examples/fips_validation/main.c

   1 /* SPDX-License-Identifier: BSD-3-Clause
   2  * Copyright(c) 2018 Intel Corporation
   3  */
   4
   5 #include <sys/stat.h>
   6 #include <getopt.h>
   7 #include <dirent.h>
   8
   9 #include <rte_cryptodev.h>
  10 #include <rte_cryptodev_pmd.h>
  11 #include <rte_mempool.h>
  12 #include <rte_mbuf.h>
  13 #include <rte_string_fns.h>
  14
  15 #include "fips_validation.h"
  16 #include "fips_dev_self_test.h"
  17
  18 #define REQ_FILE_PATH_KEYWORD   "req-file"
  19 #define RSP_FILE_PATH_KEYWORD   "rsp-file"
  20 #define FOLDER_KEYWORD          "path-is-folder"
  21 #define CRYPTODEV_KEYWORD       "cryptodev"
  22 #define CRYPTODEV_ID_KEYWORD    "cryptodev-id"
  23 #define CRYPTODEV_ST_KEYWORD    "self-test"
  24 #define CRYPTODEV_BK_ID_KEYWORD "broken-test-id"
  25 #define CRYPTODEV_BK_DIR_KEY    "broken-test-dir"
  26 #define CRYPTODEV_ENC_KEYWORD   "enc"
  27 #define CRYPTODEV_DEC_KEYWORD   "dec"
  28
  29 struct fips_test_vector vec;
  30 struct fips_test_interim_info info;
  31
  32 struct cryptodev_fips_validate_env {
  33         const char *req_path;
  34         const char *rsp_path;
  35         uint32_t is_path_folder;
  36         uint32_t dev_id;
  37         struct rte_mempool *mpool;
  38         struct rte_mempool *sess_mpool;
  39         struct rte_mempool *sess_priv_mpool;
  40         struct rte_mempool *op_pool;
  41         struct rte_mbuf *mbuf;
  42         struct rte_crypto_op *op;
  43         struct rte_cryptodev_sym_session *sess;
  44         uint32_t self_test;
  45         struct fips_dev_broken_test_config *broken_test_config;
  46 } env;
  47
  48 static int
  49 cryptodev_fips_validate_app_int(void)
  50 {
  51         struct rte_cryptodev_config conf = {rte_socket_id(), 1, 0};
  52         struct rte_cryptodev_qp_conf qp_conf = {128, NULL, NULL};
  53         uint32_t sess_sz = rte_cryptodev_sym_get_private_session_size(
  54                         env.dev_id);
  55         int ret;
  56
  57         if (env.self_test) {
  58                 ret = fips_dev_self_test(env.dev_id, env.broken_test_config);
  59                 if (ret < 0) {
  60                         struct rte_cryptodev *cryptodev =
  61                                         rte_cryptodev_pmd_get_dev(env.dev_id);
  62
  63                         rte_cryptodev_pmd_destroy(cryptodev);
  64
  65                         return ret;
  66                 }
  67         }
  68
  69         ret = rte_cryptodev_configure(env.dev_id, &conf);
  70         if (ret < 0)
  71                 return ret;
  72
  73         env.mpool = rte_pktmbuf_pool_create("FIPS_MEMPOOL", 128, 0, 0,
  74                         UINT16_MAX, rte_socket_id());
  75         if (!env.mpool)
  76                 return ret;
  77
  78         ret = rte_cryptodev_queue_pair_setup(env.dev_id, 0, &qp_conf,
  79                         rte_socket_id());
  80         if (ret < 0)
  81                 return ret;
  82
  83         ret = -ENOMEM;
  84
  85         env.sess_mpool = rte_cryptodev_sym_session_pool_create(
  86                         "FIPS_SESS_MEMPOOL", 16, 0, 0, 0, rte_socket_id());
  87         if (!env.sess_mpool)
  88                 goto error_exit;
  89
  90         env.sess_priv_mpool = rte_mempool_create("FIPS_SESS_PRIV_MEMPOOL",
  91                         16, sess_sz, 0, 0, NULL, NULL, NULL,
  92                         NULL, rte_socket_id(), 0);
  93         if (!env.sess_priv_mpool)
  94                 goto error_exit;
  95
  96         env.op_pool = rte_crypto_op_pool_create(
  97                         "FIPS_OP_POOL",
  98                         RTE_CRYPTO_OP_TYPE_SYMMETRIC,
  99                         1, 0,
 100                         16,
 101                         rte_socket_id());
 102         if (!env.op_pool)
 103                 goto error_exit;
 104
 105         env.mbuf = rte_pktmbuf_alloc(env.mpool);
 106         if (!env.mbuf)
 107                 goto error_exit;
 108
 109         env.op = rte_crypto_op_alloc(env.op_pool, RTE_CRYPTO_OP_TYPE_SYMMETRIC);
 110         if (!env.op)
 111                 goto error_exit;
 112
 113         qp_conf.mp_session = env.sess_mpool;
 114         qp_conf.mp_session_private = env.sess_priv_mpool;
 115
 116         ret = rte_cryptodev_queue_pair_setup(env.dev_id, 0, &qp_conf,
 117                         rte_socket_id());
 118         if (ret < 0)
 119                 goto error_exit;
 120
 121         return 0;
 122
 123 error_exit:
 124
 125         rte_mempool_free(env.mpool);
 126         if (env.sess_mpool)
 127                 rte_mempool_free(env.sess_mpool);
 128         if (env.sess_priv_mpool)
 129                 rte_mempool_free(env.sess_priv_mpool);
 130         if (env.op_pool)
 131                 rte_mempool_free(env.op_pool);
 132
 133         return ret;
 134 }
 135
 136 static void
 137 cryptodev_fips_validate_app_uninit(void)
 138 {
 139         rte_pktmbuf_free(env.mbuf);
 140         rte_crypto_op_free(env.op);
 141         rte_cryptodev_sym_session_clear(env.dev_id, env.sess);
 142         rte_cryptodev_sym_session_free(env.sess);
 143         rte_mempool_free(env.mpool);
 144         rte_mempool_free(env.sess_mpool);
 145         rte_mempool_free(env.sess_priv_mpool);
 146         rte_mempool_free(env.op_pool);
 147 }
 148
 149 static int
 150 fips_test_one_file(void);
 151
 152 static int
 153 parse_cryptodev_arg(char *arg)
 154 {
 155         int id = rte_cryptodev_get_dev_id(arg);
 156
 157         if (id < 0) {
 158                 RTE_LOG(ERR, USER1, "Error %i: invalid cryptodev name %s\n",
 159                                 id, arg);
 160                 return id;
 161         }
 162
 163         env.dev_id = (uint32_t)id;
 164
 165         return 0;
 166 }
 167
 168 static int
 169 parse_cryptodev_id_arg(char *arg)
 170 {
 171         uint32_t cryptodev_id;
 172
 173         if (parser_read_uint32(&cryptodev_id, arg) < 0) {
 174                 RTE_LOG(ERR, USER1, "Error %i: invalid cryptodev id %s\n",
 175                                 -EINVAL, arg);
 176                 return -1;
 177         }
 178
 179
 180         if (!rte_cryptodev_pmd_is_valid_dev(cryptodev_id)) {
 181                 RTE_LOG(ERR, USER1, "Error %i: invalid cryptodev id %s\n",
 182                                 cryptodev_id, arg);
 183                 return -1;
 184         }
 185
 186         env.dev_id = (uint32_t)cryptodev_id;
 187
 188         return 0;
 189 }
 190
 191 static void
 192 cryptodev_fips_validate_usage(const char *prgname)
 193 {
 194         printf("%s [EAL options] --\n"
 195                 "  --%s: REQUEST-FILE-PATH\n"
 196                 "  --%s: RESPONSE-FILE-PATH\n"
 197                 "  --%s: indicating both paths are folders\n"
 198                 "  --%s: CRYPTODEV-NAME\n"
 199                 "  --%s: CRYPTODEV-ID-NAME\n"
 200                 "  --%s: self test indicator\n"
 201                 "  --%s: self broken test ID\n"
 202                 "  --%s: self broken test direction\n",
 203                 prgname, REQ_FILE_PATH_KEYWORD, RSP_FILE_PATH_KEYWORD,
 204                 FOLDER_KEYWORD, CRYPTODEV_KEYWORD, CRYPTODEV_ID_KEYWORD,
 205                 CRYPTODEV_ST_KEYWORD, CRYPTODEV_BK_ID_KEYWORD,
 206                 CRYPTODEV_BK_DIR_KEY);
 207 }
 208
 209 static int
 210 cryptodev_fips_validate_parse_args(int argc, char **argv)
 211 {
 212         int opt, ret;
 213         char *prgname = argv[0];
 214         char **argvopt;
 215         int option_index;
 216         struct option lgopts[] = {
 217                         {REQ_FILE_PATH_KEYWORD, required_argument, 0, 0},
 218                         {RSP_FILE_PATH_KEYWORD, required_argument, 0, 0},
 219                         {FOLDER_KEYWORD, no_argument, 0, 0},
 220                         {CRYPTODEV_KEYWORD, required_argument, 0, 0},
 221                         {CRYPTODEV_ID_KEYWORD, required_argument, 0, 0},
 222                         {CRYPTODEV_ST_KEYWORD, no_argument, 0, 0},
 223                         {CRYPTODEV_BK_ID_KEYWORD, required_argument, 0, 0},
 224                         {CRYPTODEV_BK_DIR_KEY, required_argument, 0, 0},
 225                         {NULL, 0, 0, 0}
 226         };
 227
 228         argvopt = argv;
 229
 230         while ((opt = getopt_long(argc, argvopt, "s:",
 231                                   lgopts, &option_index)) != EOF) {
 232
 233                 switch (opt) {
 234                 case 0:
 235                         if (strcmp(lgopts[option_index].name,
 236                                         REQ_FILE_PATH_KEYWORD) == 0)
 237                                 env.req_path = optarg;
 238                         else if (strcmp(lgopts[option_index].name,
