[PATCH net 0/2] netdevsim: fix IPsec debugfs byte order

[PATCH net 0/2] netdevsim: fix IPsec debugfs byte order

[Andrei Gherzan]

The netdevsim IPsec debugfs file (used by selftests/net/rtnetlink.sh's
ipsec_offload subtest) prints the SA salt and key in host CPU byte
order instead of network byte order, because nsim_sa.key[]/salt are
typed as plain u32 and printed directly with "%08x". This makes the
reported values differ between little-endian and big-endian hosts for
the same underlying key material, and breaks the selftest on
big-endian (e.g. s390x), which hardcodes the little-endian output.

A driver-side fix was proposed in 2022 but stalled in review: keeping
the fields as plain u32 meant sparse could not validate the added
ntohl()/be32_to_cpu() conversions.

  https://lore.kernel.org/netdev/20220308135106.890270-1-kleber.souza@canonical.com/

This series:

  1/2 retypes nsim_sa.key[]/salt to __be32 (matching the existing
      __be32 ipaddr[] field) and converts with be32_to_cpu() before
      printing, so the debugfs output is now network-order on every
      host, independent of endianness.

  2/2 updates the selftest's expected output to match the new,
      endianness-independent values. It depends on 1/2: applied on
      its own it would regress little-endian hosts (though it happens
      to have no effect on big-endian hosts, whose old host-order
      output already matched the new expected values).

Tested on real booted kernels, both patches applied:
  - x86_64 (little-endian): PASS: ipsec_offload
  - s390x (big-endian):     PASS: ipsec_offload

checkpatch.pl --strict and sparse (make C=2) are clean on both patches.

Andrei Gherzan (2):
  netdevsim: print IPsec salt/key in network byte order
  selftests: rtnetlink: update ipsec_offload expected output

 drivers/net/netdevsim/ipsec.c            | 10 +++++-----
 drivers/net/netdevsim/netdevsim.h        |  4 ++--
 tools/testing/selftests/net/rtnetlink.sh |  8 ++++----
 3 files changed, 11 insertions(+), 11 deletions(-)

-- 
2.43.0

[PATCH net 1/2] netdevsim: print IPsec salt/key in network byte order

[Andrei Gherzan]

nsim_sa.key[] and nsim_sa.salt hold raw key material in network byte
order, but are typed as plain u32 and printed with "%08x" in the
debugfs read handler. This prints host-endian, so output differs
between little- and big-endian hosts for the same key:

  little-endian: salt=0x61626364 key=0x34333231 38373635 32313039 36353433
  big-endian:    salt=0x64636261 key=0x31323334 35363738 39303132 33343536

This breaks selftests/net/rtnetlink.sh's ipsec_offload subtest on
big-endian (e.g. s390x), which hardcodes the little-endian output.

Retype key[]/salt to __be32, matching ipaddr[], and convert with
be32_to_cpu() before printing. Output is now network-order on every
host, independent of endianness.

A similar fix was proposed in 2022 but kept the u32 typing, so sparse
couldn't validate the added ntohl() calls and it stalled in review.
Retyping first avoids that problem. `make C=2` on netdevsim reports
the same zero warnings as before this change.

Selftest update follows in the next patch.

Fixes: 7699353da875 ("netdevsim: add ipsec offload testing")
Reported-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Link: https://lore.kernel.org/netdev/20220308135106.890270-1-kleber.souza@canonical.com/
Signed-off-by: Andrei Gherzan <andrei.gherzan@canonical.com>
---
 drivers/net/netdevsim/ipsec.c     | 10 +++++-----
 drivers/net/netdevsim/netdevsim.h |  4 ++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/net/netdevsim/ipsec.c b/drivers/net/netdevsim/ipsec.c
index 36a1be4923d61..5722837bcda36 100644
--- a/drivers/net/netdevsim/ipsec.c
+++ b/drivers/net/netdevsim/ipsec.c
@@ -50,11 +50,11 @@ static ssize_t nsim_dbg_netdev_ops_read(struct file *filp,
 		p += scnprintf(p, bufsize - (p - buf),
 			       "sa[%i]    spi=0x%08x proto=0x%x salt=0x%08x crypt=%d\n",
 			       i, be32_to_cpu(sap->xs->id.spi),
-			       sap->xs->id.proto, sap->salt, sap->crypt);
+			       sap->xs->id.proto, be32_to_cpu(sap->salt), sap->crypt);
 		p += scnprintf(p, bufsize - (p - buf),
 			       "sa[%i]    key=0x%08x %08x %08x %08x\n",
-			       i, sap->key[0], sap->key[1],
-			       sap->key[2], sap->key[3]);
+			       i, be32_to_cpu(sap->key[0]), be32_to_cpu(sap->key[1]),
+			       be32_to_cpu(sap->key[2]), be32_to_cpu(sap->key[3]));
 	}
 
