X-Git-Url: http://git.droids-corp.org/?a=blobdiff_plain;f=examples%2Ffips_validation%2Fmain.c;h=b0de3d269a1e1ff92681aa64bdc15dbd9e14edcc;hb=1bb4a528c41f;hp=efd32a86a5b6e64f52412a87d83a0a248d2d25bc;hpb=2b84d2bd47df6545797ed9841636eb8023c4db7b;p=dpdk.git diff --git a/examples/fips_validation/main.c b/examples/fips_validation/main.c index efd32a86a5..b0de3d269a 100644 --- a/examples/fips_validation/main.c +++ b/examples/fips_validation/main.c @@ -7,7 +7,7 @@ #include #include -#include +#include #include #include #include @@ -15,16 +15,26 @@ #include "fips_validation.h" #include "fips_dev_self_test.h" -#define REQ_FILE_PATH_KEYWORD "req-file" -#define RSP_FILE_PATH_KEYWORD "rsp-file" -#define FOLDER_KEYWORD "path-is-folder" -#define CRYPTODEV_KEYWORD "cryptodev" -#define CRYPTODEV_ID_KEYWORD "cryptodev-id" -#define CRYPTODEV_ST_KEYWORD "self-test" -#define CRYPTODEV_BK_ID_KEYWORD "broken-test-id" -#define CRYPTODEV_BK_DIR_KEY "broken-test-dir" -#define CRYPTODEV_ENC_KEYWORD "enc" -#define CRYPTODEV_DEC_KEYWORD "dec" +enum { +#define OPT_REQ_FILE_PATH "req-file" + OPT_REQ_FILE_PATH_NUM = 256, +#define OPT_RSP_FILE_PATH "rsp-file" + OPT_RSP_FILE_PATH_NUM, +#define OPT_MBUF_DATAROOM "mbuf-dataroom" + OPT_MBUF_DATAROOM_NUM, +#define OPT_FOLDER "path-is-folder" + OPT_FOLDER_NUM, +#define OPT_CRYPTODEV "cryptodev" + OPT_CRYPTODEV_NUM, +#define OPT_CRYPTODEV_ID "cryptodev-id" + OPT_CRYPTODEV_ID_NUM, +#define OPT_CRYPTODEV_ST "self-test" + OPT_CRYPTODEV_ST_NUM, +#define OPT_CRYPTODEV_BK_ID "broken-test-id" + OPT_CRYPTODEV_BK_ID_NUM, +#define OPT_CRYPTODEV_BK_DIR_KEY "broken-test-dir" + OPT_CRYPTODEV_BK_DIR_KEY_NUM, +}; struct fips_test_vector vec; struct fips_test_interim_info info; @@ -33,15 +43,19 @@ struct cryptodev_fips_validate_env { const char *req_path; const char *rsp_path; uint32_t is_path_folder; - uint32_t dev_id; + uint8_t dev_id; + uint8_t dev_support_sgl; + uint16_t mbuf_data_room; struct rte_mempool *mpool; struct rte_mempool *sess_mpool; struct rte_mempool *sess_priv_mpool; struct rte_mempool *op_pool; struct rte_mbuf *mbuf; + uint8_t *digest; + uint16_t digest_len; struct rte_crypto_op *op; struct rte_cryptodev_sym_session *sess; - uint32_t self_test; + uint16_t self_test; struct fips_dev_broken_test_config *broken_test_config; } env; @@ -50,17 +64,16 @@ cryptodev_fips_validate_app_int(void) { struct rte_cryptodev_config conf = {rte_socket_id(), 1, 0}; struct rte_cryptodev_qp_conf qp_conf = {128, NULL, NULL}; + struct rte_cryptodev_info dev_info; uint32_t sess_sz = rte_cryptodev_sym_get_private_session_size( env.dev_id); + uint32_t nb_mbufs = UINT16_MAX / env.mbuf_data_room + 1; int ret; if (env.self_test) { ret = fips_dev_self_test(env.dev_id, env.broken_test_config); if (ret < 0) { - struct rte_cryptodev *cryptodev = - rte_cryptodev_pmd_get_dev(env.dev_id); - - rte_cryptodev_pmd_destroy(cryptodev); + rte_cryptodev_close(env.dev_id); return ret; } @@ -70,8 +83,15 @@ cryptodev_fips_validate_app_int(void) if (ret < 0) return ret; - env.mpool = rte_pktmbuf_pool_create("FIPS_MEMPOOL", 128, 0, 0, - UINT16_MAX, rte_socket_id()); + rte_cryptodev_info_get(env.dev_id, &dev_info); + if (dev_info.feature_flags & RTE_CRYPTODEV_FF_IN_PLACE_SGL) + env.dev_support_sgl = 1; + else + env.dev_support_sgl = 0; + + env.mpool = rte_pktmbuf_pool_create("FIPS_MEMPOOL", nb_mbufs, + 0, 0, sizeof(struct rte_mbuf) + RTE_PKTMBUF_HEADROOM + + env.mbuf_data_room, rte_socket_id()); if (!env.mpool) return ret; @@ -102,10 +122,6 @@ cryptodev_fips_validate_app_int(void) if (!env.op_pool) goto error_exit; - env.mbuf = rte_pktmbuf_alloc(env.mpool); - if (!env.mbuf) - goto error_exit; - env.op = rte_crypto_op_alloc(env.op_pool, RTE_CRYPTO_OP_TYPE_SYMMETRIC); if (!env.op) goto error_exit; @@ -160,7 +176,7 @@ parse_cryptodev_arg(char *arg) return id; } - env.dev_id = (uint32_t)id; + env.dev_id = (uint8_t)id; return 0; } @@ -177,13 +193,13 @@ parse_cryptodev_id_arg(char *arg) } - if (!rte_cryptodev_pmd_is_valid_dev(cryptodev_id)) { + if (!rte_cryptodev_is_valid_dev(cryptodev_id)) { RTE_LOG(ERR, USER1, "Error %i: invalid cryptodev id %s\n", cryptodev_id, arg); return -1; } - env.dev_id = (uint32_t)cryptodev_id; + env.dev_id = (uint8_t)cryptodev_id; return 0; } @@ -191,19 +207,21 @@ parse_cryptodev_id_arg(char *arg) static void cryptodev_fips_validate_usage(const char *prgname) { + uint32_t def_mbuf_seg_size = DEF_MBUF_SEG_SIZE; printf("%s [EAL options] --\n" " --%s: REQUEST-FILE-PATH\n" " --%s: RESPONSE-FILE-PATH\n" " --%s: indicating both paths are folders\n" + " --%s: mbuf dataroom size (default %u bytes)\n" " --%s: CRYPTODEV-NAME\n" " --%s: CRYPTODEV-ID-NAME\n" " --%s: self test indicator\n" " --%s: self broken test ID\n" " --%s: self broken test direction\n", - prgname, REQ_FILE_PATH_KEYWORD, RSP_FILE_PATH_KEYWORD, - FOLDER_KEYWORD, CRYPTODEV_KEYWORD, CRYPTODEV_ID_KEYWORD, - CRYPTODEV_ST_KEYWORD, CRYPTODEV_BK_ID_KEYWORD, - CRYPTODEV_BK_DIR_KEY); + prgname, OPT_REQ_FILE_PATH, OPT_RSP_FILE_PATH, + OPT_FOLDER, OPT_MBUF_DATAROOM, def_mbuf_seg_size, + OPT_CRYPTODEV, OPT_CRYPTODEV_ID, OPT_CRYPTODEV_ST, + OPT_CRYPTODEV_BK_ID, OPT_CRYPTODEV_BK_DIR_KEY); } static int @@ -214,109 +232,151 @@ cryptodev_fips_validate_parse_args(int argc, char **argv) char **argvopt; int option_index; struct option lgopts[] = { - {REQ_FILE_PATH_KEYWORD, required_argument, 0, 0}, - {RSP_FILE_PATH_KEYWORD, required_argument, 0, 0}, - {FOLDER_KEYWORD, no_argument, 0, 0}, - {CRYPTODEV_KEYWORD, required_argument, 0, 0}, - {CRYPTODEV_ID_KEYWORD, required_argument, 0, 0}, - {CRYPTODEV_ST_KEYWORD, no_argument, 0, 0}, - {CRYPTODEV_BK_ID_KEYWORD, required_argument, 0, 0}, - {CRYPTODEV_BK_DIR_KEY, required_argument, 0, 0}, - {NULL, 0, 0, 0} + {OPT_REQ_FILE_PATH, required_argument, + NULL, OPT_REQ_FILE_PATH_NUM}, + {OPT_RSP_FILE_PATH, required_argument, + NULL, OPT_RSP_FILE_PATH_NUM}, + {OPT_FOLDER, no_argument, + NULL, OPT_FOLDER_NUM}, + {OPT_MBUF_DATAROOM, required_argument, + NULL, OPT_MBUF_DATAROOM_NUM}, + {OPT_CRYPTODEV, required_argument, + NULL, OPT_CRYPTODEV_NUM}, + {OPT_CRYPTODEV_ID, required_argument, + NULL, OPT_CRYPTODEV_ID_NUM}, + {OPT_CRYPTODEV_ST, no_argument, + NULL, OPT_CRYPTODEV_ST_NUM}, + {OPT_CRYPTODEV_BK_ID, required_argument, + NULL, OPT_CRYPTODEV_BK_ID_NUM}, + {OPT_CRYPTODEV_BK_DIR_KEY, required_argument, + NULL, OPT_CRYPTODEV_BK_DIR_KEY_NUM}, + {NULL, 0, 0, 0} }; argvopt = argv; + env.mbuf_data_room = DEF_MBUF_SEG_SIZE; + if (rte_cryptodev_count()) + env.dev_id = 0; + else { + cryptodev_fips_validate_usage(prgname); + return -EINVAL; + } + while ((opt = getopt_long(argc, argvopt, "s:", lgopts, &option_index)) != EOF) { switch (opt) { - case 0: - if (strcmp(lgopts[option_index].name, - REQ_FILE_PATH_KEYWORD) == 0) - env.req_path = optarg; - else if (strcmp(lgopts[option_index].name, - RSP_FILE_PATH_KEYWORD) == 0) - env.rsp_path = optarg; - else if (strcmp(lgopts[option_index].name, - FOLDER_KEYWORD) == 0) - env.is_path_folder = 1; - else if (strcmp(lgopts[option_index].name, - CRYPTODEV_KEYWORD) == 0) { - ret = parse_cryptodev_arg(optarg); - if (ret < 0) { - cryptodev_fips_validate_usage(prgname); - return -EINVAL; - } - } else if (strcmp(lgopts[option_index].name, - CRYPTODEV_ID_KEYWORD) == 0) { - ret = parse_cryptodev_id_arg(optarg); - if (ret < 0) { - cryptodev_fips_validate_usage(prgname); - return -EINVAL; - } - } else if (strcmp(lgopts[option_index].name, - CRYPTODEV_ST_KEYWORD) == 0) { - env.self_test = 1; - } else if (strcmp(lgopts[option_index].name, - CRYPTODEV_BK_ID_KEYWORD) == 0) { - if (!env.broken_test_config) { - env.broken_test_config = rte_malloc( - NULL, - sizeof(*env.broken_test_config), - 0); - if (!env.broken_test_config) - return -ENOMEM; - - env.broken_test_config->expect_fail_dir = - self_test_dir_enc_auth_gen; - } + case OPT_REQ_FILE_PATH_NUM: + env.req_path = optarg; + break; - if (parser_read_uint32( - &env.broken_test_config->expect_fail_test_idx, - optarg) < 0) { - rte_free(env.broken_test_config); - cryptodev_fips_validate_usage(prgname); - return -EINVAL; - } - } else if (strcmp(lgopts[option_index].name, - CRYPTODEV_BK_DIR_KEY) == 0) { - if (!env.broken_test_config) { - env.broken_test_config = rte_malloc( - NULL, - sizeof(*env.broken_test_config), - 0); - if (!env.broken_test_config) - return -ENOMEM; - - env.broken_test_config-> - expect_fail_test_idx = 0; - } + case OPT_RSP_FILE_PATH_NUM: + env.rsp_path = optarg; + break; - if (strcmp(optarg, CRYPTODEV_ENC_KEYWORD) == 0) - env.broken_test_config->expect_fail_dir = - self_test_dir_enc_auth_gen; - else if (strcmp(optarg, CRYPTODEV_DEC_KEYWORD) - == 0) - env.broken_test_config->expect_fail_dir = - self_test_dir_dec_auth_verify; - else { - rte_free(env.broken_test_config); - cryptodev_fips_validate_usage(prgname); - return -EINVAL; - } - } else { + case OPT_FOLDER_NUM: + env.is_path_folder = 1; + break; + + case OPT_CRYPTODEV_NUM: + ret = parse_cryptodev_arg(optarg); + if (ret < 0) { + cryptodev_fips_validate_usage(prgname); + return -EINVAL; + } + break; + + case OPT_CRYPTODEV_ID_NUM: + ret = parse_cryptodev_id_arg(optarg); + if (ret < 0) { + cryptodev_fips_validate_usage(prgname); + return -EINVAL; + } + break; + + case OPT_CRYPTODEV_ST_NUM: + env.self_test = 1; + break; + + case OPT_CRYPTODEV_BK_ID_NUM: + if (!env.broken_test_config) { + env.broken_test_config = rte_malloc( + NULL, + sizeof(*env.broken_test_config), + 0); + if (!env.broken_test_config) + return -ENOMEM; + + env.broken_test_config->expect_fail_dir = + self_test_dir_enc_auth_gen; + } + + if (parser_read_uint32( + &env.broken_test_config->expect_fail_test_idx, + optarg) < 0) { + rte_free(env.broken_test_config); + cryptodev_fips_validate_usage(prgname); + return -EINVAL; + } + break; + + case OPT_CRYPTODEV_BK_DIR_KEY_NUM: + if (!env.broken_test_config) { + env.broken_test_config = rte_malloc( + NULL, + sizeof(*env.broken_test_config), + 0); + if (!env.broken_test_config) + return -ENOMEM; + + env.broken_test_config->expect_fail_test_idx = + 0; + } + + if (strcmp(optarg, "enc") == 0) + env.broken_test_config->expect_fail_dir = + self_test_dir_enc_auth_gen; + else if (strcmp(optarg, "dec") + == 0) + env.broken_test_config->expect_fail_dir = + self_test_dir_dec_auth_verify; + else { + rte_free(env.broken_test_config); cryptodev_fips_validate_usage(prgname); return -EINVAL; } break; + + + case OPT_MBUF_DATAROOM_NUM: + if (parser_read_uint16(&env.mbuf_data_room, + optarg) < 0) { + cryptodev_fips_validate_usage(prgname); + return -EINVAL; + } + + if (env.mbuf_data_room == 0) { + cryptodev_fips_validate_usage(prgname); + return -EINVAL; + } + break; + default: - return -1; + cryptodev_fips_validate_usage(prgname); + return -EINVAL; } } - if (env.req_path == NULL || env.rsp_path == NULL || - env.dev_id == UINT32_MAX) { + if ((env.req_path == NULL && env.rsp_path != NULL) || + (env.req_path != NULL && env.rsp_path == NULL)) { + RTE_LOG(ERR, USER1, "Missing req path or rsp path\n"); + cryptodev_fips_validate_usage(prgname); + return -EINVAL; + } + + if (env.req_path == NULL && env.self_test == 0) { + RTE_LOG(ERR, USER1, "--self-test must be set if req path is missing\n"); cryptodev_fips_validate_usage(prgname); return -EINVAL; } @@ -348,6 +408,11 @@ main(int argc, char *argv[]) return -1; } + if (env.req_path == NULL || env.rsp_path == NULL) { + printf("No request, exit.\n"); + goto exit; + } + if (!env.is_path_folder) { printf("Processing file %s... ", env.req_path); @@ -433,6 +498,9 @@ exit: fips_test_clear(); cryptodev_fips_validate_app_uninit(); + /* clean up the EAL */ + rte_eal_cleanup(); + return ret; } @@ -440,104 +508,169 @@ exit: #define IV_OFF (sizeof(struct rte_crypto_op) + sizeof(struct rte_crypto_sym_op)) #define CRYPTODEV_FIPS_MAX_RETRIES 16 -typedef int (*fips_test_one_case_t)(void); -typedef int (*fips_prepare_op_t)(void); -typedef int (*fips_prepare_xform_t)(struct rte_crypto_sym_xform *); - -struct fips_test_ops { - fips_prepare_xform_t prepare_xform; - fips_prepare_op_t prepare_op; - fips_test_one_case_t test; -} test_ops; +struct fips_test_ops test_ops; static int -prepare_cipher_op(void) +prepare_data_mbufs(struct fips_val *val) { - struct rte_crypto_sym_op *sym = env.op->sym; - uint8_t *iv = rte_crypto_op_ctod_offset(env.op, uint8_t *, IV_OFF); - - __rte_crypto_op_reset(env.op, RTE_CRYPTO_OP_TYPE_SYMMETRIC); - rte_pktmbuf_reset(env.mbuf); + struct rte_mbuf *m, *head = 0; + uint8_t *src = val->val; + uint32_t total_len = val->len; + uint16_t nb_seg; + int ret = 0; - sym->m_src = env.mbuf; - sym->cipher.data.offset = 0; + if (env.mbuf) + rte_pktmbuf_free(env.mbuf); - memcpy(iv, vec.iv.val, vec.iv.len); + if (total_len > RTE_MBUF_MAX_NB_SEGS) { + RTE_LOG(ERR, USER1, "Data len %u too big\n", total_len); + return -EPERM; + } - if (info.op == FIPS_TEST_ENC_AUTH_GEN) { - uint8_t *pt; + nb_seg = total_len / env.mbuf_data_room; + if (total_len % env.mbuf_data_room) + nb_seg++; - if (vec.pt.len > RTE_MBUF_MAX_NB_SEGS) { - RTE_LOG(ERR, USER1, "PT len %u\n", vec.pt.len); - return -EPERM; - } + m = rte_pktmbuf_alloc(env.mpool); + if (!m) { + RTE_LOG(ERR, USER1, "Error %i: Not enough mbuf\n", + -ENOMEM); + return -ENOMEM; + } + head = m; - pt = (uint8_t *)rte_pktmbuf_append(env.mbuf, vec.pt.len); + while (nb_seg) { + uint16_t