The helper uses CLOCK_MONOTONIC_COARSE source of time that is less accurate but more performant. We have a BPF CGROUP_SKB firewall that supports event logging through bpf_perf_event_output(). Each event has a timestamp and currently we use bpf_ktime_get_ns() for it. Use of bpf_ktime_get_coarse_ns() saves ~15-20 ns in time required for event logging. bpf_ktime_get_ns(): EgressLogByRemoteEndpoint 113.82ns 8.79M bpf_ktime_get_coarse_ns(): EgressLogByRemoteEndpoint 95.40ns 10.48M
Showing the changes to include/uapi/linux (1 of 6 files). Show all
Unified · Split
| @@ -3797,6 +3797,16 @@ union bpf_attr { · 3796 unmodified lines | |||
| 3797 | * is cleared if the flag is not specified. | 3797 | * is cleared if the flag is not specified. |
| 3798 | * Return | 3798 | * Return |
| 3799 | * **-EINVAL** if invalid *flags* are passed, zero otherwise. | 3799 | * **-EINVAL** if invalid *flags* are passed, zero otherwise. |
| 3800 | * | ||
| 3801 | * u64 bpf_ktime_get_coarse_ns(void) | ||
| 3802 | * Description | ||
| 3803 | * Return a coarse-grained version of the time elapsed since | ||
| 3804 | * system boot, in nanoseconds. Does not include time the system | ||
| 3805 | * was suspended. | ||
| 3806 | * | ||
| 3807 | * See: **clock_gettime**\ (**CLOCK_MONOTONIC_COARSE**) | ||
| 3808 | * Return | ||
| 3809 | * Current *ktime*. | ||
| 3800 | */ | 3810 | */ |
| 3801 | #define __BPF_FUNC_MAPPER(FN) \ | 3811 | #define __BPF_FUNC_MAPPER(FN) \ |
| 3802 | FN(unspec), \ | 3812 | FN(unspec), \ |
| @@ -3959,6 +3969,7 @@ union bpf_attr { · 156 unmodified lines | |||
| 3959 | FN(task_storage_delete), \ | 3969 | FN(task_storage_delete), \ |
| 3960 | FN(get_current_task_btf), \ | 3970 | FN(get_current_task_btf), \ |
| 3961 | FN(bprm_opts_set), \ | 3971 | FN(bprm_opts_set), \ |
| 3972 | FN(ktime_get_coarse_ns), \ | ||
| 3962 | /* */ | 3973 | /* */ |
| 3963 | 3974 | ||
| 3964 | /* integer value in 'imm' field of BPF_CALL instruction selects which helper | 3975 | /* integer value in 'imm' field of BPF_CALL instruction selects which helper |