€•°w      Œsphinx.addnodes”Œdocument”“”)”}”(Œ	rawsource”Œ ”Œchildren”]”(Œtranslations”ŒLanguagesNode”“”)”}”(hhh]”(h Œpending_xref”“”)”}”(hhh]”Œdocutils.nodes”ŒText”“”ŒChinese (Simplified)”…””}”Œparent”hsbaŒ
attributes”}”(Œids”]”Œclasses”]”Œnames”]”Œdupnames”]”Œbackrefs”]”Œ	refdomain”Œstd”Œreftype”Œdoc”Œ	reftarget”Œ*/translations/zh_CN/networking/xfrm_device”Œmodname”NŒ	classname”NŒrefexplicit”ˆuŒtagname”hhhubh)”}”(hhh]”hŒChinese (Traditional)”…””}”hh2sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ*/translations/zh_TW/networking/xfrm_device”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒItalian”…””}”hhFsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ*/translations/it_IT/networking/xfrm_device”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒJapanese”…””}”hhZsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ*/translations/ja_JP/networking/xfrm_device”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒKorean”…””}”hhnsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ*/translations/ko_KR/networking/xfrm_device”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒSpanish”…””}”hh‚sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ*/translations/sp_SP/networking/xfrm_device”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubeh}”(h]”h ]”h"]”h$]”h&]”Œcurrent_language”ŒEnglish”uh1h
hhŒ	_document”hŒsource”NŒline”NubhŒcomment”“”)”}”(hŒ SPDX-License-Identifier: GPL-2.0”h]”hŒ SPDX-License-Identifier: GPL-2.0”…””}”hh£sbah}”(h]”h ]”h"]”h$]”h&]”Œ	xml:space”Œpreserve”uh1h¡hhhžhhŸŒD/var/lib/git/docbuild/linux/Documentation/networking/xfrm_device.rst”h KubhŒtarget”“”)”}”(hŒ.. _xfrm_device:”h]”h}”(h]”h ]”h"]”h$]”h&]”Œrefid”Œxfrm-device”uh1h´h KhhhžhhŸh³ubhŒsection”“”)”}”(hhh]”(hŒtitle”“”)”}”(hŒ/XFRM device - offloading the IPsec computations”h]”hŒ/XFRM device - offloading the IPsec computations”…””}”(hhÉhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÇhhÄhžhhŸh³h KubhŒ	paragraph”“”)”}”(hŒNShannon Nelson <shannon.nelson@oracle.com>
Leon Romanovsky <leonro@nvidia.com>”h]”(hŒShannon Nelson <”…””}”(hhÙhžhhŸNh NubhŒ	reference”“”)”}”(hŒshannon.nelson@oracle.com”h]”hŒshannon.nelson@oracle.com”…””}”(hhãhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”Œ mailto:shannon.nelson@oracle.com”uh1háhhÙubhŒ>
Leon Romanovsky <”…””}”(hhÙhžhhŸNh Nubhâ)”}”(hŒleonro@nvidia.com”h]”hŒleonro@nvidia.com”…””}”(hh÷hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”Œmailto:leonro@nvidia.com”uh1háhhÙubhŒ>”…””}”(hhÙhžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h KhhÄhžhubhÃ)”}”(hhh]”(hÈ)”}”(hŒOverview”h]”hŒOverview”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÇhj  hžhhŸh³h KubhØ)”}”(hX±  IPsec is a useful feature for securing network traffic, but the
computational cost is high: a 10Gbps link can easily be brought down
to under 1Gbps, depending on the traffic and link configuration.
Luckily, there are NICs that offer a hardware based IPsec offload which
can radically increase throughput and decrease CPU utilization.  The XFRM
Device interface allows NIC drivers to offer to the stack access to the
hardware offload.”h]”hX±  IPsec is a useful feature for securing network traffic, but the
computational cost is high: a 10Gbps link can easily be brought down
to under 1Gbps, depending on the traffic and link configuration.
Luckily, there are NICs that offer a hardware based IPsec offload which
can radically increase throughput and decrease CPU utilization.  The XFRM
Device interface allows NIC drivers to offer to the stack access to the
hardware offload.”…””}”(hj"  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h Khj  hžhubhŒdefinition_list”“”)”}”(hhh]”hŒdefinition_list_item”“”)”}”(hXv  Right now, there are two types of hardware offload that kernel supports.
