[PATCH RFC 2/4] virtio-net: Add new flow filter selector and action for IPsec

[Srujana Challa <schalla@marvell.com>]

This update introduces a new flow filter selector to match
the ESP header and adds a new flow filter action for IPsec
processing.

Signed-off-by: Srujana Challa <schalla@marvell.com>
---
 device-types/net/description.tex | 23 ++++++++++++++++++++---
 introduction.tex                 |  3 +++
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/device-types/net/description.tex b/device-types/net/description.tex
index 2a5f635..ace2538 100644
--- a/device-types/net/description.tex
+++ b/device-types/net/description.tex
@@ -2632,7 +2632,9 @@ \subsubsection{Flow filter}\label{sec:Device Types / Network Device / Device Ope
 \hline
 0x5 & VIRTIO_NET_FF_MASK_TYPE_UDP & 8 bytes of UDP header described in \hyperref[intro:UDP]{UDP} \\
 \hline
-0x6 - 0xFF & & Reserved for future \\
+0x6 & VIRTIO_NET_FF_MASK_TYPE_ESP & 8 bytes of ESP header described in \hyperref[intro:ESP]{ESP} \\
+\hline
+0x7 - 0xFF & & Reserved for future \\
 \hline
 \end{tabularx}
 \end{table}
@@ -2692,7 +2694,11 @@ \subsubsection{Flow filter}\label{sec:Device Types / Network Device / Device Ope
 \hline
 0x2 & VIRTIO_NET_FF_ACTION_DIRECT_RX_VQ & Matching packet will be directed to a receive queue \\
 \hline
-0x3 - 0xFF & & Reserved for future \\
+0x3 & VIRTIO_NET_FF_ACTION_SECURITY & Matching packet will undergo IPsec processing \\
+\hline
+0x4 & VIRTIO_NET_FF_ACTION_SECURITY_RECIRCULATE & Matching packet will first undergo IPsec processing, followed by the flow filter rules again \\
+\hline
+0x5 - 0xFF & & Reserved for future \\
 \hline
 \end{tabularx}
 \end{table}
@@ -2746,7 +2752,8 @@ \subsubsection{Flow filter}\label{sec:Device Types / Network Device / Device Ope
 The first selector is always VIRTIO_NET_FF_MASK_TYPE_ETH. When there are multiple
 selectors, a second selector can be either VIRTIO_NET_FF_MASK_TYPE_IPV4
 or VIRTIO_NET_FF_MASK_TYPE_IPV6. If the third selector exists, the third
-selector can be either VIRTIO_NET_FF_MASK_TYPE_UDP or VIRTIO_NET_FF_MASK_TYPE_TCP.
+selector can be one of VIRTIO_NET_FF_MASK_TYPE_UDP, VIRTIO_NET_FF_MASK_TYPE_TCP
+and VIRTIO_NET_FF_MASK_TYPE_ESP.
 For example, to match a Ethernet IPv6 UDP packet,
 \field{selectors[0].type} is set to VIRTIO_NET_FF_MASK_TYPE_ETH, \field{selectors[1].type}
 is set to VIRTIO_NET_FF_MASK_TYPE_IPV6 and \field{selectors[2].type} is
@@ -3044,6 +3051,16 @@ \subsubsection{IPsec Operation}\label{sec:Device Types / Network Device / Device
 attach ICV, update/add IP headers and add ESP/AH headers/trailers to the packet
 and transmit.
 
+\paragraph{Packet processing order}
+\label{par:Device Types / Network Device / Device Operation / IPsec Operation / Packet processing order}
+
+When the flow filter is enabled, the flow filter rules are applied
+before IPsec processing and the packet will undergo IPsec processing
+only when it matches with one of the flow filter rules and the rule
+specifies the action VIRTIO_NET_FF_ACTION_SECURITY.
+See \ref{sec:Device Types / Network Device / Device Operation / Flow filter}
+for details about flow filter.
+
 \paragraph{Device and driver capabilities}
 \label{par:Device Types / Network Device / Device Operation / IPsec Operation / Device and driver capabilities}
 
diff --git a/introduction.tex b/introduction.tex
index e60298a..a7db418 100644
--- a/introduction.tex
+++ b/introduction.tex
@@ -162,6 +162,9 @@ \section{Normative References}\label{sec:Normative References}
 	\phantomsection\label{intro:TCP-Header-Format}\textbf{[TCP Header Format]} &
     TCP Header Format
 	\newline\url{https://www.rfc-editor.org/rfc/rfc9293#name-header-format}\\
+	\phantomsection\label{intro:ESP}\textbf{[ESP]} &
+    IPsec Protocol
+	\newline\url{https://www.rfc-editor.org/rfc/rfc4303}\\
 	\phantomsection\label{intro:CAN}\textbf{[CAN]} &
     ISO 11898-1:2015 Road vehicles -- Controller area network (CAN) -- Part 1: Data link layer and physical signalling\\
 	\phantomsection\label{intro:rfc8174}\textbf{[RFC8174]} &
-- 
2.25.1