It helped me find
commit b17cf742eaad ("tls: device: fix out-of-bounds write in tls_append_frag()").

So I think it is worth sending a formal patchset.

The kTLS device offload path in net/tls/tls_device.c has no test
coverage upstream -- selftests/net/tls.c is software only, and the
offload code needs a driver that implements it.

So teach netdevsim to fake it.  Patch 1 implements tlsdev_ops and
advertises the TLS features, patch 2 adds a selftest.

No crypto is done: TX puts the plaintext record on the wire, RX just
sets skb->decrypted.  That only works netdevsim to netdevsim, but it
covers record assembly and the offload lifecycle.  Real ciphertext, and
more on top of it, can come later.

Jiayuan Chen (2):
  netdevsim: add TLS device offload emulation
  selftests: netdevsim: add a kTLS device offload test

 drivers/net/Kconfig                           |   1 +
 drivers/net/netdevsim/Makefile                |   4 +
 drivers/net/netdevsim/netdev.c                |   5 +
 drivers/net/netdevsim/netdevsim.h             |  35 ++
 drivers/net/netdevsim/tls.c                   | 482 +++++++++++++++++
 .../drivers/net/netdevsim/.gitignore          |   2 +
 .../selftests/drivers/net/netdevsim/Makefile  |   7 +
 .../selftests/drivers/net/netdevsim/config    |   2 +
 .../selftests/drivers/net/netdevsim/tls.sh    | 334 ++++++++++++
 .../drivers/net/netdevsim/tls_offload.c       | 505 ++++++++++++++++++
 10 files changed, 1377 insertions(+)
 create mode 100644 drivers/net/netdevsim/tls.c
 create mode 100644 tools/testing/selftests/drivers/net/netdevsim/.gitignore
 create mode 100755 tools/testing/selftests/drivers/net/netdevsim/tls.sh
 create mode 100644 tools/testing/selftests/drivers/net/netdevsim/tls_offload.c

-- 
2.43.0

On Tue,  1 Sep 2026 23:48:55 +0800 Jiayuan Chen wrote:
> It helped me find
> commit b17cf742eaad ("tls: device: fix out-of-bounds write in tls_append_frag()").
> 
> So I think it is worth sending a formal patchset.
> 
> The kTLS device offload path in net/tls/tls_device.c has no test
> coverage upstream -- selftests/net/tls.c is software only, and the
> offload code needs a driver that implements it.
> 
> So teach netdevsim to fake it.  Patch 1 implements tlsdev_ops and
> advertises the TLS features, patch 2 adds a selftest.
> 
> No crypto is done: TX puts the plaintext record on the wire, RX just
> sets skb->decrypted.  That only works netdevsim to netdevsim, but it
> covers record assembly and the offload lifecycle.  Real ciphertext, and
> more on top of it, can come later.

Please don't post selftests to net-next which depend on a fix going 
to another tree. If we merge this now we will have a failing test 
until the fix also lands.

If we add TLS support to netdevsim it must be paired with a test 
which can also run against real HW. There was a selftest posted
recently by the person working on TLS 1.3 offload, we can use that
as the target (feel free to add that to your series, just keep 
the original author).

We can add special netdevsim-only cases but the main focus should
be writing tests that can be executed against real devices.
-- 
pw-bot: cr

on 9/4/26 6:59 AM, Jakub Kicinski wrote:
> On Tue,  1 Sep 2026 23:48:55 +0800 Jiayuan Chen wrote:
>> It helped me find
>> commit b17cf742eaad ("tls: device: fix out-of-bounds write in tls_append_frag()").
>>
>> So I think it is worth sending a formal patchset.
>>
>> The kTLS device offload path in net/tls/tls_device.c has no test
>> coverage upstream -- selftests/net/tls.c is software only, and the
>> offload code needs a driver that implements it.
>>
>> So teach netdevsim to fake it.  Patch 1 implements tlsdev_ops and
>> advertises the TLS features, patch 2 adds a selftest.
>>
>> No crypto is done: TX puts the plaintext record on the wire, RX just
>> sets skb->decrypted.  That only works netdevsim to netdevsim, but it
>> covers record assembly and the offload lifecycle.  Real ciphertext, and
>> more on top of it, can come later.
> Please don't post selftests to net-next which depend on a fix going
> to another tree. If we merge this now we will have a failing test
> until the fix also lands.
>
> If we add TLS support to netdevsim it must be paired with a test
> which can also run against real HW. There was a selftest posted
> recently by the person working on TLS 1.3 offload, we can use that
> as the target (feel free to add that to your series, just keep
> the original author).
>
> We can add special netdevsim-only cases but the main focus should
> be writing tests that can be executed against real devices.


I think I just wait until that series is merged and then take a next setp.