The helper uses CLOCK_MONOTONIC_COARSE source of time that is less accurate but more performant. We have a BPF CGROUP_SKB firewall that supports event logging through bpf_perf_event_output(). Each event has a timestamp and currently we use bpf_ktime_get_ns() for it. Use of bpf_ktime_get_coarse_ns() saves ~15-20 ns in time required for event logging. bpf_ktime_get_ns(): EgressLogByRemoteEndpoint 113.82ns 8.79M bpf_ktime_get_coarse_ns(): EgressLogByRemoteEndpoint 95.40ns 10.48M
Showing the changes to include/uapi/linux (1 of 6 files). Show all
Unified · Split
| @@ -3797,6 +3797,16 @@ union bpf_attr { · 3796 unmodified lines | ||
| 3797 | 3797 | * is cleared if the flag is not specified. |
| 3798 | 3798 | * Return |
| 3799 | 3799 | * **-EINVAL** if invalid *flags* are passed, zero otherwise. |
| 3800 | + * | |
| 3801 | + * u64 bpf_ktime_get_coarse_ns(void) | |
| 3802 | + * Description | |
| 3803 | + * Return a coarse-grained version of the time elapsed since | |
| 3804 | + * system boot, in nanoseconds. Does not include time the system | |
| 3805 | + * was suspended. | |
| 3806 | + * | |
| 3807 | + * See: **clock_gettime**\ (**CLOCK_MONOTONIC_COARSE**) | |
| 3808 | + * Return | |
| 3809 | + * Current *ktime*. | |
| 3800 | 3810 | */ |
| 3801 | 3811 | #define __BPF_FUNC_MAPPER(FN) \ |
| 3802 | 3812 | FN(unspec), \ |
| @@ -3959,6 +3969,7 @@ union bpf_attr { · 156 unmodified lines | ||
| 3959 | 3969 | FN(task_storage_delete), \ |
| 3960 | 3970 | FN(get_current_task_btf), \ |
| 3961 | 3971 | FN(bprm_opts_set), \ |
| 3972 | + FN(ktime_get_coarse_ns), \ | |
| 3962 | 3973 | /* */ |
| 3963 | 3974 | |
| 3964 | 3975 | /* integer value in 'imm' field of BPF_CALL instruction selects which helper |