CONFIG_TLS_DEVICE is optional for software offload. To verify that software offload is working, you can check the values of TlsCurrTxSw and TlsCurrRxSw in /proc/net/tls_stat. You also need to use a userspace program that enables SSL_OP_ENABLE_KTLS. Reproducible: Always
Also check the values of TlsTxSw, TlsRxSw in /proc/net/tls_stat