powerpc: Rework VDSO gettimeofday to prevent time going backwards

Currently it is possible for userspace to see the result of
gettimeofday() going backwards by 1 microsecond, assuming that
userspace is using the gettimeofday() in the VDSO.  The VDSO
gettimeofday() algorithm computes the time in "xsecs", which are
units of 2^-20 seconds, or approximately 0.954 microseconds,
using the algorithm

	now = (timebase - tb_orig_stamp) * tb_to_xs + stamp_xsec

and then converts the time in xsecs to seconds and microseconds.

The kernel updates the tb_orig_stamp and stamp_xsec values every
tick in update_vsyscall().  If the length of the tick is not an
integer number of xsecs, then some precision is lost in converting
the current time to xsecs.  For example, with CONFIG_HZ=1000, the
tick is 1ms long, which is 1048.576 xsecs.  That means that
stamp_xsec will advance by either 1048 or 1049 on each tick.
With the right conditions, it is possible for userspace to get
(timebase - tb_orig_stamp) * tb_to_xs being 1049 if the kernel is
slightly late in updating the vdso_datapage, and then for stamp_xsec
to advance by 1048 when the kernel does update it, and for userspace
to then see (timebase - tb_orig_stamp) * tb_to_xs being zero due to
integer truncation.  The result is that time appears to go backwards
by 1 microsecond.

To fix this we change the VDSO gettimeofday to use a new field in the
VDSO datapage which stores the nanoseconds part of the time as a
fractional number of seconds in a 0.32 binary fraction format.
(Or put another way, as a 32-bit number in units of 0.23283 ns.)
This is convenient because we can use the mulhwu instruction to
convert it to either microseconds or nanoseconds.

Since it turns out that computing the time of day using this new field
is simpler than either using stamp_xsec (as gettimeofday does) or
stamp_xtime.tv_nsec (as clock_gettime does), this converts both
gettimeofday and clock_gettime to use the new field.  The existing
__do_get_tspec function is converted to use the new field and take
a parameter in r7 that indicates the desired resolution, 1,000,000
for microseconds or 1,000,000,000 for nanoseconds.  The __do_get_xsec
function is then unused and is deleted.

The new algorithm is

	now = ((timebase - tb_orig_stamp) << 12) * tb_to_xs
		+ (stamp_xtime_seconds << 32) + stamp_sec_fraction

with 'now' in units of 2^-32 seconds.  That is then converted to
seconds and either microseconds or nanoseconds with

	seconds = now >> 32
	partseconds = ((now & 0xffffffff) * resolution) >> 32

The 32-bit VDSO code also makes a further simplification: it ignores
the bottom 32 bits of the tb_to_xs value, which is a 0.64 format binary
fraction.  Doing so gets rid of 4 multiply instructions.  Assuming
a timebase frequency of 1GHz or less and an update interval of no
more than 10ms, the upper 32 bits of tb_to_xs will be at least
4503599, so the error from ignoring the low 32 bits will be at most
2.2ns, which is more than an order of magnitude less than the time
taken to do gettimeofday or clock_gettime on our fastest processors,
so there is no possibility of seeing inconsistent values due to this.

This also moves update_gtod() down next to its only caller, and makes
update_vsyscall use the time passed in via the wall_time argument rather
than accessing xtime directly.  At present, wall_time always points to
xtime, but that could change in future.

Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

1 files changed, 20 insertions, 68 deletions

diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S
index 262cd5857a5..e97a9a0dc4a 100644
--- a/arch/powerpc/kernel/vdso64/gettimeofday.S
+++ b/arch/powerpc/kernel/vdso64/gettimeofday.S
@@ -33,18 +33,11 @@ V_FUNCTION_BEGIN(__kernel_gettimeofday)
         bl      V_LOCAL_FUNC(__get_datapage)    /* get data page */
         cmpldi  r11,0                   /* check if tv is NULL */
         beq     2f
-        bl      V_LOCAL_FUNC(__do_get_xsec)     /* get xsec from tb & kernel */
-        lis     r7,15                   /* r7 = 1000000 = USEC_PER_SEC */
-        ori     r7,r7,16960
-        rldicl  r5,r4,44,20             /* r5 = sec = xsec / XSEC_PER_SEC */
-        rldicr  r6,r5,20,43             /* r6 = sec * XSEC_PER_SEC */
-        std     r5,TVAL64_TV_SEC(r11)   /* store sec in tv */
-        subf    r0,r6,r4                /* r0 = xsec = (xsec - r6) */
-        mulld   r0,r0,r7                /* usec = (xsec * USEC_PER_SEC) /
-                                         * XSEC_PER_SEC
-                                         */
-        rldicl  r0,r0,44,20
-        std     r0,TVAL64_TV_USEC(r11)  /* store usec in tv */
+        lis     r7,1000000@ha           /* load up USEC_PER_SEC */
+        addi    r7,r7,1000000@l
+        bl      V_LOCAL_FUNC(__do_get_tspec) /* get sec/us from tb & kernel */
+        std     r4,TVAL64_TV_SEC(r11)   /* store sec in tv */
+        std     r5,TVAL64_TV_USEC(r11)  /* store usec in tv */
 2:      cmpldi  r10,0                   /* check if tz is NULL */
         beq     1f
         lwz     r4,CFG_TZ_MINUTEWEST(r3)/* fill tz */
@@ -77,6 +70,8 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
   .cfi_register lr,r12
         mr      r11,r4                  /* r11 saves tp */
         bl      V_LOCAL_FUNC(__get_datapage)    /* get data page */
+        lis     r7,NSEC_PER_SEC@h       /* want nanoseconds */
+        ori     r7,r7,NSEC_PER_SEC@l
 50:     bl      V_LOCAL_FUNC(__do_get_tspec)    /* get time from tb & kernel */
         bne     cr1,80f                 /* if not monotonic, all done */
 
