Re: [QUESTION] printk: time namespaces and printk timestamps

["Thomas Weißschuh" <linux@weissschuh.net>]

On 2026-05-25 11:30:08+0200, Petr Mladek wrote:
> On Mon 2026-05-25 10:47:46, Thomas Weißschuh wrote:
> > On 2026-05-25 10:37:40+0200, Petr Mladek wrote:
> > > On Sat 2026-05-23 17:20:45, Thomas Weißschuh wrote:
> > > > It looks like the monotonic timestamps of printk records do not take the
> > > > callers time namespace into account when emitted through /dev/kmsg,
> > > > /proc/kmsg and syslog(2).
> > > > 
> > > > To me this looks like a bug. What do you think? Should it be changed?
> > > 
> > > To be honest, I have never heard about time namespaces before ;-)
> > > 
> > > So, you propose to use the timestamp with the namespace-specific
> > > offset when a message is added from the given namespace, e.g. via:
> > > 
> > >    echo "This message is from another time space" > /dev/kmsg
> > > 
> > > Do I get it correctly?
> > 
> > My idea was rather to do the conversion when *reading* the message from
> > a time namespaced user process.
> 
> I see. But it might produce messages with negative timestamps. I am
> not sure if it is a good idea. I guess that many tools might get
> confused.

Yeah. While the time namespace core ensures that the observed "now" can
never be negative, messages that were recorded before the creation of
the namespace could result in negative timestamps.
These could be filtered out during formatting, but that is ugly, too.

> > > I see two potential problems:
> > > 
> > > 1. printk() historically used a monotonic clock. I am not sure if any
> > >    usespace application depends on it but there is a risk of breaking
> > >    something.
> > 
> > >From the perspective of the namespaced process currently the timestamps
> > from printk may in fact not be CLOCK_MONOTONIC.
> 
> The messages stored in the kernel ring buffer currently always have
> monotonic timestamps.

"monotonic" as in "never decreases" (obious) or "CLOCK_MONOTONIC"?
That is not actually well-documented I think.
dmesg(1) assumes CLOCK_MONOTONIC.

> I guess that you talk about matching kernel messages with other
> userspace logs. But they might be inconsistent also because
> of using different clocks...

Or matching it with clock_gettime().

> There were several discussions in the past about storing more
> timestamps from different clocks in the printk ring buffer.
> But it never went anywhere.

From the perspective of a namespaced process, this *is* the actual
CLOCK_MONOTONIC. It doesn't really know about any other one, and
the time APIs do not expose the un-namespaced clock value to a
namespaced process. So I am not sure this is the same usecase.

As a real-world example, dmesg(1) uses clock_gettime(CLOCK_MONOTONIC) in
its logic to format kmsg timestamps as wallcock/CLOCK_REALTIME ones:

# echo test > /dev/kmsg
# unshare -T --monotonic 5000000 dmesg --time-format iso | tail -1
2026-03-28T14:20:35,366875+01:00 test
# dmesg --time-format iso | tail -1
2026-05-25T12:13:55,366876+02:00 test
# date
Mon May 25 12:13:55 CEST 2026

The timestamp from the namespaced dmesg(1) is wrong.
(CLOCK_REALTIME itself is not namespace-aware)


Thomas