file 890 */ 891 /* 892 * ntp_gettime(), ntp_adjtime() - precision time interface for SunOS 893 * V4.1.1 and V4.1.3 894 * 895 * These routines consitute the Network Time Protocol (NTP) interfaces 896 * for user and daemon application programs. The ntp_gettime() routine 897 * provides the time, maximum error (synch distance) and estimated error 898 * (dispersion) to client user application programs. The ntp_adjtime() 899 * routine is used by the NTP daemon to adjust the system clock to an 900 * externally derived time. The time offset and related variables set by 901 * this routine are used by hardclock() to adjust the phase and 902 * frequency of the phase-lock loop which controls the system clock. 903 */ 904 905 #include <sys/cdefs.h> 906 __KERNEL_RCSID(0, "$NetBSD: kern_ntptime.c,v 1.44 2007/10/19 12:16:43 ad Exp $"); 907 908 #include "opt_ntp.h" 909 #include "opt_compat_netbsd.h" 910 911 #include <sys/param.h> 912 #include <sys/resourcevar.h> 913 #include <sys/systm.h> 914 #include <sys/kernel.h> 915 #include <sys/proc.h> 916 #include <sys/sysctl.h> 917 #include <sys/timex.h> 918 #ifdef COMPAT_30 919 #include <compat/sys/timex.h> 920 #endif 921 #include <sys/vnode.h> 922 #include <sys/kauth.h> 923 924 #include <sys/mount.h> 925 #include <sys/syscallargs.h> 926 927 #include <sys/cpu.h> 928 929 #ifdef NTP 930 /* 931 * The following variables are used by the hardclock() routine in the 932 * kern_clock.c module and are described in that module. 933 */ 934 extern int time_state; /* clock state */ 935 extern int time_status; /* clock status bits */ 936 extern long time_offset; /* time adjustment (us) */ 937 extern long time_freq; /* frequency offset (scaled ppm) */ 938 extern long time_maxerror; /* maximum error (us) */ 939 extern long time_esterror; /* estimated error (us) */ 940 extern long time_constant; /* pll time constant */ 941 extern long time_precision; /* clock precision (us) */ 942 extern long time_tolerance; /* frequency tolerance (scaled ppm) */ 943 extern int time_adjusted; /* ntp might have changed the system time */ 944 945 #ifdef PPS_SYNC 946 /* 947 * The following variables are used only if the PPS signal discipline 948 * is configured in the kernel. 949 */ 950 extern int pps_shift; /* interval duration (s) (shift) */ 951 extern long pps_freq; /* pps frequency offset (scaled ppm) */ 952 extern long pps_jitter; /* pps jitter (us) */ 953 extern long pps_stabil; /* pps stability (scaled ppm) */ 954 extern long pps_jitcnt; /* jitter limit exceeded */ 955 extern long pps_calcnt; /* calibration intervals */ 956 extern long pps_errcnt; /* calibration errors */ 957 extern long pps_stbcnt; /* stability limit exceeded */ 958 #endif /* PPS_SYNC */ 959 960 /*ARGSUSED*/ 961 /* 962 * ntp_gettime() - NTP user application interface 963 */ 964 void 965 ntp_gettime(ntvp) 966 struct ntptimeval *ntvp; 967 { 968 struct timeval atv; 969 int s; 970 971 memset(ntvp, 0, sizeof(struct ntptimeval)); 972 973 s = splclock(); 974 #ifdef EXT_CLOCK 975 /* 976 * The microtime() external clock routine returns a 977 * status code. If less than zero, we declare an error 978 * in the clock status word and return the kernel 979 * (software) time variable. While there are other 980 * places that call microtime(), this is the only place 981 * that matters from an application point of view. 982 */ 983 if (microtime(&atv) < 0) { 984 time_status |= STA_CLOCKERR; 985 ntvp->time = time; 986 } else 987 time_status &= ~STA_CLOCKERR; 988 #else /* EXT_CLOCK */ 989 microtime(&atv); 990 #endif /* EXT_CLOCK */ 991 ntvp->maxerror = time_maxerror; 992 ntvp->esterror = time_esterror; 993 (void) splx(s); 994 TIMEVAL_TO_TIMESPEC(&atv, &ntvp->time); 995 } 996 997 998 /* ARGSUSED */ 999 /* 1000 * ntp_adjtime() - NTP daemon application interface 1001 */ 1002 int 1003 sys_ntp_adjtime(l, v, retval) 1004 struct lwp *l; 1005 void *v; 1006 register_t *retval; 1007 { 1008 struct sys_ntp_adjtime_args /* { 1009 syscallarg(struct timex *) tp; 1010 } */ *uap = v; 1011 struct timex ntv; 1012 int error = 0; 1013 1014 error = copyin((void *)SCARG(uap, tp), (void *)&ntv, sizeof(ntv)); 1015 if (error != 0) 1016 return (error); 1017 1018 if (ntv.modes != 0 && (error = kauth_authorize_system(l->l_cred, 1019 KAUTH_SYSTEM_TIME, KAUTH_REQ_SYSTEM_TIME_NTPADJTIME, NULL, 1020 NULL, NULL)) != 0) 1021 return (error); 1022 1023 ntp_adjtime1(&ntv); 1024 1025 error = copyout((void *)&ntv, (void *)SCARG(uap, tp), sizeof(ntv)); 1026 if (error == 0) 1027 *retval = ntp_timestatus(); 1028 1029 return error; 1030 } 1031 1032 void 1033 ntp_adjtime1(ntv) 1034 struct timex *ntv; 1035 { 1036 int modes; 1037 int s; 1038 1039 /* 1040 * Update selected clock variables. Note that there is no error 1041 * checking here on the assumption the superuser should know 1042 * what it is doing. 1043 */ 1044 modes = ntv->modes; 1045 if (modes != 0) 1046 /* We need to save the system time during shutdown */ 1047 time_adjusted |= 2; 1048 s = splclock(); 1049 if (modes & MOD_FREQUENCY) 1050 #ifdef PPS_SYNC 1051 time_freq = ntv->freq - pps_freq; 1052 #else /* PPS_SYNC */ 1053 time_freq = ntv->freq; 1054 #endif /* PPS_SYNC */ 1055 if (modes & MOD_MAXERROR) 1056 time_maxerror = ntv->maxerror; 1057 if (modes & MOD_ESTERROR) 1058 time_esterror = ntv->esterror; 1059 if (modes & MOD_STATUS) { 1060 time_status &= STA_RONLY; 1061 time_status |= ntv->status & ~STA_RONLY; 1062 } 1063 if (modes & MOD_TIMECONST) 1064 time_constant = ntv->constant; 1065 if (modes & MOD_OFFSET) 1066 hardupdate(ntv->offset); 1067 1068 /* 1069 * Retrieve all clock variables 1070 */ 1071 if (time_offset < 0) 1072 ntv->offset = -(-time_offset >> SHIFT_UPDATE); 1073 else 1074 ntv->offset = time_offset >> SHIFT_UPDATE; 1075 #ifdef PPS_SYNC 1076 ntv->freq = time_freq + pps_freq; 1077 #else /* PPS_SYNC */ 1078 ntv->freq = time_freq; 1079 #endif /* PPS_SYNC */ 1080 ntv->maxerror = time_maxerror; 1081 ntv->esterror = time_esterror; 1082 ntv->status = time_status; 1083 ntv->constant = time_constant; 1084 ntv->precision = time_precision; 1085 ntv->tolerance = time_tolerance; 1086 #ifdef PPS_SYNC 1087 ntv->shift = pps_shift; 1088 ntv->ppsfreq = pps_freq; 1089 ntv->jitter = pps_jitter >> PPS_AVG; 1090 ntv->stabil = pps_stabil; 1091 ntv->calcnt = pps_calcnt; 1092 ntv->errcnt = pps_errcnt; 1093 ntv->jitcnt = pps_jitcnt; 1094 ntv->stbcnt = pps_stbcnt; 1095 #endif /* PPS_SYNC */ 1096 (void)splx(s); 1097 } 1098 #endif /* NTP */ 1099 #endif /* !__HAVE_TIMECOUNTER */ 1100 1101 #ifdef NTP 1102 int 1103 ntp_timestatus() 1104 { 1105 /* 1106 * Status word error decode. If any of these conditions 1107 * occur, an error is returned, instead of the status 1108 * word. Most applications will care only about the fact 1109 * the system clock may not be trusted, not about the 1110 * details. 