 239                                         RSP_FILE_PATH_KEYWORD) == 0)
 240                                 env.rsp_path = optarg;
 241                         else if (strcmp(lgopts[option_index].name,
 242                                         FOLDER_KEYWORD) == 0)
 243                                 env.is_path_folder = 1;
 244                         else if (strcmp(lgopts[option_index].name,
 245                                         CRYPTODEV_KEYWORD) == 0) {
 246                                 ret = parse_cryptodev_arg(optarg);
 247                                 if (ret < 0) {
 248                                         cryptodev_fips_validate_usage(prgname);
 249                                         return -EINVAL;
 250                                 }
 251                         } else if (strcmp(lgopts[option_index].name,
 252                                         CRYPTODEV_ID_KEYWORD) == 0) {
 253                                 ret = parse_cryptodev_id_arg(optarg);
 254                                 if (ret < 0) {
 255                                         cryptodev_fips_validate_usage(prgname);
 256                                         return -EINVAL;
 257                                 }
 258                         } else if (strcmp(lgopts[option_index].name,
 259                                         CRYPTODEV_ST_KEYWORD) == 0) {
 260                                 env.self_test = 1;
 261                         } else if (strcmp(lgopts[option_index].name,
 262                                         CRYPTODEV_BK_ID_KEYWORD) == 0) {
 263                                 if (!env.broken_test_config) {
 264                                         env.broken_test_config = rte_malloc(
 265                                                 NULL,
 266                                                 sizeof(*env.broken_test_config),
 267                                                 0);
 268                                         if (!env.broken_test_config)
 269                                                 return -ENOMEM;
 270
 271                                         env.broken_test_config->expect_fail_dir =
 272                                                 self_test_dir_enc_auth_gen;
 273                                 }
 274
 275                                 if (parser_read_uint32(
 276                                         &env.broken_test_config->expect_fail_test_idx,
 277                                                 optarg) < 0) {
 278                                         rte_free(env.broken_test_config);
 279                                         cryptodev_fips_validate_usage(prgname);
 280                                         return -EINVAL;
 281                                 }
 282                         } else if (strcmp(lgopts[option_index].name,
 283                                         CRYPTODEV_BK_DIR_KEY) == 0) {
 284                                 if (!env.broken_test_config) {
 285                                         env.broken_test_config = rte_malloc(
 286                                                 NULL,
 287                                                 sizeof(*env.broken_test_config),
 288                                                 0);
 289                                         if (!env.broken_test_config)
 290                                                 return -ENOMEM;
 291
 292                                         env.broken_test_config->
 293                                                 expect_fail_test_idx = 0;
 294                                 }
 295
 296                                 if (strcmp(optarg, CRYPTODEV_ENC_KEYWORD) == 0)
 297                                         env.broken_test_config->expect_fail_dir =
 298                                                 self_test_dir_enc_auth_gen;
 299                                 else if (strcmp(optarg, CRYPTODEV_DEC_KEYWORD)
 300                                                 == 0)
 301                                         env.broken_test_config->expect_fail_dir =
 302                                                 self_test_dir_dec_auth_verify;
 303                                 else {
 304                                         rte_free(env.broken_test_config);
 305                                         cryptodev_fips_validate_usage(prgname);
 306                                         return -EINVAL;
 307                                 }
 308                         } else {
 309                                 cryptodev_fips_validate_usage(prgname);
 310                                 return -EINVAL;
 311                         }
 312                         break;
 313                 default:
 314                         return -1;
 315                 }
 316         }
 317
 318         if (env.dev_id == UINT32_MAX) {
 319                 RTE_LOG(ERR, USER1, "No device specified\n");
 320                 cryptodev_fips_validate_usage(prgname);
 321                 return -EINVAL;
 322         }
 323
 324         if ((env.req_path == NULL && env.rsp_path != NULL) ||
 325                         (env.req_path != NULL && env.rsp_path == NULL)) {
 326                 RTE_LOG(ERR, USER1, "Missing req path or rsp path\n");
 327                 cryptodev_fips_validate_usage(prgname);
 328                 return -EINVAL;
 329         }
 330
 331         if (env.req_path == NULL && env.self_test == 0) {
 332                 RTE_LOG(ERR, USER1, "--self-test must be set if req path is missing\n");
 333                 cryptodev_fips_validate_usage(prgname);
 334                 return -EINVAL;
 335         }
 336
 337         return 0;
 338 }
 339
 340 int
 341 main(int argc, char *argv[])
 342 {
 343         int ret;
 344
 345         ret = rte_eal_init(argc, argv);
 346         if (ret < 0) {
 347                 RTE_LOG(ERR, USER1, "Error %i: Failed init\n", ret);
 348                 return -1;
 349         }
 350
 351         argc -= ret;
 352         argv += ret;
 353
 354         ret = cryptodev_fips_validate_parse_args(argc, argv);
 355         if (ret < 0)
 356                 rte_exit(EXIT_FAILURE, "Failed to parse arguments!\n");
 357
 358         ret = cryptodev_fips_validate_app_int();
 359         if (ret < 0) {
 360                 RTE_LOG(ERR, USER1, "Error %i: Failed init\n", ret);
 361                 return -1;
 362         }
 363
 364         if (env.req_path == NULL || env.rsp_path == NULL) {
 365                 printf("No request, exit.\n");
 366                 goto exit;
 367         }
 368
 369         if (!env.is_path_folder) {
 370                 printf("Processing file %s... ", env.req_path);
 371
 372                 ret = fips_test_init(env.req_path, env.rsp_path,
 373                         rte_cryptodev_name_get(env.dev_id));
 374                 if (ret < 0) {
 375                         RTE_LOG(ERR, USER1, "Error %i: Failed test %s\n",
 376                                         ret, env.req_path);
 377                         goto exit;
 378                 }
 379
 380
 381                 ret = fips_test_one_file();
 382                 if (ret < 0) {
 383                         RTE_LOG(ERR, USER1, "Error %i: Failed test %s\n",
 384                                         ret, env.req_path);
 385                         goto exit;
 386                 }
 387
 388                 printf("Done\n");
 389
 390         } else {
 391                 struct dirent *dir;
 392                 DIR *d_req, *d_rsp;
 393                 char req_path[1024];
 394                 char rsp_path[1024];
 395
 396                 d_req = opendir(env.req_path);
 397                 if (!d_req) {
 398                         RTE_LOG(ERR, USER1, "Error %i: Path %s not exist\n",
 399                                         -EINVAL, env.req_path);
 400                         goto exit;
 401                 }
 402
 403                 d_rsp = opendir(env.rsp_path);
 404                 if (!d_rsp) {
 405                         ret = mkdir(env.rsp_path, 0700);
 406                         if (ret == 0)
 407                                 d_rsp = opendir(env.rsp_path);
 408                         else {
 409                                 RTE_LOG(ERR, USER1, "Error %i: Invalid %s\n",
 410                                                 -EINVAL, env.rsp_path);
 411                                 goto exit;
 412                         }
 413                 }
 414                 closedir(d_rsp);
 415
 416                 while ((dir = readdir(d_req)) != NULL) {
 417                         if (strstr(dir->d_name, "req") == NULL)
