xref: /freebsd/sys/kern/kern_ntptime.c (revision 78007886c995898a9494648343e5236bca1cbba3)
1 /*-
2  ***********************************************************************
3  *								       *
4  * Copyright (c) David L. Mills 1993-2001			       *
5  *								       *
6  * Permission to use, copy, modify, and distribute this software and   *
7  * its documentation for any purpose and without fee is hereby	       *
8  * granted, provided that the above copyright notice appears in all    *
9  * copies and that both the copyright notice and this permission       *
10  * notice appear in supporting documentation, and that the name	       *
11  * University of Delaware not be used in advertising or publicity      *
12  * pertaining to distribution of the software without specific,	       *
13  * written prior permission. The University of Delaware makes no       *
14  * representations about the suitability this software for any	       *
15  * purpose. It is provided "as is" without express or implied	       *
16  * warranty.							       *
17  *								       *
18  **********************************************************************/
19 
20 /*
21  * Adapted from the original sources for FreeBSD and timecounters by:
22  * Poul-Henning Kamp <phk@FreeBSD.org>.
23  *
24  * The 32bit version of the "LP" macros seems a bit past its "sell by"
25  * date so I have retained only the 64bit version and included it directly
26  * in this file.
27  *
28  * Only minor changes done to interface with the timecounters over in
29  * sys/kern/kern_clock.c.   Some of the comments below may be (even more)
30  * confusing and/or plain wrong in that context.
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #include "opt_ntp.h"
37 
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/sysproto.h>
41 #include <sys/kernel.h>
42 #include <sys/priv.h>
43 #include <sys/proc.h>
44 #include <sys/lock.h>
45 #include <sys/mutex.h>
46 #include <sys/time.h>
47 #include <sys/timex.h>
48 #include <sys/timetc.h>
49 #include <sys/timepps.h>
50 #include <sys/syscallsubr.h>
51 #include <sys/sysctl.h>
52 
53 /*
54  * Single-precision macros for 64-bit machines
55  */
56 typedef int64_t l_fp;
57 #define L_ADD(v, u)	((v) += (u))
58 #define L_SUB(v, u)	((v) -= (u))
59 #define L_ADDHI(v, a)	((v) += (int64_t)(a) << 32)
60 #define L_NEG(v)	((v) = -(v))
61 #define L_RSHIFT(v, n) \
62 	do { \
63 		if ((v) < 0) \
64 			(v) = -(-(v) >> (n)); \
65 		else \
66 			(v) = (v) >> (n); \
67 	} while (0)
68 #define L_MPY(v, a)	((v) *= (a))
69 #define L_CLR(v)	((v) = 0)
70 #define L_ISNEG(v)	((v) < 0)
71 #define L_LINT(v, a)	((v) = (int64_t)(a) << 32)
72 #define L_GINT(v)	((v) < 0 ? -(-(v) >> 32) : (v) >> 32)
73 
74 /*
75  * Generic NTP kernel interface
76  *
77  * These routines constitute the Network Time Protocol (NTP) interfaces
78  * for user and daemon application programs. The ntp_gettime() routine
79  * provides the time, maximum error (synch distance) and estimated error
80  * (dispersion) to client user application programs. The ntp_adjtime()
81  * routine is used by the NTP daemon to adjust the system clock to an
82  * externally derived time. The time offset and related variables set by
83  * this routine are used by other routines in this module to adjust the
84  * phase and frequency of the clock discipline loop which controls the
85  * system clock.
86  *
87  * When the kernel time is reckoned directly in nanoseconds (NTP_NANO
88  * defined), the time at each tick interrupt is derived directly from
89  * the kernel time variable. When the kernel time is reckoned in
90  * microseconds, (NTP_NANO undefined), the time is derived from the
91  * kernel time variable together with a variable representing the
92  * leftover nanoseconds at the last tick interrupt. In either case, the
93  * current nanosecond time is reckoned from these values plus an
94  * interpolated value derived by the clock routines in another
95  * architecture-specific module. The interpolation can use either a
96  * dedicated counter or a processor cycle counter (PCC) implemented in
97  * some architectures.
98  *
99  * Note that all routines must run at priority splclock or higher.
100  */
101 /*
102  * Phase/frequency-lock loop (PLL/FLL) definitions
103  *
104  * The nanosecond clock discipline uses two variable types, time
105  * variables and frequency variables. Both types are represented as 64-
106  * bit fixed-point quantities with the decimal point between two 32-bit
107  * halves. On a 32-bit machine, each half is represented as a single
108  * word and mathematical operations are done using multiple-precision
109  * arithmetic. On a 64-bit machine, ordinary computer arithmetic is
110  * used.
111  *
112  * A time variable is a signed 64-bit fixed-point number in ns and
113  * fraction. It represents the remaining time offset to be amortized
114  * over succeeding tick interrupts. The maximum time offset is about
115  * 0.5 s and the resolution is about 2.3e-10 ns.
116  *
117  *			1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
118  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
119  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
120  * |s s s|			 ns				   |
121  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
122  * |			    fraction				   |
123  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
124  *
125  * A frequency variable is a signed 64-bit fixed-point number in ns/s
126  * and fraction. It represents the ns and fraction to be added to the
127  * kernel time variable at each second. The maximum frequency offset is
128  * about +-500000 ns/s and the resolution is about 2.3e-10 ns/s.
