1 /* $NetBSD: subr_time.c,v 1.39 2024/10/10 11:14:28 kre Exp $ */ 2 3 /* 4 * Copyright (c) 1982, 1986, 1989, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 * 31 * @(#)kern_clock.c 8.5 (Berkeley) 1/21/94 32 * @(#)kern_time.c 8.4 (Berkeley) 5/26/95 33 */ 34 35 #include <sys/cdefs.h> 36 __KERNEL_RCSID(0, "$NetBSD: subr_time.c,v 1.39 2024/10/10 11:14:28 kre Exp $"); 37 38 #include <sys/param.h> 39 #include <sys/kernel.h> 40 #include <sys/proc.h> 41 #include <sys/kauth.h> 42 #include <sys/lwp.h> 43 #include <sys/timex.h> 44 #include <sys/time.h> 45 #include <sys/timetc.h> 46 #include <sys/intr.h> 47 48 /* 49 * Compute number of hz until specified time. Used to compute second 50 * argument to callout_reset() from an absolute time. 51 */ 52 int 53 tvhzto(const struct timeval *tvp) 54 { 55 struct timeval now, tv; 56 57 tv = *tvp; /* Don't modify original tvp. */ 58 getmicrotime(&now); 59 timersub(&tv, &now, &tv); 60 return tvtohz(&tv); 61 } 62 63 /* 64 * Compute number of ticks in the specified amount of time. 65 */ 66 int 67 tvtohz(const struct timeval *tv) 68 { 69 unsigned long ticks; 70 long sec, usec; 71 72 /* 73 * If the number of usecs in the whole seconds part of the time 74 * difference fits in a long, then the total number of usecs will 75 * fit in an unsigned long. Compute the total and convert it to 76 * ticks, rounding up and adding 1 to allow for the current tick 77 * to expire. Rounding also depends on unsigned long arithmetic 78 * to avoid overflow. 79 * 80 * Otherwise, if the number of ticks in the whole seconds part of 81 * the time difference fits in a long, then convert the parts to 82 * ticks separately and add, using similar rounding methods and 83 * overflow avoidance. This method would work in the previous 84 * case, but it is slightly slower and assumes that hz is integral. 85 * 86 * Otherwise, round the time difference down to the maximum 87 * representable value. 88 * 89 * If ints are 32-bit, then the maximum value for any timeout in 90 * 10ms ticks is 248 days. 91 */ 92 sec = tv->tv_sec; 93 usec = tv->tv_usec; 94 95 KASSERT(usec >= 0); 96 KASSERT(usec < 1000000); 97 98 /* catch overflows in conversion time_t->int */ 99 if (tv->tv_sec > INT_MAX) 100 return INT_MAX; 101 if (tv->tv_sec < 0) 102 return 0; 103 104 if (sec < 0 || (sec == 0 && usec == 0)) { 105 /* 106 * Would expire now or in the past. Return 0 ticks. 107 * This is different from the legacy tvhzto() interface, 108 * and callers need to check for it. 109 */ 110 ticks = 0; 111 } else if (sec <= (LONG_MAX / 1000000)) 112 ticks = (((sec * 1000000) + (unsigned long)usec + (tick - 1)) 113 / tick) + 1; 114 else if (sec <= (LONG_MAX / hz)) 115 ticks = (sec * hz) + 116 (((unsigned long)usec + (tick - 1)) / tick) + 1; 117 else 118 ticks = LONG_MAX; 119 120 if (ticks > INT_MAX) 121 ticks = INT_MAX; 122 123 return ((int)ticks); 124 } 125 126 int 127 tshzto(const struct timespec *tsp) 128 { 129 struct timespec now, ts; 130 131 ts = *tsp; /* Don't modify original tsp. */ 132 getnanotime(&now); 133 timespecsub(&ts, &now, &ts); 134 return tstohz(&ts); 135 } 136 137 int 138 tshztoup(const struct timespec *tsp) 139 { 140 struct timespec now, ts; 141 142 ts = *tsp; /* Don't modify original tsp. */ 143 getnanouptime(&now); 144 timespecsub(&ts, &now, &ts); 145 return tstohz(&ts); 146 } 147 148 /* 149 * Compute number of ticks in the specified amount of time. 150 */ 151 int 152 tstohz(const struct timespec *ts) 153 { 154 struct timeval tv; 155 156 /* 157 * usec has great enough resolution for hz, so convert to a 158 * timeval and use tvtohz() above. 