sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget"/translations/zh_CN/networking/tlsmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget"/translations/zh_TW/networking/tlsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget"/translations/it_IT/networking/tlsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget"/translations/ja_JP/networking/tlsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget"/translations/ko_KR/networking/tlsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget"/translations/sp_SP/networking/tlsmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhtarget)}(h.. _kernel_tls:h]h}(h]h ]h"]h$]h&]refid kernel-tlsuh1hhKhhhhhcmsg_level = SOL_TLS; cmsg->cmsg_type = TLS_SET_RECORD_TYPE; cmsg->cmsg_len = CMSG_LEN(cmsg_len); *CMSG_DATA(cmsg) = record_type; msg.msg_controllen = cmsg->cmsg_len; msg_iov.iov_base = data; msg_iov.iov_len = length; msg.msg_iov = &msg_iov; msg.msg_iovlen = 1; return sendmsg(sock, &msg, 0); }h]hX^/* send TLS control message using record_type */ static int klts_send_ctrl_message(int sock, unsigned char record_type, void *data, size_t length) { struct msghdr msg = {0}; int cmsg_len = sizeof(record_type); struct cmsghdr *cmsg; char buf[CMSG_SPACE(cmsg_len)]; struct iovec msg_iov; /* Vector of data to send/receive into. */ msg.msg_control = buf; msg.msg_controllen = sizeof(buf); cmsg = CMSG_FIRSTHDR(&msg); cmsg->cmsg_level = SOL_TLS; cmsg->cmsg_type = TLS_SET_RECORD_TYPE; cmsg->cmsg_len = CMSG_LEN(cmsg_len); *CMSG_DATA(cmsg) = record_type; msg.msg_controllen = cmsg->cmsg_len; msg_iov.iov_base = data; msg_iov.iov_len = length; msg.msg_iov = &msg_iov; msg.msg_iovlen = 1; return sendmsg(sock, &msg, 0); }}hjsbah}(h]h ]h"]h$]h&]j.j/j0j1j2j3}uh1jhhhKhjhhubh)}(hYControl message data should be provided unencrypted, and will be encrypted by the kernel.h]hYControl message data should be provided unencrypted, and will be encrypted by the kernel.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubeh}(h]send-tls-control-messagesah ]h"]send tls control messagesah$]h&]uh1hhhhhhhhK~ubh)}(hhh](h)}(hReceiving TLS control messagesh]hReceiving TLS control messages}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hTLS control messages are passed in the userspace buffer, with message type passed via cmsg. If no cmsg buffer is provided, an error is returned if a control message is received. Data messages may be received without a cmsg buffer set.h]hTLS control messages are passed in the userspace buffer, with message type passed via cmsg. If no cmsg buffer is provided, an error is returned if a control message is received. Data messages may be received without a cmsg buffer set.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj)}(hXchar buffer[16384]; char cmsg[CMSG_SPACE(sizeof(unsigned char))]; struct msghdr msg = {0}; msg.msg_control = cmsg; msg.msg_controllen = sizeof(cmsg); struct iovec msg_iov; msg_iov.iov_base = buffer; msg_iov.iov_len = 16384; msg.msg_iov = &msg_iov; msg.msg_iovlen = 1; int ret = recvmsg(sock, &msg, 0 /* flags */); struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg); if (cmsg->cmsg_level == SOL_TLS && cmsg->cmsg_type == TLS_GET_RECORD_TYPE) { int record_type = *((unsigned char *)CMSG_DATA(cmsg)); // Do something with record_type, and control message data in // buffer. // // Note that record_type may be == to application data (23). } else { // Buffer contains application data. }h]hXchar buffer[16384]; char cmsg[CMSG_SPACE(sizeof(unsigned char))]; struct msghdr msg = {0}; msg.msg_control = cmsg; msg.msg_controllen = sizeof(cmsg); struct iovec msg_iov; msg_iov.iov_base = buffer; msg_iov.iov_len = 16384; msg.msg_iov = &msg_iov; msg.msg_iovlen = 1; int ret = recvmsg(sock, &msg, 0 /* flags */); struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg); if (cmsg->cmsg_level == SOL_TLS && cmsg->cmsg_type == TLS_GET_RECORD_TYPE) { int record_type = *((unsigned char *)CMSG_DATA(cmsg)); // Do something with record_type, and