1. Patchew
  2. linux
  3. View series

[PATCH] tee: Use SHA-1 library instead of crypto_shash

Eric Biggers posted 1 patch 2 months ago 
drivers/tee/Kconfig    |  3 +--
drivers/tee/tee_core.c | 55 +++++++-----------------------------------
2 files changed, 10 insertions(+), 48 deletions(-)
[PATCH] tee: Use SHA-1 library instead of crypto_shash
Posted by Eric Biggers 2 months ago 
Use the SHA-1 library functions instead of crypto_shash.  This is
simpler and faster.

Change uuid_v5() to return void, since it can no longer fail.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---

Note: this patch depends on the SHA-1 library functions that were merged
in v6.17-rc1.

 drivers/tee/Kconfig    |  3 +--
 drivers/tee/tee_core.c | 55 +++++++-----------------------------------
 2 files changed, 10 insertions(+), 48 deletions(-)

diff --git a/drivers/tee/Kconfig b/drivers/tee/Kconfig
index 61b507c187801..a84767940fbfc 100644
--- a/drivers/tee/Kconfig
+++ b/drivers/tee/Kconfig
@@ -1,12 +1,11 @@
 # SPDX-License-Identifier: GPL-2.0-only
 # Generic Trusted Execution Environment Configuration
 menuconfig TEE
 	tristate "Trusted Execution Environment support"
 	depends on HAVE_ARM_SMCCC || COMPILE_TEST || CPU_SUP_AMD
-	select CRYPTO
-	select CRYPTO_SHA1
+	select CRYPTO_LIB_SHA1
 	select DMA_SHARED_BUFFER
 	select GENERIC_ALLOCATOR
 	help
 	  This implements a generic interface towards a Trusted Execution
 	  Environment (TEE).
diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
index acc7998758ad8..d079aeee0690a 100644
--- a/drivers/tee/tee_core.c
+++ b/drivers/tee/tee_core.c
@@ -12,11 +12,10 @@
 #include <linux/module.h>
 #include <linux/overflow.h>
 #include <linux/slab.h>
 #include <linux/tee_core.h>
 #include <linux/uaccess.h>
-#include <crypto/hash.h>
 #include <crypto/sha1.h>
 #include "tee_private.h"
 
 #define TEE_NUM_DEVICES	32
 
@@ -140,72 +139,36 @@ static int tee_release(struct inode *inode, struct file *filp)
  * UUIDv5 is specific in RFC 4122.
  *
  * This implements section (for SHA-1):
  * 4.3.  Algorithm for Creating a Name-Based UUID
  */
-static int uuid_v5(uuid_t *uuid, const uuid_t *ns, const void *name,
-		   size_t size)
+static void uuid_v5(uuid_t *uuid, const uuid_t *ns, const void *name,
+		    size_t size)
 {
 	unsigned char hash[SHA1_DIGEST_SIZE];
-	struct crypto_shash *shash = NULL;
-	struct shash_desc *desc = NULL;
-	int rc;
-
-	shash = crypto_alloc_shash("sha1", 0, 0);
-	if (IS_ERR(shash)) {
-		rc = PTR_ERR(shash);
-		pr_err("shash(sha1) allocation failed\n");
-		return rc;
-	}
-
-	desc = kzalloc(sizeof(*desc) + crypto_shash_descsize(shash),
-		       GFP_KERNEL);
-	if (!desc) {
-		rc = -ENOMEM;
-		goto out_free_shash;
-	}
-
-	desc->tfm = shash;
+	struct sha1_ctx ctx;
 
-	rc = crypto_shash_init(desc);
-	if (rc < 0)
-		goto out_free_desc;
-
-	rc = crypto_shash_update(desc, (const u8 *)ns, sizeof(*ns));
-	if (rc < 0)
-		goto out_free_desc;
-
-	rc = crypto_shash_update(desc, (const u8 *)name, size);
-	if (rc < 0)
-		goto out_free_desc;
-
-	rc = crypto_shash_final(desc, hash);
-	if (rc < 0)
-		goto out_free_desc;
+	sha1_init(&ctx);
+	sha1_update(&ctx, (const u8 *)ns, sizeof(*ns));
+	sha1_update(&ctx, (const u8 *)name, size);
+	sha1_final(&ctx, hash);
 
 	memcpy(uuid->b, hash, UUID_SIZE);
 
