1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Algorithm testing framework and tests.
4 *
5 * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
6 * Copyright (c) 2002 Jean-Francois Dive <jef@linuxbe.org>
7 * Copyright (c) 2007 Nokia Siemens Networks
8 * Copyright (c) 2008 Herbert Xu <herbert@gondor.apana.org.au>
9 * Copyright (c) 2019 Google LLC
10 *
11 * Updated RFC4106 AES-GCM testing.
12 * Authors: Aidan O'Mahony (aidan.o.mahony@intel.com)
13 * Adrian Hoban <adrian.hoban@intel.com>
14 * Gabriele Paoloni <gabriele.paoloni@intel.com>
15 * Tadeusz Struk (tadeusz.struk@intel.com)
16 * Copyright (c) 2010, Intel Corporation.
17 */
18
19#include <crypto/aead.h>
20#include <crypto/hash.h>
21#include <crypto/skcipher.h>
22#include <linux/err.h>
23#include <linux/fips.h>
24#include <linux/module.h>
25#include <linux/once.h>
26#include <linux/prandom.h>
27#include <linux/scatterlist.h>
28#include <linux/slab.h>
29#include <linux/string.h>
30#include <linux/uio.h>
31#include <crypto/rng.h>
32#include <crypto/drbg.h>
33#include <crypto/akcipher.h>
34#include <crypto/kpp.h>
35#include <crypto/acompress.h>
36#include <crypto/sig.h>
37#include <crypto/internal/cipher.h>
38#include <crypto/internal/simd.h>
39
40#include "internal.h"
41
42MODULE_IMPORT_NS("CRYPTO_INTERNAL");
43
44static bool notests;
45module_param(notests, bool, 0644);
46MODULE_PARM_DESC(notests, "disable all crypto self-tests");
47
48#ifdef CONFIG_CRYPTO_SELFTESTS_FULL
49static bool noslowtests;
50module_param(noslowtests, bool, 0644);
51MODULE_PARM_DESC(noslowtests, "disable slow crypto self-tests");
52
53static unsigned int fuzz_iterations = 100;
54module_param(fuzz_iterations, uint, 0644);
55MODULE_PARM_DESC(fuzz_iterations, "number of fuzz test iterations");
56#else
57#define noslowtests 1
58#define fuzz_iterations 0
59#endif
60
61#ifndef CONFIG_CRYPTO_SELFTESTS
62
63/* a perfect nop */
64int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
65{
66 return 0;
67}
68
69#else
70
71#include "testmgr.h"
72
73/*
74 * Need slab memory for testing (size in number of pages).
75 */
76#define XBUFSIZE 8
77
78/*
79* Used by test_cipher()
80*/
81#define ENCRYPT 1
82#define DECRYPT 0
83
84struct aead_test_suite {
85 const struct aead_testvec *vecs;
86 unsigned int count;
87
88 /*
89 * Set if trying to decrypt an inauthentic ciphertext with this
90 * algorithm might result in EINVAL rather than EBADMSG, due to other
91 * validation the algorithm does on the inputs such as length checks.
92 */
93 unsigned int einval_allowed : 1;
94
95 /*
96 * Set if this algorithm requires that the IV be located at the end of
97 * the AAD buffer, in addition to being given in the normal way. The
98 * behavior when the two IV copies differ is implementation-defined.
99 */
100 unsigned int aad_iv : 1;
101};
102
103struct cipher_test_suite {
104 const struct cipher_testvec *vecs;
105 unsigned int count;
106};
107
108struct comp_test_suite {
109 struct {
110 const struct comp_testvec *vecs;
111 unsigned int count;
112 } comp, decomp;
113};
114
115struct hash_test_suite {
116 const struct hash_testvec *vecs;
117 unsigned int count;
118};
119
120struct cprng_test_suite {
121 const struct cprng_testvec *vecs;
122 unsigned int count;
123};
124
125struct drbg_test_suite {
126 const struct drbg_testvec *vecs;
127 unsigned int count;
128};
129
130struct akcipher_test_suite {
131 const struct akcipher_testvec *vecs;
132 unsigned int count;
133};
134
135struct sig_test_suite {
136 const struct sig_testvec *vecs;
137 unsigned int count;
138};
139
140struct kpp_test_suite {
141 const struct kpp_testvec *vecs;
142 unsigned int count;
143};
144
145struct alg_test_desc {
146 const char *alg;
147 const char *generic_driver;
148 int (*test)(const struct alg_test_desc *desc, const char *driver,
149 u32 type, u32 mask);
150 int fips_allowed; /* set if alg is allowed in fips mode */
151
152 union {
153 struct aead_test_suite aead;
154 struct cipher_test_suite cipher;
155 struct comp_test_suite comp;
156 struct hash_test_suite hash;
157 struct cprng_test_suite cprng;
158 struct drbg_test_suite drbg;
159 struct akcipher_test_suite akcipher;
160 struct sig_test_suite sig;
161 struct kpp_test_suite kpp;
162 } suite;
163};
164
165static void hexdump(unsigned char *buf, unsigned int len)
166{
167 print_hex_dump(KERN_CONT, "", DUMP_PREFIX_OFFSET,
168 16, 1,
169 buf, len, false);
170}
171
172static int __testmgr_alloc_buf(char *buf[XBUFSIZE], int order)
173{
174 int i;
175
176 for (i = 0; i < XBUFSIZE; i++) {
177 buf[i] = (char *)__get_free_pages(GFP_KERNEL, order);
178 if (!buf[i])
179 goto err_free_buf;
180 }
181
182 return 0;
183
184err_free_buf:
185 while (i-- > 0)
186 free_pages((unsigned long)buf[i], order);
187
188 return -ENOMEM;
189}
190
191static int testmgr_alloc_buf(char *buf[XBUFSIZE])
192{
193 return __testmgr_alloc_buf(buf, 0);
194}
195
196static void __testmgr_free_buf(char *buf[XBUFSIZE], int order)
197{
198 int i;
199
200 for (i = 0; i < XBUFSIZE; i++)
201 free_pages((unsigned long)buf[i], order);
202}
203
204static void testmgr_free_buf(char *buf[XBUFSIZE])
205{
206 __testmgr_free_buf(buf, 0);
207}
208
209#define TESTMGR_POISON_BYTE 0xfe
210#define TESTMGR_POISON_LEN 16
211
212static inline void testmgr_poison(void *addr, size_t len)
213{
214 memset(addr, TESTMGR_POISON_BYTE, len);
215}
216
217/* Is the memory region still fully poisoned? */
218static inline bool testmgr_is_poison(const void *addr, size_t len)
219{
220 return memchr_inv(addr, TESTMGR_POISON_BYTE, len) == NULL;
221}
222
223/* flush type for hash algorithms */
224enum flush_type {
225 /* merge with update of previous buffer(s) */
226 FLUSH_TYPE_NONE = 0,
227
228 /* update with previous buffer(s) before doing this one */
229 FLUSH_TYPE_FLUSH,
230
231 /* likewise, but also export and re-import the intermediate state */
232 FLUSH_TYPE_REIMPORT,
233};
234
235/* finalization function for hash algorithms */
236enum finalization_type {
237 FINALIZATION_TYPE_FINAL, /* use final() */
238 FINALIZATION_TYPE_FINUP, /* use finup() */
239 FINALIZATION_TYPE_DIGEST, /* use digest() */
240};
241
242/*
243 * Whether the crypto operation will occur in-place, and if so whether the
244 * source and destination scatterlist pointers will coincide (req->src ==
245 * req->dst), or whether they'll merely point to two separate scatterlists
246 * (req->src != req->dst) that reference the same underlying memory.
247 *
248 * This is only relevant for algorithm types that support in-place operation.
249 */
250enum inplace_mode {
251 OUT_OF_PLACE,
252 INPLACE_ONE_SGLIST,
253 INPLACE_TWO_SGLISTS,
254};
255
256#define TEST_SG_TOTAL 10000
257
258/**
259 * struct test_sg_division - description of a scatterlist entry
260 *
261 * This struct describes one entry of a scatterlist being constructed to check a
262 * crypto test vector.
263 *
264 * @proportion_of_total: length of this chunk relative to the total length,
265 * given as a proportion out of TEST_SG_TOTAL so that it
266 * scales to fit any test vector
267 * @offset: byte offset into a 2-page buffer at which this chunk will start
268 * @offset_relative_to_alignmask: if true, add the algorithm's alignmask to the
269 * @offset
270 * @flush_type: for hashes, whether an update() should be done now vs.
271 * continuing to accumulate data
272 * @nosimd: if doing the pending update(), do it with SIMD disabled?
273 */
274struct test_sg_division {
275 unsigned int proportion_of_total;
276 unsigned int offset;
277 bool offset_relative_to_alignmask;
278 enum flush_type flush_type;
279 bool nosimd;
280};
281
282/**
283 * struct testvec_config - configuration for testing a crypto test vector
284 *
285 * This struct describes the data layout and other parameters with which each
286 * crypto test vector can be tested.
287 *
288 * @name: name of this config, logged for debugging purposes if a test fails
289 * @inplace_mode: whether and how to operate on the data in-place, if applicable
290 * @req_flags: extra request_flags, e.g. CRYPTO_TFM_REQ_MAY_SLEEP
291 * @src_divs: description of how to arrange the source scatterlist
292 * @dst_divs: description of how to arrange the dst scatterlist, if applicable
293 * for the algorithm type. Defaults to @src_divs if unset.
294 * @iv_offset: misalignment of the IV in the range [0..MAX_ALGAPI_ALIGNMASK+1],
295 * where 0 is aligned to a 2*(MAX_ALGAPI_ALIGNMASK+1) byte boundary
296 * @iv_offset_relative_to_alignmask: if true, add the algorithm's alignmask to
297 * the @iv_offset
298 * @key_offset: misalignment of the key, where 0 is default alignment
299 * @key_offset_relative_to_alignmask: if true, add the algorithm's alignmask to
300 * the @key_offset
301 * @finalization_type: what finalization function to use for hashes
302 * @nosimd: execute with SIMD disabled? Requires !CRYPTO_TFM_REQ_MAY_SLEEP.
303 * This applies to the parts of the operation that aren't controlled
304 * individually by @nosimd_setkey or @src_divs[].nosimd.
305 * @nosimd_setkey: set the key (if applicable) with SIMD disabled? Requires
306 * !CRYPTO_TFM_REQ_MAY_SLEEP.
307 */
308struct testvec_config {
309 const char *name;
310 enum inplace_mode inplace_mode;
311 u32 req_flags;
312 struct test_sg_division src_divs[XBUFSIZE];
313 struct test_sg_division dst_divs[XBUFSIZE];
314 unsigned int iv_offset;
315 unsigned int key_offset;
316 bool iv_offset_relative_to_alignmask;
317 bool key_offset_relative_to_alignmask;
318 enum finalization_type finalization_type;
319 bool nosimd;
320 bool nosimd_setkey;
321};
322
323#define TESTVEC_CONFIG_NAMELEN 192
324
325/*
326 * The following are the lists of testvec_configs to test for each algorithm
327 * type when the "fast" crypto self-tests are enabled. They aim to provide good
328 * test coverage, while keeping the test time much shorter than the "full" tests
329 * so that the "fast" tests can be enabled in a wider range of circumstances.
330 */
331
332/* Configs for skciphers and aeads */
333static const struct testvec_config default_cipher_testvec_configs[] = {
334 {
335 .name = "in-place (one sglist)",
336 .inplace_mode = INPLACE_ONE_SGLIST,
337 .src_divs = { { .proportion_of_total = 10000 } },
338 }, {
339 .name = "in-place (two sglists)",
340 .inplace_mode = INPLACE_TWO_SGLISTS,
341 .src_divs = { { .proportion_of_total = 10000 } },
342 }, {
343 .name = "out-of-place",
344 .inplace_mode = OUT_OF_PLACE,
345 .src_divs = { { .proportion_of_total = 10000 } },
346 }, {
347 .name = "unaligned buffer, offset=1",
348 .src_divs = { { .proportion_of_total = 10000, .offset = 1 } },
349 .iv_offset = 1,
350 .key_offset = 1,
351 }, {
352 .name = "buffer aligned only to alignmask",
353 .src_divs = {
354 {
355 .proportion_of_total = 10000,
356 .offset = 1,
357 .offset_relative_to_alignmask = true,
358 },
359 },
360 .iv_offset = 1,
361 .iv_offset_relative_to_alignmask = true,
362 .key_offset = 1,
363 .key_offset_relative_to_alignmask = true,
364 }, {
365 .name = "two even aligned splits",
366 .src_divs = {
367 { .proportion_of_total = 5000 },
368 { .proportion_of_total = 5000 },
369 },
370 }, {
371 .name = "one src, two even splits dst",
372 .inplace_mode = OUT_OF_PLACE,
373 .src_divs = { { .proportion_of_total = 10000 } },
374 .dst_divs = {
375 { .proportion_of_total = 5000 },
376 { .proportion_of_total = 5000 },
377 },
378 }, {
379 .name = "uneven misaligned splits, may sleep",
380 .req_flags = CRYPTO_TFM_REQ_MAY_SLEEP,
381 .src_divs = {
382 { .proportion_of_total = 1900, .offset = 33 },
383 { .proportion_of_total = 3300, .offset = 7 },
384 { .proportion_of_total = 4800, .offset = 18 },
385 },
386 .iv_offset = 3,
387 .key_offset = 3,
388 }, {
389 .name = "misaligned splits crossing pages, inplace",
390 .inplace_mode = INPLACE_ONE_SGLIST,
391 .src_divs = {
392 {
393 .proportion_of_total = 7500,
394 .offset = PAGE_SIZE - 32
395 }, {
396 .proportion_of_total = 2500,
397 .offset = PAGE_SIZE - 7
398 },
399 },
400 }
401};
402
403static const struct testvec_config default_hash_testvec_configs[] = {
404 {
405 .name = "init+update+final aligned buffer",
406 .src_divs = { { .proportion_of_total = 10000 } },
407 .finalization_type = FINALIZATION_TYPE_FINAL,
408 }, {
409 .name = "init+finup aligned buffer",
410 .src_divs = { { .proportion_of_total = 10000 } },
411 .finalization_type = FINALIZATION_TYPE_FINUP,
412 }, {
413 .name = "digest aligned buffer",
414 .src_divs = { { .proportion_of_total = 10000 } },
415 .finalization_type = FINALIZATION_TYPE_DIGEST,
416 }, {
417 .name = "init+update+final misaligned buffer",
418 .src_divs = { { .proportion_of_total = 10000, .offset = 1 } },
419 .finalization_type = FINALIZATION_TYPE_FINAL,
420 .key_offset = 1,
421 }, {
422 .name = "digest misaligned buffer",
423 .src_divs = {
424 {
425 .proportion_of_total = 10000,
426 .offset = 1,
427 },
428 },
429 .finalization_type = FINALIZATION_TYPE_DIGEST,
430 .key_offset = 1,
431 }, {
432 .name = "init+update+update+final two even splits",
433 .src_divs = {
434 { .proportion_of_total = 5000 },
435 {
436 .proportion_of_total = 5000,
437 .flush_type = FLUSH_TYPE_FLUSH,
438 },
439 },
440 .finalization_type = FINALIZATION_TYPE_FINAL,
441 }, {
442 .name = "digest uneven misaligned splits, may sleep",
443 .req_flags = CRYPTO_TFM_REQ_MAY_SLEEP,
444 .src_divs = {
445 { .proportion_of_total = 1900, .offset = 33 },
446 { .proportion_of_total = 3300, .offset = 7 },
447 { .proportion_of_total = 4800, .offset = 18 },
448 },
449 .finalization_type = FINALIZATION_TYPE_DIGEST,
450 }, {
451 .name = "digest misaligned splits crossing pages",
452 .src_divs = {
453 {
454 .proportion_of_total = 7500,
455 .offset = PAGE_SIZE - 32,
456 }, {
457 .proportion_of_total = 2500,
458 .offset = PAGE_SIZE - 7,
459 },
460 },
461 .finalization_type = FINALIZATION_TYPE_DIGEST,
462 }, {
463 .name = "import/export",
464 .src_divs = {
465 {
466 .proportion_of_total = 6500,
467 .flush_type = FLUSH_TYPE_REIMPORT,
468 }, {
469 .proportion_of_total = 3500,
470 .flush_type = FLUSH_TYPE_REIMPORT,
471 },
472 },
473 .finalization_type = FINALIZATION_TYPE_FINAL,
474 }
475};
476
477static unsigned int count_test_sg_divisions(const struct test_sg_division *divs)
478{
479 unsigned int remaining = TEST_SG_TOTAL;
480 unsigned int ndivs = 0;
481
482 do {
483 remaining -= divs[ndivs++].proportion_of_total;
484 } while (remaining);
485
486 return ndivs;
487}
488
489#define SGDIVS_HAVE_FLUSHES BIT(0)
490#define SGDIVS_HAVE_NOSIMD BIT(1)
491
492static bool valid_sg_divisions(const struct test_sg_division *divs,
493 unsigned int count, int *flags_ret)
494{
495 unsigned int total = 0;
496 unsigned int i;
497
498 for (i = 0; i < count && total != TEST_SG_TOTAL; i++) {
499 if (divs[i].proportion_of_total <= 0 ||
500 divs[i].proportion_of_total > TEST_SG_TOTAL - total)
501 return false;
502 total += divs[i].proportion_of_total;
503 if (divs[i].flush_type != FLUSH_TYPE_NONE)
504 *flags_ret |= SGDIVS_HAVE_FLUSHES;
505 if (divs[i].nosimd)
506 *flags_ret |= SGDIVS_HAVE_NOSIMD;
507 }
508 return total == TEST_SG_TOTAL &&
509 memchr_inv(&divs[i], 0, (count - i) * sizeof(divs[0])) == NULL;
510}
511
512/*
513 * Check whether the given testvec_config is valid. This isn't strictly needed
514 * since every testvec_config should be valid, but check anyway so that people
515 * don't unknowingly add broken configs that don't do what they wanted.
516 */
517static bool valid_testvec_config(const struct testvec_config *cfg)
518{
519 int flags = 0;
520
521 if (cfg->name == NULL)
522 return false;
523
524 if (!valid_sg_divisions(cfg->src_divs, ARRAY_SIZE(cfg->src_divs),
525 &flags))
526 return false;
527
528 if (cfg->dst_divs[0].proportion_of_total) {
529 if (!valid_sg_divisions(cfg->dst_divs,
530 ARRAY_SIZE(cfg->dst_divs), &flags))
531 return false;
532 } else {
533 if (memchr_inv(cfg->dst_divs, 0, sizeof(cfg->dst_divs)))
534 return false;
535 /* defaults to dst_divs=src_divs */
536 }
537
538 if (cfg->iv_offset +
539 (cfg->iv_offset_relative_to_alignmask ? MAX_ALGAPI_ALIGNMASK : 0) >
540 MAX_ALGAPI_ALIGNMASK + 1)
541 return false;
542
543 if ((flags & (SGDIVS_HAVE_FLUSHES | SGDIVS_HAVE_NOSIMD)) &&
544 cfg->finalization_type == FINALIZATION_TYPE_DIGEST)
545 return false;
546
547 if ((cfg->nosimd || cfg->nosimd_setkey ||
548 (flags & SGDIVS_HAVE_NOSIMD)) &&
549 (cfg->req_flags & CRYPTO_TFM_REQ_MAY_SLEEP))
550 return false;
551
552 return true;
553}
554
555struct test_sglist {
556 char *bufs[XBUFSIZE];
557 struct scatterlist sgl[XBUFSIZE];
558 struct scatterlist sgl_saved[XBUFSIZE];
559 struct scatterlist *sgl_ptr;
560 unsigned int nents;
561};
562
563static int init_test_sglist(struct test_sglist *tsgl)
564{
565 return __testmgr_alloc_buf(tsgl->bufs, 1 /* two pages per buffer */);
566}
567
568static void destroy_test_sglist(struct test_sglist *tsgl)
569{
570 return __testmgr_free_buf(tsgl->bufs, 1 /* two pages per buffer */);
571}
572
573/**
574 * build_test_sglist() - build a scatterlist for a crypto test
575 *
576 * @tsgl: the scatterlist to build. @tsgl->bufs[] contains an array of 2-page
577 * buffers which the scatterlist @tsgl->sgl[] will be made to point into.
578 * @divs: the layout specification on which the scatterlist will be based
579 * @alignmask: the algorithm's alignmask
580 * @total_len: the total length of the scatterlist to build in bytes
581 * @data: if non-NULL, the buffers will be filled with this data until it ends.
582 * Otherwise the buffers will be poisoned. In both cases, some bytes
583 * past the end of each buffer will be poisoned to help detect overruns.
584 * @out_divs: if non-NULL, the test_sg_division to which each scatterlist entry
585 * corresponds will be returned here. This will match @divs except
586 * that divisions resolving to a length of 0 are omitted as they are
587 * not included in the scatterlist.
588 *
589 * Return: 0 or a -errno value
590 */
591static int build_test_sglist(struct test_sglist *tsgl,
592 const struct test_sg_division *divs,
593 const unsigned int alignmask,
594 const unsigned int total_len,
595 struct iov_iter *data,
596 const struct test_sg_division *out_divs[XBUFSIZE])
597{
598 struct {
599 const struct test_sg_division *div;
600 size_t length;
601 } partitions[XBUFSIZE];
602 const unsigned int ndivs = count_test_sg_divisions(divs);
603 unsigned int len_remaining = total_len;
604 unsigned int i;
605
606 BUILD_BUG_ON(ARRAY_SIZE(partitions) != ARRAY_SIZE(tsgl->sgl));
607 if (WARN_ON(ndivs > ARRAY_SIZE(partitions)))
608 return -EINVAL;
609
610 /* Calculate the (div, length) pairs */
611 tsgl->nents = 0;
612 for (i = 0; i < ndivs; i++) {
613 unsigned int len_this_sg =
614 min(len_remaining,
615 (total_len * divs[i].proportion_of_total +
616 TEST_SG_TOTAL / 2) / TEST_SG_TOTAL);
617
618 if (len_this_sg != 0) {
619 partitions[tsgl->nents].div = &divs[i];
620 partitions[tsgl->nents].length = len_this_sg;
621 tsgl->nents++;
622 len_remaining -= len_this_sg;
623 }
624 }
625 if (tsgl->nents == 0) {
626 partitions[tsgl->nents].div = &divs[0];
627 partitions[tsgl->nents].length = 0;
628 tsgl->nents++;
629 }
630 partitions[tsgl->nents - 1].length += len_remaining;
631
632 /* Set up the sgl entries and fill the data or poison */
633 sg_init_table(tsgl->sgl, tsgl->nents);
634 for (i = 0; i < tsgl->nents; i++) {
635 unsigned int offset = partitions[i].div->offset;
636 void *addr;
637
638 if (partitions[i].div->offset_relative_to_alignmask)
639 offset += alignmask;
640
641 while (offset + partitions[i].length + TESTMGR_POISON_LEN >
642 2 * PAGE_SIZE) {
643 if (WARN_ON(offset <= 0))
644 return -EINVAL;
645 offset /= 2;
646 }
647
648 addr = &tsgl->bufs[i][offset];
649 sg_set_buf(&tsgl->sgl[i], addr, partitions[i].length);
650
651 if (out_divs)
652 out_divs[i] = partitions[i].div;
653
654 if (data) {
655 size_t copy_len, copied;
656
657 copy_len = min(partitions[i].length, data->count);
658 copied = copy_from_iter(addr, copy_len, data);
659 if (WARN_ON(copied != copy_len))
660 return -EINVAL;
661 testmgr_poison(addr + copy_len, partitions[i].length +
662 TESTMGR_POISON_LEN - copy_len);
663 } else {
664 testmgr_poison(addr, partitions[i].length +
665 TESTMGR_POISON_LEN);
666 }
667 }
668
669 sg_mark_end(&tsgl->sgl[tsgl->nents - 1]);
670 tsgl->sgl_ptr = tsgl->sgl;
671 memcpy(tsgl->sgl_saved, tsgl->sgl, tsgl->nents * sizeof(tsgl->sgl[0]));
672 return 0;
673}
674
675/*
676 * Verify that a scatterlist crypto operation produced the correct output.
677 *
678 * @tsgl: scatterlist containing the actual output
679 * @expected_output: buffer containing the expected output
680 * @len_to_check: length of @expected_output in bytes
681 * @unchecked_prefix_len: number of ignored bytes in @tsgl prior to real result
682 * @check_poison: verify that the poison bytes after each chunk are intact?
683 *
684 * Return: 0 if correct, -EINVAL if incorrect, -EOVERFLOW if buffer overrun.
685 */
686static int verify_correct_output(const struct test_sglist *tsgl,
687 const char *expected_output,
688 unsigned int len_to_check,
689 unsigned int unchecked_prefix_len,
690 bool check_poison)
691{
692 unsigned int i;
693
694 for (i = 0; i < tsgl->nents; i++) {
695 struct scatterlist *sg = &tsgl->sgl_ptr[i];
696 unsigned int len = sg->length;
697 unsigned int offset = sg->offset;
698 const char *actual_output;
699
700 if (unchecked_prefix_len) {
701 if (unchecked_prefix_len >= len) {
702 unchecked_prefix_len -= len;
703 continue;
704 }
705 offset += unchecked_prefix_len;
706 len -= unchecked_prefix_len;
707 unchecked_prefix_len = 0;
708 }
709 len = min(len, len_to_check);
710 actual_output = page_address(sg_page(sg)) + offset;
711 if (memcmp(expected_output, actual_output, len) != 0)
712 return -EINVAL;
713 if (check_poison &&
714 !testmgr_is_poison(actual_output + len, TESTMGR_POISON_LEN))
715 return -EOVERFLOW;
716 len_to_check -= len;
717 expected_output += len;
718 }
719 if (WARN_ON(len_to_check != 0))
720 return -EINVAL;
721 return 0;
722}
723
724static bool is_test_sglist_corrupted(const struct test_sglist *tsgl)
725{
726 unsigned int i;
727
728 for (i = 0; i < tsgl->nents; i++) {
729 if (tsgl->sgl[i].page_link != tsgl->sgl_saved[i].page_link)
730 return true;
731 if (tsgl->sgl[i].offset != tsgl->sgl_saved[i].offset)
732 return true;
733 if (tsgl->sgl[i].length != tsgl->sgl_saved[i].length)
734 return true;
735 }
736 return false;
737}
738
739struct cipher_test_sglists {
740 struct test_sglist src;
741 struct test_sglist dst;
742};
743
744static struct cipher_test_sglists *alloc_cipher_test_sglists(void)
745{
746 struct cipher_test_sglists *tsgls;
747
748 tsgls = kmalloc(sizeof(*tsgls), GFP_KERNEL);
749 if (!tsgls)
750 return NULL;
751
752 if (init_test_sglist(&tsgls->src) != 0)
753 goto fail_kfree;
754 if (init_test_sglist(&tsgls->dst) != 0)
755 goto fail_destroy_src;
756
757 return tsgls;
758
759fail_destroy_src:
760 destroy_test_sglist(&tsgls->src);
761fail_kfree:
762 kfree(tsgls);
763 return NULL;
764}
765
766static void free_cipher_test_sglists(struct cipher_test_sglists *tsgls)
767{
768 if (tsgls) {
769 destroy_test_sglist(&tsgls->src);
770 destroy_test_sglist(&tsgls->dst);
771 kfree(tsgls);
772 }
773}
774
775/* Build the src and dst scatterlists for an skcipher or AEAD test */
776static int build_cipher_test_sglists(struct cipher_test_sglists *tsgls,
777 const struct testvec_config *cfg,
778 unsigned int alignmask,
779 unsigned int src_total_len,
780 unsigned int dst_total_len,
781 const struct kvec *inputs,
782 unsigned int nr_inputs)
783{
784 struct iov_iter input;
785 int err;
786
787 iov_iter_kvec(&input, ITER_SOURCE, inputs, nr_inputs, src_total_len);
788 err = build_test_sglist(&tsgls->src, cfg->src_divs, alignmask,
789 cfg->inplace_mode != OUT_OF_PLACE ?