 	len = simple_read_from_buffer(buffer, count, ppos, buf, p - buf);
@@ -87,7 +87,7 @@ static int nsim_ipsec_find_empty_idx(struct nsim_ipsec *ipsec)
 
 static int nsim_ipsec_parse_proto_keys(struct net_device *dev,
 				       struct xfrm_state *xs,
-				       u32 *mykey, u32 *mysalt)
+				       __be32 *mykey, __be32 *mysalt)
 {
 	const char aes_gcm_name[] = "rfc4106(gcm(aes))";
 	unsigned char *key_data;
@@ -117,7 +117,7 @@ static int nsim_ipsec_parse_proto_keys(struct net_device *dev,
 
 	/* 160 accounts for 16 byte key and 4 byte salt */
 	if (key_len > NSIM_IPSEC_AUTH_BITS) {
-		*mysalt = ((u32 *)key_data)[4];
+		*mysalt = ((__be32 *)key_data)[4];
 	} else if (key_len == NSIM_IPSEC_AUTH_BITS) {
 		*mysalt = 0;
 	} else {
diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
index 55aec41237b9b..a82a685384e6d 100644
--- a/drivers/net/netdevsim/netdevsim.h
+++ b/drivers/net/netdevsim/netdevsim.h
@@ -42,8 +42,8 @@
 struct nsim_sa {
 	struct xfrm_state *xs;
 	__be32 ipaddr[4];
-	u32 key[4];
-	u32 salt;
+	__be32 key[4];
+	__be32 salt;
 	bool used;
 	bool crypt;
 	bool rx;
-- 
2.43.0

[PATCH net 2/2] selftests: rtnetlink: update ipsec_offload expected output

[Andrei Gherzan]

The previous patch ("netdevsim: print IPsec salt/key in network byte
order") makes the netdevsim IPsec debugfs file print salt/key in
network byte order on every host, instead of host CPU byte order.

Update the expected output of kci_test_ipsec_offload() to match: the
values change from the little-endian-only representation to the new,
endianness-independent one. No other changes are needed since the
output is now the same on every architecture.

This depends on the previous driver patch: applied on its own, this
change would regress the test on little-endian hosts (which still
print the old host-order value), though it happens to have no effect
on big-endian hosts (whose old host-order output already matched).

Fixes: 2766a11161cc ("selftests: rtnetlink: add ipsec offload API test")
Reported-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Link: https://lore.kernel.org/netdev/20220308135106.890270-1-kleber.souza@canonical.com/
Signed-off-by: Andrei Gherzan <andrei.gherzan@canonical.com>
---
 tools/testing/selftests/net/rtnetlink.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh
index ace3a99023ed0..4843d474538f4 100755
--- a/tools/testing/selftests/net/rtnetlink.sh
+++ b/tools/testing/selftests/net/rtnetlink.sh
@@ -932,11 +932,11 @@ kci_test_ipsec_offload()
 	run_cmd diff $sysfsf - << EOF
 SA count=2 tx=3
 sa[0] tx ipaddr=$dstip
-sa[0]    spi=0x00000009 proto=0x32 salt=0x61626364 crypt=1
-sa[0]    key=0x34333231 38373635 32313039 36353433
+sa[0]    spi=0x00000009 proto=0x32 salt=0x64636261 crypt=1
+sa[0]    key=0x31323334 35363738 39303132 33343536
 sa[1] rx ipaddr=$srcip
-sa[1]    spi=0x00000009 proto=0x32 salt=0x61626364 crypt=1
-sa[1]    key=0x34333231 38373635 32313039 36353433
+sa[1]    spi=0x00000009 proto=0x32 salt=0x64636261 crypt=1
+sa[1]    key=0x31323334 35363738 39303132 33343536
 EOF
 	if [ $? -ne 0 ] ; then
 		end_test "FAIL: ipsec_offload incorrect driver data"
-- 
2.43.0

