kernel/git/next/linux-next.git/drivers/net/netdevsim/ipsec.c, branch master

netdevsim: print IPsec salt/key in network byte order

2026-09-09T20:35:04+00:00

nsim_sa.key[] and nsim_sa.salt hold raw key material in network byte order, but are typed as plain u32 and printed with "%08x" in the debugfs read handler. This prints host-endian, so output differs between little- and big-endian hosts for the same key: little-endian: salt=0x61626364 key=0x34333231 38373635 32313039 36353433 big-endian: salt=0x64636261 key=0x31323334 35363738 39303132 33343536 This breaks selftests/net/rtnetlink.sh's ipsec_offload subtest on big-endian (e.g. s390x), which hardcodes the little-endian output. Retype key[]/salt to __be32, matching ipaddr[], and convert with be32_to_cpu() before printing. Output is now network-order on every host, independent of endianness. A similar fix was proposed in 2022 but kept the u32 typing, so sparse couldn't validate the added ntohl() calls and it stalled in review. Retyping first avoids that problem. `make C=2` on netdevsim reports the same zero warnings as before this change. Selftest update follows in the next patch. Cc: stable+noautosel@kernel.org # never worked Reported-by: Kleber Sacilotto de Souza Link: https://lore.kernel.org/netdev/20220308135106.890270-1-kleber.souza@canonical.com/ Signed-off-by: Andrei Gherzan Link: https://patch.msgid.link/20260908140325.13367-2-andrei.gherzan@canonical.com Signed-off-by: Jakub Kicinski

netdevsim: add ipsec hw_features

2025-10-16T22:44:32+00:00

Currently, netdevsim only sets dev->features, which makes the ESP features fixed. For example: # ethtool -k eni0np1 | grep esp tx-esp-segmentation: on [fixed] esp-hw-offload: on [fixed] esp-tx-csum-hw-offload: on [fixed] This patch adds the ESP features to hw_features, allowing them to be changed manually. For example: # ethtool -k eni0np1 | grep esp tx-esp-segmentation: on esp-hw-offload: on esp-tx-csum-hw-offload: on Suggested-by: Sabrina Dubroca Signed-off-by: Hangbin Liu Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20251015083649.54744-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski

xfrm: Add explicit dev to .xdo_dev_state_{add,delete,free}

2025-04-16T09:01:41+00:00

Previously, device driver IPSec offload implementations would fall into two categories: 1. Those that used xso.dev to determine the offload device. 2. Those that used xso.real_dev to determine the offload device. The first category didn't work with bonding while the second did. In a non-bonding setup the two pointers are the same. This commit adds explicit pointers for the offload netdevice to .xdo_dev_state_add() / .xdo_dev_state_delete() / .xdo_dev_state_free() which eliminates the confusion and allows drivers from the first category to work with bonding. xso.real_dev now becomes a private pointer managed by the bonding driver. Signed-off-by: Cosmin Ratiu Reviewed-by: Leon Romanovsky Reviewed-by: Nikolay Aleksandrov Signed-off-by: Steffen Klassert

xfrm: provide common xdo_dev_offload_ok callback implementation

2025-02-21T07:08:15+00:00

Almost all drivers except bond and nsim had same check if device can perform XFRM offload on that specific packet. The check was that packet doesn't have IPv4 options and IPv6 extensions. In NIC drivers, the IPv4 HELEN comparison was slightly different, but the intent was to check for the same conditions. So let's chose more strict variant as a common base. Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert

