1. Patchew
  2. linux
  3. [PATCH bpf-next v2 0/5] Add cryptographic hash and signature verification kfuncs to BPF
  4. View patch

[PATCH bpf-next v2 1/5] crypto: Add BPF hash algorithm type registration module

Daniel Hodges posted 5 patches 1 week, 3 days ago
There is a newer version of this series
[PATCH bpf-next v2 1/5] crypto: Add BPF hash algorithm type registration module
Posted by Daniel Hodges 1 week, 3 days ago 
Add bpf_crypto_shash module that registers a hash type with the BPF
crypto infrastructure, enabling BPF programs to access kernel hash
algorithms through a unified interface.

Update the bpf_crypto_type interface with hash-specific callbacks:
   - alloc_tfm: Allocates crypto_shash context with proper descriptor size
   - free_tfm: Releases hash transform and context memory
   - has_algo: Checks algorithm availability via crypto_has_shash()
   - hash: Performs single-shot hashing via crypto_shash_digest()
   - digestsize: Returns the output size for the hash algorithm
   - get_flags: Exposes transform flags to BPF programs

Update bpf_shash_ctx to contain crypto_shash transform and shash_desc
descriptor to accommodate algorithm-specific descriptor requirements.

Signed-off-by: Daniel Hodges <git@danielhodges.dev>
---
 crypto/Makefile           |  3 ++
 crypto/bpf_crypto_shash.c | 94 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 97 insertions(+)
 create mode 100644 crypto/bpf_crypto_shash.c

diff --git a/crypto/Makefile b/crypto/Makefile
index 16a35649dd91..853dff375906 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -30,6 +30,9 @@ obj-$(CONFIG_CRYPTO_ECHAINIV) += echainiv.o
 crypto_hash-y += ahash.o
 crypto_hash-y += shash.o
 obj-$(CONFIG_CRYPTO_HASH2) += crypto_hash.o
+ifeq ($(CONFIG_BPF_SYSCALL),y)
+obj-$(CONFIG_CRYPTO_HASH2) += bpf_crypto_shash.o
+endif
 