790 max(dst_total_len, src_total_len) :
791 src_total_len,
792 &input, NULL);
793 if (err)
794 return err;
795
796 /*
797 * In-place crypto operations can use the same scatterlist for both the
798 * source and destination (req->src == req->dst), or can use separate
799 * scatterlists (req->src != req->dst) which point to the same
800 * underlying memory. Make sure to test both cases.
801 */
802 if (cfg->inplace_mode == INPLACE_ONE_SGLIST) {
803 tsgls->dst.sgl_ptr = tsgls->src.sgl;
804 tsgls->dst.nents = tsgls->src.nents;
805 return 0;
806 }
807 if (cfg->inplace_mode == INPLACE_TWO_SGLISTS) {
808 /*
809 * For now we keep it simple and only test the case where the
810 * two scatterlists have identical entries, rather than
811 * different entries that split up the same memory differently.
812 */
813 memcpy(tsgls->dst.sgl, tsgls->src.sgl,
814 tsgls->src.nents * sizeof(tsgls->src.sgl[0]));
815 memcpy(tsgls->dst.sgl_saved, tsgls->src.sgl,
816 tsgls->src.nents * sizeof(tsgls->src.sgl[0]));
817 tsgls->dst.sgl_ptr = tsgls->dst.sgl;
818 tsgls->dst.nents = tsgls->src.nents;
819 return 0;
820 }
821 /* Out of place */
822 return build_test_sglist(&tsgls->dst,
823 cfg->dst_divs[0].proportion_of_total ?
824 cfg->dst_divs : cfg->src_divs,
825 alignmask, dst_total_len, NULL, NULL);
826}
827
828/*
829 * Support for testing passing a misaligned key to setkey():
830 *
831 * If cfg->key_offset is set, copy the key into a new buffer at that offset,
832 * optionally adding alignmask. Else, just use the key directly.
833 */
834static int prepare_keybuf(const u8 *key, unsigned int ksize,
835 const struct testvec_config *cfg,
836 unsigned int alignmask,
837 const u8 **keybuf_ret, const u8 **keyptr_ret)
838{
839 unsigned int key_offset = cfg->key_offset;
840 u8 *keybuf = NULL, *keyptr = (u8 *)key;
841
842 if (key_offset != 0) {
843 if (cfg->key_offset_relative_to_alignmask)
844 key_offset += alignmask;
845 keybuf = kmalloc(key_offset + ksize, GFP_KERNEL);
846 if (!keybuf)
847 return -ENOMEM;
848 keyptr = keybuf + key_offset;
849 memcpy(keyptr, key, ksize);
850 }
851 *keybuf_ret = keybuf;
852 *keyptr_ret = keyptr;
853 return 0;
854}
855
856/*
857 * Like setkey_f(tfm, key, ksize), but sometimes misalign the key.
858 * In addition, run the setkey function in no-SIMD context if requested.
859 */
860#define do_setkey(setkey_f, tfm, key, ksize, cfg, alignmask) \
861({ \
862 const u8 *keybuf, *keyptr; \
863 int err; \
864 \
865 err = prepare_keybuf((key), (ksize), (cfg), (alignmask), \
866 &keybuf, &keyptr); \
867 if (err == 0) { \
868 if ((cfg)->nosimd_setkey) \
869 crypto_disable_simd_for_test(); \
870 err = setkey_f((tfm), keyptr, (ksize)); \
871 if ((cfg)->nosimd_setkey) \
872 crypto_reenable_simd_for_test(); \
873 kfree(keybuf); \
874 } \
875 err; \
876})
877
878/*
879 * The fuzz tests use prandom instead of the normal Linux RNG since they don't
880 * need cryptographically secure random numbers. This greatly improves the
881 * performance of these tests, especially if they are run before the Linux RNG
882 * has been initialized or if they are run on a lockdep-enabled kernel.
883 */
884
885static inline void init_rnd_state(struct rnd_state *rng)
886{
887 prandom_seed_state(rng, get_random_u64());
888}
889
890static inline u8 prandom_u8(struct rnd_state *rng)
891{
892 return prandom_u32_state(rng);
893}
894
895static inline u32 prandom_u32_below(struct rnd_state *rng, u32 ceil)
896{
897 /*
898 * This is slightly biased for non-power-of-2 values of 'ceil', but this
899 * isn't important here.
900 */
901 return prandom_u32_state(rng) % ceil;
902}
903
904static inline bool prandom_bool(struct rnd_state *rng)
905{
906 return prandom_u32_below(rng, 2);
907}
908
909static inline u32 prandom_u32_inclusive(struct rnd_state *rng,
910 u32 floor, u32 ceil)
911{
912 return floor + prandom_u32_below(rng, ceil - floor + 1);
913}
914
915/* Generate a random length in range [0, max_len], but prefer smaller values */
916static unsigned int generate_random_length(struct rnd_state *rng,
917 unsigned int max_len)
918{
919 unsigned int len = prandom_u32_below(rng, max_len + 1);
920
921 switch (prandom_u32_below(rng, 4)) {
922 case 0:
923 len %= 64;
924 break;
925 case 1:
926 len %= 256;
927 break;
928 case 2:
929 len %= 1024;
930 break;
931 default:
932 break;
933 }
934 if (len && prandom_u32_below(rng, 4) == 0)
935 len = rounddown_pow_of_two(len);
936 return len;
937}
938
939/* Flip a random bit in the given nonempty data buffer */
940static void flip_random_bit(struct rnd_state *rng, u8 *buf, size_t size)
941{
942 size_t bitpos;
943
944 bitpos = prandom_u32_below(rng, size * 8);
945 buf[bitpos / 8] ^= 1 << (bitpos % 8);
946}
947
948/* Flip a random byte in the given nonempty data buffer */
949static void flip_random_byte(struct rnd_state *rng, u8 *buf, size_t size)
950{
951 buf[prandom_u32_below(rng, size)] ^= 0xff;
952}
953
954/* Sometimes make some random changes to the given nonempty data buffer */
955static void mutate_buffer(struct rnd_state *rng, u8 *buf, size_t size)
956{
957 size_t num_flips;
958 size_t i;
959
960 /* Sometimes flip some bits */
961 if (prandom_u32_below(rng, 4) == 0) {
962 num_flips = min_t(size_t, 1 << prandom_u32_below(rng, 8),
963 size * 8);
964 for (i = 0; i < num_flips; i++)
965 flip_random_bit(rng, buf, size);
966 }
967
968 /* Sometimes flip some bytes */
969 if (prandom_u32_below(rng, 4) == 0) {
970 num_flips = min_t(size_t, 1 << prandom_u32_below(rng, 8), size);
971 for (i = 0; i < num_flips; i++)
972 flip_random_byte(rng, buf, size);
973 }
974}
975
976/* Randomly generate 'count' bytes, but sometimes make them "interesting" */
977static void generate_random_bytes(struct rnd_state *rng, u8 *buf, size_t count)
978{
979 u8 b;
980 u8 increment;
981 size_t i;
982
983 if (count == 0)
984 return;
985
986 switch (prandom_u32_below(rng, 8)) { /* Choose a generation strategy */
987 case 0:
988 case 1:
989 /* All the same byte, plus optional mutations */
990 switch (prandom_u32_below(rng, 4)) {
991 case 0:
992 b = 0x00;
993 break;
994 case 1:
995 b = 0xff;
996 break;
997 default:
998 b = prandom_u8(rng);
999 break;
1000 }
1001 memset(buf, b, count);
1002 mutate_buffer(rng, buf, count);
1003 break;
1004 case 2:
1005 /* Ascending or descending bytes, plus optional mutations */
1006 increment = prandom_u8(rng);
1007 b = prandom_u8(rng);
1008 for (i = 0; i < count; i++, b += increment)
1009 buf[i] = b;
1010 mutate_buffer(rng, buf, count);
1011 break;
1012 default:
1013 /* Fully random bytes */
1014 prandom_bytes_state(rng, buf, count);
1015 }
1016}
1017
1018static char *generate_random_sgl_divisions(struct rnd_state *rng,
1019 struct test_sg_division *divs,
1020 size_t max_divs, char *p, char *end,
1021 bool gen_flushes, u32 req_flags)
1022{
1023 struct test_sg_division *div = divs;
1024 unsigned int remaining = TEST_SG_TOTAL;
1025
1026 do {
1027 unsigned int this_len;
1028 const char *flushtype_str;
1029
1030 if (div == &divs[max_divs - 1] || prandom_bool(rng))
1031 this_len = remaining;
1032 else if (prandom_u32_below(rng, 4) == 0)
1033 this_len = (remaining + 1) / 2;
1034 else
1035 this_len = prandom_u32_inclusive(rng, 1, remaining);
1036 div->proportion_of_total = this_len;
1037
1038 if (prandom_u32_below(rng, 4) == 0)
1039 div->offset = prandom_u32_inclusive(rng,
1040 PAGE_SIZE - 128,
1041 PAGE_SIZE - 1);
1042 else if (prandom_bool(rng))
1043 div->offset = prandom_u32_below(rng, 32);
1044 else
1045 div->offset = prandom_u32_below(rng, PAGE_SIZE);
1046 if (prandom_u32_below(rng, 8) == 0)
1047 div->offset_relative_to_alignmask = true;
1048
1049 div->flush_type = FLUSH_TYPE_NONE;
1050 if (gen_flushes) {
1051 switch (prandom_u32_below(rng, 4)) {
1052 case 0:
1053 div->flush_type = FLUSH_TYPE_REIMPORT;
1054 break;
1055 case 1:
1056 div->flush_type = FLUSH_TYPE_FLUSH;
1057 break;
1058 }
1059 }
1060
1061 if (div->flush_type != FLUSH_TYPE_NONE &&
1062 !(req_flags & CRYPTO_TFM_REQ_MAY_SLEEP) &&
1063 prandom_bool(rng))
1064 div->nosimd = true;
1065
1066 switch (div->flush_type) {
1067 case FLUSH_TYPE_FLUSH:
1068 if (div->nosimd)
1069 flushtype_str = "<flush,nosimd>";
1070 else
1071 flushtype_str = "<flush>";
1072 break;
1073 case FLUSH_TYPE_REIMPORT:
1074 if (div->nosimd)
1075 flushtype_str = "<reimport,nosimd>";
1076 else
1077 flushtype_str = "<reimport>";
1078 break;
1079 default:
1080 flushtype_str = "";
1081 break;
1082 }
1083
1084 BUILD_BUG_ON(TEST_SG_TOTAL != 10000); /* for "%u.%u%%" */
1085 p += scnprintf(p, end - p, "%s%u.%u%%@%s+%u%s", flushtype_str,
1086 this_len / 100, this_len % 100,
1087 div->offset_relative_to_alignmask ?
1088 "alignmask" : "",
1089 div->offset, this_len == remaining ? "" : ", ");
1090 remaining -= this_len;
1091 div++;
1092 } while (remaining);
1093
1094 return p;
1095}
1096
1097/* Generate a random testvec_config for fuzz testing */
1098static void generate_random_testvec_config(struct rnd_state *rng,
1099 struct testvec_config *cfg,
1100 char *name, size_t max_namelen)
1101{
1102 char *p = name;
1103 char * const end = name + max_namelen;
1104
1105 memset(cfg, 0, sizeof(*cfg));
1106
1107 cfg->name = name;
1108
1109 p += scnprintf(p, end - p, "random:");
1110
1111 switch (prandom_u32_below(rng, 4)) {
1112 case 0:
1113 case 1:
1114 cfg->inplace_mode = OUT_OF_PLACE;
1115 break;
1116 case 2:
1117 cfg->inplace_mode = INPLACE_ONE_SGLIST;
1118 p += scnprintf(p, end - p, " inplace_one_sglist");
1119 break;
1120 default:
1121 cfg->inplace_mode = INPLACE_TWO_SGLISTS;
1122 p += scnprintf(p, end - p, " inplace_two_sglists");
1123 break;
1124 }
1125
1126 if (prandom_bool(rng)) {
1127 cfg->req_flags |= CRYPTO_TFM_REQ_MAY_SLEEP;
1128 p += scnprintf(p, end - p, " may_sleep");
1129 }
1130
1131 switch (prandom_u32_below(rng, 4)) {
1132 case 0:
1133 cfg->finalization_type = FINALIZATION_TYPE_FINAL;
1134 p += scnprintf(p, end - p, " use_final");
1135 break;
1136 case 1:
1137 cfg->finalization_type = FINALIZATION_TYPE_FINUP;
1138 p += scnprintf(p, end - p, " use_finup");
1139 break;
1140 default:
1141 cfg->finalization_type = FINALIZATION_TYPE_DIGEST;
1142 p += scnprintf(p, end - p, " use_digest");
1143 break;
1144 }
1145
1146 if (!(cfg->req_flags & CRYPTO_TFM_REQ_MAY_SLEEP)) {
1147 if (prandom_bool(rng)) {
1148 cfg->nosimd = true;
1149 p += scnprintf(p, end - p, " nosimd");
1150 }
1151 if (prandom_bool(rng)) {
1152 cfg->nosimd_setkey = true;
1153 p += scnprintf(p, end - p, " nosimd_setkey");
1154 }
1155 }
1156
1157 p += scnprintf(p, end - p, " src_divs=[");
1158 p = generate_random_sgl_divisions(rng, cfg->src_divs,
1159 ARRAY_SIZE(cfg->src_divs), p, end,
1160 (cfg->finalization_type !=
1161 FINALIZATION_TYPE_DIGEST),
1162 cfg->req_flags);
1163 p += scnprintf(p, end - p, "]");
1164
1165 if (cfg->inplace_mode == OUT_OF_PLACE && prandom_bool(rng)) {
1166 p += scnprintf(p, end - p, " dst_divs=[");
1167 p = generate_random_sgl_divisions(rng, cfg->dst_divs,
1168 ARRAY_SIZE(cfg->dst_divs),
1169 p, end, false,
1170 cfg->req_flags);
1171 p += scnprintf(p, end - p, "]");
1172 }
1173
1174 if (prandom_bool(rng)) {
1175 cfg->iv_offset = prandom_u32_inclusive(rng, 1,
1176 MAX_ALGAPI_ALIGNMASK);
1177 p += scnprintf(p, end - p, " iv_offset=%u", cfg->iv_offset);
1178 }
1179
1180 if (prandom_bool(rng)) {
1181 cfg->key_offset = prandom_u32_inclusive(rng, 1,
1182 MAX_ALGAPI_ALIGNMASK);
1183 p += scnprintf(p, end - p, " key_offset=%u", cfg->key_offset);
1184 }
1185
1186 WARN_ON_ONCE(!valid_testvec_config(cfg));
1187}
1188
1189static void crypto_disable_simd_for_test(void)
1190{
1191#ifdef CONFIG_CRYPTO_SELFTESTS_FULL
1192 migrate_disable();
1193 __this_cpu_write(crypto_simd_disabled_for_test, true);
1194#endif
1195}
1196
1197static void crypto_reenable_simd_for_test(void)
1198{
1199#ifdef CONFIG_CRYPTO_SELFTESTS_FULL
1200 __this_cpu_write(crypto_simd_disabled_for_test, false);
1201 migrate_enable();
1202#endif
1203}
1204
1205/*
1206 * Given an algorithm name, build the name of the generic implementation of that
1207 * algorithm, assuming the usual naming convention. Specifically, this appends
1208 * "-generic" to every part of the name that is not a template name. Examples:
1209 *
1210 * aes => aes-generic
1211 * cbc(aes) => cbc(aes-generic)
1212 * cts(cbc(aes)) => cts(cbc(aes-generic))
1213 * rfc7539(chacha20,poly1305) => rfc7539(chacha20-generic,poly1305-generic)
1214 *
1215 * Return: 0 on success, or -ENAMETOOLONG if the generic name would be too long
1216 */
1217static int build_generic_driver_name(const char *algname,
1218 char driver_name[CRYPTO_MAX_ALG_NAME])
1219{
1220 const char *in = algname;
1221 char *out = driver_name;
1222 size_t len = strlen(algname);
1223
1224 if (len >= CRYPTO_MAX_ALG_NAME)
1225 goto too_long;
1226 do {
1227 const char *in_saved = in;
1228
1229 while (*in && *in != '(' && *in != ')' && *in != ',')
1230 *out++ = *in++;
1231 if (*in != '(' && in > in_saved) {
1232 len += 8;
1233 if (len >= CRYPTO_MAX_ALG_NAME)
1234 goto too_long;
1235 memcpy(out, "-generic", 8);
1236 out += 8;
1237 }
1238 } while ((*out++ = *in++) != '\0');
1239 return 0;
1240
1241too_long:
1242 pr_err("alg: generic driver name for \"%s\" would be too long\n",
1243 algname);
1244 return -ENAMETOOLONG;
1245}
1246
1247static int build_hash_sglist(struct test_sglist *tsgl,
1248 const struct hash_testvec *vec,
1249 const struct testvec_config *cfg,
1250 unsigned int alignmask,
1251 const struct test_sg_division *divs[XBUFSIZE])
1252{
1253 struct kvec kv;
1254 struct iov_iter input;
1255
1256 kv.iov_base = (void *)vec->plaintext;
1257 kv.iov_len = vec->psize;
1258 iov_iter_kvec(&input, ITER_SOURCE, &kv, 1, vec->psize);
1259 return build_test_sglist(tsgl, cfg->src_divs, alignmask, vec->psize,
1260 &input, divs);
1261}
1262
1263static int check_hash_result(const char *type,
1264 const u8 *result, unsigned int digestsize,
1265 const struct hash_testvec *vec,
1266 const char *vec_name,
1267 const char *driver,
1268 const struct testvec_config *cfg)
1269{
1270 if (memcmp(result, vec->digest, digestsize) != 0) {
1271 pr_err("alg: %s: %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
1272 type, driver, vec_name, cfg->name);
1273 return -EINVAL;
1274 }
1275 if (!testmgr_is_poison(&result[digestsize], TESTMGR_POISON_LEN)) {
1276 pr_err("alg: %s: %s overran result buffer on test vector %s, cfg=\"%s\"\n",
1277 type, driver, vec_name, cfg->name);
1278 return -EOVERFLOW;
1279 }
1280 return 0;
1281}
1282
1283static inline int check_shash_op(const char *op, int err,
1284 const char *driver, const char *vec_name,
1285 const struct testvec_config *cfg)
1286{
1287 if (err)
1288 pr_err("alg: shash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n",
1289 driver, op, err, vec_name, cfg->name);
1290 return err;
1291}
1292
1293/* Test one hash test vector in one configuration, using the shash API */
1294static int test_shash_vec_cfg(const struct hash_testvec *vec,
1295 const char *vec_name,
1296 const struct testvec_config *cfg,
1297 struct shash_desc *desc,
1298 struct test_sglist *tsgl,
1299 u8 *hashstate)
1300{
1301 struct crypto_shash *tfm = desc->tfm;
1302 const unsigned int digestsize = crypto_shash_digestsize(tfm);
1303 const unsigned int statesize = crypto_shash_statesize(tfm);
1304 const char *driver = crypto_shash_driver_name(tfm);
1305 const struct test_sg_division *divs[XBUFSIZE];
1306 unsigned int i;
1307 u8 result[HASH_MAX_DIGESTSIZE + TESTMGR_POISON_LEN];
1308 int err;
1309
1310 /* Set the key, if specified */
1311 if (vec->ksize) {
1312 err = do_setkey(crypto_shash_setkey, tfm, vec->key, vec->ksize,
1313 cfg, 0);
1314 if (err) {
1315 if (err == vec->setkey_error)
1316 return 0;
1317 pr_err("alg: shash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
1318 driver, vec_name, vec->setkey_error, err,
1319 crypto_shash_get_flags(tfm));
1320 return err;
1321 }
1322 if (vec->setkey_error) {
1323 pr_err("alg: shash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
1324 driver, vec_name, vec->setkey_error);
1325 return -EINVAL;
1326 }
1327 }
1328
1329 /* Build the scatterlist for the source data */
1330 err = build_hash_sglist(tsgl, vec, cfg, 0, divs);
1331 if (err) {
1332 pr_err("alg: shash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n",
1333 driver, vec_name, cfg->name);
1334 return err;
1335 }
1336
1337 /* Do the actual hashing */
1338
1339 testmgr_poison(desc->__ctx, crypto_shash_descsize(tfm));
1340 testmgr_poison(result, digestsize + TESTMGR_POISON_LEN);
1341
1342 if (cfg->finalization_type == FINALIZATION_TYPE_DIGEST ||
1343 vec->digest_error) {
1344 /* Just using digest() */
1345 if (tsgl->nents != 1)
1346 return 0;
1347 if (cfg->nosimd)
1348 crypto_disable_simd_for_test();
1349 err = crypto_shash_digest(desc, sg_virt(&tsgl->sgl[0]),
1350 tsgl->sgl[0].length, result);
1351 if (cfg->nosimd)
1352 crypto_reenable_simd_for_test();
1353 if (err) {
1354 if (err == vec->digest_error)
1355 return 0;
1356 pr_err("alg: shash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
1357 driver, vec_name, vec->digest_error, err,
1358 cfg->name);
1359 return err;
1360 }
1361 if (vec->digest_error) {
1362 pr_err("alg: shash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
1363 driver, vec_name, vec->digest_error, cfg->name);
1364 return -EINVAL;
1365 }
1366 goto result_ready;
1367 }
1368
1369 /* Using init(), zero or more update(), then final() or finup() */
1370
1371 if (cfg->nosimd)
1372 crypto_disable_simd_for_test();
1373 err = crypto_shash_init(desc);
1374 if (cfg->nosimd)
1375 crypto_reenable_simd_for_test();
1376 err = check_shash_op("init", err, driver, vec_name, cfg);
1377 if (err)
1378 return err;
1379
1380 for (i = 0; i < tsgl->nents; i++) {
1381 if (i + 1 == tsgl->nents &&
1382 cfg->finalization_type == FINALIZATION_TYPE_FINUP) {
1383 if (divs[i]->nosimd)
1384 crypto_disable_simd_for_test();
1385 err = crypto_shash_finup(desc, sg_virt(&tsgl->sgl[i]),
1386 tsgl->sgl[i].length, result);
1387 if (divs[i]->nosimd)
1388 crypto_reenable_simd_for_test();
1389 err = check_shash_op("finup", err, driver, vec_name,
1390 cfg);
1391 if (err)
1392 return err;
1393 goto result_ready;
1394 }
1395 if (divs[i]->nosimd)
1396 crypto_disable_simd_for_test();
1397 err = crypto_shash_update(desc, sg_virt(&tsgl->sgl[i]),
1398 tsgl->sgl[i].length);
1399 if (divs[i]->nosimd)
1400 crypto_reenable_simd_for_test();
1401 err = check_shash_op("update", err, driver, vec_name, cfg);
1402 if (err)
1403 return err;
1404 if (divs[i]->flush_type == FLUSH_TYPE_REIMPORT) {
1405 /* Test ->export() and ->import() */
1406 testmgr_poison(hashstate + statesize,
1407 TESTMGR_POISON_LEN);
1408 err = crypto_shash_export(desc, hashstate);
1409 err = check_shash_op("export", err, driver, vec_name,
1410 cfg);
1411 if (err)
1412 return err;
1413 if (!testmgr_is_poison(hashstate + statesize,
1414 TESTMGR_POISON_LEN)) {
1415 pr_err("alg: shash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n",
1416 driver, vec_name, cfg->name);
1417 return -EOVERFLOW;
1418 }
1419 testmgr_poison(desc->__ctx, crypto_shash_descsize(tfm));
1420 err = crypto_shash_import(desc, hashstate);
1421 err = check_shash_op("import", err, driver, vec_name,
1422 cfg);
1423 if (err)
1424 return err;
1425 }
1426 }
1427
1428 if (cfg->nosimd)
1429 crypto_disable_simd_for_test();
1430 err = crypto_shash_final(desc, result);
1431 if (cfg->nosimd)
1432 crypto_reenable_simd_for_test();
1433 err = check_shash_op("final", err, driver, vec_name, cfg);
1434 if (err)
1435 return err;
1436result_ready:
1437 return check_hash_result("shash", result, digestsize, vec, vec_name,
1438 driver, cfg);
1439}
1440
1441static int do_ahash_op(int (*op)(struct ahash_request *req),
1442 struct ahash_request *req,
1443 struct crypto_wait *wait, bool nosimd)
1444{
1445 int err;
1446
1447 if (nosimd)
1448 crypto_disable_simd_for_test();
1449
1450 err = op(req);
1451
1452 if (nosimd)
1453 crypto_reenable_simd_for_test();
1454
1455 return crypto_wait_req(err, wait);
1456}
1457
1458static int check_nonfinal_ahash_op(const char *op, int err,
1459 u8 *result, unsigned int digestsize,
1460 const char *driver, const char *vec_name,
1461 const struct testvec_config *cfg)
1462{
1463 if (err) {
1464 pr_err("alg: ahash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n",
1465 driver, op, err, vec_name, cfg->name);
1466 return err;
1467 }
1468 if (!testmgr_is_poison(result, digestsize)) {
1469 pr_err("alg: ahash: %s %s() used result buffer on test vector %s, cfg=\"%s\"\n",
1470 driver, op, vec_name, cfg->name);
1471 return -EINVAL;
1472 }
1473 return 0;
1474}
1475
1476/* Test one hash test vector in one configuration, using the ahash API */
1477static int test_ahash_vec_cfg(const struct hash_testvec *vec,
1478 const char *vec_name,
1479 const struct testvec_config *cfg,
1480 struct ahash_request *req,
1481 struct test_sglist *tsgl,
1482 u8 *hashstate)
1483{
1484 struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
1485 const unsigned int digestsize = crypto_ahash_digestsize(tfm);
1486 const unsigned int statesize = crypto_ahash_statesize(tfm);
1487 const char *driver = crypto_ahash_driver_name(tfm);
1488 const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
1489 const struct test_sg_division *divs[XBUFSIZE];
1490 DECLARE_CRYPTO_WAIT(wait);
1491 unsigned int i;
1492 struct scatterlist *pending_sgl;
1493 unsigned int pending_len;
1494 u8 result[HASH_MAX_DIGESTSIZE + TESTMGR_POISON_LEN];
1495 int err;
1496
1497 /* Set the key, if specified */
1498 if (vec->ksize) {
1499 err = do_setkey(crypto_ahash_setkey, tfm, vec->key, vec->ksize,
1500 cfg, 0);
1501 if (err) {
1502 if (err == vec->setkey_error)
1503 return 0;
1504 pr_err("alg: ahash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
1505 driver, vec_name, vec->setkey_error, err,
1506 crypto_ahash_get_flags(tfm));
1507 return err;
1508 }
1509 if (vec->setkey_error) {
1510 pr_err("alg: ahash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
1511 driver, vec_name, vec->setkey_error);
1512 return -EINVAL;
1513 }
1514 }
1515
1516 /* Build the scatterlist for the source data */
1517 err = build_hash_sglist(tsgl, vec, cfg, 0, divs);
1518 if (err) {
1519 pr_err("alg: ahash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n",
1520 driver, vec_name, cfg->name);
1521 return err;
1522 }
1523
1524 /* Do the actual hashing */
1525
1526 testmgr_poison(req->__ctx, crypto_ahash_reqsize(tfm));
1527 testmgr_poison(result, digestsize + TESTMGR_POISON_LEN);
1528
1529 if (cfg->finalization_type == FINALIZATION_TYPE_DIGEST ||
1530 vec->digest_error) {
1531 /* Just using digest() */
1532 ahash_request_set_callback(req, req_flags, crypto_req_done,
1533 &wait);
1534 ahash_request_set_crypt(req, tsgl->sgl, result, vec->psize);
1535 err = do_ahash_op(crypto_ahash_digest, req, &wait, cfg->nosimd);
1536 if (err) {
1537 if (err == vec->digest_error)
1538 return 0;
1539 pr_err("alg: ahash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
1540 driver, vec_name, vec->digest_error, err,
1541 cfg->name);
1542 return err;
1543 }
1544 if (vec->digest_error) {
1545 pr_err("alg: ahash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
1546 driver, vec_name, vec->digest_error, cfg->name);
1547 return -EINVAL;
1548 }
1549 goto result_ready;
1550 }
1551
1552 /* Using init(), zero or more update(), then final() or finup() */
1553
1554 ahash_request_set_callback(req, req_flags, crypto_req_done, &wait);
1555 ahash_request_set_crypt(req, NULL, result, 0);
1556 err = do_ahash_op(crypto_ahash_init, req, &wait, cfg->nosimd);
1557 err = check_nonfinal_ahash_op("init", err, result, digestsize,
1558 driver, vec_name, cfg);
1559 if (err)
1560 return err;
1561
1562 pending_sgl = NULL;
1563 pending_len = 0;
1564 for (i = 0; i < tsgl->nents; i++) {
1565 if (divs[i]->flush_type != FLUSH_TYPE_NONE &&
1566 pending_sgl != NULL) {
1567 /* update() with the pending data */
1568 ahash_request_set_callback(req, req_flags,
1569 crypto_req_done, &wait);
1570 ahash_request_set_crypt(req, pending_sgl, result,
1571 pending_len);
1572 err = do_ahash_op(crypto_ahash_update, req, &wait,
1573 divs[i]->nosimd);
1574 err = check_nonfinal_ahash_op("update", err,
1575 result, digestsize,
1576 driver, vec_name, cfg);
1577 if (err)
1578 return err;
1579 pending_sgl = NULL;
1580 pending_len = 0;
1581 }
1582 if (divs[i]->flush_type == FLUSH_TYPE_REIMPORT) {
1583 /* Test ->export() and ->import() */
1584 testmgr_poison(hashstate + statesize,
1585 TESTMGR_POISON_LEN);
1586 err = crypto_ahash_export(req, hashstate);
1587 err = check_nonfinal_ahash_op("export", err,
1588 result, digestsize,
1589 driver, vec_name, cfg);
1590 if (err)
1591 return err;
1592 if (!testmgr_is_poison(hashstate + statesize,
1593 TESTMGR_POISON_LEN)) {
1594 pr_err("alg: ahash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n",
1595 driver, vec_name, cfg->name);
1596 return -EOVERFLOW;
1597 }
1598
1599 testmgr_poison(req->__ctx, crypto_ahash_reqsize(tfm));
1600 err = crypto_ahash_import(req, hashstate);
1601 err = check_nonfinal_ahash_op("import", err,
1602 result, digestsize,
1603 driver, vec_name, cfg);
1604 if (err)
1605 return err;
1606 }
1607 if (pending_sgl == NULL)
1608 pending_sgl = &tsgl->sgl[i];
1609 pending_len += tsgl->sgl[i].length;
1610 }
1611
1612 ahash_request_set_callback(req, req_flags, crypto_req_done, &wait);
1613 ahash_request_set_crypt(req, pending_sgl, result, pending_len);
1614 if (cfg->finalization_type == FINALIZATION_TYPE_FINAL) {
1615 /* finish with update() and final() */
1616 err = do_ahash_op(crypto_ahash_update, req, &wait, cfg->nosimd);
1617 err = check_nonfinal_ahash_op("update", err, result, digestsize,
1618 driver, vec_name, cfg);
1619 if (err)
1620 return err;
1621 err = do_ahash_op(crypto_ahash_final, req, &wait, cfg->nosimd);
1622 if (err) {
1623 pr_err("alg: ahash: %s final() failed with err %d on test vector %s, cfg=\"%s\"\n",
1624 driver, err, vec_name, cfg->name);
1625 return err;
1626 }
1627 } else {
1628 /* finish with finup() */
1629 err = do_ahash_op(crypto_ahash_finup, req, &wait, cfg->nosimd);
1630 if (err) {
1631 pr_err("alg: ahash: %s finup() failed with err %d on test vector %s, cfg=\"%s\"\n",
1632 driver, err, vec_name, cfg->name);
1633 return err;
1634 }
1635 }
1636
1637result_ready:
1638 return check_hash_result("ahash", result, digestsize, vec, vec_name,
1639 driver, cfg);
1640}
1641
1642static int test_hash_vec_cfg(const struct hash_testvec *vec,
1643 const char *vec_name,
1644 const struct testvec_config *cfg,
1645 struct ahash_request *req,
1646 struct shash_desc *desc,
1647 struct test_sglist *tsgl,
1648 u8 *hashstate)
1649{
1650 int err;
1651
1652 /*
1653 * For algorithms implemented as "shash", most bugs will be detected by
1654 * both the shash and ahash tests. Test the shash API first so that the
1655 * failures involve less indirection, so are easier to debug.
