0e660a6f90
There are two parts in this patch: 1, support akcipher service by cryptodev-builtin driver 2, virtio-crypto driver supports akcipher service In principle, we should separate this into two patches, to avoid compiling error, merge them into one. Then virtio-crypto gets request from guest side, and forwards the request to builtin driver to handle it. Test with a guest linux: 1, The self-test framework of crypto layer works fine in guest kernel 2, Test with Linux guest(with asym support), the following script test(note that pkey_XXX is supported only in a newer version of keyutils): - both public key & private key - create/close session - encrypt/decrypt/sign/verify basic driver operation - also test with kernel crypto layer(pkey add/query) All the cases work fine. Run script in guest: rm -rf *.der *.pem *.pfx modprobe pkcs8_key_parser # if CONFIG_PKCS8_PRIVATE_KEY_PARSER=m rm -rf /tmp/data dd if=/dev/random of=/tmp/data count=1 bs=20 openssl req -nodes -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -subj "/C=CN/ST=BJ/L=HD/O=qemu/OU=dev/CN=qemu/emailAddress=qemu@qemu.org" openssl pkcs8 -in key.pem -topk8 -nocrypt -outform DER -out key.der openssl x509 -in cert.pem -inform PEM -outform DER -out cert.der PRIV_KEY_ID=`cat key.der | keyctl padd asymmetric test_priv_key @s` echo "priv key id = "$PRIV_KEY_ID PUB_KEY_ID=`cat cert.der | keyctl padd asymmetric test_pub_key @s` echo "pub key id = "$PUB_KEY_ID keyctl pkey_query $PRIV_KEY_ID 0 keyctl pkey_query $PUB_KEY_ID 0 echo "Enc with priv key..." keyctl pkey_encrypt $PRIV_KEY_ID 0 /tmp/data enc=pkcs1 >/tmp/enc.priv echo "Dec with pub key..." keyctl pkey_decrypt $PRIV_KEY_ID 0 /tmp/enc.priv enc=pkcs1 >/tmp/dec cmp /tmp/data /tmp/dec echo "Sign with priv key..." keyctl pkey_sign $PRIV_KEY_ID 0 /tmp/data enc=pkcs1 hash=sha1 > /tmp/sig echo "Verify with pub key..." keyctl pkey_verify $PRIV_KEY_ID 0 /tmp/data /tmp/sig enc=pkcs1 hash=sha1 echo "Enc with pub key..." keyctl pkey_encrypt $PUB_KEY_ID 0 /tmp/data enc=pkcs1 >/tmp/enc.pub echo "Dec with priv key..." keyctl pkey_decrypt $PRIV_KEY_ID 0 /tmp/enc.pub enc=pkcs1 >/tmp/dec cmp /tmp/data /tmp/dec echo "Verify with pub key..." keyctl pkey_verify $PUB_KEY_ID 0 /tmp/data /tmp/sig enc=pkcs1 hash=sha1 Reviewed-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: lei he <helei.sig11@bytedance.com Signed-off-by: zhenwei pi <pizhenwei@bytedance.com> Message-Id: <20220611064243.24535-2-pizhenwei@bytedance.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
102 lines
2.4 KiB
C
102 lines
2.4 KiB
C
/*
|
|
* Virtio crypto Support
|
|
*
|
|
* Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
|
|
*
|
|
* Authors:
|
|
* Gonglei <arei.gonglei@huawei.com>
|
|
*
|
|
* This work is licensed under the terms of the GNU GPL, version 2 or
|
|
* (at your option) any later version. See the COPYING file in the
|
|
* top-level directory.
|
|
*/
|
|
|
|
#ifndef QEMU_VIRTIO_CRYPTO_H
|
|
#define QEMU_VIRTIO_CRYPTO_H
|
|
|
|
#include "standard-headers/linux/virtio_crypto.h"
|
|
#include "hw/virtio/virtio.h"
|
|
#include "sysemu/iothread.h"
|
|
#include "sysemu/cryptodev.h"
|
|
#include "qom/object.h"
|
|
|
|
|
|
#define DEBUG_VIRTIO_CRYPTO 0
|
|
|
|
#define DPRINTF(fmt, ...) \
|
|
do { \
|
|
if (DEBUG_VIRTIO_CRYPTO) { \
|
|
fprintf(stderr, "virtio_crypto: " fmt, ##__VA_ARGS__); \
|
|
} \
|
|
} while (0)
|
|
|
|
|
|
#define TYPE_VIRTIO_CRYPTO "virtio-crypto-device"
|
|
OBJECT_DECLARE_SIMPLE_TYPE(VirtIOCrypto, VIRTIO_CRYPTO)
|
|
#define VIRTIO_CRYPTO_GET_PARENT_CLASS(obj) \
|
|
OBJECT_GET_PARENT_CLASS(obj, TYPE_VIRTIO_CRYPTO)
|
|
|
|
|
|
typedef struct VirtIOCryptoConf {
|
|
CryptoDevBackend *cryptodev;
|
|
|
|
/* Supported service mask */
|
|
uint32_t crypto_services;
|
|
|
|
/* Detailed algorithms mask */
|
|
uint32_t cipher_algo_l;
|
|
uint32_t cipher_algo_h;
|
|
uint32_t hash_algo;
|
|
uint32_t mac_algo_l;
|
|
uint32_t mac_algo_h;
|
|
uint32_t aead_algo;
|
|
uint32_t akcipher_algo;
|
|
|
|
/* Maximum length of cipher key */
|
|
uint32_t max_cipher_key_len;
|
|
/* Maximum length of authenticated key */
|
|
uint32_t max_auth_key_len;
|
|
/* Maximum size of each crypto request's content */
|
|
uint64_t max_size;
|
|
} VirtIOCryptoConf;
|
|
|
|
struct VirtIOCrypto;
|
|
|
|
typedef struct VirtIOCryptoReq {
|
|
VirtQueueElement elem;
|
|
/* flags of operation, such as type of algorithm */
|
|
uint32_t flags;
|
|
struct virtio_crypto_inhdr *in;
|
|
struct iovec *in_iov; /* Head address of dest iovec */
|
|
unsigned int in_num; /* Number of dest iovec */
|
|
size_t in_len;
|
|
VirtQueue *vq;
|
|
struct VirtIOCrypto *vcrypto;
|
|
CryptoDevBackendOpInfo op_info;
|
|
} VirtIOCryptoReq;
|
|
|
|
typedef struct VirtIOCryptoQueue {
|
|
VirtQueue *dataq;
|
|
QEMUBH *dataq_bh;
|
|
struct VirtIOCrypto *vcrypto;
|
|
} VirtIOCryptoQueue;
|
|
|
|
struct VirtIOCrypto {
|
|
VirtIODevice parent_obj;
|
|
|
|
VirtQueue *ctrl_vq;
|
|
VirtIOCryptoQueue *vqs;
|
|
VirtIOCryptoConf conf;
|
|
CryptoDevBackend *cryptodev;
|
|
|
|
uint32_t max_queues;
|
|
uint32_t status;
|
|
|
|
int multiqueue;
|
|
uint32_t curr_queues;
|
|
size_t config_size;
|
|
uint8_t vhost_started;
|
|
};
|
|
|
|
#endif /* QEMU_VIRTIO_CRYPTO_H */
|