wsphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget//translations/zh_CN/networking/xfrm/xfrm_devicemodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget//translations/zh_TW/networking/xfrm/xfrm_devicemodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget//translations/it_IT/networking/xfrm/xfrm_devicemodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget//translations/ja_JP/networking/xfrm/xfrm_devicemodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget//translations/ko_KR/networking/xfrm/xfrm_devicemodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget//translations/sp_SP/networking/xfrm/xfrm_devicemodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhhI/var/lib/git/docbuild/linux/Documentation/networking/xfrm/xfrm_device.rsthKubhtarget)}(h.. _xfrm_device:h]h}(h]h ]h"]h$]h&]refid xfrm-deviceuh1hhKhhhhhhubhsection)}(hhh](htitle)}(h/XFRM device - offloading the IPsec computationsh]h/XFRM device - offloading the IPsec computations}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh paragraph)}(hNShannon Nelson Leon Romanovsky h](hShannon Nelson <}(hhhhhNhNubh reference)}(hshannon.nelson@oracle.comh]hshannon.nelson@oracle.com}(hhhhhNhNubah}(h]h ]h"]h$]h&]refuri mailto:shannon.nelson@oracle.comuh1hhhubh> Leon Romanovsky <}(hhhhhNhNubh)}(hleonro@nvidia.comh]hleonro@nvidia.com}(hhhhhNhNubah}(h]h ]h"]h$]h&]refurimailto:leonro@nvidia.comuh1hhhubh>}(hhhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hhh](h)}(hOverviewh]hOverview}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK ubh)}(hXIPsec is a useful feature for securing network traffic, but the computational cost is high: a 10Gbps link can easily be brought down to under 1Gbps, depending on the traffic and link configuration. Luckily, there are NICs that offer a hardware based IPsec offload which can radically increase throughput and decrease CPU utilization. The XFRM Device interface allows NIC drivers to offer to the stack access to the hardware offload.h]hXIPsec is a useful feature for securing network traffic, but the computational cost is high: a 10Gbps link can easily be brought down to under 1Gbps, depending on the traffic and link configuration. Luckily, there are NICs that offer a hardware based IPsec offload which can radically increase throughput and decrease CPU utilization. The XFRM Device interface allows NIC drivers to offer to the stack access to the hardware offload.}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hHRight now, there are two types of hardware offload that kernel supports:h]hHRight now, there are two types of hardware offload that kernel supports:}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh block_quote)}(hX0* IPsec crypto offload: * NIC performs encrypt/decrypt * Kernel does everything else * IPsec packet offload: * NIC performs encrypt/decrypt * NIC does encapsulation * Kernel and NIC have SA and policy in-sync * NIC handles the SA and policies states * The Kernel talks to the keymanager h]h bullet_list)}(hhh](h list_item)}(hTIPsec crypto offload: * NIC performs encrypt/decrypt * Kernel does everything else h](h)}(hIPsec crypto offload:h]hIPsec crypto offload:}(hjOhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjKubjE)}(hhh](jJ)}(hNIC performs encrypt/decrypth]h)}(hjbh]hNIC performs encrypt/decrypt}(hjdhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj`ubah}(h]h ]h"]h$]h&]uh1jIhj]ubjJ)}(hKernel does everything else h]h)}(hKernel does everything elseh]hKernel does everything else}(hj{hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjwubah}(h]h ]h"]h$]h&]uh1jIhj]ubeh}(h]h ]h"]h$]h&]bullet*uh1jDhhhKhjKubeh}(h]h ]h"]h$]h&]uh1jIhjFubjJ)}(hIPsec packet offload: * NIC performs encrypt/decrypt * NIC does encapsulation * Kernel and NIC have SA and policy in-sync * NIC handles the SA and policies states * The Kernel talks to the keymanager h](h)}(hIPsec packet offload:h]hIPsec packet offload:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubjE)}(hhh](jJ)}(hNIC performs encrypt/decrypth]h)}(hjh]hNIC performs