* IPsec crypto offload:
  * NIC performs encrypt/decrypt
  * Kernel does everything else
* IPsec packet offload:
  * NIC performs encrypt/decrypt
  * NIC does encapsulation
  * Kernel and NIC have SA and policy in-sync
  * NIC handles the SA and policies states
  * The Kernel talks to the keymanager
”h]”(hŒterm”“”)”}”(hŒHRight now, there are two types of hardware offload that kernel supports.”h]”hŒHRight now, there are two types of hardware offload that kernel supports.”…””}”(hj=  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j;  hŸh³h K hj7  ubhŒ
definition”“”)”}”(hhh]”hŒbullet_list”“”)”}”(hhh]”(hŒ	list_item”“”)”}”(hŒRIPsec crypto offload:
* NIC performs encrypt/decrypt
* Kernel does everything else”h]”hØ)”}”(hŒRIPsec crypto offload:
* NIC performs encrypt/decrypt
* Kernel does everything else”h]”hŒRIPsec crypto offload:
* NIC performs encrypt/decrypt
* Kernel does everything else”…””}”(hj[  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h KhjW  ubah}”(h]”h ]”h"]”h$]”h&]”uh1jU  hjR  ubjV  )”}”(hŒÈIPsec packet offload:
* NIC performs encrypt/decrypt
* NIC does encapsulation
* Kernel and NIC have SA and policy in-sync
* NIC handles the SA and policies states
* The Kernel talks to the keymanager
”h]”hØ)”}”(hŒÇIPsec packet offload:
* NIC performs encrypt/decrypt
* NIC does encapsulation
* Kernel and NIC have SA and policy in-sync
* NIC handles the SA and policies states
* The Kernel talks to the keymanager”h]”hŒÇIPsec packet offload:
* NIC performs encrypt/decrypt
* NIC does encapsulation
* Kernel and NIC have SA and policy in-sync
* NIC handles the SA and policies states
* The Kernel talks to the keymanager”…””}”(hjs  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h Khjo  ubah}”(h]”h ]”h"]”h$]”h&]”uh1jU  hjR  ubeh}”(h]”h ]”h"]”h$]”h&]”Œbullet”Œ*”uh1jP  hŸh³h KhjM  ubah}”(h]”h ]”h"]”h$]”h&]”uh1jK  hj7  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1j5  hŸh³h K hj2  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j0  hj  hžhhŸNh NubhØ)”}”(hŒîUserland access to the offload is typically through a system such as
libreswan or KAME/raccoon, but the iproute2 'ip xfrm' command set can
be handy when experimenting.  An example command might look something
like this for crypto offload:”h]”hŒòUserland access to the offload is typically through a system such as
libreswan or KAME/raccoon, but the iproute2 â€˜ip xfrmâ€™ command set can
be handy when experimenting.  An example command might look something
like this for crypto offload:”…””}”(hj¡  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K"hj  hžhubhŒblock_quote”“”)”}”(hX	  ip x s add proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport \
   reqid 0x07 replay-window 32 \
   aead 'rfc4106(gcm(aes))' 0x44434241343332312423222114131211f4f3f2f1 128 \
   sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp \
   offload dev eth4 dir in
”h]”j1  )”}”(hhh]”j6  )”}”(hŒýip x s add proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport \
reqid 0x07 replay-window 32 \
aead 'rfc4106(gcm(aes))' 0x44434241343332312423222114131211f4f3f2f1 128 \
sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp \
offload dev eth4 dir in
”h]”(j<  )”}”(hŒJip x s add proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport \”h]”hŒJip x s add proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport  ”…””}”(hj¼  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j;  hŸh³h K+hj¸  ubjL  )”}”(hhh]”hØ)”}”(hŒ±reqid 0x07 replay-window 32 \
aead 'rfc4106(gcm(aes))' 0x44434241343332312423222114131211f4f3f2f1 128 \
sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp \
offload dev eth4 dir in”h]”hŒµreqid 0x07 replay-window 32  
aead â€˜rfc4106(gcm(aes))â€™ 0x44434241343332312423222114131211f4f3f2f1 128  
sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp  