 418                                 continue;
 419
 420                         snprintf(req_path, 1023, "%s/%s", env.req_path,
 421                                         dir->d_name);
 422                         snprintf(rsp_path, 1023, "%s/%s", env.rsp_path,
 423                                         dir->d_name);
 424                         strlcpy(strstr(rsp_path, "req"), "rsp", 4);
 425
 426                         printf("Processing file %s... ", req_path);
 427
 428                         ret = fips_test_init(req_path, rsp_path,
 429                         rte_cryptodev_name_get(env.dev_id));
 430                         if (ret < 0) {
 431                                 RTE_LOG(ERR, USER1, "Error %i: Failed test %s\n",
 432                                                 ret, req_path);
 433                                 break;
 434                         }
 435
 436                         ret = fips_test_one_file();
 437                         if (ret < 0) {
 438                                 RTE_LOG(ERR, USER1, "Error %i: Failed test %s\n",
 439                                                 ret, req_path);
 440                                 break;
 441                         }
 442
 443                         printf("Done\n");
 444                 }
 445
 446                 closedir(d_req);
 447         }
 448
 449
 450 exit:
 451         fips_test_clear();
 452         cryptodev_fips_validate_app_uninit();
 453
 454         return ret;
 455
 456 }
 457
 458 #define IV_OFF (sizeof(struct rte_crypto_op) + sizeof(struct rte_crypto_sym_op))
 459 #define CRYPTODEV_FIPS_MAX_RETRIES      16
 460
 461 typedef int (*fips_test_one_case_t)(void);
 462 typedef int (*fips_prepare_op_t)(void);
 463 typedef int (*fips_prepare_xform_t)(struct rte_crypto_sym_xform *);
 464
 465 struct fips_test_ops {
 466         fips_prepare_xform_t prepare_xform;
 467         fips_prepare_op_t prepare_op;
 468         fips_test_one_case_t test;
 469 } test_ops;
 470
 471 static int
 472 prepare_cipher_op(void)
 473 {
 474         struct rte_crypto_sym_op *sym = env.op->sym;
 475         uint8_t *iv = rte_crypto_op_ctod_offset(env.op, uint8_t *, IV_OFF);
 476
 477         __rte_crypto_op_reset(env.op, RTE_CRYPTO_OP_TYPE_SYMMETRIC);
 478         rte_pktmbuf_reset(env.mbuf);
 479
 480         sym->m_src = env.mbuf;
 481         sym->cipher.data.offset = 0;
 482
 483         memcpy(iv, vec.iv.val, vec.iv.len);
 484
 485         if (info.op == FIPS_TEST_ENC_AUTH_GEN) {
 486                 uint8_t *pt;
 487
 488                 if (vec.pt.len > RTE_MBUF_MAX_NB_SEGS) {
 489                         RTE_LOG(ERR, USER1, "PT len %u\n", vec.pt.len);
 490                         return -EPERM;
 491                 }
 492
 493                 pt = (uint8_t *)rte_pktmbuf_append(env.mbuf, vec.pt.len);
 494
 495                 if (!pt) {
 496                         RTE_LOG(ERR, USER1, "Error %i: MBUF too small\n",
 497                                         -ENOMEM);
 498                         return -ENOMEM;
 499                 }
 500
 501                 memcpy(pt, vec.pt.val, vec.pt.len);
 502                 sym->cipher.data.length = vec.pt.len;
 503
 504         } else {
 505                 uint8_t *ct;
 506
 507                 if (vec.ct.len > RTE_MBUF_MAX_NB_SEGS) {
 508                         RTE_LOG(ERR, USER1, "CT len %u\n", vec.ct.len);
 509                         return -EPERM;
 510                 }
 511
 512                 ct = (uint8_t *)rte_pktmbuf_append(env.mbuf, vec.ct.len);
 513
 514                 if (!ct) {
 515                         RTE_LOG(ERR, USER1, "Error %i: MBUF too small\n",
 516                                         -ENOMEM);
 517                         return -ENOMEM;
 518                 }
 519
 520                 memcpy(ct, vec.ct.val, vec.ct.len);
 521                 sym->cipher.data.length = vec.ct.len;
 522         }
 523
 524         rte_crypto_op_attach_sym_session(env.op, env.sess);
 525
 526         return 0;
 527 }
 528
 529 static int
 530 prepare_auth_op(void)
 531 {
 532         struct rte_crypto_sym_op *sym = env.op->sym;
 533         uint8_t *pt;
 534
 535         __rte_crypto_op_reset(env.op, RTE_CRYPTO_OP_TYPE_SYMMETRIC);
 536         rte_pktmbuf_reset(env.mbuf);
 537
 538         sym->m_src = env.mbuf;
 539         sym->auth.data.offset = 0;
 540
 541         pt = (uint8_t *)rte_pktmbuf_append(env.mbuf, vec.pt.len +
 542                         vec.cipher_auth.digest.len);
 543
 544         if (!pt) {
 545                 RTE_LOG(ERR, USER1, "Error %i: MBUF too small\n",
 546                                 -ENOMEM);
 547                 return -ENOMEM;
 548         }
 549
 550         sym->auth.data.length = vec.pt.len;
 551         sym->auth.digest.data = pt + vec.pt.len;
 552         sym->auth.digest.phys_addr = rte_pktmbuf_iova_offset(
 553                         env.mbuf, vec.pt.len);
 554
 555         memcpy(pt, vec.pt.val, vec.pt.len);
 556
 557         if (info.op == FIPS_TEST_DEC_AUTH_VERIF)
 558                 memcpy(pt + vec.pt.len, vec.cipher_auth.digest.val,
 559                                 vec.cipher_auth.digest.len);
 560
 561         rte_crypto_op_attach_sym_session(env.op, env.sess);
 562
 563         return 0;
 564 }
 565
 566 static int
 567 prepare_aead_op(void)
 568 {
 569         struct rte_crypto_sym_op *sym = env.op->sym;
 570         uint8_t *iv = rte_crypto_op_ctod_offset(env.op, uint8_t *, IV_OFF);
 571
 572         __rte_crypto_op_reset(env.op, RTE_CRYPTO_OP_TYPE_SYMMETRIC);
 573         rte_pktmbuf_reset(env.mbuf);
 574
 575         if (info.algo == FIPS_TEST_ALGO_AES_CCM)
 576                 memcpy(iv + 1, vec.iv.val, vec.iv.len);
 577         else
 578                 memcpy(iv, vec.iv.val, vec.iv.len);
 579
 580         sym->m_src = env.mbuf;
 581         sym->aead.data.offset = 0;
 582         sym->aead.aad.data = vec.aead.aad.val;
 583         sym->aead.aad.phys_addr = rte_malloc_virt2iova(sym->aead.aad.data);
 584
 585         if (info.op == FIPS_TEST_ENC_AUTH_GEN) {
 586                 uint8_t *pt;
 587
 588                 if (vec.pt.len > RTE_MBUF_MAX_NB_SEGS) {
 589                         RTE_LOG(ERR, USER1, "PT len %u\n", vec.pt.len);
 590                         return -EPERM;
 591                 }
 592
 593                 pt = (uint8_t *)rte_pktmbuf_append(env.mbuf,
 594                                 vec.pt.len + vec.aead.digest.len);
 595
 596                 if (!pt) {
 597                         RTE_LOG(ERR, USER1, "Error %i: MBUF too small\n",
 598                                         -ENOMEM);
 599                         return -ENOMEM;
 600                 }
 601
 602                 memcpy(pt, vec.pt.val, vec.pt.len);
 603                 sym->aead.data.length = vec.pt.len;
 604                 sym->aead.digest.data = pt + vec.pt.len;
 605                 sym->aead.digest.phys_addr = rte_pktmbuf_iova_offset(
 606                                 env.mbuf, vec.pt.len);
 607         } else {
 608                 uint8_t *ct;
 609
 610                 if (vec.ct.len > RTE_MBUF_MAX_NB_SEGS) {
 611                         RTE_LOG(ERR, USER1, "CT len %u\n", vec.ct.len);
 612                         return -EPERM;
 613                 }
 614
 615                 ct = (uint8_t *)rte_pktmbuf_append(env.mbuf, vec.ct.len);
 616
 617                 if (!ct) {
 618                         RTE_LOG(ERR, USER1, "Error %i: MBUF too small\n",
 619                                         -ENOMEM);
 620                         return -ENOMEM;
 621                 }
 622
 623                 memcpy(ct, vec.ct.val, vec.ct.len);
 624                 sym->aead.data.length = vec.ct.len;
 625                 sym->aead.digest.data = vec.aead.digest.val;
 626                 sym->aead.digest.phys_addr = rte_malloc_virt2iova(
 627                                 sym->aead.digest.data);
 628         }
 629
 630         rte_crypto_op_attach_sym_session(env.op, env.sess);
 631
 632         return 0;
 633 }
 634
 635 static int
 636 prepare_aes_xform(struct rte_crypto_sym_xform *xform)
 637 {
 638         const struct rte_cryptodev_symmetric_capability *cap;
 639         struct rte_cryptodev_sym_capability_idx cap_idx;
 640         struct rte_crypto_cipher_xform *cipher_xform = &xform->cipher;
 641
 642         xform->type = RTE_CRYPTO_SYM_XFORM_CIPHER;
 643
 644         if (info.interim_info.aes_data.cipher_algo == RTE_CRYPTO_CIPHER_AES_CBC)
 645                 cipher_xform->algo = RTE_CRYPTO_CIPHER_AES_CBC;
 646         else
 647                 cipher_xform->algo = RTE_CRYPTO_CIPHER_AES_ECB;
 648
 649         cipher_xform->op = (info.op == FIPS_TEST_ENC_AUTH_GEN) ?
