People who run tcpdump want "wire" timestamps as close as possible.
Yes, things get delayed with the IRQ path, DMA delays, IRQ
mitigation and whatnot, but it's an order of magnitude worse if
you delay to user read() since that introduces also the delay of
the packet copies to userspace which are significantly larger than
these hardware level delays. If tcpdump gets swapped out, the
timestamp delay can be on the order of several seconds making it
totally useless.
My proposal wasn't to delay to user read, just to do the time stamp in socket
context. This means as soon as packet or RAW/UDP have looked up the socket and can
check a per socket flag do the time stamp.
The only delay this would add would be the queueing time from the NIC
to the softirq. Do you really think that is that bad?
-Andi