Security Linux Kernel Crypto Subsystem of Linux Kernel - Overview

 1// https://github.com/cryptodev-linux/cryptodev-linux/blob/master/ioctl.c
 2
 3static const struct file_operations cryptodev_fops = {
 4	.owner = THIS_MODULE,
 5	.open = cryptodev_open,
 6	.release = cryptodev_release,
 7	.unlocked_ioctl = cryptodev_ioctl,
 8#ifdef CONFIG_COMPAT
 9	.compat_ioctl = cryptodev_compat_ioctl,
10#endif /* CONFIG_COMPAT */
11	.poll = cryptodev_poll,
12};
13
14static struct miscdevice cryptodev = {
15	.minor = MISC_DYNAMIC_MINOR,
16	.name = "crypto",
17	.fops = &cryptodev_fops,
18	.mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH,
19};
20
21static int __init
22cryptodev_register(void)
23{
24	int rc;
25
26	rc = misc_register(&cryptodev);
27	if (unlikely(rc)) {
28		pr_err(PFX "registration of /dev/crypto failed\n");
29		return rc;
30	}
31
32	return 0;
33}

 1// https://github.com/cryptodev-linux/cryptodev-linux/blob/master/crypto/cryptodev.h
 2
 3struct crypt_auth_op {
 4	__u32	ses;		/* session identifier */
 5	__u16	op;		/* COP_ENCRYPT or COP_DECRYPT */
 6	__u16	flags;		/* see COP_FLAG_AEAD_* */
 7	__u32	len;		/* length of source data */
 8	__u32	auth_len;	/* length of auth data */
 9	__u8	__user *auth_src;	/* authenticated-only data */
10
11	/* The current implementation is more efficient if data are
12	 * encrypted in-place (src==dst). */
13	__u8	__user *src;	/* data to be encrypted and authenticated */
14	__u8	__user *dst;	/* pointer to output data. Must have
15	                         * space for tag. For TLS this should be at least 
16	                         * len + tag_size + block_size for padding */
17
18	__u8    __user *tag;    /* where the tag will be copied to. TLS mode
19                                 * doesn't use that as tag is copied to dst.
20                                 * SRTP mode copies tag there. */
21	__u32	tag_len;	/* the length of the tag. Use zero for digest size or max tag. */
22
23	/* initialization vector for encryption operations */
24	__u8	__user *iv;
25	__u32   iv_len;
26};

 1// setup data for your crypto request
 2cryp.ses = ctx->sess.ses;
 3cryp.iv = (void*)iv;
 4cryp.op = COP_DECRYPT;
 5cryp.auth_len = auth_size;
 6cryp.auth_src = (void*)auth;
 7cryp.len = size;
 8cryp.src = (void*)ciphertext;
 9cryp.dst = ciphertext;
10cryp.flags = COP_FLAG_AEAD_TLS_TYPE;
11
12// call ioctl to pass a crypto request to `/dev/crypto`
13if (ioctl(ctx->cfd, CIOCAUTHCRYPT, &cryp)) {
14  perror("ioctl(CIOCAUTHCRYPT)");
15  return -1;
16}

1struct crypto_tfm {
2	u32 crt_flags;
3	int node;
4	void (*exit)(struct crypto_tfm *tfm);
5	struct crypto_alg *__crt_alg; // crypto algorithm or transformation implementation
6	void *__crt_ctx[] CRYPTO_MINALIGN_ATTR;
7};

 1struct crypto_engine {
 2	char			name[ENGINE_NAME_LEN];
 3	bool			idling;
 4	bool			busy;
 5	bool			running;
 6
 7	bool			retry_support;
 8
 9	struct list_head	list;
10	spinlock_t		queue_lock;
11	struct crypto_queue	queue;
12	struct device		*dev;
13
14	bool			rt;
15
16	// implement these three functions to trigger your hardware crypto engine
17	int (*prepare_crypt_hardware)(struct crypto_engine *engine);
18	int (*unprepare_crypt_hardware)(struct crypto_engine *engine);
19	int (*do_batch_requests)(struct crypto_engine *engine);
20
21	struct kthread_worker           *kworker;
22	struct kthread_work             pump_requests;
23
24	void				*priv_data;
25	struct crypto_async_request	*cur_req;
26};

 1struct skcipher_alg {
 2	int (*setkey)(struct crypto_skcipher *tfm, const u8 *key,
 3	              unsigned int keylen);
 4	int (*encrypt)(struct skcipher_request *req);
 5	int (*decrypt)(struct skcipher_request *req);
 6	int (*init)(struct crypto_skcipher *tfm);
 7	void (*exit)(struct crypto_skcipher *tfm);
 8
 9	unsigned int min_keysize;
10	unsigned int max_keysize;
11	unsigned int ivsize;
12	unsigned int chunksize;
13	unsigned int walksize;
14
15	struct crypto_alg base;
16};
17
18static struct skcipher_alg crypto_algs[] = {
19{
20	.base.cra_name		= "ecb(aes)",
21	.base.cra_driver_name	= "stm32-ecb-aes",
22	.base.cra_priority	= 200,
23	.base.cra_flags		= CRYPTO_ALG_ASYNC,
24	.base.cra_blocksize	= AES_BLOCK_SIZE,
25	.base.cra_ctxsize	= sizeof(struct stm32_cryp_ctx),
26	.base.cra_alignmask	= 0xf,
27	.base.cra_module	= THIS_MODULE,
28
29	.init			= stm32_cryp_init_tfm,
30	.min_keysize		= AES_MIN_KEY_SIZE,
31	.max_keysize		= AES_MAX_KEY_SIZE,
32	.setkey			= stm32_cryp_aes_setkey,
33	.encrypt		= stm32_cryp_aes_ecb_encrypt,
34	.decrypt		= stm32_cryp_aes_ecb_decrypt,
35},
36}

1ret = crypto_register_skciphers(crypto_algs, ARRAY_SIZE(crypto_algs));
2if (ret) {
3	dev_err(dev, "Could not register algs\n");
4	goto err_algs;
5}