[PATCH 0/2] Drop redundant tcp_rate_check_app_limited calls

[PATCH 0/2] Drop redundant tcp_rate_check_app_limited calls

[Geliang Tang]

From: Geliang Tang <tanggeliang@kylinos.cn>

These two patches drop the redundant tcp_rate_check_app_limited() calls
before tcp_sendmsg_locked() in tcp_bpf_push() and tls_push_sg(), since
tcp_rate_check_app_limited() is already called inside tcp_sendmsg_locked().

Note:

The first patch was originally part of my ongoing "MPTCP sockmap support"
series [1] (patch 5). Matthieu suggested converting it to a fix and sending
it directly to netdev. Removing the redundant tcp_rate_check_app_limited()
call benefits my subsequent MPTCP work: in patch 3 of that series, I
implement an MPTCP-specific mptcp_rate_check_app_limited() function and
call it in mptcp_sendmsg_locked(). This allows me to reuse tcp_bpf_push()
by simply replacing tcp_sendmsg_locked() with

		sk->sk_socket->ops->sendmsg_locked(),

without carrying protocol-specific assumptions.

The second patch similarly benefits my ongoing "MPTCP KTLS support" work
[2]. In patch 9 of that series, I had defined a check_app_limited()
interface in struct tls_prot_ops, but this interface is unnecessary if we
can reuse the existing TLS infrastructure more cleanly.

[1]
MPTCP sockmap support
https://lore.kernel.org/mptcp/b5f9e8d7-b738-1df6-3b5e-1d54cbbc663c@gmail.com/T/#t

[2]
MPTCP KTLS support
https://lore.kernel.org/netdev/cover.1782123118.git.tanggeliang@kylinos.cn/

Geliang Tang (2):
  bpf: drop duplicate check_app_limited in tcp_bpf_push
  tls: drop duplicate check_app_limited in tls_push_sg

 net/ipv4/tcp_bpf.c | 1 -
 net/tls/tls_main.c | 2 --
 2 files changed, 3 deletions(-)

-- 
2.53.0

[PATCH bpf 1/2] bpf: drop duplicate check_app_limited in tcp_bpf_push

[Geliang Tang]

From: Geliang Tang <tanggeliang@kylinos.cn>

When the sendpage->MSG_SPLICE_PAGES migration series replaced
do_tcp_sendpages() with direct tcp_sendmsg_locked() calls, callers that
had used do_tcp_sendpages() kept an explicit tcp_rate_check_app_limited(sk)
that was originally needed to cover do_tcp_sendpages() (which did not call
tcp_rate_check_app_limited()). After the inlining, tcp_sendmsg_locked()
always provides the check, and the outer call became redundant.

The site changed here, tcp_bpf_push(), is a MSG_SPLICE_PAGES loop that
holds the socket lock and only iterates when size > 0; tcp_sendmsg_locked()
is invoked on every iteration with state identical to what the outer call
sees, so dropping the outer call is safe and behavior-preserving.

A potential benefit of this change is that it facilitates future reuse of
tcp_bpf_push() for sockmap support in protocols beyond TCP, such as MPTCP.
Since tcp_rate_check_app_limited() is TCP-specific while sendmsg_locked()
is a generic interface in struct proto_ops, this change allows us to switch
to different protocols via sk->sk_socket->ops->sendmsg_locked() without
carrying protocol-specific assumptions.

Fixes: ebf2e8860eea ("tcp_bpf: Inline do_tcp_sendpages as it's now a wrapper around tcp_sendmsg")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
---
 net/ipv4/tcp_bpf.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index 2e234d155b5e..d5fcf3ce4861 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -108,7 +108,6 @@ static int tcp_bpf_push(struct sock *sk, struct sk_msg *msg, u32 apply_bytes,
 		off  = sge->offset;
 		page = sg_page(sge);
 
-		tcp_rate_check_app_limited(sk);
 retry:
 		msghdr.msg_flags = flags | MSG_SPLICE_PAGES;
 		has_tx_ulp = tls_sw_has_ctx_tx(sk);
-- 
2.53.0

Re: [PATCH bpf 1/2] bpf: drop duplicate check_app_limited in tcp_bpf_push

[Jiayuan Chen]