control message data in // buffer. // // Note that record_type may be == to application data (23). } else { // Buffer contains application data. }}hjsbah}(h]h ]h"]h$]h&]j.j/j0j1j2j3}uh1jhhhKhjhhubh)}(h`_.h](h9A patchset to OpenSSL to use ktls as the record layer is }(hjhhhNhNubh reference)}(h=`here `_h]hhere}(hjhhhNhNubah}(h]h ]h"]h$]h&]namehererefuri3https://github.com/Mellanox/openssl/commits/tls_rx2uh1jhjubh)}(h6 h]h}(h]hereah ]h"]hereah$]h&]refurijuh1h referencedKhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(h`An example `_ of calling send directly after a handshake using gnutls. Since it doesn't implement a full record layer, control messages are not supported.h](j)}(h?`An example `_h]h An example}(hj hhhNhNubah}(h]h ]h"]h$]h&]name An examplej/https://github.com/ktls/af_ktls-tool/commits/RXuh1jhjubh)}(h2 h]h}(h] an-exampleah ]h"] an exampleah$]h&]refurijuh1hjKhjubh of calling send directly after a handshake using gnutls. Since it doesn’t implement a full record layer, control messages are not supported.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubeh}(h]'integrating-in-to-userspace-tls-libraryah ]h"]'integrating in to userspace tls libraryah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hOptional optimizationsh]hOptional optimizations}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj9hhhhhKubh)}(hXLThere are certain condition-specific optimizations the TLS ULP can make, if requested. Those optimizations are either not universally beneficial or may impact correctness, hence they require an opt-in. All options are set per-socket using setsockopt(), and their state can be checked using getsockopt() and via socket diag (``ss``).h](hXDThere are certain condition-specific optimizations the TLS ULP can make, if requested. Those optimizations are either not universally beneficial or may impact correctness, hence they require an opt-in. All options are set per-socket using setsockopt(), and their state can be checked using getsockopt() and via socket diag (}(hjJhhhNhNubj&)}(h``ss``h]hss}(hjRhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjJubh).}(hjJhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhj9hhubh)}(hhh](h)}(hTLS_TX_ZEROCOPY_ROh]hTLS_TX_ZEROCOPY_RO}(hjmhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjjhhhhhKubh)}(hFor device offload only. Allow sendfile() data to be transmitted directly to the NIC without making an in-kernel copy. This allows true zero-copy behavior when device offload is enabled.h]hFor device offload only. Allow sendfile() data to be transmitted directly to the NIC without making an in-kernel copy. This allows true zero-copy behavior when device offload is enabled.}(hj{hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjjhhubh)}(hThe application must make sure that the data is not modified between being submitted and transmission completing. In other words this is mostly applicable if the data sent on a socket via sendfile() is read-only.h]hThe application must make sure that the data is not modified between being submitted and transmission completing. In other words this is mostly applicable if the data sent on a socket via sendfile() is read-only.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjjhhubh)}(hModifying the data may result in different versions of the data being used for the original TCP transmission and TCP retransmissions. To the receiver this will look like TLS records had been tampered with and will result in record authentication failures.h]hModifying the data may result in different versions of the data being used for the original TCP transmission and TCP retransmissions. To the receiver this will look like TLS records had been tampered with and will result in record authentication failures.