Re: [PATCH net-next V4 14/14] selftests: drv-net: Add PSP HW GRO conformance tests

[Cosmin Ratiu <cratiu@nvidia.com>]

On Fri, 2026-09-11 at 18:24 -0700, Jakub Kicinski wrote:
> On Tue, 8 Sep 2026 09:52:44 +0300 Tariq Toukan wrote:
> > From: Cosmin Ratiu <cratiu@nvidia.com>
> > 
> > Add PSP conformance tests using the same gro helper binary as other
> > gro
> > tests , but in --psp mode. SPIs are procured by psp_gro.py from a
> > real
> > PSP device and handed off to the gro sender & receiver. The sender
> > crafts and encrypts packets in software, the receiver relies fully
> > on
> > the HW to decrypt, decapsulate and do HW GRO.
> > 
> > Because the NIC decrypts and decapsulates before the frames reach
> > the
> > receiver AF_PACKET tap, the gro receiver sees the plain frames and
> > the
> > assertions remain exactly the same as other gro tests.
> > 
> > So these tests verify, at length, that the device does PSP HW-GRO
> > the
> > same way as plain TCP.
> > 
> > Additional PSP-specific tests are defined to check that GRO doesn't
> > merge packets across PSP versions, SPIs, encryption-status, etc.
> > 
> > Some gro tests are not included because they don't work:
> > - ip_csum: the checksum is recomputed by psp_dev_rcv().
> > - tcp_csum: packets are marked with CHECKSUM_UNNECESSARY.
> > - ip_frag4/ip_frag6: PSP is incompatible with IP fragmentation.
> > - IPv6 extension header tests: PSP doesn't deal with IPv6 ext
> > headers.
> 
> Daniel commented on the csum tests already, it'd also be good to
> understand what the problem with frag tests is. Presumably they
> get passed thru still encrypted? Or dropped and counted as errors?

It seems ConnectX HW doesn't parse IP fragments beyond the IP header in
steering (presumably there are too many corner cases), so the PSP rule
selecting packets with UDP dport == 1000 doesn't decrypt those packets
and they get dropped by SW. IPsec behaves similarly, IP fragments are
just left to SW, but for PSP there's no such option.
In any case, this is probably HW-specific and there's no reason for
this test not to be included, so I will include it in the next version.

> 
> > diff --git a/tools/testing/selftests/drivers/net/hw/Makefile
> > b/tools/testing/selftests/drivers/net/hw/Makefile
> > index 6105be8e590f..daa7e52f236e 100644
> > --- a/tools/testing/selftests/drivers/net/hw/Makefile
> > +++ b/tools/testing/selftests/drivers/net/hw/Makefile
> > @@ -13,6 +13,20 @@ else
> >  $(warning excluding iouring tests, liburing not installed or too
> > old)
> >  endif
> >  
> > +# psp_gro.py uses the gro binary in PSP mode, which requires
> > OpenSSL.
> > +PKG_CONFIG ?= pkg-config
> > +HAVE_OPENSSL := $(shell echo 'int main(void) { return 0; }' | \
> > +		  $(CC) -x c - -include openssl/evp.h \
> > +		  $(shell $(PKG_CONFIG) --cflags --libs libcrypto
> > 2>/dev/null \
> > +			  || echo -lcrypto) \
> > +		  -o /dev/null >/dev/null 2>&1 && echo 1)
> > +
> > +ifeq ($(HAVE_OPENSSL),1)
> > +COND_PROGS += psp_gro.py
> > +else
> > +$(warning excluding PSP GRO tests, libcrypto not installed)
> > +endif
> 
> Looks like slop. Why do this? Just run the test and see if it works.
> Don't hide the python tests because build was lacking. We explicitly
> want to see all tests run and fail if something is missing in the
> build
> setup in NIPA.

Will do.

> 
> If you really want you can "probe" or display the support in some --
> help
> message from the binary and check at runtime. 
> 
> >  TEST_GEN_FILES := \
> >  	$(COND_GEN_FILES) \
> >  # end of TEST_GEN_FILES
> > @@ -40,6 +54,7 @@ TEST_PROGS = \
> >  	nk_qlease.py \
> >  	ntuple.py \
> >  	pp_alloc_fail.py \
> > +	$(COND_PROGS) \
> >  	rss_api.py \
> >  	rss_ctx.py \
> >  	rss_drv.py \
> > @@ -64,6 +79,8 @@ TEST_FILES := \
> >  
> >  TEST_INCLUDES := \
> >  	$(wildcard lib/py/*.py ../lib/py/*.py) \
> > +	../gro_lib.py \
> > +	../psp_lib.py \
> 
> ugh, just move the test down to the drv-net dir, and Xfail for
> netdevsim. Both PSP and GRO live in ../ better to keep this test
> there as well.

It was there originally, but I figured since PSP is a HW-only protocol,
the test belongs in hw/. But I'll move it back, it makes more sense in
this context.

> 
> > +# Tests for both IP versions, a subset of gro tests. Missing:
> > +# - tcp_csum: PSP packets are validated by HW (with the ICV) and
> > marked with
> > +# CHECKSUM_UNNECESSARY.
> > +_COMMON = ["data_same", "data_lrg_sml", "data_sml_lrg",
> > "data_lrg_1byte",
> > +           "data_burst",
> > +           "ack",
> > +           "flags_psh", "flags_syn", "flags_rst", "flags_urg",
> > "flags_cwr",
> > +           "tcp_seq", "tcp_ts", "tcp_opt",
> > +           "ip_ecn", "ip_tos",
> > +           "large_max", "large_rem",
> 
> Really not great that we have to duplicate all the cases under psp.
> Narcisa is adding BIG TCP cases for instance, how are we
> going to keep this in sync :S
> 

Will drop the lists and just use the gro_variants() generator, with a
filter on top to be able to avoid some tests.

Cosmin.