 650                         RTE_CRYPTO_CIPHER_OP_ENCRYPT :
 651                         RTE_CRYPTO_CIPHER_OP_DECRYPT;
 652         cipher_xform->key.data = vec.cipher_auth.key.val;
 653         cipher_xform->key.length = vec.cipher_auth.key.len;
 654         if (cipher_xform->algo == RTE_CRYPTO_CIPHER_AES_CBC) {
 655                 cipher_xform->iv.length = vec.iv.len;
 656                 cipher_xform->iv.offset = IV_OFF;
 657         } else {
 658                 cipher_xform->iv.length = 0;
 659                 cipher_xform->iv.offset = 0;
 660         }
 661         cap_idx.algo.cipher = cipher_xform->algo;
 662         cap_idx.type = RTE_CRYPTO_SYM_XFORM_CIPHER;
 663
 664         cap = rte_cryptodev_sym_capability_get(env.dev_id, &cap_idx);
 665         if (!cap) {
 666                 RTE_LOG(ERR, USER1, "Failed to get capability for cdev %u\n",
 667                                 env.dev_id);
 668                 return -EINVAL;
 669         }
 670
 671         if (rte_cryptodev_sym_capability_check_cipher(cap,
 672                         cipher_xform->key.length,
 673                         cipher_xform->iv.length) != 0) {
 674                 RTE_LOG(ERR, USER1, "PMD %s key length %u IV length %u\n",
 675                                 info.device_name, cipher_xform->key.length,
 676                                 cipher_xform->iv.length);
 677                 return -EPERM;
 678         }
 679
 680         return 0;
 681 }
 682
 683 static int
 684 prepare_tdes_xform(struct rte_crypto_sym_xform *xform)
 685 {
 686         const struct rte_cryptodev_symmetric_capability *cap;
 687         struct rte_cryptodev_sym_capability_idx cap_idx;
 688         struct rte_crypto_cipher_xform *cipher_xform = &xform->cipher;
 689
 690         xform->type = RTE_CRYPTO_SYM_XFORM_CIPHER;
 691
 692         if (info.interim_info.tdes_data.test_mode == TDES_MODE_CBC)
 693                 cipher_xform->algo = RTE_CRYPTO_CIPHER_3DES_CBC;
 694         else
 695                 cipher_xform->algo = RTE_CRYPTO_CIPHER_3DES_ECB;
 696         cipher_xform->op = (info.op == FIPS_TEST_ENC_AUTH_GEN) ?
 697                         RTE_CRYPTO_CIPHER_OP_ENCRYPT :
 698                         RTE_CRYPTO_CIPHER_OP_DECRYPT;
 699         cipher_xform->key.data = vec.cipher_auth.key.val;
 700         cipher_xform->key.length = vec.cipher_auth.key.len;
 701
 702         if (cipher_xform->algo == RTE_CRYPTO_CIPHER_3DES_CBC) {
 703                 cipher_xform->iv.length = vec.iv.len;
 704                 cipher_xform->iv.offset = IV_OFF;
 705         } else {
 706                 cipher_xform->iv.length = 0;
 707                 cipher_xform->iv.offset = 0;
 708         }
 709         cap_idx.algo.cipher = cipher_xform->algo;
 710         cap_idx.type = RTE_CRYPTO_SYM_XFORM_CIPHER;
 711
 712         cap = rte_cryptodev_sym_capability_get(env.dev_id, &cap_idx);
 713         if (!cap) {
 714                 RTE_LOG(ERR, USER1, "Failed to get capability for cdev %u\n",
 715                                 env.dev_id);
 716                 return -EINVAL;
 717         }
 718
 719         if (rte_cryptodev_sym_capability_check_cipher(cap,
 720                         cipher_xform->key.length,
 721                         cipher_xform->iv.length) != 0) {
 722                 RTE_LOG(ERR, USER1, "PMD %s key length %u IV length %u\n",
 723                                 info.device_name, cipher_xform->key.length,
 724                                 cipher_xform->iv.length);
 725                 return -EPERM;
 726         }
 727
 728         return 0;
 729 }
 730
 731 static int
 732 prepare_hmac_xform(struct rte_crypto_sym_xform *xform)
 733 {
 734         const struct rte_cryptodev_symmetric_capability *cap;
 735         struct rte_cryptodev_sym_capability_idx cap_idx;
 736         struct rte_crypto_auth_xform *auth_xform = &xform->auth;
 737
 738         xform->type = RTE_CRYPTO_SYM_XFORM_AUTH;
 739
 740         auth_xform->algo = info.interim_info.hmac_data.algo;
 741         auth_xform->op = RTE_CRYPTO_AUTH_OP_GENERATE;
 742         auth_xform->digest_length = vec.cipher_auth.digest.len;
 743         auth_xform->key.data = vec.cipher_auth.key.val;
 744         auth_xform->key.length = vec.cipher_auth.key.len;
 745
 746         cap_idx.algo.auth = auth_xform->algo;
 747         cap_idx.type = RTE_CRYPTO_SYM_XFORM_AUTH;
 748
 749         cap = rte_cryptodev_sym_capability_get(env.dev_id, &cap_idx);
 750         if (!cap) {
 751                 RTE_LOG(ERR, USER1, "Failed to get capability for cdev %u\n",
 752                                 env.dev_id);
 753                 return -EINVAL;
 754         }
 755
 756         if (rte_cryptodev_sym_capability_check_auth(cap,
 757                         auth_xform->key.length,
 758                         auth_xform->digest_length, 0) != 0) {
 759                 RTE_LOG(ERR, USER1, "PMD %s key length %u IV length %u\n",
 760                                 info.device_name, auth_xform->key.length,
 761                                 auth_xform->digest_length);
 762                 return -EPERM;
 763         }
 764
 765         return 0;
 766 }
 767
 768 static int
 769 prepare_gcm_xform(struct rte_crypto_sym_xform *xform)
 770 {
 771         const struct rte_cryptodev_symmetric_capability *cap;
 772         struct rte_cryptodev_sym_capability_idx cap_idx;
 773         struct rte_crypto_aead_xform *aead_xform = &xform->aead;
 774
 775         xform->type = RTE_CRYPTO_SYM_XFORM_AEAD;
 776
 777         aead_xform->algo = RTE_CRYPTO_AEAD_AES_GCM;
 778         aead_xform->aad_length = vec.aead.aad.len;
 779         aead_xform->digest_length = vec.aead.digest.len;
 780         aead_xform->iv.offset = IV_OFF;
 781         aead_xform->iv.length = vec.iv.len;
 782         aead_xform->key.data = vec.aead.key.val;
 783         aead_xform->key.length = vec.aead.key.len;
 784         aead_xform->op = (info.op == FIPS_TEST_ENC_AUTH_GEN) ?