offload dev eth4 dir in”…””}”(hjÍ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K(hjÊ  ubah}”(h]”h ]”h"]”h$]”h&]”uh1jK  hj¸  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1j5  hŸh³h K+hjµ  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j0  hj±  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j¯  hŸh³h K'hj  hžhubhØ)”}”(hŒand for packet offload”h]”hŒand for packet offload”…””}”(hjó  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K-hj  hžhubj°  )”}”(hX  ip x s add proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport \
   reqid 0x07 replay-window 32 \
   aead 'rfc4106(gcm(aes))' 0x44434241343332312423222114131211f4f3f2f1 128 \
   sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp \
   offload packet dev eth4 dir in

ip x p add src 14.0.0.70 dst 14.0.0.52 offload packet dev eth4 dir in
tmpl src 14.0.0.70 dst 14.0.0.52 proto esp reqid 10000 mode transport
”h]”(j1  )”}”(hhh]”j6  )”}”(hX  ip x s add proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport \
reqid 0x07 replay-window 32 \
aead 'rfc4106(gcm(aes))' 0x44434241343332312423222114131211f4f3f2f1 128 \
sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp \
offload packet dev eth4 dir in
”h]”(j<  )”}”(hŒJip x s add proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport \”h]”hŒJip x s add proto esp dst 14.0.0.70 src 14.0.0.52 spi 0x07 mode transport  ”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j;  hŸh³h K3hj  ubjL  )”}”(hhh]”hØ)”}”(hŒ¸reqid 0x07 replay-window 32 \
aead 'rfc4106(gcm(aes))' 0x44434241343332312423222114131211f4f3f2f1 128 \
sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp \
offload packet dev eth4 dir in”h]”hŒ¼reqid 0x07 replay-window 32  
aead â€˜rfc4106(gcm(aes))â€™ 0x44434241343332312423222114131211f4f3f2f1 128  
sel src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp  
offload packet dev eth4 dir in”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K0hj  ubah}”(h]”h ]”h"]”h$]”h&]”uh1jK  hj  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1j5  hŸh³h K3hj  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j0  hj  ubhØ)”}”(hŒ‹ip x p add src 14.0.0.70 dst 14.0.0.52 offload packet dev eth4 dir in
tmpl src 14.0.0.70 dst 14.0.0.52 proto esp reqid 10000 mode transport”h]”hŒ‹ip x p add src 14.0.0.70 dst 14.0.0.52 offload packet dev eth4 dir in
tmpl src 14.0.0.70 dst 14.0.0.52 proto esp reqid 10000 mode transport”…””}”(hj=  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K5hj  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1j¯  hŸh³h K/hj  hžhubhØ)”}”(hŒIYes, that's ugly, but that's what shell scripts and/or libreswan are for.”h]”hŒMYes, thatâ€™s ugly, but thatâ€™s what shell scripts and/or libreswan are for.”…””}”(hjQ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K8hj  hžhubeh}”(h]”Œoverview”ah ]”h"]”Œoverview”ah$]”h&]”uh1hÂhhÄhžhhŸh³h KubhÃ)”}”(hhh]”(hÈ)”}”(hŒCallbacks to implement”h]”hŒCallbacks to implement”…””}”(hjj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÇhjg  hžhhŸh³h K=ubhŒliteral_block”“”)”}”(hXF  /* from include/linux/netdevice.h */
struct xfrmdev_ops {
      /* Crypto and Packet offload callbacks */
      int     (*xdo_dev_state_add) (struct xfrm_state *x, struct netlink_ext_ack *extack);
      void    (*xdo_dev_state_delete) (struct xfrm_state *x);
      void    (*xdo_dev_state_free) (struct xfrm_state *x);
      bool    (*xdo_dev_offload_ok) (struct sk_buff *skb,
                                     struct xfrm_state *x);
      void    (*xdo_dev_state_advance_esn) (struct xfrm_state *x);
      void    (*xdo_dev_state_update_stats) (struct xfrm_state *x);

      /* Solely packet offload callbacks */
      int     (*xdo_dev_policy_add) (struct xfrm_policy *x, struct netlink_ext_ack *extack);
      void    (*xdo_dev_policy_delete) (struct xfrm_policy *x);
      void    (*xdo_dev_policy_free) (struct xfrm_policy *x);
};”h]”hXF  /* from include/linux/netdevice.h */
struct xfrmdev_ops {
      /* Crypto and Packet offload callbacks */
      int     (*xdo_dev_state_add) (struct xfrm_state *x, struct netlink_ext_ack *extack);