Re: [PATCH net 0/2] netdevsim: fix IPsec debugfs byte order

[Andrei Gherzan]

[-- Attachment #1: Type: text/plain, Size: 2335 bytes --]

On 26/09/08 03:03PM, Andrei Gherzan wrote:
> The netdevsim IPsec debugfs file (used by selftests/net/rtnetlink.sh's
> ipsec_offload subtest) prints the SA salt and key in host CPU byte
> order instead of network byte order, because nsim_sa.key[]/salt are
> typed as plain u32 and printed directly with "%08x". This makes the
> reported values differ between little-endian and big-endian hosts for
> the same underlying key material, and breaks the selftest on
> big-endian (e.g. s390x), which hardcodes the little-endian output.
> 
> A driver-side fix was proposed in 2022 but stalled in review: keeping
> the fields as plain u32 meant sparse could not validate the added
> ntohl()/be32_to_cpu() conversions.
> 
>   https://lore.kernel.org/netdev/20220308135106.890270-1-kleber.souza@canonical.com/
> 
> This series:
> 
>   1/2 retypes nsim_sa.key[]/salt to __be32 (matching the existing
>       __be32 ipaddr[] field) and converts with be32_to_cpu() before
>       printing, so the debugfs output is now network-order on every
>       host, independent of endianness.
> 
>   2/2 updates the selftest's expected output to match the new,
>       endianness-independent values. It depends on 1/2: applied on
>       its own it would regress little-endian hosts (though it happens
>       to have no effect on big-endian hosts, whose old host-order
>       output already matched the new expected values).
> 

I forgot to add Cc: stable@vger.kernel.org to these patches. Should I
send a v2 for that, given patch 2/2 only makes sense together with
patch 1/2 (applying just one regresses the test on one endianness or
the other)?

> Tested on real booted kernels, both patches applied:
>   - x86_64 (little-endian): PASS: ipsec_offload
>   - s390x (big-endian):     PASS: ipsec_offload
> 
> checkpatch.pl --strict and sparse (make C=2) are clean on both patches.
> 
> Andrei Gherzan (2):
>   netdevsim: print IPsec salt/key in network byte order
>   selftests: rtnetlink: update ipsec_offload expected output
> 
>  drivers/net/netdevsim/ipsec.c            | 10 +++++-----
>  drivers/net/netdevsim/netdevsim.h        |  4 ++--
>  tools/testing/selftests/net/rtnetlink.sh |  8 ++++----
>  3 files changed, 11 insertions(+), 11 deletions(-)

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH net 0/2] netdevsim: fix IPsec debugfs byte order

[Jakub Kicinski]

On Wed, 9 Sep 2026 14:37:41 +0100 Andrei Gherzan wrote:
> I forgot to add Cc: stable@vger.kernel.org to these patches. 

We don't generally send documentation and test fixes to stable in netdev
Especially now that stable is busy enough with all the AI-found bugs
In fact I'm stripping the Fixes tags, too.

> Should I send a v2 for that, given patch 2/2 only makes sense
> together with patch 1/2 (applying just one regresses the test on one
> endianness or the other)?

No need.

Thanks for the changes!

Re: [PATCH net 0/2] netdevsim: fix IPsec debugfs byte order

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue,  8 Sep 2026 15:03:23 +0100 you wrote:
> The netdevsim IPsec debugfs file (used by selftests/net/rtnetlink.sh's
> ipsec_offload subtest) prints the SA salt and key in host CPU byte
> order instead of network byte order, because nsim_sa.key[]/salt are
> typed as plain u32 and printed directly with "%08x". This makes the
> reported values differ between little-endian and big-endian hosts for
> the same underlying key material, and breaks the selftest on
> big-endian (e.g. s390x), which hardcodes the little-endian output.
> 
> [...]

Here is the summary with links:
  - [net,1/2] netdevsim: print IPsec salt/key in network byte order
    https://git.kernel.org/netdev/net-next/c/d26840324690
  - [net,2/2] selftests: rtnetlink: update ipsec_offload expected output
    https://git.kernel.org/netdev/net-next/c/a99568611764

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html