On 9/14/26 3:14 PM, Geliang Tang wrote:
> From: Geliang Tang <tanggeliang@kylinos.cn>
>
> When the sendpage->MSG_SPLICE_PAGES migration series replaced
> do_tcp_sendpages() with direct tcp_sendmsg_locked() calls, callers that
> had used do_tcp_sendpages() kept an explicit tcp_rate_check_app_limited(sk)
> that was originally needed to cover do_tcp_sendpages() (which did not call
> tcp_rate_check_app_limited()). After the inlining, tcp_sendmsg_locked()
> always provides the check, and the outer call became redundant.
>
> The site changed here, tcp_bpf_push(), is a MSG_SPLICE_PAGES loop that
> holds the socket lock and only iterates when size > 0; tcp_sendmsg_locked()
> is invoked on every iteration with state identical to what the outer call
> sees, so dropping the outer call is safe and behavior-preserving.
>
> A potential benefit of this change is that it facilitates future reuse of
> tcp_bpf_push() for sockmap support in protocols beyond TCP, such as MPTCP.
> Since tcp_rate_check_app_limited() is TCP-specific while sendmsg_locked()
> is a generic interface in struct proto_ops, this change allows us to switch
> to different protocols via sk->sk_socket->ops->sendmsg_locked() without
> carrying protocol-specific assumptions.
>
> Fixes: ebf2e8860eea ("tcp_bpf: Inline do_tcp_sendpages as it's now a wrapper around tcp_sendmsg")


Same as the tls one: this looks like a cleanup to me. Is there a real 
regression that affects kernel or user behavior?

Do we really need a Fixes tag?


> Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
> ---
>   net/ipv4/tcp_bpf.c | 1 -
>   1 file changed, 1 deletion(-)
>
> diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
> index 2e234d155b5e..d5fcf3ce4861 100644
> --- a/net/ipv4/tcp_bpf.c
> +++ b/net/ipv4/tcp_bpf.c
> @@ -108,7 +108,6 @@ static int tcp_bpf_push(struct sock *sk, struct sk_msg *msg, u32 apply_bytes,
>   		off  = sge->offset;
>   		page = sg_page(sge);
>   
> -		tcp_rate_check_app_limited(sk);
>   retry:
>   		msghdr.msg_flags = flags | MSG_SPLICE_PAGES;
>   		has_tx_ulp = tls_sw_has_ctx_tx(sk);

Re: [PATCH bpf 1/2] bpf: drop duplicate check_app_limited in tcp_bpf_push

[gang.yan]

September 14, 2026 at 4:24 PM, "Jiayuan Chen" <jiayuan.chen@linux.dev mailto:jiayuan.chen@linux.dev?to=%22Jiayuan%20Chen%22%20%3Cjiayuan.chen%40linux.dev%3E > wrote:

> Same as the tls one: this looks like a cleanup to me. Is there a real regression that affects kernel or user behavior?
> 
> Do we really need a Fixes tag?
> 
Hi Jiayuan,

It's a part of the thread in [1], just kindly remind that there had some comments from Matt:

'''
Also, should this be seen as a fix? From what I understand, some
behaviours have changed, and it is only recently that this call is no
longer needed.
'''

From my view, it seems like that there have some misses in the 'fixed' commit, so the fix tag
should be kept, right?


[1] https://lore.kernel.org/mptcp/b5f9e8d7-b738-1df6-3b5e-1d54cbbc663c@gmail.com/T/#m1fbcb32408236e2c68554fd26353c98bb59633f9

Thanks
Gang
> > 
> > Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
> >  ---
> >  net/ipv4/tcp_bpf.c | 1 -
> >  1 file changed, 1 deletion(-)
> > 
> >  diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
> >  index 2e234d155b5e..d5fcf3ce4861 100644
> >  --- a/net/ipv4/tcp_bpf.c
> >  +++ b/net/ipv4/tcp_bpf.c
> >  @@ -108,7 +108,6 @@ static int tcp_bpf_push(struct sock *sk, struct sk_msg *msg, u32 apply_bytes,
> >  off = sge->offset;
> >  page = sg_page(sge);
> >  > - tcp_rate_check_app_limited(sk);
> >  retry:
> >  msghdr.msg_flags = flags | MSG_SPLICE_PAGES;
> >  has_tx_ulp = tls_sw_has_ctx_tx(sk);
> >
>

