linux-kernel - user/sys ticks for process exceeds overall user/sys ticks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20140219103805.03095e6b@sunflower.ssw.jku.at>
Date:	Wed, 19 Feb 2014 10:38:05 +0100
From:	Peter Hofer <peter.hofer@....at>
To:	linux-kernel@...r.kernel.org
Subject: user/sys ticks for process exceeds overall user/sys ticks

Hello everyone,

 I am trying to determine what fraction of the whole system's user and
sys time are consumed by a specific process, over a period of time.
Hence, I read the respective tick counts from the first lines
of /proc/stat and /proc/<pid>/stat at the start and end of that period
and compute deltas.

However, on an otherwise idle system, I often see the ticks consumed by
a threaded process exceed those of the whole system. The difference is
not just a few ticks, but can amount to over 10%, regardless of how
long the observed time period is. There is no virtualization involved.
I have been able to reproduce this with the current openSUSE and Ubuntu
releases on different x86_64 machines.

How can this be explained? Intuitively, I would expect that a tick
accounted to a running task is at the same time accounted to the CPU it
is running on, and so a process can never be accounted more ticks than
the whole system, i.e. all CPUs.

I have attached a simple Python script to reproduce this behavior.
Example output:

> ./ticks.py 
delta process: user: 2495 sys: 181
delta all: user: 2283 sys: 258

Thanks,
 Peter
View attachment "ticks.py" of type "text/plain" (1019 bytes)