commit 6ad3f365de73345a5de4f6c6f7d520dd547f8695
author developer <developer@mediatek.com> Mon Oct 28 11:19:49 2024 +0800
committer developer <developer@mediatek.com> Wed Nov 13 14:39:46 2024 +0800
tree 5d68b41c95c8bb8de1a16d208f3e1cb00d0f43e0
parent 009e5ccc54a6b99ed635dd0222d4633cec02b0c9

[][openwrt][mt7988][crypto][Fix session disconnected when transfering IPSec tunnel]

[Description]
Fix session disconnected when transfering IPSec tunnel.
The root cause of this problem is memory consistency. When a Transform
Record is prepared, the data is only on CPU cache. DMA controller in
EIP197 may fetch incomplete data from main memory since the TR in CPU
cache didn't totally sync to main memory.
After this commit, when a Transform Record is built, we'll sync to main
memory immediately with PCL_Transform_Register().

[Release-log]
N/A


Change-Id: I7085d6fa76f60e75a883645e08af1298bdf62b98
Reviewed-on: https://gerrit.mediatek.inc/c/openwrt/feeds/mtk_openwrt_feeds/+/9808508

feed/kernel/crypto-eip/src/ddk-wrapper.c

diff --git a/feed/kernel/crypto-eip/src/ddk-wrapper.c b/feed/kernel/crypto-eip/src/ddk-wrapper.c
index a0559db..e704e77 100644
--- a/feed/kernel/crypto-eip/src/ddk-wrapper.c
+++ b/feed/kernel/crypto-eip/src/ddk-wrapper.c
@@ -1955,7 +1955,8 @@
 	SABuilder_Params_t params;
 	bool set_auth_success = false;
 	unsigned int SAWords = 0;
-	uint8_t *inner, *outer;
+	uint8_t *inner = NULL;
+	uint8_t *outer = NULL;
 
 	DMABuf_Status_t dma_status;
 	DMABuf_Properties_t dma_properties = {0, 0, 0, 0};
@@ -1963,6 +1964,8 @@
 
 	DMABuf_Handle_t sa_handle = {0};
 
+	PCL_Status_t pcl_status;
+
 	sa_status = SABuilder_Init_ESP(&params,
 				       &ipsec_params,
 				       be32_to_cpu(xs->id.spi),
@@ -1972,22 +1975,22 @@
 
 	if (sa_status != SAB_STATUS_OK) {
 		pr_err("SABuilder_Init_ESP failed\n");
-		sa_handle.p = NULL;
-		return (u32 *) sa_handle.p;
+		sa_host_addr.p = NULL;
+		goto error_ret;
 	}
 
 	/* No support for aead now */
 	if (xs->aead) {
 		CRYPTO_ERR("AEAD not supported\n");
-		sa_handle.p = NULL;
-		return (u32 *) sa_handle.p;
+		sa_host_addr.p = NULL;
+		goto error_ret;
 	}
 
 	/* Check algorithm exist in xfrm state*/
 	if (!xs->ealg || !xs->aalg) {
 		CRYPTO_ERR("NULL algorithm in xfrm state\n");
-		sa_handle.p = NULL;
-		return (u32 *) sa_handle.p;
+		sa_host_addr.p = NULL;
+		goto error_ret;
 	}
 
 	/* Add crypto key and parameters */
@@ -2000,8 +2003,8 @@
 	set_auth_success = set_auth_algo(xs->aalg, &params, inner, outer);
 	if (set_auth_success != true) {
 		CRYPTO_ERR("Set Auth Algo failed\n");
-		sa_handle.p = NULL;
-		return (u32 *) sa_handle.p;
+		sa_host_addr.p = NULL;
+		goto error_ret;
 	}
 
 	ipsec_params.IPsecFlags |= (SAB_IPSEC_PROCESS_IP_HEADERS
@@ -2014,8 +2017,8 @@
 	sa_status = SABuilder_GetSizes(&params, &SAWords, NULL, NULL);
 	if (sa_status != SAB_STATUS_OK) {
 		CRYPTO_ERR("SA not created because of size errors\n");
-		sa_handle.p = NULL;
-		return (u32 *) sa_handle.p;
+		sa_host_addr.p = NULL;
+		goto error_ret;
 	}
 
 	dma_properties.fCached = true;
@@ -2026,18 +2029,29 @@
 	dma_status = DMABuf_Alloc(dma_properties, &sa_host_addr, &sa_handle);
 	if (dma_status != DMABUF_STATUS_OK) {
 		CRYPTO_ERR("Allocation of SA failed\n");
-		/* goto error_exit; */
-		sa_handle.p = NULL;
-		return (u32 *) sa_handle.p;
+		sa_host_addr.p = NULL;
+		goto error_ret;
 	}
 
 	sa_status = SABuilder_BuildSA(&params, (u32 *) sa_host_addr.p, NULL, NULL);
 	if (sa_status != SAB_STATUS_OK) {
 		CRYPTO_ERR("SA not created because of errors\n");
-		sa_handle.p = NULL;
-		return (u32 *) sa_handle.p;
+		DMABuf_Release(sa_handle);
+		sa_host_addr.p = NULL;
+		goto error_ret;
+	}
+
+	pcl_status = PCL_Transform_Register(sa_handle);
+	if (pcl_status != PCL_STATUS_OK) {
+		CRYPTO_ERR("%s: PCL_Transform_Register failed\n", __func__);
+		DMABuf_Release(sa_handle);
+		sa_host_addr.p = NULL;
+		goto error_ret;
 	}
 
+	xfrm_params->p_handle = (u32 *) sa_handle.p;
+
+error_ret:
 	kfree(inner);
 	kfree(outer);
 	return (u32 *) sa_host_addr.p;
@@ -2358,7 +2372,7 @@
 
 bool
 mtk_ddk_invalidate_rec(
-		const DMABuf_Handle_t Rec_p,
+		void *sa_p,
 		const bool IsTransform)
 {
 	PEC_Status_t PEC_Rc;
@@ -2373,7 +2387,9 @@
 	void *OutTokenDscrExt_p = NULL;
 	IOToken_Input_Dscr_Ext_t InTokenDscrExt;
 	IOToken_Output_Dscr_Ext_t OutTokenDscrExt;
+	DMABuf_Handle_t Rec_p;
 
+	Rec_p.p = sa_p;
 	ZEROINIT(InTokenDscrExt);
 	InTokenDscrExt_p = &InTokenDscrExt;
 	OutTokenDscrExt_p = &OutTokenDscrExt;
@@ -2684,7 +2700,7 @@
 	}
 	return 0;
 unregister_exit:
-	mtk_ddk_invalidate_rec(sa, true);
+	mtk_ddk_invalidate_rec(sa.p, true);
 	PCL_Transform_UnRegister(sa);
 	return -1;
 }
@@ -2726,7 +2742,7 @@
 		return;
 
 	pcl_status = PCL_DTL_Transform_Remove(PCL_INTERFACE_ID, 0, sa);
-	ret = mtk_ddk_invalidate_rec(sa, true);
+	ret = mtk_ddk_invalidate_rec(sa.p, true);
 	pcl_status = PCL_Transform_UnRegister(sa);
 
 	return;