Re: [PATCH v15 3/9] tls: add TLS 1.3 hardware offload support

On Thu, Jul 23, 2026 at 1:47=E2=80=AFAM Paolo Abeni <[email protected]> wro=
te:
>
> On 7/9/26 10:53 PM, Rishikesh Jethwani wrote:
> > diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
> > index 8c588cdab733..c4c15c0e731a 100644
> > --- a/net/tls/tls_main.c
> > +++ b/net/tls/tls_main.c
> > @@ -714,49 +714,64 @@ static int do_tls_setsockopt_conf(struct sock *sk=
, sockptr_t optval,
> >       }
> >
> >       if (tx) {
> > -             rc =3D tls_set_device_offload(sk);
> > -             conf =3D TLS_HW;
> > -             if (!rc) {
> > -                     TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLSTXDEVICE=
);
> > -                     TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLSCURRTXDE=
VICE);
> > -             } else {
> > -                     rc =3D tls_set_sw_offload(sk, 1,
> > -                                             update ? crypto_info : NU=
LL);
> > -                     if (rc)
> > -                             goto err_crypto_info;
> > -
> > -                     if (update) {
> > -                             TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLS=
TXREKEYOK);
> > -                     } else {
> > -                             TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLS=
TXSW);
> > -                             TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLS=
CURRTXSW);
> > +             if (update && ctx->tx_conf =3D=3D TLS_HW) {
> > +                     rc =3D -EOPNOTSUPP;
> > +                     goto err_crypto_info;
> > +             }
> > +
> > +             if (!update) {
> > +                     rc =3D tls_set_device_offload(sk);
>
> This largish chunk changes the whole logic beyond offload update for
> _both_ TLS 1.2 and 1.3 with no obvious reasons and no explaination at
> all, nor in form of code comments nor in the commit message.
>
> Among other things,  tls_set_device_offload() is now called
> conditionally. Is that an optimization? Was the call really unneeded
> even before to this patch? At very least such change should be in a
> separate patch, which reasonable documentation/explaination.
>
> /P
>
These changes explicitly reject rekey attempts on an existing
HW-offloaded connection with -EOPNOTSUPP, since HW KeyUpdate is not
supported yet.
For the SW path, rekeying does not need to call
tls_set_device_offload{,_rx}(). I=E2=80=99ll create a separate prep patch f=
or
this.