return &bpf_map_peek_elem_proto;
        case BPF_FUNC_ktime_get_ns:
                return &bpf_ktime_get_ns_proto;
+       case BPF_FUNC_ktime_get_boot_ns:
+               return &bpf_ktime_get_boot_ns_proto;
        case BPF_FUNC_tail_call:
                return &bpf_tail_call_proto;
        case BPF_FUNC_get_prandom_u32:
 
 extern const struct bpf_func_proto bpf_get_numa_node_id_proto;
 extern const struct bpf_func_proto bpf_tail_call_proto;
 extern const struct bpf_func_proto bpf_ktime_get_ns_proto;
+extern const struct bpf_func_proto bpf_ktime_get_boot_ns_proto;
 extern const struct bpf_func_proto bpf_get_current_pid_tgid_proto;
 extern const struct bpf_func_proto bpf_get_current_uid_gid_proto;
 extern const struct bpf_func_proto bpf_get_current_comm_proto;
 
  * u64 bpf_ktime_get_ns(void)
  *     Description
  *             Return the time elapsed since system boot, in nanoseconds.
+ *             Does not include time the system was suspended.
+ *             See: clock_gettime(CLOCK_MONOTONIC)
  *     Return
  *             Current *ktime*.
  *
  *             * **-EOPNOTSUPP**       Unsupported operation, for example a
  *                                     call from outside of TC ingress.
  *             * **-ESOCKTNOSUPPORT**  Socket type not supported (reuseport).
+ *
+ * u64 bpf_ktime_get_boot_ns(void)
+ *     Description
+ *             Return the time elapsed since system boot, in nanoseconds.
+ *             Does include the time the system was suspended.
+ *             See: clock_gettime(CLOCK_BOOTTIME)
+ *     Return
+ *             Current *ktime*.
  */
 #define __BPF_FUNC_MAPPER(FN)          \
        FN(unspec),                     \
        FN(xdp_output),                 \
        FN(get_netns_cookie),           \
        FN(get_current_ancestor_cgroup_id),     \
-       FN(sk_assign),
+       FN(sk_assign),                  \
+       FN(ktime_get_boot_ns),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
 
 const struct bpf_func_proto bpf_get_smp_processor_id_proto __weak;
 const struct bpf_func_proto bpf_get_numa_node_id_proto __weak;
 const struct bpf_func_proto bpf_ktime_get_ns_proto __weak;
+const struct bpf_func_proto bpf_ktime_get_boot_ns_proto __weak;
 
 const struct bpf_func_proto bpf_get_current_pid_tgid_proto __weak;
 const struct bpf_func_proto bpf_get_current_uid_gid_proto __weak;
 
        .ret_type       = RET_INTEGER,
 };
 
+BPF_CALL_0(bpf_ktime_get_boot_ns)
+{
+       /* NMI safe access to clock boottime */
+       return ktime_get_boot_fast_ns();
+}
+
+const struct bpf_func_proto bpf_ktime_get_boot_ns_proto = {
+       .func           = bpf_ktime_get_boot_ns,
+       .gpl_only       = false,
+       .ret_type       = RET_INTEGER,
+};
+
 BPF_CALL_0(bpf_get_current_pid_tgid)
 {
        struct task_struct *task = current;
                return &bpf_tail_call_proto;
        case BPF_FUNC_ktime_get_ns:
                return &bpf_ktime_get_ns_proto;
+       case BPF_FUNC_ktime_get_boot_ns:
+               return &bpf_ktime_get_boot_ns_proto;
        default:
                break;
        }
 
                return &bpf_map_peek_elem_proto;
        case BPF_FUNC_ktime_get_ns:
                return &bpf_ktime_get_ns_proto;
+       case BPF_FUNC_ktime_get_boot_ns:
+               return &bpf_ktime_get_boot_ns_proto;
        case BPF_FUNC_tail_call:
                return &bpf_tail_call_proto;
        case BPF_FUNC_get_current_pid_tgid:
 
  * u64 bpf_ktime_get_ns(void)
  *     Description
  *             Return the time elapsed since system boot, in nanoseconds.
+ *             Does not include time the system was suspended.
+ *             See: clock_gettime(CLOCK_MONOTONIC)
  *     Return
  *             Current *ktime*.
  *
  *             * **-EOPNOTSUPP**       Unsupported operation, for example a
  *                                     call from outside of TC ingress.
  *             * **-ESOCKTNOSUPPORT**  Socket type not supported (reuseport).
+ *
+ * u64 bpf_ktime_get_boot_ns(void)
+ *     Description
+ *             Return the time elapsed since system boot, in nanoseconds.
+ *             Does include the time the system was suspended.
+ *             See: clock_gettime(CLOCK_BOOTTIME)
+ *     Return
+ *             Current *ktime*.
  */
 #define __BPF_FUNC_MAPPER(FN)          \
        FN(unspec),                     \
        FN(xdp_output),                 \
        FN(get_netns_cookie),           \
        FN(get_current_ancestor_cgroup_id),     \
-       FN(sk_assign),
+       FN(sk_assign),                  \
+       FN(ktime_get_boot_ns),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call