Re: [PATCH] libpcapng: fix timestamp wrapping in output files

[Stephen Hemminger <stephen@networkplumber.org>]

On Sat,  7 May 2022 17:12:36 +0100
Quentin Armitage <quentin@armitage.org.uk> wrote:

> In pcap_tsc_to_ns(), delta * NSEC_PER_SEC will overflow approx 8
> seconds after pcap_init is called when using a TSC with a frequency
> of 2.5GHz.
> 
> To avoid the overflow, reread the time and TSC once
> delta * NSEC_PER_SEC > (1 << 63). In order to ensure that there
> is no overflow if there is a several second gap between calls to
> pcapng_tsc_to_ns() the actual check to reread the clock is:
>   delta > ((1ULL << 63) / NSEC_PER_SEC)
> 
> Fixes: 8d23ce8f5ee ("pcapng: add new library for writing pcapng files")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
> ---
>  lib/pcapng/rte_pcapng.c | 15 ++++++++++++++-
>  1 file changed, 14 insertions(+), 1 deletion(-)
> 
> diff --git a/lib/pcapng/rte_pcapng.c b/lib/pcapng/rte_pcapng.c
> index 90b2f5bc69..7770be725f 100644
> --- a/lib/pcapng/rte_pcapng.c
> +++ b/lib/pcapng/rte_pcapng.c
> @@ -34,7 +34,7 @@ struct rte_pcapng {
>  };
>  
>  /* For converting TSC cycles to PCAPNG ns format */
> -struct pcapng_time {
> +static struct pcapng_time {
>  	uint64_t ns;
>  	uint64_t cycles;
>  } pcapng_time;
> @@ -53,7 +53,21 @@ static uint64_t pcapng_tsc_to_ns(uint64_t cycles)
>  {
>  	uint64_t delta;
>  
> +	/* With a TSC frequency of 2.5GHz, delta * NSEC_PER_SEC will
> +	 * wrap in under 8 seconds. Once half that time has elapsed
> +	 * reread the system clock and TSC to ensure wrapping does not
> +	 * occur.
> +	 */
>  	delta = cycles - pcapng_time.cycles;
> +	if (delta > ((1ULL << 63) / NSEC_PER_SEC)) {
> +		pcapng_init();
> +		if (cycles > pcapng_time.cycles)
> +			delta = cycles - pcapng_time.cycles;
> +		else {
> +			delta = pcapng_time.cycles - cycles;
> +			return pcapng_time.ns - (delta * NSEC_PER_SEC) / rte_get_tsc_hz();
> +		}
> +	}
>  	return pcapng_time.ns + (delta * NSEC_PER_SEC) / rte_get_tsc_hz();
>  }
>  

Can't this be fixed by scaling better? Calling pcapng_init in fast path would
cause a system call, thats bad.