1 | /* $NetBSD: kern_ntptime.c,v 1.57 2015/11/23 23:45:44 joerg Exp $ */ |
2 | |
3 | /*- |
4 | * Copyright (c) 2008 The NetBSD Foundation, Inc. |
5 | * All rights reserved. |
6 | * |
7 | * Redistribution and use in source and binary forms, with or without |
8 | * modification, are permitted provided that the following conditions |
9 | * are met: |
10 | * 1. Redistributions of source code must retain the above copyright |
11 | * notice, this list of conditions and the following disclaimer. |
12 | * 2. Redistributions in binary form must reproduce the above copyright |
13 | * notice, this list of conditions and the following disclaimer in the |
14 | * documentation and/or other materials provided with the distribution. |
15 | * |
16 | * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS |
17 | * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED |
18 | * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
19 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS |
20 | * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
21 | * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF |
22 | * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS |
23 | * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN |
24 | * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
25 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
26 | * POSSIBILITY OF SUCH DAMAGE. |
27 | */ |
28 | |
29 | /*- |
30 | *********************************************************************** |
31 | * * |
32 | * Copyright (c) David L. Mills 1993-2001 * |
33 | * * |
34 | * Permission to use, copy, modify, and distribute this software and * |
35 | * its documentation for any purpose and without fee is hereby * |
36 | * granted, provided that the above copyright notice appears in all * |
37 | * copies and that both the copyright notice and this permission * |
38 | * notice appear in supporting documentation, and that the name * |
39 | * University of Delaware not be used in advertising or publicity * |
40 | * pertaining to distribution of the software without specific, * |
41 | * written prior permission. The University of Delaware makes no * |
42 | * representations about the suitability this software for any * |
43 | * purpose. It is provided "as is" without express or implied * |
44 | * warranty. * |
45 | * * |
46 | **********************************************************************/ |
47 | |
48 | /* |
49 | * Adapted from the original sources for FreeBSD and timecounters by: |
50 | * Poul-Henning Kamp <phk@FreeBSD.org>. |
51 | * |
52 | * The 32bit version of the "LP" macros seems a bit past its "sell by" |
53 | * date so I have retained only the 64bit version and included it directly |
54 | * in this file. |
55 | * |
56 | * Only minor changes done to interface with the timecounters over in |
57 | * sys/kern/kern_clock.c. Some of the comments below may be (even more) |
58 | * confusing and/or plain wrong in that context. |
59 | */ |
60 | |
61 | #include <sys/cdefs.h> |
62 | /* __FBSDID("$FreeBSD: src/sys/kern/kern_ntptime.c,v 1.59 2005/05/28 14:34:41 rwatson Exp $"); */ |
63 | __KERNEL_RCSID(0, "$NetBSD: kern_ntptime.c,v 1.57 2015/11/23 23:45:44 joerg Exp $" ); |
64 | |
65 | #ifdef _KERNEL_OPT |
66 | #include "opt_ntp.h" |
67 | #endif |
68 | |
69 | #include <sys/param.h> |
70 | #include <sys/resourcevar.h> |
71 | #include <sys/systm.h> |
72 | #include <sys/kernel.h> |
73 | #include <sys/proc.h> |
74 | #include <sys/sysctl.h> |
75 | #include <sys/timex.h> |
76 | #include <sys/vnode.h> |
77 | #include <sys/kauth.h> |
78 | #include <sys/mount.h> |
79 | #include <sys/syscallargs.h> |
80 | #include <sys/cpu.h> |
81 | |
82 | #include <compat/sys/timex.h> |
83 | |
84 | /* |
85 | * Single-precision macros for 64-bit machines |
86 | */ |
87 | typedef int64_t l_fp; |
88 | #define L_ADD(v, u) ((v) += (u)) |
89 | #define L_SUB(v, u) ((v) -= (u)) |
90 | #define L_ADDHI(v, a) ((v) += (int64_t)(a) << 32) |
91 | #define L_NEG(v) ((v) = -(v)) |
92 | #define L_RSHIFT(v, n) \ |
93 | do { \ |
94 | if ((v) < 0) \ |
95 | (v) = -(-(v) >> (n)); \ |
96 | else \ |
97 | (v) = (v) >> (n); \ |
98 | } while (0) |
99 | #define L_MPY(v, a) ((v) *= (a)) |
100 | #define L_CLR(v) ((v) = 0) |
101 | #define L_ISNEG(v) ((v) < 0) |
102 | #define L_LINT(v, a) ((v) = (int64_t)((uint64_t)(a) << 32)) |
103 | #define L_GINT(v) ((v) < 0 ? -(-(v) >> 32) : (v) >> 32) |
104 | |
105 | #ifdef NTP |
106 | /* |
107 | * Generic NTP kernel interface |
108 | * |
109 | * These routines constitute the Network Time Protocol (NTP) interfaces |
110 | * for user and daemon application programs. The ntp_gettime() routine |