 785                         RTE_CRYPTO_AEAD_OP_ENCRYPT :
 786                         RTE_CRYPTO_AEAD_OP_DECRYPT;
 787
 788         cap_idx.algo.aead = aead_xform->algo;
 789         cap_idx.type = RTE_CRYPTO_SYM_XFORM_AEAD;
 790
 791         cap = rte_cryptodev_sym_capability_get(env.dev_id, &cap_idx);
 792         if (!cap) {
 793                 RTE_LOG(ERR, USER1, "Failed to get capability for cdev %u\n",
 794                                 env.dev_id);
 795                 return -EINVAL;
 796         }
 797
 798         if (rte_cryptodev_sym_capability_check_aead(cap,
 799                         aead_xform->key.length,
 800                         aead_xform->digest_length, aead_xform->aad_length,
 801                         aead_xform->iv.length) != 0) {
 802                 RTE_LOG(ERR, USER1,
 803                         "PMD %s key_len %u tag_len %u aad_len %u iv_len %u\n",
 804                                 info.device_name, aead_xform->key.length,
 805                                 aead_xform->digest_length,
 806                                 aead_xform->aad_length,
 807                                 aead_xform->iv.length);
 808                 return -EPERM;
 809         }
 810
 811         return 0;
 812 }
 813
 814 static int
 815 prepare_cmac_xform(struct rte_crypto_sym_xform *xform)
 816 {
 817         const struct rte_cryptodev_symmetric_capability *cap;
 818         struct rte_cryptodev_sym_capability_idx cap_idx;
 819         struct rte_crypto_auth_xform *auth_xform = &xform->auth;
 820
 821         xform->type = RTE_CRYPTO_SYM_XFORM_AUTH;
 822
 823         auth_xform->algo = RTE_CRYPTO_AUTH_AES_CMAC;
 824         auth_xform->op = (info.op == FIPS_TEST_ENC_AUTH_GEN) ?
 825                         RTE_CRYPTO_AUTH_OP_GENERATE : RTE_CRYPTO_AUTH_OP_VERIFY;
 826         auth_xform->digest_length = vec.cipher_auth.digest.len;
 827         auth_xform->key.data = vec.cipher_auth.key.val;
 828         auth_xform->key.length = vec.cipher_auth.key.len;
 829
 830         cap_idx.algo.auth = auth_xform->algo;
 831         cap_idx.type = RTE_CRYPTO_SYM_XFORM_AUTH;
 832
 833         cap = rte_cryptodev_sym_capability_get(env.dev_id, &cap_idx);
 834         if (!cap) {
 835                 RTE_LOG(ERR, USER1, "Failed to get capability for cdev %u\n",
 836                                 env.dev_id);
 837                 return -EINVAL;
 838         }
 839
 840         if (rte_cryptodev_sym_capability_check_auth(cap,
 841                         auth_xform->key.length,
 842                         auth_xform->digest_length, 0) != 0) {
 843                 RTE_LOG(ERR, USER1, "PMD %s key length %u IV length %u\n",
 844                                 info.device_name, auth_xform->key.length,
 845                                 auth_xform->digest_length);
 846                 return -EPERM;
 847         }
 848
 849         return 0;
 850 }
 851
 852 static int
 853 prepare_ccm_xform(struct rte_crypto_sym_xform *xform)
 854 {
 855         const struct rte_cryptodev_symmetric_capability *cap;
 856         struct rte_cryptodev_sym_capability_idx cap_idx;
 857         struct rte_crypto_aead_xform *aead_xform = &xform->aead;
 858
 859         xform->type = RTE_CRYPTO_SYM_XFORM_AEAD;
 860
 861         aead_xform->algo = RTE_CRYPTO_AEAD_AES_CCM;
 862         aead_xform->aad_length = vec.aead.aad.len;
 863         aead_xform->digest_length = vec.aead.digest.len;
 864         aead_xform->iv.offset = IV_OFF;
 865         aead_xform->iv.length = vec.iv.len;
 866         aead_xform->key.data = vec.aead.key.val;
 867         aead_xform->key.length = vec.aead.key.len;
 868         aead_xform->op = (info.op == FIPS_TEST_ENC_AUTH_GEN) ?
 869                         RTE_CRYPTO_AEAD_OP_ENCRYPT :
 870                         RTE_CRYPTO_AEAD_OP_DECRYPT;
 871
 872         cap_idx.algo.aead = aead_xform->algo;
 873         cap_idx.type = RTE_CRYPTO_SYM_XFORM_AEAD;
 874
 875         cap = rte_cryptodev_sym_capability_get(env.dev_id, &cap_idx);
 876         if (!cap) {
 877                 RTE_LOG(ERR, USER1, "Failed to get capability for cdev %u\n",
 878                                 env.dev_id);
 879                 return -EINVAL;
 880         }
 881
 882         if (rte_cryptodev_sym_capability_check_aead(cap,
 883                         aead_xform->key.length,
 884                         aead_xform->digest_length, aead_xform->aad_length,
 885                         aead_xform->iv.length) != 0) {
 886                 RTE_LOG(ERR, USER1,
 887                         "PMD %s key_len %u tag_len %u aad_len %u iv_len %u\n",
 888                                 info.device_name, aead_xform->key.length,
 889                                 aead_xform->digest_length,
 890                                 aead_xform->aad_length,
 891                                 aead_xform->iv.length);
 892                 return -EPERM;
 893         }
 894
 895         return 0;
 896 }
 897
 898 static int
 899 prepare_sha_xform(struct rte_crypto_sym_xform *xform)
 900 {
 901         const struct rte_cryptodev_symmetric_capability *cap;
 902         struct rte_cryptodev_sym_capability_idx cap_idx;
 903         struct rte_crypto_auth_xform *auth_xform = &xform->auth;
 904
 905         xform->type = RTE_CRYPTO_SYM_XFORM_AUTH;
 906
 907         auth_xform->algo = info.interim_info.sha_data.algo;
 908         auth_xform->op = RTE_CRYPTO_AUTH_OP_GENERATE;
 909         auth_xform->digest_length = vec.cipher_auth.digest.len;
 910
 911         cap_idx.algo.auth = auth_xform->algo;
 912         cap_idx.type = RTE_CRYPTO_SYM_XFORM_AUTH;
 913
 914         cap = rte_cryptodev_sym_capability_get(env.dev_id, &cap_idx);
 915         if (!cap) {
 916                 RTE_LOG(ERR, USER1, "Failed to get capability for cdev %u\n",
 917                                 env.dev_id);
 918                 return -EINVAL;
 919         }
 920
 921         if (rte_cryptodev_sym_capability_check_auth(cap,
 922                         auth_xform->key.length,
 923                         auth_xform->digest_length, 0) != 0) {
 924                 RTE_LOG(ERR, USER1, "PMD %s key length %u digest length %u\n",
 925                                 info.device_name, auth_xform->key.length,
 926                                 auth_xform->digest_length);
 927                 return -EPERM;
 928         }
 929
 930         return 0;
 931 }
 932
 933 static int
 934 prepare_xts_xform(struct rte_crypto_sym_xform *xform)
 935 {
 936         const struct rte_cryptodev_symmetric_capability *cap;
 937         struct rte_cryptodev_sym_capability_idx cap_idx;
 938         struct rte_crypto_cipher_xform *cipher_xform = &xform->cipher;
 939
 940         xform->type = RTE_CRYPTO_SYM_XFORM_CIPHER;
 941
 942         cipher_xform->algo = RTE_CRYPTO_CIPHER_AES_XTS;
 943         cipher_xform->op = (info.op == FIPS_TEST_ENC_AUTH_GEN) ?
