On Thu, May 08, 2025 at 08:22:39PM +0800, Jason Xing wrote:

Thanks for the kind reply.

It looks like how to detect depends on how the bpf prog is written?
Mostly depends on how the writer handles this data part. Even though
we don't guarantee on how to ask users/admins to write/adjust their
bpf codes, it's not that convenient for them if this patch is applied,
to be frank. I'm not pushing you to accept this patch, just curious on
"how and why". Now I can guess why you're opposed to it....

The BPF program is not user-generated, it is run in the context of the
function you're moving.

skb_tx_timestamp()
-> skb_clone_tx_timestamp()
   -> classify()
      -> ptp_classify_raw()
         -> bpf_prog_run(ptp_insns, skb)