devutils/ATFQ/book ATFQ git

Part I · How it works

10.1 Wall clock and monotonic clock: measuring time right

alsowall clockmonotonic clockclock_monotonicclock_realtimeclock_gettimesystem timeclocksourcetscrtchardware clockhwclocktime measurement

TL;DR

  • The wall clock says what time it is. It can jump: NTP corrects it, an admin sets it, a VM resumes. Never measure durations with it.
  • The monotonic clock only moves forward, from an arbitrary start (boot): made for durations and timeouts.
  • A battery-powered hardware clock (RTC) keeps time while the machine is off; the kernel reads it at boot, then counts with a CPU counter.
date                       # wall clock, in your time zone
cat /proc/uptime           # seconds since boot: monotonic
timedatectl                # wall clock, RTC, zone, NTP status

On your machine

alice@laptopexample
$ atfq 10.1
  Zone      Europe/Paris
  RTC       the hardware clock keeps UTC
  Source    tsc (also available: hpet, acpi_pm)
  Sync      systemd-timesyncd, synchronised
  Booted    2026-10-11 06:26 UTC

An example: Alice's laptop, one of the test machines. In your terminal, this block shows your own machine, read live.

Pitfalls

Deep dive 2 questions

Where does the kernel get the time from?

A clock source: a counter ticking at a known, steady rate. On x86 it's the TSC, a CPU register counting cycles; on ARM, the architected timer (arch_sys_counter); in VMs, often a paravirtual clock (kvm-clock). Reading it takes nanoseconds and needs no system call: clock_gettime runs in user space through the vDSO.

Why can the wall clock go backwards?

Because it's an estimate of real time, corrected from outside. NTP usually adjusts it gradually, speeding it up or slowing it slightly (slewing), but steps it when it's far off, at boot or after a long suspend. The monotonic clock is slewed too, but never stepped.

Commands
date timedatectl
Paths
/sys/devices/system/clocksource/
See also
10.2 Keeping the clock right: NTP
1.4 Interrupts: how devices get attention