 944                         RTE_CRYPTO_CIPHER_OP_ENCRYPT :
 945                         RTE_CRYPTO_CIPHER_OP_DECRYPT;
 946         cipher_xform->key.data = vec.cipher_auth.key.val;
 947         cipher_xform->key.length = vec.cipher_auth.key.len;
 948         cipher_xform->iv.length = vec.iv.len;
 949         cipher_xform->iv.offset = IV_OFF;
 950
 951         cap_idx.algo.cipher = RTE_CRYPTO_CIPHER_AES_XTS;
 952         cap_idx.type = RTE_CRYPTO_SYM_XFORM_CIPHER;
 953
 954         cap = rte_cryptodev_sym_capability_get(env.dev_id, &cap_idx);
 955         if (!cap) {
 956                 RTE_LOG(ERR, USER1, "Failed to get capability for cdev %u\n",
 957                                 env.dev_id);
 958                 return -EINVAL;
 959         }
 960
 961         if (rte_cryptodev_sym_capability_check_cipher(cap,
 962                         cipher_xform->key.length,
 963                         cipher_xform->iv.length) != 0) {
 964                 RTE_LOG(ERR, USER1, "PMD %s key length %u IV length %u\n",
 965                                 info.device_name, cipher_xform->key.length,
 966                                 cipher_xform->iv.length);
 967                 return -EPERM;
 968         }
 969
 970         return 0;
 971 }
 972
 973 static void
 974 get_writeback_data(struct fips_val *val)
 975 {
 976         val->val = rte_pktmbuf_mtod(env.mbuf, uint8_t *);
 977         val->len = rte_pktmbuf_pkt_len(env.mbuf);
 978 }
 979
 980 static int
 981 fips_run_test(void)
 982 {
 983         struct rte_crypto_sym_xform xform = {0};
 984         uint16_t n_deqd;
 985         int ret;
 986
 987         ret = test_ops.prepare_xform(&xform);
 988         if (ret < 0)
 989                 return ret;
 990
 991         env.sess = rte_cryptodev_sym_session_create(env.sess_mpool);
 992         if (!env.sess)
 993                 return -ENOMEM;
 994
 995         ret = rte_cryptodev_sym_session_init(env.dev_id,
 996                         env.sess, &xform, env.sess_priv_mpool);
 997         if (ret < 0) {
 998                 RTE_LOG(ERR, USER1, "Error %i: Init session\n",
 999                                 ret);
1000                 goto exit;
1001         }
1002
1003         ret = test_ops.prepare_op();
1004         if (ret < 0) {
1005                 RTE_LOG(ERR, USER1, "Error %i: Prepare op\n",
1006                                 ret);
1007                 goto exit;
1008         }
1009
1010         if (rte_cryptodev_enqueue_burst(env.dev_id, 0, &env.op, 1) < 1) {
1011                 RTE_LOG(ERR, USER1, "Error: Failed enqueue\n");
1012                 ret = -1;
1013                 goto exit;
1014         }
1015
1016         do {
1017                 struct rte_crypto_op *deqd_op;
1018
1019                 n_deqd = rte_cryptodev_dequeue_burst(env.dev_id, 0, &deqd_op,
1020                                 1);
1021         } while (n_deqd == 0);
1022
1023         vec.status = env.op->status;
1024
1025 exit:
1026         rte_cryptodev_sym_session_clear(env.dev_id, env.sess);
1027         rte_cryptodev_sym_session_free(env.sess);
1028         env.sess = NULL;
1029
1030         return ret;
1031 }
1032
1033 static int
1034 fips_generic_test(void)
1035 {
1036         struct fips_val val;
1037         int ret;
1038
1039         fips_test_write_one_case();
1040
1041         ret = fips_run_test();
1042         if (ret < 0) {
1043                 if (ret == -EPERM || ret == -ENOTSUP) {
1044                         fprintf(info.fp_wr, "Bypass\n\n");
1045                         return 0;
1046                 }
1047
1048                 return ret;
1049         }
1050
1051         get_writeback_data(&val);
1052
1053         switch (info.file_type) {
1054         case FIPS_TYPE_REQ:
1055         case FIPS_TYPE_RSP:
1056                 if (info.parse_writeback == NULL)
1057                         return -EPERM;
1058                 ret = info.parse_writeback(&val);
1059                 if (ret < 0)
1060                         return ret;
1061                 break;
1062         case FIPS_TYPE_FAX:
1063                 if (info.kat_check == NULL)
1064                         return -EPERM;
1065                 ret = info.kat_check(&val);
1066                 if (ret < 0)
1067                         return ret;
1068                 break;
1069         }
1070
1071         fprintf(info.fp_wr, "\n");
1072
1073         return 0;
1074 }
1075
1076 static int
1077 fips_mct_tdes_test(void)
1078 {
1079 #define TDES_BLOCK_SIZE         8
1080 #define TDES_EXTERN_ITER        400
1081 #define TDES_INTERN_ITER        10000
1082         struct fips_val val, val_key;
1083         uint8_t prev_out[TDES_BLOCK_SIZE] = {0};
1084         uint8_t prev_prev_out[TDES_BLOCK_SIZE] = {0};
1085         uint8_t prev_in[TDES_BLOCK_SIZE] = {0};
1086         uint32_t i, j, k;
1087         int ret;
1088         int test_mode = info.interim_info.tdes_data.test_mode;
1089
1090         for (i = 0; i < TDES_EXTERN_ITER; i++) {
1091                 if ((i == 0) && (info.version == 21.4f)) {
1092                         if (!(strstr(info.vec[0], "COUNT")))
1093                                 fprintf(info.fp_wr, "%s%u\n", "COUNT = ", 0);
1094                 }
1095
1096                 if (i != 0)
1097                         update_info_vec(i);
1098
1099                 fips_test_write_one_case();
1100
1101                 for (j = 0; j < TDES_INTERN_ITER; j++) {
1102                         ret = fips_run_test();
1103                         if (ret < 0) {
1104                                 if (ret == -EPERM) {
1105                                         fprintf(info.fp_wr, "Bypass\n");
1106                                         return 0;
1107                                 }
1108                                 return ret;
1109                         }
1110
1111                         get_writeback_data(&val);
1112
1113                         if (info.op == FIPS_TEST_DEC_AUTH_VERIF)
1114                                 memcpy(prev_in, vec.ct.val, TDES_BLOCK_SIZE);
1115
1116                         if (j == 0) {
1117                                 memcpy(prev_out, val.val, TDES_BLOCK_SIZE);
1118
1119                                 if (info.op == FIPS_TEST_ENC_AUTH_GEN) {
1120                                         if (test_mode == TDES_MODE_ECB) {
1121                                                 memcpy(vec.pt.val, val.val,
1122                                                            TDES_BLOCK_SIZE);
1123                                         } else {
1124                                                 memcpy(vec.pt.val, vec.iv.val,
1125                                                            TDES_BLOCK_SIZE);
1126                                                 memcpy(vec.iv.val, val.val,
1127                                                            TDES_BLOCK_SIZE);
1128                                         }
1129
1130                                 } else {
1131                                         if (test_mode == TDES_MODE_ECB) {
1132                                                 memcpy(vec.ct.val, val.val,
1133                                                            TDES_BLOCK_SIZE);
1134                                         } else {
1135                                                 memcpy(vec.iv.val, vec.ct.val,
1136                                                            TDES_BLOCK_SIZE);
1137                                                 memcpy(vec.ct.val, val.val,
1138                                                            TDES_BLOCK_SIZE);
1139                                         }
1140                                 }
1141                                 continue;
1142                         }
1143
1144                         if (info.op == FIPS_TEST_ENC_AUTH_GEN) {
1145                                 if (test_mode == TDES_MODE_ECB) {
1146                                         memcpy(vec.pt.val, val.val,
1147                                                    TDES_BLOCK_SIZE);
1148                                 } else {
1149                                         memcpy(vec.iv.val, val.val,
1150                                                    TDES_BLOCK_SIZE);
1151                                         memcpy(vec.pt.val, prev_out,
1152                                                    TDES_BLOCK_SIZE);
1153                                 }
1154                         } else {
1155                                 if (test_mode == TDES_MODE_ECB) {
1156                                         memcpy(vec.ct.val, val.val,
1157                                                    TDES_BLOCK_SIZE);
1158                                 } else {
1159                                         memcpy(vec.iv.val, vec.ct.val,
1160                                                    TDES_BLOCK_SIZE);
1161                                         memcpy(vec.ct.val, val.val,
1162                                                    TDES_BLOCK_SIZE);
1163                                 }
1164                         }
1165
1166                         if (j == TDES_INTERN_ITER - 1)
1167                                 continue;
1168
1169                         memcpy(prev_out, val.val, TDES_BLOCK_SIZE);
1170
1171                         if (j == TDES_INTERN_ITER - 3)
1172                                 memcpy(prev_prev_out, val.val, TDES_BLOCK_SIZE);
1173                 }
1174
1175                 info.parse_writeback(&val);
1176                 fprintf(info.fp_wr, "\n");
1177
1178                 if (i == TDES_EXTERN_ITER - 1)
1179                         continue;
1180
1181                 /** update key */
1182                 memcpy(&val_key, &vec.cipher_auth.key, sizeof(val_key));
1183
1184                 if (info.interim_info.tdes_data.nb_keys == 0) {
1185                         if (memcmp(val_key.val, val_key.val + 8, 8) == 0)
1186                                 info.interim_info.tdes_data.nb_keys = 1;
1187                         else if (memcmp(val_key.val, val_key.val + 16, 8) == 0)
1188                                 info.interim_info.tdes_data.nb_keys = 2;
1189                         else
1190                                 info.interim_info.tdes_data.nb_keys = 3;
1191
1192                 }
1193
1194                 for (k = 0; k < TDES_BLOCK_SIZE; k++) {
1195
1196                         switch (info.interim_info.tdes_data.nb_keys) {
1197                         case 3:
1198                                 val_key.val[k] ^= val.val[k];
1199                                 val_key.val[k + 8] ^= prev_out[k];
1200                                 val_key.val[k + 16] ^= prev_prev_out[k];
1201                                 break;
1202                         case 2:
1203                                 val_key.val[k] ^= val.val[k];
1204                                 val_key.val[k + 8] ^= prev_out[k];
1205                                 val_key.val[k + 16] ^= val.val[k];
1206                                 break;
1207                         default: /* case 1 */
1208                                 val_key.val[k] ^= val.val[k];
1209                                 val_key.val[k + 8] ^= val.val[k];
1210                                 val_key.val[k + 16] ^= val.val[k];
1211                                 break;
1212                         }
1213
1214                 }
1215
1216                 for (k = 0; k < 24; k++)
1217                         val_key.val[k] = (__builtin_popcount(val_key.val[k]) &
1218                                         0x1) ?
