linux-kernel - Re: Re: [RFC PATCH 00/11] trace-cmd: Support the feature recording trace data of guests on the host

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 27 Aug 2013 17:07:34 +0900
From:	Yoshihiro YUNOMAE <yoshihiro.yunomae.ez@...achi.com>
To:	Steven Rostedt <rostedt@...dmis.org>
Cc:	Hidehiro Kawai <hidehiro.kawai.ez@...achi.com>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	linux-kernel@...r.kernel.org, yrl.pp-manager.tt@...achi.com
Subject: Re: Re: [RFC PATCH 00/11] trace-cmd: Support the feature recording
 trace data of guests on the host

Hi Steven,

(2013/08/26 23:22), Steven Rostedt wrote:
> On Mon, 26 Aug 2013 10:46:38 +0900
> Yoshihiro YUNOMAE <yoshihiro.yunomae.ez@...achi.com> wrote:
>
>>> The --date option is used because the two machines are not in sync with
>>> the trace time stamp. What the date option does, is to sync the
>>> timestamp up with the gettimeofday and the output reports that. This
>>> allows the two boxes to report information that is relatively close to
>>> how the two interacted.
>>
>> Oh, I didn't know the --date option.
>> As you mentioned, we can merge trace data in chronological order by
>> using --date option if the times of those machines are synchronized by
>> NTP.
>>
>>> If the guest and the host have the same clock, then the --date option
>>> is not needed and the two should be able to be merged normally.
>>
>> No, we can not assure that the guest and the host have the same clock
>> even if it is running on the same physical machine, because both kernel
>> doesn't share it, there is some difference between them. So, we still
>> need time synchronizing guest-host by NTP and --date option.
>>
>> However, there are cases that times of those machines cannot be
>> synchronized. For example, although multiple users can run guests on
>> virtualization environments (e.g. multi-tenant cloud hosting), there
>> are no guarantee that they use the same NTP server. Moreover, even if
>> the times are synchronized, trace data cannot exactly be merged because
>> the NTP-synchronized time granularity may not be enough fine for
>> sorting guest-host switching events.
>
> Right, unless there's some other means no synchronize between boxes,
> this is currently the best we have.

I'm considering that trace data use x86-tsc as timestamp in order to
merge trace data. By using x86-tsc, we can merge trace data even if
time of those machines is not synchronized. And the precision will be
enough for understanding operations of guests and host. However, TSC
values on a guest are not equal to the values on the host because
         TSC_guest = TSC_host + TSC_offset.
This series actually doesn't support TSC offset, but I'd like to
add such feature to fix host/guest clock difference in the next series.
TSC offset values can be gotten as write_tsc_offset trace event from
kernel-3.11. (see https://lkml.org/lkml/2013/6/12/72)
How do you think about this merging feature?

Thanks,
Yoshihiro YUNOMAE

-- 
Yoshihiro YUNOMAE
Software Platform Research Dept. Linux Technology Center
Hitachi, Ltd., Yokohama Research Laboratory
E-mail: yoshihiro.yunomae.ez@...achi.com


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/