Re: [PATCH v14 net-next 2/5] psp: add new netlink cmd for dev-assoc and dev-disassoc

[Jakub Kicinski <kuba@kernel.org>]

On Thu,  7 May 2026 21:26:07 -0700 Wei Wang wrote:
> From: Wei Wang <weibunny@fb.com>
> 
> The main purpose of this cmd is to be able to associate a
> non-psp-capable device (e.g. veth or netkit) with a psp device.
> One use case is if we create a pair of veth/netkit, and assign 1 end
> inside a netns, while leaving the other end within the default netns,
> with a real PSP device, e.g. netdevsim or a physical PSP-capable NIC.
> With this command, we could associate the veth/netkit inside the netns
> with PSP device, so the virtual device could act as PSP-capable device
> to initiate PSP connections, and performs PSP encryption/decryption on
> the real PSP device.

> --- a/net/psp/psp_main.c
> +++ b/net/psp/psp_main.c
> @@ -37,8 +37,18 @@ struct mutex psp_devs_lock;
>   */
>  int psp_dev_check_access(struct psp_dev *psd, struct net *net, bool admin)
>  {
> +	struct psp_assoc_dev *entry;
> +
>  	if (dev_net(psd->main_netdev) == net)
>  		return 0;
> +
> +	if (!admin) {
> +		list_for_each_entry(entry, &psd->assoc_dev_list, dev_list) {
> +			if (dev_net(entry->assoc_dev) == net)


Would

	if (psp_has_assoc_dev_in_ns(psd, net)) ?

work here?

> +				return 0;
> +		}
> +	}
> +
>  	return -ENOENT;
>  }

>  static struct psp_dev *
> @@ -79,18 +147,58 @@ static int __psp_device_get_locked(const struct genl_split_ops *ops,
>  	return PTR_ERR_OR_ZERO(info->user_ptr[0]);
>  }
>  
> +/*
> + * Admin version of psp_device_get_locked() where it returns psd only if
> + * current netns is the same as psd->main_netdev's netns.
> + */

this..

>  int psp_device_get_locked_admin(const struct genl_split_ops *ops,
>  				struct sk_buff *skb, struct genl_info *info)
>  {
>  	return __psp_device_get_locked(ops, skb, info, true);
>  }
>  
> +/*
> + * Non-admin version of psp_device_get_locked() where it returns psd in netns
> + * for not only psd->main_netdev but all netdevs in psd->assoc_dev_list.
> + */

.. and this belong in previous commit. But TBH they seem unnecessary.

>  int psp_device_get_locked(const struct genl_split_ops *ops,
>  			  struct sk_buff *skb, struct genl_info *info)
>  {
>  	return __psp_device_get_locked(ops, skb, info, false);
>  }

> +int psp_nl_dev_assoc_doit(struct sk_buff *skb, struct genl_info *info)
> +{
> +	struct psp_dev *psd = info->user_ptr[0];
> +	struct psp_assoc_dev *psp_assoc_dev;
> +	struct net_device *assoc_dev;
> +	struct sk_buff *rsp;
> +	u32 assoc_ifindex;
> +	struct net *net;
> +	int err;
> +
> +	if (psd->assoc_dev_cnt >= PSP_ASSOC_DEV_MAX) {
> +		NL_SET_ERR_MSG(info->extack,
> +			       "Maximum number of associated devices reached");
> +		return -ENOSPC;
> +	}
> +
> +	net = psp_nl_resolve_assoc_dev_ns(psd, info);
> +	if (IS_ERR(net))
> +		return PTR_ERR(net);
> +
> +	psp_assoc_dev = kzalloc_obj(*psp_assoc_dev, GFP_KERNEL);

nit: I think GFP_KERNEL is implicit if flags are not specified.

> +	if (!psp_assoc_dev) {
> +		err = -ENOMEM;
> +		goto err_put_net;
> +	}