@@ -171,49 +166,12 @@ V_FUNCTION_END(__kernel_clock_getres)
 
 
 /*
- * This is the core of gettimeofday(), it returns the xsec
- * value in r4 and expects the datapage ptr (non clobbered)
- * in r3. clobbers r0,r4,r5,r6,r7,r8
- * When returning, r8 contains the counter value that can be reused
- */
-V_FUNCTION_BEGIN(__do_get_xsec)
-  .cfi_startproc
-        /* check for update count & load values */
-1:      ld      r8,CFG_TB_UPDATE_COUNT(r3)
-        andi.   r0,r8,1                 /* pending update ? loop */
-        bne-    1b
-        xor     r0,r8,r8                /* create dependency */
-        add     r3,r3,r0
-
-        /* Get TB & offset it. We use the MFTB macro which will generate
-         * workaround code for Cell.
-         */
-        MFTB(r7)
-        ld      r9,CFG_TB_ORIG_STAMP(r3)
-        subf    r7,r9,r7
-
-        /* Scale result */
-        ld      r5,CFG_TB_TO_XS(r3)
-        mulhdu  r7,r7,r5
-
-        /* Add stamp since epoch */
-        ld      r6,CFG_STAMP_XSEC(r3)
-        add     r4,r6,r7
-
-        xor     r0,r4,r4
-        add     r3,r3,r0
-        ld      r0,CFG_TB_UPDATE_COUNT(r3)
-        cmpld   cr0,r0,r8               /* check if updated */
-        bne-    1b
-        blr
-  .cfi_endproc
-V_FUNCTION_END(__do_get_xsec)
-
-/*
- * This is the core of clock_gettime(), it returns the current
- * time in seconds and nanoseconds in r4 and r5.
+ * This is the core of clock_gettime() and gettimeofday(),
+ * it returns the current time in r4 (seconds) and r5.
+ * On entry, r7 gives the resolution of r5, either USEC_PER_SEC
+ * or NSEC_PER_SEC, giving r5 in microseconds or nanoseconds.
  * It expects the datapage ptr in r3 and doesn't clobber it.
- * It clobbers r0 and r6 and returns NSEC_PER_SEC in r7.
+ * It clobbers r0, r6 and r9.
  * On return, r8 contains the counter value that can be reused.
  * This clobbers cr0 but not any other cr field.
  */
@@ -229,18 +187,18 @@ V_FUNCTION_BEGIN(__do_get_tspec)
         /* Get TB & offset it. We use the MFTB macro which will generate
          * workaround code for Cell.
          */
-        MFTB(r7)
+        MFTB(r6)
         ld      r9,CFG_TB_ORIG_STAMP(r3)
-        subf    r7,r9,r7
+        subf    r6,r9,r6
 
         /* Scale result */
         ld      r5,CFG_TB_TO_XS(r3)
-        sldi    r7,r7,12                /* compute time since stamp_xtime */
-        mulhdu  r6,r7,r5                /* in units of 2^-32 seconds */
+        sldi    r6,r6,12                /* compute time since stamp_xtime */
+        mulhdu  r6,r6,r5                /* in units of 2^-32 seconds */
 
         /* Add stamp since epoch */
         ld      r4,STAMP_XTIME+TSPC64_TV_SEC(r3)
-        ld      r5,STAMP_XTIME+TSPC64_TV_NSEC(r3)
+        lwz     r5,STAMP_SEC_FRAC(r3)
         or      r0,r4,r5
         or      r0,r0,r6
         xor     r0,r0,r0
@@ -250,17 +208,11 @@ V_FUNCTION_BEGIN(__do_get_tspec)
         bne-    1b                      /* reload if so */
 
         /* convert to seconds & nanoseconds and add to stamp */
-        lis     r7,NSEC_PER_SEC@h
-        ori     r7,r7,NSEC_PER_SEC@l
-        mulhwu  r0,r6,r7                /* compute nanoseconds and */
+        add     r6,r6,r5                /* add on fractional seconds of xtime */
+        mulhwu  r5,r6,r7                /* compute micro or nanoseconds and */
         srdi    r6,r6,32                /* seconds since stamp_xtime */
-        clrldi  r0,r0,32
-        add     r5,r5,r0                /* add nanoseconds together */
-        cmpd    r5,r7                   /* overflow? */
+        clrldi  r5,r5,32
         add     r4,r4,r6
-        bltlr                           /* all done if no overflow */
-        subf    r5,r7,r5                /* if overflow, adjust */
-        addi    r4,r4,1
         blr
   .cfi_endproc
 V_FUNCTION_END(__do_get_tspec)