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM hjjhhubeh}(h]tls-tx-zerocopy-roah ]h"]tls_tx_zerocopy_roah$]h&]uh1hhj9hhhhhKubh)}(hhh](h)}(hTLS_RX_EXPECT_NO_PADh]hTLS_RX_EXPECT_NO_PAD}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(hTLS 1.3 only. Expect the sender to not pad records. This allows the data to be decrypted directly into user space buffers with TLS 1.3.h]hTLS 1.3 only. Expect the sender to not pad records. This allows the data to be decrypted directly into user space buffers with TLS 1.3.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hThis optimization is safe to enable only if the remote end is trusted, otherwise it is an attack vector to doubling the TLS processing cost.h]hThis optimization is safe to enable only if the remote end is trusted, otherwise it is an attack vector to doubling the TLS processing cost.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hIf the record decrypted turns out to had been padded or is not a data record it will be decrypted again into a kernel buffer without zero copy. Such events are counted in the ``TlsDecryptRetry`` statistic.h](hIf the record decrypted turns out to had been padded or is not a data record it will be decrypted again into a kernel buffer without zero copy. Such events are counted in the }(hjhhhNhNubj&)}(h``TlsDecryptRetry``h]hTlsDecryptRetry}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjubh statistic.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMhjhhubeh}(h]tls-rx-expect-no-padah ]h"]tls_rx_expect_no_padah$]h&]uh1hhj9hhhhhMubh)}(hhh](h)}(hTLS_TX_MAX_PAYLOAD_LENh]hTLS_TX_MAX_PAYLOAD_LEN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(hPSpecifies the maximum size of the plaintext payload for transmitted TLS records.h]hPSpecifies the maximum size of the plaintext payload for transmitted TLS records.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hWhen this option is set, the kernel enforces the specified limit on all outgoing TLS records. No plaintext fragment will exceed this size. This option can be used to implement the TLS Record Size Limit extension [1].h]hWhen this option is set, the kernel enforces the specified limit on all outgoing TLS records. No plaintext fragment will exceed this size. This option can be used to implement the TLS Record Size Limit extension [1].}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM hjhhubh bullet_list)}(hhh](h list_item)}(hEFor TLS 1.2, the value corresponds directly to the record size limit.h]h)}(hj8h]hEFor TLS 1.2, the value corresponds directly to the record size limit.}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM$hj6ubah}(h]h ]h"]h$]h&]uh1j4hj1hhhhhNubj5)}(hFor TLS 1.3, the value should be set to record_size_limit - 1, since the record size limit includes one additional byte for the ContentType field. h]h)}(hFor TLS 1.3, the value should be set to record_size_limit - 1, since the record size limit includes one additional byte for the ContentType field.h]hFor TLS 1.3, the value should be set to record_size_limit - 1, since the record size limit includes one additional byte for the ContentType field.}(hjQhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM%hjMubah}(h]h ]h"]h$]h&]uh1j4hj1hhhhhNubeh}(h]h ]h"]h$]h&]bullet*uh1j/hhhM$hjhhubh)}(hThe valid range for this option is 64 to 16384 bytes for TLS 1.2, and 63 to 16384 bytes for TLS 1.3. The lower minimum for TLS 1.3 accounts for the extra byte used by the ContentType field.h]hThe valid range for this option is 64 to 16384 bytes for TLS 1.2, and 63 to 16384 bytes for TLS 1.3. The lower minimum for TLS 1.3 accounts for the extra byte used by the ContentType field.