[PATCH net-next v3 0/4] net/sched: let actions drop their per CPU memory

[PATCH net-next v3 0/4] net/sched: let actions drop their per CPU memory

[Alexandre Cassen]

This series lets actions drop their per CPU stats and lets skip_sw
tunnel_key actions drop their dst cache:

- skbedit, police, mpls and sample honor TCA_ACT_FLAGS_NO_PERCPU_STATS.
- bpf, ife and skbmod honor it too. All actions now do.
- Action init sees the offload flags of the filter. A skip_sw filter
  alone now satisfies the skbedit queue_mapping check.
- tunnel_key skips the dst cache for skip_sw actions.

v3:
- Add patch 2 for bpf, ife and skbmod (Jamal).
- Add Jamal's Reviewed-by to patch 3.
- Correct the memory saving in patch 1 to 8 KB. The 6.5 KB in v2 ignored
  the padding that the alignment of the stats adds.
- Reword the title. Patch 2 does not concern hardware only actions.

v2: https://lore.kernel.org/netdev/20261104214607.556269-1-acassen@corp.free.fr/
- Add the act_api patch so that a skip_sw filter is enough for the
  tunnel_key patch (Sashiko [1], Jakub).
- Give the memory saving in the tunnel_key patch (Sashiko [1], Jakub)
  and in patch 1.
- Drop the race note from patch 1. Commit 1800f27a5ef8 ("net/sched:
  act_api: take tcfa_lock for hardware stats updates") fixes this race,
  which Sashiko [1] also flags.
- Add Jamal's Reviewed-by to patch 1 and the tunnel_key patch.

v1: https://lore.kernel.org/netdev/20261009051930.3619697-1-acassen@corp.free.fr/
[1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261009051930.3619697-1-acassen%40corp.free.fr

Alexandre Cassen (4):
  net/sched: honor TCA_ACT_FLAGS_NO_PERCPU_STATS in more actions
  net/sched: honor TCA_ACT_FLAGS_NO_PERCPU_STATS in bpf, ife and skbmod
  net/sched: act_api: pass the filter offload flags to action init
  net/sched: act_tunnel_key: skip dst cache for skip_sw actions

 net/sched/act_api.c        | 17 +++++++----------
 net/sched/act_bpf.c        |  8 ++++----
 net/sched/act_ife.c        | 24 ++++++++++++------------
 net/sched/act_mpls.c       |  8 ++++----
 net/sched/act_police.c     | 10 +++++-----
 net/sched/act_sample.c     |  6 +++---
 net/sched/act_skbedit.c    |  9 +++++----
 net/sched/act_skbmod.c     |  8 ++++----
 net/sched/act_tunnel_key.c | 10 +++++++---
 9 files changed, 51 insertions(+), 49 deletions(-)

-- 
2.43.0

[PATCH net-next v3 2/4] net/sched: honor TCA_ACT_FLAGS_NO_PERCPU_STATS in bpf, ife and skbmod

[Alexandre Cassen]

bpf, ife and skbmod are the last actions that ignore
TCA_ACT_FLAGS_NO_PERCPU_STATS. Commit 40bd094d65fc ("flow_offload: fill
flags to action structure") makes them store and dump the flag. They
still allocate per CPU stats, about 8 KB per action on a 128 CPU host.
Yet tc reports no_percpu on them.

Honor the flag here too. These actions run only in software. With
no_percpu every packet takes tcfa_lock to update the stats. Only the
users who set the flag pay this cost.

Signed-off-by: Alexandre Cassen <acassen@corp.free.fr>
---
 net/sched/act_bpf.c    |  8 ++++----
 net/sched/act_ife.c    | 24 ++++++++++++------------
 net/sched/act_skbmod.c |  8 ++++----
 3 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index 06d8f78b7368..3aea3ff5785f 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -42,7 +42,7 @@ TC_INDIRECT_SCOPE int tcf_bpf_act(struct sk_buff *skb,
 	int action, filter_res;
 
 	tcf_lastuse_update(&prog->tcf_tm);
-	bstats_update(this_cpu_ptr(prog->common.cpu_bstats), skb);
+	tcf_action_update_bstats(&prog->common, skb);
 