111 | * provides the time, maximum error (synch distance) and estimated error |
112 | * (dispersion) to client user application programs. The ntp_adjtime() |
113 | * routine is used by the NTP daemon to adjust the system clock to an |
114 | * externally derived time. The time offset and related variables set by |
115 | * this routine are used by other routines in this module to adjust the |
116 | * phase and frequency of the clock discipline loop which controls the |
117 | * system clock. |
118 | * |
119 | * When the kernel time is reckoned directly in nanoseconds (NTP_NANO |
120 | * defined), the time at each tick interrupt is derived directly from |
121 | * the kernel time variable. When the kernel time is reckoned in |
122 | * microseconds, (NTP_NANO undefined), the time is derived from the |
123 | * kernel time variable together with a variable representing the |
124 | * leftover nanoseconds at the last tick interrupt. In either case, the |
125 | * current nanosecond time is reckoned from these values plus an |
126 | * interpolated value derived by the clock routines in another |
127 | * architecture-specific module. The interpolation can use either a |
128 | * dedicated counter or a processor cycle counter (PCC) implemented in |
129 | * some architectures. |
130 | * |
131 | * Note that all routines must run at priority splclock or higher. |
132 | */ |
133 | /* |
134 | * Phase/frequency-lock loop (PLL/FLL) definitions |
135 | * |
136 | * The nanosecond clock discipline uses two variable types, time |
137 | * variables and frequency variables. Both types are represented as 64- |
138 | * bit fixed-point quantities with the decimal point between two 32-bit |
139 | * halves. On a 32-bit machine, each half is represented as a single |
140 | * word and mathematical operations are done using multiple-precision |
141 | * arithmetic. On a 64-bit machine, ordinary computer arithmetic is |
142 | * used. |
143 | * |
144 | * A time variable is a signed 64-bit fixed-point number in ns and |
145 | * fraction. It represents the remaining time offset to be amortized |
146 | * over succeeding tick interrupts. The maximum time offset is about |
147 | * 0.5 s and the resolution is about 2.3e-10 ns. |
148 | * |
149 | * 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 |
150 | * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
151 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
152 | * |s s s| ns | |
153 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
154 | * | fraction | |
155 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
156 | * |
157 | * A frequency variable is a signed 64-bit fixed-point number in ns/s |
158 | * and fraction. It represents the ns and fraction to be added to the |
159 | * kernel time variable at each second. The maximum frequency offset is |
160 | * about +-500000 ns/s and the resolution is about 2.3e-10 ns/s. |
161 | * |
162 | * 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 |
163 | * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
164 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
165 | * |s s s s s s s s s s s s s| ns/s | |
166 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
167 | * | fraction | |
168 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
169 | */ |
170 | /* |
171 | * The following variables establish the state of the PLL/FLL and the |
172 | * residual time and frequency offset of the local clock. |
173 | */ |
174 | #define SHIFT_PLL 4 /* PLL loop gain (shift) */ |
175 | #define SHIFT_FLL 2 /* FLL loop gain (shift) */ |
176 | |
177 | static int time_state = TIME_OK; /* clock state */ |
178 | static int time_status = STA_UNSYNC; /* clock status bits */ |
179 | static long time_tai; /* TAI offset (s) */ |
180 | static long time_monitor; /* last time offset scaled (ns) */ |
181 | static long time_constant; /* poll interval (shift) (s) */ |
182 | static long time_precision = 1; /* clock precision (ns) */ |
183 | static long time_maxerror = MAXPHASE / 1000; /* maximum error (us) */ |
184 | static long time_esterror = MAXPHASE / 1000; /* estimated error (us) */ |
185 | static time_t time_reftime; /* time at last adjustment (s) */ |
186 | static l_fp time_offset; /* time offset (ns) */ |
187 | static l_fp time_freq; /* frequency offset (ns/s) */ |
188 | #endif /* NTP */ |
189 | |
190 | static l_fp time_adj; /* tick adjust (ns/s) */ |
191 | int64_t time_adjtime; /* correction from adjtime(2) (usec) */ |
192 | |
193 | extern int time_adjusted; /* ntp might have changed the system time */ |
194 | |
195 | #ifdef NTP |