encrypt/decrypt}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK hjubah}(h]h ]h"]h$]h&]uh1jIhjubjJ)}(hNIC does encapsulationh]h)}(hjh]hNIC does encapsulation}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK!hjubah}(h]h ]h"]h$]h&]uh1jIhjubjJ)}(h)Kernel and NIC have SA and policy in-synch]h)}(hjh]h)Kernel and NIC have SA and policy in-sync}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK"hjubah}(h]h ]h"]h$]h&]uh1jIhjubjJ)}(h&NIC handles the SA and policies statesh]h)}(hjh]h&NIC handles the SA and policies states}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK#hjubah}(h]h ]h"]h$]h&]uh1jIhjubjJ)}(h#The Kernel talks to the keymanager h]h)}(h"The Kernel talks to the keymanagerh]h"The Kernel talks to the keymanager}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK$hjubah}(h]h ]h"]h$]h&]uh1jIhjubeh}(h]h ]h"]h$]h&]jjuh1jDhhhK hjubeh}(h]h ]h"]h$]h&]uh1jIhjFubeh}(h]h ]h"]h$]h&]jjuh1jDhhhKhj@ubah}(h]h ]h"]h$]h&]uh1j>hhhKhjhhubh)}(hUserland access to the offload is typically through a system such as libreswan or KAME/raccoon, but the iproute2 'ip xfrm' command set can be handy when experimenting. An example command might look something like this for crypto offload::h]hUserland access to the offload is typically through a system such as libreswan or KAME/raccoon, but the iproute2 ‘ip xfrm’ command set can be handy when experimenting. An example command might look something like this for crypto offload:}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK&hjhhubh literal_block)}(hXip x s add proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport \ reqid 0x07 replay-window 32 \ aead 'rfc4106(gcm(aes))' 0x44434241343332312423222114131211f4f3f2f1 128 \ sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp \ offload dev eth4 dir inh]hXip x s add proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport \ reqid 0x07 replay-window 32 \ aead 'rfc4106(gcm(aes))' 0x44434241343332312423222114131211f4f3f2f1 128 \ sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp \ offload dev eth4 dir in}hjNsbah}(h]h ]h"]h$]h&]hhuh1jLhhhK+hjhhubh)}(hand for packet offload::h]hand for packet offload:}(hj\hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK1hjhhubjM)}(hXip x s add proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport \ reqid 0x07 replay-window 32 \ aead 'rfc4106(gcm(aes))' 0x44434241343332312423222114131211f4f3f2f1 128 \ sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp \ offload packet dev eth4 dir in ip x p add src 14.0.0.70 dst 14.0.0.52 offload packet dev eth4 dir in tmpl src 14.0.0.70 dst 14.0.0.52 proto esp reqid 10000 mode transporth]hXip x s add proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport \ reqid 0x07 replay-window 32 \ aead 'rfc4106(gcm(aes))' 0x44434241343332312423222114131211f4f3f2f1 128 \ sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp \ offload packet dev eth4 dir in ip x p add src 14.0.0.70 dst 14.0.0.52 offload packet dev eth4 dir in tmpl src 14.0.0.70 dst 14.0.0.52 proto esp reqid 10000 mode transport}hjjsbah}(h]h ]h"]h$]h&]hhuh1jLhhhK3hjhhubh)}(hIYes, that's ugly, but that's what shell scripts and/or libreswan are for.h]hMYes, that’s ugly, but that’s what shell scripts and/or libreswan are for.}(hjxhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKnetdev->xfrmdev_ops = &ixgbe_xfrmdev_ops; adapter->netdev->features |= NETIF_F_HW_ESP; adapter->netdev->hw_enc_features |= NETIF_F_HW_ESP;h]hadapter->netdev->xfrmdev_ops = &ixgbe_xfrmdev_ops; adapter->netdev->features |= NETIF_F_HW_ESP; adapter->netdev->hw_enc_features |= NETIF_F_HW_ESP;}hjsbah}(h]h ]h"]h$]h&]hhuh1jLhhhKjhjhhubh)}(hWhen new SAs are set up with a request for "offload" feature, the driver's xdo_dev_state_add() will be given the new SA to be offloaded and an indication of whether it is for Rx or Tx. The driver shouldh]hWhen new SAs are set up with a request for “offload” feature, the driver’s xdo_dev_state_add() will be given the new SA to be offloaded and an indication of whether it is for Rx or Tx. The driver should}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKnhjhhubj?)