      void    (*xdo_dev_state_delete) (struct xfrm_state *x);
      void    (*xdo_dev_state_free) (struct xfrm_state *x);
      bool    (*xdo_dev_offload_ok) (struct sk_buff *skb,
                                     struct xfrm_state *x);
      void    (*xdo_dev_state_advance_esn) (struct xfrm_state *x);
      void    (*xdo_dev_state_update_stats) (struct xfrm_state *x);

      /* Solely packet offload callbacks */
      int     (*xdo_dev_policy_add) (struct xfrm_policy *x, struct netlink_ext_ack *extack);
      void    (*xdo_dev_policy_delete) (struct xfrm_policy *x);
      void    (*xdo_dev_policy_free) (struct xfrm_policy *x);
};”…””}”hjz  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1jx  hŸh³h KAhjg  hžhubhØ)”}”(hX  The NIC driver offering ipsec offload will need to implement callbacks
relevant to supported offload to make the offload available to the network
stack's XFRM subsystem. Additionally, the feature bits NETIF_F_HW_ESP and
NETIF_F_HW_ESP_TX_CSUM will signal the availability of the offload.”h]”hX!  The NIC driver offering ipsec offload will need to implement callbacks
relevant to supported offload to make the offload available to the network
stackâ€™s XFRM subsystem. Additionally, the feature bits NETIF_F_HW_ESP and
NETIF_F_HW_ESP_TX_CSUM will signal the availability of the offload.”…””}”(hjˆ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h KRhjg  hžhubeh}”(h]”Œcallbacks-to-implement”ah ]”h"]”Œcallbacks to implement”ah$]”h&]”uh1hÂhhÄhžhhŸh³h K=ubhÃ)”}”(hhh]”(hÈ)”}”(hŒFlow”h]”hŒFlow”…””}”(hj¡  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÇhjž  hžhhŸh³h KZubhØ)”}”(hŒ×At probe time and before the call to register_netdev(), the driver should
set up local data structures and XFRM callbacks, and set the feature bits.
The XFRM code's listener will finish the setup on NETDEV_REGISTER.”h]”hŒÙAt probe time and before the call to register_netdev(), the driver should
set up local data structures and XFRM callbacks, and set the feature bits.
The XFRM codeâ€™s listener will finish the setup on NETDEV_REGISTER.”…””}”(hj¯  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K\hjž  hžhubjy  )”}”(hŒ“adapter->netdev->xfrmdev_ops = &ixgbe_xfrmdev_ops;
adapter->netdev->features |= NETIF_F_HW_ESP;
adapter->netdev->hw_enc_features |= NETIF_F_HW_ESP;”h]”hŒ“adapter->netdev->xfrmdev_ops = &ixgbe_xfrmdev_ops;
adapter->netdev->features |= NETIF_F_HW_ESP;
adapter->netdev->hw_enc_features |= NETIF_F_HW_ESP;”…””}”hj½  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1jx  hŸh³h Kbhjž  hžhubhØ)”}”(hŒËWhen new SAs are set up with a request for "offload" feature, the
driver's xdo_dev_state_add() will be given the new SA to be offloaded
and an indication of whether it is for Rx or Tx.  The driver should”h]”hŒÑWhen new SAs are set up with a request for â€œoffloadâ€ feature, the
driverâ€™s xdo_dev_state_add() will be given the new SA to be offloaded
and an indication of whether it is for Rx or Tx.  The driver should”…””}”(hjË  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h Kfhjž  hžhubj°  )”}”(hXÝ  - verify the algorithm is supported for offloads
- store the SA information (key, salt, target-ip, protocol, etc)
- enable the HW offload of the SA
- return status value:

        ===========   ===================================
        0             success
        -EOPNETSUPP   offload not supported, try SW IPsec,
                      not applicable for packet offload mode
        other         fail the request
        ===========   ===================================
