[net-next, v3 0/2] psp: Support PSP Tx on logical devices like VLAN

[net-next, v3 0/2] psp: Support PSP Tx on logical devices like VLAN

[Kiran Kella]

This patch adds support to allow transmit on virtual devices if the
bottom most underlying transport device matches the PSP device associated
with the transmitting application socket.

  python ./psp.py
  TAP version 13
  1..29
  ok 1 psp.data_basic_send_v0_ip4
  ok 2 psp.data_basic_send_v0_ip6
  ok 3 psp.data_basic_send_v1_ip4
  ok 4 psp.data_basic_send_v1_ip6
  ok 5 psp.data_basic_send_v2_ip4
  ok 6 psp.data_basic_send_v2_ip6
  ok 7 psp.data_basic_send_v3_ip4
  ok 8 psp.data_basic_send_v3_ip6
  ok 9 psp.data_mss_adjust_ip4
  ok 10 psp.data_mss_adjust_ip6
  ok 11 psp.dev_list_devices
  ok 12 psp.dev_get_device
  ok 13 psp.dev_get_device_bad
  ok 14 psp.dev_rotate
  ok 15 psp.dev_rotate_spi
  ok 16 psp.assoc_basic
  ok 17 psp.assoc_bad_dev
  ok 18 psp.assoc_sk_only_conn
  ok 19 psp.assoc_sk_only_mismatch
  ok 20 psp.assoc_sk_only_mismatch_tx
  ok 21 psp.assoc_sk_only_unconn
  ok 22 psp.assoc_version_mismatch
  ok 23 psp.assoc_twice
  ok 24 psp.data_send_bad_key
  ok 25 psp.data_send_disconnect
  ok 26 psp.data_stale_key
  ok 27 psp.removal_device_rx
  ok 28 psp.removal_device_bi
  ok 29 psp.vlan_basic_send
  # Totals: pass:29 fail:0 xfail:0 xpass:0 skip:0 error:0
  #
  # Responder logs (0):
  # STDERR:
  # #  Set PSP enable on device 3 to 0xf
  # #  Set PSP enable on device 3 to 0x0

CHANGES:
v3:
  - Enable 8021q module in the net/config for vlan test
  - Guard against a race between psp_netdevice_event and psp_dev_unregister
    by using psp_dev_tryget/put in the linking path to ensure the psp_dev
    is still alive before propagating it to upper devices.

v2: 
  - Simplified the psp_netdevice_event() to return if the upper device is
    bond device.
  - Handle the scenario where the psp_dev_unregister() is invoked by a
    driver before the unregister_netdev() that can result in stale
    psp_dev pointer in the upper devices. 
  - Fix the vlan_basic_send test to run on any lower device and not
    require nsim.

v1: https://lore.kernel.org/all/20260121073517.3323332-1-kiran.kella@broadcom.com/

Kiran Kella (2):
  psp: Support for transmit on logical device when the underlying
    transport device supports PSP.
  selftests: drv-net: psp: add test for VLAN sub-interface

 net/psp/psp_main.c                         | 117 ++++++++++++++++++++-
 tools/testing/selftests/drivers/net/config |   1 +
 tools/testing/selftests/drivers/net/psp.py |  81 +++++++++++++-
 3 files changed, 197 insertions(+), 2 deletions(-)

-- 
2.45.4

[net-next, v3 1/2] psp: Support for transmit on logical device when the underlying transport device supports PSP.

[Kiran Kella]

This is achieved by propagating the psp_dev from the lower device
to the upper devices in the device stack via a netdevice notifier.
The lowest device owns the psp_dev pointer while the upper devices
just borrow the pointer. When the lower device is unlinked, the
borrowed pointer is cleared in the upper device.
Assumption being that psp_dev is set on the lowest device before
any upper devices are stacked on that lowest device.