}(hX- verify the algorithm is supported for offloads - store the SA information (key, salt, target-ip, protocol, etc) - enable the HW offload of the SA - return status value: =========== =================================== 0 success -EOPNETSUPP offload not supported, try SW IPsec, not applicable for packet offload mode other fail the request =========== =================================== h]jE)}(hhh](jJ)}(h.verify the algorithm is supported for offloadsh]h)}(hjh]h.verify the algorithm is supported for offloads}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKrhjubah}(h]h ]h"]h$]h&]uh1jIhjubjJ)}(h>store the SA information (key, salt, target-ip, protocol, etc)h]h)}(hjh]h>store the SA information (key, salt, target-ip, protocol, etc)}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKshjubah}(h]h ]h"]h$]h&]uh1jIhjubjJ)}(henable the HW offload of the SAh]h)}(hj5h]henable the HW offload of the SA}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKthj3ubah}(h]h ]h"]h$]h&]uh1jIhjubjJ)}(hX;return status value: =========== =================================== 0 success -EOPNETSUPP offload not supported, try SW IPsec, not applicable for packet offload mode other fail the request =========== =================================== h](h)}(hreturn status value:h]hreturn status value:}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKuhjJubj?)}(hX=========== =================================== 0 success -EOPNETSUPP offload not supported, try SW IPsec, not applicable for packet offload mode other fail the request =========== =================================== h]htable)}(hhh]htgroup)}(hhh](hcolspec)}(hhh]h}(h]h ]h"]h$]h&]colwidthK uh1jjhjgubjk)}(hhh]h}(h]h ]h"]h$]h&]colwidthK&uh1jjhjgubhtbody)}(hhh](hrow)}(hhh](hentry)}(hhh]h)}(h0h]h0}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKxhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hsuccessh]hsuccess}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKxhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(h -EOPNETSUPPh]h -EOPNETSUPP}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKyhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hKoffload not supported, try SW IPsec, not applicable for packet offload modeh]hKoffload not supported, try SW IPsec, not applicable for packet offload mode}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKyhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh](j)}(hhh]h)}(hotherh]hother}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK{hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hfail the requesth]hfail the request}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK{hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjgubeh}(h]h ]h"]h$]h&]colsKuh1jehjbubah}(h]h ]h"]h$]h&]uh1j`hj\ubah}(h]h ]h"]h$]h&]uh1j>hhhKwhjJubeh}(h]h ]h"]h$]h&]uh1jIhjubeh}(h]h ]h"]h$]h&]j-uh1jDhhhKrhjubah}(h]h ]h"]h$]h&]uh1j>hhhKrhjhhubh)}(hThe driver can also set an offload_handle in the SA, an opaque void pointer that can be used to convey context into the fast-path offload requests::h]hThe driver can also set an offload_handle in the SA, an opaque void pointer that can be used to convey context into the fast-path offload requests:}(hjZhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK~hjhhubjM)}(h!xs->xso.offload_handle = context;h]h!xs->xso.offload_handle = context;}hjhsbah}(h]h ]h"]h$]h&]hhuh1jLhhhKhjhhubh)}(hXWhen the network stack is preparing an IPsec packet for an SA that has been setup for offload, it first calls into xdo_dev_offload_ok() with the skb and the intended offload state to ask the driver if the offload will serviceable. This can check the packet information to be sure the offload can be supported (e.g. IPv4 or IPv6, no IPv4 options, etc) and return true or false to signify its support. In case driver doesn't implement this callback, the stack provides reasonable defaults.h]hXWhen the network stack is preparing an IPsec packet for an SA that has been setup for offload, it first calls into xdo_dev_offload_ok() with the skb and the intended offload state to ask the driver if the offload will serviceable. This can check the packet information to be sure the offload can be supported (e.g. IPv4 or IPv6, no IPv4 options, etc) and return true or false to signify its support. In case driver doesn’t implement this callback, the stack provides reasonable defaults.