Documentation/networking/tls-offload.rst

110 After TX state is installed, the stack guarantees that the first segment
124 so the initial records' TCP sequence number may be anywhere inside the segment.
141 to be possible device has to keep small amount of segment-to-segment state.
144  * partial headers (if a segment carried only a part of the TLS header)
147    authentication tag has to be written or read from the subsequent segment)
187 corresponding to the segment. Networking stack makes sure decrypted
215 Whenever an out of order segment is transmitted the driver provides
218 segment has to be passed to the device as part of the packet context,
226 (next expected segment is the one after the out of order one), or continue
227 with the previous stream state - assuming that the out of order segment
235 Whenever an out of order segment is detected the driver requests
236 that the ``ktls`` software fallback code encrypt it. If the segment's
238 and doesn't change device state. If the segment is in the future, it
258 the new record will start on a segment boundary (like it does when
269    :alt:	reorder of non-header segment
272    Reorder of non-header segment
277 In above case segment 1 is received and decrypted successfully.
278 Segment 2 was dropped so 3 arrives out of order. The device knows
279 the next record starts inside 3, based on record length in segment 1.
280 Segment 3 is passed untouched, because due to lack of data from segment 2
281 the remainder of the previous record inside segment 3 cannot be handled.
283 and partial block from the new record in segment 3 and when 4 and 5
290 Kernel synchronization may be necessary if the lost segment contained
294    :alt:	reorder of header segment
297    Reorder of segment with a TLS header
299 In this example segment 2 gets dropped, and it contains a record header.
300 Device can only detect that segment 4 also contains a TLS header
301 if it knows the length of the previous record from segment 2. In this case
325 segment boundary.
379 For example authentication failure for any record in the segment should
416 Offload performance may depend on segment and record size.
516 Segment drops