1656 */
1657
1658 if (desc) {
1659 err = test_shash_vec_cfg(vec, vec_name, cfg, desc, tsgl,
1660 hashstate);
1661 if (err)
1662 return err;
1663 }
1664
1665 return test_ahash_vec_cfg(vec, vec_name, cfg, req, tsgl, hashstate);
1666}
1667
1668static int test_hash_vec(const struct hash_testvec *vec, unsigned int vec_num,
1669 struct ahash_request *req, struct shash_desc *desc,
1670 struct test_sglist *tsgl, u8 *hashstate)
1671{
1672 char vec_name[16];
1673 unsigned int i;
1674 int err;
1675
1676 sprintf(vec_name, "%u", vec_num);
1677
1678 for (i = 0; i < ARRAY_SIZE(default_hash_testvec_configs); i++) {
1679 err = test_hash_vec_cfg(vec, vec_name,
1680 &default_hash_testvec_configs[i],
1681 req, desc, tsgl, hashstate);
1682 if (err)
1683 return err;
1684 }
1685
1686 if (!noslowtests) {
1687 struct rnd_state rng;
1688 struct testvec_config cfg;
1689 char cfgname[TESTVEC_CONFIG_NAMELEN];
1690
1691 init_rnd_state(&rng);
1692
1693 for (i = 0; i < fuzz_iterations; i++) {
1694 generate_random_testvec_config(&rng, &cfg, cfgname,
1695 sizeof(cfgname));
1696 err = test_hash_vec_cfg(vec, vec_name, &cfg,
1697 req, desc, tsgl, hashstate);
1698 if (err)
1699 return err;
1700 cond_resched();
1701 }
1702 }
1703 return 0;
1704}
1705
1706/*
1707 * Generate a hash test vector from the given implementation.
1708 * Assumes the buffers in 'vec' were already allocated.
1709 */
1710static void generate_random_hash_testvec(struct rnd_state *rng,
1711 struct ahash_request *req,
1712 struct hash_testvec *vec,
1713 unsigned int maxkeysize,
1714 unsigned int maxdatasize,
1715 char *name, size_t max_namelen)
1716{
1717 /* Data */
1718 vec->psize = generate_random_length(rng, maxdatasize);
1719 generate_random_bytes(rng, (u8 *)vec->plaintext, vec->psize);
1720
1721 /*
1722 * Key: length in range [1, maxkeysize], but usually choose maxkeysize.
1723 * If algorithm is unkeyed, then maxkeysize == 0 and set ksize = 0.
1724 */
1725 vec->setkey_error = 0;
1726 vec->ksize = 0;
1727 if (maxkeysize) {
1728 vec->ksize = maxkeysize;
1729 if (prandom_u32_below(rng, 4) == 0)
1730 vec->ksize = prandom_u32_inclusive(rng, 1, maxkeysize);
1731 generate_random_bytes(rng, (u8 *)vec->key, vec->ksize);
1732
1733 vec->setkey_error = crypto_ahash_setkey(
1734 crypto_ahash_reqtfm(req), vec->key, vec->ksize);
1735 /* If the key couldn't be set, no need to continue to digest. */
1736 if (vec->setkey_error)
1737 goto done;
1738 }
1739
1740 /* Digest */
1741 vec->digest_error = crypto_hash_digest(
1742 crypto_ahash_reqtfm(req), vec->plaintext,
1743 vec->psize, (u8 *)vec->digest);
1744done:
1745 snprintf(name, max_namelen, "\"random: psize=%u ksize=%u\"",
1746 vec->psize, vec->ksize);
1747}
1748
1749/*
1750 * Test the hash algorithm represented by @req against the corresponding generic
1751 * implementation, if one is available.
1752 */
1753static int test_hash_vs_generic_impl(const char *generic_driver,
1754 unsigned int maxkeysize,
1755 struct ahash_request *req,
1756 struct shash_desc *desc,
1757 struct test_sglist *tsgl,
1758 u8 *hashstate)
1759{
1760 struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
1761 const unsigned int digestsize = crypto_ahash_digestsize(tfm);
1762 const unsigned int blocksize = crypto_ahash_blocksize(tfm);
1763 const unsigned int maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN;
1764 const char *algname = crypto_hash_alg_common(tfm)->base.cra_name;
1765 const char *driver = crypto_ahash_driver_name(tfm);
1766 struct rnd_state rng;
1767 char _generic_driver[CRYPTO_MAX_ALG_NAME];
1768 struct ahash_request *generic_req = NULL;
1769 struct crypto_ahash *generic_tfm = NULL;
1770 unsigned int i;
1771 struct hash_testvec vec = { 0 };
1772 char vec_name[64];
1773 struct testvec_config *cfg;
1774 char cfgname[TESTVEC_CONFIG_NAMELEN];
1775 int err;
1776
1777 if (noslowtests)
1778 return 0;
1779
1780 init_rnd_state(&rng);
1781
1782 if (!generic_driver) { /* Use default naming convention? */
1783 err = build_generic_driver_name(algname, _generic_driver);
1784 if (err)
1785 return err;
1786 generic_driver = _generic_driver;
1787 }
1788
1789 if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */
1790 return 0;
1791
1792 generic_tfm = crypto_alloc_ahash(generic_driver, 0, 0);
1793 if (IS_ERR(generic_tfm)) {
1794 err = PTR_ERR(generic_tfm);
1795 if (err == -ENOENT) {
1796 pr_warn("alg: hash: skipping comparison tests for %s because %s is unavailable\n",
1797 driver, generic_driver);
1798 return 0;
1799 }
1800 pr_err("alg: hash: error allocating %s (generic impl of %s): %d\n",
1801 generic_driver, algname, err);
1802 return err;
1803 }
1804
1805 cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
1806 if (!cfg) {
1807 err = -ENOMEM;
1808 goto out;
1809 }
1810
1811 generic_req = ahash_request_alloc(generic_tfm, GFP_KERNEL);
1812 if (!generic_req) {
1813 err = -ENOMEM;
1814 goto out;
1815 }
1816
1817 /* Check the algorithm properties for consistency. */
1818
1819 if (digestsize != crypto_ahash_digestsize(generic_tfm)) {
1820 pr_err("alg: hash: digestsize for %s (%u) doesn't match generic impl (%u)\n",
1821 driver, digestsize,
1822 crypto_ahash_digestsize(generic_tfm));
1823 err = -EINVAL;
1824 goto out;
1825 }
1826
1827 if (blocksize != crypto_ahash_blocksize(generic_tfm)) {
1828 pr_err("alg: hash: blocksize for %s (%u) doesn't match generic impl (%u)\n",
1829 driver, blocksize, crypto_ahash_blocksize(generic_tfm));
1830 err = -EINVAL;
1831 goto out;
1832 }
1833
1834 /*
1835 * Now generate test vectors using the generic implementation, and test
1836 * the other implementation against them.
1837 */
1838
1839 vec.key = kmalloc(maxkeysize, GFP_KERNEL);
1840 vec.plaintext = kmalloc(maxdatasize, GFP_KERNEL);
1841 vec.digest = kmalloc(digestsize, GFP_KERNEL);
1842 if (!vec.key || !vec.plaintext || !vec.digest) {
1843 err = -ENOMEM;
1844 goto out;
1845 }
1846
1847 for (i = 0; i < fuzz_iterations * 8; i++) {
1848 generate_random_hash_testvec(&rng, generic_req, &vec,
1849 maxkeysize, maxdatasize,
1850 vec_name, sizeof(vec_name));
1851 generate_random_testvec_config(&rng, cfg, cfgname,
1852 sizeof(cfgname));
1853
1854 err = test_hash_vec_cfg(&vec, vec_name, cfg,
1855 req, desc, tsgl, hashstate);
1856 if (err)
1857 goto out;
1858 cond_resched();
1859 }
1860 err = 0;
1861out:
1862 kfree(cfg);
1863 kfree(vec.key);
1864 kfree(vec.plaintext);
1865 kfree(vec.digest);
1866 ahash_request_free(generic_req);
1867 crypto_free_ahash(generic_tfm);
1868 return err;
1869}
1870
1871static int alloc_shash(const char *driver, u32 type, u32 mask,
1872 struct crypto_shash **tfm_ret,
1873 struct shash_desc **desc_ret)
1874{
1875 struct crypto_shash *tfm;
1876 struct shash_desc *desc;
1877
1878 tfm = crypto_alloc_shash(driver, type, mask);
1879 if (IS_ERR(tfm)) {
1880 if (PTR_ERR(tfm) == -ENOENT || PTR_ERR(tfm) == -EEXIST) {
1881 /*
1882 * This algorithm is only available through the ahash
1883 * API, not the shash API, so skip the shash tests.
1884 */
1885 return 0;
1886 }
1887 pr_err("alg: hash: failed to allocate shash transform for %s: %ld\n",
1888 driver, PTR_ERR(tfm));
1889 return PTR_ERR(tfm);
1890 }
1891
1892 desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(tfm), GFP_KERNEL);
1893 if (!desc) {
1894 crypto_free_shash(tfm);
1895 return -ENOMEM;
1896 }
1897 desc->tfm = tfm;
1898
1899 *tfm_ret = tfm;
1900 *desc_ret = desc;
1901 return 0;
1902}
1903
1904static int __alg_test_hash(const struct hash_testvec *vecs,
1905 unsigned int num_vecs, const char *driver,
1906 u32 type, u32 mask,
1907 const char *generic_driver, unsigned int maxkeysize)
1908{
1909 struct crypto_ahash *atfm = NULL;
1910 struct ahash_request *req = NULL;
1911 struct crypto_shash *stfm = NULL;
1912 struct shash_desc *desc = NULL;
1913 struct test_sglist *tsgl = NULL;
1914 u8 *hashstate = NULL;
1915 unsigned int statesize;
1916 unsigned int i;
1917 int err;
1918
1919 /*
1920 * Always test the ahash API. This works regardless of whether the
1921 * algorithm is implemented as ahash or shash.
1922 */
1923
1924 atfm = crypto_alloc_ahash(driver, type, mask);
1925 if (IS_ERR(atfm)) {
1926 if (PTR_ERR(atfm) == -ENOENT)
1927 return 0;
1928 pr_err("alg: hash: failed to allocate transform for %s: %ld\n",
1929 driver, PTR_ERR(atfm));
1930 return PTR_ERR(atfm);
1931 }
1932 driver = crypto_ahash_driver_name(atfm);
1933
1934 req = ahash_request_alloc(atfm, GFP_KERNEL);
1935 if (!req) {
1936 pr_err("alg: hash: failed to allocate request for %s\n",
1937 driver);
1938 err = -ENOMEM;
1939 goto out;
1940 }
1941
1942 /*
1943 * If available also test the shash API, to cover corner cases that may
1944 * be missed by testing the ahash API only.
1945 */
1946 err = alloc_shash(driver, type, mask, &stfm, &desc);
1947 if (err)
1948 goto out;
1949
1950 tsgl = kmalloc(sizeof(*tsgl), GFP_KERNEL);
1951 if (!tsgl || init_test_sglist(tsgl) != 0) {
1952 pr_err("alg: hash: failed to allocate test buffers for %s\n",
1953 driver);
1954 kfree(tsgl);
1955 tsgl = NULL;
1956 err = -ENOMEM;
1957 goto out;
1958 }
1959
1960 statesize = crypto_ahash_statesize(atfm);
1961 if (stfm)
1962 statesize = max(statesize, crypto_shash_statesize(stfm));
1963 hashstate = kmalloc(statesize + TESTMGR_POISON_LEN, GFP_KERNEL);
1964 if (!hashstate) {
1965 pr_err("alg: hash: failed to allocate hash state buffer for %s\n",
1966 driver);
1967 err = -ENOMEM;
1968 goto out;
1969 }
1970
1971 for (i = 0; i < num_vecs; i++) {
1972 if (fips_enabled && vecs[i].fips_skip)
1973 continue;
1974
1975 err = test_hash_vec(&vecs[i], i, req, desc, tsgl, hashstate);
1976 if (err)
1977 goto out;
1978 cond_resched();
1979 }
1980 err = test_hash_vs_generic_impl(generic_driver, maxkeysize, req,
1981 desc, tsgl, hashstate);
1982out:
1983 kfree(hashstate);
1984 if (tsgl) {
1985 destroy_test_sglist(tsgl);
1986 kfree(tsgl);
1987 }
1988 kfree(desc);
1989 crypto_free_shash(stfm);
1990 ahash_request_free(req);
1991 crypto_free_ahash(atfm);
1992 return err;
1993}
1994
1995static int alg_test_hash(const struct alg_test_desc *desc, const char *driver,
1996 u32 type, u32 mask)
1997{
1998 const struct hash_testvec *template = desc->suite.hash.vecs;
1999 unsigned int tcount = desc->suite.hash.count;
2000 unsigned int nr_unkeyed, nr_keyed;
2001 unsigned int maxkeysize = 0;
2002 int err;
2003
2004 /*
2005 * For OPTIONAL_KEY algorithms, we have to do all the unkeyed tests
2006 * first, before setting a key on the tfm. To make this easier, we
2007 * require that the unkeyed test vectors (if any) are listed first.
2008 */
2009
2010 for (nr_unkeyed = 0; nr_unkeyed < tcount; nr_unkeyed++) {
2011 if (template[nr_unkeyed].ksize)
2012 break;
2013 }
2014 for (nr_keyed = 0; nr_unkeyed + nr_keyed < tcount; nr_keyed++) {
2015 if (!template[nr_unkeyed + nr_keyed].ksize) {
2016 pr_err("alg: hash: test vectors for %s out of order, "
2017 "unkeyed ones must come first\n", desc->alg);
2018 return -EINVAL;
2019 }
2020 maxkeysize = max_t(unsigned int, maxkeysize,
2021 template[nr_unkeyed + nr_keyed].ksize);
2022 }
2023
2024 err = 0;
2025 if (nr_unkeyed) {
2026 err = __alg_test_hash(template, nr_unkeyed, driver, type, mask,
2027 desc->generic_driver, maxkeysize);
2028 template += nr_unkeyed;
2029 }
2030
2031 if (!err && nr_keyed)
2032 err = __alg_test_hash(template, nr_keyed, driver, type, mask,
2033 desc->generic_driver, maxkeysize);
2034
2035 return err;
2036}
2037
2038static int test_aead_vec_cfg(int enc, const struct aead_testvec *vec,
2039 const char *vec_name,
2040 const struct testvec_config *cfg,
2041 struct aead_request *req,
2042 struct cipher_test_sglists *tsgls)
2043{
2044 struct crypto_aead *tfm = crypto_aead_reqtfm(req);
2045 const unsigned int alignmask = crypto_aead_alignmask(tfm);
2046 const unsigned int ivsize = crypto_aead_ivsize(tfm);
2047 const unsigned int authsize = vec->clen - vec->plen;
2048 const char *driver = crypto_aead_driver_name(tfm);
2049 const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
2050 const char *op = enc ? "encryption" : "decryption";
2051 DECLARE_CRYPTO_WAIT(wait);
2052 u8 _iv[3 * (MAX_ALGAPI_ALIGNMASK + 1) + MAX_IVLEN];
2053 u8 *iv = PTR_ALIGN(&_iv[0], 2 * (MAX_ALGAPI_ALIGNMASK + 1)) +
2054 cfg->iv_offset +
2055 (cfg->iv_offset_relative_to_alignmask ? alignmask : 0);
2056 struct kvec input[2];
2057 int err;
2058
2059 /* Set the key */
2060 if (vec->wk)
2061 crypto_aead_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2062 else
2063 crypto_aead_clear_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2064
2065 err = do_setkey(crypto_aead_setkey, tfm, vec->key, vec->klen,
2066 cfg, alignmask);
2067 if (err && err != vec->setkey_error) {
2068 pr_err("alg: aead: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
2069 driver, vec_name, vec->setkey_error, err,
2070 crypto_aead_get_flags(tfm));
2071 return err;
2072 }
2073 if (!err && vec->setkey_error) {
2074 pr_err("alg: aead: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
2075 driver, vec_name, vec->setkey_error);
2076 return -EINVAL;
2077 }
2078
2079 /* Set the authentication tag size */
2080 err = crypto_aead_setauthsize(tfm, authsize);
2081 if (err && err != vec->setauthsize_error) {
2082 pr_err("alg: aead: %s setauthsize failed on test vector %s; expected_error=%d, actual_error=%d\n",
2083 driver, vec_name, vec->setauthsize_error, err);
2084 return err;
2085 }
2086 if (!err && vec->setauthsize_error) {
2087 pr_err("alg: aead: %s setauthsize unexpectedly succeeded on test vector %s; expected_error=%d\n",
2088 driver, vec_name, vec->setauthsize_error);
2089 return -EINVAL;
2090 }
2091
2092 if (vec->setkey_error || vec->setauthsize_error)
2093 return 0;
2094
2095 /* The IV must be copied to a buffer, as the algorithm may modify it */
2096 if (WARN_ON(ivsize > MAX_IVLEN))
2097 return -EINVAL;
2098 if (vec->iv)
2099 memcpy(iv, vec->iv, ivsize);
2100 else
2101 memset(iv, 0, ivsize);
2102
2103 /* Build the src/dst scatterlists */
2104 input[0].iov_base = (void *)vec->assoc;
2105 input[0].iov_len = vec->alen;
2106 input[1].iov_base = enc ? (void *)vec->ptext : (void *)vec->ctext;
2107 input[1].iov_len = enc ? vec->plen : vec->clen;
2108 err = build_cipher_test_sglists(tsgls, cfg, alignmask,
2109 vec->alen + (enc ? vec->plen :
2110 vec->clen),
2111 vec->alen + (enc ? vec->clen :
2112 vec->plen),
2113 input, 2);
2114 if (err) {
2115 pr_err("alg: aead: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n",
2116 driver, op, vec_name, cfg->name);
2117 return err;
2118 }
2119
2120 /* Do the actual encryption or decryption */
2121 testmgr_poison(req->__ctx, crypto_aead_reqsize(tfm));
2122 aead_request_set_callback(req, req_flags, crypto_req_done, &wait);
2123 aead_request_set_crypt(req, tsgls->src.sgl_ptr, tsgls->dst.sgl_ptr,
2124 enc ? vec->plen : vec->clen, iv);
2125 aead_request_set_ad(req, vec->alen);
2126 if (cfg->nosimd)
2127 crypto_disable_simd_for_test();
2128 err = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);
2129 if (cfg->nosimd)
2130 crypto_reenable_simd_for_test();
2131 err = crypto_wait_req(err, &wait);
2132
2133 /* Check that the algorithm didn't overwrite things it shouldn't have */
2134 if (req->cryptlen != (enc ? vec->plen : vec->clen) ||
2135 req->assoclen != vec->alen ||
2136 req->iv != iv ||
2137 req->src != tsgls->src.sgl_ptr ||
2138 req->dst != tsgls->dst.sgl_ptr ||
2139 crypto_aead_reqtfm(req) != tfm ||
2140 req->base.complete != crypto_req_done ||
2141 req->base.flags != req_flags ||
2142 req->base.data != &wait) {
2143 pr_err("alg: aead: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n",
2144 driver, op, vec_name, cfg->name);
2145 if (req->cryptlen != (enc ? vec->plen : vec->clen))
2146 pr_err("alg: aead: changed 'req->cryptlen'\n");
2147 if (req->assoclen != vec->alen)
2148 pr_err("alg: aead: changed 'req->assoclen'\n");
2149 if (req->iv != iv)
2150 pr_err("alg: aead: changed 'req->iv'\n");
2151 if (req->src != tsgls->src.sgl_ptr)
2152 pr_err("alg: aead: changed 'req->src'\n");
2153 if (req->dst != tsgls->dst.sgl_ptr)
2154 pr_err("alg: aead: changed 'req->dst'\n");
2155 if (crypto_aead_reqtfm(req) != tfm)
2156 pr_err("alg: aead: changed 'req->base.tfm'\n");
2157 if (req->base.complete != crypto_req_done)
2158 pr_err("alg: aead: changed 'req->base.complete'\n");
2159 if (req->base.flags != req_flags)
2160 pr_err("alg: aead: changed 'req->base.flags'\n");
2161 if (req->base.data != &wait)
2162 pr_err("alg: aead: changed 'req->base.data'\n");
2163 return -EINVAL;
2164 }
2165 if (is_test_sglist_corrupted(&tsgls->src)) {
2166 pr_err("alg: aead: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n",
2167 driver, op, vec_name, cfg->name);
2168 return -EINVAL;
2169 }
2170 if (tsgls->dst.sgl_ptr != tsgls->src.sgl &&
2171 is_test_sglist_corrupted(&tsgls->dst)) {
2172 pr_err("alg: aead: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n",
2173 driver, op, vec_name, cfg->name);
2174 return -EINVAL;
2175 }
2176
2177 /* Check for unexpected success or failure, or wrong error code */
2178 if ((err == 0 && vec->novrfy) ||
2179 (err != vec->crypt_error && !(err == -EBADMSG && vec->novrfy))) {
2180 char expected_error[32];
2181
2182 if (vec->novrfy &&
2183 vec->crypt_error != 0 && vec->crypt_error != -EBADMSG)
2184 sprintf(expected_error, "-EBADMSG or %d",
2185 vec->crypt_error);
2186 else if (vec->novrfy)
2187 sprintf(expected_error, "-EBADMSG");
2188 else
2189 sprintf(expected_error, "%d", vec->crypt_error);
2190 if (err) {
2191 pr_err("alg: aead: %s %s failed on test vector %s; expected_error=%s, actual_error=%d, cfg=\"%s\"\n",
2192 driver, op, vec_name, expected_error, err,
2193 cfg->name);
2194 return err;
2195 }
2196 pr_err("alg: aead: %s %s unexpectedly succeeded on test vector %s; expected_error=%s, cfg=\"%s\"\n",
2197 driver, op, vec_name, expected_error, cfg->name);
2198 return -EINVAL;
2199 }
2200 if (err) /* Expectedly failed. */
2201 return 0;
2202
2203 /* Check for the correct output (ciphertext or plaintext) */
2204 err = verify_correct_output(&tsgls->dst, enc ? vec->ctext : vec->ptext,
2205 enc ? vec->clen : vec->plen,
2206 vec->alen,
2207 enc || cfg->inplace_mode == OUT_OF_PLACE);
2208 if (err == -EOVERFLOW) {
2209 pr_err("alg: aead: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n",
2210 driver, op, vec_name, cfg->name);
2211 return err;
2212 }
2213 if (err) {
2214 pr_err("alg: aead: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
2215 driver, op, vec_name, cfg->name);
2216 return err;
2217 }
2218
2219 return 0;
2220}
2221
2222static int test_aead_vec(int enc, const struct aead_testvec *vec,
2223 unsigned int vec_num, struct aead_request *req,
2224 struct cipher_test_sglists *tsgls)
2225{
2226 char vec_name[16];
2227 unsigned int i;
2228 int err;
2229
2230 if (enc && vec->novrfy)
2231 return 0;
2232
2233 sprintf(vec_name, "%u", vec_num);
2234
2235 for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) {
2236 err = test_aead_vec_cfg(enc, vec, vec_name,
2237 &default_cipher_testvec_configs[i],
2238 req, tsgls);
2239 if (err)
2240 return err;
2241 }
2242
2243 if (!noslowtests) {
2244 struct rnd_state rng;
2245 struct testvec_config cfg;
2246 char cfgname[TESTVEC_CONFIG_NAMELEN];
2247
2248 init_rnd_state(&rng);
2249
2250 for (i = 0; i < fuzz_iterations; i++) {
2251 generate_random_testvec_config(&rng, &cfg, cfgname,
2252 sizeof(cfgname));
2253 err = test_aead_vec_cfg(enc, vec, vec_name,
2254 &cfg, req, tsgls);
2255 if (err)
2256 return err;
2257 cond_resched();
2258 }
2259 }
2260 return 0;
2261}
2262
2263struct aead_slow_tests_ctx {
2264 struct rnd_state rng;
2265 struct aead_request *req;
2266 struct crypto_aead *tfm;
2267 const struct alg_test_desc *test_desc;
2268 struct cipher_test_sglists *tsgls;
2269 unsigned int maxdatasize;
2270 unsigned int maxkeysize;
2271
2272 struct aead_testvec vec;
2273 char vec_name[64];
2274 char cfgname[TESTVEC_CONFIG_NAMELEN];
2275 struct testvec_config cfg;
2276};
2277
2278/*
2279 * Make at least one random change to a (ciphertext, AAD) pair. "Ciphertext"
2280 * here means the full ciphertext including the authentication tag. The
2281 * authentication tag (and hence also the ciphertext) is assumed to be nonempty.
