mirror of
https://github.com/qemu/qemu.git
synced 2025-08-15 13:47:03 +00:00
24ad5e1995
When TLS 1.3 is negotiated on a TLS session, GNUTLS will perform automatic rekeying of the session after 16 million records. This is done for all algorithms except CHACHA20_POLY1305 which does not require rekeying. Unfortunately the rekeying breaks GNUTLS' promise that it is safe to use a gnutls_session_t object concurrently from multiple threads if they are exclusively calling gnutls_record_send/recv. This patch implements a workaround for QEMU that adds a mutex lock around any gnutls_record_send/recv call to serialize execution within GNUTLS code. When GNUTLS calls into the push/pull functions we can release the lock so the OS level I/O calls can at least have some parallelism. The big downside of this is that the actual encryption/decryption code is fully serialized, which will halve performance of that cipher operations if two threads are contending. The workaround is not enabled by default, since most use of GNUTLS in QEMU does not tickle the problem, only non-multifd migration with a return path open is affected. Fortunately the migration code also won't trigger the halving of performance, since only the outbound channel diretion needs to sustain high data rates, the inbound direction is low volume. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Link: https://lore.kernel.org/qemu-devel/20250718150514.2635338-2-berrange@redhat.com [add stub for qcrypto_tls_session_require_thread_safety; fix unused var] Signed-off-by: Fabiano Rosas <farosas@suse.de> |
||
|---|---|---|
| .. | ||
| aes-round.h | ||
| aes.h | ||
| afsplit.h | ||
| akcipher.h | ||
| block.h | ||
| cipher.h | ||
| clmul.h | ||
| desrfb.h | ||
| hash.h | ||
| hmac.h | ||
| init.h | ||
| ivgen.h | ||
| pbkdf.h | ||
| random.h | ||
| secret_common.h | ||
| secret_keyring.h | ||
| secret.h | ||
| sm4.h | ||
| tls-cipher-suites.h | ||
| tlscreds.h | ||
| tlscredsanon.h | ||
| tlscredspsk.h | ||
| tlscredsx509.h | ||
| tlssession.h | ||
| x509-utils.h | ||
| xts.h | ||