Signed-off-by: Kiran Kella <kiran.kella@broadcom.com>
Reviewed-by: Ajit Kumar Khaparde <ajit.khaparde@broadcom.com>
Reviewed-by: Akhilesh Samineni <akhilesh.samineni@broadcom.com>
---
 net/psp/psp_main.c | 117 ++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 116 insertions(+), 1 deletion(-)

diff --git a/net/psp/psp_main.c b/net/psp/psp_main.c
index a8534124f626..303a3af3bdf2 100644
--- a/net/psp/psp_main.c
+++ b/net/psp/psp_main.c
@@ -3,6 +3,7 @@
 #include <linux/bitfield.h>
 #include <linux/list.h>
 #include <linux/netdevice.h>
+#include <linux/rtnetlink.h>
 #include <linux/xarray.h>
 #include <net/net_namespace.h>
 #include <net/psp.h>
@@ -110,13 +111,45 @@ void psp_dev_free(struct psp_dev *psd)
 	kfree_rcu(psd, rcu);
 }
 
+/**
+ * psp_clear_upper_dev_psp_dev() - Clear borrowed psp_dev pointer on upper
+ *				   device
+ * @upper_dev:	Upper device that may have borrowed psp_dev pointer
+ * @priv:	netdev_nested_priv containing the psp_dev being unregistered
+ *
+ * Callback for netdev_walk_all_upper_dev_rcu() to clear borrowed psp_dev
+ * pointers on upper devices when the underlying psp_dev is being unregistered.
+ *
+ * Return: 0 to continue walking, non-zero to stop.
+ */
+static int psp_clear_upper_dev_psp_dev(struct net_device *upper_dev,
+				       struct netdev_nested_priv *priv)
+{
+	struct psp_dev *psd = priv->data;
+	struct psp_dev *upper_psd;
+
+	upper_psd = rcu_dereference(upper_dev->psp_dev);
+	if (upper_psd == psd)
+		rcu_assign_pointer(upper_dev->psp_dev, NULL);
+
+	return 0;
+}
+
 /**
  * psp_dev_unregister() - unregister PSP device
  * @psd:	PSP device structure
+ *
+ * Unregisters a PSP device and clears all borrowed psp_dev pointers on
+ * upper devices (e.g., VLAN subinterfaces) that reference this device.
+ * This prevents use-after-free if upper devices still have borrowed
+ * pointers when the psp_dev structure is freed.
  */
 void psp_dev_unregister(struct psp_dev *psd)
 {
 	struct psp_assoc *pas, *next;
+	struct netdev_nested_priv priv = {
+		.data = psd,
+	};
 
 	mutex_lock(&psp_devs_lock);
 	mutex_lock(&psd->lock);
@@ -137,6 +170,12 @@ void psp_dev_unregister(struct psp_dev *psd)
 
 	rcu_assign_pointer(psd->main_netdev->psp_dev, NULL);
 
+	/* Clear borrowed psp_dev pointers on all upper devices */
+	rcu_read_lock();
+	netdev_walk_all_upper_dev_rcu(psd->main_netdev,
+				      psp_clear_upper_dev_psp_dev, &priv);
+	rcu_read_unlock();
+
 	psd->ops = NULL;
 	psd->drv_priv = NULL;
 
@@ -313,11 +352,87 @@ int psp_dev_rcv(struct sk_buff *skb, u16 dev_id, u8 generation, bool strip_icv)
 }
 EXPORT_SYMBOL(psp_dev_rcv);
 
