• Ingo Franzki's avatar
    s390/sha3: Fix SHA3 selftests failures · 992b7066
    Ingo Franzki authored
    Since commit "s390/sha3: Support sha3 performance enhancements"
    the selftests of the sha3_256_s390 and sha3_512_s390 kernel digests
    sometimes fail with:
    
      alg: shash: sha3-256-s390 test failed (wrong result) on test vector 3,
                  cfg="import/export"
      alg: self-tests for sha3-256 using sha3-256-s390 failed (rc=-22)
    
    or with
    
      alg: ahash: sha3-256-s390 test failed (wrong result) on test vector 3,
                  cfg="digest misaligned splits crossing pages"
      alg: self-tests for sha3-256 using sha3-256-s390 failed (rc=-22)
    
    The first failure is because the newly introduced context field
    'first_message_part' is not copied during export and import operations.
    Because of that the value of 'first_message_part' is more or less random
    after an import into a newly allocated context and may or may not fit to
    the state of the imported SHA3 operation, causing an invalid hash when it
    does not fit.
    
    Save the 'first_message_part' field in the currently unused field 'partial'
    of struct sha3_state, even though the meaning of 'partial' is not exactly
    the same as 'first_message_part'. For the caller the returned state blob
    is opaque and it must only be ensured that the state can be imported later
    on by the module that exported it.
    
    The second failure is when on entry of s390_sha_update() the flag
    'first_message_part' is on, and kimd is called in the first 'if (index)'
    block as well as in the second 'if (len >= bsize)' block. In this case,
    the 'first_message_part' is turned off after the first kimd, but the
    function code incorrectly retains the NIP flag. Reset the NIP flag after
    the first kimd unconditionally besides turning 'first_message_part' off.
    Reported-by: default avatarMarc Hartmayer <mhartmay@linux.ibm.com>
    Fixes: 88c02b3f ("s390/sha3: Support sha3 performance enhancements")
    Reviewed-by: default avatarHarald Freudenberger <freude@linux.ibm.com>
    Reviewed-by: default avatarHolger Dengler <dengler@linux.ibm.com>
    Reviewed-by: default avatarJoerg Schmidbauer <jschmidb@de.ibm.com>
    Signed-off-by: default avatarIngo Franzki <ifranzki@linux.ibm.com>
    Signed-off-by: default avatarHeiko Carstens <hca@linux.ibm.com>
    992b7066
sha3_512_s390.c 3.83 KB