196 | #ifdef PPS_SYNC |
197 | /* |
198 | * The following variables are used when a pulse-per-second (PPS) signal |
199 | * is available and connected via a modem control lead. They establish |
200 | * the engineering parameters of the clock discipline loop when |
201 | * controlled by the PPS signal. |
202 | */ |
203 | #define PPS_FAVG 2 /* min freq avg interval (s) (shift) */ |
204 | #define PPS_FAVGDEF 8 /* default freq avg int (s) (shift) */ |
205 | #define PPS_FAVGMAX 15 /* max freq avg interval (s) (shift) */ |
206 | #define PPS_PAVG 4 /* phase avg interval (s) (shift) */ |
207 | #define PPS_VALID 120 /* PPS signal watchdog max (s) */ |
208 | #define PPS_MAXWANDER 100000 /* max PPS wander (ns/s) */ |
209 | #define PPS_POPCORN 2 /* popcorn spike threshold (shift) */ |
210 | |
211 | static struct timespec pps_tf[3]; /* phase median filter */ |
212 | static l_fp pps_freq; /* scaled frequency offset (ns/s) */ |
213 | static long pps_fcount; /* frequency accumulator */ |
214 | static long pps_jitter; /* nominal jitter (ns) */ |
215 | static long pps_stabil; /* nominal stability (scaled ns/s) */ |
216 | static long pps_lastsec; /* time at last calibration (s) */ |
217 | static int pps_valid; /* signal watchdog counter */ |
218 | static int pps_shift = PPS_FAVG; /* interval duration (s) (shift) */ |
219 | static int pps_shiftmax = PPS_FAVGDEF; /* max interval duration (s) (shift) */ |
220 | static int pps_intcnt; /* wander counter */ |
221 | |
222 | /* |
223 | * PPS signal quality monitors |
224 | */ |
225 | static long pps_calcnt; /* calibration intervals */ |
226 | static long pps_jitcnt; /* jitter limit exceeded */ |
227 | static long pps_stbcnt; /* stability limit exceeded */ |
228 | static long pps_errcnt; /* calibration errors */ |
229 | #endif /* PPS_SYNC */ |
230 | /* |
231 | * End of phase/frequency-lock loop (PLL/FLL) definitions |
232 | */ |
233 | |
234 | static void hardupdate(long offset); |
235 | |
236 | /* |
237 | * ntp_gettime() - NTP user application interface |
238 | */ |
239 | void |
240 | ntp_gettime(struct ntptimeval *ntv) |
241 | { |
242 | |
243 | mutex_spin_enter(&timecounter_lock); |
244 | nanotime(&ntv->time); |
245 | ntv->maxerror = time_maxerror; |
246 | ntv->esterror = time_esterror; |
247 | ntv->tai = time_tai; |
248 | ntv->time_state = time_state; |
249 | mutex_spin_exit(&timecounter_lock); |
250 | } |
251 | |
252 | /* ARGSUSED */ |
253 | /* |
254 | * ntp_adjtime() - NTP daemon application interface |
255 | */ |
256 | int |
257 | sys_ntp_adjtime(struct lwp *l, const struct sys_ntp_adjtime_args *uap, register_t *retval) |
258 | { |
259 | /* { |
260 | syscallarg(struct timex *) tp; |
261 | } */ |
262 | struct timex ntv; |
263 | int error; |
264 | |
265 | error = copyin((void *)SCARG(uap, tp), (void *)&ntv, sizeof(ntv)); |
266 | if (error != 0) |
267 | return (error); |
268 | |
269 | if (ntv.modes != 0 && (error = kauth_authorize_system(l->l_cred, |
270 | KAUTH_SYSTEM_TIME, KAUTH_REQ_SYSTEM_TIME_NTPADJTIME, NULL, |
271 | NULL, NULL)) != 0) |
272 | return (error); |
273 | |
274 | ntp_adjtime1(&ntv); |
275 | |
276 | error = copyout((void *)&ntv, (void *)SCARG(uap, tp), sizeof(ntv)); |
277 | if (!error) |
278 | *retval = ntp_timestatus(); |
279 | |
280 | return error; |
281 | } |
282 | |
283 | void |
284 | ntp_adjtime1(struct timex *ntv) |
285 | { |
286 | long freq; |
287 | int modes; |
288 | |
289 | /* |
290 | * Update selected clock variables - only the superuser can |
291 | * change anything. Note that there is no error checking here on |
292 | * the assumption the superuser should know what it is doing. |
293 | * Note that either the time constant or TAI offset are loaded |
294 | * from the ntv.constant member, depending on the mode bits. If |
295 | * the STA_PLL bit in the status word is cleared, the state and |
296 | * status words are reset to the initial values at boot. |
297 | */ |
298 | mutex_spin_enter(&timecounter_lock); |
299 | modes = ntv->modes; |
300 | if (modes != 0) |
301 | /* We need to save the system time during shutdown */ |
302 | time_adjusted |= 2; |
303 | if (modes & MOD_MAXERROR) |
304 | time_maxerror = ntv->maxerror; |
305 | if (modes & MOD_ESTERROR) |
306 | time_esterror = ntv->esterror; |
307 | if (modes & MOD_STATUS) { |
308 | if (time_status & STA_PLL && !(ntv->status & STA_PLL)) { |
309 | time_state = TIME_OK; |
310 | time_status = STA_UNSYNC; |
311 | #ifdef PPS_SYNC |
312 | pps_shift = PPS_FAVG; |
313 | #endif /* PPS_SYNC */ |
314 | } |
315 | time_status &= STA_RONLY; |
316 | time_status |= ntv->status & ~STA_RONLY; |
317 | } |
318 | if (modes & MOD_TIMECONST) { |
