Re: [PATCH net-next V4 14/14] selftests: drv-net: Add PSP HW GRO conformance tests

[Jakub Kicinski <kuba@kernel.org>]

On Tue, 8 Sep 2026 09:52:44 +0300 Tariq Toukan wrote:
> From: Cosmin Ratiu <cratiu@nvidia.com>
> 
> Add PSP conformance tests using the same gro helper binary as other gro
> tests , but in --psp mode. SPIs are procured by psp_gro.py from a real
> PSP device and handed off to the gro sender & receiver. The sender
> crafts and encrypts packets in software, the receiver relies fully on
> the HW to decrypt, decapsulate and do HW GRO.
> 
> Because the NIC decrypts and decapsulates before the frames reach the
> receiver AF_PACKET tap, the gro receiver sees the plain frames and the
> assertions remain exactly the same as other gro tests.
> 
> So these tests verify, at length, that the device does PSP HW-GRO the
> same way as plain TCP.
> 
> Additional PSP-specific tests are defined to check that GRO doesn't
> merge packets across PSP versions, SPIs, encryption-status, etc.
> 
> Some gro tests are not included because they don't work:
> - ip_csum: the checksum is recomputed by psp_dev_rcv().
> - tcp_csum: packets are marked with CHECKSUM_UNNECESSARY.
> - ip_frag4/ip_frag6: PSP is incompatible with IP fragmentation.
> - IPv6 extension header tests: PSP doesn't deal with IPv6 ext headers.

Daniel commented on the csum tests already, it'd also be good to
understand what the problem with frag tests is. Presumably they
get passed thru still encrypted? Or dropped and counted as errors?

> diff --git a/tools/testing/selftests/drivers/net/hw/Makefile b/tools/testing/selftests/drivers/net/hw/Makefile
> index 6105be8e590f..daa7e52f236e 100644
> --- a/tools/testing/selftests/drivers/net/hw/Makefile
> +++ b/tools/testing/selftests/drivers/net/hw/Makefile
> @@ -13,6 +13,20 @@ else
>  $(warning excluding iouring tests, liburing not installed or too old)
>  endif
>  
> +# psp_gro.py uses the gro binary in PSP mode, which requires OpenSSL.
> +PKG_CONFIG ?= pkg-config
> +HAVE_OPENSSL := $(shell echo 'int main(void) { return 0; }' | \
> +		  $(CC) -x c - -include openssl/evp.h \
> +		  $(shell $(PKG_CONFIG) --cflags --libs libcrypto 2>/dev/null \
> +			  || echo -lcrypto) \
> +		  -o /dev/null >/dev/null 2>&1 && echo 1)
> +
> +ifeq ($(HAVE_OPENSSL),1)
> +COND_PROGS += psp_gro.py
> +else
> +$(warning excluding PSP GRO tests, libcrypto not installed)
> +endif

Looks like slop. Why do this? Just run the test and see if it works.
Don't hide the python tests because build was lacking. We explicitly
want to see all tests run and fail if something is missing in the build
setup in NIPA.

If you really want you can "probe" or display the support in some --help
message from the binary and check at runtime. 

>  TEST_GEN_FILES := \
>  	$(COND_GEN_FILES) \
>  # end of TEST_GEN_FILES
> @@ -40,6 +54,7 @@ TEST_PROGS = \
>  	nk_qlease.py \
>  	ntuple.py \
>  	pp_alloc_fail.py \
> +	$(COND_PROGS) \
>  	rss_api.py \
>  	rss_ctx.py \
>  	rss_drv.py \
> @@ -64,6 +79,8 @@ TEST_FILES := \
>  
>  TEST_INCLUDES := \
>  	$(wildcard lib/py/*.py ../lib/py/*.py) \
> +	../gro_lib.py \
> +	../psp_lib.py \

ugh, just move the test down to the drv-net dir, and Xfail for
netdevsim. Both PSP and GRO live in ../ better to keep this test
there as well.

> +# Tests for both IP versions, a subset of gro tests. Missing:
> +# - tcp_csum: PSP packets are validated by HW (with the ICV) and marked with
> +# CHECKSUM_UNNECESSARY.
> +_COMMON = ["data_same", "data_lrg_sml", "data_sml_lrg", "data_lrg_1byte",
> +           "data_burst",
> +           "ack",
> +           "flags_psh", "flags_syn", "flags_rst", "flags_urg", "flags_cwr",
> +           "tcp_seq", "tcp_ts", "tcp_opt",
> +           "ip_ecn", "ip_tos",
> +           "large_max", "large_rem",

Really not great that we have to duplicate all the cases under psp.
Narcisa is adding BIG TCP cases for instance, how are we
going to keep this in sync :S