+/**
+ * psp_netdevice_event() - Handle netdevice events for PSP device propagation
+ * @nb:		notifier block
+ * @event:	netdevice event
+ * @ptr:	netdevice notifier info
+ *
+ * Propagates psp_dev pointer from lower devices to upper devices when
+ * upper devices are created (e.g., VLAN subinterfaces).
+ * Excluding from this logic, the upper devices that have multiple lower
+ * devices eg., bond devices.
+ *
+ * Return: NOTIFY_DONE
+ */
+static int psp_netdevice_event(struct notifier_block *nb,
+			       unsigned long event, void *ptr)
+{
+	struct netdev_notifier_changeupper_info *info;
+	struct net_device *dev, *upper_dev;
+	struct psp_dev *psd;
+
+	if (event != NETDEV_CHANGEUPPER)
+		return NOTIFY_DONE;
+
+	info = ptr;
+	dev = netdev_notifier_info_to_dev(ptr);
+	upper_dev = info->upper_dev;
+
+	if (netif_is_lag_master(upper_dev))
+		return NOTIFY_DONE;
+
+	if (info->linking) {
+		/* Lower device is being linked to an upper device.
+		 * Propagate psp_dev from the immediate lower device to the
+		 * upper device. The immediate lower device would have already
+		 * got the psp_dev pointer set in a previous notification (or
+		 * owns it if it's the lowest device).
+		 * Upper devices just borrow the pointer.
+		 *
+		 * Use psp_dev_tryget/put to guard against a concurrent
+		 * psp_dev_unregister that may have already cleared the
+		 * lower device's pointer and started freeing the psp_dev.
+		 */
+		psd = rtnl_dereference(dev->psp_dev);
+		if (psd && psp_dev_tryget(psd)) {
+			rcu_assign_pointer(upper_dev->psp_dev, psd);
+			psp_dev_put(psd);
+		}
+	} else {
+		/* Lower device is being unlinked from an upper device.
+		 * Clear the borrowed psp_dev pointer on the upper device.
+		 * Any devices stacked above upper_dev will get their own
+		 * NETDEV_CHANGEUPPER notifications as the stack unwinds.
+		 */
+		psd = rtnl_dereference(upper_dev->psp_dev);
+		if (psd)
+			rcu_assign_pointer(upper_dev->psp_dev, NULL);
+	}
+
+	return NOTIFY_DONE;
+}
+
+static struct notifier_block psp_netdevice_notifier = {
+	.notifier_call = psp_netdevice_event,
+};
+
 static int __init psp_init(void)
 {
+	int err;
+
 	mutex_init(&psp_devs_lock);
 
-	return genl_register_family(&psp_nl_family);
+	err = register_netdevice_notifier(&psp_netdevice_notifier);
+	if (err)
+		return err;
+
+	err = genl_register_family(&psp_nl_family);
+	if (err) {
+		unregister_netdevice_notifier(&psp_netdevice_notifier);
+		return err;
+	}
+	return 0;
 }
 
 subsys_initcall(psp_init);
-- 
2.45.4

Re: [net-next, v3 1/2] psp: Support for transmit on logical device when the underlying transport device supports PSP.

[Jakub Kicinski]

On Thu, 26 Feb 2026 10:46:53 -0800 Kiran Kella wrote:
> This is achieved by propagating the psp_dev from the lower device
> to the upper devices in the device stack via a netdevice notifier.
> The lowest device owns the psp_dev pointer while the upper devices
> just borrow the pointer. When the lower device is unlinked, the
> borrowed pointer is cleared in the upper device.
> Assumption being that psp_dev is set on the lowest device before
> any upper devices are stacked on that lowest device.

As I mentioned in the other thread I'd like to establish some clear
expectation on where psd propagates automatically and where it doesn't.
I don't want to see a stream of patches that say "fix propagating PSP
onto X upper". And conversely report saying "PSP got propagated but
it doesn't actually work" (macvlan in bridge mode etc).

Hence my preference was to require the user who created the device
to propagate PSP. Willem, WDYT?

> +/**
> + * psp_clear_upper_dev_psp_dev() - Clear borrowed psp_dev pointer on upper
> + *				   device
> + * @upper_dev:	Upper device that may have borrowed psp_dev pointer
> + * @priv:	netdev_nested_priv containing the psp_dev being unregistered
> + *
> + * Callback for netdev_walk_all_upper_dev_rcu() to clear borrowed psp_dev
> + * pointers on upper devices when the underlying psp_dev is being unregistered.
> + *
> + * Return: 0 to continue walking, non-zero to stop.

