New options were introduced to FLOW_ACTION_POLICE after struct
dsa_mall_policer_tc_entry was added. The following commands will succeed
on DSA ports:

  tc qdisc add dev lan1 handle ffff: ingress
  tc filter add dev lan1 ingress matchall skip_sw action police \
    pkts_rate 80000 pkts_burst 100 mtu 1000 conform-exceed ok

resulting
  1. burst_pkt, rate_pkt_ps, etc. being ignored;
  2. burst and rate_bytes_per_sec set to 0 without any error.

Among new options, some may be useful to hardware offloading, such as
packet rate mode. Instead of making decisions for drivers, extend struct
dsa_mall_policer_tc_entry to all options of FLOW_ACTION_POLICE.

Drivers should reject unsupported combinations in their
.port_policer_add() implementations.

We are also aware that .port_policer_add() have been implemented in some
DSA drivers - they have already been affected by the above issue (since
we didn't conduct any checks on our side). However, it's up to them to
decide if options should be checked (which may cause regressions with
previously successful configurations), or they are satisfied with the
current behavior - if not, they should submit their own patches to fix
it.

Signed-off-by: David Yang <mmyangfl@gmail.com>
---
v1: https://lore.kernel.org/r/20260126061340.757543-1-mmyangfl@gmail.com
  - fix DSA core only
 include/net/dsa.h | 11 +++++++++++
 net/dsa/user.c    | 11 +++++++++++
 2 files changed, 22 insertions(+)

diff --git a/include/net/dsa.h b/include/net/dsa.h
index 6b2b5ed64ea4..4c177b168ec8 100644
--- a/include/net/dsa.h
+++ b/include/net/dsa.h
@@ -21,6 +21,7 @@
 #include <linux/phylink.h>
 #include <net/devlink.h>
 #include <net/switchdev.h>
+#include <net/flow_offload.h>
 
 struct dsa_8021q_context;
 struct tc_action;
@@ -220,6 +221,16 @@ struct dsa_mall_mirror_tc_entry {
 struct dsa_mall_policer_tc_entry {
 	u32 burst;
 	u64 rate_bytes_per_sec;
+	u64 peakrate_bytes_ps;
+	u32 avrate;
+	u16 overhead;
+	u64 burst_pkt;
+	u64 rate_pkt_ps;
+	u32 mtu;
+	struct {
+		enum flow_action_id act_id;
+		u32 extval;
+	} exceed, notexceed;
 };
 
 /* TC matchall entry */
diff --git a/net/dsa/user.c b/net/dsa/user.c
index f59d66f0975d..2a209b83c701 100644
--- a/net/dsa/user.c
+++ b/net/dsa/user.c
@@ -1497,8 +1497,19 @@ dsa_user_add_cls_matchall_police(struct net_device *dev,
 	mall_tc_entry->cookie = cls->cookie;
 	mall_tc_entry->type = DSA_PORT_MALL_POLICER;
 	policer = &mall_tc_entry->policer;
+	/* until they export the type of act->police in flow_offload.h ... */
 	policer->rate_bytes_per_sec = act->police.rate_bytes_ps;
 	policer->burst = act->police.burst;
+	policer->peakrate_bytes_ps = act->police.peakrate_bytes_ps;
+	policer->avrate = act->police.avrate;
+	policer->overhead = act->police.overhead;
+	policer->burst_pkt = act->police.burst_pkt;
+	policer->rate_pkt_ps = act->police.rate_pkt_ps;
+	policer->mtu = act->police.mtu;
+	policer->exceed.act_id = act->police.exceed.act_id;
+	policer->exceed.extval = act->police.exceed.extval;
+	policer->notexceed.act_id = act->police.notexceed.act_id;
+	policer->notexceed.extval = act->police.notexceed.extval;
 
 	err = ds->ops->port_policer_add(ds, dp->index, policer);
 	if (err) {
-- 
2.51.0

On Sat, Jan 31, 2026 at 12:58:16PM +0800, David Yang wrote:
> diff --git a/net/dsa/user.c b/net/dsa/user.c
> index f59d66f0975d..2a209b83c701 100644
> --- a/net/dsa/user.c
> +++ b/net/dsa/user.c
> @@ -1497,8 +1497,19 @@ dsa_user_add_cls_matchall_police(struct net_device *dev,
>  	mall_tc_entry->cookie = cls->cookie;
>  	mall_tc_entry->type = DSA_PORT_MALL_POLICER;
>  	policer = &mall_tc_entry->policer;
> +	/* until they export the type of act->police in flow_offload.h ... */

There is no "us" and "them", it's a single git tree. Just submit a patch
to whomever ./scripts/get_maintainer.pl says to.

Have you tried something like the patch attached (just compile-tested)?

On Mon, Feb 2, 2026 at 6:52 PM Vladimir Oltean <olteanv@gmail.com> wrote:
>
> On Sat, Jan 31, 2026 at 12:58:16PM +0800, David Yang wrote:
> > diff --git a/net/dsa/user.c b/net/dsa/user.c
> > index f59d66f0975d..2a209b83c701 100644
> > --- a/net/dsa/user.c
> > +++ b/net/dsa/user.c
> > @@ -1497,8 +1497,19 @@ dsa_user_add_cls_matchall_police(struct net_device *dev,
> >       mall_tc_entry->cookie = cls->cookie;
> >       mall_tc_entry->type = DSA_PORT_MALL_POLICER;
> >       policer = &mall_tc_entry->policer;
> > +     /* until they export the type of act->police in flow_offload.h ... */
>
> There is no "us" and "them", it's a single git tree. Just submit a patch
> to whomever ./scripts/get_maintainer.pl says to.
>
> Have you tried something like the patch attached (just compile-tested)?

Yes, but I was afraid it would be kind of inconsistent not exposing
other struct flow_action_*. Nicer and better approach, though.

On Tue, Feb 03, 2026 at 09:40:02AM +0800, David Yang wrote:
> On Mon, Feb 2, 2026 at 6:52 PM Vladimir Oltean <olteanv@gmail.com> wrote:
> >
> > On Sat, Jan 31, 2026 at 12:58:16PM +0800, David Yang wrote:
> > > diff --git a/net/dsa/user.c b/net/dsa/user.c
> > > index f59d66f0975d..2a209b83c701 100644
> > > --- a/net/dsa/user.c
> > > +++ b/net/dsa/user.c
> > > @@ -1497,8 +1497,19 @@ dsa_user_add_cls_matchall_police(struct net_device *dev,
> > >       mall_tc_entry->cookie = cls->cookie;
> > >       mall_tc_entry->type = DSA_PORT_MALL_POLICER;
> > >       policer = &mall_tc_entry->policer;
> > > +     /* until they export the type of act->police in flow_offload.h ... */
> >
> > There is no "us" and "them", it's a single git tree. Just submit a patch
> > to whomever ./scripts/get_maintainer.pl says to.
> >
> > Have you tried something like the patch attached (just compile-tested)?
> 
> Yes, but I was afraid it would be kind of inconsistent not exposing
> other struct flow_action_*. Nicer and better approach, though.

Since it doesn't affect existing users of struct flow_action_entry,
I don't think it's that big a deal. You can take this patch and submit a
v3 with it if it helps.