On Wed, 5 Feb 2025 02:30:22 +0800 Jason Xing wrote: > + if (cgroup_bpf_enabled(CGROUP_SOCK_OPS) && > + SK_BPF_CB_FLAG_TEST(sk, SK_BPF_CB_TX_TIMESTAMPING) && skb) { > + struct skb_shared_info *shinfo = skb_shinfo(skb); > + struct tcp_skb_cb *tcb = TCP_SKB_CB(skb); > + > + tcb->txstamp_ack_bpf = 1; > + shinfo->tx_flags |= SKBTX_BPF; > + shinfo->tskey = TCP_SKB_CB(skb)->seq + skb->len - 1; > + } If BPF program is attached we'll timestamp all skbs? Am I reading this right? Wouldn't it be better to let BPF_SOCK_OPS_TS_SND_CB return whether it's interested in tracing current packet all the way thru the stack?