On Thu, Oct 31, 2024 at 1:52 PM Martin KaFai Lau <martin.lau@xxxxxxxxx> wrote: > > On 10/30/24 7:41 PM, Jason Xing wrote: > > >> All that said, while looking at tcp_tx_timestamp() again, there is always > >> "shinfo->tskey = TCP_SKB_CB(skb)->seq + skb->len - 1;". shinfo->tskey can be > >> used directly as-is by the bpf prog. I think now I am missing why the bpf prog > >> needs the sk_tskey in the sk? > > > > As you said, tcp seqno could be treated as the key, but it leaks the > > information in TCP layer to users. Please see the commit: > > I don't think it is a concern for bpf prog running in the kernel. The sockops > bpf prog can already read the sk, the skb (which has seqno), and many others. > > The bpf prog is not a print-only logic. Only using bpf prog to do raw data > dumping is not fully utilizing its capability, e.g. data aggregation. The bpf > prog should aggregate the data first which is to calculate the delay here. Agree, I forgot BPF is only for admin, so it's a feasible solution. It saves a lot of energy :) It looks like the thing is getting simpler and simpler, which could be mostly taken over by bpf itself at last. Good news! Thanks, Jason