 obj-$(CONFIG_CRYPTO_AKCIPHER2) += akcipher.o
 obj-$(CONFIG_CRYPTO_SIG2) += sig.o
diff --git a/crypto/bpf_crypto_shash.c b/crypto/bpf_crypto_shash.c
new file mode 100644
index 000000000000..39032e7dd602
--- /dev/null
+++ b/crypto/bpf_crypto_shash.c
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/bpf_crypto.h>
+#include <crypto/hash.h>
+
+struct bpf_shash_ctx {
+	struct crypto_shash *tfm;
+	struct shash_desc desc;
+};
+
+static void *bpf_crypto_shash_alloc_tfm(const char *algo)
+{
+	struct bpf_shash_ctx *ctx;
+	struct crypto_shash *tfm;
+
+	tfm = crypto_alloc_shash(algo, 0, 0);
+	if (IS_ERR(tfm))
+		return tfm;
+
+	ctx = kzalloc(sizeof(*ctx) + crypto_shash_descsize(tfm), GFP_KERNEL);
+	if (!ctx) {
+		crypto_free_shash(tfm);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	ctx->tfm = tfm;
+	ctx->desc.tfm = tfm;
+
+	return ctx;
+}
+
+static void bpf_crypto_shash_free_tfm(void *tfm)
+{
+	struct bpf_shash_ctx *ctx = tfm;
+
+	crypto_free_shash(ctx->tfm);
+	kfree(ctx);
+}
+
+static int bpf_crypto_shash_has_algo(const char *algo)
+{
+	return crypto_has_shash(algo, 0, 0);
+}
+
+static int bpf_crypto_shash_hash(void *tfm, const u8 *data, u8 *out,
+				 unsigned int len)
+{
+	struct bpf_shash_ctx *ctx = tfm;
+
+	return crypto_shash_digest(&ctx->desc, data, len, out);
+}
+
+static unsigned int bpf_crypto_shash_digestsize(void *tfm)
+{
+	struct bpf_shash_ctx *ctx = tfm;
+
+	return crypto_shash_digestsize(ctx->tfm);
+}
+
+static u32 bpf_crypto_shash_get_flags(void *tfm)
+{
+	struct bpf_shash_ctx *ctx = tfm;
+
+	return crypto_shash_get_flags(ctx->tfm);
+}
+
+static const struct bpf_crypto_type bpf_crypto_shash_type = {
+	.alloc_tfm	= bpf_crypto_shash_alloc_tfm,
+	.free_tfm	= bpf_crypto_shash_free_tfm,
+	.has_algo	= bpf_crypto_shash_has_algo,
+	.hash		= bpf_crypto_shash_hash,
+	.digestsize	= bpf_crypto_shash_digestsize,
+	.get_flags	= bpf_crypto_shash_get_flags,
+	.owner		= THIS_MODULE,
+	.name		= "hash",
+};
+
+static int __init bpf_crypto_shash_init(void)
+{
+	return bpf_crypto_register_type(&bpf_crypto_shash_type);
+}
+
+static void __exit bpf_crypto_shash_exit(void)
+{
+	int err = bpf_crypto_unregister_type(&bpf_crypto_shash_type);
+
+	WARN_ON_ONCE(err);
+}
+
+module_init(bpf_crypto_shash_init);
+module_exit(bpf_crypto_shash_exit);
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Hash algorithm support for BPF");
-- 
2.51.0
Re: [PATCH bpf-next v2 1/5] crypto: Add BPF hash algorithm type registration module
Posted by Song Liu 1 week, 3 days ago 
On Fri, Dec 5, 2025 at 9:40 AM Daniel Hodges <git@danielhodges.dev> wrote:
>
> Add bpf_crypto_shash module that registers a hash type with the BPF
> crypto infrastructure, enabling BPF programs to access kernel hash
> algorithms through a unified interface.
>
> Update the bpf_crypto_type interface with hash-specific callbacks:
>    - alloc_tfm: Allocates crypto_shash context with proper descriptor size
>    - free_tfm: Releases hash transform and context memory
>    - has_algo: Checks algorithm availability via crypto_has_shash()
>    - hash: Performs single-shot hashing via crypto_shash_digest()
>    - digestsize: Returns the output size for the hash algorithm
>    - get_flags: Exposes transform flags to BPF programs
>
> Update bpf_shash_ctx to contain crypto_shash transform and shash_desc
> descriptor to accommodate algorithm-specific descriptor requirements.
>
> Signed-off-by: Daniel Hodges <git@danielhodges.dev>
> ---
>  crypto/Makefile           |  3 ++
>  crypto/bpf_crypto_shash.c | 94 +++++++++++++++++++++++++++++++++++++++
>  2 files changed, 97 insertions(+)
>  create mode 100644 crypto/bpf_crypto_shash.c
>
> diff --git a/crypto/Makefile b/crypto/Makefile
> index 16a35649dd91..853dff375906 100644
> --- a/crypto/Makefile
> +++ b/crypto/Makefile
> @@ -30,6 +30,9 @@ obj-$(CONFIG_CRYPTO_ECHAINIV) += echainiv.o
>  crypto_hash-y += ahash.o
>  crypto_hash-y += shash.o
>  obj-$(CONFIG_CRYPTO_HASH2) += crypto_hash.o
> +ifeq ($(CONFIG_BPF_SYSCALL),y)
> +obj-$(CONFIG_CRYPTO_HASH2) += bpf_crypto_shash.o
> +endif
>
>  obj-$(CONFIG_CRYPTO_AKCIPHER2) += akcipher.o
>  obj-$(CONFIG_CRYPTO_SIG2) += sig.o
> diff --git a/crypto/bpf_crypto_shash.c b/crypto/bpf_crypto_shash.c
> new file mode 100644
> index 000000000000..39032e7dd602
> --- /dev/null
> +++ b/crypto/bpf_crypto_shash.c
> @@ -0,0 +1,94 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +#include <linux/types.h>
> +#include <linux/module.h>
> +#include <linux/bpf_crypto.h>
> +#include <crypto/hash.h>
> +
> +struct bpf_shash_ctx {
> +       struct crypto_shash *tfm;
> +       struct shash_desc desc;
> +};

Instead of adding bpf_shash_ctx and bpf_ecdsa_ctx, can we extend
bpf_crypto_ctx to cover all hash and ECDSA? bpf_crypto_ctx has a
const pointer to bpf_crypto_type, so this should be possible?