}(hjmhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM)hjhhubh)}(h1[1] https://datatracker.ietf.org/doc/html/rfc8449h](h[1] }(hj{hhhNhNubj)}(h-https://datatracker.ietf.org/doc/html/rfc8449h]h-https://datatracker.ietf.org/doc/html/rfc8449}(hjhhhNhNubah}(h]h ]h"]h$]h&]refurijuh1jhj{ubeh}(h]h ]h"]h$]h&]uh1hhhhM-hjhhubeh}(h]tls-tx-max-payload-lenah ]h"]tls_tx_max_payload_lenah$]h&]uh1hhj9hhhhhMubeh}(h]optional-optimizationsah ]h"]optional optimizationsah$]h&]uh1hhhhhhhhKubeh}(h]user-interfaceah ]h"]user interfaceah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(h Statisticsh]h Statistics}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhM0ubh)}(h[TLS implementation exposes the following per-namespace statistics (``/proc/net/tls_stat``):h](hCTLS implementation exposes the following per-namespace statistics (}(hjhhhNhNubj&)}(h``/proc/net/tls_stat``h]h/proc/net/tls_stat}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjubh):}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM2hjhhubj0)}(hhh](j5)}(ht``TlsCurrTxSw``, ``TlsCurrRxSw`` - number of TX and RX sessions currently installed where host handles cryptography h]h)}(hs``TlsCurrTxSw``, ``TlsCurrRxSw`` - number of TX and RX sessions currently installed where host handles cryptographyh](j&)}(h``TlsCurrTxSw``h]h TlsCurrTxSw}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjubh, }(hjhhhNhNubj&)}(h``TlsCurrRxSw``h]h TlsCurrRxSw}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjubhS - number of TX and RX sessions currently installed where host handles cryptography}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM5hjubah}(h]h ]h"]h$]h&]uh1j4hjhhhhhNubj5)}(h{``TlsCurrTxDevice``, ``TlsCurrRxDevice`` - number of TX and RX sessions currently installed where NIC handles cryptography h]h)}(hz``TlsCurrTxDevice``, ``TlsCurrRxDevice`` - number of TX and RX sessions currently installed where NIC handles cryptographyh](j&)}(h``TlsCurrTxDevice``h]hTlsCurrTxDevice}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1j%hj ubh, }(hj hhhNhNubj&)}(h``TlsCurrRxDevice``h]hTlsCurrRxDevice}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1j%hj ubhR - number of TX and RX sessions currently installed where NIC handles cryptography}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM9hjubah}(h]h ]h"]h$]h&]uh1j4hjhhhhhNubj5)}(hV``TlsTxSw``, ``TlsRxSw`` - number of TX and RX sessions opened with host cryptography h]h)}(hU``TlsTxSw``, ``TlsRxSw`` - number of TX and RX sessions opened with host cryptographyh](j&)}(h ``TlsTxSw``h]hTlsTxSw}(hj\hhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjXubh, }(hjXhhhNhNubj&)}(h ``TlsRxSw``h]hTlsRxSw}(hjnhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjXubh= - number of TX and RX sessions opened with host cryptography}(hjXhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM=hjTubah}(h]h ]h"]h$]h&]uh1j4hjhhhhhNubj5)}(h]``TlsTxDevice``, ``TlsRxDevice`` - number of TX and RX sessions opened with NIC cryptography h]h)}(h\``TlsTxDevice``, ``TlsRxDevice`` - number of TX and RX sessions opened with NIC cryptographyh](j&)}(h``TlsTxDevice``h]h TlsTxDevice}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjubh, }(hjhhhNhNubj&)}(h``TlsRxDevice``h]h TlsRxDevice}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjubh< - number of TX and RX sessions opened with NIC cryptography}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM@hjubah}(h]h ]h"]h$]h&]uh1j4hjhhhhhNubj5)}(hZ``TlsDecryptError`` - record decryption failed (e.g. due to incorrect authentication tag) h]h)}(hY``TlsDecryptError`` - record decryption failed (e.g. due to incorrect authentication tag)h](j&)}(h``TlsDecryptError``h]hTlsDecryptError}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjubhF - record decryption failed (e.g. due to incorrect authentication tag)}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMChjubah}(h]h ]h"]h$]h&]uh1j4hjhhhhhNubj5)}(hP``TlsDeviceRxResync`` - number of RX resyncs sent to NICs handling cryptography h]h)}(hO``TlsDeviceRxResync`` - number of RX resyncs sent to NICs handling cryptographyh](j&)}(h``TlsDeviceRxResync``h]hTlsDeviceRxResync}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjubh: - number of RX resyncs sent to NICs handling cryptography}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMFhjubah}(h]h ]h"]h$]h&]uh1j4hjhhhhhNubj5)}(h``TlsDecryptRetry`` - number of RX records which had to be re-decrypted due to ``TLS_RX_EXPECT_NO_PAD`` mis-prediction. Note that this counter will