On Wed, Feb 5, 2025 at 9:57 AM Jakub Kicinski <kuba@xxxxxxxxxx> wrote: > > On Wed, 5 Feb 2025 02:30:22 +0800 Jason Xing wrote: > > + if (cgroup_bpf_enabled(CGROUP_SOCK_OPS) && > > + SK_BPF_CB_FLAG_TEST(sk, SK_BPF_CB_TX_TIMESTAMPING) && skb) { > > + struct skb_shared_info *shinfo = skb_shinfo(skb); > > + struct tcp_skb_cb *tcb = TCP_SKB_CB(skb); > > + > > + tcb->txstamp_ack_bpf = 1; > > + shinfo->tx_flags |= SKBTX_BPF; > > + shinfo->tskey = TCP_SKB_CB(skb)->seq + skb->len - 1; > > + } > > If BPF program is attached we'll timestamp all skbs? Am I reading this > right? For now, not really because tcp_tx_timestamp() gets called only when dealing with the last part of this sendmsg(). So not all the skbs will be traced. > > Wouldn't it be better to let BPF_SOCK_OPS_TS_SND_CB return whether it's > interested in tracing current packet all the way thru the stack? This flag is mainly used to correlate the sendmsg timestamp with corresponding tskey, or else the skb travers the qdisc layer without knowing how to match its sendmsg. Thanks, Jason