129  *
130  *			1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
131  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
132  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
133  * |s s s s s s s s s s s s s|	          ns/s			   |
134  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
135  * |			    fraction				   |
136  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
137  */
138 /*
139  * The following variables establish the state of the PLL/FLL and the
140  * residual time and frequency offset of the local clock.
141  */
142 #define SHIFT_PLL	4		/* PLL loop gain (shift) */
143 #define SHIFT_FLL	2		/* FLL loop gain (shift) */
144 
145 static int time_state = TIME_OK;	/* clock state */
146 static int time_status = STA_UNSYNC;	/* clock status bits */
147 static long time_tai;			/* TAI offset (s) */
148 static long time_monitor;		/* last time offset scaled (ns) */
149 static long time_constant;		/* poll interval (shift) (s) */
150 static long time_precision = 1;		/* clock precision (ns) */
151 static long time_maxerror = MAXPHASE / 1000; /* maximum error (us) */
152 static long time_esterror = MAXPHASE / 1000; /* estimated error (us) */
153 static long time_reftime;		/* time at last adjustment (s) */
154 static l_fp time_offset;		/* time offset (ns) */
155 static l_fp time_freq;			/* frequency offset (ns/s) */
156 static l_fp time_adj;			/* tick adjust (ns/s) */
157 
158 static int64_t time_adjtime;		/* correction from adjtime(2) (usec) */
159 
160 #ifdef PPS_SYNC
161 /*
162  * The following variables are used when a pulse-per-second (PPS) signal
163  * is available and connected via a modem control lead. They establish
164  * the engineering parameters of the clock discipline loop when
165  * controlled by the PPS signal.
166  */
167 #define PPS_FAVG	2		/* min freq avg interval (s) (shift) */
168 #define PPS_FAVGDEF	8		/* default freq avg int (s) (shift) */
169 #define PPS_FAVGMAX	15		/* max freq avg interval (s) (shift) */
170 #define PPS_PAVG	4		/* phase avg interval (s) (shift) */
171 #define PPS_VALID	120		/* PPS signal watchdog max (s) */
172 #define PPS_MAXWANDER	100000		/* max PPS wander (ns/s) */
173 #define PPS_POPCORN	2		/* popcorn spike threshold (shift) */
174 
175 static struct timespec pps_tf[3];	/* phase median filter */
176 static l_fp pps_freq;			/* scaled frequency offset (ns/s) */
177 static long pps_fcount;			/* frequency accumulator */
178 static long pps_jitter;			/* nominal jitter (ns) */
179 static long pps_stabil;			/* nominal stability (scaled ns/s) */
180 static long pps_lastsec;		/* time at last calibration (s) */
181 static int pps_valid;			/* signal watchdog counter */
182 static int pps_shift = PPS_FAVG;	/* interval duration (s) (shift) */
183 static int pps_shiftmax = PPS_FAVGDEF;	/* max interval duration (s) (shift) */
184 static int pps_intcnt;			/* wander counter */
185 
186 /*
187  * PPS signal quality monitors
188  */
189 static long pps_calcnt;			/* calibration intervals */
190 static long pps_jitcnt;			/* jitter limit exceeded */
191 static long pps_stbcnt;			/* stability limit exceeded */
192 static long pps_errcnt;			/* calibration errors */
193 #endif /* PPS_SYNC */
194 /*
195  * End of phase/frequency-lock loop (PLL/FLL) definitions
196  */
197 
198 static void ntp_init(void);
199 static void hardupdate(long offset);
200 static void ntp_gettime1(struct ntptimeval *ntvp);
201 
202 static void
203 ntp_gettime1(struct ntptimeval *ntvp)
204 {
205 	struct timespec atv;	/* nanosecond time */
206 
207 	GIANT_REQUIRED;
208 
209 	nanotime(&atv);
210 	ntvp->time.tv_sec = atv.tv_sec;
211 	ntvp->time.tv_nsec = atv.tv_nsec;
212 	ntvp->maxerror = time_maxerror;
213 	ntvp->esterror = time_esterror;
214 	ntvp->tai = time_tai;
215 	ntvp->time_state = time_state;
216 
217 	/*
218 	 * Status word error decode. If any of these conditions occur,
219 	 * an error is returned, instead of the status word. Most
220 	 * applications will care only about the fact the system clock
221 	 * may not be trusted, not about the details.
222 	 *
223 	 * Hardware or software error
224 	 */
225 	if ((time_status & (STA_UNSYNC | STA_CLOCKERR)) ||
226 
227 	/*
228 	 * PPS signal lost when either time or frequency synchronization
229 	 * requested
230 	 */
231 	    (time_status & (STA_PPSFREQ | STA_PPSTIME) &&
232 	    !(time_status & STA_PPSSIGNAL)) ||
233 
234 	/*
235 	 * PPS jitter exceeded when time synchronization requested
236 	 */
237 	    (time_status & STA_PPSTIME &&
238 	    time_status & STA_PPSJITTER) ||
239 
240 	/*
241 	 * PPS wander exceeded or calibration error when frequency
242 	 * synchronization requested
243 	 */
244 	    (time_status & STA_PPSFREQ &&
245 	    time_status & (STA_PPSWANDER | STA_PPSERROR)))
246 		ntvp->time_state = TIME_ERROR;
247 }
248 
249 /*
250  * ntp_gettime() - NTP user application interface
251  *
252  * See the timex.h header file for synopsis and API description.  Note that
253  * the TAI offset is returned in the ntvtimeval.tai structure member.