Re: [PATCH bpf 1/2] bpf: drop duplicate check_app_limited in tcp_bpf_push

[Matthieu Baerts]

Hi Gang, Jiayuan, Geliang,

On 14/09/2026 10:45, gang.yan@linux.dev wrote:
> September 14, 2026 at 4:24 PM, "Jiayuan Chen" <jiayuan.chen@linux.dev mailto:jiayuan.chen@linux.dev?to=%22Jiayuan%20Chen%22%20%3Cjiayuan.chen%40linux.dev%3E > wrote:
> 
>> Same as the tls one: this looks like a cleanup to me. Is there a real regression that affects kernel or user behavior?
>>
>> Do we really need a Fixes tag?
>>
> Hi Jiayuan,
> 
> It's a part of the thread in [1], just kindly remind that there had some comments from Matt:
> 
> '''
> Also, should this be seen as a fix? From what I understand, some
> behaviours have changed, and it is only recently that this call is no
> longer needed.
> '''
> 
> From my view, it seems like that there have some misses in the 'fixed' commit, so the fix tag
> should be kept, right?

When I first saw the modification, it fell like Geliang was fixing
something, hence my question. It is indeed fixing something, but if it
"just" avoids extra checks that are now useless, I agree that it doesn't
need to carry the fixes tag. (Except if it creates a noticeable perf
regression, but I don't think so here.)

If the Fixes tag is removed, it is always good to mention this commit to
help with the context (and just in case if this patch can help with the
backports). And also good to mention c5c37af6ecad9 ("tcp: Convert
do_tcp_sendpages() to use MSG_SPLICE_PAGES") in the commit message as well.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH bpf 1/2] bpf: drop duplicate check_app_limited in tcp_bpf_push

[gang.yan]

September 14, 2026 at 4:24 PM, "Jiayuan Chen" <jiayuan.chen@linux.dev mailto:jiayuan.chen@linux.dev?to=%22Jiayuan%20Chen%22%20%3Cjiayuan.chen%40linux.dev%3E > wrote:

> Same as the tls one: this looks like a cleanup to me. Is there a real regression that affects kernel or user behavior?
> 
> Do we really need a Fixes tag?
> 
Hi Jiayuan,

It's a part of the thread in [1], just kindly remind that there had some comments from Matt:

'''
Also, should this be seen as a fix? From what I understand, some
behaviours have changed, and it is only recently that this call is no
longer needed.
'''

From my view, it seems like that there have some misses in the 'fixed' commit, so the fix tag
should be kept, right?


[1] https://lore.kernel.org/mptcp/b5f9e8d7-b738-1df6-3b5e-1d54cbbc663c@gmail.com/T/#m1fbcb32408236e2c68554fd26353c98bb59633f9

Thanks
Gang
> > 
> > Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
> >  ---
> >  net/ipv4/tcp_bpf.c | 1 -
> >  1 file changed, 1 deletion(-)
> > 
> >  diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
> >  index 2e234d155b5e..d5fcf3ce4861 100644
> >  --- a/net/ipv4/tcp_bpf.c
> >  +++ b/net/ipv4/tcp_bpf.c
> >  @@ -108,7 +108,6 @@ static int tcp_bpf_push(struct sock *sk, struct sk_msg *msg, u32 apply_bytes,
> >  off = sge->offset;
> >  page = sg_page(sge);
> >  > - tcp_rate_check_app_limited(sk);
> >  retry:
> >  msghdr.msg_flags = flags | MSG_SPLICE_PAGES;
> >  has_tx_ulp = tls_sw_has_ctx_tx(sk);
> >
>

Re: [PATCH bpf 1/2] bpf: drop duplicate check_app_limited in tcp_bpf_push

[Geliang Tang]