319 | if (ntv->constant < 0) |
320 | time_constant = 0; |
321 | else if (ntv->constant > MAXTC) |
322 | time_constant = MAXTC; |
323 | else |
324 | time_constant = ntv->constant; |
325 | } |
326 | if (modes & MOD_TAI) { |
327 | if (ntv->constant > 0) /* XXX zero & negative numbers ? */ |
328 | time_tai = ntv->constant; |
329 | } |
330 | #ifdef PPS_SYNC |
331 | if (modes & MOD_PPSMAX) { |
332 | if (ntv->shift < PPS_FAVG) |
333 | pps_shiftmax = PPS_FAVG; |
334 | else if (ntv->shift > PPS_FAVGMAX) |
335 | pps_shiftmax = PPS_FAVGMAX; |
336 | else |
337 | pps_shiftmax = ntv->shift; |
338 | } |
339 | #endif /* PPS_SYNC */ |
340 | if (modes & MOD_NANO) |
341 | time_status |= STA_NANO; |
342 | if (modes & MOD_MICRO) |
343 | time_status &= ~STA_NANO; |
344 | if (modes & MOD_CLKB) |
345 | time_status |= STA_CLK; |
346 | if (modes & MOD_CLKA) |
347 | time_status &= ~STA_CLK; |
348 | if (modes & MOD_FREQUENCY) { |
349 | freq = (ntv->freq * 1000LL) >> 16; |
350 | if (freq > MAXFREQ) |
351 | L_LINT(time_freq, MAXFREQ); |
352 | else if (freq < -MAXFREQ) |
353 | L_LINT(time_freq, -MAXFREQ); |
354 | else { |
355 | /* |
356 | * ntv.freq is [PPM * 2^16] = [us/s * 2^16] |
357 | * time_freq is [ns/s * 2^32] |
358 | */ |
359 | time_freq = ntv->freq * 1000LL * 65536LL; |
360 | } |
361 | #ifdef PPS_SYNC |
362 | pps_freq = time_freq; |
363 | #endif /* PPS_SYNC */ |
364 | } |
365 | if (modes & MOD_OFFSET) { |
366 | if (time_status & STA_NANO) |
367 | hardupdate(ntv->offset); |
368 | else |
369 | hardupdate(ntv->offset * 1000); |
370 | } |
371 | |
372 | /* |
373 | * Retrieve all clock variables. Note that the TAI offset is |
374 | * returned only by ntp_gettime(); |
375 | */ |
376 | if (time_status & STA_NANO) |
377 | ntv->offset = L_GINT(time_offset); |
378 | else |
379 | ntv->offset = L_GINT(time_offset) / 1000; /* XXX rounding ? */ |
380 | ntv->freq = L_GINT((time_freq / 1000LL) << 16); |
381 | ntv->maxerror = time_maxerror; |
382 | ntv->esterror = time_esterror; |
383 | ntv->status = time_status; |
384 | ntv->constant = time_constant; |
385 | if (time_status & STA_NANO) |
386 | ntv->precision = time_precision; |
387 | else |
388 | ntv->precision = time_precision / 1000; |
389 | ntv->tolerance = MAXFREQ * SCALE_PPM; |
390 | #ifdef PPS_SYNC |
391 | ntv->shift = pps_shift; |
392 | ntv->ppsfreq = L_GINT((pps_freq / 1000LL) << 16); |
393 | if (time_status & STA_NANO) |
394 | ntv->jitter = pps_jitter; |
395 | else |
396 | ntv->jitter = pps_jitter / 1000; |
397 | ntv->stabil = pps_stabil; |
398 | ntv->calcnt = pps_calcnt; |
399 | ntv->errcnt = pps_errcnt; |
400 | ntv->jitcnt = pps_jitcnt; |
401 | ntv->stbcnt = pps_stbcnt; |
402 | #endif /* PPS_SYNC */ |
403 | mutex_spin_exit(&timecounter_lock); |
404 | } |
405 | #endif /* NTP */ |
406 | |
407 | /* |
408 | * second_overflow() - called after ntp_tick_adjust() |
409 | * |
410 | * This routine is ordinarily called immediately following the above |
411 | * routine ntp_tick_adjust(). While these two routines are normally |
412 | * combined, they are separated here only for the purposes of |
413 | * simulation. |
414 | */ |
415 | void |
416 | ntp_update_second(int64_t *adjustment, time_t *newsec) |
417 | { |
418 | int tickrate; |
419 | l_fp ftemp; /* 32/64-bit temporary */ |
420 | |
421 | KASSERT(mutex_owned(&timecounter_lock)); |
422 | |
423 | #ifdef NTP |
424 | |
425 | /* |
426 | * On rollover of the second both the nanosecond and microsecond |
427 | * clocks are updated and the state machine cranked as |
428 | * necessary. The phase adjustment to be used for the next |
429 | * second is calculated and the maximum error is increased by |
430 | * the tolerance. |
431 | */ |
432 | time_maxerror += MAXFREQ / 1000; |
433 | |
434 | /* |
435 | * Leap second processing. If in leap-insert state at |
436 | * the end of the day, the system clock is set back one |
437 | * second; if in leap-delete state, the system clock is |
438 | * set ahead one second. The nano_time() routine or |
439 | * external clock driver will insure that reported time |
440 | * is always monotonic. |
441 | */ |
442 | switch (time_state) { |
443 | |
444 | /* |
445 | * No warning. |
446 | */ |
447 | case TIME_OK: |
448 | if (time_status & STA_INS) |
449 | time_state = TIME_INS; |
450 | else if (time_status & STA_DEL) |
451 | time_state = TIME_DEL; |
452 | break; |
453 | |
454 | /* |
455 | * Insert second 23:59:60 following second |
456 | * 23:59:59. |
457 | */ |
458 | case TIME_INS: |
459 | if (!(time_status & STA_INS)) |
460 | time_state = TIME_OK; |
461 | else if ((*newsec) % 86400 == 0) { |
462 | (*newsec)--; |
463 | time_state = TIME_OOP; |