netdevsim: copy addresses for both in and out paths

2024-10-11T22:44:27+00:00

The current code only copies the address for the in path, leaving the out path address set to 0. This patch corrects the issue by copying the addresses for both the in and out paths. Before this patch: # cat /sys/kernel/debug/netdevsim/netdevsim0/ports/0/ipsec SA count=2 tx=20 sa[0] tx ipaddr=0.0.0.0 sa[0] spi=0x00000100 proto=0x32 salt=0x0adecc3a crypt=1 sa[0] key=0x3167608a ca4f1397 43565909 941fa627 sa[1] rx ipaddr=192.168.0.1 sa[1] spi=0x00000101 proto=0x32 salt=0x0adecc3a crypt=1 sa[1] key=0x3167608a ca4f1397 43565909 941fa627 After this patch: = cat /sys/kernel/debug/netdevsim/netdevsim0/ports/0/ipsec SA count=2 tx=20 sa[0] tx ipaddr=192.168.0.2 sa[0] spi=0x00000100 proto=0x32 salt=0x0adecc3a crypt=1 sa[0] key=0x3167608a ca4f1397 43565909 941fa627 sa[1] rx ipaddr=192.168.0.1 sa[1] spi=0x00000101 proto=0x32 salt=0x0adecc3a crypt=1 sa[1] key=0x3167608a ca4f1397 43565909 941fa627 Fixes: 7699353da875 ("netdevsim: add ipsec offload testing") Reviewed-by: Simon Horman Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20241010040027.21440-3-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski

netdevsim: print human readable IP address

2024-10-11T22:44:27+00:00

Currently, IPSec addresses are printed in hexadecimal format, which is not user-friendly. e.g. # cat /sys/kernel/debug/netdevsim/netdevsim0/ports/0/ipsec SA count=2 tx=20 sa[0] rx ipaddr=0x00000000 00000000 00000000 0100a8c0 sa[0] spi=0x00000101 proto=0x32 salt=0x0adecc3a crypt=1 sa[0] key=0x3167608a ca4f1397 43565909 941fa627 sa[1] tx ipaddr=0x00000000 00000000 00000000 00000000 sa[1] spi=0x00000100 proto=0x32 salt=0x0adecc3a crypt=1 sa[1] key=0x3167608a ca4f1397 43565909 941fa627 This patch updates the code to print the IPSec address in a human-readable format for easier debug. e.g. # cat /sys/kernel/debug/netdevsim/netdevsim0/ports/0/ipsec SA count=4 tx=40 sa[0] tx ipaddr=0.0.0.0 sa[0] spi=0x00000100 proto=0x32 salt=0x0adecc3a crypt=1 sa[0] key=0x3167608a ca4f1397 43565909 941fa627 sa[1] rx ipaddr=192.168.0.1 sa[1] spi=0x00000101 proto=0x32 salt=0x0adecc3a crypt=1 sa[1] key=0x3167608a ca4f1397 43565909 941fa627 sa[2] tx ipaddr=:: sa[2] spi=0x00000100 proto=0x32 salt=0x0adecc3a crypt=1 sa[2] key=0x3167608a ca4f1397 43565909 941fa627 sa[3] rx ipaddr=2000::1 sa[3] spi=0x00000101 proto=0x32 salt=0x0adecc3a crypt=1 sa[3] key=0x3167608a ca4f1397 43565909 941fa627 Reviewed-by: Simon Horman Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20241010040027.21440-2-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski

netdevsim: Fill IPsec state validation failure reason

2023-01-27T00:28:48+00:00

Rely on extack to return failure reason. Signed-off-by: Leon Romanovsky Signed-off-by: Jakub Kicinski

xfrm: extend add state callback to set failure reason

2023-01-27T00:28:48+00:00

Almost all validation logic is in the drivers, but they are missing reliable way to convey failure reason to userspace applications. Let's use extack to return this information to users. Signed-off-by: Leon Romanovsky Signed-off-by: Jakub Kicinski

xfrm: allow state packet offload mode

2022-12-05T09:32:44+00:00

Allow users to configure xfrm states with packet offload mode. The packet mode must be requested both for policy and state, and such requires us to do not implement fallback. We explicitly return an error if requested packet mode can't be configured. Reviewed-by: Raed Salem Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert

netdevsim: rely on XFRM state direction instead of flags

2022-05-06T06:34:33+00:00

Make sure that netdevsim relies on direction and not on flags. Reviewed-by: Raed Salem Signed-off-by: Leon Romanovsky Acked-by: Jakub Kicinski Signed-off-by: Steffen Klassert