Please (tell your LLM) to avoid adding kdoc which restates what the
code does. For static function really kdoc is only useful if there's
something not-obvious to say.

> +static int psp_clear_upper_dev_psp_dev(struct net_device *upper_dev,
> +				       struct netdev_nested_priv *priv)

Please (tell your LLM) that the action goes after the object / noun.
psp_upper_psp_dev_clear() or some such.

> +{
> +	struct psp_dev *psd = priv->data;
> +	struct psp_dev *upper_psd;
> +
> +	upper_psd = rcu_dereference(upper_dev->psp_dev);
> +	if (upper_psd == psd)
> +		rcu_assign_pointer(upper_dev->psp_dev, NULL);
> +
> +	return 0;
> +}
> +
>  /**
>   * psp_dev_unregister() - unregister PSP device
>   * @psd:	PSP device structure
> + *
> + * Unregisters a PSP device and clears all borrowed psp_dev pointers on
> + * upper devices (e.g., VLAN subinterfaces) that reference this device.
> + * This prevents use-after-free if upper devices still have borrowed
> + * pointers when the psp_dev structure is freed.
>   */
>  void psp_dev_unregister(struct psp_dev *psd)
>  {
>  	struct psp_assoc *pas, *next;
> +	struct netdev_nested_priv priv = {
> +		.data = psd,
> +	};

reverse xmas tree
-- 
pw-bot: cr

Re: [net-next, v3 1/2] psp: Support for transmit on logical device when the underlying transport device supports PSP.

[Willem de Bruijn]

Jakub Kicinski wrote:
> On Thu, 26 Feb 2026 10:46:53 -0800 Kiran Kella wrote:
> > This is achieved by propagating the psp_dev from the lower device
> > to the upper devices in the device stack via a netdevice notifier.
> > The lowest device owns the psp_dev pointer while the upper devices
> > just borrow the pointer. When the lower device is unlinked, the
> > borrowed pointer is cleared in the upper device.
> > Assumption being that psp_dev is set on the lowest device before
> > any upper devices are stacked on that lowest device.
> 
> As I mentioned in the other thread I'd like to establish some clear
> expectation on where psd propagates automatically and where it doesn't.
> I don't want to see a stream of patches that say "fix propagating PSP
> onto X upper". And conversely report saying "PSP got propagated but
> it doesn't actually work" (macvlan in bridge mode etc).
> 
> Hence my preference was to require the user who created the device
> to propagate PSP. Willem, WDYT?

Can you give a bit more detail what you have in mind?

An explicit user (netlink) API to associate a psp_dev with a
net_device?

Re: [net-next, v3 1/2] psp: Support for transmit on logical device when the underlying transport device supports PSP.

[Jakub Kicinski]

On Sat, 28 Feb 2026 14:46:28 -0500 Willem de Bruijn wrote:
> Jakub Kicinski wrote:
> > On Thu, 26 Feb 2026 10:46:53 -0800 Kiran Kella wrote:  
> > > This is achieved by propagating the psp_dev from the lower device
> > > to the upper devices in the device stack via a netdevice notifier.
> > > The lowest device owns the psp_dev pointer while the upper devices
> > > just borrow the pointer. When the lower device is unlinked, the
> > > borrowed pointer is cleared in the upper device.
> > > Assumption being that psp_dev is set on the lowest device before
> > > any upper devices are stacked on that lowest device.  
> > 
> > As I mentioned in the other thread I'd like to establish some clear
> > expectation on where psd propagates automatically and where it doesn't.
> > I don't want to see a stream of patches that say "fix propagating PSP
> > onto X upper". And conversely report saying "PSP got propagated but
> > it doesn't actually work" (macvlan in bridge mode etc).
> > 
> > Hence my preference was to require the user who created the device
> > to propagate PSP. Willem, WDYT?  
> 
> Can you give a bit more detail what you have in mind?
> 
> An explicit user (netlink) API to associate a psp_dev with a
> net_device?