2282 */
2283static void mutate_aead_message(struct rnd_state *rng,
2284 struct aead_testvec *vec, bool aad_iv,
2285 unsigned int ivsize)
2286{
2287 const unsigned int aad_tail_size = aad_iv ? ivsize : 0;
2288 const unsigned int authsize = vec->clen - vec->plen;
2289
2290 if (prandom_bool(rng) && vec->alen > aad_tail_size) {
2291 /* Mutate the AAD */
2292 flip_random_bit(rng, (u8 *)vec->assoc,
2293 vec->alen - aad_tail_size);
2294 if (prandom_bool(rng))
2295 return;
2296 }
2297 if (prandom_bool(rng)) {
2298 /* Mutate auth tag (assuming it's at the end of ciphertext) */
2299 flip_random_bit(rng, (u8 *)vec->ctext + vec->plen, authsize);
2300 } else {
2301 /* Mutate any part of the ciphertext */
2302 flip_random_bit(rng, (u8 *)vec->ctext, vec->clen);
2303 }
2304}
2305
2306/*
2307 * Minimum authentication tag size in bytes at which we assume that we can
2308 * reliably generate inauthentic messages, i.e. not generate an authentic
2309 * message by chance.
2310 */
2311#define MIN_COLLISION_FREE_AUTHSIZE 8
2312
2313static void generate_aead_message(struct rnd_state *rng,
2314 struct aead_request *req,
2315 const struct aead_test_suite *suite,
2316 struct aead_testvec *vec,
2317 bool prefer_inauthentic)
2318{
2319 struct crypto_aead *tfm = crypto_aead_reqtfm(req);
2320 const unsigned int ivsize = crypto_aead_ivsize(tfm);
2321 const unsigned int authsize = vec->clen - vec->plen;
2322 const bool inauthentic = (authsize >= MIN_COLLISION_FREE_AUTHSIZE) &&
2323 (prefer_inauthentic ||
2324 prandom_u32_below(rng, 4) == 0);
2325
2326 /* Generate the AAD. */
2327 generate_random_bytes(rng, (u8 *)vec->assoc, vec->alen);
2328 if (suite->aad_iv && vec->alen >= ivsize)
2329 /* Avoid implementation-defined behavior. */
2330 memcpy((u8 *)vec->assoc + vec->alen - ivsize, vec->iv, ivsize);
2331
2332 if (inauthentic && prandom_bool(rng)) {
2333 /* Generate a random ciphertext. */
2334 generate_random_bytes(rng, (u8 *)vec->ctext, vec->clen);
2335 } else {
2336 int i = 0;
2337 struct scatterlist src[2], dst;
2338 u8 iv[MAX_IVLEN];
2339 DECLARE_CRYPTO_WAIT(wait);
2340
2341 /* Generate a random plaintext and encrypt it. */
2342 sg_init_table(src, 2);
2343 if (vec->alen)
2344 sg_set_buf(&src[i++], vec->assoc, vec->alen);
2345 if (vec->plen) {
2346 generate_random_bytes(rng, (u8 *)vec->ptext, vec->plen);
2347 sg_set_buf(&src[i++], vec->ptext, vec->plen);
2348 }
2349 sg_init_one(&dst, vec->ctext, vec->alen + vec->clen);
2350 memcpy(iv, vec->iv, ivsize);
2351 aead_request_set_callback(req, 0, crypto_req_done, &wait);
2352 aead_request_set_crypt(req, src, &dst, vec->plen, iv);
2353 aead_request_set_ad(req, vec->alen);
2354 vec->crypt_error = crypto_wait_req(crypto_aead_encrypt(req),
2355 &wait);
2356 /* If encryption failed, we're done. */
2357 if (vec->crypt_error != 0)
2358 return;
2359 memmove((u8 *)vec->ctext, vec->ctext + vec->alen, vec->clen);
2360 if (!inauthentic)
2361 return;
2362 /*
2363 * Mutate the authentic (ciphertext, AAD) pair to get an
2364 * inauthentic one.
2365 */
2366 mutate_aead_message(rng, vec, suite->aad_iv, ivsize);
2367 }
2368 vec->novrfy = 1;
2369 if (suite->einval_allowed)
2370 vec->crypt_error = -EINVAL;
2371}
2372
2373/*
2374 * Generate an AEAD test vector 'vec' using the implementation specified by
2375 * 'req'. The buffers in 'vec' must already be allocated.
2376 *
2377 * If 'prefer_inauthentic' is true, then this function will generate inauthentic
2378 * test vectors (i.e. vectors with 'vec->novrfy=1') more often.
2379 */
2380static void generate_random_aead_testvec(struct rnd_state *rng,
2381 struct aead_request *req,
2382 struct aead_testvec *vec,
2383 const struct aead_test_suite *suite,
2384 unsigned int maxkeysize,
2385 unsigned int maxdatasize,
2386 char *name, size_t max_namelen,
2387 bool prefer_inauthentic)
2388{
2389 struct crypto_aead *tfm = crypto_aead_reqtfm(req);
2390 const unsigned int ivsize = crypto_aead_ivsize(tfm);
2391 const unsigned int maxauthsize = crypto_aead_maxauthsize(tfm);
2392 unsigned int authsize;
2393 unsigned int total_len;
2394
2395 /* Key: length in [0, maxkeysize], but usually choose maxkeysize */
2396 vec->klen = maxkeysize;
2397 if (prandom_u32_below(rng, 4) == 0)
2398 vec->klen = prandom_u32_below(rng, maxkeysize + 1);
2399 generate_random_bytes(rng, (u8 *)vec->key, vec->klen);
2400 vec->setkey_error = crypto_aead_setkey(tfm, vec->key, vec->klen);
2401
2402 /* IV */
2403 generate_random_bytes(rng, (u8 *)vec->iv, ivsize);
2404
2405 /* Tag length: in [0, maxauthsize], but usually choose maxauthsize */
2406 authsize = maxauthsize;
2407 if (prandom_u32_below(rng, 4) == 0)
2408 authsize = prandom_u32_below(rng, maxauthsize + 1);
2409 if (prefer_inauthentic && authsize < MIN_COLLISION_FREE_AUTHSIZE)
2410 authsize = MIN_COLLISION_FREE_AUTHSIZE;
2411 if (WARN_ON(authsize > maxdatasize))
2412 authsize = maxdatasize;
2413 maxdatasize -= authsize;
2414 vec->setauthsize_error = crypto_aead_setauthsize(tfm, authsize);
2415
2416 /* AAD, plaintext, and ciphertext lengths */
2417 total_len = generate_random_length(rng, maxdatasize);
2418 if (prandom_u32_below(rng, 4) == 0)
2419 vec->alen = 0;
2420 else
2421 vec->alen = generate_random_length(rng, total_len);
2422 vec->plen = total_len - vec->alen;
2423 vec->clen = vec->plen + authsize;
2424
2425 /*
2426 * Generate the AAD, plaintext, and ciphertext. Not applicable if the
2427 * key or the authentication tag size couldn't be set.
2428 */
2429 vec->novrfy = 0;
2430 vec->crypt_error = 0;
2431 if (vec->setkey_error == 0 && vec->setauthsize_error == 0)
2432 generate_aead_message(rng, req, suite, vec, prefer_inauthentic);
2433 snprintf(name, max_namelen,
2434 "\"random: alen=%u plen=%u authsize=%u klen=%u novrfy=%d\"",
2435 vec->alen, vec->plen, authsize, vec->klen, vec->novrfy);
2436}
2437
2438static void try_to_generate_inauthentic_testvec(struct aead_slow_tests_ctx *ctx)
2439{
2440 int i;
2441
2442 for (i = 0; i < 10; i++) {
2443 generate_random_aead_testvec(&ctx->rng, ctx->req, &ctx->vec,
2444 &ctx->test_desc->suite.aead,
2445 ctx->maxkeysize, ctx->maxdatasize,
2446 ctx->vec_name,
2447 sizeof(ctx->vec_name), true);
2448 if (ctx->vec.novrfy)
2449 return;
2450 }
2451}
2452
2453/*
2454 * Generate inauthentic test vectors (i.e. ciphertext, AAD pairs that aren't the
2455 * result of an encryption with the key) and verify that decryption fails.
2456 */
2457static int test_aead_inauthentic_inputs(struct aead_slow_tests_ctx *ctx)
2458{
2459 unsigned int i;
2460 int err;
2461
2462 for (i = 0; i < fuzz_iterations * 8; i++) {
2463 /*
2464 * Since this part of the tests isn't comparing the
2465 * implementation to another, there's no point in testing any
2466 * test vectors other than inauthentic ones (vec.novrfy=1) here.
2467 *
2468 * If we're having trouble generating such a test vector, e.g.
2469 * if the algorithm keeps rejecting the generated keys, don't
2470 * retry forever; just continue on.
2471 */
2472 try_to_generate_inauthentic_testvec(ctx);
2473 if (ctx->vec.novrfy) {
2474 generate_random_testvec_config(&ctx->rng, &ctx->cfg,
2475 ctx->cfgname,
2476 sizeof(ctx->cfgname));
2477 err = test_aead_vec_cfg(DECRYPT, &ctx->vec,
2478 ctx->vec_name, &ctx->cfg,
2479 ctx->req, ctx->tsgls);
2480 if (err)
2481 return err;
2482 }
2483 cond_resched();
2484 }
2485 return 0;
2486}
2487
2488/*
2489 * Test the AEAD algorithm against the corresponding generic implementation, if
2490 * one is available.
2491 */
2492static int test_aead_vs_generic_impl(struct aead_slow_tests_ctx *ctx)
2493{
2494 struct crypto_aead *tfm = ctx->tfm;
2495 const char *algname = crypto_aead_alg(tfm)->base.cra_name;
2496 const char *driver = crypto_aead_driver_name(tfm);
2497 const char *generic_driver = ctx->test_desc->generic_driver;
2498 char _generic_driver[CRYPTO_MAX_ALG_NAME];
2499 struct crypto_aead *generic_tfm = NULL;
2500 struct aead_request *generic_req = NULL;
2501 unsigned int i;
2502 int err;
2503
2504 if (!generic_driver) { /* Use default naming convention? */
2505 err = build_generic_driver_name(algname, _generic_driver);
2506 if (err)
2507 return err;
2508 generic_driver = _generic_driver;
2509 }
2510
2511 if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */
2512 return 0;
2513
2514 generic_tfm = crypto_alloc_aead(generic_driver, 0, 0);
2515 if (IS_ERR(generic_tfm)) {
2516 err = PTR_ERR(generic_tfm);
2517 if (err == -ENOENT) {
2518 pr_warn("alg: aead: skipping comparison tests for %s because %s is unavailable\n",
2519 driver, generic_driver);
2520 return 0;
2521 }
2522 pr_err("alg: aead: error allocating %s (generic impl of %s): %d\n",
2523 generic_driver, algname, err);
2524 return err;
2525 }
2526
2527 generic_req = aead_request_alloc(generic_tfm, GFP_KERNEL);
2528 if (!generic_req) {
2529 err = -ENOMEM;
2530 goto out;
2531 }
2532
2533 /* Check the algorithm properties for consistency. */
2534
2535 if (crypto_aead_maxauthsize(tfm) !=
2536 crypto_aead_maxauthsize(generic_tfm)) {
2537 pr_err("alg: aead: maxauthsize for %s (%u) doesn't match generic impl (%u)\n",
2538 driver, crypto_aead_maxauthsize(tfm),
2539 crypto_aead_maxauthsize(generic_tfm));
2540 err = -EINVAL;
2541 goto out;
2542 }
2543
2544 if (crypto_aead_ivsize(tfm) != crypto_aead_ivsize(generic_tfm)) {
2545 pr_err("alg: aead: ivsize for %s (%u) doesn't match generic impl (%u)\n",
2546 driver, crypto_aead_ivsize(tfm),
2547 crypto_aead_ivsize(generic_tfm));
2548 err = -EINVAL;
2549 goto out;
2550 }
2551
2552 if (crypto_aead_blocksize(tfm) != crypto_aead_blocksize(generic_tfm)) {
2553 pr_err("alg: aead: blocksize for %s (%u) doesn't match generic impl (%u)\n",
2554 driver, crypto_aead_blocksize(tfm),
2555 crypto_aead_blocksize(generic_tfm));
2556 err = -EINVAL;
2557 goto out;
2558 }
2559
2560 /*
2561 * Now generate test vectors using the generic implementation, and test
2562 * the other implementation against them.
2563 */
2564 for (i = 0; i < fuzz_iterations * 8; i++) {
2565 generate_random_aead_testvec(&ctx->rng, generic_req, &ctx->vec,
2566 &ctx->test_desc->suite.aead,
2567 ctx->maxkeysize, ctx->maxdatasize,
2568 ctx->vec_name,
2569 sizeof(ctx->vec_name), false);
2570 generate_random_testvec_config(&ctx->rng, &ctx->cfg,
2571 ctx->cfgname,
2572 sizeof(ctx->cfgname));
2573 if (!ctx->vec.novrfy) {
2574 err = test_aead_vec_cfg(ENCRYPT, &ctx->vec,
2575 ctx->vec_name, &ctx->cfg,
2576 ctx->req, ctx->tsgls);
2577 if (err)
2578 goto out;
2579 }
2580 if (ctx->vec.crypt_error == 0 || ctx->vec.novrfy) {
2581 err = test_aead_vec_cfg(DECRYPT, &ctx->vec,
2582 ctx->vec_name, &ctx->cfg,
2583 ctx->req, ctx->tsgls);
2584 if (err)
2585 goto out;
2586 }
2587 cond_resched();
2588 }
2589 err = 0;
2590out:
2591 crypto_free_aead(generic_tfm);
2592 aead_request_free(generic_req);
2593 return err;
2594}
2595
2596static int test_aead_slow(const struct alg_test_desc *test_desc,
2597 struct aead_request *req,
2598 struct cipher_test_sglists *tsgls)
2599{
2600 struct aead_slow_tests_ctx *ctx;
2601 unsigned int i;
2602 int err;
2603
2604 if (noslowtests)
2605 return 0;
2606
2607 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2608 if (!ctx)
2609 return -ENOMEM;
2610 init_rnd_state(&ctx->rng);
2611 ctx->req = req;
2612 ctx->tfm = crypto_aead_reqtfm(req);
2613 ctx->test_desc = test_desc;
2614 ctx->tsgls = tsgls;
2615 ctx->maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN;
2616 ctx->maxkeysize = 0;
2617 for (i = 0; i < test_desc->suite.aead.count; i++)
2618 ctx->maxkeysize = max_t(unsigned int, ctx->maxkeysize,
2619 test_desc->suite.aead.vecs[i].klen);
2620
2621 ctx->vec.key = kmalloc(ctx->maxkeysize, GFP_KERNEL);
2622 ctx->vec.iv = kmalloc(crypto_aead_ivsize(ctx->tfm), GFP_KERNEL);
2623 ctx->vec.assoc = kmalloc(ctx->maxdatasize, GFP_KERNEL);
2624 ctx->vec.ptext = kmalloc(ctx->maxdatasize, GFP_KERNEL);
2625 ctx->vec.ctext = kmalloc(ctx->maxdatasize, GFP_KERNEL);
2626 if (!ctx->vec.key || !ctx->vec.iv || !ctx->vec.assoc ||
2627 !ctx->vec.ptext || !ctx->vec.ctext) {
2628 err = -ENOMEM;
2629 goto out;
2630 }
2631
2632 err = test_aead_vs_generic_impl(ctx);
2633 if (err)
2634 goto out;
2635
2636 err = test_aead_inauthentic_inputs(ctx);
2637out:
2638 kfree(ctx->vec.key);
2639 kfree(ctx->vec.iv);
2640 kfree(ctx->vec.assoc);
2641 kfree(ctx->vec.ptext);
2642 kfree(ctx->vec.ctext);
2643 kfree(ctx);
2644 return err;
2645}
2646
2647static int test_aead(int enc, const struct aead_test_suite *suite,
2648 struct aead_request *req,
2649 struct cipher_test_sglists *tsgls)
2650{
2651 unsigned int i;
2652 int err;
2653
2654 for (i = 0; i < suite->count; i++) {
2655 err = test_aead_vec(enc, &suite->vecs[i], i, req, tsgls);
2656 if (err)
2657 return err;
2658 cond_resched();
2659 }
2660 return 0;
2661}
2662
2663static int alg_test_aead(const struct alg_test_desc *desc, const char *driver,
2664 u32 type, u32 mask)
2665{
2666 const struct aead_test_suite *suite = &desc->suite.aead;
2667 struct crypto_aead *tfm;
2668 struct aead_request *req = NULL;
2669 struct cipher_test_sglists *tsgls = NULL;
2670 int err;
2671
2672 if (suite->count <= 0) {
2673 pr_err("alg: aead: empty test suite for %s\n", driver);
2674 return -EINVAL;
2675 }
2676
2677 tfm = crypto_alloc_aead(driver, type, mask);
2678 if (IS_ERR(tfm)) {
2679 if (PTR_ERR(tfm) == -ENOENT)
2680 return 0;
2681 pr_err("alg: aead: failed to allocate transform for %s: %ld\n",
2682 driver, PTR_ERR(tfm));
2683 return PTR_ERR(tfm);
2684 }
2685 driver = crypto_aead_driver_name(tfm);
2686
2687 req = aead_request_alloc(tfm, GFP_KERNEL);
2688 if (!req) {
2689 pr_err("alg: aead: failed to allocate request for %s\n",
2690 driver);
2691 err = -ENOMEM;
2692 goto out;
2693 }
2694
2695 tsgls = alloc_cipher_test_sglists();
2696 if (!tsgls) {
2697 pr_err("alg: aead: failed to allocate test buffers for %s\n",
2698 driver);
2699 err = -ENOMEM;
2700 goto out;
2701 }
2702
2703 err = test_aead(ENCRYPT, suite, req, tsgls);
2704 if (err)
2705 goto out;
2706
2707 err = test_aead(DECRYPT, suite, req, tsgls);
2708 if (err)
2709 goto out;
2710
2711 err = test_aead_slow(desc, req, tsgls);
2712out:
2713 free_cipher_test_sglists(tsgls);
2714 aead_request_free(req);
2715 crypto_free_aead(tfm);
2716 return err;
2717}
2718
2719static int test_cipher(struct crypto_cipher *tfm, int enc,
2720 const struct cipher_testvec *template,
2721 unsigned int tcount)
2722{
2723 const char *algo = crypto_tfm_alg_driver_name(crypto_cipher_tfm(tfm));
2724 unsigned int i, j, k;
2725 char *q;
2726 const char *e;
2727 const char *input, *result;
2728 void *data;
2729 char *xbuf[XBUFSIZE];
2730 int ret = -ENOMEM;
2731
2732 if (testmgr_alloc_buf(xbuf))
2733 goto out_nobuf;
2734
2735 if (enc == ENCRYPT)
2736 e = "encryption";
2737 else
2738 e = "decryption";
2739
2740 j = 0;
2741 for (i = 0; i < tcount; i++) {
2742
2743 if (fips_enabled && template[i].fips_skip)
2744 continue;
2745
2746 input = enc ? template[i].ptext : template[i].ctext;
2747 result = enc ? template[i].ctext : template[i].ptext;
2748 j++;
2749
2750 ret = -EINVAL;
2751 if (WARN_ON(template[i].len > PAGE_SIZE))
2752 goto out;
2753
2754 data = xbuf[0];
2755 memcpy(data, input, template[i].len);
2756
2757 crypto_cipher_clear_flags(tfm, ~0);
2758 if (template[i].wk)
2759 crypto_cipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2760
2761 ret = crypto_cipher_setkey(tfm, template[i].key,
2762 template[i].klen);
2763 if (ret) {
2764 if (ret == template[i].setkey_error)
2765 continue;
2766 pr_err("alg: cipher: %s setkey failed on test vector %u; expected_error=%d, actual_error=%d, flags=%#x\n",
2767 algo, j, template[i].setkey_error, ret,
2768 crypto_cipher_get_flags(tfm));
2769 goto out;
2770 }
2771 if (template[i].setkey_error) {
2772 pr_err("alg: cipher: %s setkey unexpectedly succeeded on test vector %u; expected_error=%d\n",
2773 algo, j, template[i].setkey_error);
2774 ret = -EINVAL;
2775 goto out;
2776 }
2777
2778 for (k = 0; k < template[i].len;
2779 k += crypto_cipher_blocksize(tfm)) {
2780 if (enc)
2781 crypto_cipher_encrypt_one(tfm, data + k,
2782 data + k);
2783 else
2784 crypto_cipher_decrypt_one(tfm, data + k,
2785 data + k);
2786 }
2787
2788 q = data;
2789 if (memcmp(q, result, template[i].len)) {
2790 printk(KERN_ERR "alg: cipher: Test %d failed "
2791 "on %s for %s\n", j, e, algo);
2792 hexdump(q, template[i].len);
2793 ret = -EINVAL;
2794 goto out;
2795 }
2796 }
2797
2798 ret = 0;
2799
2800out:
2801 testmgr_free_buf(xbuf);
2802out_nobuf:
2803 return ret;
2804}
2805
2806static int test_skcipher_vec_cfg(int enc, const struct cipher_testvec *vec,
2807 const char *vec_name,
2808 const struct testvec_config *cfg,
2809 struct skcipher_request *req,
2810 struct cipher_test_sglists *tsgls)
2811{
2812 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
2813 const unsigned int alignmask = crypto_skcipher_alignmask(tfm);
2814 const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
2815 const char *driver = crypto_skcipher_driver_name(tfm);
2816 const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
2817 const char *op = enc ? "encryption" : "decryption";
2818 DECLARE_CRYPTO_WAIT(wait);
2819 u8 _iv[3 * (MAX_ALGAPI_ALIGNMASK + 1) + MAX_IVLEN];
2820 u8 *iv = PTR_ALIGN(&_iv[0], 2 * (MAX_ALGAPI_ALIGNMASK + 1)) +
2821 cfg->iv_offset +
2822 (cfg->iv_offset_relative_to_alignmask ? alignmask : 0);
2823 struct kvec input;
2824 int err;
2825
2826 /* Set the key */
2827 if (vec->wk)
2828 crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2829 else
2830 crypto_skcipher_clear_flags(tfm,
2831 CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2832 err = do_setkey(crypto_skcipher_setkey, tfm, vec->key, vec->klen,
2833 cfg, alignmask);
2834 if (err) {
2835 if (err == vec->setkey_error)
2836 return 0;
2837 pr_err("alg: skcipher: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
2838 driver, vec_name, vec->setkey_error, err,
2839 crypto_skcipher_get_flags(tfm));
2840 return err;
2841 }
2842 if (vec->setkey_error) {
2843 pr_err("alg: skcipher: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
2844 driver, vec_name, vec->setkey_error);
2845 return -EINVAL;
2846 }
2847
2848 /* The IV must be copied to a buffer, as the algorithm may modify it */
2849 if (ivsize) {
2850 if (WARN_ON(ivsize > MAX_IVLEN))
2851 return -EINVAL;
2852 if (vec->iv)
2853 memcpy(iv, vec->iv, ivsize);
2854 else
2855 memset(iv, 0, ivsize);
2856 } else {
2857 iv = NULL;
2858 }
2859
2860 /* Build the src/dst scatterlists */
2861 input.iov_base = enc ? (void *)vec->ptext : (void *)vec->ctext;
2862 input.iov_len = vec->len;
2863 err = build_cipher_test_sglists(tsgls, cfg, alignmask,
2864 vec->len, vec->len, &input, 1);
2865 if (err) {
2866 pr_err("alg: skcipher: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n",
2867 driver, op, vec_name, cfg->name);
2868 return err;
2869 }
2870
2871 /* Do the actual encryption or decryption */
2872 testmgr_poison(req->__ctx, crypto_skcipher_reqsize(tfm));
2873 skcipher_request_set_callback(req, req_flags, crypto_req_done, &wait);
2874 skcipher_request_set_crypt(req, tsgls->src.sgl_ptr, tsgls->dst.sgl_ptr,
2875 vec->len, iv);
2876 if (cfg->nosimd)
2877 crypto_disable_simd_for_test();
2878 err = enc ? crypto_skcipher_encrypt(req) : crypto_skcipher_decrypt(req);
2879 if (cfg->nosimd)
2880 crypto_reenable_simd_for_test();
2881 err = crypto_wait_req(err, &wait);
2882
2883 /* Check that the algorithm didn't overwrite things it shouldn't have */
2884 if (req->cryptlen != vec->len ||
2885 req->iv != iv ||
2886 req->src != tsgls->src.sgl_ptr ||
2887 req->dst != tsgls->dst.sgl_ptr ||
2888 crypto_skcipher_reqtfm(req) != tfm ||
2889 req->base.complete != crypto_req_done ||
2890 req->base.flags != req_flags ||
2891 req->base.data != &wait) {
2892 pr_err("alg: skcipher: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n",
2893 driver, op, vec_name, cfg->name);
2894 if (req->cryptlen != vec->len)
2895 pr_err("alg: skcipher: changed 'req->cryptlen'\n");
2896 if (req->iv != iv)
2897 pr_err("alg: skcipher: changed 'req->iv'\n");
2898 if (req->src != tsgls->src.sgl_ptr)
2899 pr_err("alg: skcipher: changed 'req->src'\n");
2900 if (req->dst != tsgls->dst.sgl_ptr)
2901 pr_err("alg: skcipher: changed 'req->dst'\n");
2902 if (crypto_skcipher_reqtfm(req) != tfm)
2903 pr_err("alg: skcipher: changed 'req->base.tfm'\n");
2904 if (req->base.complete != crypto_req_done)
2905 pr_err("alg: skcipher: changed 'req->base.complete'\n");
2906 if (req->base.flags != req_flags)
2907 pr_err("alg: skcipher: changed 'req->base.flags'\n");
2908 if (req->base.data != &wait)
2909 pr_err("alg: skcipher: changed 'req->base.data'\n");
2910 return -EINVAL;
2911 }
2912 if (is_test_sglist_corrupted(&tsgls->src)) {
2913 pr_err("alg: skcipher: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n",
2914 driver, op, vec_name, cfg->name);
2915 return -EINVAL;
2916 }
2917 if (tsgls->dst.sgl_ptr != tsgls->src.sgl &&
2918 is_test_sglist_corrupted(&tsgls->dst)) {
2919 pr_err("alg: skcipher: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n",
2920 driver, op, vec_name, cfg->name);
2921 return -EINVAL;
2922 }
2923
2924 /* Check for success or failure */
2925 if (err) {
2926 if (err == vec->crypt_error)
2927 return 0;
2928 pr_err("alg: skcipher: %s %s failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
2929 driver, op, vec_name, vec->crypt_error, err, cfg->name);
2930 return err;
2931 }
2932 if (vec->crypt_error) {
2933 pr_err("alg: skcipher: %s %s unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
2934 driver, op, vec_name, vec->crypt_error, cfg->name);
2935 return -EINVAL;
2936 }
2937
2938 /* Check for the correct output (ciphertext or plaintext) */
2939 err = verify_correct_output(&tsgls->dst, enc ? vec->ctext : vec->ptext,
2940 vec->len, 0, true);
2941 if (err == -EOVERFLOW) {
2942 pr_err("alg: skcipher: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n",
2943 driver, op, vec_name, cfg->name);
2944 return err;
2945 }
2946 if (err) {
2947 pr_err("alg: skcipher: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
2948 driver, op, vec_name, cfg->name);
2949 return err;
2950 }
2951
2952 /* If applicable, check that the algorithm generated the correct IV */
2953 if (vec->iv_out && memcmp(iv, vec->iv_out, ivsize) != 0) {
2954 pr_err("alg: skcipher: %s %s test failed (wrong output IV) on test vector %s, cfg=\"%s\"\n",
2955 driver, op, vec_name, cfg->name);
2956 hexdump(iv, ivsize);
2957 return -EINVAL;
2958 }
2959
2960 return 0;
2961}
2962
2963static int test_skcipher_vec(int enc, const struct cipher_testvec *vec,
2964 unsigned int vec_num,
2965 struct skcipher_request *req,
2966 struct cipher_test_sglists *tsgls)
2967{
2968 char vec_name[16];
2969 unsigned int i;
2970 int err;
2971
2972 if (fips_enabled && vec->fips_skip)
2973 return 0;
2974
2975 sprintf(vec_name, "%u", vec_num);
2976
2977 for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) {
2978 err = test_skcipher_vec_cfg(enc, vec, vec_name,
2979 &default_cipher_testvec_configs[i],
2980 req, tsgls);
2981 if (err)
2982 return err;
2983 }
2984
2985 if (!noslowtests) {
2986 struct rnd_state rng;
2987 struct testvec_config cfg;
2988 char cfgname[TESTVEC_CONFIG_NAMELEN];
2989
2990 init_rnd_state(&rng);
2991
2992 for (i = 0; i < fuzz_iterations; i++) {
2993 generate_random_testvec_config(&rng, &cfg, cfgname,
2994 sizeof(cfgname));
2995 err = test_skcipher_vec_cfg(enc, vec, vec_name,
2996 &cfg, req, tsgls);
2997 if (err)
2998 return err;
2999 cond_resched();
3000 }
3001 }
3002 return 0;
3003}
3004
3005/*
3006 * Generate a symmetric cipher test vector from the given implementation.
