KeQueryPerformanceCounter across VM's

NTDEV
1

Hi,

I’m doing some analysis of VM’s under Hyper-V and wondered if anybody knew
if the timestamps from KeQueryPerformanceCounter were correlated across
multiple VM’s under Hyper-V. It seems like if the time source is the HPET
counter, this might be the case, although it may just not work that way.

It would be convenient for my analysis if I could query the performance
counter from an app in a VM and then query the performance counter in a
driver in the parent partition or another vm, to measure the time interval
for say network traffic to make it from a VM to a parent partition driver.
It would be even more convenient if I could trigger ETW events in a VM and
events in the parent partition and have the timestamps across the two trace
files be from a common time base.

I’m doing this analysis on Win2008R2 RC (7100).

Jan

2

They come from a common clock source, so they won’t drift with respect to
each other, as long as you don’t pause any VM. But the offsets will all be
different. If you manage to figure out what the offsets are between all of
them, you might be able to figure out how to correlate all of it.

–
Jake Oshins
Hyper-V I/O Architect
Windows Kernel Group

This post implies no warranties and confers no rights.

“Jan Bottorff” wrote in message news:xxxxx@ntdev…
Hi,

I’m doing some analysis of VM’s under Hyper-V and wondered if anybody knew
if the timestamps from KeQueryPerformanceCounter were correlated across
multiple VM’s under Hyper-V. It seems like if the time source is the HPET
counter, this might be the case, although it may just not work that way.

It would be convenient for my analysis if I could query the performance
counter from an app in a VM and then query the performance counter in a
driver in the parent partition or another vm, to measure the time interval
for say network traffic to make it from a VM to a parent partition driver.
It would be even more convenient if I could trigger ETW events in a VM and
events in the parent partition and have the timestamps across the two trace
files be from a common time base.

I’m doing this analysis on Win2008R2 RC (7100).

Jan