 	filter = rcu_dereference_bh(prog->filter);
 	if (at_ingress) {
@@ -76,7 +76,7 @@ TC_INDIRECT_SCOPE int tcf_bpf_act(struct sk_buff *skb,
 		break;
 	case TC_ACT_SHOT:
 		action = filter_res;
-		qstats_cpu_drop_inc(prog->common.cpu_qstats);
+		tcf_action_inc_drop_qstats(&prog->common);
 		break;
 	case TC_ACT_UNSPEC:
 		action = prog->tcf_action;
@@ -305,8 +305,8 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla,
 	index = parm->index;
 	ret = tcf_idr_check_alloc(tn, &index, act, bind);
 	if (!ret) {
-		ret = tcf_idr_create(tn, index, est, act,
-				     &act_bpf_ops, bind, true, flags);
+		ret = tcf_idr_create_from_flags(tn, index, est, act,
+						&act_bpf_ops, bind, flags);
 		if (ret < 0) {
 			tcf_idr_cleanup(tn, index);
 			return ret;
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 3946a9589bb8..a931f0d353d2 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -551,8 +551,8 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
 	}
 
 	if (!exists) {
-		ret = tcf_idr_create(tn, index, est, a, &act_ife_ops,
-				     bind, true, flags);
+		ret = tcf_idr_create_from_flags(tn, index, est, a,
+						&act_ife_ops, bind, flags);
 		if (ret) {
 			tcf_idr_cleanup(tn, index);
 			kfree(p);
@@ -720,7 +720,7 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
 
 	p = rcu_dereference_bh(ife->params);
 
-	bstats_update(this_cpu_ptr(ife->common.cpu_bstats), skb);
+	tcf_action_update_bstats(&ife->common, skb);
 	tcf_lastuse_update(&ife->tcf_tm);
 
 	if (skb_at_tc_ingress(skb))
@@ -728,7 +728,7 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
 
 	tlv_data = ife_decode(skb, &metalen);
 	if (unlikely(!tlv_data)) {
-		qstats_cpu_drop_inc(ife->common.cpu_qstats);
+		tcf_action_inc_drop_qstats(&ife->common);
 		return TC_ACT_SHOT;
 	}
 
@@ -742,7 +742,7 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
 		curr_data = ife_tlv_meta_decode(tlv_data, ifehdr_end, &mtype,
 						&dlen, NULL);
 		if (!curr_data) {
-			qstats_cpu_drop_inc(ife->common.cpu_qstats);
+			tcf_action_inc_drop_qstats(&ife->common);
 			return TC_ACT_SHOT;
 		}
 
@@ -751,7 +751,7 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
 			/* abuse overlimits to count metadata we cannot
 			 * decode: no ops for it, or the decoder rejected it
 			 */
-			qstats_cpu_overlimit_inc(ife->common.cpu_qstats);
+			tcf_action_inc_overlimit_qstats(&ife->common);
 
 			if (ret == -ENOENT)
 				pr_info_ratelimited("Unknown metaid %d dlen %d\n",
@@ -763,7 +763,7 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
 	}
 
 	if (WARN_ON(tlv_data != ifehdr_end)) {
-		qstats_cpu_drop_inc(ife->common.cpu_qstats);
+		tcf_action_inc_drop_qstats(&ife->common);
 		return TC_ACT_SHOT;
 	}
 
@@ -819,21 +819,21 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,
 			exceed_mtu = true;
 	}
 
-	bstats_update(this_cpu_ptr(ife->common.cpu_bstats), skb);
+	tcf_action_update_bstats(&ife->common, skb);
 	tcf_lastuse_update(&ife->tcf_tm);
 
 	if (!metalen) {		/* no metadata to send */
 		/* abuse overlimits to count when we allow packet
 		 * with no metadata
 		 */
-		qstats_cpu_overlimit_inc(ife->common.cpu_qstats);
+		tcf_action_inc_overlimit_qstats(&ife->common);
 		return action;
 	}
 	/* could be stupid policy setup or mtu config
 	 * so lets be conservative.. */
 	if ((action == TC_ACT_SHOT) || exceed_mtu) {
 drop:
-		qstats_cpu_drop_inc(ife->common.cpu_qstats);
+		tcf_action_inc_drop_qstats(&ife->common);
 		return TC_ACT_SHOT;
 	}
 
@@ -898,9 +898,9 @@ TC_INDIRECT_SCOPE int tcf_ife_act(struct sk_buff *skb,
 	int ret;
 
 	if (unlikely(!tcf_ife_is_eth_skb(skb))) {
-		bstats_update(this_cpu_ptr(ife->common.cpu_bstats), skb);
+		tcf_action_update_bstats(&ife->common, skb);
 		tcf_lastuse_update(&ife->tcf_tm);
-		qstats_cpu_drop_inc(ife->common.cpu_qstats);
+		tcf_action_inc_drop_qstats(&ife->common);
 		return TC_ACT_SHOT;
 	}
 
