RE: [PATCH RFC v5 2/4] virtio-net: Add new flow filter selector and action for IPsec

> From: Srujana Challa <[email protected]>
> Sent: Thursday, April 24, 2025 3:14 PM
> 
> This update introduces a new flow filter selector to match the ESP header and
> adds a new flow filter action for IPsec processing.
> 
> Signed-off-by: Srujana Challa <[email protected]>
> ---
>  device-types/net/description.tex | 25 +++++++++++++++++++++----
>  1 file changed, 21 insertions(+), 4 deletions(-)
> 
> diff --git a/device-types/net/description.tex b/device-
> types/net/description.tex
> index d918c55..ea70c6f 100644
> --- a/device-types/net/description.tex
> +++ b/device-types/net/description.tex
> @@ -3097,7 +3097,9 @@ \subsubsection{Flow filter}\label{sec:Device Types /
> Network Device / Device Ope  \hline
>  0x5 & VIRTIO_NET_FF_MASK_TYPE_UDP & 8 bytes of UDP header described
> in \hyperref[intro:UDP]{UDP} \\  \hline
> -0x6 - 0xFF & & Reserved for future \\
> +0x6 & VIRTIO_NET_FF_MASK_TYPE_ESP & 8 bytes of ESP header \\ \hline
> +0x7 - 0xFF & & Reserved for future \\
>  \hline
>  \end{tabularx}
>  \end{table}
> @@ -3157,7 +3159,11 @@ \subsubsection{Flow filter}\label{sec:Device Types
> / Network Device / Device Ope  \hline
>  0x2 & VIRTIO_NET_FF_ACTION_DIRECT_RX_VQ & Matching packet will be
> directed to a receive queue \\  \hline
> -0x3 - 0xFF & & Reserved for future \\
> +0x3 & VIRTIO_NET_FF_ACTION_IPSEC & Matching packet will undergo IPsec
> +processing \\ \hline
> +0x4 & VIRTIO_NET_FF_ACTION_IPSEC_RECIRCULATE & Matching packet will
> +first undergo IPsec processing, followed by the flow filter rules again
> +\\ \hline
> +0x5 - 0xFF & & Reserved for future \\
>  \hline
>  \end{tabularx}
>  \end{table}
> @@ -3210,8 +3216,8 @@ \subsubsection{Flow filter}\label{sec:Device Types /
> Network Device / Device Ope
> 
>  The first selector is always VIRTIO_NET_FF_MASK_TYPE_ETH. When there are
> multiple  selectors, a second selector can be either
> VIRTIO_NET_FF_MASK_TYPE_IPV4 -or VIRTIO_NET_FF_MASK_TYPE_IPV6. If
> the third selector exists, the third -selector can be either
> VIRTIO_NET_FF_MASK_TYPE_UDP or VIRTIO_NET_FF_MASK_TYPE_TCP.
> +or VIRTIO_NET_FF_MASK_TYPE_IPV6. If the third selector exists, it can
> +be set to VIRTIO_NET_FF_MASK_TYPE_UDP,
> VIRTIO_NET_FF_MASK_TYPE_TCP and VIRTIO_NET_FF_MASK_TYPE_ESP.
>  For example, to match a Ethernet IPv6 UDP packet,  \field{selectors[0].type} is
> set to VIRTIO_NET_FF_MASK_TYPE_ETH, \field{selectors[1].type}  is set to
> VIRTIO_NET_FF_MASK_TYPE_IPV6 and \field{selectors[2].type} is @@ -3509,6
> +3515,17 @@ \subsubsection{IPsec Operation}\label{sec:Device Types /
> Network Device / Device  attach ICV, update/add IP header and add ESP/AH
> header/trailer to the packet  and transmit.
> 
> +\paragraph{Packet processing order}
> +\label{par:Device Types / Network Device / Device Operation / IPsec
> +Operation / Packet processing order}
> +
> +If an IPsec action rule, either VIRTIO_NET_FF_ACTION_IPSEC or
> +VIRTIO_NET_FF_ACTION_IPSEC_RECIRCULATE,
> +is matched during flow filter processing, IPsec processing is applied on the
> packet.
> +In the case of VIRTIO_NET_FF_ACTION_IPSEC_RECIRCULATE, the packet goes
> +through IPsec processing and is then recirculated only once to avoid the
> infinite loops in the device.
> +
> +See \ref{sec:Device Types / Network Device / Device Operation / Flow
> +filter} for details about flow filter.
> +
>  \paragraph{Device and driver capabilities}  \label{par:Device Types / Network
> Device / Device Operation / IPsec Operation / Device and driver capabilities}
> 
> --
> 2.25.1

If you happen to send v6 of this, it would be good to add, a one line description about re-circulate.
If not, we can add it right after this series merged.
Something like,

When a packet it recirculated, it undergoes flow filters processing again with the updated packet content.

Reviewed-by: Parav Pandit <[email protected]>