1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright 2026 Google LLC 4 */ 5 #include <crypto/gf128hash.h> 6 #include "ghash-testvecs.h" 7 8 /* 9 * A fixed key used when presenting GHASH as an unkeyed hash function in order 10 * to reuse hash-test-template.h. At the beginning of the test suite, this is 11 * initialized to a key prepared from bytes generated from a fixed seed. 12 */ 13 static struct ghash_key test_key; 14 15 static void ghash_init_withtestkey(struct ghash_ctx *ctx) 16 { 17 ghash_init(ctx, &test_key); 18 } 19 20 static void ghash_withtestkey(const u8 *data, size_t len, 21 u8 out[GHASH_BLOCK_SIZE]) 22 { 23 ghash(&test_key, data, len, out); 24 } 25 26 /* Generate the HASH_KUNIT_CASES using hash-test-template.h. */ 27 #define HASH ghash_withtestkey 28 #define HASH_CTX ghash_ctx 29 #define HASH_SIZE GHASH_BLOCK_SIZE 30 #define HASH_INIT ghash_init_withtestkey 31 #define HASH_UPDATE ghash_update 32 #define HASH_FINAL ghash_final 33 #include "hash-test-template.h" 34 35 /* 36 * Test a key and messages containing all one bits. This is useful to detect 37 * overflow bugs in implementations that emulate carryless multiplication using 38 * a series of standard multiplications with the bits spread out. 39 */ 40 static void test_ghash_allones_key_and_message(struct kunit *test) 41 { 42 struct ghash_key key; 43 struct ghash_ctx hashofhashes_ctx; 44 u8 hash[GHASH_BLOCK_SIZE]; 45 46 static_assert(TEST_BUF_LEN >= 4096); 47 memset(test_buf, 0xff, 4096); 48 49 ghash_preparekey(&key, test_buf); 50 ghash_init(&hashofhashes_ctx, &key); 51 for (size_t len = 0; len <= 4096; len += 16) { 52 ghash(&key, test_buf, len, hash); 53 ghash_update(&hashofhashes_ctx, hash, sizeof(hash)); 54 } 55 ghash_final(&hashofhashes_ctx, hash); 56 KUNIT_ASSERT_MEMEQ(test, hash, ghash_allones_hashofhashes, 57 sizeof(hash)); 58 } 59 60 #define MAX_LEN_FOR_KEY_CHECK 1024 61 62 /* 63 * Given two prepared keys which should be identical (but may differ in 64 * alignment and/or whether they are followed by a guard page or not), verify 65 * that they produce consistent results on various data lengths. 66 */ 67 static void check_key_consistency(struct kunit *test, 68 const struct ghash_key *key1, 69 const struct ghash_key *key2) 70 { 71 u8 *data = test_buf; 72 u8 hash1[GHASH_BLOCK_SIZE]; 73 u8 hash2[GHASH_BLOCK_SIZE]; 74 75 rand_bytes(data, MAX_LEN_FOR_KEY_CHECK); 76 KUNIT_ASSERT_MEMEQ(test, key1, key2, sizeof(*key1)); 77 78 for (int i = 0; i < 100; i++) { 79 size_t len = rand_length(MAX_LEN_FOR_KEY_CHECK); 80 81 ghash(key1, data, len, hash1); 82 ghash(key2, data, len, hash2); 83 KUNIT_ASSERT_MEMEQ(test, hash1, hash2, sizeof(hash1)); 84 } 85 } 86 87 /* Test that no buffer overreads occur on either raw_key or ghash_key. */ 88 static void test_ghash_with_guarded_key(struct kunit *test) 89 { 90 u8 raw_key[GHASH_BLOCK_SIZE]; 91 u8 *guarded_raw_key = &test_buf[TEST_BUF_LEN - sizeof(raw_key)]; 92 struct ghash_key key1, key2; 93 struct ghash_key *guarded_key = 94 (struct ghash_key *)&test_buf[TEST_BUF_LEN - sizeof(key1)]; 95 96 /* Prepare with regular buffers. */ 97 rand_bytes(raw_key, sizeof(raw_key)); 98 