Yes:
https://lore.kernel.org/all/20260224002410.1553838-7-weibunny@fb.com/

Re: [net-next, v3 1/2] psp: Support for transmit on logical device when the underlying transport device supports PSP.

[Willem de Bruijn]

Jakub Kicinski wrote:
> On Sat, 28 Feb 2026 14:46:28 -0500 Willem de Bruijn wrote:
> > Jakub Kicinski wrote:
> > > On Thu, 26 Feb 2026 10:46:53 -0800 Kiran Kella wrote:  
> > > > This is achieved by propagating the psp_dev from the lower device
> > > > to the upper devices in the device stack via a netdevice notifier.
> > > > The lowest device owns the psp_dev pointer while the upper devices
> > > > just borrow the pointer. When the lower device is unlinked, the
> > > > borrowed pointer is cleared in the upper device.
> > > > Assumption being that psp_dev is set on the lowest device before
> > > > any upper devices are stacked on that lowest device.  
> > > 
> > > As I mentioned in the other thread I'd like to establish some clear
> > > expectation on where psd propagates automatically and where it doesn't.
> > > I don't want to see a stream of patches that say "fix propagating PSP
> > > onto X upper". And conversely report saying "PSP got propagated but
> > > it doesn't actually work" (macvlan in bridge mode etc).
> > > 
> > > Hence my preference was to require the user who created the device
> > > to propagate PSP. Willem, WDYT?  
> > 
> > Can you give a bit more detail what you have in mind?
> > 
> > An explicit user (netlink) API to associate a psp_dev with a
> > net_device?
> 
> Yes:
> https://lore.kernel.org/all/20260224002410.1553838-7-weibunny@fb.com/

I see. Yes, fair to ask for an explicit sensible policy.

It would be nice if PSP could transparently be enabled on upper
devices, similar to dev->features.

But this quickly runs into practical questions like when and how can a
bonding device with multiple independent lower devices support PSP?

dev->features also has type specific carve-outs for upper types, such
as vlan_features and hw_enc_features. We probably don't want to
introduce the same for PSP.

Re: [net-next, v3 1/2] psp: Support for transmit on logical device when the underlying transport device supports PSP.

[Kiran Kella]

[-- Attachment #1: Type: text/plain, Size: 3117 bytes --]

On Sat, Feb 28, 2026 at 11:34 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Thu, 26 Feb 2026 10:46:53 -0800 Kiran Kella wrote:
> > This is achieved by propagating the psp_dev from the lower device
> > to the upper devices in the device stack via a netdevice notifier.
> > The lowest device owns the psp_dev pointer while the upper devices
> > just borrow the pointer. When the lower device is unlinked, the
> > borrowed pointer is cleared in the upper device.
> > Assumption being that psp_dev is set on the lowest device before
> > any upper devices are stacked on that lowest device.
>
> As I mentioned in the other thread I'd like to establish some clear
> expectation on where psd propagates automatically and where it doesn't.
> I don't want to see a stream of patches that say "fix propagating PSP
> onto X upper". And conversely report saying "PSP got propagated but
> it doesn't actually work" (macvlan in bridge mode etc).
>
> Hence my preference was to require the user who created the device
> to propagate PSP. Willem, WDYT?

I too prefer to go with the single approach where the user has to
propagate the PSP.

>
> > +/**
> > + * psp_clear_upper_dev_psp_dev() - Clear borrowed psp_dev pointer on upper
> > + *                              device
> > + * @upper_dev:       Upper device that may have borrowed psp_dev pointer
> > + * @priv:    netdev_nested_priv containing the psp_dev being unregistered
> > + *
> > + * Callback for netdev_walk_all_upper_dev_rcu() to clear borrowed psp_dev
> > + * pointers on upper devices when the underlying psp_dev is being unregistered.
> > + *
> > + * Return: 0 to continue walking, non-zero to stop.
>
> Please (tell your LLM) to avoid adding kdoc which restates what the
> code does. For static function really kdoc is only useful if there's
> something not-obvious to say.