3007 * Assumes the buffers in 'vec' were already allocated.
3008 */
3009static void generate_random_cipher_testvec(struct rnd_state *rng,
3010 struct skcipher_request *req,
3011 struct cipher_testvec *vec,
3012 unsigned int maxdatasize,
3013 char *name, size_t max_namelen)
3014{
3015 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
3016 const unsigned int maxkeysize = crypto_skcipher_max_keysize(tfm);
3017 const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
3018 struct scatterlist src, dst;
3019 u8 iv[MAX_IVLEN];
3020 DECLARE_CRYPTO_WAIT(wait);
3021
3022 /* Key: length in [0, maxkeysize], but usually choose maxkeysize */
3023 vec->klen = maxkeysize;
3024 if (prandom_u32_below(rng, 4) == 0)
3025 vec->klen = prandom_u32_below(rng, maxkeysize + 1);
3026 generate_random_bytes(rng, (u8 *)vec->key, vec->klen);
3027 vec->setkey_error = crypto_skcipher_setkey(tfm, vec->key, vec->klen);
3028
3029 /* IV */
3030 generate_random_bytes(rng, (u8 *)vec->iv, ivsize);
3031
3032 /* Plaintext */
3033 vec->len = generate_random_length(rng, maxdatasize);
3034 generate_random_bytes(rng, (u8 *)vec->ptext, vec->len);
3035
3036 /* If the key couldn't be set, no need to continue to encrypt. */
3037 if (vec->setkey_error)
3038 goto done;
3039
3040 /* Ciphertext */
3041 sg_init_one(&src, vec->ptext, vec->len);
3042 sg_init_one(&dst, vec->ctext, vec->len);
3043 memcpy(iv, vec->iv, ivsize);
3044 skcipher_request_set_callback(req, 0, crypto_req_done, &wait);
3045 skcipher_request_set_crypt(req, &src, &dst, vec->len, iv);
3046 vec->crypt_error = crypto_wait_req(crypto_skcipher_encrypt(req), &wait);
3047 if (vec->crypt_error != 0) {
3048 /*
3049 * The only acceptable error here is for an invalid length, so
3050 * skcipher decryption should fail with the same error too.
3051 * We'll test for this. But to keep the API usage well-defined,
3052 * explicitly initialize the ciphertext buffer too.
3053 */
3054 memset((u8 *)vec->ctext, 0, vec->len);
3055 }
3056done:
3057 snprintf(name, max_namelen, "\"random: len=%u klen=%u\"",
3058 vec->len, vec->klen);
3059}
3060
3061/*
3062 * Test the skcipher algorithm represented by @req against the corresponding
3063 * generic implementation, if one is available.
3064 */
3065static int test_skcipher_vs_generic_impl(const char *generic_driver,
3066 struct skcipher_request *req,
3067 struct cipher_test_sglists *tsgls)
3068{
3069 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
3070 const unsigned int maxkeysize = crypto_skcipher_max_keysize(tfm);
3071 const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
3072 const unsigned int blocksize = crypto_skcipher_blocksize(tfm);
3073 const unsigned int maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN;
3074 const char *algname = crypto_skcipher_alg(tfm)->base.cra_name;
3075 const char *driver = crypto_skcipher_driver_name(tfm);
3076 struct rnd_state rng;
3077 char _generic_driver[CRYPTO_MAX_ALG_NAME];
3078 struct crypto_skcipher *generic_tfm = NULL;
3079 struct skcipher_request *generic_req = NULL;
3080 unsigned int i;
3081 struct cipher_testvec vec = { 0 };
3082 char vec_name[64];
3083 struct testvec_config *cfg;
3084 char cfgname[TESTVEC_CONFIG_NAMELEN];
3085 int err;
3086
3087 if (noslowtests)
3088 return 0;
3089
3090 init_rnd_state(&rng);
3091
3092 if (!generic_driver) { /* Use default naming convention? */
3093 err = build_generic_driver_name(algname, _generic_driver);
3094 if (err)
3095 return err;
3096 generic_driver = _generic_driver;
3097 }
3098
3099 if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */
3100 return 0;
3101
3102 generic_tfm = crypto_alloc_skcipher(generic_driver, 0, 0);
3103 if (IS_ERR(generic_tfm)) {
3104 err = PTR_ERR(generic_tfm);
3105 if (err == -ENOENT) {
3106 pr_warn("alg: skcipher: skipping comparison tests for %s because %s is unavailable\n",
3107 driver, generic_driver);
3108 return 0;
3109 }
3110 pr_err("alg: skcipher: error allocating %s (generic impl of %s): %d\n",
3111 generic_driver, algname, err);
3112 return err;
3113 }
3114
3115 cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
3116 if (!cfg) {
3117 err = -ENOMEM;
3118 goto out;
3119 }
3120
3121 generic_req = skcipher_request_alloc(generic_tfm, GFP_KERNEL);
3122 if (!generic_req) {
3123 err = -ENOMEM;
3124 goto out;
3125 }
3126
3127 /* Check the algorithm properties for consistency. */
3128
3129 if (crypto_skcipher_min_keysize(tfm) !=
3130 crypto_skcipher_min_keysize(generic_tfm)) {
3131 pr_err("alg: skcipher: min keysize for %s (%u) doesn't match generic impl (%u)\n",
3132 driver, crypto_skcipher_min_keysize(tfm),
3133 crypto_skcipher_min_keysize(generic_tfm));
3134 err = -EINVAL;
3135 goto out;
3136 }
3137
3138 if (maxkeysize != crypto_skcipher_max_keysize(generic_tfm)) {
3139 pr_err("alg: skcipher: max keysize for %s (%u) doesn't match generic impl (%u)\n",
3140 driver, maxkeysize,
3141 crypto_skcipher_max_keysize(generic_tfm));
3142 err = -EINVAL;
3143 goto out;
3144 }
3145
3146 if (ivsize != crypto_skcipher_ivsize(generic_tfm)) {
3147 pr_err("alg: skcipher: ivsize for %s (%u) doesn't match generic impl (%u)\n",
3148 driver, ivsize, crypto_skcipher_ivsize(generic_tfm));
3149 err = -EINVAL;
3150 goto out;
3151 }
3152
3153 if (blocksize != crypto_skcipher_blocksize(generic_tfm)) {
3154 pr_err("alg: skcipher: blocksize for %s (%u) doesn't match generic impl (%u)\n",
3155 driver, blocksize,
3156 crypto_skcipher_blocksize(generic_tfm));
3157 err = -EINVAL;
3158 goto out;
3159 }
3160
3161 /*
3162 * Now generate test vectors using the generic implementation, and test
3163 * the other implementation against them.
3164 */
3165
3166 vec.key = kmalloc(maxkeysize, GFP_KERNEL);
3167 vec.iv = kmalloc(ivsize, GFP_KERNEL);
3168 vec.ptext = kmalloc(maxdatasize, GFP_KERNEL);
3169 vec.ctext = kmalloc(maxdatasize, GFP_KERNEL);
3170 if (!vec.key || !vec.iv || !vec.ptext || !vec.ctext) {
3171 err = -ENOMEM;
3172 goto out;
3173 }
3174
3175 for (i = 0; i < fuzz_iterations * 8; i++) {
3176 generate_random_cipher_testvec(&rng, generic_req, &vec,
3177 maxdatasize,
3178 vec_name, sizeof(vec_name));
3179 generate_random_testvec_config(&rng, cfg, cfgname,
3180 sizeof(cfgname));
3181
3182 err = test_skcipher_vec_cfg(ENCRYPT, &vec, vec_name,
3183 cfg, req, tsgls);
3184 if (err)
3185 goto out;
3186 err = test_skcipher_vec_cfg(DECRYPT, &vec, vec_name,
3187 cfg, req, tsgls);
3188 if (err)
3189 goto out;
3190 cond_resched();
3191 }
3192 err = 0;
3193out:
3194 kfree(cfg);
3195 kfree(vec.key);
3196 kfree(vec.iv);
3197 kfree(vec.ptext);
3198 kfree(vec.ctext);
3199 crypto_free_skcipher(generic_tfm);
3200 skcipher_request_free(generic_req);
3201 return err;
3202}
3203
3204static int test_skcipher(int enc, const struct cipher_test_suite *suite,
3205 struct skcipher_request *req,
3206 struct cipher_test_sglists *tsgls)
3207{
3208 unsigned int i;
3209 int err;
3210
3211 for (i = 0; i < suite->count; i++) {
3212 err = test_skcipher_vec(enc, &suite->vecs[i], i, req, tsgls);
3213 if (err)
3214 return err;
3215 cond_resched();
3216 }
3217 return 0;
3218}
3219
3220static int alg_test_skcipher(const struct alg_test_desc *desc,
3221 const char *driver, u32 type, u32 mask)
3222{
3223 const struct cipher_test_suite *suite = &desc->suite.cipher;
3224 struct crypto_skcipher *tfm;
3225 struct skcipher_request *req = NULL;
3226 struct cipher_test_sglists *tsgls = NULL;
3227 int err;
3228
3229 if (suite->count <= 0) {
3230 pr_err("alg: skcipher: empty test suite for %s\n", driver);
3231 return -EINVAL;
3232 }
3233
3234 tfm = crypto_alloc_skcipher(driver, type, mask);
3235 if (IS_ERR(tfm)) {
3236 if (PTR_ERR(tfm) == -ENOENT)
3237 return 0;
3238 pr_err("alg: skcipher: failed to allocate transform for %s: %ld\n",
3239 driver, PTR_ERR(tfm));
3240 return PTR_ERR(tfm);
3241 }
3242 driver = crypto_skcipher_driver_name(tfm);
3243
3244 req = skcipher_request_alloc(tfm, GFP_KERNEL);
3245 if (!req) {
3246 pr_err("alg: skcipher: failed to allocate request for %s\n",
3247 driver);
3248 err = -ENOMEM;
3249 goto out;
3250 }
3251
3252 tsgls = alloc_cipher_test_sglists();
3253 if (!tsgls) {
3254 pr_err("alg: skcipher: failed to allocate test buffers for %s\n",
3255 driver);
3256 err = -ENOMEM;
3257 goto out;
3258 }
3259
3260 err = test_skcipher(ENCRYPT, suite, req, tsgls);
3261 if (err)
3262 goto out;
3263
3264 err = test_skcipher(DECRYPT, suite, req, tsgls);
3265 if (err)
3266 goto out;
3267
3268 err = test_skcipher_vs_generic_impl(desc->generic_driver, req, tsgls);
3269out:
3270 free_cipher_test_sglists(tsgls);
3271 skcipher_request_free(req);
3272 crypto_free_skcipher(tfm);
3273 return err;
3274}
3275
3276static int test_acomp(struct crypto_acomp *tfm,
3277 const struct comp_testvec *ctemplate,
3278 const struct comp_testvec *dtemplate,
3279 int ctcount, int dtcount)
3280{
3281 const char *algo = crypto_tfm_alg_driver_name(crypto_acomp_tfm(tfm));
3282 unsigned int i;
3283 char *output, *decomp_out;
3284 int ret;
3285 struct scatterlist src, dst;
3286 struct acomp_req *req;
3287 struct crypto_wait wait;
3288
3289 output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
3290 if (!output)
3291 return -ENOMEM;
3292
3293 decomp_out = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
3294 if (!decomp_out) {
3295 kfree(output);
3296 return -ENOMEM;
3297 }
3298
3299 for (i = 0; i < ctcount; i++) {
3300 unsigned int dlen = COMP_BUF_SIZE;
3301 int ilen = ctemplate[i].inlen;
3302 void *input_vec;
3303
3304 input_vec = kmemdup(ctemplate[i].input, ilen, GFP_KERNEL);
3305 if (!input_vec) {
3306 ret = -ENOMEM;
3307 goto out;
3308 }
3309
3310 memset(output, 0, dlen);
3311 crypto_init_wait(&wait);
3312 sg_init_one(&src, input_vec, ilen);
3313 sg_init_one(&dst, output, dlen);
3314
3315 req = acomp_request_alloc(tfm);
3316 if (!req) {
3317 pr_err("alg: acomp: request alloc failed for %s\n",
3318 algo);
3319 kfree(input_vec);
3320 ret = -ENOMEM;
3321 goto out;
3322 }
3323
3324 acomp_request_set_params(req, &src, &dst, ilen, dlen);
3325 acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3326 crypto_req_done, &wait);
3327
3328 ret = crypto_wait_req(crypto_acomp_compress(req), &wait);
3329 if (ret) {
3330 pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
3331 i + 1, algo, -ret);
3332 kfree(input_vec);
3333 acomp_request_free(req);
3334 goto out;
3335 }
3336
3337 ilen = req->dlen;
3338 dlen = COMP_BUF_SIZE;
3339 sg_init_one(&src, output, ilen);
3340 sg_init_one(&dst, decomp_out, dlen);
3341 crypto_init_wait(&wait);
3342 acomp_request_set_params(req, &src, &dst, ilen, dlen);
3343
3344 ret = crypto_wait_req(crypto_acomp_decompress(req), &wait);
3345 if (ret) {
3346 pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
3347 i + 1, algo, -ret);
3348 kfree(input_vec);
3349 acomp_request_free(req);
3350 goto out;
3351 }
3352
3353 if (req->dlen != ctemplate[i].inlen) {
3354 pr_err("alg: acomp: Compression test %d failed for %s: output len = %d\n",
3355 i + 1, algo, req->dlen);
3356 ret = -EINVAL;
3357 kfree(input_vec);
3358 acomp_request_free(req);
3359 goto out;
3360 }
3361
3362 if (memcmp(input_vec, decomp_out, req->dlen)) {
3363 pr_err("alg: acomp: Compression test %d failed for %s\n",
3364 i + 1, algo);
3365 hexdump(output, req->dlen);
3366 ret = -EINVAL;
3367 kfree(input_vec);
3368 acomp_request_free(req);
3369 goto out;
3370 }
3371
3372 kfree(input_vec);
3373 acomp_request_free(req);
3374 }
3375
3376 for (i = 0; i < dtcount; i++) {
3377 unsigned int dlen = COMP_BUF_SIZE;
3378 int ilen = dtemplate[i].inlen;
3379 void *input_vec;
3380
3381 input_vec = kmemdup(dtemplate[i].input, ilen, GFP_KERNEL);
3382 if (!input_vec) {
3383 ret = -ENOMEM;
3384 goto out;
3385 }
3386
3387 memset(output, 0, dlen);
3388 crypto_init_wait(&wait);
3389 sg_init_one(&src, input_vec, ilen);
3390 sg_init_one(&dst, output, dlen);
3391
3392 req = acomp_request_alloc(tfm);
3393 if (!req) {
3394 pr_err("alg: acomp: request alloc failed for %s\n",
3395 algo);
3396 kfree(input_vec);
3397 ret = -ENOMEM;
3398 goto out;
3399 }
3400
3401 acomp_request_set_params(req, &src, &dst, ilen, dlen);
3402 acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3403 crypto_req_done, &wait);
3404
3405 ret = crypto_wait_req(crypto_acomp_decompress(req), &wait);
3406 if (ret) {
3407 pr_err("alg: acomp: decompression failed on test %d for %s: ret=%d\n",
3408 i + 1, algo, -ret);
3409 kfree(input_vec);
3410 acomp_request_free(req);
3411 goto out;
3412 }
3413
3414 if (req->dlen != dtemplate[i].outlen) {
3415 pr_err("alg: acomp: Decompression test %d failed for %s: output len = %d\n",
3416 i + 1, algo, req->dlen);
3417 ret = -EINVAL;
3418 kfree(input_vec);
3419 acomp_request_free(req);
3420 goto out;
3421 }
3422
3423 if (memcmp(output, dtemplate[i].output, req->dlen)) {
3424 pr_err("alg: acomp: Decompression test %d failed for %s\n",
3425 i + 1, algo);
3426 hexdump(output, req->dlen);
3427 ret = -EINVAL;
3428 kfree(input_vec);
3429 acomp_request_free(req);
3430 goto out;
3431 }
3432
3433 kfree(input_vec);
3434 acomp_request_free(req);
3435 }
3436
3437 ret = 0;
3438
3439out:
3440 kfree(decomp_out);
3441 kfree(output);
3442 return ret;
3443}
3444
3445static int test_cprng(struct crypto_rng *tfm,
3446 const struct cprng_testvec *template,
3447 unsigned int tcount)
3448{
3449 const char *algo = crypto_tfm_alg_driver_name(crypto_rng_tfm(tfm));
3450 int err = 0, i, j, seedsize;
3451 u8 *seed;
3452 char result[32];
3453
3454 seedsize = crypto_rng_seedsize(tfm);
3455
3456 seed = kmalloc(seedsize, GFP_KERNEL);
3457 if (!seed) {
3458 printk(KERN_ERR "alg: cprng: Failed to allocate seed space "
3459 "for %s\n", algo);
3460 return -ENOMEM;
3461 }
3462
3463 for (i = 0; i < tcount; i++) {
3464 memset(result, 0, 32);
3465
3466 memcpy(seed, template[i].v, template[i].vlen);
3467 memcpy(seed + template[i].vlen, template[i].key,
3468 template[i].klen);
3469 memcpy(seed + template[i].vlen + template[i].klen,
3470 template[i].dt, template[i].dtlen);
3471
3472 err = crypto_rng_reset(tfm, seed, seedsize);
3473 if (err) {
3474 printk(KERN_ERR "alg: cprng: Failed to reset rng "
3475 "for %s\n", algo);
3476 goto out;
3477 }
3478
3479 for (j = 0; j < template[i].loops; j++) {
3480 err = crypto_rng_get_bytes(tfm, result,
3481 template[i].rlen);
3482 if (err < 0) {
3483 printk(KERN_ERR "alg: cprng: Failed to obtain "
3484 "the correct amount of random data for "
3485 "%s (requested %d)\n", algo,
3486 template[i].rlen);
3487 goto out;
3488 }
3489 }
3490
3491 err = memcmp(result, template[i].result,
3492 template[i].rlen);
3493 if (err) {
3494 printk(KERN_ERR "alg: cprng: Test %d failed for %s\n",
3495 i, algo);
3496 hexdump(result, template[i].rlen);
3497 err = -EINVAL;
3498 goto out;
3499 }
3500 }
3501
3502out:
3503 kfree(seed);
3504 return err;
3505}
3506
3507static int alg_test_cipher(const struct alg_test_desc *desc,
3508 const char *driver, u32 type, u32 mask)
3509{
3510 const struct cipher_test_suite *suite = &desc->suite.cipher;
3511 struct crypto_cipher *tfm;
3512 int err;
3513
3514 tfm = crypto_alloc_cipher(driver, type, mask);
3515 if (IS_ERR(tfm)) {
3516 if (PTR_ERR(tfm) == -ENOENT)
3517 return 0;
3518 printk(KERN_ERR "alg: cipher: Failed to load transform for "
3519 "%s: %ld\n", driver, PTR_ERR(tfm));
3520 return PTR_ERR(tfm);
3521 }
3522
3523 err = test_cipher(tfm, ENCRYPT, suite->vecs, suite->count);
3524 if (!err)
3525 err = test_cipher(tfm, DECRYPT, suite->vecs, suite->count);
3526
3527 crypto_free_cipher(tfm);
3528 return err;
3529}
3530
3531static int alg_test_comp(const struct alg_test_desc *desc, const char *driver,