”h]”jQ  )”}”(hhh]”(jV  )”}”(hŒ.verify the algorithm is supported for offloads”h]”hØ)”}”(hjâ  h]”hŒ.verify the algorithm is supported for offloads”…””}”(hjä  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h Kjhjà  ubah}”(h]”h ]”h"]”h$]”h&]”uh1jU  hjÝ  ubjV  )”}”(hŒ>store the SA information (key, salt, target-ip, protocol, etc)”h]”hØ)”}”(hjù  h]”hŒ>store the SA information (key, salt, target-ip, protocol, etc)”…””}”(hjû  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h Kkhj÷  ubah}”(h]”h ]”h"]”h$]”h&]”uh1jU  hjÝ  ubjV  )”}”(hŒenable the HW offload of the SA”h]”hØ)”}”(hj  h]”hŒenable the HW offload of the SA”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h Klhj  ubah}”(h]”h ]”h"]”h$]”h&]”uh1jU  hjÝ  ubjV  )”}”(hX;  return status value:

      ===========   ===================================
      0             success
      -EOPNETSUPP   offload not supported, try SW IPsec,
                    not applicable for packet offload mode
      other         fail the request
      ===========   ===================================
”h]”(hØ)”}”(hŒreturn status value:”h]”hŒreturn status value:”…””}”(hj)  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h Kmhj%  ubj°  )”}”(hX  ===========   ===================================
0             success
-EOPNETSUPP   offload not supported, try SW IPsec,
              not applicable for packet offload mode
other         fail the request
===========   ===================================
”h]”hŒtable”“”)”}”(hhh]”hŒtgroup”“”)”}”(hhh]”(hŒcolspec”“”)”}”(hhh]”h}”(h]”h ]”h"]”h$]”h&]”Œcolwidth”Kuh1jE  hjB  ubjF  )”}”(hhh]”h}”(h]”h ]”h"]”h$]”h&]”Œcolwidth”K&uh1jE  hjB  ubhŒtbody”“”)”}”(hhh]”(hŒrow”“”)”}”(hhh]”(hŒentry”“”)”}”(hhh]”hØ)”}”(hŒ0”h]”hŒ0”…””}”(hjj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h Kphjg  ubah}”(h]”h ]”h"]”h$]”h&]”uh1je  hjb  ubjf  )”}”(hhh]”hØ)”}”(hŒsuccess”h]”hŒsuccess”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h Kphj~  ubah}”(h]”h ]”h"]”h$]”h&]”uh1je  hjb  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1j`  hj]  ubja  )”}”(hhh]”(jf  )”}”(hhh]”hØ)”}”(hŒ-EOPNETSUPP”h]”hŒ-EOPNETSUPP”…””}”(hj¡  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h Kqhjž  ubah}”(h]”h ]”h"]”h$]”h&]”uh1je  hj›  ubjf  )”}”(hhh]”hØ)”}”(hŒKoffload not supported, try SW IPsec,
not applicable for packet offload mode”h]”hŒKoffload not supported, try SW IPsec,
not applicable for packet offload mode”…””}”(hj¸  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h Kqhjµ  ubah}”(h]”h ]”h"]”h$]”h&]”uh1je  hj›  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1j`  hj]  ubja  )”}”(hhh]”(jf  )”}”(hhh]”hØ)”}”(hŒother”h]”hŒother”…””}”(hjØ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h KshjÕ  ubah}”(h]”h ]”h"]”h$]”h&]”uh1je  hjÒ  ubjf  )”}”(hhh]”hØ)”}”(hŒfail the request”h]”hŒfail the request”…””}”(hjï  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h Kshjì  ubah}”(h]”h ]”h"]”h$]”h&]”uh1je  hjÒ  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1j`  hj]  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1j[  hjB  ubeh}”(h]”h ]”h"]”h$]”h&]”Œcols”Kuh1j@  hj=  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j;  hj7  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j¯  hŸh³h Kohj%  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1jU  hjÝ  ubeh}”(h]”h ]”h"]”h$]”h&]”j  Œ-”uh1jP  hŸh³h KjhjÙ  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j¯  hŸh³h Kjhjž  hžhubhØ)”}”(hŒ”The driver can also set an offload_handle in the SA, an opaque void pointer
that can be used to convey context into the fast-path offload requests::”h]”hŒ“The driver can also set an offload_handle in the SA, an opaque void pointer
that can be used to convey context into the fast-path offload requests:”…””}”(hj5  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h Kvhjž  hžhubjy  )”}”(hŒ!xs->xso.offload_handle = context;”h]”hŒ!xs->xso.offload_handle = context;”…””}”hjC  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1jx  hŸh³h Kyhjž  hžhubhØ)”}”(hXè  When the network stack is preparing an IPsec packet for an SA that has
been setup for offload, it first calls into xdo_dev_offload_ok() with
the skb and the intended offload state to ask the driver if the offload
will serviceable.  This can check the packet information to be sure the
