1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright 2025 Google LLC
4 */
5 #include <crypto/polyval.h>
6 #include "polyval-testvecs.h"
7
8 /*
9 * A fixed key used when presenting POLYVAL as an unkeyed hash function in order
10 * to reuse hash-test-template.h. At the beginning of the test suite, this is
11 * initialized to a key prepared from bytes generated from a fixed seed.
12 */
13 static struct polyval_key test_key;
14
polyval_init_withtestkey(struct polyval_ctx * ctx)15 static void polyval_init_withtestkey(struct polyval_ctx *ctx)
16 {
17 polyval_init(ctx, &test_key);
18 }
19
polyval_withtestkey(const u8 * data,size_t len,u8 out[POLYVAL_BLOCK_SIZE])20 static void polyval_withtestkey(const u8 *data, size_t len,
21 u8 out[POLYVAL_BLOCK_SIZE])
22 {
23 polyval(&test_key, data, len, out);
24 }
25
26 /* Generate the HASH_KUNIT_CASES using hash-test-template.h. */
27 #define HASH polyval_withtestkey
28 #define HASH_CTX polyval_ctx
29 #define HASH_SIZE POLYVAL_BLOCK_SIZE
30 #define HASH_INIT polyval_init_withtestkey
31 #define HASH_UPDATE polyval_update
32 #define HASH_FINAL polyval_final
33 #include "hash-test-template.h"
34
35 /*
36 * Test an example from RFC8452 ("AES-GCM-SIV: Nonce Misuse-Resistant
37 * Authenticated Encryption") to ensure compatibility with that.
38 */
test_polyval_rfc8452_testvec(struct kunit * test)39 static void test_polyval_rfc8452_testvec(struct kunit *test)
40 {
41 static const u8 raw_key[POLYVAL_BLOCK_SIZE] =
42 "\x31\x07\x28\xd9\x91\x1f\x1f\x38"
43 "\x37\xb2\x43\x16\xc3\xfa\xb9\xa0";
44 static const u8 data[48] =
45 "\x65\x78\x61\x6d\x70\x6c\x65\x00"
46 "\x00\x00\x00\x00\x00\x00\x00\x00"
47 "\x48\x65\x6c\x6c\x6f\x20\x77\x6f"
48 "\x72\x6c\x64\x00\x00\x00\x00\x00"
49 "\x38\x00\x00\x00\x00\x00\x00\x00"
50 "\x58\x00\x00\x00\x00\x00\x00\x00";
51 static const u8 expected_hash[POLYVAL_BLOCK_SIZE] =
52 "\xad\x7f\xcf\x0b\x51\x69\x85\x16"
53 "\x62\x67\x2f\x3c\x5f\x95\x13\x8f";
54 u8 hash[POLYVAL_BLOCK_SIZE];
55 struct polyval_key key;
56
57 polyval_preparekey(&key, raw_key);
58 polyval(&key, data, sizeof(data), hash);
59 KUNIT_ASSERT_MEMEQ(test, hash, expected_hash, sizeof(hash));
60 }
61
62 /*
63 * Test a key and messages containing all one bits. This is useful to detect
64 * overflow bugs in implementations that emulate carryless multiplication using
65 * a series of standard multiplications with the bits spread out.
66 */
test_polyval_allones_key_and_message(struct kunit * test)67 static void test_polyval_allones_key_and_message(struct kunit *test)
68 {
69 struct polyval_key key;
70 struct polyval_ctx hashofhashes_ctx;
71 u8 hash[POLYVAL_BLOCK_SIZE];
72
73 static_assert(TEST_BUF_LEN >= 4096);
74 memset(test_buf, 0xff, 4096);
75
76 polyval_preparekey(&key, test_buf);
77 polyval_init(&hashofhashes_ctx, &key);
78 for (size_t len = 0; len <= 4096; len += 16) {
79 polyval(&key, test_buf, len, hash);
80 polyval_update(&hashofhashes_ctx, hash, sizeof(hash));
81 }
82 polyval_final(&hashofhashes_ctx, hash);
83 KUNIT_ASSERT_MEMEQ(test, hash, polyval_allones_hashofhashes,
84 sizeof(hash));
85 }
86
87 #define MAX_LEN_FOR_KEY_CHECK 1024
88
89 /*
90 * Given two prepared keys which should be identical (but may differ in
91 * alignment and/or whether they are followed by a guard page or not), verify
92 * that they produce consistent results on various data lengths.