1111 * 1112 * Hardware or software error 1113 */ 1114 if ((time_status & (STA_UNSYNC | STA_CLOCKERR)) || 1115 1116 /* 1117 * PPS signal lost when either time or frequency 1118 * synchronization requested 1119 */ 1120 (time_status & (STA_PPSFREQ | STA_PPSTIME) && 1121 !(time_status & STA_PPSSIGNAL)) || 1122 1123 /* 1124 * PPS jitter exceeded when time synchronization 1125 * requested 1126 */ 1127 (time_status & STA_PPSTIME && 1128 time_status & STA_PPSJITTER) || 1129 1130 /* 1131 * PPS wander exceeded or calibration error when 1132 * frequency synchronization requested 1133 */ 1134 (time_status & STA_PPSFREQ && 1135 time_status & (STA_PPSWANDER | STA_PPSERROR))) 1136 return (TIME_ERROR); 1137 else 1138 return (time_state); 1139 } 1140 1141 /*ARGSUSED*/ 1142 /* 1143 * ntp_gettime() - NTP user application interface 1144 */ 1145 int 1146 sys___ntp_gettime30(struct lwp *l, void *v, register_t *retval) 1147 { 1148 struct sys___ntp_gettime30_args /* { 1149 syscallarg(struct ntptimeval *) ntvp; 1150 } */ *uap = v; 1151 struct ntptimeval ntv; 1152 int error = 0; 1153 1154 if (SCARG(uap, ntvp)) { 1155 ntp_gettime(&ntv); 1156 1157 error = copyout((void *)&ntv, (void *)SCARG(uap, ntvp), 1158 sizeof(ntv)); 1159 } 1160 if (!error) { 1161 *retval = ntp_timestatus(); 1162 } 1163 return(error); 1164 } 1165 1166 #ifdef COMPAT_30 1167 int 1168 compat_30_sys_ntp_gettime(struct lwp *l, void *v, register_t *retval) 1169 { 1170 struct compat_30_sys_ntp_gettime_args /* { 1171 syscallarg(struct ntptimeval30 *) ontvp; 1172 } */ *uap = v; 1173 struct ntptimeval ntv; 1174 struct ntptimeval30 ontv; 1175 int error = 0; 1176 1177 if (SCARG(uap, ntvp)) { 1178 ntp_gettime(&ntv); 1179 TIMESPEC_TO_TIMEVAL(&ontv.time, &ntv.time); 1180 ontv.maxerror = ntv.maxerror; 1181 ontv.esterror = ntv.esterror; 1182 1183 error = copyout((void *)&ontv, (void *)SCARG(uap, ntvp), 1184 sizeof(ontv)); 1185 } 1186 if (!error) 1187 *retval = ntp_timestatus(); 1188 1189 return (error); 1190 } 1191 #endif 1192 1193 /* 1194 * return information about kernel precision timekeeping 1195 */ 1196 static int 1197 sysctl_kern_ntptime(SYSCTLFN_ARGS) 1198 { 1199 struct sysctlnode node; 1200 struct ntptimeval ntv; 1201 1202 ntp_gettime(&ntv); 1203 1204 node = *rnode; 1205 node.sysctl_data = &ntv; 1206 node.sysctl_size = sizeof(ntv); 1207 return (sysctl_lookup(SYSCTLFN_CALL(&node))); 1208 } 1209 1210 SYSCTL_SETUP(sysctl_kern_ntptime_setup, "sysctl kern.ntptime node setup") 1211 { 1212 1213 sysctl_createv(clog, 0, NULL, NULL, 1214 CTLFLAG_PERMANENT, 1215 CTLTYPE_NODE, "kern", NULL, 1216 NULL, 0, NULL, 0, 1217 CTL_KERN, CTL_EOL); 1218 1219 sysctl_createv(clog, 0, NULL, NULL, 1220 CTLFLAG_PERMANENT, 1221 CTLTYPE_STRUCT, "ntptime", 1222 SYSCTL_DESCR("Kernel clock values for NTP"), 1223 sysctl_kern_ntptime, 0, NULL, 1224 sizeof(struct ntptimeval), 1225 CTL_KERN, KERN_NTPTIME, CTL_EOL); 1226 } 1227 #else /* !NTP */ 1228 /* For some reason, raising SIGSYS (as sys_nosys would) is problematic. */ 1229 1230 int 1231 sys___ntp_gettime30(struct lwp *l, void *v, register_t *retval) 1232 { 1233 1234 return(ENOSYS); 1235 } 1236 1237 #ifdef COMPAT_30 1238 int 1239 compat_30_sys_ntp_gettime(struct lwp *l, void *v, register_t *retval) 1240 { 1241 1242 return(ENOSYS); 1243 } 1244 #endif 1245 #endif /* !NTP */ 1246