Ack

>
> > +static int psp_clear_upper_dev_psp_dev(struct net_device *upper_dev,
> > +                                    struct netdev_nested_priv *priv)
>
> Please (tell your LLM) that the action goes after the object / noun.
> psp_upper_psp_dev_clear() or some such.

Ack

>
> > +{
> > +     struct psp_dev *psd = priv->data;
> > +     struct psp_dev *upper_psd;
> > +
> > +     upper_psd = rcu_dereference(upper_dev->psp_dev);
> > +     if (upper_psd == psd)
> > +             rcu_assign_pointer(upper_dev->psp_dev, NULL);
> > +
> > +     return 0;
> > +}
> > +
> >  /**
> >   * psp_dev_unregister() - unregister PSP device
> >   * @psd:     PSP device structure
> > + *
> > + * Unregisters a PSP device and clears all borrowed psp_dev pointers on
> > + * upper devices (e.g., VLAN subinterfaces) that reference this device.
> > + * This prevents use-after-free if upper devices still have borrowed
> > + * pointers when the psp_dev structure is freed.
> >   */
> >  void psp_dev_unregister(struct psp_dev *psd)
> >  {
> >       struct psp_assoc *pas, *next;
> > +     struct netdev_nested_priv priv = {
> > +             .data = psd,
> > +     };
>
> reverse xmas tree

Ack

> --
> pw-bot: cr

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5465 bytes --]

[net-next, v3 2/2] selftests: drv-net: psp: add test for VLAN sub-interface

[Kiran Kella]

Add test to validate that the psp device information is propagated
properly from the lower device to the upper devices so that
the PSP transmit validation passes.

Signed-off-by: Kiran Kella <kiran.kella@broadcom.com>
Reviewed-by: Akhilesh Samineni <akhilesh.samineni@broadcom.com>
---
 tools/testing/selftests/drivers/net/config |  1 +
 tools/testing/selftests/drivers/net/psp.py | 81 +++++++++++++++++++++-
 2 files changed, 81 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/drivers/net/config b/tools/testing/selftests/drivers/net/config
index 77ccf83d87e0..e03676f1d993 100644
--- a/tools/testing/selftests/drivers/net/config
+++ b/tools/testing/selftests/drivers/net/config
@@ -3,6 +3,7 @@ CONFIG_DEBUG_INFO_BTF=y
 CONFIG_DEBUG_INFO_BTF_MODULES=n
 CONFIG_INET_PSP=y
 CONFIG_IPV6=y
+CONFIG_VLAN_8021Q=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_NETCONSOLE_EXTENDED_LOG=y
diff --git a/tools/testing/selftests/drivers/net/psp.py b/tools/testing/selftests/drivers/net/psp.py
index 864d9fce1094..b3d00bb01816 100755
--- a/tools/testing/selftests/drivers/net/psp.py
+++ b/tools/testing/selftests/drivers/net/psp.py
@@ -9,6 +9,7 @@ import socket
 import struct
 import termios
 import time
+import types
 
 from lib.py import defer
 from lib.py import ksft_run, ksft_exit, ksft_pr
@@ -18,6 +19,7 @@ from lib.py import KsftSkipEx
 from lib.py import NetDrvEpEnv, PSPFamily, NlError
 from lib.py import bkg, rand_port, wait_port_listen
 
+from lib.py import cmd, ip
 
 def _get_outq(s):
     one = b'\0' * 4
@@ -570,6 +572,83 @@ def removal_device_bi(cfg):
     finally:
         _close_conn(cfg, s)
 
