on 9/4/26 6:59 AM, Jakub Kicinski wrote:
On Tue, 1 Sep 2026 23:48:55 +0800 Jiayuan Chen wrote:It helped me find commit b17cf742eaad ("tls: device: fix out-of-bounds write in tls_append_frag()"). So I think it is worth sending a formal patchset. The kTLS device offload path in net/tls/tls_device.c has no test coverage upstream -- selftests/net/tls.c is software only, and the offload code needs a driver that implements it. So teach netdevsim to fake it. Patch 1 implements tlsdev_ops and advertises the TLS features, patch 2 adds a selftest. No crypto is done: TX puts the plaintext record on the wire, RX just sets skb->decrypted. That only works netdevsim to netdevsim, but it covers record assembly and the offload lifecycle. Real ciphertext, and more on top of it, can come later.Please don't post selftests to net-next which depend on a fix going to another tree. If we merge this now we will have a failing test until the fix also lands. If we add TLS support to netdevsim it must be paired with a test which can also run against real HW. There was a selftest posted recently by the person working on TLS 1.3 offload, we can use that as the target (feel free to add that to your series, just keep the original author). We can add special netdevsim-only cases but the main focus should be writing tests that can be executed against real devices.
I think I just wait until that series is merged and then take a next setp.