3532 u32 type, u32 mask)
3533{
3534 struct crypto_acomp *acomp;
3535 int err;
3536
3537 acomp = crypto_alloc_acomp(driver, type, mask);
3538 if (IS_ERR(acomp)) {
3539 if (PTR_ERR(acomp) == -ENOENT)
3540 return 0;
3541 pr_err("alg: acomp: Failed to load transform for %s: %ld\n",
3542 driver, PTR_ERR(acomp));
3543 return PTR_ERR(acomp);
3544 }
3545 err = test_acomp(acomp, desc->suite.comp.comp.vecs,
3546 desc->suite.comp.decomp.vecs,
3547 desc->suite.comp.comp.count,
3548 desc->suite.comp.decomp.count);
3549 crypto_free_acomp(acomp);
3550 return err;
3551}
3552
3553static int alg_test_cprng(const struct alg_test_desc *desc, const char *driver,
3554 u32 type, u32 mask)
3555{
3556 struct crypto_rng *rng;
3557 int err;
3558
3559 rng = crypto_alloc_rng(driver, type, mask);
3560 if (IS_ERR(rng)) {
3561 if (PTR_ERR(rng) == -ENOENT)
3562 return 0;
3563 printk(KERN_ERR "alg: cprng: Failed to load transform for %s: "
3564 "%ld\n", driver, PTR_ERR(rng));
3565 return PTR_ERR(rng);
3566 }
3567
3568 err = test_cprng(rng, desc->suite.cprng.vecs, desc->suite.cprng.count);
3569
3570 crypto_free_rng(rng);
3571
3572 return err;
3573}
3574
3575
3576static int drbg_cavs_test(const struct drbg_testvec *test, int pr,
3577 const char *driver, u32 type, u32 mask)
3578{
3579 int ret = -EAGAIN;
3580 struct crypto_rng *drng;
3581 struct drbg_test_data test_data;
3582 struct drbg_string addtl, pers, testentropy;
3583 unsigned char *buf = kzalloc(test->expectedlen, GFP_KERNEL);
3584
3585 if (!buf)
3586 return -ENOMEM;
3587
3588 drng = crypto_alloc_rng(driver, type, mask);
3589 if (IS_ERR(drng)) {
3590 kfree_sensitive(buf);
3591 if (PTR_ERR(drng) == -ENOENT)
3592 return 0;
3593 printk(KERN_ERR "alg: drbg: could not allocate DRNG handle for "
3594 "%s\n", driver);
3595 return PTR_ERR(drng);
3596 }
3597
3598 test_data.testentropy = &testentropy;
3599 drbg_string_fill(&testentropy, test->entropy, test->entropylen);
3600 drbg_string_fill(&pers, test->pers, test->perslen);
3601 ret = crypto_drbg_reset_test(drng, &pers, &test_data);
3602 if (ret) {
3603 printk(KERN_ERR "alg: drbg: Failed to reset rng\n");
3604 goto outbuf;
3605 }
3606
3607 drbg_string_fill(&addtl, test->addtla, test->addtllen);
3608 if (pr) {
3609 drbg_string_fill(&testentropy, test->entpra, test->entprlen);
3610 ret = crypto_drbg_get_bytes_addtl_test(drng,
3611 buf, test->expectedlen, &addtl, &test_data);
3612 } else {
3613 ret = crypto_drbg_get_bytes_addtl(drng,
3614 buf, test->expectedlen, &addtl);
3615 }
3616 if (ret < 0) {
3617 printk(KERN_ERR "alg: drbg: could not obtain random data for "
3618 "driver %s\n", driver);
3619 goto outbuf;
3620 }
3621
3622 drbg_string_fill(&addtl, test->addtlb, test->addtllen);
3623 if (pr) {
3624 drbg_string_fill(&testentropy, test->entprb, test->entprlen);
3625 ret = crypto_drbg_get_bytes_addtl_test(drng,
3626 buf, test->expectedlen, &addtl, &test_data);
3627 } else {
3628 ret = crypto_drbg_get_bytes_addtl(drng,
3629 buf, test->expectedlen, &addtl);
3630 }
3631 if (ret < 0) {
3632 printk(KERN_ERR "alg: drbg: could not obtain random data for "
3633 "driver %s\n", driver);
3634 goto outbuf;
3635 }
3636
3637 ret = memcmp(test->expected, buf, test->expectedlen);
3638
3639outbuf:
3640 crypto_free_rng(drng);
3641 kfree_sensitive(buf);
3642 return ret;
3643}
3644
3645
3646static int alg_test_drbg(const struct alg_test_desc *desc, const char *driver,
3647 u32 type, u32 mask)
3648{
3649 int err = 0;
3650 int pr = 0;
3651 int i = 0;
3652 const struct drbg_testvec *template = desc->suite.drbg.vecs;
3653 unsigned int tcount = desc->suite.drbg.count;
3654
3655 if (0 == memcmp(driver, "drbg_pr_", 8))
3656 pr = 1;
3657
3658 for (i = 0; i < tcount; i++) {
3659 err = drbg_cavs_test(&template[i], pr, driver, type, mask);
3660 if (err) {
3661 printk(KERN_ERR "alg: drbg: Test %d failed for %s\n",
3662 i, driver);
3663 err = -EINVAL;
3664 break;
3665 }
3666 }
3667 return err;
3668
3669}
3670
3671static int do_test_kpp(struct crypto_kpp *tfm, const struct kpp_testvec *vec,
3672 const char *alg)
3673{
3674 struct kpp_request *req;
3675 void *input_buf = NULL;
3676 void *output_buf = NULL;
3677 void *a_public = NULL;
3678 void *a_ss = NULL;
3679 void *shared_secret = NULL;
3680 struct crypto_wait wait;
3681 unsigned int out_len_max;
3682 int err = -ENOMEM;
3683 struct scatterlist src, dst;
3684
3685 req = kpp_request_alloc(tfm, GFP_KERNEL);
3686 if (!req)
3687 return err;
3688
3689 crypto_init_wait(&wait);
3690
3691 err = crypto_kpp_set_secret(tfm, vec->secret, vec->secret_size);
3692 if (err < 0)
3693 goto free_req;
3694
3695 out_len_max = crypto_kpp_maxsize(tfm);
3696 output_buf = kzalloc(out_len_max, GFP_KERNEL);
3697 if (!output_buf) {
3698 err = -ENOMEM;
3699 goto free_req;
3700 }
3701
3702 /* Use appropriate parameter as base */
3703 kpp_request_set_input(req, NULL, 0);
3704 sg_init_one(&dst, output_buf, out_len_max);
3705 kpp_request_set_output(req, &dst, out_len_max);
3706 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3707 crypto_req_done, &wait);
3708
3709 /* Compute party A's public key */
3710 err = crypto_wait_req(crypto_kpp_generate_public_key(req), &wait);
3711 if (err) {
3712 pr_err("alg: %s: Party A: generate public key test failed. err %d\n",
3713 alg, err);
3714 goto free_output;
3715 }
3716
3717 if (vec->genkey) {
3718 /* Save party A's public key */
3719 a_public = kmemdup(sg_virt(req->dst), out_len_max, GFP_KERNEL);
3720 if (!a_public) {
3721 err = -ENOMEM;
3722 goto free_output;
3723 }
3724 } else {
3725 /* Verify calculated public key */
3726 if (memcmp(vec->expected_a_public, sg_virt(req->dst),
3727 vec->expected_a_public_size)) {
3728 pr_err("alg: %s: Party A: generate public key test failed. Invalid output\n",
3729 alg);
3730 err = -EINVAL;
3731 goto free_output;
3732 }
3733 }
3734
3735 /* Calculate shared secret key by using counter part (b) public key. */
3736 input_buf = kmemdup(vec->b_public, vec->b_public_size, GFP_KERNEL);
3737 if (!input_buf) {
3738 err = -ENOMEM;
3739 goto free_output;
3740 }
3741
3742 sg_init_one(&src, input_buf, vec->b_public_size);
3743 sg_init_one(&dst, output_buf, out_len_max);
3744 kpp_request_set_input(req, &src, vec->b_public_size);
3745 kpp_request_set_output(req, &dst, out_len_max);
3746 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3747 crypto_req_done, &wait);
3748 err = crypto_wait_req(crypto_kpp_compute_shared_secret(req), &wait);
3749 if (err) {
3750 pr_err("alg: %s: Party A: compute shared secret test failed. err %d\n",
3751 alg, err);
3752 goto free_all;
3753 }
3754
3755 if (vec->genkey) {
3756 /* Save the shared secret obtained by party A */
3757 a_ss = kmemdup(sg_virt(req->dst), vec->expected_ss_size, GFP_KERNEL);
3758 if (!a_ss) {
3759 err = -ENOMEM;
3760 goto free_all;
3761 }
3762
3763 /*
3764 * Calculate party B's shared secret by using party A's
3765 * public key.
3766 */
3767 err = crypto_kpp_set_secret(tfm, vec->b_secret,
3768 vec->b_secret_size);
3769 if (err < 0)
3770 goto free_all;
3771
3772 sg_init_one(&src, a_public, vec->expected_a_public_size);
3773 sg_init_one(&dst, output_buf, out_len_max);
3774 kpp_request_set_input(req, &src, vec->expected_a_public_size);
3775 kpp_request_set_output(req, &dst, out_len_max);
3776 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3777 crypto_req_done, &wait);
3778 err = crypto_wait_req(crypto_kpp_compute_shared_secret(req),
3779 &wait);
3780 if (err) {
3781 pr_err("alg: %s: Party B: compute shared secret failed. err %d\n",
3782 alg, err);
3783 goto free_all;
3784 }
3785
3786 shared_secret = a_ss;
3787 } else {
3788 shared_secret = (void *)vec->expected_ss;
3789 }
3790
3791 /*
3792 * verify shared secret from which the user will derive
3793 * secret key by executing whatever hash it has chosen
3794 */
3795 if (memcmp(shared_secret, sg_virt(req->dst),
3796 vec->expected_ss_size)) {
3797 pr_err("alg: %s: compute shared secret test failed. Invalid output\n",
3798 alg);
3799 err = -EINVAL;
3800 }
3801
3802free_all:
3803 kfree(a_ss);
3804 kfree(input_buf);
3805free_output:
3806 kfree(a_public);
3807 kfree(output_buf);
3808free_req:
3809 kpp_request_free(req);
3810 return err;
3811}
3812
3813static int test_kpp(struct crypto_kpp *tfm, const char *alg,
3814 const struct kpp_testvec *vecs, unsigned int tcount)
3815{
3816 int ret, i;
3817
3818 for (i = 0; i < tcount; i++) {
3819 ret = do_test_kpp(tfm, vecs++, alg);
3820 if (ret) {
3821 pr_err("alg: %s: test failed on vector %d, err=%d\n",
3822 alg, i + 1, ret);
3823 return ret;
3824 }
3825 }
3826 return 0;
3827}
3828
3829static int alg_test_kpp(const struct alg_test_desc *desc, const char *driver,
3830 u32 type, u32 mask)
3831{
3832 struct crypto_kpp *tfm;
3833 int err = 0;
3834
3835 tfm = crypto_alloc_kpp(driver, type, mask);
3836 if (IS_ERR(tfm)) {
3837 if (PTR_ERR(tfm) == -ENOENT)
3838 return 0;
3839 pr_err("alg: kpp: Failed to load tfm for %s: %ld\n",
3840 driver, PTR_ERR(tfm));
3841 return PTR_ERR(tfm);
3842 }
3843 if (desc->suite.kpp.vecs)
3844 err = test_kpp(tfm, desc->alg, desc->suite.kpp.vecs,
3845 desc->suite.kpp.count);
3846
3847 crypto_free_kpp(tfm);
3848 return err;
3849}
3850
3851static u8 *test_pack_u32(u8 *dst, u32 val)
3852{
3853 memcpy(dst, &val, sizeof(val));
3854 return dst + sizeof(val);
3855}
3856
3857static int test_akcipher_one(struct crypto_akcipher *tfm,
3858 const struct akcipher_testvec *vecs)
3859{
3860 char *xbuf[XBUFSIZE];
3861 struct akcipher_request *req;
3862 void *outbuf_enc = NULL;
3863 void *outbuf_dec = NULL;
3864 struct crypto_wait wait;
3865 unsigned int out_len_max, out_len = 0;
3866 int err = -ENOMEM;
3867 struct scatterlist src, dst, src_tab[2];
3868 const char *c;
3869 unsigned int c_size;
3870
3871 if (testmgr_alloc_buf(xbuf))
3872 return err;
3873
3874 req = akcipher_request_alloc(tfm, GFP_KERNEL);
3875 if (!req)
3876 goto free_xbuf;
3877
3878 crypto_init_wait(&wait);
3879
3880 if (vecs->public_key_vec)
3881 err = crypto_akcipher_set_pub_key(tfm, vecs->key,
3882 vecs->key_len);
3883 else
3884 err = crypto_akcipher_set_priv_key(tfm, vecs->key,
3885 vecs->key_len);
3886 if (err)
3887 goto free_req;
3888
3889 /* First run encrypt test which does not require a private key */
3890 err = -ENOMEM;
3891 out_len_max = crypto_akcipher_maxsize(tfm);
3892 outbuf_enc = kzalloc(out_len_max, GFP_KERNEL);
3893 if (!outbuf_enc)
3894 goto free_req;
3895
3896 c = vecs->c;
3897 c_size = vecs->c_size;
3898
3899 err = -E2BIG;
3900 if (WARN_ON(vecs->m_size > PAGE_SIZE))
3901 goto free_all;
3902 memcpy(xbuf[0], vecs->m, vecs->m_size);
3903
3904 sg_init_table(src_tab, 2);
3905 sg_set_buf(&src_tab[0], xbuf[0], 8);
3906 sg_set_buf(&src_tab[1], xbuf[0] + 8, vecs->m_size - 8);
3907 sg_init_one(&dst, outbuf_enc, out_len_max);
3908 akcipher_request_set_crypt(req, src_tab, &dst, vecs->m_size,
3909 out_len_max);
3910 akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3911 crypto_req_done, &wait);
3912
3913 err = crypto_wait_req(crypto_akcipher_encrypt(req), &wait);
3914 if (err) {
3915 pr_err("alg: akcipher: encrypt test failed. err %d\n", err);
3916 goto free_all;
3917 }
3918 if (c) {
3919 if (req->dst_len != c_size) {
3920 pr_err("alg: akcipher: encrypt test failed. Invalid output len\n");
3921 err = -EINVAL;
3922 goto free_all;
3923 }
3924 /* verify that encrypted message is equal to expected */
3925 if (memcmp(c, outbuf_enc, c_size) != 0) {
3926 pr_err("alg: akcipher: encrypt test failed. Invalid output\n");
3927 hexdump(outbuf_enc, c_size);
3928 err = -EINVAL;
3929 goto free_all;
3930 }
3931 }
3932
3933 /*
3934 * Don't invoke decrypt test which requires a private key
3935 * for vectors with only a public key.
3936 */
3937 if (vecs->public_key_vec) {
3938 err = 0;
3939 goto free_all;
3940 }
3941 outbuf_dec = kzalloc(out_len_max, GFP_KERNEL);
3942 if (!outbuf_dec) {
3943 err = -ENOMEM;
3944 goto free_all;
3945 }
3946
3947 if (!c) {
3948 c = outbuf_enc;
3949 c_size = req->dst_len;
3950 }
3951
3952 err = -E2BIG;
3953 if (WARN_ON(c_size > PAGE_SIZE))
3954 goto free_all;
3955 memcpy(xbuf[0], c, c_size);
3956
3957 sg_init_one(&src, xbuf[0], c_size);
3958 sg_init_one(&dst, outbuf_dec, out_len_max);
3959 crypto_init_wait(&wait);
3960 akcipher_request_set_crypt(req, &src, &dst, c_size, out_len_max);
3961
3962 err = crypto_wait_req(crypto_akcipher_decrypt(req), &wait);
3963 if (err) {
3964 pr_err("alg: akcipher: decrypt test failed. err %d\n", err);
3965 goto free_all;
3966 }
3967 out_len = req->dst_len;
3968 if (out_len < vecs->m_size) {
3969 pr_err("alg: akcipher: decrypt test failed. Invalid output len %u\n",
3970 out_len);
3971 err = -EINVAL;
3972 goto free_all;
3973 }
3974 /* verify that decrypted message is equal to the original msg */
3975 if (memchr_inv(outbuf_dec, 0, out_len - vecs->m_size) ||
3976 memcmp(vecs->m, outbuf_dec + out_len - vecs->m_size,
3977 vecs->m_size)) {
3978 pr_err("alg: akcipher: decrypt test failed. Invalid output\n");
3979 hexdump(outbuf_dec, out_len);
3980 err = -EINVAL;
3981 }
3982free_all:
3983 kfree(outbuf_dec);
3984 kfree(outbuf_enc);
3985free_req:
3986 akcipher_request_free(req);
3987free_xbuf:
3988 testmgr_free_buf(xbuf);
3989 return err;
3990}
3991
3992static int test_akcipher(struct crypto_akcipher *tfm, const char *alg,
3993 const struct akcipher_testvec *vecs,
3994 unsigned int tcount)
3995{
3996 const char *algo =
3997 crypto_tfm_alg_driver_name(crypto_akcipher_tfm(tfm));
3998 int ret, i;
3999
4000 for (i = 0; i < tcount; i++) {
4001 ret = test_akcipher_one(tfm, vecs++);
4002 if (!ret)
4003 continue;
4004
4005 pr_err("alg: akcipher: test %d failed for %s, err=%d\n",
4006 i + 1, algo, ret);
4007 return ret;
4008 }
4009 return 0;
4010}
4011
4012static int alg_test_akcipher(const struct alg_test_desc *desc,
4013 const char *driver, u32 type, u32 mask)
4014{
4015 struct crypto_akcipher *tfm;
4016 int err = 0;
4017
4018 tfm = crypto_alloc_akcipher(driver, type, mask);
4019 if (IS_ERR(tfm)) {
4020 if (PTR_ERR(tfm) == -ENOENT)
4021 return 0;
4022 pr_err("alg: akcipher: Failed to load tfm for %s: %ld\n",
4023 driver, PTR_ERR(tfm));
4024 return PTR_ERR(tfm);
4025 }
4026 if (desc->suite.akcipher.vecs)
4027 err = test_akcipher(tfm, desc->alg, desc->suite.akcipher.vecs,
4028 desc->suite.akcipher.count);
4029
4030 crypto_free_akcipher(tfm);
4031 return err;
4032}
4033
4034static int test_sig_one(struct crypto_sig *tfm, const struct sig_testvec *vecs)
4035{
4036 u8 *ptr, *key __free(kfree);
4037 int err, sig_size;
4038
4039 key = kmalloc(vecs->key_len + 2 * sizeof(u32) + vecs->param_len,
4040 GFP_KERNEL);
4041 if (!key)
4042 return -ENOMEM;
4043
4044 /* ecrdsa expects additional parameters appended to the key */
4045 memcpy(key, vecs->key, vecs->key_len);
4046 ptr = key + vecs->key_len;
4047 ptr = test_pack_u32(ptr, vecs->algo);
4048 ptr = test_pack_u32(ptr, vecs->param_len);
4049 memcpy(ptr, vecs->params, vecs->param_len);
4050
4051 if (vecs->public_key_vec)
4052 err = crypto_sig_set_pubkey(tfm, key, vecs->key_len);
4053 else
4054 err = crypto_sig_set_privkey(tfm, key, vecs->key_len);
4055 if (err)
4056 return err;
4057
4058 /*
4059 * Run asymmetric signature verification first
4060 * (which does not require a private key)
4061 */
4062 err = crypto_sig_verify(tfm, vecs->c, vecs->c_size,
4063 vecs->m, vecs->m_size);
4064 if (err) {
4065 pr_err("alg: sig: verify test failed: err %d\n", err);
4066 return err;
4067 }
4068
4069 /*
4070 * Don't invoke sign test (which requires a private key)
4071 * for vectors with only a public key.