}(hjvhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hCrypto offload mode: When ready to send, the driver needs to inspect the Tx packet for the offload information, including the opaque context, and set up the packet send accordingly::h]hCrypto offload mode: When ready to send, the driver needs to inspect the Tx packet for the offload information, including the opaque context, and set up the packet send accordingly:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubjM)}(hPxs = xfrm_input_state(skb); context = xs->xso.offload_handle; set up HW for sendh]hPxs = xfrm_input_state(skb); context = xs->xso.offload_handle; set up HW for send}hjsbah}(h]h ]h"]h$]h&]hhuh1jLhhhKhjhhubh)}(hThe stack has already inserted the appropriate IPsec headers in the packet data, the offload just needs to do the encryption and fix up the header values.h]hThe stack has already inserted the appropriate IPsec headers in the packet data, the offload just needs to do the encryption and fix up the header values.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hX4When a packet is received and the HW has indicated that it offloaded a decryption, the driver needs to add a reference to the decoded SA into the packet's skb. At this point the data should be decrypted but the IPsec headers are still in the packet data; they are removed later up the stack in xfrm_input().h]hX6When a packet is received and the HW has indicated that it offloaded a decryption, the driver needs to add a reference to the decoded SA into the packet’s skb. At this point the data should be decrypted but the IPsec headers are still in the packet data; they are removed later up the stack in xfrm_input().}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubhenumerated_list)}(hhh](jJ)}(hFind and hold the SA that was used to the Rx skb:: /* get spi, protocol, and destination IP from packet headers */ xs = find xs from (spi, protocol, dest_IP) xfrm_state_hold(xs); h](h)}(h2Find and hold the SA that was used to the Rx skb::h]h1Find and hold the SA that was used to the Rx skb:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubjM)}(h/* get spi, protocol, and destination IP from packet headers */ xs = find xs from (spi, protocol, dest_IP) xfrm_state_hold(xs);h]h/* get spi, protocol, and destination IP from packet headers */ xs = find xs from (spi, protocol, dest_IP) xfrm_state_hold(xs);}hjsbah}(h]h ]h"]h$]h&]hhuh1jLhhhKhjubeh}(h]h ]h"]h$]h&]uh1jIhjhhhhhNubjJ)}(hStore the state information into the skb:: sp = secpath_set(skb); if (!sp) return; sp->xvec[sp->len++] = xs; sp->olen++; h](h)}(h*Store the state information into the skb::h]h)Store the state information into the skb:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubjM)}(hMsp = secpath_set(skb); if (!sp) return; sp->xvec[sp->len++] = xs; sp->olen++;h]hMsp = secpath_set(skb); if (!sp) return; sp->xvec[sp->len++] = xs; sp->olen++;}hjsbah}(h]h ]h"]h$]h&]hhuh1jLhhhKhjubeh}(h]h ]h"]h$]h&]uh1jIhjhhhhhNubjJ)}(hIndicate the success and/or error status of the offload:: xo = xfrm_offload(skb); xo->flags = CRYPTO_DONE; xo->status = crypto_status; h](h)}(h9Indicate the success and/or error status of the offload::h]h8Indicate the success and/or error status of the offload:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubjM)}(hLxo = xfrm_offload(skb); xo->flags = CRYPTO_DONE; xo->status = crypto_status;h]hLxo = xfrm_offload(skb); xo->flags = CRYPTO_DONE; xo->status = crypto_status;}hjsbah}(h]h ]h"]h$]h&]hhuh1jLhhhKhj ubeh}(h]h ]h"]h$]h&]uh1jIhjhhhhhNubjJ)}(h0Hand the packet to napi_gro_receive() as usual. h]h)}(h/Hand the packet to napi_gro_receive() as usual.h]h/Hand the packet to napi_gro_receive() as usual.