254  */
255 #ifndef _SYS_SYSPROTO_H_
256 struct ntp_gettime_args {
257 	struct ntptimeval *ntvp;
258 };
259 #endif
260 /* ARGSUSED */
261 int
262 ntp_gettime(struct thread *td, struct ntp_gettime_args *uap)
263 {
264 	struct ntptimeval ntv;
265 
266 	mtx_lock(&Giant);
267 	ntp_gettime1(&ntv);
268 	mtx_unlock(&Giant);
269 
270 	td->td_retval[0] = ntv.time_state;
271 	return (copyout(&ntv, uap->ntvp, sizeof(ntv)));
272 }
273 
274 static int
275 ntp_sysctl(SYSCTL_HANDLER_ARGS)
276 {
277 	struct ntptimeval ntv;	/* temporary structure */
278 
279 	ntp_gettime1(&ntv);
280 
281 	return (sysctl_handle_opaque(oidp, &ntv, sizeof(ntv), req));
282 }
283 
284 SYSCTL_NODE(_kern, OID_AUTO, ntp_pll, CTLFLAG_RW, 0, "");
285 SYSCTL_PROC(_kern_ntp_pll, OID_AUTO, gettime, CTLTYPE_OPAQUE|CTLFLAG_RD,
286 	0, sizeof(struct ntptimeval) , ntp_sysctl, "S,ntptimeval", "");
287 
288 #ifdef PPS_SYNC
289 SYSCTL_INT(_kern_ntp_pll, OID_AUTO, pps_shiftmax, CTLFLAG_RW, &pps_shiftmax, 0, "");
290 SYSCTL_INT(_kern_ntp_pll, OID_AUTO, pps_shift, CTLFLAG_RW, &pps_shift, 0, "");
291 SYSCTL_INT(_kern_ntp_pll, OID_AUTO, time_monitor, CTLFLAG_RD, &time_monitor, 0, "");
292 
293 SYSCTL_OPAQUE(_kern_ntp_pll, OID_AUTO, pps_freq, CTLFLAG_RD, &pps_freq, sizeof(pps_freq), "I", "");
294 SYSCTL_OPAQUE(_kern_ntp_pll, OID_AUTO, time_freq, CTLFLAG_RD, &time_freq, sizeof(time_freq), "I", "");
295 #endif
296 
297 /*
298  * ntp_adjtime() - NTP daemon application interface
299  *
300  * See the timex.h header file for synopsis and API description.  Note that
301  * the timex.constant structure member has a dual purpose to set the time
302  * constant and to set the TAI offset.
303  */
304 #ifndef _SYS_SYSPROTO_H_
305 struct ntp_adjtime_args {
306 	struct timex *tp;
307 };
308 #endif
309 
310 int
311 ntp_adjtime(struct thread *td, struct ntp_adjtime_args *uap)
312 {
313 	struct timex ntv;	/* temporary structure */
314 	long freq;		/* frequency ns/s) */
315 	int modes;		/* mode bits from structure */
316 	int s;			/* caller priority */
317 	int error;
318 
319 	error = copyin((caddr_t)uap->tp, (caddr_t)&ntv, sizeof(ntv));
320 	if (error)
321 		return(error);
322 
323 	/*
324 	 * Update selected clock variables - only the superuser can
325 	 * change anything. Note that there is no error checking here on
326 	 * the assumption the superuser should know what it is doing.
327 	 * Note that either the time constant or TAI offset are loaded
328 	 * from the ntv.constant member, depending on the mode bits. If
329 	 * the STA_PLL bit in the status word is cleared, the state and
330 	 * status words are reset to the initial values at boot.