ghash_preparekey(&key1, raw_key); 99 100 /* Prepare with guarded raw_key, then check that it works. */ 101 memcpy(guarded_raw_key, raw_key, sizeof(raw_key)); 102 ghash_preparekey(&key2, guarded_raw_key); 103 check_key_consistency(test, &key1, &key2); 104 105 /* Prepare guarded ghash_key, then check that it works. */ 106 ghash_preparekey(guarded_key, raw_key); 107 check_key_consistency(test, &key1, guarded_key); 108 } 109 110 /* 111 * Test that ghash_key only needs to be aligned to 112 * __alignof__(struct ghash_key), i.e. 8 bytes. The assembly code may prefer 113 * 16-byte or higher alignment, but it mustn't require it. 114 */ 115 static void test_ghash_with_minimally_aligned_key(struct kunit *test) 116 { 117 u8 raw_key[GHASH_BLOCK_SIZE]; 118 struct ghash_key key; 119 struct ghash_key *minaligned_key = 120 (struct ghash_key *)&test_buf[MAX_LEN_FOR_KEY_CHECK + 121 __alignof__(struct ghash_key)]; 122 123 KUNIT_ASSERT_TRUE(test, IS_ALIGNED((uintptr_t)minaligned_key, 124 __alignof__(struct ghash_key))); 125 KUNIT_ASSERT_TRUE(test, !IS_ALIGNED((uintptr_t)minaligned_key, 126 2 * __alignof__(struct ghash_key))); 127 128 rand_bytes(raw_key, sizeof(raw_key)); 129 ghash_preparekey(&key, raw_key); 130 ghash_preparekey(minaligned_key, raw_key); 131 check_key_consistency(test, &key, minaligned_key); 132 } 133 134 struct ghash_irq_test_state { 135 struct ghash_key expected_key; 136 u8 raw_key[GHASH_BLOCK_SIZE]; 137 }; 138 139 static bool ghash_irq_test_func(void *state_) 140 { 141 struct ghash_irq_test_state *state = state_; 142 struct ghash_key key; 143 144 ghash_preparekey(&key, state->raw_key); 145 return memcmp(&key, &state->expected_key, sizeof(key)) == 0; 146 } 147 148 /* 149 * Test that ghash_preparekey() produces the same output regardless of whether 150 * FPU or vector registers are usable when it is called. 151 */ 152 static void test_ghash_preparekey_in_irqs(struct kunit *test) 153 { 154 struct ghash_irq_test_state state; 155 156 rand_bytes(state.raw_key, sizeof(state.raw_key)); 157 ghash_preparekey(&state.expected_key, state.raw_key); 158 kunit_run_irq_test(test, ghash_irq_test_func, 200000, &state); 159 } 160 161 static int ghash_suite_init(struct kunit_suite *suite) 162 { 163 u8 raw_key[GHASH_BLOCK_SIZE]; 164 165 rand_bytes_seeded_from_len(raw_key, sizeof(raw_key)); 166 ghash_preparekey(&test_key, raw_key); 167 return hash_suite_init(suite); 168 } 169 170 static void ghash_suite_exit(struct kunit_suite *suite) 171 { 172 hash_suite_exit(suite); 173 } 174 175 static struct kunit_case ghash_test_cases[] = { 176 HASH_KUNIT_CASES, 177 KUNIT_CASE(test_ghash_allones_key_and_message), 178 KUNIT_CASE(test_ghash_with_guarded_key), 179 KUNIT_CASE(test_ghash_with_minimally_aligned_key), 180 KUNIT_CASE(test_ghash_preparekey_in_irqs), 181 KUNIT_CASE(benchmark_hash), 182 {}, 183 }; 184 185 static struct kunit_suite ghash_test_suite = { 186 .name = "ghash", 187 .test_cases = ghash_test_cases, 188 .suite_init = ghash_suite_init, 189 .suite_exit = ghash_suite_exit, 190 }; 191 kunit_test_suite(ghash_test_suite); 192 193 MODULE_DESCRIPTION("KUnit tests and benchmark for GHASH"); 194 MODULE_LICENSE("GPL"); 195