offload can be supported (e.g. IPv4 or IPv6, no IPv4 options, etc) and
return true or false to signify its support. In case driver doesn't implement
this callback, the stack provides reasonable defaults.”h]”hXê  When the network stack is preparing an IPsec packet for an SA that has
been setup for offload, it first calls into xdo_dev_offload_ok() with
the skb and the intended offload state to ask the driver if the offload
will serviceable.  This can check the packet information to be sure the
offload can be supported (e.g. IPv4 or IPv6, no IPv4 options, etc) and
return true or false to signify its support. In case driver doesnâ€™t implement
this callback, the stack provides reasonable defaults.”…””}”(hjQ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K|hjž  hžhubhØ)”}”(hŒ¶Crypto offload mode:
When ready to send, the driver needs to inspect the Tx packet for the
offload information, including the opaque context, and set up the packet
send accordingly::”h]”hŒµCrypto offload mode:
When ready to send, the driver needs to inspect the Tx packet for the
offload information, including the opaque context, and set up the packet
send accordingly:”…””}”(hj_  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K„hjž  hžhubjy  )”}”(hŒPxs = xfrm_input_state(skb);
context = xs->xso.offload_handle;
set up HW for send”h]”hŒPxs = xfrm_input_state(skb);
context = xs->xso.offload_handle;
set up HW for send”…””}”hjm  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1jx  hŸh³h K‰hjž  hžhubhØ)”}”(hŒšThe stack has already inserted the appropriate IPsec headers in the
packet data, the offload just needs to do the encryption and fix up the
header values.”h]”hŒšThe stack has already inserted the appropriate IPsec headers in the
packet data, the offload just needs to do the encryption and fix up the
header values.”…””}”(hj{  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h Khjž  hžhubhØ)”}”(hX4  When a packet is received and the HW has indicated that it offloaded a
decryption, the driver needs to add a reference to the decoded SA into
the packet's skb.  At this point the data should be decrypted but the
IPsec headers are still in the packet data; they are removed later up
the stack in xfrm_input().”h]”hX6  When a packet is received and the HW has indicated that it offloaded a
decryption, the driver needs to add a reference to the decoded SA into
the packetâ€™s skb.  At this point the data should be decrypted but the
IPsec headers are still in the packet data; they are removed later up
the stack in xfrm_input().”…””}”(hj‰  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K’hjž  hžhubj°  )”}”(hX2  find and hold the SA that was used to the Rx skb::

        get spi, protocol, and destination IP from packet headers
        xs = find xs from (spi, protocol, dest_IP)
        xfrm_state_hold(xs);

store the state information into the skb::

        sp = secpath_set(skb);
        if (!sp) return;
        sp->xvec[sp->len++] = xs;
        sp->olen++;

indicate the success and/or error status of the offload::

        xo = xfrm_offload(skb);
        xo->flags = CRYPTO_DONE;
        xo->status = crypto_status;

hand the packet to napi_gro_receive() as usual
”h]”(hØ)”}”(hŒ2find and hold the SA that was used to the Rx skb::”h]”hŒ1find and hold the SA that was used to the Rx skb:”…””}”(hj›  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K˜hj—  ubjy  )”}”(hŒyget spi, protocol, and destination IP from packet headers
xs = find xs from (spi, protocol, dest_IP)
xfrm_state_hold(xs);”h]”hŒyget spi, protocol, and destination IP from packet headers
xs = find xs from (spi, protocol, dest_IP)
xfrm_state_hold(xs);”…””}”hj©  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1jx  hŸh³h Kšhj—  ubhØ)”}”(hŒ*store the state information into the skb::”h]”hŒ)store the state information into the skb:”…””}”(hj·  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h Kžhj—  ubjy  )”}”(hŒMsp = secpath_set(skb);