331 	 */
332 	mtx_lock(&Giant);
333 	modes = ntv.modes;
334 	if (modes)
335 		error = priv_check(td, PRIV_NTP_ADJTIME);
336 	if (error)
337 		goto done2;
338 	s = splclock();
339 	if (modes & MOD_MAXERROR)
340 		time_maxerror = ntv.maxerror;
341 	if (modes & MOD_ESTERROR)
342 		time_esterror = ntv.esterror;
343 	if (modes & MOD_STATUS) {
344 		if (time_status & STA_PLL && !(ntv.status & STA_PLL)) {
345 			time_state = TIME_OK;
346 			time_status = STA_UNSYNC;
347 #ifdef PPS_SYNC
348 			pps_shift = PPS_FAVG;
349 #endif /* PPS_SYNC */
350 		}
351 		time_status &= STA_RONLY;
352 		time_status |= ntv.status & ~STA_RONLY;
353 	}
354 	if (modes & MOD_TIMECONST) {
355 		if (ntv.constant < 0)
356 			time_constant = 0;
357 		else if (ntv.constant > MAXTC)
358 			time_constant = MAXTC;
359 		else
360 			time_constant = ntv.constant;
361 	}
362 	if (modes & MOD_TAI) {
363 		if (ntv.constant > 0) /* XXX zero & negative numbers ? */
364 			time_tai = ntv.constant;
365 	}
366 #ifdef PPS_SYNC
367 	if (modes & MOD_PPSMAX) {
368 		if (ntv.shift < PPS_FAVG)
369 			pps_shiftmax = PPS_FAVG;
370 		else if (ntv.shift > PPS_FAVGMAX)
371 			pps_shiftmax = PPS_FAVGMAX;
372 		else
373 			pps_shiftmax = ntv.shift;
374 	}
375 #endif /* PPS_SYNC */
376 	if (modes & MOD_NANO)
377 		time_status |= STA_NANO;
378 	if (modes & MOD_MICRO)
379 		time_status &= ~STA_NANO;
380 	if (modes & MOD_CLKB)
381 		time_status |= STA_CLK;
382 	if (modes & MOD_CLKA)
383 		time_status &= ~STA_CLK;
384 	if (modes & MOD_FREQUENCY) {
385 		freq = (ntv.freq * 1000LL) >> 16;
386 		if (freq > MAXFREQ)
387 			L_LINT(time_freq, MAXFREQ);
388 		else if (freq < -MAXFREQ)
389 			L_LINT(time_freq, -MAXFREQ);
390 		else {
391 			/*
392 			 * ntv.freq is [PPM * 2^16] = [us/s * 2^16]
393 			 * time_freq is [ns/s * 2^32]
394 			 */
395 			time_freq = ntv.freq * 1000LL * 65536LL;
396 		}
397 #ifdef PPS_SYNC
398 		pps_freq = time_freq;
399 #endif /* PPS_SYNC */
400 	}
401 	if (modes & MOD_OFFSET) {
402 		if (time_status & STA_NANO)
403 			hardupdate(ntv.offset);
404 		else
405 			hardupdate(ntv.offset * 1000);
406 	}
407 
408 	/*
409 	 * Retrieve all clock variables. Note that the TAI offset is
410 	 * returned only by ntp_gettime();
411 	 */
412 	if (time_status & STA_NANO)
413 		ntv.offset = L_GINT(time_offset);
414 	else
415 		ntv.offset = L_GINT(time_offset) / 1000; /* XXX rounding ? */
416 	ntv.freq = L_GINT((time_freq / 1000LL) << 16);
417 	ntv.maxerror = time_maxerror;
418 	ntv.esterror = time_esterror;
419 	ntv.status = time_status;
420 	ntv.constant = time_constant;
421 	if (time_status & STA_NANO)
422 		ntv.precision = time_precision;
423 	else
424 		ntv.precision = time_precision / 1000;
425 	ntv.tolerance = MAXFREQ * SCALE_PPM;
426 #ifdef PPS_SYNC
427 	ntv.shift = pps_shift;
428 	ntv.ppsfreq = L_GINT((pps_freq / 1000LL) << 16);
429 	if (time_status & STA_NANO)
430 		ntv.jitter = pps_jitter;
431 	else
432 		ntv.jitter = pps_jitter / 1000;
433 	ntv.stabil = pps_stabil;
434 	ntv.calcnt = pps_calcnt;
435 	ntv.errcnt = pps_errcnt;
436 	ntv.jitcnt = pps_jitcnt;
437 	ntv.stbcnt = pps_stbcnt;
438 #endif /* PPS_SYNC */
439 	splx(s);
440 
441 	error = copyout((caddr_t)&ntv, (caddr_t)uap->tp, sizeof(ntv));
442 	if (error)
443 		goto done2;
444 
445 	/*
446 	 * Status word error decode. See comments in
447 	 * ntp_gettime() routine.
448 	 */
449 	if ((time_status & (STA_UNSYNC | STA_CLOCKERR)) ||
450 	    (time_status & (STA_PPSFREQ | STA_PPSTIME) &&
451 	    !(time_status & STA_PPSSIGNAL)) ||
452 	    (time_status & STA_PPSTIME &&
453 	    time_status & STA_PPSJITTER) ||
454 	    (time_status & STA_PPSFREQ &&
455 	    time_status & (STA_PPSWANDER | STA_PPSERROR))) {
456 		td->td_retval[0] = TIME_ERROR;
457 	} else {
458 		td->td_retval[0] = time_state;
459 	}
460 done2:
461 	mtx_unlock(&Giant);
462 	return (error);
463 }
464 
465 /*
466  * second_overflow() - called after ntp_tick_adjust()
467  *
468  * This routine is ordinarily called immediately following the above
469  * routine ntp_tick_adjust(). While these two routines are normally
470  * combined, they are separated here only for the purposes of
471  * simulation.
472  */
473 void
474 ntp_update_second(int64_t *adjustment, time_t *newsec)
475 {
476 	int tickrate;
477 	l_fp ftemp;		/* 32/64-bit temporary */
478 
479 	/*
480 	 * On rollover of the second both the nanosecond and microsecond
481 	 * clocks are updated and the state machine cranked as
482 	 * necessary. The phase adjustment to be used for the next
483 	 * second is calculated and the maximum error is increased by
484 	 * the tolerance.