1219                                         val_key.val[k] : (val_key.val[k] ^ 0x1);
1220
1221                 if (info.op == FIPS_TEST_ENC_AUTH_GEN) {
1222                         if (test_mode == TDES_MODE_ECB) {
1223                                 memcpy(vec.pt.val, val.val, TDES_BLOCK_SIZE);
1224                         } else {
1225                                 memcpy(vec.iv.val, val.val, TDES_BLOCK_SIZE);
1226                                 memcpy(vec.pt.val, prev_out, TDES_BLOCK_SIZE);
1227                         }
1228                 } else {
1229                         if (test_mode == TDES_MODE_ECB) {
1230                                 memcpy(vec.ct.val, val.val, TDES_BLOCK_SIZE);
1231                         } else {
1232                                 memcpy(vec.iv.val, prev_out, TDES_BLOCK_SIZE);
1233                                 memcpy(vec.ct.val, val.val, TDES_BLOCK_SIZE);
1234                         }
1235                 }
1236         }
1237
1238         return 0;
1239 }
1240
1241 static int
1242 fips_mct_aes_ecb_test(void)
1243 {
1244 #define AES_BLOCK_SIZE  16
1245 #define AES_EXTERN_ITER 100
1246 #define AES_INTERN_ITER 1000
1247         struct fips_val val, val_key;
1248         uint8_t prev_out[AES_BLOCK_SIZE] = {0};
1249         uint32_t i, j, k;
1250         int ret;
1251
1252         for (i = 0; i < AES_EXTERN_ITER; i++) {
1253                 if (i != 0)
1254                         update_info_vec(i);
1255
1256                 fips_test_write_one_case();
1257
1258                 for (j = 0; j < AES_INTERN_ITER; j++) {
1259                         ret = fips_run_test();
1260                         if (ret < 0) {
1261                                 if (ret == -EPERM) {
1262                                         fprintf(info.fp_wr, "Bypass\n");
1263                                         return 0;
1264                                 }
1265
1266                                 return ret;
1267                         }
1268
1269                         get_writeback_data(&val);
1270
1271                         if (info.op == FIPS_TEST_ENC_AUTH_GEN)
1272                                 memcpy(vec.pt.val, val.val, AES_BLOCK_SIZE);
1273                         else
1274                                 memcpy(vec.ct.val, val.val, AES_BLOCK_SIZE);
1275
1276                         if (j == AES_INTERN_ITER - 1)
1277                                 continue;
1278
1279                         memcpy(prev_out, val.val, AES_BLOCK_SIZE);
1280                 }
1281
1282                 info.parse_writeback(&val);
1283                 fprintf(info.fp_wr, "\n");
1284
1285                 if (i == AES_EXTERN_ITER - 1)
1286                         continue;
1287
1288                 /** update key */
1289                 memcpy(&val_key, &vec.cipher_auth.key, sizeof(val_key));
1290                 for (k = 0; k < vec.cipher_auth.key.len; k++) {
1291                         switch (vec.cipher_auth.key.len) {
1292                         case 16:
1293                                 val_key.val[k] ^= val.val[k];
1294                                 break;
1295                         case 24:
1296                                 if (k < 8)
1297                                         val_key.val[k] ^= prev_out[k + 8];
1298                                 else
1299                                         val_key.val[k] ^= val.val[k - 8];
1300                                 break;
1301                         case 32:
1302                                 if (k < 16)
1303                                         val_key.val[k] ^= prev_out[k];
1304                                 else
1305                                         val_key.val[k] ^= val.val[k - 16];
1306                                 break;
1307                         default:
1308                                 return -1;
1309                         }
1310                 }
1311         }
1312
1313         return 0;
1314 }
1315 static int
1316 fips_mct_aes_test(void)
1317 {
1318 #define AES_BLOCK_SIZE  16
1319 #define AES_EXTERN_ITER 100
1320 #define AES_INTERN_ITER 1000
1321         struct fips_val val, val_key;
1322         uint8_t prev_out[AES_BLOCK_SIZE] = {0};
1323         uint8_t prev_in[AES_BLOCK_SIZE] = {0};
1324         uint32_t i, j, k;
1325         int ret;
1326
1327         if (info.interim_info.aes_data.cipher_algo == RTE_CRYPTO_CIPHER_AES_ECB)
1328                 return fips_mct_aes_ecb_test();
1329
1330         for (i = 0; i < AES_EXTERN_ITER; i++) {
1331                 if (i != 0)
1332                         update_info_vec(i);
1333
1334                 fips_test_write_one_case();
1335
1336                 for (j = 0; j < AES_INTERN_ITER; j++) {
1337                         ret = fips_run_test();
1338                         if (ret < 0) {
1339                                 if (ret == -EPERM) {
1340                                         fprintf(info.fp_wr, "Bypass\n");
1341                                         return 0;
1342                                 }
1343
1344                                 return ret;
1345                         }
1346
1347                         get_writeback_data(&val);
1348
1349                         if (info.op == FIPS_TEST_DEC_AUTH_VERIF)
1350                                 memcpy(prev_in, vec.ct.val, AES_BLOCK_SIZE);
1351
1352                         if (j == 0) {
1353                                 memcpy(prev_out, val.val, AES_BLOCK_SIZE);
1354
1355                                 if (info.op == FIPS_TEST_ENC_AUTH_GEN) {
1356                                         memcpy(vec.pt.val, vec.iv.val,
1357                                                         AES_BLOCK_SIZE);
1358                                         memcpy(vec.iv.val, val.val,
1359                                                         AES_BLOCK_SIZE);
1360                                 } else {
1361                                         memcpy(vec.ct.val, vec.iv.val,
1362                                                         AES_BLOCK_SIZE);
1363                                         memcpy(vec.iv.val, prev_in,
1364                                                         AES_BLOCK_SIZE);
1365                                 }
1366                                 continue;
1367                         }
1368
1369                         if (info.op == FIPS_TEST_ENC_AUTH_GEN) {
1370                                 memcpy(vec.iv.val, val.val, AES_BLOCK_SIZE);
1371                                 memcpy(vec.pt.val, prev_out, AES_BLOCK_SIZE);
1372                         } else {
1373                                 memcpy(vec.iv.val, prev_in, AES_BLOCK_SIZE);
1374                                 memcpy(vec.ct.val, prev_out, AES_BLOCK_SIZE);
1375                         }
1376
1377                         if (j == AES_INTERN_ITER - 1)
1378                                 continue;
1379
1380                         memcpy(prev_out, val.val, AES_BLOCK_SIZE);
1381                 }
1382
1383                 info.parse_writeback(&val);
1384                 fprintf(info.fp_wr, "\n");
1385
1386                 if (i == AES_EXTERN_ITER - 1)
1387                         continue;
1388
1389                 /** update key */
1390                 memcpy(&val_key, &vec.cipher_auth.key, sizeof(val_key));
1391                 for (k = 0; k < vec.cipher_auth.key.len; k++) {
1392                         switch (vec.cipher_auth.key.len) {
1393                         case 16:
1394                                 val_key.val[k] ^= val.val[k];
1395                                 break;
1396                         case 24:
1397                                 if (k < 8)
1398                                         val_key.val[k] ^= prev_out[k + 8];
1399                                 else
1400                                         val_key.val[k] ^= val.val[k - 8];
1401                                 break;
1402                         case 32:
1403                                 if (k < 16)
1404                                         val_key.val[k] ^= prev_out[k];
1405                                 else
1406                                         val_key.val[k] ^= val.val[k - 16];
1407                                 break;
1408                         default:
1409                                 return -1;
1410                         }
1411                 }
1412
1413                 if (info.op == FIPS_TEST_DEC_AUTH_VERIF)
1414                         memcpy(vec.iv.val, val.val, AES_BLOCK_SIZE);
1415         }
1416
1417         return 0;
1418 }
1419
1420 static int
1421 fips_mct_sha_test(void)
1422 {
1423 #define SHA_EXTERN_ITER 100
1424 #define SHA_INTERN_ITER 1000
1425 #define SHA_MD_BLOCK    3