 	/* Tag for version 5 */
 	uuid->b[6] = (hash[6] & 0x0F) | 0x50;
 	uuid->b[8] = (hash[8] & 0x3F) | 0x80;
-
-out_free_desc:
-	kfree(desc);
-
-out_free_shash:
-	crypto_free_shash(shash);
-	return rc;
 }
 
 int tee_session_calc_client_uuid(uuid_t *uuid, u32 connection_method,
 				 const u8 connection_data[TEE_IOCTL_UUID_LEN])
 {
 	gid_t ns_grp = (gid_t)-1;
 	kgid_t grp = INVALID_GID;
 	char *name = NULL;
 	int name_len;
-	int rc;
+	int rc = 0;
 
 	if (connection_method == TEE_IOCTL_LOGIN_PUBLIC ||
 	    connection_method == TEE_IOCTL_LOGIN_REE_KERNEL) {
 		/* Nil UUID to be passed to TEE environment */
 		uuid_copy(uuid, &uuid_null);
@@ -258,11 +221,11 @@ int tee_session_calc_client_uuid(uuid_t *uuid, u32 connection_method,
 	default:
 		rc = -EINVAL;
 		goto out_free_name;
 	}
 
-	rc = uuid_v5(uuid, &tee_client_uuid_ns, name, name_len);
+	uuid_v5(uuid, &tee_client_uuid_ns, name, name_len);
 out_free_name:
 	kfree(name);
 
 	return rc;
 }

base-commit: 0905809b38bda1fa0b206986c44d846e46f13c1d
-- 
2.50.1
Re: [PATCH] tee: Use SHA-1 library instead of crypto_shash
Posted by Sumit Garg 1 month, 3 weeks ago 
On Fri, Aug 01, 2025 at 04:55:41PM -0700, Eric Biggers wrote:
> Use the SHA-1 library functions instead of crypto_shash.  This is
> simpler and faster.
> 
> Change uuid_v5() to return void, since it can no longer fail.
> 
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> ---
> 
> Note: this patch depends on the SHA-1 library functions that were merged
> in v6.17-rc1.
> 
>  drivers/tee/Kconfig    |  3 +--
>  drivers/tee/tee_core.c | 55 +++++++-----------------------------------
>  2 files changed, 10 insertions(+), 48 deletions(-)

Nice cleanup, FWIW:

Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

-Sumit

> 
> diff --git a/drivers/tee/Kconfig b/drivers/tee/Kconfig
> index 61b507c187801..a84767940fbfc 100644
> --- a/drivers/tee/Kconfig
> +++ b/drivers/tee/Kconfig
> @@ -1,12 +1,11 @@
>  # SPDX-License-Identifier: GPL-2.0-only
>  # Generic Trusted Execution Environment Configuration
>  menuconfig TEE
>  	tristate "Trusted Execution Environment support"
>  	depends on HAVE_ARM_SMCCC || COMPILE_TEST || CPU_SUP_AMD
> -	select CRYPTO
> -	select CRYPTO_SHA1
> +	select CRYPTO_LIB_SHA1
>  	select DMA_SHARED_BUFFER
>  	select GENERIC_ALLOCATOR
>  	help
>  	  This implements a generic interface towards a Trusted Execution
>  	  Environment (TEE).
> diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
> index acc7998758ad8..d079aeee0690a 100644
> --- a/drivers/tee/tee_core.c
> +++ b/drivers/tee/tee_core.c
> @@ -12,11 +12,10 @@
>  #include <linux/module.h>
>  #include <linux/overflow.h>
>  #include <linux/slab.h>
>  #include <linux/tee_core.h>
>  #include <linux/uaccess.h>
> -#include <crypto/hash.h>
>  #include <crypto/sha1.h>
>  #include "tee_private.h"
>  
>  #define TEE_NUM_DEVICES	32
>  
> @@ -140,72 +139,36 @@ static int tee_release(struct inode *inode, struct file *filp)
>   * UUIDv5 is specific in RFC 4122.
>   *
>   * This implements section (for SHA-1):
>   * 4.3.  Algorithm for Creating a Name-Based UUID
>   */
> -static int uuid_v5(uuid_t *uuid, const uuid_t *ns, const void *name,
> -		   size_t size)
> +static void uuid_v5(uuid_t *uuid, const uuid_t *ns, const void *name,
> +		    size_t size)
>  {
>  	unsigned char hash[SHA1_DIGEST_SIZE];
> -	struct crypto_shash *shash = NULL;
> -	struct shash_desc *desc = NULL;
> -	int rc;
> -
> -	shash = crypto_alloc_shash("sha1", 0, 0);
> -	if (IS_ERR(shash)) {
> -		rc = PTR_ERR(shash);
> -		pr_err("shash(sha1) allocation failed\n");
> -		return rc;
> -	}
> -
> -	desc = kzalloc(sizeof(*desc) + crypto_shash_descsize(shash),
> -		       GFP_KERNEL);
> -	if (!desc) {
> -		rc = -ENOMEM;
> -		goto out_free_shash;
> -	}
> -
> -	desc->tfm = shash;
> +	struct sha1_ctx ctx;
>  
> -	rc = crypto_shash_init(desc);
> -	if (rc < 0)
> -		goto out_free_desc;
> -
> -	rc = crypto_shash_update(desc, (const u8 *)ns, sizeof(*ns));
> -	if (rc < 0)
> -		goto out_free_desc;
> -
> -	rc = crypto_shash_update(desc, (const u8 *)name, size);
> -	if (rc < 0)
> -		goto out_free_desc;
> -
> -	rc = crypto_shash_final(desc, hash);
> -	if (rc < 0)
> -		goto out_free_desc;
> +	sha1_init(&ctx);
> +	sha1_update(&ctx, (const u8 *)ns, sizeof(*ns));
> +	sha1_update(&ctx, (const u8 *)name, size);
> +	sha1_final(&ctx, hash);
>  
>  	memcpy(uuid->b, hash, UUID_SIZE);
>  
>  	/* Tag for version 5 */
>  	uuid->b[6] = (hash[6] & 0x0F) | 0x50;
>  	uuid->b[8] = (hash[8] & 0x3F) | 0x80;
> -
> -out_free_desc:
> -	kfree(desc);
> -
> -out_free_shash:
> -	crypto_free_shash(shash);
> -	return rc;
>  }
>  
>  int tee_session_calc_client_uuid(uuid_t *uuid, u32 connection_method,
>  				 const u8 connection_data[TEE_IOCTL_UUID_LEN])
>  {
>  	gid_t ns_grp = (gid_t)-1;
>  	kgid_t grp = INVALID_GID;
>  	char *name = NULL;
>  	int name_len;
> -	int rc;
> +	int rc = 0;
>  
>  	if (connection_method == TEE_IOCTL_LOGIN_PUBLIC ||
>  	    connection_method == TEE_IOCTL_LOGIN_REE_KERNEL) {
>  		/* Nil UUID to be passed to TEE environment */
>  		uuid_copy(uuid, &uuid_null);
> @@ -258,11 +221,11 @@ int tee_session_calc_client_uuid(uuid_t *uuid, u32 connection_method,
>  	default:
>  		rc = -EINVAL;
>  		goto out_free_name;
>  	}
>  
> -	rc = uuid_v5(uuid, &tee_client_uuid_ns, name, name_len);
> +	uuid_v5(uuid, &tee_client_uuid_ns, name, name_len);
>  out_free_name:
>  	kfree(name);
>  
>  	return rc;
>  }
> 
> base-commit: 0905809b38bda1fa0b206986c44d846e46f13c1d
> -- 
> 2.50.1
>
Re: [PATCH] tee: Use SHA-1 library instead of crypto_shash
Posted by Jens Wiklander 1 month, 3 weeks ago 
On Mon, Aug 11, 2025 at 8:13 AM Sumit Garg <sumit.garg@kernel.org> wrote:
>
> On Fri, Aug 01, 2025 at 04:55:41PM -0700, Eric Biggers wrote:
> > Use the SHA-1 library functions instead of crypto_shash.  This is
> > simpler and faster.
> >
> > Change uuid_v5() to return void, since it can no longer fail.
> >
> > Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> > ---
> >
> > Note: this patch depends on the SHA-1 library functions that were merged
> > in v6.17-rc1.
> >
> >  drivers/tee/Kconfig    |  3 +--
> >  drivers/tee/tee_core.c | 55 +++++++-----------------------------------
> >  2 files changed, 10 insertions(+), 48 deletions(-)
>
> Nice cleanup, FWIW:
>
> Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

Looks good. I'm picking up this.

Thanks,
Jens

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.