485 	 */
486 	time_maxerror += MAXFREQ / 1000;
487 
488 	/*
489 	 * Leap second processing. If in leap-insert state at
490 	 * the end of the day, the system clock is set back one
491 	 * second; if in leap-delete state, the system clock is
492 	 * set ahead one second. The nano_time() routine or
493 	 * external clock driver will insure that reported time
494 	 * is always monotonic.
495 	 */
496 	switch (time_state) {
497 
498 		/*
499 		 * No warning.
500 		 */
501 		case TIME_OK:
502 		if (time_status & STA_INS)
503 			time_state = TIME_INS;
504 		else if (time_status & STA_DEL)
505 			time_state = TIME_DEL;
506 		break;
507 
508 		/*
509 		 * Insert second 23:59:60 following second
510 		 * 23:59:59.
511 		 */
512 		case TIME_INS:
513 		if (!(time_status & STA_INS))
514 			time_state = TIME_OK;
515 		else if ((*newsec) % 86400 == 0) {
516 			(*newsec)--;
517 			time_state = TIME_OOP;
518 			time_tai++;
519 		}
520 		break;
521 
522 		/*
523 		 * Delete second 23:59:59.
524 		 */
525 		case TIME_DEL:
526 		if (!(time_status & STA_DEL))
527 			time_state = TIME_OK;
528 		else if (((*newsec) + 1) % 86400 == 0) {
529 			(*newsec)++;
530 			time_tai--;
531 			time_state = TIME_WAIT;
532 		}
533 		break;
534 
535 		/*
536 		 * Insert second in progress.
537 		 */
538 		case TIME_OOP:
539 			time_state = TIME_WAIT;
540 		break;
541 
542 		/*
543 		 * Wait for status bits to clear.
544 		 */
545 		case TIME_WAIT:
546 		if (!(time_status & (STA_INS | STA_DEL)))
547 			time_state = TIME_OK;
548 	}
549 
550 	/*
551 	 * Compute the total time adjustment for the next second
552 	 * in ns. The offset is reduced by a factor depending on
553 	 * whether the PPS signal is operating. Note that the
554 	 * value is in effect scaled by the clock frequency,
555 	 * since the adjustment is added at each tick interrupt.
556 	 */
557 	ftemp = time_offset;
558 #ifdef PPS_SYNC
559 	/* XXX even if PPS signal dies we should finish adjustment ? */
560 	if (time_status & STA_PPSTIME && time_status &
561 	    STA_PPSSIGNAL)
562 		L_RSHIFT(ftemp, pps_shift);
563 	else
564 		L_RSHIFT(ftemp, SHIFT_PLL + time_constant);
565 #else
566 		L_RSHIFT(ftemp, SHIFT_PLL + time_constant);
567 #endif /* PPS_SYNC */
568 	time_adj = ftemp;
569 	L_SUB(time_offset, ftemp);
570 	L_ADD(time_adj, time_freq);
571 
572 	/*
573 	 * Apply any correction from adjtime(2).  If more than one second
574 	 * off we slew at a rate of 5ms/s (5000 PPM) else 500us/s (500PPM)
575 	 * until the last second is slewed the final < 500 usecs.
576 	 */
577 	if (time_adjtime != 0) {
578 		if (time_adjtime > 1000000)
579 			tickrate = 5000;
580 		else if (time_adjtime < -1000000)
581 			tickrate = -5000;
582 		else if (time_adjtime > 500)
583 			tickrate = 500;
584 		else if (time_adjtime < -500)
585 			tickrate = -500;
586 		else
587 			tickrate = time_adjtime;
588 		time_adjtime -= tickrate;
589 		L_LINT(ftemp, tickrate * 1000);
590 		L_ADD(time_adj, ftemp);
591 	}
592 	*adjustment = time_adj;
593 
594 #ifdef PPS_SYNC
595 	if (pps_valid > 0)
596 		pps_valid--;
597 	else
598 		time_status &= ~STA_PPSSIGNAL;
599 #endif /* PPS_SYNC */
600 }
601 
602 /*
603  * ntp_init() - initialize variables and structures
604  *
605  * This routine must be called after the kernel variables hz and tick
606  * are set or changed and before the next tick interrupt. In this
607  * particular implementation, these values are assumed set elsewhere in
608  * the kernel. The design allows the clock frequency and tick interval
609  * to be changed while the system is running. So, this routine should
610  * probably be integrated with the code that does that.
611  */
612 static void
613 ntp_init()
614 {
615 
616 	/*
617 	 * The following variables are initialized only at startup. Only
618 	 * those structures not cleared by the compiler need to be
619 	 * initialized, and these only in the simulator. In the actual
620 	 * kernel, any nonzero values here will quickly evaporate.