if (!sp) return;
sp->xvec[sp->len++] = xs;
sp->olen++;”h]”hŒMsp = secpath_set(skb);
if (!sp) return;
sp->xvec[sp->len++] = xs;
sp->olen++;”…””}”hjÅ  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1jx  hŸh³h K hj—  ubhØ)”}”(hŒ9indicate the success and/or error status of the offload::”h]”hŒ8indicate the success and/or error status of the offload:”…””}”(hjÓ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K¥hj—  ubjy  )”}”(hŒLxo = xfrm_offload(skb);
xo->flags = CRYPTO_DONE;
xo->status = crypto_status;”h]”hŒLxo = xfrm_offload(skb);
xo->flags = CRYPTO_DONE;
xo->status = crypto_status;”…””}”hjá  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1jx  hŸh³h K§hj—  ubhØ)”}”(hŒ.hand the packet to napi_gro_receive() as usual”h]”hŒ.hand the packet to napi_gro_receive() as usual”…””}”(hjï  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K«hj—  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1j¯  hŸh³h K˜hjž  hžhubhØ)”}”(hŒÕIn ESN mode, xdo_dev_state_advance_esn() is called from
xfrm_replay_advance_esn() for RX, and xfrm_replay_overflow_offload_esn for TX.
Driver will check packet seq number and update HW ESN state machine if needed.”h]”hŒÕIn ESN mode, xdo_dev_state_advance_esn() is called from
xfrm_replay_advance_esn() for RX, and xfrm_replay_overflow_offload_esn for TX.
Driver will check packet seq number and update HW ESN state machine if needed.”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K­hjž  hžhubhØ)”}”(hŒåPacket offload mode:
HW adds and deletes XFRM headers. So in RX path, XFRM stack is bypassed if HW
reported success. In TX path, the packet lefts kernel without extra header
and not encrypted, the HW is responsible to perform it.”h]”hŒåPacket offload mode:
HW adds and deletes XFRM headers. So in RX path, XFRM stack is bypassed if HW
reported success. In TX path, the packet lefts kernel without extra header
and not encrypted, the HW is responsible to perform it.”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K±hjž  hžhubhØ)”}”(hXº  When the SA is removed by the user, the driver's xdo_dev_state_delete()
and xdo_dev_policy_delete() are asked to disable the offload.  Later,
xdo_dev_state_free() and xdo_dev_policy_free() are called from a garbage
collection routine after all reference counts to the state and policy
have been removed and any remaining resources can be cleared for the
offload state.  How these are used by the driver will depend on specific
hardware needs.”h]”hX¼  When the SA is removed by the user, the driverâ€™s xdo_dev_state_delete()
and xdo_dev_policy_delete() are asked to disable the offload.  Later,
xdo_dev_state_free() and xdo_dev_policy_free() are called from a garbage
collection routine after all reference counts to the state and policy
have been removed and any remaining resources can be cleared for the
offload state.  How these are used by the driver will depend on specific
hardware needs.”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K¶hjž  hžhubhØ)”}”(hŒÈAs a netdev is set to DOWN the XFRM stack's netdev listener will call
xdo_dev_state_delete(), xdo_dev_policy_delete(), xdo_dev_state_free() and
xdo_dev_policy_free() on any remaining offloaded states.”h]”hŒÊAs a netdev is set to DOWN the XFRM stackâ€™s netdev listener will call
xdo_dev_state_delete(), xdo_dev_policy_delete(), xdo_dev_state_free() and
xdo_dev_policy_free() on any remaining offloaded states.”…””}”(hj-  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h K¾hjž  hžhubhØ)”}”(hXQ  Outcome of HW handling packets, the XFRM core can't count hard, soft limits.
The HW/driver are responsible to perform it and provide accurate data when
xdo_dev_state_update_stats() is called. In case of one of these limits
occuried, the driver needs to call to xfrm_state_check_expire() to make sure
that XFRM performs rekeying sequence.”h]”hXS  Outcome of HW handling packets, the XFRM core canâ€™t count hard, soft limits.
