PR feedback

Signed-off-by: Alan Jowett <[email protected]>

libs/execution_context/ebpf_maps.c

@@ -1203,15 +1203,15 @@ _insert_into_hot_list(_Inout_ ebpf_core_lru_map_t* map, size_t partition, _Inout
     switch (key_state) {
     case EBPF_LRU_KEY_UNINITIALIZED:
         EBPF_LRU_ENTRY_GENERATION_PTR(map, entry)[partition] = map->partitions[partition].current_generation;
-        EBPF_LRU_ENTRY_LAST_USED_TIME_PTR(map, entry)[partition] = KeQueryInterruptTime();
+        EBPF_LRU_ENTRY_LAST_USED_TIME_PTR(map, entry)[partition] = ebpf_query_time_sinc_boot_approximate(false);
         ebpf_list_insert_tail(
             &map->partitions[partition].hot_list, &EBPF_LRU_ENTRY_LIST_ENTRY_PTR(map, entry)[partition]);
         map->partitions[partition].hot_list_size++;
         break;
     case EBPF_LRU_KEY_COLD:
         // Remove from cold list.
         EBPF_LRU_ENTRY_GENERATION_PTR(map, entry)[partition] = map->partitions[partition].current_generation;
-        EBPF_LRU_ENTRY_LAST_USED_TIME_PTR(map, entry)[partition] = KeQueryInterruptTime();
+        EBPF_LRU_ENTRY_LAST_USED_TIME_PTR(map, entry)[partition] = ebpf_query_time_sinc_boot_approximate(false);
         ebpf_list_remove_entry(&EBPF_LRU_ENTRY_LIST_ENTRY_PTR(map, entry)[partition]);
         ebpf_list_insert_tail(
             &map->partitions[partition].hot_list, &EBPF_LRU_ENTRY_LIST_ENTRY_PTR(map, entry)[partition]);

libs/runtime/ebpf_platform.c

@@ -225,6 +225,18 @@ ebpf_query_time_since_boot(bool include_suspended_time)
     }
 }
 
+uint64_t
+ebpf_query_time_sinc_boot_approximate(bool include_suspend_time)
+{
+    LARGE_INTEGER time;
+    if (include_suspend_time) {
+        time = KeQueryInterruptTime();
+    } else {
+        time = KeQueryUnbiasedInterruptTime();
+    }
+    return time.QuadPart;
+}
+
 MDL*
 ebpf_map_memory(size_t length)
 {

libs/runtime/ebpf_platform.h

@@ -640,6 +640,19 @@ extern "C"
     uint64_t
     ebpf_query_time_since_boot(bool include_suspended_time);
 
+    /**
+     * @brief Return time elapsed since boot in units of 100 nanoseconds.
+     * This function is faster than ebpf_query_time_since_boot() but may not
+     * be as accurate.
+     *
+     * @param[in] include_suspended_time Include time the system spent in a suspended state.
+     *
+     * @return Time elapsed since boot in 100 nanosecond units.
+     */
+    EBPF_INLINE_HINT
+    uint64_t
+    ebpf_query_time_sinc_boot_approximate(bool include_suspended_time);
+
     /**
      * @brief Affinitize the current thread to a specific CPU by index and return the old affinity.
      *