[PATCH nf-next 0/3] netfilter: flowtable: update upper device stats in the fast path

[Julius Bairaktaris]

With the software flowtable, packets bypass the bridge, VLAN, PPPoE and
tunnel devices above the flowtable device, so their counters only see
the first packets of each connection. The classic forwarding path
always counts them, so this series does too, without a flag.

Patch 1 adds VLAN stats helpers; it touches include/linux/if_vlan.h, so
a netdev ack would let it go through nf-next. Patch 2 updates the
counters from the fast path with the lengths the classic path counts.
Patch 3 adds bridge, VLAN and tunnel counter checks to nft_flowtable.sh,
which fail without patches 1 and 2.

Hardware offloaded flows are not counted. A GSO packet sent through a
PPPoE device counts once, not once per segment.

Cost: struct flow_offload grows from 296 to 328 bytes (slab object 320
to 384). Forwarding from a bridge with a VLAN port to a veth in an x86
guest, mean of three interleaved runs without/with the series: TCP
55.7/55.0 Gbit/s, 64 byte UDP 177/173 kpps.

This series was written with the help of an AI coding assistant. I have
reviewed and tested it.

Julius Bairaktaris (3):
  8021q: add vlan_dev_sw_netstats_rx_add() and
    vlan_dev_sw_netstats_tx_add()
  netfilter: flowtable: update upper device stats in the fast path
  selftests: netfilter: nft_flowtable.sh: check upper device counters

 include/linux/if_vlan.h                       | 36 ++++++++++
 include/net/netfilter/nf_flow_table.h         |  8 ++-
 net/netfilter/nf_flow_table_core.c            |  3 +
 net/netfilter/nf_flow_table_ip.c              | 53 +++++++++++++++
 net/netfilter/nf_flow_table_path.c            |  9 +++
 .../selftests/net/netfilter/nft_flowtable.sh  | 67 +++++++++++++++++++
 6 files changed, 175 insertions(+), 1 deletion(-)


base-commit: 87b80c2f6b05cad9f0ff9136709c62a0f59923e3
-- 
2.53.0