Thanks,
Song
Re: [PATCH bpf-next v2 1/5] crypto: Add BPF hash algorithm type registration module
Posted by Daniel Hodges 1 week, 1 day ago 
On Fri, Dec 05, 2025 at 05:00:47PM -0800, Song Liu wrote:
> On Fri, Dec 5, 2025 at 9:40 AM Daniel Hodges <git@danielhodges.dev> wrote:
> >
> > Add bpf_crypto_shash module that registers a hash type with the BPF
> > crypto infrastructure, enabling BPF programs to access kernel hash
> > algorithms through a unified interface.
> >
> > Update the bpf_crypto_type interface with hash-specific callbacks:
> >    - alloc_tfm: Allocates crypto_shash context with proper descriptor size
> >    - free_tfm: Releases hash transform and context memory
> >    - has_algo: Checks algorithm availability via crypto_has_shash()
> >    - hash: Performs single-shot hashing via crypto_shash_digest()
> >    - digestsize: Returns the output size for the hash algorithm
> >    - get_flags: Exposes transform flags to BPF programs
> >
> > Update bpf_shash_ctx to contain crypto_shash transform and shash_desc
> > descriptor to accommodate algorithm-specific descriptor requirements.
> >
> > Signed-off-by: Daniel Hodges <git@danielhodges.dev>
> > ---
> >  crypto/Makefile           |  3 ++
> >  crypto/bpf_crypto_shash.c | 94 +++++++++++++++++++++++++++++++++++++++
> >  2 files changed, 97 insertions(+)
> >  create mode 100644 crypto/bpf_crypto_shash.c
> >
> > diff --git a/crypto/Makefile b/crypto/Makefile
> > index 16a35649dd91..853dff375906 100644
> > --- a/crypto/Makefile
> > +++ b/crypto/Makefile
> > @@ -30,6 +30,9 @@ obj-$(CONFIG_CRYPTO_ECHAINIV) += echainiv.o
> >  crypto_hash-y += ahash.o
> >  crypto_hash-y += shash.o
> >  obj-$(CONFIG_CRYPTO_HASH2) += crypto_hash.o
> > +ifeq ($(CONFIG_BPF_SYSCALL),y)
> > +obj-$(CONFIG_CRYPTO_HASH2) += bpf_crypto_shash.o
> > +endif
> >
> >  obj-$(CONFIG_CRYPTO_AKCIPHER2) += akcipher.o
> >  obj-$(CONFIG_CRYPTO_SIG2) += sig.o
> > diff --git a/crypto/bpf_crypto_shash.c b/crypto/bpf_crypto_shash.c
> > new file mode 100644
> > index 000000000000..39032e7dd602
> > --- /dev/null
> > +++ b/crypto/bpf_crypto_shash.c
> > @@ -0,0 +1,94 @@
> > +// SPDX-License-Identifier: GPL-2.0-only
> > +#include <linux/types.h>
> > +#include <linux/module.h>
> > +#include <linux/bpf_crypto.h>
> > +#include <crypto/hash.h>
> > +
> > +struct bpf_shash_ctx {
> > +       struct crypto_shash *tfm;
> > +       struct shash_desc desc;
> > +};
> 
> Instead of adding bpf_shash_ctx and bpf_ecdsa_ctx, can we extend
> bpf_crypto_ctx to cover all hash and ECDSA? bpf_crypto_ctx has a
> const pointer to bpf_crypto_type, so this should be possible?
> 
> Thanks,
> Song


Sounds good!
Re: [PATCH bpf-next v2 1/5] crypto: Add BPF hash algorithm type registration module
Posted by bot+bpf-ci@kernel.org 1 week, 3 days ago 
> diff --git a/crypto/Makefile b/crypto/Makefile
> index 16a35649dd91..853dff375906 100644
> --- a/crypto/Makefile
> +++ b/crypto/Makefile

[ ... ]

> diff --git a/crypto/bpf_crypto_shash.c b/crypto/bpf_crypto_shash.c
> new file mode 100644
> index 000000000000..39032e7dd602
> --- /dev/null
> +++ b/crypto/bpf_crypto_shash.c

[ ... ]

> +static const struct bpf_crypto_type bpf_crypto_shash_type = {
> +	.alloc_tfm	= bpf_crypto_shash_alloc_tfm,
> +	.free_tfm	= bpf_crypto_shash_free_tfm,
> +	.has_algo	= bpf_crypto_shash_has_algo,
> +	.hash		= bpf_crypto_shash_hash,
> +	.digestsize	= bpf_crypto_shash_digestsize,
> +	.get_flags	= bpf_crypto_shash_get_flags,
> +	.owner		= THIS_MODULE,
> +	.name		= "hash",
> +};

Does this code compile? The struct bpf_crypto_type definition in
include/linux/bpf_crypto.h doesn't have .hash or .digestsize fields at
this commit. The commit message says "Update the bpf_crypto_type
interface with hash-specific callbacks" but the interface wasn't
actually updated in this commit.

Looking forward in the git history, commit 51e5f5be27dc adds these
fields to the interface. Should that commit come before this one for
bisectability?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/19971392632

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.