Hi Jiayuan,

On Mon, 2026-09-14 at 16:24 +0800, Jiayuan Chen wrote:
> 
> On 9/14/26 3:14 PM, Geliang Tang wrote:
> > From: Geliang Tang <tanggeliang@kylinos.cn>
> > 
> > When the sendpage->MSG_SPLICE_PAGES migration series replaced
> > do_tcp_sendpages() with direct tcp_sendmsg_locked() calls, callers
> > that
> > had used do_tcp_sendpages() kept an explicit
> > tcp_rate_check_app_limited(sk)
> > that was originally needed to cover do_tcp_sendpages() (which did
> > not call
> > tcp_rate_check_app_limited()). After the inlining,
> > tcp_sendmsg_locked()
> > always provides the check, and the outer call became redundant.
> > 
> > The site changed here, tcp_bpf_push(), is a MSG_SPLICE_PAGES loop
> > that
> > holds the socket lock and only iterates when size > 0;
> > tcp_sendmsg_locked()
> > is invoked on every iteration with state identical to what the
> > outer call
> > sees, so dropping the outer call is safe and behavior-preserving.
> > 
> > A potential benefit of this change is that it facilitates future
> > reuse of
> > tcp_bpf_push() for sockmap support in protocols beyond TCP, such as
> > MPTCP.
> > Since tcp_rate_check_app_limited() is TCP-specific while
> > sendmsg_locked()
> > is a generic interface in struct proto_ops, this change allows us
> > to switch
> > to different protocols via sk->sk_socket->ops->sendmsg_locked()
> > without
> > carrying protocol-specific assumptions.
> > 
> > Fixes: ebf2e8860eea ("tcp_bpf: Inline do_tcp_sendpages as it's now
> > a wrapper around tcp_sendmsg")
> 
> 
> Same as the tls one: this looks like a cleanup to me. Is there a real
> regression that affects kernel or user behavior?
> 
> Do we really need a Fixes tag?

Thanks for the review. I fully agree - I'll drop the "Fixes" tags and
update the commit logs in v2.

Thanks,
-Geliang

> 
> 
> > Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
> > ---
> >   net/ipv4/tcp_bpf.c | 1 -
> >   1 file changed, 1 deletion(-)
> > 
> > diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
> > index 2e234d155b5e..d5fcf3ce4861 100644
> > --- a/net/ipv4/tcp_bpf.c
> > +++ b/net/ipv4/tcp_bpf.c
> > @@ -108,7 +108,6 @@ static int tcp_bpf_push(struct sock *sk, struct
> > sk_msg *msg, u32 apply_bytes,
> >   		off  = sge->offset;
> >   		page = sg_page(sge);
> >   
> > -		tcp_rate_check_app_limited(sk);
> >   retry:
> >   		msghdr.msg_flags = flags | MSG_SPLICE_PAGES;
> >   		has_tx_ulp = tls_sw_has_ctx_tx(sk);

[PATCH net 2/2] tls: drop duplicate check_app_limited in tls_push_sg

[Geliang Tang]

From: Geliang Tang <tanggeliang@kylinos.cn>

When the sendpage->MSG_SPLICE_PAGES migration series replaced
do_tcp_sendpages() with direct tcp_sendmsg_locked() calls, callers that
had used do_tcp_sendpages() kept an explicit tcp_rate_check_app_limited(sk)
that was originally needed to cover do_tcp_sendpages() (which did not call
tcp_rate_check_app_limited()). After the inlining, tcp_sendmsg_locked()
always provides the check, and the outer call became redundant.

The site changed here, tls_push_sg(), is a MSG_SPLICE_PAGES loop that holds
the socket lock and only iterates when size > 0; tcp_sendmsg_locked() is
invoked on every iteration with state identical to what the outer call
sees, so dropping the outer call is safe and behavior-preserving.

A potential benefit of this change is that it facilitates future reuse of
tls_push_sg() for KTLS support in protocols beyond TCP, such as MPTCP.
Since tcp_rate_check_app_limited() is TCP-specific while sendmsg_locked()
is a generic interface in struct proto_ops, this change allows us to switch
to different protocols via sk->sk_socket->ops->sendmsg_locked() without
carrying protocol-specific assumptions.