len = RTE_MIN(total_len, env.mbuf_data_room); + uint8_t *dst = (uint8_t *)rte_pktmbuf_append(m, len); - if (!pt) { + if (!dst) { RTE_LOG(ERR, USER1, "Error %i: MBUF too small\n", -ENOMEM); - return -ENOMEM; + ret = -ENOMEM; + goto error_exit; } - memcpy(pt, vec.pt.val, vec.pt.len); - sym->cipher.data.length = vec.pt.len; - - } else { - uint8_t *ct; + memcpy(dst, src, len); - if (vec.ct.len > RTE_MBUF_MAX_NB_SEGS) { - RTE_LOG(ERR, USER1, "CT len %u\n", vec.ct.len); - return -EPERM; + if (head != m) { + ret = rte_pktmbuf_chain(head, m); + if (ret) { + rte_pktmbuf_free(m); + RTE_LOG(ERR, USER1, "Error %i: SGL build\n", + ret); + goto error_exit; + } } + total_len -= len; - ct = (uint8_t *)rte_pktmbuf_append(env.mbuf, vec.ct.len); + if (total_len) { + if (!env.dev_support_sgl) { + RTE_LOG(ERR, USER1, "SGL not supported\n"); + ret = -EPERM; + goto error_exit; + } - if (!ct) { - RTE_LOG(ERR, USER1, "Error %i: MBUF too small\n", - -ENOMEM); - return -ENOMEM; - } + m = rte_pktmbuf_alloc(env.mpool); + if (!m) { + RTE_LOG(ERR, USER1, "Error %i: No memory\n", + -ENOMEM); + goto error_exit; + } + } else + break; + + src += len; + nb_seg--; + } + + if (total_len) { + RTE_LOG(ERR, USER1, "Error %i: Failed to store all data\n", + -ENOMEM); + goto error_exit; + } + + env.mbuf = head; + + return 0; + +error_exit: + if (head) + rte_pktmbuf_free(head); + return ret; +} + +static int +prepare_cipher_op(void) +{ + struct rte_crypto_sym_op *sym = env.op->sym; + uint8_t *iv = rte_crypto_op_ctod_offset(env.op, uint8_t *, IV_OFF); + int ret; + + __rte_crypto_op_reset(env.op, RTE_CRYPTO_OP_TYPE_SYMMETRIC); + + memcpy(iv, vec.iv.val, vec.iv.len); + + if (info.op == FIPS_TEST_ENC_AUTH_GEN) { + ret = prepare_data_mbufs(&vec.pt); + if (ret < 0) + return ret; + + sym->cipher.data.length = vec.pt.len; + } else { + ret = prepare_data_mbufs(&vec.ct); + if (ret < 0) + return ret; - memcpy(ct, vec.ct.val, vec.ct.len); sym->cipher.data.length = vec.ct.len; } rte_crypto_op_attach_sym_session(env.op, env.sess); + sym->m_src = env.mbuf; + sym->cipher.data.offset = 0; + return 0; } -static int +int prepare_auth_op(void) { struct rte_crypto_sym_op *sym = env.op->sym; - uint8_t *pt; + int ret; __rte_crypto_op_reset(env.op, RTE_CRYPTO_OP_TYPE_SYMMETRIC); - rte_pktmbuf_reset(env.mbuf); - sym->m_src = env.mbuf; - sym->auth.data.offset = 0; + if (vec.iv.len) { + uint8_t *iv = rte_crypto_op_ctod_offset(env.op, uint8_t *, + IV_OFF); + memset(iv, 0, vec.iv.len); + if (vec.iv.val) + memcpy(iv, vec.iv.val, vec.iv.len); + } - pt = (uint8_t *)rte_pktmbuf_append(env.mbuf, vec.pt.len + - vec.cipher_auth.digest.len); + ret = prepare_data_mbufs(&vec.pt); + if (ret < 0) + return ret; - if (!pt) { - RTE_LOG(ERR, USER1, "Error %i: MBUF too small\n", - -ENOMEM); + if (env.digest) + rte_free(env.digest); + + env.digest = rte_zmalloc(NULL, vec.cipher_auth.digest.len, + RTE_CACHE_LINE_SIZE); + if (!env.digest) { + RTE_LOG(ERR, USER1, "Not enough memory\n"); return -ENOMEM; } + env.digest_len = vec.cipher_auth.digest.len; + sym->m_src = env.mbuf; + sym->auth.data.offset = 0; sym->auth.data.length = vec.pt.len; - sym->auth.digest.data = pt + vec.pt.len; - sym->auth.digest.phys_addr = rte_pktmbuf_mtophys_offset( - env.mbuf, vec.pt.len); - - memcpy(pt, vec.pt.val, vec.pt.len); + sym->auth.digest.data = env.digest; + sym->auth.digest.phys_addr = rte_malloc_virt2iova(env.digest); if (info.op == FIPS_TEST_DEC_AUTH_VERIF) - memcpy(pt + vec.pt.len, vec.cipher_auth.digest.val, + memcpy(env.digest, vec.cipher_auth.digest.val, vec.cipher_auth.digest.len); rte_crypto_op_attach_sym_session(env.op, env.sess); @@ -545,70 +678,58 @@ prepare_auth_op(void) return 0; } -static int +int prepare_aead_op(void) { struct rte_crypto_sym_op *sym = env.op->sym; uint8_t *iv = rte_crypto_op_ctod_offset(env.op, uint8_t *, IV_OFF); + int ret; __rte_crypto_op_reset(env.op, RTE_CRYPTO_OP_TYPE_SYMMETRIC); - rte_pktmbuf_reset(env.mbuf); if (info.algo == FIPS_TEST_ALGO_AES_CCM) - memcpy(iv + 1, vec.iv.val, vec.iv.len); - else - memcpy(iv, vec.iv.val, vec.iv.len); + iv++; - sym->m_src = env.mbuf; - sym->aead.data.offset = 0; - sym->aead.aad.data = vec.aead.aad.val; - sym->aead.aad.phys_addr = rte_malloc_virt2iova(sym->aead.aad.data); + if (vec.iv.val) + memcpy(iv, vec.iv.val, vec.iv.len); + else + /* if REQ file has iv length but not data, default as all 0 */ + memset(iv, 0, vec.iv.len); if (info.op == FIPS_TEST_ENC_AUTH_GEN) { - uint8_t *pt; - - if (vec.pt.len > RTE_MBUF_MAX_NB_SEGS) { - RTE_LOG(ERR, USER1, "PT len %u\n", vec.pt.len); - return -EPERM; - } - - pt = (uint8_t *)rte_pktmbuf_append(env.mbuf, - vec.pt.len + vec.aead.digest.len); + ret = prepare_data_mbufs(&vec.pt); + if (ret < 0) + return ret; - if (!pt) { - RTE_LOG(ERR, USER1, "Error %i: MBUF too small\n", - -ENOMEM); + if (env.digest) + rte_free(env.digest); + env.digest = rte_zmalloc(NULL, vec.aead.digest.len, + RTE_CACHE_LINE_SIZE); + if (!env.digest) { + RTE_LOG(ERR, USER1, "Not enough memory\n"); return -ENOMEM; } + env.digest_len = vec.cipher_auth.digest.len; - memcpy(pt, vec.pt.val, vec.pt.len); sym->aead.data.length = vec.pt.len; - sym->aead.digest.data = pt + vec.pt.len; - sym->aead.digest.phys_addr = rte_pktmbuf_mtophys_offset( - env.mbuf, vec.pt.len); + sym->aead.digest.data = env.digest; + sym->aead.digest.phys_addr = rte_malloc_virt2iova(env.digest); } else { - uint8_t *ct; - - if (vec.ct.len > RTE_MBUF_MAX_NB_SEGS) { - RTE_LOG(ERR, USER1, "CT len %u\n", vec.ct.len); - return -EPERM; - } - - ct = (uint8_t *)rte_pktmbuf_append(env.mbuf, vec.ct.len); - - if (!ct) { - RTE_LOG(ERR, USER1, "Error %i: MBUF too small\n", - -ENOMEM); - return -ENOMEM; - } + ret = prepare_data_mbufs(&vec.ct); + if (ret < 0) + return ret; - memcpy(ct, vec.ct.val, vec.ct.len); sym->aead.data.length = vec.ct.len; sym->aead.digest.data = vec.aead.digest.val; sym->aead.digest.phys_addr = rte_malloc_virt2iova( sym->aead.digest.data); } + sym->m_src = env.mbuf; + sym->aead.data.offset = 0; + sym->aead.aad.data = vec.aead.aad.val; + sym->aead.aad.phys_addr = rte_malloc_virt2iova(sym->aead.aad.data); + rte_crypto_op_attach_sym_session(env.op, env.sess); return 0; @@ -747,7 +868,7 @@ prepare_hmac_xform(struct rte_crypto_sym_xform *xform) return 0; } -static int +int prepare_gcm_xform(struct rte_crypto_sym_xform *xform) { const struct rte_cryptodev_symmetric_capability *cap; @@ -793,6 +914,51 @@ prepare_gcm_xform(struct rte_crypto_sym_xform *xform) return 0; } +int +prepare_gmac_xform(struct rte_crypto_sym_xform *xform) +{ + const struct rte_cryptodev_symmetric_capability *cap; + struct rte_cryptodev_sym_capability_idx