464 | time_tai++; |
465 | } |
466 | break; |
467 | |
468 | /* |
469 | * Delete second 23:59:59. |
470 | */ |
471 | case TIME_DEL: |
472 | if (!(time_status & STA_DEL)) |
473 | time_state = TIME_OK; |
474 | else if (((*newsec) + 1) % 86400 == 0) { |
475 | (*newsec)++; |
476 | time_tai--; |
477 | time_state = TIME_WAIT; |
478 | } |
479 | break; |
480 | |
481 | /* |
482 | * Insert second in progress. |
483 | */ |
484 | case TIME_OOP: |
485 | time_state = TIME_WAIT; |
486 | break; |
487 | |
488 | /* |
489 | * Wait for status bits to clear. |
490 | */ |
491 | case TIME_WAIT: |
492 | if (!(time_status & (STA_INS | STA_DEL))) |
493 | time_state = TIME_OK; |
494 | } |
495 | |
496 | /* |
497 | * Compute the total time adjustment for the next second |
498 | * in ns. The offset is reduced by a factor depending on |
499 | * whether the PPS signal is operating. Note that the |
500 | * value is in effect scaled by the clock frequency, |
501 | * since the adjustment is added at each tick interrupt. |
502 | */ |
503 | ftemp = time_offset; |
504 | #ifdef PPS_SYNC |
505 | /* XXX even if PPS signal dies we should finish adjustment ? */ |
506 | if (time_status & STA_PPSTIME && time_status & |
507 | STA_PPSSIGNAL) |
508 | L_RSHIFT(ftemp, pps_shift); |
509 | else |
510 | L_RSHIFT(ftemp, SHIFT_PLL + time_constant); |
511 | #else |
512 | L_RSHIFT(ftemp, SHIFT_PLL + time_constant); |
513 | #endif /* PPS_SYNC */ |
514 | time_adj = ftemp; |
515 | L_SUB(time_offset, ftemp); |
516 | L_ADD(time_adj, time_freq); |
517 | |
518 | #ifdef PPS_SYNC |
519 | if (pps_valid > 0) |
520 | pps_valid--; |
521 | else |
522 | time_status &= ~STA_PPSSIGNAL; |
523 | #endif /* PPS_SYNC */ |
524 | #else /* !NTP */ |
525 | L_CLR(time_adj); |
526 | #endif /* !NTP */ |
527 | |
528 | /* |
529 | * Apply any correction from adjtime(2). If more than one second |
530 | * off we slew at a rate of 5ms/s (5000 PPM) else 500us/s (500PPM) |
531 | * until the last second is slewed the final < 500 usecs. |
532 | */ |
533 | if (time_adjtime != 0) { |
534 | if (time_adjtime > 1000000) |
535 | tickrate = 5000; |
536 | else if (time_adjtime < -1000000) |
537 | tickrate = -5000; |
538 | else if (time_adjtime > 500) |
539 | tickrate = 500; |
540 | else if (time_adjtime < -500) |
541 | tickrate = -500; |
542 | else |
543 | tickrate = time_adjtime; |
544 | time_adjtime -= tickrate; |
545 | L_LINT(ftemp, tickrate * 1000); |
546 | L_ADD(time_adj, ftemp); |
547 | } |
548 | *adjustment = time_adj; |
549 | } |
550 | |
551 | /* |
552 | * ntp_init() - initialize variables and structures |
553 | * |
554 | * This routine must be called after the kernel variables hz and tick |
555 | * are set or changed and before the next tick interrupt. In this |
556 | * particular implementation, these values are assumed set elsewhere in |
557 | * the kernel. The design allows the clock frequency and tick interval |
558 | * to be changed while the system is running. So, this routine should |
559 | * probably be integrated with the code that does that. |
560 | */ |
561 | void |
562 | ntp_init(void) |
563 | { |
564 | |
565 | /* |
566 | * The following variables are initialized only at startup. Only |
567 | * those structures not cleared by the compiler need to be |
568 | * initialized, and these only in the simulator. In the actual |
569 | * kernel, any nonzero values here will quickly evaporate. |
570 | */ |
571 | L_CLR(time_adj); |
572 | #ifdef NTP |
573 | L_CLR(time_offset); |
574 | L_CLR(time_freq); |
575 | #ifdef PPS_SYNC |
576 | pps_tf[0].tv_sec = pps_tf[0].tv_nsec = 0; |
577 | pps_tf[1].tv_sec = pps_tf[1].tv_nsec = 0; |
578 | pps_tf[2].tv_sec = pps_tf[2].tv_nsec = 0; |
579 | pps_fcount = 0; |
580 | L_CLR(pps_freq); |
581 | #endif /* PPS_SYNC */ |
582 | #endif |
583 | } |
584 | |
585 | #ifdef NTP |
586 | /* |
587 | * hardupdate() - local clock update |
588 | * |
589 | * This routine is called by ntp_adjtime() to update the local clock |
590 | * phase and frequency. The implementation is of an adaptive-parameter, |
591 | * hybrid phase/frequency-lock loop (PLL/FLL). The routine computes new |
592 | * time and frequency offset estimates for each call. If the kernel PPS |
593 | * discipline code is configured (PPS_SYNC), the PPS signal itself |
594 | * determines the new time offset, instead of the calling argument. |
595 | * Presumably, calls to ntp_adjtime() occur only when the caller |
596 | * believes the local clock is valid within some bound (+-128 ms with |
597 | * NTP). If the caller's time is far different than the PPS time, an |
598 | * argument will ensue, and it's not clear who will lose. |
