RE: [PATCH RFC v5 1/4] virtio-net: Add IPsec operation, capabilities and resource objects

> From: Srujana Challa <[email protected]>
> Sent: Thursday, April 24, 2025 3:13 PM

> 
> This commit introduces the IPsec Operation to the Net device along with the
> capabilities and resource objects. This enables the offloading of IPsec
> processing, both before transmission and after reception, thereby providing
> inline offload capabilities.
> 
> Capbilities:
> 
> 1. IPsec Resource Capability (VIRTIO_CRYPTO_IPSEC_RESOURCE_CAP):
>    Indicates the device's IPsec resource limits, such as the number of
>    encryption and decryption Security Associations (SAs).
> 2. IPsec SA Capability (VIRTIO_CRYPTO_IPSEC_SA_CAP): Specifies the
>    supported IPsec modes, along with the supported cryptographic
>    algorithms, authentication algorithms, IPsec options and
>    anti-replay window size.
> 
> Resource objects:
> 1. VIRTIO_NET_RESOURCE_OBJ_IPSEC_OUTB_SA
> 2. VIRTIO_NET_RESOURCE_OBJ_IPSEC_INB_SA
> 
> These IPsec SA resource objects encompass parameters necessary for packet
> encryption and decryption. These include the SPI, tunnel headers, IPsec
> mode, IPsec options, and metadata specific to cipher and authentication.
> 
> This patch refers the Virtio-crypto IPsec service operation capabilities and
> resource objects data structures and crypto algorithm definitions to avoid
> duplication, however the admin command type vaule differs between Virtio-
> crypto and Virtio-net.
> 
> Signed-off-by: Srujana Challa <[email protected]>
> ---
>  device-types/net/description.tex | 52 ++++++++++++++++++++++++++++++++
>  1 file changed, 52 insertions(+)
> 
> diff --git a/device-types/net/description.tex b/device-
> types/net/description.tex
> index 0bb1cef..d918c55 100644
> --- a/device-types/net/description.tex
> +++ b/device-types/net/description.tex
> @@ -140,6 +140,11 @@ \subsection{Feature bits}\label{sec:Device Types /
> Network Device / Feature bits  \item[VIRTIO_NET_F_OUT_NET_HEADER(69)]
> Driver can provide the start of
>   \field{outer_nh_offset} value. Device gains advantage by not reading packet
>    to calculate outer network header offset.
> +
> +\item[VIRTIO_NET_F_IPSEC(70)] Device supports inline IPsec processing.
> + \field{struct virtio_net_hdr} size expands upto field \field{sturct
> +ipsec_resource_hdr}  when VIRTIO_NET_F_IPSEC is negotiated.
> +
>  \end{description}
> 
>  \subsubsection{Feature bit requirements}\label{sec:Device Types / Network
> Device / Feature bits / Feature bit requirements} @@ -462,6 +467,10 @@
> \subsection{Device and driver capabilities}\label{sec:Device Types / Network
> Dev  \hline
>  0x0802 & \hyperref[par:Device Types / Network Device / Device Operation /
> Flow filter / Device and driver capabilities / VIRTIO-NET-FF-ACTION-
> CAP]{VIRTIO_NET_FF_ACTION_CAP} & Flow filter action capability \\  \hline
> +0x0803 & \hyperref[par:Device Types / Crypto Device / Device Operation
> +/ IPsec Service Operation / Device and driver capabilities /
> +VIRTIO-CRYPTO-IPSEC-RESOURCE-CAP]{VIRTIO_NET_IPSEC_RESOURCE_CAP}
> &
> +IPsec resource capability \\ \hline
> +0x0804 & \hyperref[par:Device Types / Crypto Device / Device Operation
> +/ IPsec Service Operation / Device and driver capabilities /
> +VIRTIO-CRYPTO-IPSEC-SA-CAP]{VIRTIO_NET_IPSEC_SA_CAP} & IPsec Security
> +Association(SA) capability \\ \hline
>  \end{tabularx}
> 
>  \subsection{Device resource objects}\label{sec:Device Types / Network
> Device / Device resource objects} @@ -478,6 +487,10 @@ \subsection{Device
> resource objects}\label{sec:Device Types / Network Device / D  \hline
>  0x0202 & \hyperref[par:Device Types / Network Device / Device Operation /
> Flow filter / Resource objects / VIRTIO-NET-RESOURCE-OBJ-FF-
> RULE]{VIRTIO_NET_RESOURCE_OBJ_FF_RULE} & Flow filter rule object \\
> \hline
> +0x0203 & \hyperref[par:Device Types / Crypto Device / Device Operation
> +/ IPsec Service Operation / Resource objects /