also increment for non-data records. h]h)}(h``TlsDecryptRetry`` - number of RX records which had to be re-decrypted due to ``TLS_RX_EXPECT_NO_PAD`` mis-prediction. Note that this counter will also increment for non-data records.h](j&)}(h``TlsDecryptRetry``h]hTlsDecryptRetry}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjubh< - number of RX records which had to be re-decrypted due to }(hjhhhNhNubj&)}(h``TLS_RX_EXPECT_NO_PAD``h]hTLS_RX_EXPECT_NO_PAD}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjubhQ mis-prediction. Note that this counter will also increment for non-data records.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMIhjubah}(h]h ]h"]h$]h&]uh1j4hjhhhhhNubj5)}(h``TlsRxNoPadViolation`` - number of data RX records which had to be re-decrypted due to ``TLS_RX_EXPECT_NO_PAD`` mis-prediction. h]h)}(h``TlsRxNoPadViolation`` - number of data RX records which had to be re-decrypted due to ``TLS_RX_EXPECT_NO_PAD`` mis-prediction.h](j&)}(h``TlsRxNoPadViolation``h]hTlsRxNoPadViolation}(hjPhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjLubhA - number of data RX records which had to be re-decrypted due to }(hjLhhhNhNubj&)}(h``TLS_RX_EXPECT_NO_PAD``h]hTLS_RX_EXPECT_NO_PAD}(hjbhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjLubh mis-prediction.}(hjLhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMNhjHubah}(h]h ]h"]h$]h&]uh1j4hjhhhhhNubj5)}(hd``TlsTxRekeyOk``, ``TlsRxRekeyOk`` - number of successful rekeys on existing sessions for TX and RX h]h)}(hc``TlsTxRekeyOk``, ``TlsRxRekeyOk`` - number of successful rekeys on existing sessions for TX and RXh](j&)}(h``TlsTxRekeyOk``h]h TlsTxRekeyOk}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjubh, }(hjhhhNhNubj&)}(h``TlsRxRekeyOk``h]h TlsRxRekeyOk}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjubhA - number of successful rekeys on existing sessions for TX and RX}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMRhjubah}(h]h ]h"]h$]h&]uh1j4hjhhhhhNubj5)}(hf``TlsTxRekeyError``, ``TlsRxRekeyError`` - number of failed rekeys on existing sessions for TX and RX h]h)}(he``TlsTxRekeyError``, ``TlsRxRekeyError`` - number of failed rekeys on existing sessions for TX and RXh](j&)}(h``TlsTxRekeyError``h]hTlsTxRekeyError}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjubh, }(hjhhhNhNubj&)}(h``TlsRxRekeyError``h]hTlsRxRekeyError}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjubh= - number of failed rekeys on existing sessions for TX and RX}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMUhjubah}(h]h ]h"]h$]h&]uh1j4hjhhhhhNubj5)}(hu``TlsRxRekeyReceived`` - number of received KeyUpdate handshake messages, requiring userspace to provide a new RX keyh]h)}(hu``TlsRxRekeyReceived`` - number of received KeyUpdate handshake messages, requiring userspace to provide a new RX keyh](j&)}(h``TlsRxRekeyReceived``h]hTlsRxRekeyReceived}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j%hjubh_ - number of received KeyUpdate handshake messages, requiring userspace to provide a new RX key}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMXhjubah}(h]h ]h"]h$]h&]uh1j4hjhhhhhNubeh}(h]h ]h"]h$]h&]jk-uh1j/hhhM5hjhhubeh}(h] statisticsah ]h"] statisticsah$]h&]uh1hhhhhhhhM0ubeh}(h](hid1eh ]h"]( kernel tls kernel_tlseh$]h&]uh1hhhhhhhhKexpect_referenced_by_name}j+hsexpect_referenced_by_id}hhsubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerjUerror_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourceh _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}refids}h]hasnameids}(j+hj*j'hhjjjejbjjj|jyjjjjjjj6j3jjj#j jjjjjjjjj"ju nametypes}(j+j*hjjejj|jjjj6jj#jjjjj"uh}(hhj'hhhjhjbhjjhjyjjjjjjjj3jjjj jjj9jjjjjjjjju footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}jcKsRparse_messages]transform_messages]hsystem_message)}(hhh]h)}(hhh]h0Hyperlink target "kernel-tls" is not referenced.}hjsbah}(h]h ]h"]h$]h&]uh1hhjubah}(h]h ]h"]h$]h&]levelKtypeINFOsourcehlineKuh1juba transformerN include_log] decorationNhhub.