1426         struct fips_val val, md[SHA_MD_BLOCK];
1427         char temp[MAX_DIGEST_SIZE*2];
1428         int ret;
1429         uint32_t i, j;
1430
1431         val.val = rte_malloc(NULL, (MAX_DIGEST_SIZE*SHA_MD_BLOCK), 0);
1432         for (i = 0; i < SHA_MD_BLOCK; i++)
1433                 md[i].val = rte_malloc(NULL, (MAX_DIGEST_SIZE*2), 0);
1434
1435         rte_free(vec.pt.val);
1436         vec.pt.val = rte_malloc(NULL, (MAX_DIGEST_SIZE*SHA_MD_BLOCK), 0);
1437
1438         fips_test_write_one_case();
1439         fprintf(info.fp_wr, "\n");
1440
1441         for (j = 0; j < SHA_EXTERN_ITER; j++) {
1442
1443                 memcpy(md[0].val, vec.cipher_auth.digest.val,
1444                         vec.cipher_auth.digest.len);
1445                 md[0].len = vec.cipher_auth.digest.len;
1446                 memcpy(md[1].val, vec.cipher_auth.digest.val,
1447                         vec.cipher_auth.digest.len);
1448                 md[1].len = vec.cipher_auth.digest.len;
1449                 memcpy(md[2].val, vec.cipher_auth.digest.val,
1450                         vec.cipher_auth.digest.len);
1451                 md[2].len = vec.cipher_auth.digest.len;
1452
1453                 for (i = 0; i < (SHA_INTERN_ITER); i++) {
1454
1455                         memcpy(vec.pt.val, md[0].val,
1456                                 (size_t)md[0].len);
1457                         memcpy((vec.pt.val + md[0].len), md[1].val,
1458                                 (size_t)md[1].len);
1459                         memcpy((vec.pt.val + md[0].len + md[1].len),
1460                                 md[2].val,
1461                                 (size_t)md[2].len);
1462                         vec.pt.len = md[0].len + md[1].len + md[2].len;
1463
1464                         ret = fips_run_test();
1465                         if (ret < 0) {
1466                                 if (ret == -EPERM || ret == -ENOTSUP) {
1467                                         fprintf(info.fp_wr, "Bypass\n\n");
1468                                         return 0;
1469                                 }
1470                                 return ret;
1471                         }
1472
1473                         get_writeback_data(&val);
1474
1475                         memcpy(md[0].val, md[1].val, md[1].len);
1476                         md[0].len = md[1].len;
1477                         memcpy(md[1].val, md[2].val, md[2].len);
1478                         md[1].len = md[2].len;
1479
1480                         memcpy(md[2].val, (val.val + vec.pt.len),
1481                                 vec.cipher_auth.digest.len);
1482                         md[2].len = vec.cipher_auth.digest.len;
1483                 }
1484
1485                 memcpy(vec.cipher_auth.digest.val, md[2].val, md[2].len);
1486                 vec.cipher_auth.digest.len = md[2].len;
1487
1488                 fprintf(info.fp_wr, "COUNT = %u\n", j);
1489
1490                 writeback_hex_str("", temp, &vec.cipher_auth.digest);
1491
1492                 fprintf(info.fp_wr, "MD = %s\n\n", temp);
1493         }
1494
1495         for (i = 0; i < (SHA_MD_BLOCK); i++)
1496                 rte_free(md[i].val);
1497
1498         rte_free(vec.pt.val);
1499
1500         return 0;
1501 }
1502
1503
1504 static int
1505 init_test_ops(void)
1506 {
1507         switch (info.algo) {
1508         case FIPS_TEST_ALGO_AES:
1509                 test_ops.prepare_op = prepare_cipher_op;
1510                 test_ops.prepare_xform  = prepare_aes_xform;
1511                 if (info.interim_info.aes_data.test_type == AESAVS_TYPE_MCT)
1512                         test_ops.test = fips_mct_aes_test;
1513                 else
1514                         test_ops.test = fips_generic_test;
1515                 break;
1516         case FIPS_TEST_ALGO_HMAC:
1517                 test_ops.prepare_op = prepare_auth_op;
1518                 test_ops.prepare_xform = prepare_hmac_xform;
1519                 test_ops.test = fips_generic_test;
1520                 break;
1521         case FIPS_TEST_ALGO_TDES:
1522                 test_ops.prepare_op = prepare_cipher_op;
1523                 test_ops.prepare_xform  = prepare_tdes_xform;
1524                 if (info.interim_info.tdes_data.test_type == TDES_MCT)
1525                         test_ops.test = fips_mct_tdes_test;
1526                 else
1527                         test_ops.test = fips_generic_test;
1528                 break;
1529         case FIPS_TEST_ALGO_AES_GCM:
1530                 test_ops.prepare_op = prepare_aead_op;
1531                 test_ops.prepare_xform = prepare_gcm_xform;
1532                 test_ops.test = fips_generic_test;
1533                 break;
1534         case FIPS_TEST_ALGO_AES_CMAC:
1535                 test_ops.prepare_op = prepare_auth_op;
1536                 test_ops.prepare_xform = prepare_cmac_xform;
1537                 test_ops.test = fips_generic_test;
1538                 break;
1539         case FIPS_TEST_ALGO_AES_CCM:
1540                 test_ops.prepare_op = prepare_aead_op;
1541                 test_ops.prepare_xform = prepare_ccm_xform;
1542                 test_ops.test = fips_generic_test;
1543                 break;
1544         case FIPS_TEST_ALGO_SHA:
1545                 test_ops.prepare_op = prepare_auth_op;
1546                 test_ops.prepare_xform = prepare_sha_xform;
1547                 if (info.interim_info.sha_data.test_type == SHA_MCT)
1548                         test_ops.test = fips_mct_sha_test;
1549                 else
1550                         test_ops.test = fips_generic_test;
1551                 break;
1552         case FIPS_TEST_ALGO_AES_XTS:
1553                 test_ops.prepare_op = prepare_cipher_op;
1554                 test_ops.prepare_xform = prepare_xts_xform;
1555                 test_ops.test = fips_generic_test;
1556                 break;
1557         default:
1558                 if (strstr(info.file_name, "TECB") ||
1559                                 strstr(info.file_name, "TCBC")) {
1560                         info.algo = FIPS_TEST_ALGO_TDES;
1561                         test_ops.prepare_op = prepare_cipher_op;
1562                         test_ops.prepare_xform  = prepare_tdes_xform;
1563                         if (info.interim_info.tdes_data.test_type == TDES_MCT)
1564                                 test_ops.test = fips_mct_tdes_test;
1565                         else
1566                                 test_ops.test = fips_generic_test;
1567                         break;
1568                 }
1569                 return -1;
1570         }
1571
1572         return 0;
1573 }
1574
1575 static void
1576 print_test_block(void)
1577 {
1578         uint32_t i;
1579
1580         for (i = 0; i < info.nb_vec_lines; i++)
1581                 printf("%s\n", info.vec[i]);
1582
1583         printf("\n");
1584 }
1585
1586 static int
1587 fips_test_one_file(void)
1588 {
1589         int fetch_ret = 0, ret;
1590
1591
1592         ret = init_test_ops();
1593         if (ret < 0) {
1594                 RTE_LOG(ERR, USER1, "Error %i: Init test op\n", ret);
1595                 return ret;
1596         }
1597
1598         while (ret >= 0 && fetch_ret == 0) {
1599                 fetch_ret = fips_test_fetch_one_block();
1600                 if (fetch_ret < 0) {
1601                         RTE_LOG(ERR, USER1, "Error %i: Fetch block\n",
1602                                         fetch_ret);
1603                         ret = fetch_ret;
1604                         goto error_one_case;
1605                 }
1606
1607                 if (info.nb_vec_lines == 0) {
1608                         if (fetch_ret == -EOF)
1609                                 break;
1610
1611                         fprintf(info.fp_wr, "\n");
1612                         continue;
1613                 }
1614
1615                 ret = fips_test_parse_one_case();
1616                 switch (ret) {
1617                 case 0:
1618                         ret = test_ops.test();
1619                         if (ret == 0)
1620                                 break;
1621                         RTE_LOG(ERR, USER1, "Error %i: test block\n",
1622                                         ret);
1623                         goto error_one_case;
1624                 case 1:
1625                         break;
1626                 default:
1627                         RTE_LOG(ERR, USER1, "Error %i: Parse block\n",
1628                                         ret);
1629                         goto error_one_case;
1630                 }
1631
1632                 continue;
1633 error_one_case:
1634                 print_test_block();
1635         }
1636
1637         fips_test_clear();
1638
1639         return ret;
1640
1641 }