him411/nss-packages-breeze303
1
0
Fork 0
mirror of https://github.com/breeze303/nss-packages.git synced 2025-12-15 16:22:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

nss-cfi: Fix crash on IPQ807x when utilizing NSS cores for crypto tasks

Browse Source 
This commit addresses a crash that occurs when running crypto tasks on
IPQ807x devices explicitly utilizing the NSS cores. The crash was
reproducible in scenarios involving cryptographic operations offloaded
to the NSS cores (e.g., using cryptodev with OpenSSL or running the
crypto test module).

IMPORTANT: This fix should not be misunderstood as a general-purpose
performance boost for all cryptographic workloads. If your goal is to
accelerate AES encryption across the board (e.g., using OpenSSL for
routine file encryption), this approach is **not** practical.

The primary benefit of leveraging the NSS cores for cryptographic operations
is within VPN-oriented use cases, such as OpenVPN or IPsec, where the
offloading to NSS cores can reduce CPU load and improve throughput.

It’s critical to note that this fix will **not** accelerate encryption
for protocols like Wireguard. Wireguard’s design uses ChaCha20-Poly1305
rather than AES, and it cannot easily be offloaded to hardware.

Additionally, Wireguard uses short-lived cryptographic keys that rotate
frequently. This frequent key rotation makes it difficult to interface
with hardware offloading mechanisms, which are typically optimized for
long-lived sessions like those found in IPsec.

Signed-off-by: Sebastian Gottschall <s.gottschall@dd-wrt.com>
Signed-off-by: Sean Khan <datapronix@protonmail.com>
This commit is contained in:
Sean Khan 2024-09-21 16:32:23 -04:00
parent 46cd9e7707
commit 24ae066757
2 changed files with 73 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
qca-nss-cfi/Makefile
View File

@ -1,7 +1,7 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=qca-nss-cfi
PKG_RELEASE:=2
PKG_RELEASE:=3
PKG_SOURCE_URL:=https://git.codelinaro.org/clo/qsdk/oss/lklm/nss-cfi.git
PKG_SOURCE_PROTO:=git

72
qca-nss-cfi/patches/0007-cryptoapi-v2.0-fix-crash.patch Normal file
View File

@ -0,0 +1,72 @@
--- a/cryptoapi/v2.0/nss_cryptoapi_aead.c
+++ b/cryptoapi/v2.0/nss_cryptoapi_aead.c
@@ -97,9 +97,9 @@ int nss_cryptoapi_aead_init(struct crypt
bool need_fallback;
BUG_ON(!ctx);
- NSS_CRYPTOAPI_SET_MAGIC(ctx);
memset(ctx, 0, sizeof(struct nss_cryptoapi_ctx));
+ NSS_CRYPTOAPI_SET_MAGIC(ctx);
ctx->user = g_cryptoapi.user;
ctx->stats.init++;
--- a/cryptoapi/v2.0/nss_cryptoapi_ahash.c
+++ b/cryptoapi/v2.0/nss_cryptoapi_ahash.c
@@ -231,8 +231,10 @@ int nss_cryptoapi_ahash_setkey(struct cr
void nss_cryptoapi_ahash_done(void *app_data, struct nss_crypto_hdr *ch, uint8_t status)
{
struct ahash_request *req = app_data;
- struct nss_cryptoapi_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
+ struct crypto_ahash *ahash = crypto_ahash_reqtfm(req);
+ struct nss_cryptoapi_ctx *ctx = crypto_ahash_ctx(ahash);
struct nss_cryptoapi_req_ctx *rctx = ahash_request_ctx(req);
+
uint8_t *hw_hmac;
int error;
@@ -268,7 +270,7 @@ void nss_cryptoapi_ahash_done(void *app_
* Decrement cryptoapi reference
*/
nss_cryptoapi_ref_dec(ctx);
- req->base.complete(&req->base, error);
+ ahash_request_complete(req, error);
}
/*
--- a/cryptoapi/v2.0/nss_cryptoapi_skcipher.c
+++ b/cryptoapi/v2.0/nss_cryptoapi_skcipher.c
@@ -92,9 +92,9 @@ int nss_cryptoapi_skcipher_init(struct c
struct nss_cryptoapi_ctx *ctx = crypto_skcipher_ctx(tfm);
BUG_ON(!ctx);
- NSS_CRYPTOAPI_SET_MAGIC(ctx);
memset(ctx, 0, sizeof(struct nss_cryptoapi_ctx));
+ NSS_CRYPTOAPI_SET_MAGIC(ctx);
ctx->user = g_cryptoapi.user;
ctx->stats.init++;
@@ -220,11 +220,11 @@ int nss_cryptoapi_skcipher_setkey(struct
void nss_cryptoapi_skcipher_done(void *app_data, struct nss_crypto_hdr *ch, uint8_t status)
{
struct skcipher_request *req = app_data;
- struct nss_cryptoapi_ctx *ctx = skcipher_request_ctx(req);
+ struct crypto_skcipher *cipher = crypto_skcipher_reqtfm(req);
+ struct nss_cryptoapi_ctx *ctx = crypto_skcipher_ctx(cipher);
int error;
BUG_ON(!ch);
-
/*
* Check cryptoapi context magic number.
*/
@@ -256,7 +256,7 @@ void nss_cryptoapi_skcipher_done(void *a
* Decrement cryptoapi reference
*/
nss_cryptoapi_ref_dec(ctx);
- req->base.complete(&req->base, error);
+ skcipher_request_complete(req, error);
}
/*