4072 */
4073 if (vecs->public_key_vec)
4074 return 0;
4075
4076 sig_size = crypto_sig_maxsize(tfm);
4077 if (sig_size < vecs->c_size) {
4078 pr_err("alg: sig: invalid maxsize %u\n", sig_size);
4079 return -EINVAL;
4080 }
4081
4082 u8 *sig __free(kfree) = kzalloc(sig_size, GFP_KERNEL);
4083 if (!sig)
4084 return -ENOMEM;
4085
4086 /* Run asymmetric signature generation */
4087 err = crypto_sig_sign(tfm, vecs->m, vecs->m_size, sig, sig_size);
4088 if (err < 0) {
4089 pr_err("alg: sig: sign test failed: err %d\n", err);
4090 return err;
4091 }
4092
4093 /* Verify that generated signature equals cooked signature */
4094 if (err != vecs->c_size ||
4095 memcmp(sig, vecs->c, vecs->c_size) ||
4096 memchr_inv(sig + vecs->c_size, 0, sig_size - vecs->c_size)) {
4097 pr_err("alg: sig: sign test failed: invalid output\n");
4098 hexdump(sig, sig_size);
4099 return -EINVAL;
4100 }
4101
4102 return 0;
4103}
4104
4105static int test_sig(struct crypto_sig *tfm, const char *alg,
4106 const struct sig_testvec *vecs, unsigned int tcount)
4107{
4108 const char *algo = crypto_tfm_alg_driver_name(crypto_sig_tfm(tfm));
4109 int ret, i;
4110
4111 for (i = 0; i < tcount; i++) {
4112 ret = test_sig_one(tfm, vecs++);
4113 if (ret) {
4114 pr_err("alg: sig: test %d failed for %s: err %d\n",
4115 i + 1, algo, ret);
4116 return ret;
4117 }
4118 }
4119 return 0;
4120}
4121
4122static int alg_test_sig(const struct alg_test_desc *desc, const char *driver,
4123 u32 type, u32 mask)
4124{
4125 struct crypto_sig *tfm;
4126 int err = 0;
4127
4128 tfm = crypto_alloc_sig(driver, type, mask);
4129 if (IS_ERR(tfm)) {
4130 pr_err("alg: sig: Failed to load tfm for %s: %ld\n",
4131 driver, PTR_ERR(tfm));
4132 return PTR_ERR(tfm);
4133 }
4134 if (desc->suite.sig.vecs)
4135 err = test_sig(tfm, desc->alg, desc->suite.sig.vecs,
4136 desc->suite.sig.count);
4137
4138 crypto_free_sig(tfm);
4139 return err;
4140}
4141
4142static int alg_test_null(const struct alg_test_desc *desc,
4143 const char *driver, u32 type, u32 mask)
4144{
4145 return 0;
4146}
4147
4148#define ____VECS(tv) .vecs = tv, .count = ARRAY_SIZE(tv)
4149#define __VECS(tv) { ____VECS(tv) }
4150
4151/* Please keep this list sorted by algorithm name. */
4152static const struct alg_test_desc alg_test_descs[] = {
4153 {
4154 .alg = "adiantum(xchacha12,aes)",
4155 .generic_driver = "adiantum(xchacha12-lib,aes-generic,nhpoly1305-generic)",
4156 .test = alg_test_skcipher,
4157 .suite = {
4158 .cipher = __VECS(adiantum_xchacha12_aes_tv_template)
4159 },
4160 }, {
4161 .alg = "adiantum(xchacha20,aes)",
4162 .generic_driver = "adiantum(xchacha20-lib,aes-generic,nhpoly1305-generic)",
4163 .test = alg_test_skcipher,
4164 .suite = {
4165 .cipher = __VECS(adiantum_xchacha20_aes_tv_template)
4166 },
4167 }, {
4168 .alg = "aegis128",
4169 .test = alg_test_aead,
4170 .suite = {
4171 .aead = __VECS(aegis128_tv_template)
4172 }
4173 }, {
4174 .alg = "ansi_cprng",
4175 .test = alg_test_cprng,
4176 .suite = {
4177 .cprng = __VECS(ansi_cprng_aes_tv_template)
4178 }
4179 }, {
4180 .alg = "authenc(hmac(md5),ecb(cipher_null))",
4181 .generic_driver = "authenc(hmac-md5-lib,ecb-cipher_null)",
4182 .test = alg_test_aead,
4183 .suite = {
4184 .aead = __VECS(hmac_md5_ecb_cipher_null_tv_template)
4185 }
4186 }, {
4187 .alg = "authenc(hmac(sha1),cbc(aes))",
4188 .generic_driver = "authenc(hmac-sha1-lib,cbc(aes-generic))",
4189 .test = alg_test_aead,
4190 .fips_allowed = 1,
4191 .suite = {
4192 .aead = __VECS(hmac_sha1_aes_cbc_tv_temp)
4193 }
4194 }, {
4195 .alg = "authenc(hmac(sha1),cbc(des))",
4196 .generic_driver = "authenc(hmac-sha1-lib,cbc(des-generic))",
4197 .test = alg_test_aead,
4198 .suite = {
4199 .aead = __VECS(hmac_sha1_des_cbc_tv_temp)
4200 }
4201 }, {
4202 .alg = "authenc(hmac(sha1),cbc(des3_ede))",
4203 .generic_driver = "authenc(hmac-sha1-lib,cbc(des3_ede-generic))",
4204 .test = alg_test_aead,
4205 .suite = {
4206 .aead = __VECS(hmac_sha1_des3_ede_cbc_tv_temp)
4207 }
4208 }, {
4209 .alg = "authenc(hmac(sha1),ctr(aes))",
4210 .test = alg_test_null,
4211 .fips_allowed = 1,
4212 }, {
4213 .alg = "authenc(hmac(sha1),ecb(cipher_null))",
4214 .generic_driver = "authenc(hmac-sha1-lib,ecb-cipher_null)",
4215 .test = alg_test_aead,
4216 .suite = {
4217 .aead = __VECS(hmac_sha1_ecb_cipher_null_tv_temp)
4218 }
4219 }, {
4220 .alg = "authenc(hmac(sha1),rfc3686(ctr(aes)))",
4221 .test = alg_test_null,
4222 .fips_allowed = 1,
4223 }, {
4224 .alg = "authenc(hmac(sha224),cbc(des))",
4225 .generic_driver = "authenc(hmac-sha224-lib,cbc(des-generic))",
4226 .test = alg_test_aead,
4227 .suite = {
4228 .aead = __VECS(hmac_sha224_des_cbc_tv_temp)
4229 }
4230 }, {
4231 .alg = "authenc(hmac(sha224),cbc(des3_ede))",
4232 .generic_driver = "authenc(hmac-sha224-lib,cbc(des3_ede-generic))",
4233 .test = alg_test_aead,
4234 .suite = {
4235 .aead = __VECS(hmac_sha224_des3_ede_cbc_tv_temp)
4236 }
4237 }, {
4238 .alg = "authenc(hmac(sha256),cbc(aes))",
4239 .generic_driver = "authenc(hmac-sha256-lib,cbc(aes-generic))",
4240 .test = alg_test_aead,
4241 .fips_allowed = 1,
4242 .suite = {
4243 .aead = __VECS(hmac_sha256_aes_cbc_tv_temp)
4244 }
4245 }, {
4246 .alg = "authenc(hmac(sha256),cbc(des))",
4247 .generic_driver = "authenc(hmac-sha256-lib,cbc(des-generic))",
4248 .test = alg_test_aead,
4249 .suite = {
4250 .aead = __VECS(hmac_sha256_des_cbc_tv_temp)
4251 }
4252 }, {
4253 .alg = "authenc(hmac(sha256),cbc(des3_ede))",
4254 .generic_driver = "authenc(hmac-sha256-lib,cbc(des3_ede-generic))",
4255 .test = alg_test_aead,
4256 .suite = {
4257 .aead = __VECS(hmac_sha256_des3_ede_cbc_tv_temp)
4258 }
4259 }, {
4260 .alg = "authenc(hmac(sha256),ctr(aes))",
4261 .test = alg_test_null,
4262 .fips_allowed = 1,
4263 }, {
4264 .alg = "authenc(hmac(sha256),cts(cbc(aes)))",
4265 .generic_driver = "authenc(hmac-sha256-lib,cts(cbc(aes-generic)))",
4266 .test = alg_test_aead,
4267 .suite = {
4268 .aead = __VECS(krb5_test_aes128_cts_hmac_sha256_128)
4269 }
4270 }, {
4271 .alg = "authenc(hmac(sha256),rfc3686(ctr(aes)))",
4272 .test = alg_test_null,
4273 .fips_allowed = 1,
4274 }, {
4275 .alg = "authenc(hmac(sha384),cbc(des))",
4276 .generic_driver = "authenc(hmac-sha384-lib,cbc(des-generic))",
4277 .test = alg_test_aead,
4278 .suite = {
4279 .aead = __VECS(hmac_sha384_des_cbc_tv_temp)
4280 }
4281 }, {
4282 .alg = "authenc(hmac(sha384),cbc(des3_ede))",
4283 .generic_driver = "authenc(hmac-sha384-lib,cbc(des3_ede-generic))",
4284 .test = alg_test_aead,
4285 .suite = {
4286 .aead = __VECS(hmac_sha384_des3_ede_cbc_tv_temp)
4287 }
4288 }, {
4289 .alg = "authenc(hmac(sha384),ctr(aes))",
4290 .test = alg_test_null,
4291 .fips_allowed = 1,
4292 }, {
4293 .alg = "authenc(hmac(sha384),cts(cbc(aes)))",
4294 .generic_driver = "authenc(hmac-sha384-lib,cts(cbc(aes-generic)))",
4295 .test = alg_test_aead,
4296 .suite = {
4297 .aead = __VECS(krb5_test_aes256_cts_hmac_sha384_192)
4298 }
4299 }, {
4300 .alg = "authenc(hmac(sha384),rfc3686(ctr(aes)))",
4301 .test = alg_test_null,
4302 .fips_allowed = 1,
4303 }, {
4304 .alg = "authenc(hmac(sha512),cbc(aes))",
4305 .generic_driver = "authenc(hmac-sha512-lib,cbc(aes-generic))",
4306 .fips_allowed = 1,
4307 .test = alg_test_aead,
4308 .suite = {
4309 .aead = __VECS(hmac_sha512_aes_cbc_tv_temp)
4310 }
4311 }, {
4312 .alg = "authenc(hmac(sha512),cbc(des))",
4313 .generic_driver = "authenc(hmac-sha512-lib,cbc(des-generic))",
4314 .test = alg_test_aead,
4315 .suite = {
4316 .aead = __VECS(hmac_sha512_des_cbc_tv_temp)
4317 }
4318 }, {
4319 .alg = "authenc(hmac(sha512),cbc(des3_ede))",
4320 .generic_driver = "authenc(hmac-sha512-lib,cbc(des3_ede-generic))",
4321 .test = alg_test_aead,
4322 .suite = {
4323 .aead = __VECS(hmac_sha512_des3_ede_cbc_tv_temp)
4324 }
4325 }, {
4326 .alg = "authenc(hmac(sha512),ctr(aes))",
4327 .test = alg_test_null,
4328 .fips_allowed = 1,
4329 }, {
4330 .alg = "authenc(hmac(sha512),rfc3686(ctr(aes)))",
4331 .test = alg_test_null,
4332 .fips_allowed = 1,
4333 }, {
4334 .alg = "blake2b-160",
4335 .test = alg_test_hash,
4336 .fips_allowed = 0,
4337 .suite = {
4338 .hash = __VECS(blake2b_160_tv_template)
4339 }
4340 }, {
4341 .alg = "blake2b-256",
4342 .test = alg_test_hash,
4343 .fips_allowed = 0,
4344 .suite = {
4345 .hash = __VECS(blake2b_256_tv_template)
4346 }
4347 }, {
4348 .alg = "blake2b-384",
4349 .test = alg_test_hash,
4350 .fips_allowed = 0,
4351 .suite = {
4352 .hash = __VECS(blake2b_384_tv_template)
4353 }
4354 }, {
4355 .alg = "blake2b-512",
4356 .test = alg_test_hash,
4357 .fips_allowed = 0,
4358 .suite = {
4359 .hash = __VECS(blake2b_512_tv_template)
4360 }
4361 }, {
4362 .alg = "cbc(aes)",
4363 .test = alg_test_skcipher,
4364 .fips_allowed = 1,
4365 .suite = {
4366 .cipher = __VECS(aes_cbc_tv_template)
4367 },
4368 }, {
4369 .alg = "cbc(anubis)",
4370 .test = alg_test_skcipher,
4371 .suite = {
4372 .cipher = __VECS(anubis_cbc_tv_template)
4373 },
4374 }, {
4375 .alg = "cbc(aria)",
4376 .test = alg_test_skcipher,
4377 .suite = {
4378 .cipher = __VECS(aria_cbc_tv_template)
4379 },
4380 }, {
4381 .alg = "cbc(blowfish)",
4382 .test = alg_test_skcipher,
4383 .suite = {
4384 .cipher = __VECS(bf_cbc_tv_template)
4385 },
4386 }, {
4387 .alg = "cbc(camellia)",
4388 .test = alg_test_skcipher,
4389 .suite = {
4390 .cipher = __VECS(camellia_cbc_tv_template)
4391 },
4392 }, {
4393 .alg = "cbc(cast5)",
4394 .test = alg_test_skcipher,
4395 .suite = {
4396 .cipher = __VECS(cast5_cbc_tv_template)
4397 },
4398 }, {
4399 .alg = "cbc(cast6)",
4400 .test = alg_test_skcipher,
4401 .suite = {
4402 .cipher = __VECS(cast6_cbc_tv_template)
4403 },
4404 }, {
4405 .alg = "cbc(des)",
4406 .test = alg_test_skcipher,
4407 .suite = {
4408 .cipher = __VECS(des_cbc_tv_template)
4409 },
4410 }, {
4411 .alg = "cbc(des3_ede)",
4412 .test = alg_test_skcipher,
4413 .suite = {
4414 .cipher = __VECS(des3_ede_cbc_tv_template)
4415 },
4416 }, {
4417 /* Same as cbc(aes) except the key is stored in
4418 * hardware secure memory which we reference by index
4419 */
4420 .alg = "cbc(paes)",
4421 .test = alg_test_null,
4422 .fips_allowed = 1,
4423 }, {
4424 /* Same as cbc(sm4) except the key is stored in
4425 * hardware secure memory which we reference by index
4426 */
4427 .alg = "cbc(psm4)",
4428 .test = alg_test_null,
4429 }, {
4430 .alg = "cbc(serpent)",
4431 .test = alg_test_skcipher,
4432 .suite = {
4433 .cipher = __VECS(serpent_cbc_tv_template)
4434 },
4435 }, {
4436 .alg = "cbc(sm4)",
4437 .test = alg_test_skcipher,
4438 .suite = {
4439 .cipher = __VECS(sm4_cbc_tv_template)
4440 }
4441 }, {
4442 .alg = "cbc(twofish)",
4443 .test = alg_test_skcipher,
4444 .suite = {
4445 .cipher = __VECS(tf_cbc_tv_template)
4446 },
4447 }, {
4448#if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
4449 .alg = "cbc-paes-s390",
4450 .fips_allowed = 1,
4451 .test = alg_test_skcipher,
4452 .suite = {
4453 .cipher = __VECS(aes_cbc_tv_template)
4454 }
4455 }, {
4456#endif
4457 .alg = "cbcmac(aes)",
4458 .test = alg_test_hash,
4459 .suite = {
4460 .hash = __VECS(aes_cbcmac_tv_template)
4461 }
4462 }, {
4463 .alg = "cbcmac(sm4)",
4464 .test = alg_test_hash,
4465 .suite = {
4466 .hash = __VECS(sm4_cbcmac_tv_template)
4467 }
4468 }, {
4469 .alg = "ccm(aes)",
4470 .generic_driver = "ccm_base(ctr(aes-generic),cbcmac(aes-generic))",
4471 .test = alg_test_aead,
4472 .fips_allowed = 1,
4473 .suite = {
4474 .aead = {
4475 ____VECS(aes_ccm_tv_template),
4476 .einval_allowed = 1,
4477 }
4478 }
4479 }, {
4480 .alg = "ccm(sm4)",
4481 .generic_driver = "ccm_base(ctr(sm4-generic),cbcmac(sm4-generic))",
4482 .test = alg_test_aead,
4483 .suite = {
4484 .aead = {
4485 ____VECS(sm4_ccm_tv_template),
4486 .einval_allowed = 1,
4487 }
4488 }
4489 }, {
4490 .alg = "chacha20",
4491 .generic_driver = "chacha20-lib",
4492 .test = alg_test_skcipher,
4493 .suite = {
4494 .cipher = __VECS(chacha20_tv_template)
4495 },
4496 }, {
4497 .alg = "cmac(aes)",
4498 .fips_allowed = 1,
4499 .test = alg_test_hash,
4500 .suite = {
4501 .hash = __VECS(aes_cmac128_tv_template)
4502 }
4503 }, {
4504 .alg = "cmac(camellia)",
4505 .test = alg_test_hash,
4506 .suite = {
4507 .hash = __VECS(camellia_cmac128_tv_template)
4508 }
4509 }, {
4510 .alg = "cmac(des3_ede)",
4511 .test = alg_test_hash,
4512 .suite = {
4513 .hash = __VECS(des3_ede_cmac64_tv_template)
4514 }
4515 }, {
4516 .alg = "cmac(sm4)",
4517 .test = alg_test_hash,
4518 .suite = {
4519 .hash = __VECS(sm4_cmac128_tv_template)
4520 }
4521 }, {
4522 .alg = "crc32",
4523 .generic_driver = "crc32-lib",
4524 .test = alg_test_hash,
4525 .fips_allowed = 1,
4526 .suite = {
4527 .hash = __VECS(crc32_tv_template)
4528 }
4529 }, {
4530 .alg = "crc32c",
4531 .generic_driver = "crc32c-lib",
4532 .test = alg_test_hash,
4533 .fips_allowed = 1,
4534 .suite = {
4535 .hash = __VECS(crc32c_tv_template)
4536 }
4537 }, {
4538 .alg = "ctr(aes)",
4539 .test = alg_test_skcipher,
4540 .fips_allowed = 1,
4541 .suite = {
4542 .cipher = __VECS(aes_ctr_tv_template)
4543 }
4544 }, {
4545 .alg = "ctr(aria)",
4546 .test = alg_test_skcipher,
4547 .suite = {
4548 .cipher = __VECS(aria_ctr_tv_template)
4549 }
4550 }, {
4551 .alg = "ctr(blowfish)",
4552 .test = alg_test_skcipher,
4553 .suite = {
4554 .cipher = __VECS(bf_ctr_tv_template)
4555 }
4556 }, {
4557 .alg = "ctr(camellia)",
4558 .test = alg_test_skcipher,
4559 .suite = {
4560 .cipher = __VECS(camellia_ctr_tv_template)
4561 }
4562 }, {
4563 .alg = "ctr(cast5)",
4564 .test = alg_test_skcipher,
4565 .suite = {
4566 .cipher = __VECS(cast5_ctr_tv_template)
4567 }
4568 }, {
4569 .alg = "ctr(cast6)",
4570 .test = alg_test_skcipher,
4571 .suite = {
4572 .cipher = __VECS(cast6_ctr_tv_template)
4573 }
4574 }, {
4575 .alg = "ctr(des)",
4576 .test = alg_test_skcipher,
4577 .suite = {
4578 .cipher = __VECS(des_ctr_tv_template)
4579 }
4580 }, {
4581 .alg = "ctr(des3_ede)",
4582 .test = alg_test_skcipher,
4583 .suite = {
4584 .cipher = __VECS(des3_ede_ctr_tv_template)
4585 }
4586 }, {
4587 /* Same as ctr(aes) except the key is stored in
4588 * hardware secure memory which we reference by index
4589 */
4590 .alg = "ctr(paes)",
4591 .test = alg_test_null,
4592 .fips_allowed = 1,
4593 }, {
4594
4595 /* Same as ctr(sm4) except the key is stored in
4596 * hardware secure memory which we reference by index
4597 */
4598 .alg = "ctr(psm4)",
4599 .test = alg_test_null,
4600 }, {
4601 .alg = "ctr(serpent)",
4602 .test = alg_test_skcipher,
4603 .suite = {
4604 .cipher = __VECS(serpent_ctr_tv_template)
4605 }
4606 }, {
4607 .alg = "ctr(sm4)",
4608 .test = alg_test_skcipher,
4609 .suite = {
4610 .cipher = __VECS(sm4_ctr_tv_template)
4611 }
4612 }, {
4613 .alg = "ctr(twofish)",
4614 .test = alg_test_skcipher,
4615 .suite = {
4616 .cipher = __VECS(tf_ctr_tv_template)
4617 }
4618 }, {
4619#if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
4620 .alg = "ctr-paes-s390",
4621 .fips_allowed = 1,
4622 .test = alg_test_skcipher,
4623 .suite = {
4624 .cipher = __VECS(aes_ctr_tv_template)
4625 }
4626 }, {
4627#endif
4628 .alg = "cts(cbc(aes))",
4629 .test = alg_test_skcipher,
4630 .fips_allowed = 1,
4631 .suite = {
4632 .cipher = __VECS(cts_mode_tv_template)
4633 }
4634 }, {
4635 /* Same as cts(cbc((aes)) except the key is stored in
4636 * hardware secure memory which we reference by index
4637 */
4638 .alg = "cts(cbc(paes))",
4639 .test = alg_test_null,
4640 .fips_allowed = 1,
4641 }, {
4642 .alg = "cts(cbc(sm4))",
4643 .test = alg_test_skcipher,
4644 .suite = {
4645 .cipher = __VECS(sm4_cts_tv_template)
4646 }
4647 }, {
4648 .alg = "deflate",
4649 .test = alg_test_comp,
4650 .fips_allowed = 1,
4651 .suite = {
4652 .comp = {
4653 .comp = __VECS(deflate_comp_tv_template),
4654 .decomp = __VECS(deflate_decomp_tv_template)
4655 }
4656 }
4657 }, {
4658 .alg = "deflate-iaa",
4659 .test = alg_test_comp,
4660 .fips_allowed = 1,
4661 .suite = {
4662 .comp = {
4663 .comp = __VECS(deflate_comp_tv_template),
4664 .decomp = __VECS(deflate_decomp_tv_template)
4665 }
4666 }
4667 }, {
4668 .alg = "dh",
4669 .test = alg_test_kpp,
4670 .suite = {
4671 .kpp = __VECS(dh_tv_template)
4672 }
4673 }, {
4674 .alg = "digest_null",
4675 .test = alg_test_null,
4676 }, {
4677 .alg = "drbg_nopr_ctr_aes128",
4678 .test = alg_test_drbg,
4679 .fips_allowed = 1,
4680 .suite = {
4681 .drbg = __VECS(drbg_nopr_ctr_aes128_tv_template)
4682 }
4683 }, {
4684 .alg = "drbg_nopr_ctr_aes192",
4685 .test = alg_test_drbg,
4686 .fips_allowed = 1,
4687 .suite = {
4688 .drbg = __VECS(drbg_nopr_ctr_aes192_tv_template)
4689 }
4690 }, {
4691 .alg = "drbg_nopr_ctr_aes256",
4692 .test = alg_test_drbg,
4693 .fips_allowed = 1,
4694 .suite = {
4695 .drbg = __VECS(drbg_nopr_ctr_aes256_tv_template)
4696 }
4697 }, {
4698 .alg = "drbg_nopr_hmac_sha256",
4699 .test = alg_test_drbg,
4700 .fips_allowed = 1,
4701 .suite = {
4702 .drbg = __VECS(drbg_nopr_hmac_sha256_tv_template)
4703 }
4704 }, {
4705 /*
4706 * There is no need to specifically test the DRBG with every
4707 * backend cipher -- covered by drbg_nopr_hmac_sha512 test
4708 */
4709 .alg = "drbg_nopr_hmac_sha384",
4710 .test = alg_test_null,
4711 .fips_allowed = 1
4712 }, {
4713 .alg = "drbg_nopr_hmac_sha512",
4714 .test = alg_test_drbg,
4715 .fips_allowed = 1,
4716 .suite = {
4717 .drbg = __VECS(drbg_nopr_hmac_sha512_tv_template)
4718 }
4719 }, {
4720 .alg = "drbg_nopr_sha256",
4721 .test = alg_test_drbg,
4722 .fips_allowed = 1,
4723 .suite = {
4724 .drbg = __VECS(drbg_nopr_sha256_tv_template)
4725 }
4726 }, {
4727 /* covered by drbg_nopr_sha256 test */
4728 .alg = "drbg_nopr_sha384",
4729 .test = alg_test_null,
4730 .fips_allowed = 1
4731 }, {
4732 .alg = "drbg_nopr_sha512",
4733 .fips_allowed = 1,
4734 .test = alg_test_null,
4735 }, {
4736 .alg = "drbg_pr_ctr_aes128",
4737 .test = alg_test_drbg,
4738 .fips_allowed = 1,
4739 .suite = {
4740 .drbg = __VECS(drbg_pr_ctr_aes128_tv_template)
4741 }
4742 }, {
4743 /* covered by drbg_pr_ctr_aes128 test */
4744 .alg = "drbg_pr_ctr_aes192",
4745 .fips_allowed = 1,
4746 .test = alg_test_null,
4747 }, {
4748 .alg = "drbg_pr_ctr_aes256",
4749 .fips_allowed = 1,
4750 .test = alg_test_null,
4751 }, {
4752 .alg = "drbg_pr_hmac_sha256",
4753 .test = alg_test_drbg,
4754 .fips_allowed = 1,
4755 .suite = {
4756 .drbg = __VECS(drbg_pr_hmac_sha256_tv_template)
4757 }
4758 }, {
4759 /* covered by drbg_pr_hmac_sha256 test */
4760 .alg = "drbg_pr_hmac_sha384",
4761 .test = alg_test_null,
4762 .fips_allowed = 1
4763 }, {
4764 .alg = "drbg_pr_hmac_sha512",
4765 .test = alg_test_null,
4766 .fips_allowed = 1,
4767 }, {
4768 .alg = "drbg_pr_sha256",
4769 .test = alg_test_drbg,
4770 .fips_allowed = 1,
4771 .suite = {
4772 .drbg = __VECS(drbg_pr_sha256_tv_template)
4773 }
4774 }, {
4775 /* covered by drbg_pr_sha256 test */
4776 .alg = "drbg_pr_sha384",
4777 .test = alg_test_null,
4778 .fips_allowed = 1
4779 }, {
4780 .alg = "drbg_pr_sha512",
4781 .fips_allowed = 1,
4782 .test = alg_test_null,
4783 }, {
4784 .alg = "ecb(aes)",
4785 .test = alg_test_skcipher,
4786 .fips_allowed = 1,
4787 .suite = {
4788 .cipher = __VECS(aes_tv_template)
4789 }
4790 }, {
4791 .alg = "ecb(anubis)",
4792 .test = alg_test_skcipher,
4793 .suite = {
4794 .cipher = __VECS(anubis_tv_template)
4795 }
4796 }, {
4797 .alg = "ecb(arc4)",
4798 .generic_driver = "arc4-generic",
4799 .test = alg_test_skcipher,
4800 .suite = {
4801 .cipher = __VECS(arc4_tv_template)
4802 }
4803 }, {
4804 .alg = "ecb(aria)",
4805 .test = alg_test_skcipher,
4806 .suite = {
4807 .cipher = __VECS(aria_tv_template)
4808 }
4809 }, {
4810 .alg = "ecb(blowfish)",
4811 .test = alg_test_skcipher,
4812 .suite = {
4813 .cipher = __VECS(bf_tv_template)
4814 }
4815 }, {
4816 .alg = "ecb(camellia)",
4817 .test = alg_test_skcipher,
4818 .suite = {
4819 .cipher = __VECS(camellia_tv_template)
4820 }
4821 }, {
4822 .alg = "ecb(cast5)",
4823 .test = alg_test_skcipher,
4824 .suite = {
4825 .cipher = __VECS(cast5_tv_template)
4826 }
4827 }, {
4828 .alg = "ecb(cast6)",
4829 .test = alg_test_skcipher,
4830 .suite = {
4831 .cipher = __VECS(cast6_tv_template)
4832 }
4833 }, {
4834 .alg = "ecb(cipher_null)",
4835 .test = alg_test_null,
4836 .fips_allowed = 1,
4837 }, {
4838 .alg = "ecb(des)",
4839 .test = alg_test_skcipher,
4840 .suite = {
4841 .cipher = __VECS(des_tv_template)
4842 }
4843 }, {
4844 .alg = "ecb(des3_ede)",
4845 .test = alg_test_skcipher,
4846 .suite = {
4847 .cipher = __VECS(des3_ede_tv_template)
4848 }
4849 }, {
4850 .alg = "ecb(fcrypt)",
4851 .test = alg_test_skcipher,
4852 .suite = {
4853 .cipher = {
4854 .vecs = fcrypt_pcbc_tv_template,
4855 .count = 1
4856 }
4857 }
4858 }, {
4859 .alg = "ecb(khazad)",
4860 .test = alg_test_skcipher,
4861 .suite = {
4862 .cipher = __VECS(khazad_tv_template)
4863 }
4864 }, {
4865 /* Same as ecb(aes) except the key is stored in
4866 * hardware secure memory which we reference by index
4867 */
4868 .alg = "ecb(paes)",
4869 .test = alg_test_null,
4870 .fips_allowed = 1,
4871 }, {
4872 .alg = "ecb(seed)",
4873 .test = alg_test_skcipher,
4874 .suite = {
4875 .cipher = __VECS(seed_tv_template)