cap_idx; + struct rte_crypto_auth_xform *auth_xform = &xform->auth; + + xform->type = RTE_CRYPTO_SYM_XFORM_AUTH; + + auth_xform->algo = RTE_CRYPTO_AUTH_AES_GMAC; + auth_xform->op = (info.op == FIPS_TEST_ENC_AUTH_GEN) ? + RTE_CRYPTO_AUTH_OP_GENERATE : + RTE_CRYPTO_AUTH_OP_VERIFY; + auth_xform->iv.offset = IV_OFF; + auth_xform->iv.length = vec.iv.len; + auth_xform->digest_length = vec.aead.digest.len; + auth_xform->key.data = vec.aead.key.val; + auth_xform->key.length = vec.aead.key.len; + + cap_idx.algo.auth = auth_xform->algo; + cap_idx.type = RTE_CRYPTO_SYM_XFORM_AUTH; + + cap = rte_cryptodev_sym_capability_get(env.dev_id, &cap_idx); + if (!cap) { + RTE_LOG(ERR, USER1, "Failed to get capability for cdev %u\n", + env.dev_id); + return -EINVAL; + } + + if (rte_cryptodev_sym_capability_check_auth(cap, + auth_xform->key.length, + auth_xform->digest_length, + auth_xform->iv.length) != 0) { + + RTE_LOG(ERR, USER1, + "PMD %s key length %u Digest length %u IV length %u\n", + info.device_name, auth_xform->key.length, + auth_xform->digest_length, + auth_xform->iv.length); + return -EPERM; + } + + return 0; +} + static int prepare_cmac_xform(struct rte_crypto_sym_xform *xform) { @@ -952,11 +1118,49 @@ prepare_xts_xform(struct rte_crypto_sym_xform *xform) return 0; } -static void +static int get_writeback_data(struct fips_val *val) { - val->val = rte_pktmbuf_mtod(env.mbuf, uint8_t *); - val->len = rte_pktmbuf_pkt_len(env.mbuf); + struct rte_mbuf *m = env.mbuf; + uint16_t data_len = rte_pktmbuf_pkt_len(m); + uint16_t total_len = data_len + env.digest_len; + uint8_t *src, *dst, *wb_data; + + /* in case val is reused for MCT test, try to free the buffer first */ + if (val->val) { + free(val->val); + val->val = NULL; + } + + wb_data = dst = calloc(1, total_len); + if (!dst) { + RTE_LOG(ERR, USER1, "Error %i: Not enough memory\n", -ENOMEM); + return -ENOMEM; + } + + while (m && data_len) { + uint16_t seg_len = RTE_MIN(rte_pktmbuf_data_len(m), data_len); + + src = rte_pktmbuf_mtod(m, uint8_t *); + memcpy(dst, src, seg_len); + m = m->next; + data_len -= seg_len; + dst += seg_len; + } + + if (data_len) { + RTE_LOG(ERR, USER1, "Error -1: write back data\n"); + free(wb_data); + return -1; + } + + if (env.digest) + memcpy(dst, env.digest, env.digest_len); + + val->val = wb_data; + val->len = total_len; + + return 0; } static int @@ -1015,14 +1219,14 @@ exit: static int fips_generic_test(void) { - struct fips_val val; + struct fips_val val = {NULL, 0}; int ret; fips_test_write_one_case(); ret = fips_run_test(); if (ret < 0) { - if (ret == -EPERM) { + if (ret == -EPERM || ret == -ENOTSUP) { fprintf(info.fp_wr, "Bypass\n\n"); return 0; } @@ -1030,7 +1234,9 @@ fips_generic_test(void) return ret; } - get_writeback_data(&val); + ret = get_writeback_data(&val); + if (ret < 0) + return ret; switch (info.file_type) { case FIPS_TYPE_REQ: @@ -1051,6 +1257,7 @@ fips_generic_test(void) } fprintf(info.fp_wr, "\n"); + free(val.val); return 0; } @@ -1061,7 +1268,7 @@ fips_mct_tdes_test(void) #define TDES_BLOCK_SIZE 8 #define TDES_EXTERN_ITER 400 #define TDES_INTERN_ITER 10000 - struct fips_val val, val_key; + struct fips_val val = {NULL, 0}, val_key; uint8_t prev_out[TDES_BLOCK_SIZE] = {0}; uint8_t prev_prev_out[TDES_BLOCK_SIZE] = {0}; uint8_t prev_in[TDES_BLOCK_SIZE] = {0}; @@ -1070,10 +1277,12 @@ fips_mct_tdes_test(void) int test_mode = info.interim_info.tdes_data.test_mode; for (i = 0; i < TDES_EXTERN_ITER; i++) { - if (i == 0) { + if ((i == 0) && (info.version == 21.4f)) { if (!