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index 09e9dcf58253..72dedb9b19a6 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -32,7 +32,7 @@ TC_INDIRECT_SCOPE int tcf_skbmod_act(struct sk_buff *skb,
 	u64 flags;
 
 	tcf_lastuse_update(&d->tcf_tm);
-	bstats_update(this_cpu_ptr(d->common.cpu_bstats), skb);
+	tcf_action_update_bstats(&d->common, skb);
 
 	p = rcu_dereference_bh(d->skbmod_p);
 	if (unlikely(p->action == TC_ACT_SHOT))
@@ -91,7 +91,7 @@ TC_INDIRECT_SCOPE int tcf_skbmod_act(struct sk_buff *skb,
 	return p->action;
 
 drop:
-	qstats_cpu_overlimit_inc(d->common.cpu_qstats);
+	tcf_action_inc_overlimit_qstats(&d->common);
 	return TC_ACT_SHOT;
 }
 
@@ -171,8 +171,8 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla,
 	}
 
 	if (!exists) {
-		ret = tcf_idr_create(tn, index, est, a,
-				     &act_skbmod_ops, bind, true, flags);
+		ret = tcf_idr_create_from_flags(tn, index, est, a,
+						&act_skbmod_ops, bind, flags);
 		if (ret) {
 			tcf_idr_cleanup(tn, index);
 			return ret;
-- 
2.43.0

Re: [PATCH net-next v3 2/4] net/sched: honor TCA_ACT_FLAGS_NO_PERCPU_STATS in bpf, ife and skbmod

[Jakub Kicinski]

On Mon,  9 Nov 2026 13:46:13 +0100 Alexandre Cassen wrote:
> -		ret = tcf_idr_create(tn, index, est, act,
> -				     &act_bpf_ops, bind, true, flags);
> +		ret = tcf_idr_create_from_flags(tn, index, est, act,
> +						&act_bpf_ops, bind, flags);

Now that we modified all actions could you take a look at removing 
the unnecessary API variants? tcf_idr_create() has one remaining
caller AFAICT, so we can probably rename tcf_idr_create_from_flags()
back to tcf_idr_create() and make using flags the default?

Re: [PATCH net-next v3 0/4] net/sched: let actions drop their per CPU memory

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon,  9 Nov 2026 13:46:11 +0100 you wrote:
> This series lets actions drop their per CPU stats and lets skip_sw
> tunnel_key actions drop their dst cache:
> 
> - skbedit, police, mpls and sample honor TCA_ACT_FLAGS_NO_PERCPU_STATS.
> - bpf, ife and skbmod honor it too. All actions now do.
> - Action init sees the offload flags of the filter. A skip_sw filter
>   alone now satisfies the skbedit queue_mapping check.
> - tunnel_key skips the dst cache for skip_sw actions.
> 
> [...]

Here is the summary with links:
  - [net-next,v3,1/4] net/sched: honor TCA_ACT_FLAGS_NO_PERCPU_STATS in more actions
    https://git.kernel.org/netdev/net-next/c/a4c9d4347525
  - [net-next,v3,2/4] net/sched: honor TCA_ACT_FLAGS_NO_PERCPU_STATS in bpf, ife and skbmod
    https://git.kernel.org/netdev/net-next/c/72760229298c
  - [net-next,v3,3/4] net/sched: act_api: pass the filter offload flags to action init
    https://git.kernel.org/netdev/net-next/c/7744652f1063
  - [net-next,v3,4/4] net/sched: act_tunnel_key: skip dst cache for skip_sw actions
    https://git.kernel.org/netdev/net-next/c/fc40a98e5be9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH net-next v3 2/4] net/sched: honor TCA_ACT_FLAGS_NO_PERCPU_STATS in bpf, ife and skbmod

[Alexandre Cassen]

On 11/12/26 02:22, Jakub Kicinski wrote:
> On Mon,  9 Nov 2026 13:46:13 +0100 Alexandre Cassen wrote:
>> -		ret = tcf_idr_create(tn, index, est, act,
>> -				     &act_bpf_ops, bind, true, flags);
>> +		ret = tcf_idr_create_from_flags(tn, index, est, act,
>> +						&act_bpf_ops, bind, flags);
> 
> Now that we modified all actions could you take a look at removing
> the unnecessary API variants? tcf_idr_create() has one remaining
> caller AFAICT, so we can probably rename tcf_idr_create_from_flags()
> back to tcf_idr_create() and make using flags the default?

ack, will have a look over the week-end (and try to respond to the 
sashiko boy on previous mlx5 patchset for tunnel key partitioning)