[RFC] BPF timestamping

[Bruce Evans]

On Wed, 9 Jun 2010, Jung-uk Kim wrote:

> bpf(4) can only timestamp packets with microtime(9).  I want to expand
> it to be able to use different format and resolution.  The patch is
> here:
>
> http://people.freebsd.org/~jkim/bpf_tstamp.diff
>
> With this patch, we can select different format and resolution of the
> timestamps.  It is done via ioctl(2) with BIOCSTSTAMP command.
> Similarly, you can get the current format and resolution with
> BIOCGTSTAMP command.  Currently, the following functions are
> available:
>
> 	BPF_T_MICROTIME		microtime(9)
> 	BPF_T_NANOTIME		nanotime(9)
> 	BPF_T_BINTIME		bintime(9)
> 	BPF_T_MICROTIME_FAST	getmicrotime(9)
> 	BPF_T_NANOTIME_FAST	getnanotime(9)
> 	BPF_T_BINTIME_FAST	getbintime(9)
> 	BPF_T_NONE		ignore time stamps

This has too many timestamp types, yet not one timestamp type which
is any good except possibly BPF_T_NONE, and not one monotonic timestamp
type.  Only external uses and compatibility require use of CLOCK_REALTIME.

I recently tried looking at timeout resolution on FreeBSD cluster
machines using ktrace, and found ktrace unusable for this.  At
first I blamed the slowness of the default misconfiguered timecounter
ACPI-fast, but the main problem was that I forgot my home directory
was on nfs, and nfs makes writing ktrace records take hundreds of
times longer than on local file systems.  ACPI-fast seemed to be
taking nearly 1000 uS, but it was nfs taking that long.

Anyway, ACPI-fast takes nearly 1000 nS, which is many times too long
to be good for timestamping individual syscalls or packets, and makes
sub-microseconds resolution useless.  The above non-get *time()
interfaces still use the primary timecounter, and this might be slow
even if it is not misconfigured.  The above get*time() interfaces are
fast only at the cost of being broken.  Among other bugs, their times
only change at relatively large intervals which should become infinity
with tickless kernels.  (BTW, icmp timestamps are still broken on
systems with hz < 100.  Someone changed microtime() to getmicrotime(),
but getmicrotime() cannot deliver the resolution of 1 mS supported by
icmp timestamps unless these intervals are <= 1 mS.)

Bruce