621 	 */
622 	L_CLR(time_offset);
623 	L_CLR(time_freq);
624 #ifdef PPS_SYNC
625 	pps_tf[0].tv_sec = pps_tf[0].tv_nsec = 0;
626 	pps_tf[1].tv_sec = pps_tf[1].tv_nsec = 0;
627 	pps_tf[2].tv_sec = pps_tf[2].tv_nsec = 0;
628 	pps_fcount = 0;
629 	L_CLR(pps_freq);
630 #endif /* PPS_SYNC */
631 }
632 
633 SYSINIT(ntpclocks, SI_SUB_CLOCKS, SI_ORDER_MIDDLE, ntp_init, NULL)
634 
635 /*
636  * hardupdate() - local clock update
637  *
638  * This routine is called by ntp_adjtime() to update the local clock
639  * phase and frequency. The implementation is of an adaptive-parameter,
640  * hybrid phase/frequency-lock loop (PLL/FLL). The routine computes new
641  * time and frequency offset estimates for each call. If the kernel PPS
642  * discipline code is configured (PPS_SYNC), the PPS signal itself
643  * determines the new time offset, instead of the calling argument.
644  * Presumably, calls to ntp_adjtime() occur only when the caller
645  * believes the local clock is valid within some bound (+-128 ms with
646  * NTP). If the caller's time is far different than the PPS time, an
647  * argument will ensue, and it's not clear who will lose.
648  *
649  * For uncompensated quartz crystal oscillators and nominal update
650  * intervals less than 256 s, operation should be in phase-lock mode,
651  * where the loop is disciplined to phase. For update intervals greater
652  * than 1024 s, operation should be in frequency-lock mode, where the
653  * loop is disciplined to frequency. Between 256 s and 1024 s, the mode
654  * is selected by the STA_MODE status bit.
655  */
656 static void
657 hardupdate(offset)
658 	long offset;		/* clock offset (ns) */
659 {
660 	long mtemp;
661 	l_fp ftemp;
662 
663 	/*
664 	 * Select how the phase is to be controlled and from which
665 	 * source. If the PPS signal is present and enabled to
666 	 * discipline the time, the PPS offset is used; otherwise, the
667 	 * argument offset is used.
668 	 */
669 	if (!(time_status & STA_PLL))
670 		return;
671 	if (!(time_status & STA_PPSTIME && time_status &
672 	    STA_PPSSIGNAL)) {
673 		if (offset > MAXPHASE)
674 			time_monitor = MAXPHASE;
675 		else if (offset < -MAXPHASE)
676 			time_monitor = -MAXPHASE;
677 		else
678 			time_monitor = offset;
679 		L_LINT(time_offset, time_monitor);
680 	}
681 
682 	/*
683 	 * Select how the frequency is to be controlled and in which
684 	 * mode (PLL or FLL). If the PPS signal is present and enabled
685 	 * to discipline the frequency, the PPS frequency is used;
686 	 * otherwise, the argument offset is used to compute it.
687 	 */
688 	if (time_status & STA_PPSFREQ && time_status & STA_PPSSIGNAL) {
689 		time_reftime = time_second;
690 		return;
691 	}
692 	if (time_status & STA_FREQHOLD || time_reftime == 0)
693 		time_reftime = time_second;
694 	mtemp = time_second - time_reftime;
695 	L_LINT(ftemp, time_monitor);
696 	L_RSHIFT(ftemp, (SHIFT_PLL + 2 + time_constant) << 1);
697 	L_MPY(ftemp, mtemp);
698 	L_ADD(time_freq, ftemp);
699 	time_status &= ~STA_MODE;
700 	if (mtemp >= MINSEC && (time_status & STA_FLL || mtemp >
701 	    MAXSEC)) {
702 		L_LINT(ftemp, (time_monitor << 4) / mtemp);
703 		L_RSHIFT(ftemp, SHIFT_FLL + 4);
704 		L_ADD(time_freq, ftemp);
705 		time_status |= STA_MODE;
706 	}
707 	time_reftime = time_second;
708 	if (L_GINT(time_freq) > MAXFREQ)
709 		L_LINT(time_freq, MAXFREQ);
710 	else if (L_GINT(time_freq) < -MAXFREQ)
711 		L_LINT(time_freq, -MAXFREQ);
712 }
713 
714 #ifdef PPS_SYNC
715 /*
716  * hardpps() - discipline CPU clock oscillator to external PPS signal
717  *
718  * This routine is called at each PPS interrupt in order to discipline
719  * the CPU clock oscillator to the PPS signal. There are two independent
720  * first-order feedback loops, one for the phase, the other for the
721  * frequency. The phase loop measures and grooms the PPS phase offset
722  * and leaves it in a handy spot for the seconds overflow routine. The
723  * frequency loop averages successive PPS phase differences and
724  * calculates the PPS frequency offset, which is also processed by the
725  * seconds overflow routine. The code requires the caller to capture the
726  * time and architecture-dependent hardware counter values in
727  * nanoseconds at the on-time PPS signal transition.
728  *
729  * Note that, on some Unix systems this routine runs at an interrupt
730  * priority level higher than the timer interrupt routine hardclock().
731  * Therefore, the variables used are distinct from the hardclock()
732  * variables, except for the actual time and frequency variables, which
733  * are determined by this routine and updated atomically.