Fixes: e117dcfd646e ("tls: Inline do_tcp_sendpages()")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
---
 net/tls/tls_main.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index fbb274287aa5..8bdb78718a8d 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -185,8 +185,6 @@ int tls_push_sg(struct sock *sk,
 
 	ctx->splicing_pages = true;
 	while (1) {
-		/* is sending application-limited? */
-		tcp_rate_check_app_limited(sk);
 		p = sg_page(sg);
 retry:
 		bvec_set_page(&bvec, p, size, offset);
-- 
2.53.0

Re: [PATCH net 2/2] tls: drop duplicate check_app_limited in tls_push_sg

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 3334 bytes --]

> When the sendpage->MSG_SPLICE_PAGES migration series replaced
> do_tcp_sendpages() with direct tcp_sendmsg_locked() calls, callers that
> had used do_tcp_sendpages() kept an explicit tcp_rate_check_app_limited(sk)
> that was originally needed to cover do_tcp_sendpages() (which did not call
> tcp_rate_check_app_limited()). After the inlining, tcp_sendmsg_locked()
> always provides the check, and the outer call became redundant.
>
> Fixes: e117dcfd646e ("tls: Inline do_tcp_sendpages()")

Does the Fixes: tag identify the correct commit? The changelog states the
outer call "was originally needed to cover do_tcp_sendpages() (which did
not call tcp_rate_check_app_limited())" and that it "became redundant"
only "after the inlining". But e117dcfd646e did not introduce the
redundancy.

At e117dcfd646e's parent, do_tcp_sendpages() was already a thin wrapper
that funnels into tcp_sendmsg_locked():

  ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset,
                           size_t size, int flags)
  {
          struct bio_vec bvec;
          struct msghdr msg = { .msg_flags = flags | MSG_SPLICE_PAGES, };
          bvec_set_page(&bvec, page, size, offset);
          iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size);
          if (flags & MSG_SENDPAGE_NOTLAST)
                  msg.msg_flags |= MSG_MORE;
          return tcp_sendmsg_locked(sk, &msg, size);
  }

The conversion that made this true - and therefore the commit that made
the tls_push_sg() call redundant - is c5c37af6ecad9 ("tcp: Convert
do_tcp_sendpages() to use MSG_SPLICE_PAGES"), three commits earlier in
the same series. Before c5c37af6ecad9, do_tcp_sendpages() open-coded the
send loop and indeed had no rate check, and tcp_sendmsg_locked() already
carried tcp_rate_check_app_limited() at that point. e117dcfd646e only
replaced the wrapper call with its body; it left the
tcp_rate_check_app_limited(sk) line untouched as diff context.

If a Fixes: tag is kept, should it be:

  Fixes: c5c37af6ecad9 ("tcp: Convert do_tcp_sendpages() to use MSG_SPLICE_PAGES")

Both commits landed in the same merge window, so the practical backport
range is unchanged.


> so dropping the outer call is safe and behavior-preserving.
>
> A potential benefit of this change is that it facilitates future reuse of
> tls_push_sg() for KTLS support in protocols beyond TCP, such as MPTCP.
>
> Fixes: e117dcfd646e ("tls: Inline do_tcp_sendpages()")

Should this patch carry a Fixes: tag? The changelog describes the change
as "safe and behavior-preserving" and motivates it as cleanup plus
preparation for future MPTCP reuse. No user-visible bug, regression, crash
or misbehaviour is described or fixed: the removed
tcp_rate_check_app_limited(sk) is duplicated by the identical call inside
tcp_sendmsg_locked(), so tp->app_limited ends up with the same value
either way.

A Fixes: tag on a no-op cleanup mainly serves to draw the patch into
automated stable selection (AUTOSEL) for no benefit. Either drop the tag,
or state concretely what observable behaviour was wrong before so the tag
is justified.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/34817950722

Re: [PATCH 0/2] Drop redundant tcp_rate_check_app_limited calls

[Jakub Kicinski]

On Mon, 14 Sep 2026 15:14:21 +0800 Geliang Tang wrote:
>   bpf: drop duplicate check_app_limited in tcp_bpf_push
>   tls: drop duplicate check_app_limited in tls_push_sg

you can't have 2 patches in one series targeting different trees

Re: [PATCH 0/2] Drop redundant tcp_rate_check_app_limited calls

[Geliang Tang]

Hi Jakub,

On Tue, 2026-09-15 at 16:01 -0700, Jakub Kicinski wrote:
> On Mon, 14 Sep 2026 15:14:21 +0800 Geliang Tang wrote:
> >   bpf: drop duplicate check_app_limited in tcp_bpf_push
> >   tls: drop duplicate check_app_limited in tls_push_sg
> 
> you can't have 2 patches in one series targeting different trees

Right, my bad. I'll send them as two separate patches in v3, each to
its own tree.

Thanks,
-Geliang