}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj3ubah}(h]h ]h"]h$]h&]uh1jIhjhhhhhNubeh}(h]h ]h"]h$]h&]enumtypearabicprefixhsuffix.uh1jhjhhhhhKubh)}(hIn ESN mode, xdo_dev_state_advance_esn() is called from xfrm_replay_advance_esn() for RX, and xfrm_replay_overflow_offload_esn for TX. Driver will check packet seq number and update HW ESN state machine if needed.h]hIn ESN mode, xdo_dev_state_advance_esn() is called from xfrm_replay_advance_esn() for RX, and xfrm_replay_overflow_offload_esn for TX. Driver will check packet seq number and update HW ESN state machine if needed.}(hjVhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hPacket offload mode: HW adds and deletes XFRM headers. So in RX path, XFRM stack is bypassed if HW reported success. In TX path, the packet lefts kernel without extra header and not encrypted, the HW is responsible to perform it.h]hPacket offload mode: HW adds and deletes XFRM headers. So in RX path, XFRM stack is bypassed if HW reported success. In TX path, the packet lefts kernel without extra header and not encrypted, the HW is responsible to perform it.}(hjdhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hXWhen the SA is removed by the user, the driver's xdo_dev_state_delete() and xdo_dev_policy_delete() are asked to disable the offload. Later, xdo_dev_state_free() and xdo_dev_policy_free() are called from a garbage collection routine after all reference counts to the state and policy have been removed and any remaining resources can be cleared for the offload state. How these are used by the driver will depend on specific hardware needs.h]hXWhen the SA is removed by the user, the driver’s xdo_dev_state_delete() and xdo_dev_policy_delete() are asked to disable the offload. Later, xdo_dev_state_free() and xdo_dev_policy_free() are called from a garbage collection routine after all reference counts to the state and policy have been removed and any remaining resources can be cleared for the offload state. How these are used by the driver will depend on specific hardware needs.}(hjrhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hAs a netdev is set to DOWN the XFRM stack's netdev listener will call xdo_dev_state_delete(), xdo_dev_policy_delete(), xdo_dev_state_free() and xdo_dev_policy_free() on any remaining offloaded states.h]hAs a netdev is set to DOWN the XFRM stack’s netdev listener will call xdo_dev_state_delete(), xdo_dev_policy_delete(), xdo_dev_state_free() and xdo_dev_policy_free() on any remaining offloaded states.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hXQOutcome of HW handling packets, the XFRM core can't count hard, soft limits. The HW/driver are responsible to perform it and provide accurate data when xdo_dev_state_update_stats() is called. In case of one of these limits occuried, the driver needs to call to xfrm_state_check_expire() to make sure that XFRM performs rekeying sequence.h]hXSOutcome of HW handling packets, the XFRM core can’t count hard, soft limits. The HW/driver are responsible to perform it and provide accurate data when xdo_dev_state_update_stats() is called. In case of one of these limits occuried, the driver needs to call to xfrm_state_check_expire() to make sure that XFRM performs rekeying sequence.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubeh}(h]flowah ]h"]flowah$]h&]uh1hhhhhhhhKbubeh}(h](-xfrm-device-offloading-the-ipsec-computationsheh ]h"](/xfrm device - offloading the ipsec computations xfrm_deviceeh$]h&]uh1hhhhhhhhKexpect_referenced_by_name}jhsexpect_referenced_by_id}hhsubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksjfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerjerror_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourceh _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}refids}h]hasnameids}(jhjjjjjjjju nametypes}(jjjjjuh}(hhjhjjjjjju footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages]hsystem_message)}(hhh]h)}(hhh]h1Hyperlink target "xfrm-device" is not referenced.}hj=sbah}(h]h ]h"]h$]h&]uh1hhj:ubah}(h]h ]h"]h$]h&]levelKtypeINFOsourcehlineKuh1j8uba transformerN include_log] decorationNhhub.