Re: [PATCH RFC net-next 0/4] bonding: support LAG IPsec offload with replicated SAs

[Leon Romanovsky]

On Wed, May 20, 2026 at 05:10:00PM +0900, Jihong Min wrote:
> This RFC adds a bonding model for IPsec/XFRM hardware offload on
> 802.3ad and balance-xor LAG devices when the transmit hash policy is
> layer3+4. This is an intentional scope limit rather than a hard limit,
> as this is the configuration I can test with my gear.
> 
> The main idea is to leave the existing upstream single-lower-device XFRM
> offload path for active-backup intentionally untouched, while adding a
> replicated state model for LAG.
> 
> For LAG bonds, the bonding driver installs the same XFRM state on every
> eligible running slave and stores the per-slave hardware handles in
> bonding-private state. Lower drivers that support this model can then
> resolve the handle for the concrete lower netdev used by the datapath.
> 
> LAG IPsec features are user controlled. Newly eligible LAG bonds start
> with the ESP/XFRM features disabled, but advertise supported mutable
> features when all running eligible slaves can support them. Users can
> then opt in with ethtool. Feature enable is propagated to the lower
> devices and rolled back if a lower device cannot enable the requested
> features.
> 
> The series also handles LAG membership and eligibility changes by adding
> replicated SAs to newly usable slaves, removing the departing lower
> instance on down/remove, and flushing bond-owned XFRM offload state when
> the bond leaves the supported mode or hash-policy configuration.
> 
> This series does not convert any physical NIC driver. A lower driver
> must explicitly opt in to the replicated-upper-device model before it can
> use these bond-owned states in its datapath.
> 
> For example, a driver such as mlx5 would opt in by marking its
> xfrmdev_ops and by resolving datapath handles through the helper:
> 
>         static const struct xfrmdev_ops mlx5e_ipsec_xfrmdev_ops = {
>                 ...
>                 .xdo_dev_state_lower_handle = NULL,
>                 .flags = XFRMDEV_OPS_F_LOWER_HANDLE,
>         };
> 
>         handle = xfrm_dev_state_lower_handle(x, netdev);
>         if (!handle)
>                 goto drop;
> 
>         sa_entry = (struct mlx5e_ipsec_sa_entry *)handle;

I’m curious how you replicate and maintain the hardware state across these
devices. How are you handling the anti-replay window?

Thanks

> 
> Jihong Min (4):
>   xfrm: add a lower-device offload handle resolver
>   bonding: replicate XFRM offload state across LAG slaves
>   bonding: expose user-controlled IPsec features for LAG
>   bonding: handle replicated IPsec SAs across LAG changes
> 
>  drivers/net/bonding/bond_main.c    | 855 ++++++++++++++++++++++++++++-
>  drivers/net/bonding/bond_options.c |  59 +-
>  include/linux/netdevice.h          |  27 +
>  include/net/bonding.h              |  29 +-
>  include/net/xfrm.h                 |  48 +-
>  net/xfrm/xfrm_state.c              |   1 +
>  6 files changed, 1000 insertions(+), 19 deletions(-)
> 
> 
> base-commit: 27fa82620cbaa89a7fc11ac3057701d598813e87
> -- 
> 2.53.0
>