734  */
735 void
736 hardpps(tsp, nsec)
737 	struct timespec *tsp;	/* time at PPS */
738 	long nsec;		/* hardware counter at PPS */
739 {
740 	long u_sec, u_nsec, v_nsec; /* temps */
741 	l_fp ftemp;
742 
743 	/*
744 	 * The signal is first processed by a range gate and frequency
745 	 * discriminator. The range gate rejects noise spikes outside
746 	 * the range +-500 us. The frequency discriminator rejects input
747 	 * signals with apparent frequency outside the range 1 +-500
748 	 * PPM. If two hits occur in the same second, we ignore the
749 	 * later hit; if not and a hit occurs outside the range gate,
750 	 * keep the later hit for later comparison, but do not process
751 	 * it.
752 	 */
753 	time_status |= STA_PPSSIGNAL | STA_PPSJITTER;
754 	time_status &= ~(STA_PPSWANDER | STA_PPSERROR);
755 	pps_valid = PPS_VALID;
756 	u_sec = tsp->tv_sec;
757 	u_nsec = tsp->tv_nsec;
758 	if (u_nsec >= (NANOSECOND >> 1)) {
759 		u_nsec -= NANOSECOND;
760 		u_sec++;
761 	}
762 	v_nsec = u_nsec - pps_tf[0].tv_nsec;
763 	if (u_sec == pps_tf[0].tv_sec && v_nsec < NANOSECOND -
764 	    MAXFREQ)
765 		return;
766 	pps_tf[2] = pps_tf[1];
767 	pps_tf[1] = pps_tf[0];
768 	pps_tf[0].tv_sec = u_sec;
769 	pps_tf[0].tv_nsec = u_nsec;
770 
771 	/*
772 	 * Compute the difference between the current and previous
773 	 * counter values. If the difference exceeds 0.5 s, assume it
774 	 * has wrapped around, so correct 1.0 s. If the result exceeds
775 	 * the tick interval, the sample point has crossed a tick
776 	 * boundary during the last second, so correct the tick. Very
777 	 * intricate.
778 	 */
779 	u_nsec = nsec;
780 	if (u_nsec > (NANOSECOND >> 1))
781 		u_nsec -= NANOSECOND;
782 	else if (u_nsec < -(NANOSECOND >> 1))
783 		u_nsec += NANOSECOND;
784 	pps_fcount += u_nsec;
785 	if (v_nsec > MAXFREQ || v_nsec < -MAXFREQ)
786 		return;
787 	time_status &= ~STA_PPSJITTER;
788 
789 	/*
790 	 * A three-stage median filter is used to help denoise the PPS
791 	 * time. The median sample becomes the time offset estimate; the
792 	 * difference between the other two samples becomes the time
793 	 * dispersion (jitter) estimate.
794 	 */
795 	if (pps_tf[0].tv_nsec > pps_tf[1].tv_nsec) {
796 		if (pps_tf[1].tv_nsec > pps_tf[2].tv_nsec) {
797 			v_nsec = pps_tf[1].tv_nsec;	/* 0 1 2 */
798 			u_nsec = pps_tf[0].tv_nsec - pps_tf[2].tv_nsec;
799 		} else if (pps_tf[2].tv_nsec > pps_tf[0].tv_nsec) {
800 			v_nsec = pps_tf[0].tv_nsec;	/* 2 0 1 */
801 			u_nsec = pps_tf[2].tv_nsec - pps_tf[1].tv_nsec;
802 		} else {
803 			v_nsec = pps_tf[2].tv_nsec;	/* 0 2 1 */
804 			u_nsec = pps_tf[0].tv_nsec - pps_tf[1].tv_nsec;
805 		}
806 	} else {
807 		if (pps_tf[1].tv_nsec < pps_tf[2].tv_nsec) {
808 			v_nsec = pps_tf[1].tv_nsec;	/* 2 1 0 */
809 			u_nsec = pps_tf[2].tv_nsec - pps_tf[0].tv_nsec;
810 		} else if (pps_tf[2].tv_nsec < pps_tf[0].tv_nsec) {
811 			v_nsec = pps_tf[0].tv_nsec;	/* 1 0 2 */
812 			u_nsec = pps_tf[1].tv_nsec - pps_tf[2].tv_nsec;
813 		} else {
814 			v_nsec = pps_tf[2].tv_nsec;	/* 1 2 0 */
815 			u_nsec = pps_tf[1].tv_nsec - pps_tf[0].tv_nsec;
816 		}
817 	}
818 
819 	/*
820 	 * Nominal jitter is due to PPS signal noise and interrupt
821 	 * latency. If it exceeds the popcorn threshold, the sample is
822 	 * discarded. otherwise, if so enabled, the time offset is
823 	 * updated. We can tolerate a modest loss of data here without
824 	 * much degrading time accuracy.
825 	 */
826 	if (u_nsec > (pps_jitter << PPS_POPCORN)) {
827 		time_status |= STA_PPSJITTER;
828 		pps_jitcnt++;
829 	} else if (time_status & STA_PPSTIME) {
830 		time_monitor = -v_nsec;
831 		L_LINT(time_offset, time_monitor);
832 	}
833 	pps_jitter += (u_nsec - pps_jitter) >> PPS_FAVG;
834 	u_sec = pps_tf[0].tv_sec - pps_lastsec;
835 	if (u_sec < (1 << pps_shift))
836 		return;
837 
838 	/*
839 	 * At the end of the calibration interval the difference between
840 	 * the first and last counter values becomes the scaled
841 	 * frequency. It will later be divided by the length of the
842 	 * interval to determine the frequency update. If the frequency
843 	 * exceeds a sanity threshold, or if the actual calibration
844 	 * interval is not equal to the expected length, the data are
845 	 * discarded. We can tolerate a modest loss of data here without
846 	 * much degrading frequency accuracy.