599 | * |
600 | * For uncompensated quartz crystal oscillators and nominal update |
601 | * intervals less than 256 s, operation should be in phase-lock mode, |
602 | * where the loop is disciplined to phase. For update intervals greater |
603 | * than 1024 s, operation should be in frequency-lock mode, where the |
604 | * loop is disciplined to frequency. Between 256 s and 1024 s, the mode |
605 | * is selected by the STA_MODE status bit. |
606 | * |
607 | * Note: splclock() is in effect. |
608 | */ |
609 | void |
610 | hardupdate(long offset) |
611 | { |
612 | long mtemp; |
613 | l_fp ftemp; |
614 | |
615 | KASSERT(mutex_owned(&timecounter_lock)); |
616 | |
617 | /* |
618 | * Select how the phase is to be controlled and from which |
619 | * source. If the PPS signal is present and enabled to |
620 | * discipline the time, the PPS offset is used; otherwise, the |
621 | * argument offset is used. |
622 | */ |
623 | if (!(time_status & STA_PLL)) |
624 | return; |
625 | if (!(time_status & STA_PPSTIME && time_status & |
626 | STA_PPSSIGNAL)) { |
627 | if (offset > MAXPHASE) |
628 | time_monitor = MAXPHASE; |
629 | else if (offset < -MAXPHASE) |
630 | time_monitor = -MAXPHASE; |
631 | else |
632 | time_monitor = offset; |
633 | L_LINT(time_offset, time_monitor); |
634 | } |
635 | |
636 | /* |
637 | * Select how the frequency is to be controlled and in which |
638 | * mode (PLL or FLL). If the PPS signal is present and enabled |
639 | * to discipline the frequency, the PPS frequency is used; |
640 | * otherwise, the argument offset is used to compute it. |
641 | */ |
642 | if (time_status & STA_PPSFREQ && time_status & STA_PPSSIGNAL) { |
643 | time_reftime = time_second; |
644 | return; |
645 | } |
646 | if (time_status & STA_FREQHOLD || time_reftime == 0) |
647 | time_reftime = time_second; |
648 | mtemp = time_second - time_reftime; |
649 | L_LINT(ftemp, time_monitor); |
650 | L_RSHIFT(ftemp, (SHIFT_PLL + 2 + time_constant) << 1); |
651 | L_MPY(ftemp, mtemp); |
652 | L_ADD(time_freq, ftemp); |
653 | time_status &= ~STA_MODE; |
654 | if (mtemp >= MINSEC && (time_status & STA_FLL || mtemp > |
655 | MAXSEC)) { |
656 | L_LINT(ftemp, (time_monitor << 4) / mtemp); |
657 | L_RSHIFT(ftemp, SHIFT_FLL + 4); |
658 | L_ADD(time_freq, ftemp); |
659 | time_status |= STA_MODE; |
660 | } |
661 | time_reftime = time_second; |
662 | if (L_GINT(time_freq) > MAXFREQ) |
663 | L_LINT(time_freq, MAXFREQ); |
664 | else if (L_GINT(time_freq) < -MAXFREQ) |
665 | L_LINT(time_freq, -MAXFREQ); |
666 | } |
667 | |
668 | #ifdef PPS_SYNC |
669 | /* |
670 | * hardpps() - discipline CPU clock oscillator to external PPS signal |
671 | * |
672 | * This routine is called at each PPS interrupt in order to discipline |
673 | * the CPU clock oscillator to the PPS signal. It measures the PPS phase |
674 | * and leaves it in a handy spot for the hardclock() routine. It |
675 | * integrates successive PPS phase differences and calculates the |
676 | * frequency offset. This is used in hardclock() to discipline the CPU |
677 | * clock oscillator so that intrinsic frequency error is cancelled out. |
678 | * The code requires the caller to capture the time and hardware counter |
679 | * value at the on-time PPS signal transition. |
680 | * |
681 | * Note that, on some Unix systems, this routine runs at an interrupt |
682 | * priority level higher than the timer interrupt routine hardclock(). |
683 | * Therefore, the variables used are distinct from the hardclock() |
684 | * variables, except for certain exceptions: The PPS frequency pps_freq |
685 | * and phase pps_offset variables are determined by this routine and |
686 | * updated atomically. The time_tolerance variable can be considered a |
687 | * constant, since it is infrequently changed, and then only when the |
688 | * PPS signal is disabled. The watchdog counter pps_valid is updated |
689 | * once per second by hardclock() and is atomically cleared in this |
690 | * routine. |
691 | */ |
692 | void |
693 | hardpps(struct timespec *tsp, /* time at PPS */ |
694 | long nsec /* hardware counter at PPS */) |
695 | { |
696 | long u_sec, u_nsec, v_nsec; /* temps */ |
697 | l_fp ftemp; |
698 | |
699 | KASSERT(mutex_owned(&timecounter_lock)); |
700 | |
701 | /* |
702 | * The signal is first processed by a range gate and frequency |
703 | * discriminator. The range gate rejects noise spikes outside |
704 | * the range +-500 us. The frequency discriminator rejects input |
705 | * signals with apparent frequency outside the range 1 +-500 |
706 | * PPM. If two hits occur in the same second, we ignore the |