+def vlan_basic_send(cfg):
+    """
+    Test PSP over VLAN-to-VLAN traffic
+
+    Network topology:
+      Local VLAN (nsim0.100) <---> Remote VLAN (nsim1.100)
+           |                            |
+      Local Physical (nsim0) <---> Remote Physical (nsim1)
+          [PSP configured here]
+    """
+    _init_psp_dev(cfg)
+
+    try:
+        cmd("modprobe 8021q")
+    except Exception:
+        raise KsftSkipEx("VLAN (8021q) kernel module not available")
+
+    vlan_id = 100
+    local_ifname = f"{cfg.ifname}.{vlan_id}"
+    remote_ifname = f"{cfg.remote_ifname}.{vlan_id}"
+
+    # Create VLAN interface on LOCAL side
+    ip(f"link add link {cfg.ifname} name {local_ifname} type vlan id {vlan_id}")
+    defer(ip, f"link del {local_ifname}")
+    ip(f"addr add 192.0.2.21/24 dev {local_ifname}")
+    ip(f"-6 addr add 2001:db8::21/64 dev {local_ifname} nodad")
+    ip(f"link set {local_ifname} up")
+
+    # Create VLAN interface on REMOTE side
+    ip(f"link add link {cfg.remote_ifname} name {remote_ifname} "
+       f"type vlan id {vlan_id}", host=cfg.remote)
+    defer(ip, f"link del {remote_ifname}", host=cfg.remote)
+    ip(f"addr add 192.0.2.22/24 dev {remote_ifname}", host=cfg.remote)
+    ip(f"-6 addr add 2001:db8::22/64 dev {remote_ifname} nodad",
+       host=cfg.remote)
+    ip(f"link set {remote_ifname} up", host=cfg.remote)
+
+    local_ifindex = ip(f"-j link show {local_ifname}", json=True)[0]['ifindex']
+
+    vlan_cfg = types.SimpleNamespace(
+        ifname=local_ifname,
+        ifindex=local_ifindex,
+        remote_ifname=remote_ifname,
+        addr_v={"4": "192.0.2.21", "6": "2001:db8::21"},
+        remote_addr_v={"4": "192.0.2.22", "6": "2001:db8::22"},
+        addr="192.0.2.21",
+        remote_addr="192.0.2.22",
+        pspnl=cfg.pspnl,
+        psp_dev_id=cfg.psp_dev_id,
+        remote=cfg.remote,
+        comm_port=cfg.comm_port,
+        comm_sock=cfg.comm_sock,
+    )
+
+    s = _make_psp_conn(vlan_cfg, version=0)
+    defer(_close_psp_conn, vlan_cfg, s)
+
+    # Create PSP associations
+    # The socket's device is VLAN, but PSP device is on physical NIC
+    rx_assoc = vlan_cfg.pspnl.rx_assoc({
+        "version": 0,
+        "dev-id": vlan_cfg.psp_dev_id,  # PSP device on physical interface
+        "sock-fd": s.fileno()
+    })
+    rx = rx_assoc['rx-key']
+    tx = _spi_xchg(s, rx)
+
+    vlan_cfg.pspnl.tx_assoc({
+        "dev-id": vlan_cfg.psp_dev_id,
+        "version": 0,
+        "tx-key": tx,
+        "sock-fd": s.fileno()
+    })
+
+    # Send data through VLAN interface (VLAN-to-VLAN traffic!)
+    data_len = _send_careful(vlan_cfg, s, 100)
+    _check_data_rx(vlan_cfg, data_len)
 
 def psp_ip_ver_test_builder(name, test_func, psp_ver, ipver):
     """Build test cases for each combo of PSP version and IP version"""
@@ -624,7 +703,7 @@ def main() -> None:
                 ]
 
                 ksft_run(cases=cases, globs=globals(),
-                         case_pfx={"dev_", "data_", "assoc_", "removal_"},
+                         case_pfx={"dev_", "data_", "assoc_", "removal_", "vlan_"},
                          args=(cfg, ))
 
                 cfg.comm_sock.send(b"exit\0")
-- 
2.45.4