847 	 */
848 	pps_calcnt++;
849 	v_nsec = -pps_fcount;
850 	pps_lastsec = pps_tf[0].tv_sec;
851 	pps_fcount = 0;
852 	u_nsec = MAXFREQ << pps_shift;
853 	if (v_nsec > u_nsec || v_nsec < -u_nsec || u_sec != (1 <<
854 	    pps_shift)) {
855 		time_status |= STA_PPSERROR;
856 		pps_errcnt++;
857 		return;
858 	}
859 
860 	/*
861 	 * Here the raw frequency offset and wander (stability) is
862 	 * calculated. If the wander is less than the wander threshold
863 	 * for four consecutive averaging intervals, the interval is
864 	 * doubled; if it is greater than the threshold for four
865 	 * consecutive intervals, the interval is halved. The scaled
866 	 * frequency offset is converted to frequency offset. The
867 	 * stability metric is calculated as the average of recent
868 	 * frequency changes, but is used only for performance
869 	 * monitoring.
870 	 */
871 	L_LINT(ftemp, v_nsec);
872 	L_RSHIFT(ftemp, pps_shift);
873 	L_SUB(ftemp, pps_freq);
874 	u_nsec = L_GINT(ftemp);
875 	if (u_nsec > PPS_MAXWANDER) {
876 		L_LINT(ftemp, PPS_MAXWANDER);
877 		pps_intcnt--;
878 		time_status |= STA_PPSWANDER;
879 		pps_stbcnt++;
880 	} else if (u_nsec < -PPS_MAXWANDER) {
881 		L_LINT(ftemp, -PPS_MAXWANDER);
882 		pps_intcnt--;
883 		time_status |= STA_PPSWANDER;
884 		pps_stbcnt++;
885 	} else {
886 		pps_intcnt++;
887 	}
888 	if (pps_intcnt >= 4) {
889 		pps_intcnt = 4;
890 		if (pps_shift < pps_shiftmax) {
891 			pps_shift++;
892 			pps_intcnt = 0;
893 		}
894 	} else if (pps_intcnt <= -4 || pps_shift > pps_shiftmax) {
895 		pps_intcnt = -4;
896 		if (pps_shift > PPS_FAVG) {
897 			pps_shift--;
898 			pps_intcnt = 0;
899 		}
900 	}
901 	if (u_nsec < 0)
902 		u_nsec = -u_nsec;
903 	pps_stabil += (u_nsec * SCALE_PPM - pps_stabil) >> PPS_FAVG;
904 
905 	/*
906 	 * The PPS frequency is recalculated and clamped to the maximum
907 	 * MAXFREQ. If enabled, the system clock frequency is updated as
908 	 * well.
909 	 */
910 	L_ADD(pps_freq, ftemp);
911 	u_nsec = L_GINT(pps_freq);
912 	if (u_nsec > MAXFREQ)
913 		L_LINT(pps_freq, MAXFREQ);
914 	else if (u_nsec < -MAXFREQ)
915 		L_LINT(pps_freq, -MAXFREQ);
916 	if (time_status & STA_PPSFREQ)
917 		time_freq = pps_freq;
918 }
919 #endif /* PPS_SYNC */
920 
921 #ifndef _SYS_SYSPROTO_H_
922 struct adjtime_args {
923 	struct timeval *delta;
924 	struct timeval *olddelta;
925 };
926 #endif
927 /* ARGSUSED */
928 int
929 adjtime(struct thread *td, struct adjtime_args *uap)
930 {
931 	struct timeval delta, olddelta, *deltap;
932 	int error;
933 
934 	if (uap->delta) {
935 		error = copyin(uap->delta, &delta, sizeof(delta));
936 		if (error)
937 			return (error);
938 		deltap = &delta;
939 	} else
940 		deltap = NULL;
941 	error = kern_adjtime(td, deltap, &olddelta);
942 	if (uap->olddelta && error == 0)
943 		error = copyout(&olddelta, uap->olddelta, sizeof(olddelta));
944 	return (error);
945 }
946 
947 int
948 kern_adjtime(struct thread *td, struct timeval *delta, struct timeval *olddelta)
949 {
950 	struct timeval atv;
951 	int error;
952 
953 	if ((error = priv_check(td, PRIV_ADJTIME)))
954 		return (error);
955 
956 	mtx_lock(&Giant);
957 	if (olddelta) {
958 		atv.tv_sec = time_adjtime / 1000000;
959 		atv.tv_usec = time_adjtime % 1000000;
960 		if (atv.tv_usec < 0) {
961 			atv.tv_usec += 1000000;
962 			atv.tv_sec--;
963 		}
964 		*olddelta = atv;
965 	}
966 	if (delta)
967 		time_adjtime = (int64_t)delta->tv_sec * 1000000 +
968 		    delta->tv_usec;
969 	mtx_unlock(&Giant);
970 	return (error);
971 }
972 
973