707 | * later hit; if not and a hit occurs outside the range gate, |
708 | * keep the later hit for later comparison, but do not process |
709 | * it. |
710 | */ |
711 | time_status |= STA_PPSSIGNAL | STA_PPSJITTER; |
712 | time_status &= ~(STA_PPSWANDER | STA_PPSERROR); |
713 | pps_valid = PPS_VALID; |
714 | u_sec = tsp->tv_sec; |
715 | u_nsec = tsp->tv_nsec; |
716 | if (u_nsec >= (NANOSECOND >> 1)) { |
717 | u_nsec -= NANOSECOND; |
718 | u_sec++; |
719 | } |
720 | v_nsec = u_nsec - pps_tf[0].tv_nsec; |
721 | if (u_sec == pps_tf[0].tv_sec && v_nsec < NANOSECOND - |
722 | MAXFREQ) |
723 | return; |
724 | pps_tf[2] = pps_tf[1]; |
725 | pps_tf[1] = pps_tf[0]; |
726 | pps_tf[0].tv_sec = u_sec; |
727 | pps_tf[0].tv_nsec = u_nsec; |
728 | |
729 | /* |
730 | * Compute the difference between the current and previous |
731 | * counter values. If the difference exceeds 0.5 s, assume it |
732 | * has wrapped around, so correct 1.0 s. If the result exceeds |
733 | * the tick interval, the sample point has crossed a tick |
734 | * boundary during the last second, so correct the tick. Very |
735 | * intricate. |
736 | */ |
737 | u_nsec = nsec; |
738 | if (u_nsec > (NANOSECOND >> 1)) |
739 | u_nsec -= NANOSECOND; |
740 | else if (u_nsec < -(NANOSECOND >> 1)) |
741 | u_nsec += NANOSECOND; |
742 | pps_fcount += u_nsec; |
743 | if (v_nsec > MAXFREQ || v_nsec < -MAXFREQ) |
744 | return; |
745 | time_status &= ~STA_PPSJITTER; |
746 | |
747 | /* |
748 | * A three-stage median filter is used to help denoise the PPS |
749 | * time. The median sample becomes the time offset estimate; the |
750 | * difference between the other two samples becomes the time |
751 | * dispersion (jitter) estimate. |
752 | */ |
753 | if (pps_tf[0].tv_nsec > pps_tf[1].tv_nsec) { |
754 | if (pps_tf[1].tv_nsec > pps_tf[2].tv_nsec) { |
755 | v_nsec = pps_tf[1].tv_nsec; /* 0 1 2 */ |
756 | u_nsec = pps_tf[0].tv_nsec - pps_tf[2].tv_nsec; |
757 | } else if (pps_tf[2].tv_nsec > pps_tf[0].tv_nsec) { |
758 | v_nsec = pps_tf[0].tv_nsec; /* 2 0 1 */ |
759 | u_nsec = pps_tf[2].tv_nsec - pps_tf[1].tv_nsec; |
760 | } else { |
761 | v_nsec = pps_tf[2].tv_nsec; /* 0 2 1 */ |
762 | u_nsec = pps_tf[0].tv_nsec - pps_tf[1].tv_nsec; |
763 | } |
764 | } else { |
765 | if (pps_tf[1].tv_nsec < pps_tf[2].tv_nsec) { |
766 | v_nsec = pps_tf[1].tv_nsec; /* 2 1 0 */ |
767 | u_nsec = pps_tf[2].tv_nsec - pps_tf[0].tv_nsec; |
768 | } else if (pps_tf[2].tv_nsec < pps_tf[0].tv_nsec) { |
769 | v_nsec = pps_tf[0].tv_nsec; /* 1 0 2 */ |
770 | u_nsec = pps_tf[1].tv_nsec - pps_tf[2].tv_nsec; |
771 | } else { |
772 | v_nsec = pps_tf[2].tv_nsec; /* 1 2 0 */ |
773 | u_nsec = pps_tf[1].tv_nsec - pps_tf[0].tv_nsec; |
774 | } |
775 | } |
776 | |
777 | /* |
778 | * Nominal jitter is due to PPS signal noise and interrupt |
779 | * latency. If it exceeds the popcorn threshold, the sample is |
780 | * discarded. otherwise, if so enabled, the time offset is |
781 | * updated. We can tolerate a modest loss of data here without |
782 | * much degrading time accuracy. |
783 | */ |
784 | if (u_nsec > (pps_jitter << PPS_POPCORN)) { |
785 | time_status |= STA_PPSJITTER; |
786 | pps_jitcnt++; |
787 | } else if (time_status & STA_PPSTIME) { |
788 | time_monitor = -v_nsec; |
789 | L_LINT(time_offset, time_monitor); |
790 | } |
791 | pps_jitter += (u_nsec - pps_jitter) >> PPS_FAVG; |
792 | u_sec = pps_tf[0].tv_sec - pps_lastsec; |
793 | if (u_sec < (1 << pps_shift)) |
794 | return; |
795 | |
796 | /* |
797 | * At the end of the calibration interval the difference between |
798 | * the first and last counter values becomes the scaled |
799 | * frequency. It will later be divided by the length of the |
800 | * interval to determine the frequency update. If the frequency |
801 | * exceeds a sanity threshold, or if the actual calibration |
802 | * interval is not equal to the expected length, the data are |
803 | * discarded. We can tolerate a modest loss of data here without |
804 | * much degrading frequency accuracy. |
805 | */ |
806 | pps_calcnt++; |
807 | v_nsec = -pps_fcount; |
808 | pps_lastsec = pps_tf[0].tv_sec; |
809 | pps_fcount = 0; |
810 | u_nsec = MAXFREQ << pps_shift; |
811 | if (v_nsec > u_nsec || v_nsec < -u_nsec || u_sec != (1 << |
812 | pps_shift)) { |
813 | time_status |= STA_PPSERROR; |
814 | pps_errcnt++; |
815 | return; |
816 | } |
817 | |
818 | /* |
819 | * Here the raw frequency offset and wander (stability) is |
820 | * calculated. If the wander is less than the wander threshold |
821 | * for four consecutive averaging intervals, the interval is |
822 | * doubled; if it is greater than the threshold for four |