159 */ 160 TIMESPEC_TO_TIMEVAL(&tv, ts); 161 return tvtohz(&tv); 162 } 163 164 /* 165 * Check that a proposed value to load into the .it_value or 166 * .it_interval part of an interval timer is acceptable, and 167 * fix it to have at least minimal value (i.e. if it is less 168 * than the resolution of the clock, round it up.). We don't 169 * timeout the 0,0 value because this means to disable the 170 * timer or the interval. 171 */ 172 int 173 itimerfix(struct timeval *tv) 174 { 175 176 if (tv->tv_usec < 0 || tv->tv_usec >= 1000000) 177 return EINVAL; 178 if (tv->tv_sec < 0) 179 return ETIMEDOUT; 180 if (tv->tv_sec == 0 && tv->tv_usec != 0 && tv->tv_usec < tick) 181 tv->tv_usec = tick; 182 return 0; 183 } 184 185 int 186 itimespecfix(struct timespec *ts) 187 { 188 189 if (ts->tv_nsec < 0 || ts->tv_nsec >= 1000000000) 190 return EINVAL; 191 if (ts->tv_sec < 0) 192 return ETIMEDOUT; 193 if (ts->tv_sec == 0 && ts->tv_nsec != 0 && ts->tv_nsec < tick * 1000) 194 ts->tv_nsec = tick * 1000; 195 return 0; 196 } 197 198 int 199 inittimeleft(struct timespec *ts, struct timespec *sleepts) 200 { 201 202 if (itimespecfix(ts)) { 203 return -1; 204 } 205 KASSERT(ts->tv_sec >= 0); 206 getnanouptime(sleepts); 207 return 0; 208 } 209 210 int 211 gettimeleft(struct timespec *ts, struct timespec *sleepts) 212 { 213 struct timespec now, sleptts; 214 215 KASSERT(ts->tv_sec >= 0); 216 217 /* 218 * Reduce ts by elapsed time based on monotonic time scale. 219 */ 220 getnanouptime(&now); 221 KASSERT(timespeccmp(sleepts, &now, <=)); 222 timespecsub(&now, sleepts, &sleptts); 223 *sleepts = now; 224 225 if (timespeccmp(ts, &sleptts, <=)) { /* timed out */ 226 timespecclear(ts); 227 return 0; 228 } 229 timespecsub(ts, &sleptts, ts); 230 231 return tstohz(ts); 232 } 233 234 void 235 clock_timeleft(clockid_t clockid, struct timespec *ts, struct timespec *sleepts) 236 { 237 struct timespec sleptts; 238 239 clock_gettime1(clockid, &sleptts); 240 timespecadd(ts, sleepts, ts); 241 timespecsub(ts, &sleptts, ts); 242 *sleepts = sleptts; 243 } 244 245 int 246 clock_gettime1(clockid_t clock_id, struct timespec *ts) 247 { 248 int error; 249 struct proc *p; 250 251 #define CPUCLOCK_ID_MASK (~(CLOCK_THREAD_CPUTIME_ID|CLOCK_PROCESS_CPUTIME_ID)) 252 if (clock_id & CLOCK_PROCESS_CPUTIME_ID) { 253 pid_t pid = clock_id & CPUCLOCK_ID_MASK; 254 struct timeval cputime; 255 256 mutex_enter(&proc_lock); 257 p = pid == 0 ? curproc : proc_find(pid); 258 if (p == NULL) { 259 mutex_exit(&proc_lock); 260 return ESRCH; 261 } 262 mutex_enter(p->p_lock); 263 calcru(p, /*usertime*/NULL, /*systime*/NULL, /*intrtime*/NULL, 264 &cputime); 265 mutex_exit(p->p_lock); 266 mutex_exit(&proc_lock); 267 268 // XXX: Perhaps create a special kauth type 269 error = kauth_authorize_process(kauth_cred_get(), 270 KAUTH_PROCESS_PTRACE, p, 271 KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL); 272 if (error) 273 return error; 274 275 TIMEVAL_TO_TIMESPEC(&cputime, ts); 276 return 0; 277 } else if (clock_id & CLOCK_THREAD_CPUTIME_ID) { 278 struct lwp *l; 279 lwpid_t lid = clock_id & CPUCLOCK_ID_MASK; 280 struct bintime tm = {0, 0}; 281 282 p = curproc; 283 mutex_enter(p->p_lock); 284 l = lid == 0 ? curlwp : lwp_find(p, lid); 285 if (l == NULL) { 286 mutex_exit(p->p_lock); 287 return ESRCH; 288 } 289 addrulwp(l, &tm); 290 mutex_exit(p->p_lock); 291 292 bintime2timespec(&tm, ts); 293 return 0; 294 } 295 296 switch (clock_id) { 297 case CLOCK_REALTIME: 298 nanotime(ts); 299 break; 300 case CLOCK_MONOTONIC: 301 nanouptime(ts); 302 break; 303 default: 304 return EINVAL; 305 } 306 307 return 0; 308 } 309 310 /* 311 * Calculate delta and convert from struct timespec to the ticks. 