The HW/driver are responsible to perform it and provide accurate data when
xdo_dev_state_update_stats() is called. In case of one of these limits
occuried, the driver needs to call to xfrm_state_check_expire() to make sure
that XFRM performs rekeying sequence.”…””}”(hj;  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h×hŸh³h KÂhjž  hžhubeh}”(h]”Œflow”ah ]”h"]”Œflow”ah$]”h&]”uh1hÂhhÄhžhhŸh³h KZubeh}”(h]”(Œ-xfrm-device-offloading-the-ipsec-computations”hÁeh ]”h"]”(Œ/xfrm device - offloading the ipsec computations”Œxfrm_device”eh$]”h&]”uh1hÂhhhžhhŸh³h KŒexpect_referenced_by_name”}”jW  h¶sŒexpect_referenced_by_id”}”hÁh¶subeh}”(h]”h ]”h"]”h$]”h&]”Œsource”h³uh1hŒcurrent_source”NŒcurrent_line”NŒsettings”Œdocutils.frontend”ŒValues”“”)”}”(hÇNŒ	generator”NŒ	datestamp”NŒsource_link”NŒ
source_url”NŒtoc_backlinks”je  Œfootnote_backlinks”KŒsectnum_xform”KŒstrip_comments”NŒstrip_elements_with_classes”NŒstrip_classes”NŒreport_level”KŒ
halt_level”KŒexit_status_level”KŒdebug”NŒwarning_stream”NŒ	traceback”ˆŒinput_encoding”Œ	utf-8-sig”Œinput_encoding_error_handler”Œstrict”Œoutput_encoding”Œutf-8”Œoutput_encoding_error_handler”j€  Œerror_encoding”Œutf-8”Œerror_encoding_error_handler”Œbackslashreplace”Œlanguage_code”Œen”Œrecord_dependencies”NŒconfig”NŒ	id_prefix”hŒauto_id_prefix”Œid”Œdump_settings”NŒdump_internals”NŒdump_transforms”NŒdump_pseudo_xml”NŒexpose_internals”NŒstrict_visitor”NŒ_disable_config”NŒ_source”h³Œ_destination”NŒ_config_files”]”Œ7/var/lib/git/docbuild/linux/Documentation/docutils.conf”aŒfile_insertion_enabled”ˆŒraw_enabled”KŒline_length_limit”M'Œpep_references”NŒpep_base_url”Œhttps://peps.python.org/”Œpep_file_url_template”Œpep-%04d”Œrfc_references”NŒrfc_base_url”Œ&https://datatracker.ietf.org/doc/html/”Œ	tab_width”KŒtrim_footnote_reference_space”‰Œsyntax_highlight”Œlong”Œsmart_quotes”ˆŒsmartquotes_locales”]”Œcharacter_level_inline_markup”‰Œdoctitle_xform”‰Œdocinfo_xform”KŒsectsubtitle_xform”‰Œimage_loading”Œlink”Œembed_stylesheet”‰Œcloak_email_addresses”ˆŒsection_self_link”‰Œenv”NubŒreporter”NŒindirect_targets”]”Œsubstitution_defs”}”Œsubstitution_names”}”Œrefnames”}”Œrefids”}”hÁ]”h¶asŒnameids”}”(jW  hÁjV  jS  jd  ja  j›  j˜  jN  jK  uŒ	nametypes”}”(jW  ˆjV  ‰jd  ‰j›  ‰jN  ‰uh}”(hÁhÄjS  hÄja  j  j˜  jg  jK  jž  uŒfootnote_refs”}”Œcitation_refs”}”Œautofootnotes”]”Œautofootnote_refs”]”Œsymbol_footnotes”]”Œsymbol_footnote_refs”]”Œ	footnotes”]”Œ	citations”]”Œautofootnote_start”KŒsymbol_footnote_start”K Œ
id_counter”Œcollections”ŒCounter”“”}”…”R”Œparse_messages”]”Œtransform_messages”]”hŒsystem_message”“”)”}”(hhh]”hØ)”}”(hhh]”hŒ1Hyperlink target "xfrm-device" is not referenced.”…””}”hjê  sbah}”(h]”h ]”h"]”h$]”h&]”uh1h×hjç  ubah}”(h]”h ]”h"]”h$]”h&]”Œlevel”KŒtype”ŒINFO”Œsource”h³Œline”Kuh1jå  ubaŒtransformer”NŒinclude_log”]”Œ
decoration”Nhžhub.