问题描述

在业务稳定运行一段时间后，发现Enclave内部的系统时间出现漂移（enclave内部时间与primary VM系统时间不一致）。

解决方案

可使用chrony配置定时读取设备/dev/ptp0提供的时间

具体操作

1. 安装git及qt-enclave-bootstrap qingtian-tool包

yum install git make kernel-devel-$(uname -r)  qt-enclave-bootstrap qingtian-tool -y

2. 编译并安装virtio-qtbox驱动

• 从gitee获取开源代码

cd /home; git clone -b sync https://gitee.com/HuaweiCloudDeveloper/huawei-qingtian.git

• 编译并安装virtio-qtbox驱动

cd /home/huawei-qingtian/virtio-qtbox; make
make install

3. 安装docker

pip3 install docker knack
yum install docker -y

• 测试docker

docker version
docker run hello-world

4. 制作QingTian Enclave的eif

• 编译directShell作为调试程序

cp /home/huawei-qingtian/enclave/qtsm-sdk-c/tests/vsock_shell/vsock_shell.c /home/enclave_eif/
cd /home/enclave_eif/
gcc /home/enclave_eif/vsock_shell.c -o /home/enclave_eif/directShell
chmod 777 /home/enclave_eif/directShell

• 提前准备chrony的相关配置带入docker镜像

vim /home/enclave_eif/chrony.conf

• 使用以下配置作为chrony的配置

server ntp.myhuaweicloud.com minpoll 4 maxpoll 10 iburst
refclock PHC /dev/ptp0 poll 0 delay 0.000010 prefer
# Ignore stratum in source selection.
stratumweight 0.05

# Record the rate at which the system clock gains/losses time.
driftfile /var/lib/chrony/drift

# Enable kernel RTC synchronization.
rtcsync

# In first three updates step the system clock instead of slew
# if the adjustment is larger than 10 seconds.
makestep 1.0 -1

# Allow NTP client access from local network.
#allow 192.168/16

# Listen for commands only on localhost.
bindcmdaddress 127.0.0.1
bindcmdaddress ::1

# Serve time even if not synchronized to any NTP server.
#local stratum 10

# Disable logging of client accesses.
noclientlog

# Send a message to syslog if a clock adjustment is larger than 0.5 seconds.
logchange 0.5

logdir /var/log/chrony
#log measurements statistics tracking

• 使用以下Dockerfile文件

vim /home/enclave_eif/Dockerfile

FROM ubuntu:latest

RUN apt-get update && \
    apt-get install -y linuxptp chrony && \
    rm -rf /var/lib/apt/lists/*
COPY ./directShell /root/directShell
COPY ./chrony.conf /etc/chrony/chrony.conf

CMD ["/root/directShell"]

• 构建eif以及拉起QingTian Enclave

docker build -f /home/enclave_eif/Dockerfile -t enclave-ptp .

systemctl restart qt-enclave-env
qt enclave make-img --docker-uri enclave-ptp --eif enclave-ptp.eif
qt enclave start --cpus 2 --mem 1024 --eif /home/enclave_eif/enclave-ptp.eif --cid 4 --debug-mode
qt enclave query --enclave-id 0

• 使用nc-vsock登录调测chrony

cd /home
git clone https://github.com/stefanha/nc-vsock.git
cd /home/nc-vsock && make
/home/nc-vsock/nc-vsock 4 9999

• 拉起chronyd进程(为调测解释，此处为手动拉起)

/usr/sbin/chronyd -f /etc/chrony/chrony.conf

• 查看当前时间，修改当前时间，过一段时间再次查看，发现校回准确时间

date
date -s '+2 hours'
date