312 */ 313 int 314 ts2timo(clockid_t clock_id, int flags, struct timespec *ts, 315 int *timo, struct timespec *start) 316 { 317 int error; 318 struct timespec tsd; 319 320 if (ts->tv_nsec < 0 || ts->tv_nsec >= 1000000000L) 321 return EINVAL; 322 323 if ((flags & TIMER_ABSTIME) != 0 || start != NULL) { 324 error = clock_gettime1(clock_id, &tsd); 325 if (error != 0) 326 return error; 327 if (start != NULL) 328 *start = tsd; 329 } 330 331 if ((flags & TIMER_ABSTIME) != 0) { 332 if (!timespecsubok(ts, &tsd)) 333 return EINVAL; 334 timespecsub(ts, &tsd, &tsd); 335 ts = &tsd; 336 } 337 338 error = itimespecfix(ts); 339 if (error != 0) 340 return error; 341 342 if (ts->tv_sec == 0 && ts->tv_nsec == 0) 343 return ETIMEDOUT; 344 345 *timo = tstohz(ts); 346 KASSERT(*timo > 0); 347 348 return 0; 349 } 350 351 bool 352 timespecaddok(const struct timespec *tsp, const struct timespec *usp) 353 { 354 enum { TIME_MIN = __type_min(time_t), TIME_MAX = __type_max(time_t) }; 355 time_t a = tsp->tv_sec; 356 time_t b = usp->tv_sec; 357 bool carry; 358 359 /* 360 * Caller is responsible for guaranteeing valid timespec 361 * inputs. Any user-controlled inputs must be validated or 362 * adjusted. 363 */ 364 KASSERT(tsp->tv_nsec >= 0); 365 KASSERT(usp->tv_nsec >= 0); 366 KASSERT(tsp->tv_nsec < 1000000000L); 367 KASSERT(usp->tv_nsec < 1000000000L); 368 CTASSERT(1000000000L <= __type_max(long) - 1000000000L); 369 370 /* 371 * Fail if a + b + carry overflows TIME_MAX, or if a + b 372 * overflows TIME_MIN because timespecadd adds the carry after 373 * computing a + b. 374 * 375 * Break it into two mutually exclusive and exhaustive cases: 376 * I. a >= 0 377 * II. a < 0 378 */ 379 carry = (tsp->tv_nsec + usp->tv_nsec >= 1000000000L); 380 if (a >= 0) { 381 /* 382 * Case I: a >= 0. If b < 0, then b + 1 <= 0, so 383 * 384 * a + b + 1 <= a + 0 <= TIME_MAX, 385 * 386 * and 387 * 388 * a + b >= 0 + b = b >= TIME_MIN, 389 * 390 * so this can't overflow. 391 * 392 * If b >= 0, then a + b + carry >= a + b >= 0, so 393 * negative results and thus results below TIME_MIN are 394 * impossible; we need only avoid 395 * 396 * a + b + carry > TIME_MAX, 397 * 398 * which we will do by rejecting if 399 * 400 * b > TIME_MAX - a - carry, 401 * 402 * which in turn is incidentally always false if b < 0 403 * so we don't need extra logic to discriminate on the 404 * b >= 0 and b < 0 cases. 405 * 406 * Since 0 <= a <= TIME_MAX, we know 407 * 408 * 0 <= TIME_MAX - a <= TIME_MAX, 409 * 410 * and hence 411 * 412 * -1 <= TIME_MAX - a - 1 < TIME_MAX. 413 * 414 * So we can compute TIME_MAX - a - carry (i.e., either 415 * TIME_MAX - a or TIME_MAX - a - 1) safely without 416 * overflow. 417 */ 418 if (b > TIME_MAX - a - carry) 419 return false; 420 } else { 421 /* 422 * Case II: a < 0. If b >= 0, then since a + 1 <= 0, 423 * we have 424 * 425 * a + b + 1 <= b <= TIME_MAX, 426 * 427 * and 428 * 429 * a + b >= a >= TIME_MIN, 430 * 431 * so this can't overflow. 432 * 433 * If b < 0, then the intermediate a + b is negative 434 * and the outcome a + b + 1 is nonpositive, so we need 435 * only avoid 436 * 437 * a + b < TIME_MIN, 438 * 439 * which we will do by rejecting if 440 * 441 * a < TIME_MIN - b. 442 * 443 * (Reminder: The carry is added afterward in 444 * timespecadd, so to avoid overflow it is not enough 445 * to merely reject a + b + carry < TIME_MIN.) 446 * 447 * It is safe to compute the difference TIME_MIN - b 448 * because b is negative, so the result lies in 449 * (TIME_MIN, 0]. 