(strstr(info.vec[0], "COUNT"))) fprintf(info.fp_wr, "%s%u\n", "COUNT = ", 0); - } else + } + + if (i != 0) update_info_vec(i); fips_test_write_one_case(); @@ -1088,7 +1297,9 @@ fips_mct_tdes_test(void) return ret; } - get_writeback_data(&val); + ret = get_writeback_data(&val); + if (ret < 0) + return ret; if (info.op == FIPS_TEST_DEC_AUTH_VERIF) memcpy(prev_in, vec.ct.val, TDES_BLOCK_SIZE); @@ -1215,6 +1426,9 @@ fips_mct_tdes_test(void) } } + if (val.val) + free(val.val); + return 0; } @@ -1224,7 +1438,7 @@ fips_mct_aes_ecb_test(void) #define AES_BLOCK_SIZE 16 #define AES_EXTERN_ITER 100 #define AES_INTERN_ITER 1000 - struct fips_val val, val_key; + struct fips_val val = {NULL, 0}, val_key; uint8_t prev_out[AES_BLOCK_SIZE] = {0}; uint32_t i, j, k; int ret; @@ -1246,7 +1460,9 @@ fips_mct_aes_ecb_test(void) return ret; } - get_writeback_data(&val); + ret = get_writeback_data(&val); + if (ret < 0) + return ret; if (info.op == FIPS_TEST_ENC_AUTH_GEN) memcpy(vec.pt.val, val.val, AES_BLOCK_SIZE); @@ -1290,6 +1506,9 @@ fips_mct_aes_ecb_test(void) } } + if (val.val) + free(val.val); + return 0; } static int @@ -1298,7 +1517,7 @@ fips_mct_aes_test(void) #define AES_BLOCK_SIZE 16 #define AES_EXTERN_ITER 100 #define AES_INTERN_ITER 1000 - struct fips_val val, val_key; + struct fips_val val = {NULL, 0}, val_key; uint8_t prev_out[AES_BLOCK_SIZE] = {0}; uint8_t prev_in[AES_BLOCK_SIZE] = {0}; uint32_t i, j, k; @@ -1324,7 +1543,9 @@ fips_mct_aes_test(void) return ret; } - get_writeback_data(&val); + ret = get_writeback_data(&val); + if (ret < 0) + return ret; if (info.op == FIPS_TEST_DEC_AUTH_VERIF) memcpy(prev_in, vec.ct.val, AES_BLOCK_SIZE); @@ -1394,6 +1615,9 @@ fips_mct_aes_test(void) memcpy(vec.iv.val, val.val, AES_BLOCK_SIZE); } + if (val.val) + free(val.val); + return 0; } @@ -1403,12 +1627,11 @@ fips_mct_sha_test(void) #define SHA_EXTERN_ITER 100 #define SHA_INTERN_ITER 1000 #define SHA_MD_BLOCK 3 - struct fips_val val, md[SHA_MD_BLOCK]; + struct fips_val val = {NULL, 0}, md[SHA_MD_BLOCK]; char temp[MAX_DIGEST_SIZE*2]; int ret; uint32_t i, j; - val.val = rte_malloc(NULL, (MAX_DIGEST_SIZE*SHA_MD_BLOCK), 0); for (i = 0; i < SHA_MD_BLOCK; i++) md[i].val = rte_malloc(NULL, (MAX_DIGEST_SIZE*2), 0); @@ -1443,14 +1666,16 @@ fips_mct_sha_test(void) ret = fips_run_test(); if (ret < 0) { - if (ret == -EPERM) { + if (ret == -EPERM || ret == -ENOTSUP) { fprintf(info.fp_wr, "Bypass\n\n"); return 0; } return ret; } - get_writeback_data(&val); + ret = get_writeback_data(&val); + if (ret < 0) + return ret; memcpy(md[0].val, md[1].val, md[1].len); md[0].len = md[1].len; @@ -1477,6 +1702,9 @@ fips_mct_sha_test(void) rte_free(vec.pt.val); + if (val.val) + free(val.val); + return 0; } @@ -1568,7 +1796,6 @@ fips_test_one_file(void) { int fetch_ret = 0, ret; - ret = init_test_ops(); if (ret < 0) { RTE_LOG(ERR, USER1, "Error %i: Init test op\n", ret); @@ -1616,6 +1843,12 @@ error_one_case: fips_test_clear(); - return ret; + if (env.digest) { + rte_free(env.digest); + env.digest = NULL; + } + if (env.mbuf) + rte_pktmbuf_free(env.mbuf); + return ret; }