93 */
check_key_consistency(struct kunit * test,const struct polyval_key * key1,const struct polyval_key * key2)94 static void check_key_consistency(struct kunit *test,
95 const struct polyval_key *key1,
96 const struct polyval_key *key2)
97 {
98 u8 *data = test_buf;
99 u8 hash1[POLYVAL_BLOCK_SIZE];
100 u8 hash2[POLYVAL_BLOCK_SIZE];
101
102 rand_bytes(data, MAX_LEN_FOR_KEY_CHECK);
103 KUNIT_ASSERT_MEMEQ(test, key1, key2, sizeof(*key1));
104
105 for (int i = 0; i < 100; i++) {
106 size_t len = rand_length(MAX_LEN_FOR_KEY_CHECK);
107
108 polyval(key1, data, len, hash1);
109 polyval(key2, data, len, hash2);
110 KUNIT_ASSERT_MEMEQ(test, hash1, hash2, sizeof(hash1));
111 }
112 }
113
114 /* Test that no buffer overreads occur on either raw_key or polyval_key. */
test_polyval_with_guarded_key(struct kunit * test)115 static void test_polyval_with_guarded_key(struct kunit *test)
116 {
117 u8 raw_key[POLYVAL_BLOCK_SIZE];
118 u8 *guarded_raw_key = &test_buf[TEST_BUF_LEN - sizeof(raw_key)];
119 struct polyval_key key1, key2;
120 struct polyval_key *guarded_key =
121 (struct polyval_key *)&test_buf[TEST_BUF_LEN - sizeof(key1)];
122
123 /* Prepare with regular buffers. */
124 rand_bytes(raw_key, sizeof(raw_key));
125 polyval_preparekey(&key1, raw_key);
126
127 /* Prepare with guarded raw_key, then check that it works. */
128 memcpy(guarded_raw_key, raw_key, sizeof(raw_key));
129 polyval_preparekey(&key2, guarded_raw_key);
130 check_key_consistency(test, &key1, &key2);
131
132 /* Prepare guarded polyval_key, then check that it works. */
133 polyval_preparekey(guarded_key, raw_key);
134 check_key_consistency(test, &key1, guarded_key);
135 }
136
137 /*
138 * Test that polyval_key only needs to be aligned to
139 * __alignof__(struct polyval_key), i.e. 8 bytes. The assembly code may prefer
140 * 16-byte or higher alignment, but it musn't require it.
141 */
test_polyval_with_minimally_aligned_key(struct kunit * test)142 static void test_polyval_with_minimally_aligned_key(struct kunit *test)
143 {
144 u8 raw_key[POLYVAL_BLOCK_SIZE];
145 struct polyval_key key;
146 struct polyval_key *minaligned_key =
147 (struct polyval_key *)&test_buf[MAX_LEN_FOR_KEY_CHECK +
148 __alignof__(struct polyval_key)];
149
150 KUNIT_ASSERT_TRUE(test, IS_ALIGNED((uintptr_t)minaligned_key,
151 __alignof__(struct polyval_key)));
152 KUNIT_ASSERT_TRUE(test,
153 !IS_ALIGNED((uintptr_t)minaligned_key,
154 2 * __alignof__(struct polyval_key)));
155
156 rand_bytes(raw_key, sizeof(raw_key));
157 polyval_preparekey(&key, raw_key);
158 polyval_preparekey(minaligned_key, raw_key);
159 check_key_consistency(test, &key, minaligned_key);
160 }
161
162 struct polyval_irq_test_state {
163 struct polyval_key expected_key;
164 u8 raw_key[POLYVAL_BLOCK_SIZE];
165 };
166
polyval_irq_test_func(void * state_)167 static bool polyval_irq_test_func(void *state_)
168 {
169 struct polyval_irq_test_state *state = state_;
170 struct polyval_key key;
171
172 polyval_preparekey(&key, state->raw_key);
173 return memcmp(&key, &state->expected_key, sizeof(key)) == 0;
174 }
175
176 /*
177 * Test that polyval_preparekey() produces the same output regardless of whether
178 * FPU or vector registers are usable when it is called.
179 */
test_polyval_preparekey_in_irqs(struct kunit * test)180 static void test_polyval_preparekey_in_irqs(struct kunit *test)
181 {
182 struct polyval_irq_test_state state;
183
184 rand_bytes(state.raw_key, sizeof(state.raw_key));
185 polyval_preparekey(&state.expected_key, state.raw_key);
186 kunit_run_irq_test(test, polyval_irq_test_func, 20000, &state);
187 }
188
polyval_suite_init(struct kunit_suite * suite)189 static int polyval_suite_init(struct kunit_suite *suite)
190 {
191 u8 raw_key[POLYVAL_BLOCK_SIZE];
192
193 rand_bytes_seeded_from_len(raw_key, sizeof(raw_key));
194 polyval_preparekey(&test_key, raw_key);
195 return hash_suite_init(suite);
196 }
197
polyval_suite_exit(struct kunit_suite * suite)198 static void polyval_suite_exit(struct kunit_suite *suite)
199 {
200 hash_suite_exit(suite);
201 }
202
203 static struct kunit_case polyval_test_cases[] = {
204 HASH_KUNIT_CASES,
205 KUNIT_CASE(test_polyval_rfc8452_testvec),
206 KUNIT_CASE(test_polyval_allones_key_and_message),
207 KUNIT_CASE(test_polyval_with_guarded_key),
208 KUNIT_CASE(test_polyval_with_minimally_aligned_key),
209 KUNIT_CASE(test_polyval_preparekey_in_irqs),
210 KUNIT_CASE(benchmark_hash),
211 {},
212 };
213
214 static struct kunit_suite polyval_test_suite = {
215 .name = "polyval",
216 .test_cases = polyval_test_cases,
217 .suite_init = polyval_suite_init,
218 .suite_exit = polyval_suite_exit,
219 };
220 kunit_test_suite(polyval_test_suite);
221
222 MODULE_DESCRIPTION("KUnit tests and benchmark for POLYVAL");
223 MODULE_LICENSE("GPL");
224