Re: [PATCH net] xfrm: always flush state and policy upon NETDEV_DOWN/NETDEV_UNREGISTER events

[Leon Romanovsky <leon@kernel.org>]

On Thu, Jan 29, 2026 at 05:05:32PM +0100, Sabrina Dubroca wrote:
> 2026-01-29, 19:16:30 +0900, Tetsuo Handa wrote:
> > On 2026/01/29 18:09, Leon Romanovsky wrote:
> > > On Thu, Jan 29, 2026 at 05:06:08PM +0900, Tetsuo Handa wrote:
> > >> On 2026/01/28 21:35, Leon Romanovsky wrote:
> > >>> On Wed, Jan 28, 2026 at 07:44:02PM +0900, Tetsuo Handa wrote:
> > >>>> On 2026/01/28 19:24, Leon Romanovsky wrote:
> > >>>>> I think this can work, but IMHO the more robust approach is to ensure that all
> > >>>>> states and policies are removed when the NETIF_F_HW_ESP feature bit is cleared.
> > >>>>
> > >>>> The transaction will become complicated, for dev->features manipulation
> > >>>> function can fail.
> > >>>
> > >>> Line above returning NOTIFY_OK, check that NETIF_F_HW_ESP is cleared,
> > >>> and remove everything.
> > >>
> > >> That answer needs more clarification. I came to get confused about what we should do.
> > >>
> > >> Question 1:
> > >>
> > >>   Since NETIF_F_HW_ESP is a hardware dependent flag, not all "struct net_device"
> > >>   support NETIF_F_HW_ESP flag. Is this interpretation correct?
> > > 
> > > Yes, however any device (SW or HW) should set this flag if they want to
> > > provide IPsec offload.
> > 
> > OK. There are "IPsec with offload" and "IPsec without offload".
> > Both cases use code in net/xfrm/ directory.
> > 
> > Users (not the kernel source but Linux administrator) can choose
> > "IPsec without offload" by clearing the NETIF_F_HW_ESP bit via
> > "ethtool -K $dev esp-hw-offload off" command even if $dev supports
> > both "IPsec with offload" and "IPsec without offload".
> 
> We should avoid talking about "IPsec with/without offload" when this
> can mean multiple different things:
> 
>  - ip xfrm state add ... offload ...
>    (and the offload request actually succeeded)
>  - packet going through all the offload code and to the device
>  - device with NETIF_F_HW_ESP set in dev->features
>  - device with ->xdo_dev_state_add
> 
> (I'm probably forgetting a few more)

At least for me, "IPsec with offload" means all together:
device has ->xdo_dev_state_add + NETIF_F_HW_ESP bit + "ip xfrm state add ... offload
..."

I don't think that it is correct thing to adapt core code to something
specific to netdevsim which was introduced to emulate missing HW device.
Like in real HW device, the expectation is to have NETIF_F_HW_ESP bit,
we should have that bit in netdevsim too.

Thanks