823 | * consecutive intervals, the interval is halved. The scaled |
824 | * frequency offset is converted to frequency offset. The |
825 | * stability metric is calculated as the average of recent |
826 | * frequency changes, but is used only for performance |
827 | * monitoring. |
828 | */ |
829 | L_LINT(ftemp, v_nsec); |
830 | L_RSHIFT(ftemp, pps_shift); |
831 | L_SUB(ftemp, pps_freq); |
832 | u_nsec = L_GINT(ftemp); |
833 | if (u_nsec > PPS_MAXWANDER) { |
834 | L_LINT(ftemp, PPS_MAXWANDER); |
835 | pps_intcnt--; |
836 | time_status |= STA_PPSWANDER; |
837 | pps_stbcnt++; |
838 | } else if (u_nsec < -PPS_MAXWANDER) { |
839 | L_LINT(ftemp, -PPS_MAXWANDER); |
840 | pps_intcnt--; |
841 | time_status |= STA_PPSWANDER; |
842 | pps_stbcnt++; |
843 | } else { |
844 | pps_intcnt++; |
845 | } |
846 | if (pps_intcnt >= 4) { |
847 | pps_intcnt = 4; |
848 | if (pps_shift < pps_shiftmax) { |
849 | pps_shift++; |
850 | pps_intcnt = 0; |
851 | } |
852 | } else if (pps_intcnt <= -4 || pps_shift > pps_shiftmax) { |
853 | pps_intcnt = -4; |
854 | if (pps_shift > PPS_FAVG) { |
855 | pps_shift--; |
856 | pps_intcnt = 0; |
857 | } |
858 | } |
859 | if (u_nsec < 0) |
860 | u_nsec = -u_nsec; |
861 | pps_stabil += (u_nsec * SCALE_PPM - pps_stabil) >> PPS_FAVG; |
862 | |
863 | /* |
864 | * The PPS frequency is recalculated and clamped to the maximum |
865 | * MAXFREQ. If enabled, the system clock frequency is updated as |
866 | * well. |
867 | */ |
868 | L_ADD(pps_freq, ftemp); |
869 | u_nsec = L_GINT(pps_freq); |
870 | if (u_nsec > MAXFREQ) |
871 | L_LINT(pps_freq, MAXFREQ); |
872 | else if (u_nsec < -MAXFREQ) |
873 | L_LINT(pps_freq, -MAXFREQ); |
874 | if (time_status & STA_PPSFREQ) |
875 | time_freq = pps_freq; |
876 | } |
877 | #endif /* PPS_SYNC */ |
878 | #endif /* NTP */ |
879 | |
880 | #ifdef NTP |
881 | int |
882 | ntp_timestatus(void) |
883 | { |
884 | int rv; |
885 | |
886 | /* |
887 | * Status word error decode. If any of these conditions |
888 | * occur, an error is returned, instead of the status |
889 | * word. Most applications will care only about the fact |
890 | * the system clock may not be trusted, not about the |
891 | * details. |
892 | * |
893 | * Hardware or software error |
894 | */ |
895 | mutex_spin_enter(&timecounter_lock); |
896 | if ((time_status & (STA_UNSYNC | STA_CLOCKERR)) || |
897 | |
898 | /* |
899 | * PPS signal lost when either time or frequency |
900 | * synchronization requested |
901 | */ |
902 | (time_status & (STA_PPSFREQ | STA_PPSTIME) && |
903 | !(time_status & STA_PPSSIGNAL)) || |
904 | |
905 | /* |
906 | * PPS jitter exceeded when time synchronization |
907 | * requested |
908 | */ |
909 | (time_status & STA_PPSTIME && |
910 | time_status & STA_PPSJITTER) || |
911 | |
912 | /* |
913 | * PPS wander exceeded or calibration error when |
914 | * frequency synchronization requested |
915 | */ |
916 | (time_status & STA_PPSFREQ && |
917 | time_status & (STA_PPSWANDER | STA_PPSERROR))) |
918 | rv = TIME_ERROR; |
919 | else |
920 | rv = time_state; |
921 | mutex_spin_exit(&timecounter_lock); |
922 | |
923 | return rv; |
924 | } |
925 | |
926 | /*ARGSUSED*/ |
927 | /* |
928 | * ntp_gettime() - NTP user application interface |
929 | */ |
930 | int |
931 | sys___ntp_gettime50(struct lwp *l, const struct sys___ntp_gettime50_args *uap, register_t *retval) |
932 | { |
933 | /* { |
934 | syscallarg(struct ntptimeval *) ntvp; |
935 | } */ |
936 | struct ntptimeval ntv; |
937 | int error = 0; |
938 | |
939 | if (SCARG(uap, ntvp)) { |
940 | ntp_gettime(&ntv); |
941 | |
942 | error = copyout((void *)&ntv, (void *)SCARG(uap, ntvp), |
943 | sizeof(ntv)); |
944 | } |
945 | if (!error) { |
946 | *retval = ntp_timestatus(); |
947 | } |
948 | return(error); |
949 | } |
950 | |
951 | /* |
952 | * return information about kernel precision timekeeping |
953 | */ |
954 | static int |
955 | sysctl_kern_ntptime(SYSCTLFN_ARGS) |
956 | { |
957 | struct sysctlnode node; |
958 | struct ntptimeval ntv; |
959 | |
960 | ntp_gettime(&ntv); |
961 | |
962 | node = *rnode; |
963 | node.sysctl_data = &ntv; |
964 | node.sysctl_size = sizeof(ntv); |
965 | return (sysctl_lookup(SYSCTLFN_CALL(&node))); |
966 | } |
967 | |
968 | SYSCTL_SETUP(sysctl_kern_ntptime_setup, "sysctl kern.ntptime node setup" ) |
969 | { |
970 | |
971 | sysctl_createv(clog, 0, NULL, NULL, |
972 | CTLFLAG_PERMANENT, |
973 | CTLTYPE_STRUCT, "ntptime" , |
974 | SYSCTL_DESCR("Kernel clock values for NTP" ), |
975 | sysctl_kern_ntptime, 0, NULL, |
976 | sizeof(struct ntptimeval), |
977 | CTL_KERN, KERN_NTPTIME, CTL_EOL); |
978 | } |
979 | #endif /* !NTP */ |
980 | |