450 */ 451 if (b < 0 && a < TIME_MIN - b) 452 return false; 453 } 454 455 return true; 456 } 457 458 bool 459 timespecsubok(const struct timespec *tsp, const struct timespec *usp) 460 { 461 enum { TIME_MIN = __type_min(time_t), TIME_MAX = __type_max(time_t) }; 462 time_t a = tsp->tv_sec, b = usp->tv_sec; 463 bool borrow; 464 465 /* 466 * Caller is responsible for guaranteeing valid timespec 467 * inputs. Any user-controlled inputs must be validated or 468 * adjusted. 469 */ 470 KASSERT(tsp->tv_nsec >= 0); 471 KASSERT(usp->tv_nsec >= 0); 472 KASSERT(tsp->tv_nsec < 1000000000L); 473 KASSERT(usp->tv_nsec < 1000000000L); 474 CTASSERT(1000000000L <= __type_max(long) - 1000000000L); 475 476 /* 477 * Fail if a - b - borrow overflows TIME_MIN, or if a - b 478 * overflows TIME_MAX because timespecsub subtracts the borrow 479 * after computing a - b. 480 * 481 * Break it into two mutually exclusive and exhaustive cases: 482 * I. a < 0 483 * II. a >= 0 484 */ 485 borrow = (tsp->tv_nsec - usp->tv_nsec < 0); 486 if (a < 0) { 487 /* 488 * Case I: a < 0. If b < 0, then -b - 1 >= 0, so 489 * 490 * a - b - 1 >= a + 0 >= TIME_MIN, 491 * 492 * and, since a <= -1, provided that TIME_MIN <= 493 * -TIME_MAX - 1 so that TIME_MAX <= -TIME_MIN - 1 (in 494 * fact, equality holds, under the assumption of 495 * two's-complement arithmetic), 496 * 497 * a - b <= -1 - b = -b - 1 <= TIME_MAX, 498 * 499 * so this can't overflow. 500 */ 501 CTASSERT(TIME_MIN <= -TIME_MAX - 1); 502 503 /* 504 * If b >= 0, then a - b - borrow <= a - b < 0, so 505 * positive results and thus results above TIME_MAX are 506 * impossible; we need only avoid 507 * 508 * a - b - borrow < TIME_MIN, 509 * 510 * which we will do by rejecting if 511 * 512 * a < TIME_MIN + b + borrow. 513 * 514 * The right-hand side is safe to evaluate for any 515 * values of b and borrow as long as TIME_MIN + 516 * TIME_MAX + 1 <= TIME_MAX, i.e., TIME_MIN <= -1. 517 * (Note: If time_t were unsigned, this would fail!) 518 * 519 * Note: Unlike Case I in timespecaddok, this criterion 520 * does not work for b < 0, nor can the roles of a and 521 * b in the inequality be reversed (e.g., -b < TIME_MIN 522 * - a + borrow) without extra cases like checking for 523 * b = TEST_MIN. 524 */ 525 CTASSERT(TIME_MIN < -1); 526 if (b >= 0 && a < TIME_MIN + b + borrow) 527 return false; 528 } else { 529 /* 530 * Case II: a >= 0. If b >= 0, then 531 * 532 * a - b <= a <= TIME_MAX, 533 * 534 * and, provided TIME_MIN <= -TIME_MAX - 1 (in fact, 535 * equality holds, under the assumption of 536 * two's-complement arithmetic) 537 * 538 * a - b - 1 >= -b - 1 >= -TIME_MAX - 1 >= TIME_MIN, 539 * 540 * so this can't overflow. 541 */ 542 CTASSERT(TIME_MIN <= -TIME_MAX - 1); 543 544 /* 545 * If b < 0, then a - b >= a >= 0, so negative results 546 * and thus results below TIME_MIN are impossible; we 547 * need only avoid 548 * 549 * a - b > TIME_MAX, 550 * 551 * which we will do by rejecting if 552 * 553 * a > TIME_MAX + b. 554 * 555 * (Reminder: The borrow is subtracted afterward in 556 * timespecsub, so to avoid overflow it is not enough 557 * to merely reject a - b - borrow > TIME_MAX.) 558 * 559 * It is safe to compute the sum TIME_MAX + b because b 560 * is negative, so the result lies in [0, TIME_MAX). 561 */ 562 if (b < 0 && a > TIME_MAX + b) 563 return false; 564 } 565 566 return true; 567 } 568