> +VIRTIO-CRYPTO-RESOURCE-OBJ-IPSEC-OUTBOUND-
> SA]{VIRTIO_NET_RESOURCE_OBJ_I
> +PSEC_OUTB_SA} & IPsec outbound SA resource object \\ \hline
> +0x0204 & \hyperref[par:Device Types / Crypto Device / Device Operation
> +/ IPsec Service Operation / Resource objects /
> +VIRTIO-CRYPTO-RESOURCE-OBJ-IPSEC-INBOUND-
> SA]{VIRTIO_NET_RESOURCE_OBJ_IP
> +SEC_INB_SA} & IPsec inbound SA resource object \\ \hline
>  \end{tabularx}
> 
>  \subsection{Device parts}\label{sec:Device Types / Network Device / Device
> parts} @@ -3480,6 +3493,45 @@ \subsubsection{Flow filter}\label{sec:Device
> Types / Network Device / Device Ope  capability and the classifier object,
> unless the VIRTIO_NET_FF_MASK_F_PARTIAL_MASK  is enabled.
> 
> +\subsubsection{IPsec Operation}\label{sec:Device Types / Network Device
> +/ Device Operation / IPsec Operation}
> +
> +A network device can support the processing of IPsec operations when
> +VIRTIO_NET_F_IPSEC feature is negotiated. In addition to standard
> +packet processing, the IPsec protocol processing is also handled by the
> network device.
> +This occurs both pre-transmit and post-receive, providing inline IPsec
> capabilities.
> +
> +IPsec Inbound processing: In receive path the device performs
> +decryption, authentication, integrity checking and remove additional
> +headers, including tunnel header if in tunnel mode, as well as the
> +ESP/AH header from the packet (See \hyperref[intro:IPSEC]{[IPSEC]}). The
> resulting packet contains only the plain data.
> +
> +IPsec Outbound processing: In transmit path the device performs
> +encryption, attach ICV, update/add IP header and add ESP/AH
> +header/trailer to the packet and transmit.
> +
> +\paragraph{Device and driver capabilities} \label{par:Device Types /
> +Network Device / Device Operation / IPsec Operation / Device and driver
> +capabilities}
> +
> +The device and the driver indicate IPsec SA resource limits using the
> +capability \hyperref[par:Device Types / Crypto Device / Device
> +Operation / IPsec Service Operation / Device and driver capabilities /
> +VIRTIO-CRYPTO-IPSEC-RESOURCE-CAP]{VIRTIO_NET_IPSEC_RESOURCE_CAP}
> +The \hyperref[par:Device Types / Crypto Device / Device Operation /
> +IPsec Service Operation / Device and driver capabilities /
> +VIRTIO-CRYPTO-IPSEC-SA-CAP]{VIRTIO_NET_IPSEC_SA_CAP}
> +capability specifies which IPsec protocol capabilities the device
> +supports. The driver indicates the IPsec parameters by setting the IPsec SA
> capability prior to adding any resource objects.
> +
> +\paragraph{Resource objects}
> +\label{par:Device Types / Network Device / Device Operation / IPsec
> +Operation / Resource objects}
> +
> +The driver controls the IPsec SA resource object using administration
> +commands described in \ref{sec:Basic Facilities of a Virtio Device / Device
> groups / Group administration commands / Device resource objects}.
> +
> +The IPsec SA resource object contains necessary parameters for packet
> +encryption and decryption. These include the SPI, tunnel headers, IPsec
> +mode, IPsec options, and data specific to cipher and authentication.
> +
> +See \hyperref[par:Device Types / Crypto Device / Device Operation / IPsec
> Service Operation / Resource objects / VIRTIO-CRYPTO-RESOURCE-OBJ-IPSEC-
> OUTBOUND-SA]{VIRTIO_NET_RESOURCE_OBJ_IPSEC_OUTB_SA}.
> +
> +See \hyperref[par:Device Types / Crypto Device / Device Operation / IPsec
> Service Operation / Resource objects / VIRTIO-CRYPTO-RESOURCE-OBJ-IPSEC-
> INBOUND-SA]{VIRTIO_NET_RESOURCE_OBJ_IPSEC_INB_SA}.
> +
>  \subsubsection{Legacy Interface: Framing Requirements}\label{sec:Device
> Types / Network Device / Legacy Interface: Framing Requirements}
> 
> --
> 2.25.1

IIRC, the outer header length vnet field is added to speed up the ipsec.
So we should add the dependency or recommendation here to say, when device offers IPSEC feature, it SHOULD offer OUTER_HDR too.

For the rest,
Reviewed-by: Parav Pandit <[email protected]>