4876 }
4877 }, {
4878 .alg = "ecb(serpent)",
4879 .test = alg_test_skcipher,
4880 .suite = {
4881 .cipher = __VECS(serpent_tv_template)
4882 }
4883 }, {
4884 .alg = "ecb(sm4)",
4885 .test = alg_test_skcipher,
4886 .suite = {
4887 .cipher = __VECS(sm4_tv_template)
4888 }
4889 }, {
4890 .alg = "ecb(tea)",
4891 .test = alg_test_skcipher,
4892 .suite = {
4893 .cipher = __VECS(tea_tv_template)
4894 }
4895 }, {
4896 .alg = "ecb(twofish)",
4897 .test = alg_test_skcipher,
4898 .suite = {
4899 .cipher = __VECS(tf_tv_template)
4900 }
4901 }, {
4902 .alg = "ecb(xeta)",
4903 .test = alg_test_skcipher,
4904 .suite = {
4905 .cipher = __VECS(xeta_tv_template)
4906 }
4907 }, {
4908 .alg = "ecb(xtea)",
4909 .test = alg_test_skcipher,
4910 .suite = {
4911 .cipher = __VECS(xtea_tv_template)
4912 }
4913 }, {
4914#if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
4915 .alg = "ecb-paes-s390",
4916 .fips_allowed = 1,
4917 .test = alg_test_skcipher,
4918 .suite = {
4919 .cipher = __VECS(aes_tv_template)
4920 }
4921 }, {
4922#endif
4923 .alg = "ecdh-nist-p192",
4924 .test = alg_test_kpp,
4925 .suite = {
4926 .kpp = __VECS(ecdh_p192_tv_template)
4927 }
4928 }, {
4929 .alg = "ecdh-nist-p256",
4930 .test = alg_test_kpp,
4931 .fips_allowed = 1,
4932 .suite = {
4933 .kpp = __VECS(ecdh_p256_tv_template)
4934 }
4935 }, {
4936 .alg = "ecdh-nist-p384",
4937 .test = alg_test_kpp,
4938 .fips_allowed = 1,
4939 .suite = {
4940 .kpp = __VECS(ecdh_p384_tv_template)
4941 }
4942 }, {
4943 .alg = "ecdsa-nist-p192",
4944 .test = alg_test_sig,
4945 .suite = {
4946 .sig = __VECS(ecdsa_nist_p192_tv_template)
4947 }
4948 }, {
4949 .alg = "ecdsa-nist-p256",
4950 .test = alg_test_sig,
4951 .fips_allowed = 1,
4952 .suite = {
4953 .sig = __VECS(ecdsa_nist_p256_tv_template)
4954 }
4955 }, {
4956 .alg = "ecdsa-nist-p384",
4957 .test = alg_test_sig,
4958 .fips_allowed = 1,
4959 .suite = {
4960 .sig = __VECS(ecdsa_nist_p384_tv_template)
4961 }
4962 }, {
4963 .alg = "ecdsa-nist-p521",
4964 .test = alg_test_sig,
4965 .fips_allowed = 1,
4966 .suite = {
4967 .sig = __VECS(ecdsa_nist_p521_tv_template)
4968 }
4969 }, {
4970 .alg = "ecrdsa",
4971 .test = alg_test_sig,
4972 .suite = {
4973 .sig = __VECS(ecrdsa_tv_template)
4974 }
4975 }, {
4976 .alg = "essiv(authenc(hmac(sha256),cbc(aes)),sha256)",
4977 .generic_driver = "essiv(authenc(hmac-sha256-lib,cbc(aes-generic)),sha256-lib)",
4978 .test = alg_test_aead,
4979 .fips_allowed = 1,
4980 .suite = {
4981 .aead = __VECS(essiv_hmac_sha256_aes_cbc_tv_temp)
4982 }
4983 }, {
4984 .alg = "essiv(cbc(aes),sha256)",
4985 .generic_driver = "essiv(cbc(aes-generic),sha256-lib)",
4986 .test = alg_test_skcipher,
4987 .fips_allowed = 1,
4988 .suite = {
4989 .cipher = __VECS(essiv_aes_cbc_tv_template)
4990 }
4991 }, {
4992#if IS_ENABLED(CONFIG_CRYPTO_DH_RFC7919_GROUPS)
4993 .alg = "ffdhe2048(dh)",
4994 .test = alg_test_kpp,
4995 .fips_allowed = 1,
4996 .suite = {
4997 .kpp = __VECS(ffdhe2048_dh_tv_template)
4998 }
4999 }, {
5000 .alg = "ffdhe3072(dh)",
5001 .test = alg_test_kpp,
5002 .fips_allowed = 1,
5003 .suite = {
5004 .kpp = __VECS(ffdhe3072_dh_tv_template)
5005 }
5006 }, {
5007 .alg = "ffdhe4096(dh)",
5008 .test = alg_test_kpp,
5009 .fips_allowed = 1,
5010 .suite = {
5011 .kpp = __VECS(ffdhe4096_dh_tv_template)
5012 }
5013 }, {
5014 .alg = "ffdhe6144(dh)",
5015 .test = alg_test_kpp,
5016 .fips_allowed = 1,
5017 .suite = {
5018 .kpp = __VECS(ffdhe6144_dh_tv_template)
5019 }
5020 }, {
5021 .alg = "ffdhe8192(dh)",
5022 .test = alg_test_kpp,
5023 .fips_allowed = 1,
5024 .suite = {
5025 .kpp = __VECS(ffdhe8192_dh_tv_template)
5026 }
5027 }, {
5028#endif /* CONFIG_CRYPTO_DH_RFC7919_GROUPS */
5029 .alg = "gcm(aes)",
5030 .generic_driver = "gcm_base(ctr(aes-generic),ghash-generic)",
5031 .test = alg_test_aead,
5032 .fips_allowed = 1,
5033 .suite = {
5034 .aead = __VECS(aes_gcm_tv_template)
5035 }
5036 }, {
5037 .alg = "gcm(aria)",
5038 .generic_driver = "gcm_base(ctr(aria-generic),ghash-generic)",
5039 .test = alg_test_aead,
5040 .suite = {
5041 .aead = __VECS(aria_gcm_tv_template)
5042 }
5043 }, {
5044 .alg = "gcm(sm4)",
5045 .generic_driver = "gcm_base(ctr(sm4-generic),ghash-generic)",
5046 .test = alg_test_aead,
5047 .suite = {
5048 .aead = __VECS(sm4_gcm_tv_template)
5049 }
5050 }, {
5051 .alg = "ghash",
5052 .test = alg_test_hash,
5053 .suite = {
5054 .hash = __VECS(ghash_tv_template)
5055 }
5056 }, {
5057 .alg = "hctr2(aes)",
5058 .generic_driver =
5059 "hctr2_base(xctr(aes-generic),polyval-generic)",
5060 .test = alg_test_skcipher,
5061 .suite = {
5062 .cipher = __VECS(aes_hctr2_tv_template)
5063 }
5064 }, {
5065 .alg = "hmac(md5)",
5066 .generic_driver = "hmac-md5-lib",
5067 .test = alg_test_hash,
5068 .suite = {
5069 .hash = __VECS(hmac_md5_tv_template)
5070 }
5071 }, {
5072 .alg = "hmac(rmd160)",
5073 .test = alg_test_hash,
5074 .suite = {
5075 .hash = __VECS(hmac_rmd160_tv_template)
5076 }
5077 }, {
5078 .alg = "hmac(sha1)",
5079 .generic_driver = "hmac-sha1-lib",
5080 .test = alg_test_hash,
5081 .fips_allowed = 1,
5082 .suite = {
5083 .hash = __VECS(hmac_sha1_tv_template)
5084 }
5085 }, {
5086 .alg = "hmac(sha224)",
5087 .generic_driver = "hmac-sha224-lib",
5088 .test = alg_test_hash,
5089 .fips_allowed = 1,
5090 .suite = {
5091 .hash = __VECS(hmac_sha224_tv_template)
5092 }
5093 }, {
5094 .alg = "hmac(sha256)",
5095 .generic_driver = "hmac-sha256-lib",
5096 .test = alg_test_hash,
5097 .fips_allowed = 1,
5098 .suite = {
5099 .hash = __VECS(hmac_sha256_tv_template)
5100 }
5101 }, {
5102 .alg = "hmac(sha3-224)",
5103 .test = alg_test_hash,
5104 .fips_allowed = 1,
5105 .suite = {
5106 .hash = __VECS(hmac_sha3_224_tv_template)
5107 }
5108 }, {
5109 .alg = "hmac(sha3-256)",
5110 .test = alg_test_hash,
5111 .fips_allowed = 1,
5112 .suite = {
5113 .hash = __VECS(hmac_sha3_256_tv_template)
5114 }
5115 }, {
5116 .alg = "hmac(sha3-384)",
5117 .test = alg_test_hash,
5118 .fips_allowed = 1,
5119 .suite = {
5120 .hash = __VECS(hmac_sha3_384_tv_template)
5121 }
5122 }, {
5123 .alg = "hmac(sha3-512)",
5124 .test = alg_test_hash,
5125 .fips_allowed = 1,
5126 .suite = {
5127 .hash = __VECS(hmac_sha3_512_tv_template)
5128 }
5129 }, {
5130 .alg = "hmac(sha384)",
5131 .generic_driver = "hmac-sha384-lib",
5132 .test = alg_test_hash,
5133 .fips_allowed = 1,
5134 .suite = {
5135 .hash = __VECS(hmac_sha384_tv_template)
5136 }
5137 }, {
5138 .alg = "hmac(sha512)",
5139 .generic_driver = "hmac-sha512-lib",
5140 .test = alg_test_hash,
5141 .fips_allowed = 1,
5142 .suite = {
5143 .hash = __VECS(hmac_sha512_tv_template)
5144 }
5145 }, {
5146 .alg = "hmac(sm3)",
5147 .test = alg_test_hash,
5148 .suite = {
5149 .hash = __VECS(hmac_sm3_tv_template)
5150 }
5151 }, {
5152 .alg = "hmac(streebog256)",
5153 .test = alg_test_hash,
5154 .suite = {
5155 .hash = __VECS(hmac_streebog256_tv_template)
5156 }
5157 }, {
5158 .alg = "hmac(streebog512)",
5159 .test = alg_test_hash,
5160 .suite = {
5161 .hash = __VECS(hmac_streebog512_tv_template)
5162 }
5163 }, {
5164 .alg = "jitterentropy_rng",
5165 .fips_allowed = 1,
5166 .test = alg_test_null,
5167 }, {
5168 .alg = "krb5enc(cmac(camellia),cts(cbc(camellia)))",
5169 .test = alg_test_aead,
5170 .suite.aead = __VECS(krb5_test_camellia_cts_cmac)
5171 }, {
5172 .alg = "lrw(aes)",
5173 .generic_driver = "lrw(ecb(aes-generic))",
5174 .test = alg_test_skcipher,
5175 .suite = {
5176 .cipher = __VECS(aes_lrw_tv_template)
5177 }
5178 }, {
5179 .alg = "lrw(camellia)",
5180 .generic_driver = "lrw(ecb(camellia-generic))",
5181 .test = alg_test_skcipher,
5182 .suite = {
5183 .cipher = __VECS(camellia_lrw_tv_template)
5184 }
5185 }, {
5186 .alg = "lrw(cast6)",
5187 .generic_driver = "lrw(ecb(cast6-generic))",
5188 .test = alg_test_skcipher,
5189 .suite = {
5190 .cipher = __VECS(cast6_lrw_tv_template)
5191 }
5192 }, {
5193 .alg = "lrw(serpent)",
5194 .generic_driver = "lrw(ecb(serpent-generic))",
5195 .test = alg_test_skcipher,
5196 .suite = {
5197 .cipher = __VECS(serpent_lrw_tv_template)
5198 }
5199 }, {
5200 .alg = "lrw(twofish)",
5201 .generic_driver = "lrw(ecb(twofish-generic))",
5202 .test = alg_test_skcipher,
5203 .suite = {
5204 .cipher = __VECS(tf_lrw_tv_template)
5205 }
5206 }, {
5207 .alg = "lz4",
5208 .test = alg_test_comp,
5209 .fips_allowed = 1,
5210 .suite = {
5211 .comp = {
5212 .comp = __VECS(lz4_comp_tv_template),
5213 .decomp = __VECS(lz4_decomp_tv_template)
5214 }
5215 }
5216 }, {
5217 .alg = "lz4hc",
5218 .test = alg_test_comp,
5219 .fips_allowed = 1,
5220 .suite = {
5221 .comp = {
5222 .comp = __VECS(lz4hc_comp_tv_template),
5223 .decomp = __VECS(lz4hc_decomp_tv_template)
5224 }
5225 }
5226 }, {
5227 .alg = "lzo",
5228 .test = alg_test_comp,
5229 .fips_allowed = 1,
5230 .suite = {
5231 .comp = {
5232 .comp = __VECS(lzo_comp_tv_template),
5233 .decomp = __VECS(lzo_decomp_tv_template)
5234 }
5235 }
5236 }, {
5237 .alg = "lzo-rle",
5238 .test = alg_test_comp,
5239 .fips_allowed = 1,
5240 .suite = {
5241 .comp = {
5242 .comp = __VECS(lzorle_comp_tv_template),
5243 .decomp = __VECS(lzorle_decomp_tv_template)
5244 }
5245 }
5246 }, {
5247 .alg = "md4",
5248 .test = alg_test_hash,
5249 .suite = {
5250 .hash = __VECS(md4_tv_template)
5251 }
5252 }, {
5253 .alg = "md5",
5254 .generic_driver = "md5-lib",
5255 .test = alg_test_hash,
5256 .suite = {
5257 .hash = __VECS(md5_tv_template)
5258 }
5259 }, {
5260 .alg = "michael_mic",
5261 .test = alg_test_hash,
5262 .suite = {
5263 .hash = __VECS(michael_mic_tv_template)
5264 }
5265 }, {
5266 .alg = "nhpoly1305",
5267 .test = alg_test_hash,
5268 .suite = {
5269 .hash = __VECS(nhpoly1305_tv_template)
5270 }
5271 }, {
5272 .alg = "p1363(ecdsa-nist-p192)",
5273 .test = alg_test_null,
5274 }, {
5275 .alg = "p1363(ecdsa-nist-p256)",
5276 .test = alg_test_sig,
5277 .fips_allowed = 1,
5278 .suite = {
5279 .sig = __VECS(p1363_ecdsa_nist_p256_tv_template)
5280 }
5281 }, {
5282 .alg = "p1363(ecdsa-nist-p384)",
5283 .test = alg_test_null,
5284 .fips_allowed = 1,
5285 }, {
5286 .alg = "p1363(ecdsa-nist-p521)",
5287 .test = alg_test_null,
5288 .fips_allowed = 1,
5289 }, {
5290 .alg = "pcbc(fcrypt)",
5291 .test = alg_test_skcipher,
5292 .suite = {
5293 .cipher = __VECS(fcrypt_pcbc_tv_template)
5294 }
5295 }, {
5296#if IS_ENABLED(CONFIG_CRYPTO_PHMAC_S390)
5297 .alg = "phmac(sha224)",
5298 .test = alg_test_hash,
5299 .fips_allowed = 1,
5300 .suite = {
5301 .hash = __VECS(hmac_sha224_tv_template)
5302 }
5303 }, {
5304 .alg = "phmac(sha256)",
5305 .test = alg_test_hash,
5306 .fips_allowed = 1,
5307 .suite = {
5308 .hash = __VECS(hmac_sha256_tv_template)
5309 }
5310 }, {
5311 .alg = "phmac(sha384)",
5312 .test = alg_test_hash,
5313 .fips_allowed = 1,
5314 .suite = {
5315 .hash = __VECS(hmac_sha384_tv_template)
5316 }
5317 }, {
5318 .alg = "phmac(sha512)",
5319 .test = alg_test_hash,
5320 .fips_allowed = 1,
5321 .suite = {
5322 .hash = __VECS(hmac_sha512_tv_template)
5323 }
5324 }, {
5325#endif
5326 .alg = "pkcs1(rsa,none)",
5327 .test = alg_test_sig,
5328 .suite = {
5329 .sig = __VECS(pkcs1_rsa_none_tv_template)
5330 }
5331 }, {
5332 .alg = "pkcs1(rsa,sha224)",
5333 .test = alg_test_null,
5334 .fips_allowed = 1,
5335 }, {
5336 .alg = "pkcs1(rsa,sha256)",
5337 .test = alg_test_sig,
5338 .fips_allowed = 1,
5339 .suite = {
5340 .sig = __VECS(pkcs1_rsa_tv_template)
5341 }
5342 }, {
5343 .alg = "pkcs1(rsa,sha3-256)",
5344 .test = alg_test_null,
5345 .fips_allowed = 1,
5346 }, {
5347 .alg = "pkcs1(rsa,sha3-384)",
5348 .test = alg_test_null,
5349 .fips_allowed = 1,
5350 }, {
5351 .alg = "pkcs1(rsa,sha3-512)",
5352 .test = alg_test_null,
5353 .fips_allowed = 1,
5354 }, {
5355 .alg = "pkcs1(rsa,sha384)",
5356 .test = alg_test_null,
5357 .fips_allowed = 1,
5358 }, {
5359 .alg = "pkcs1(rsa,sha512)",
5360 .test = alg_test_null,
5361 .fips_allowed = 1,
5362 }, {
5363 .alg = "pkcs1pad(rsa)",
5364 .test = alg_test_null,
5365 .fips_allowed = 1,
5366 }, {
5367 .alg = "polyval",
5368 .test = alg_test_hash,
5369 .suite = {
5370 .hash = __VECS(polyval_tv_template)
5371 }
5372 }, {
5373 .alg = "rfc3686(ctr(aes))",
5374 .test = alg_test_skcipher,
5375 .fips_allowed = 1,
5376 .suite = {
5377 .cipher = __VECS(aes_ctr_rfc3686_tv_template)
5378 }
5379 }, {
5380 .alg = "rfc3686(ctr(sm4))",
5381 .test = alg_test_skcipher,
5382 .suite = {
5383 .cipher = __VECS(sm4_ctr_rfc3686_tv_template)
5384 }
5385 }, {
5386 .alg = "rfc4106(gcm(aes))",
5387 .generic_driver = "rfc4106(gcm_base(ctr(aes-generic),ghash-generic))",
5388 .test = alg_test_aead,
5389 .fips_allowed = 1,
5390 .suite = {
5391 .aead = {
5392 ____VECS(aes_gcm_rfc4106_tv_template),
5393 .einval_allowed = 1,
5394 .aad_iv = 1,
5395 }
5396 }
5397 }, {
5398 .alg = "rfc4309(ccm(aes))",
5399 .generic_driver = "rfc4309(ccm_base(ctr(aes-generic),cbcmac(aes-generic)))",
5400 .test = alg_test_aead,
5401 .fips_allowed = 1,
5402 .suite = {
5403 .aead = {
5404 ____VECS(aes_ccm_rfc4309_tv_template),
5405 .einval_allowed = 1,
5406 .aad_iv = 1,
5407 }
5408 }
5409 }, {
5410 .alg = "rfc4543(gcm(aes))",
5411 .generic_driver = "rfc4543(gcm_base(ctr(aes-generic),ghash-generic))",
5412 .test = alg_test_aead,
5413 .suite = {
5414 .aead = {
5415 ____VECS(aes_gcm_rfc4543_tv_template),
5416 .einval_allowed = 1,
5417 .aad_iv = 1,
5418 }
5419 }
5420 }, {
5421 .alg = "rfc7539(chacha20,poly1305)",
5422 .generic_driver = "rfc7539(chacha20-lib,poly1305-generic)",
5423 .test = alg_test_aead,
5424 .suite = {
5425 .aead = __VECS(rfc7539_tv_template)
5426 }
5427 }, {
5428 .alg = "rfc7539esp(chacha20,poly1305)",
5429 .generic_driver = "rfc7539esp(chacha20-lib,poly1305-generic)",
5430 .test = alg_test_aead,
5431 .suite = {
5432 .aead = {
5433 ____VECS(rfc7539esp_tv_template),
5434 .einval_allowed = 1,
5435 .aad_iv = 1,
5436 }
5437 }
5438 }, {
5439 .alg = "rmd160",
5440 .test = alg_test_hash,
5441 .suite = {
5442 .hash = __VECS(rmd160_tv_template)
5443 }
5444 }, {
5445 .alg = "rsa",
5446 .test = alg_test_akcipher,
5447 .fips_allowed = 1,
5448 .suite = {
5449 .akcipher = __VECS(rsa_tv_template)
5450 }
5451 }, {
5452 .alg = "sha1",
5453 .generic_driver = "sha1-lib",
5454 .test = alg_test_hash,
5455 .fips_allowed = 1,
5456 .suite = {
5457 .hash = __VECS(sha1_tv_template)
5458 }
5459 }, {
5460 .alg = "sha224",
5461 .generic_driver = "sha224-lib",
5462 .test = alg_test_hash,
5463 .fips_allowed = 1,
5464 .suite = {
5465 .hash = __VECS(sha224_tv_template)
5466 }
5467 }, {
5468 .alg = "sha256",
5469 .generic_driver = "sha256-lib",
5470 .test = alg_test_hash,
5471 .fips_allowed = 1,
5472 .suite = {
5473 .hash = __VECS(sha256_tv_template)
5474 }
5475 }, {
5476 .alg = "sha3-224",
5477 .test = alg_test_hash,
5478 .fips_allowed = 1,
5479 .suite = {
5480 .hash = __VECS(sha3_224_tv_template)
5481 }
5482 }, {
5483 .alg = "sha3-256",
5484 .test = alg_test_hash,
5485 .fips_allowed = 1,
5486 .suite = {
5487 .hash = __VECS(sha3_256_tv_template)
5488 }
5489 }, {
5490 .alg = "sha3-384",
5491 .test = alg_test_hash,
5492 .fips_allowed = 1,
5493 .suite = {
5494 .hash = __VECS(sha3_384_tv_template)
5495 }
5496 }, {
5497 .alg = "sha3-512",
5498 .test = alg_test_hash,
5499 .fips_allowed = 1,
5500 .suite = {
5501 .hash = __VECS(sha3_512_tv_template)
5502 }
5503 }, {
5504 .alg = "sha384",
5505 .generic_driver = "sha384-lib",
5506 .test = alg_test_hash,
5507 .fips_allowed = 1,
5508 .suite = {
5509 .hash = __VECS(sha384_tv_template)
5510 }
5511 }, {
5512 .alg = "sha512",
5513 .generic_driver = "sha512-lib",
5514 .test = alg_test_hash,
5515 .fips_allowed = 1,
5516 .suite = {
5517 .hash = __VECS(sha512_tv_template)
5518 }
5519 }, {
5520 .alg = "sm3",
5521 .test = alg_test_hash,
5522 .suite = {
5523 .hash = __VECS(sm3_tv_template)
5524 }
5525 }, {
5526 .alg = "streebog256",
5527 .test = alg_test_hash,
5528 .suite = {
5529 .hash = __VECS(streebog256_tv_template)
5530 }
5531 }, {
5532 .alg = "streebog512",
5533 .test = alg_test_hash,
5534 .suite = {
5535 .hash = __VECS(streebog512_tv_template)
5536 }
5537 }, {
5538 .alg = "wp256",
5539 .test = alg_test_hash,
5540 .suite = {
5541 .hash = __VECS(wp256_tv_template)
5542 }
5543 }, {
5544 .alg = "wp384",
5545 .test = alg_test_hash,
5546 .suite = {
5547 .hash = __VECS(wp384_tv_template)
5548 }
5549 }, {
5550 .alg = "wp512",
5551 .test = alg_test_hash,
5552 .suite = {
5553 .hash = __VECS(wp512_tv_template)
5554 }
5555 }, {
5556 .alg = "x962(ecdsa-nist-p192)",
5557 .test = alg_test_sig,
5558 .suite = {
5559 .sig = __VECS(x962_ecdsa_nist_p192_tv_template)
5560 }
5561 }, {
5562 .alg = "x962(ecdsa-nist-p256)",
5563 .test = alg_test_sig,
5564 .fips_allowed = 1,
5565 .suite = {
5566 .sig = __VECS(x962_ecdsa_nist_p256_tv_template)
5567 }
5568 }, {
5569 .alg = "x962(ecdsa-nist-p384)",
5570 .test = alg_test_sig,
5571 .fips_allowed = 1,
5572 .suite = {
5573 .sig = __VECS(x962_ecdsa_nist_p384_tv_template)
5574 }
5575 }, {
5576 .alg = "x962(ecdsa-nist-p521)",
5577 .test = alg_test_sig,
5578 .fips_allowed = 1,
5579 .suite = {
5580 .sig = __VECS(x962_ecdsa_nist_p521_tv_template)
5581 }
5582 }, {
5583 .alg = "xcbc(aes)",
5584 .test = alg_test_hash,
5585 .suite = {
5586 .hash = __VECS(aes_xcbc128_tv_template)
5587 }
5588 }, {
5589 .alg = "xcbc(sm4)",
5590 .test = alg_test_hash,
5591 .suite = {
5592 .hash = __VECS(sm4_xcbc128_tv_template)
5593 }
5594 }, {
5595 .alg = "xchacha12",
5596 .generic_driver = "xchacha12-lib",
5597 .test = alg_test_skcipher,
5598 .suite = {
5599 .cipher = __VECS(xchacha12_tv_template)
5600 },
5601 }, {
5602 .alg = "xchacha20",
5603 .generic_driver = "xchacha20-lib",
5604 .test = alg_test_skcipher,
5605 .suite = {
5606 .cipher = __VECS(xchacha20_tv_template)
5607 },
5608 }, {
5609 .alg = "xctr(aes)",
5610 .test = alg_test_skcipher,
5611 .suite = {
5612 .cipher = __VECS(aes_xctr_tv_template)
5613 }
5614 }, {
5615 .alg = "xts(aes)",
5616 .generic_driver = "xts(ecb(aes-generic))",
5617 .test = alg_test_skcipher,
5618 .fips_allowed = 1,
5619 .suite = {
5620 .cipher = __VECS(aes_xts_tv_template)
5621 }
5622 }, {
5623 .alg = "xts(camellia)",
5624 .generic_driver = "xts(ecb(camellia-generic))",
5625 .test = alg_test_skcipher,
5626 .suite = {
5627 .cipher = __VECS(camellia_xts_tv_template)
5628 }
5629 }, {
5630 .alg = "xts(cast6)",
5631 .generic_driver = "xts(ecb(cast6-generic))",
5632 .test = alg_test_skcipher,
5633 .suite = {
5634 .cipher = __VECS(cast6_xts_tv_template)
5635 }
5636 }, {
5637 /* Same as xts(aes) except the key is stored in
5638 * hardware secure memory which we reference by index
5639 */
5640 .alg = "xts(paes)",
5641 .test = alg_test_null,
5642 .fips_allowed = 1,
5643 }, {
5644 .alg = "xts(serpent)",
5645 .generic_driver = "xts(ecb(serpent-generic))",
5646 .test = alg_test_skcipher,
5647 .suite = {
5648 .cipher = __VECS(serpent_xts_tv_template)
5649 }
5650 }, {
5651 .alg = "xts(sm4)",
5652 .generic_driver = "xts(ecb(sm4-generic))",
5653 .test = alg_test_skcipher,
5654 .suite = {
5655 .cipher = __VECS(sm4_xts_tv_template)
5656 }
5657 }, {
5658 .alg = "xts(twofish)",
5659 .generic_driver = "xts(ecb(twofish-generic))",
5660 .test = alg_test_skcipher,
5661 .suite = {
5662 .cipher = __VECS(tf_xts_tv_template)
5663 }
5664 }, {
5665#if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
5666 .alg = "xts-paes-s390",
5667 .fips_allowed = 1,
5668 .test = alg_test_skcipher,
5669 .suite = {
5670 .cipher = __VECS(aes_xts_tv_template)
5671 }
5672 }, {
5673#endif
5674 .alg = "xxhash64",
5675 .test = alg_test_hash,
5676 .fips_allowed = 1,
5677 .suite = {
5678 .hash = __VECS(xxhash64_tv_template)
5679 }
5680 }, {
5681 .alg = "zstd",
5682 .test = alg_test_comp,
5683 .fips_allowed = 1,
5684 .suite = {
5685 .comp = {
5686 .comp = __VECS(zstd_comp_tv_template),
5687 .decomp = __VECS(zstd_decomp_tv_template)
5688 }
5689 }
5690 }
5691};
5692
5693static void alg_check_test_descs_order(void)
5694{
5695 int i;
5696
5697 for (i = 1; i < ARRAY_SIZE(alg_test_descs); i++) {
5698 int diff = strcmp(alg_test_descs[i - 1].alg,
5699 alg_test_descs[i].alg);
5700
5701 if (WARN_ON(diff > 0)) {
5702 pr_warn("testmgr: alg_test_descs entries in wrong order: '%s' before '%s'\n",
5703 alg_test_descs[i - 1].alg,
5704 alg_test_descs[i].alg);
5705 }
5706
5707 if (WARN_ON(diff == 0)) {
5708 pr_warn("testmgr: duplicate alg_test_descs entry: '%s'\n",
5709 alg_test_descs[i].alg);
5710 }
5711 }
5712}
5713
5714static void alg_check_testvec_configs(void)
5715{
5716 int i;
5717
5718 for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++)
5719 WARN_ON(!valid_testvec_config(
5720 &default_cipher_testvec_configs[i]));
5721
5722 for (i = 0; i < ARRAY_SIZE(default_hash_testvec_configs); i++)
5723 WARN_ON(!valid_testvec_config(
5724 &default_hash_testvec_configs[i]));
5725}
5726
5727static void testmgr_onetime_init(void)
5728{
5729 alg_check_test_descs_order();
5730 alg_check_testvec_configs();
5731
5732 if (!noslowtests)
5733 pr_warn("alg: full crypto tests enabled. This is intended for developer use only.\n");
5734}
5735
5736static int alg_find_test(const char *alg)
5737{
5738 int start = 0;
5739 int end = ARRAY_SIZE(alg_test_descs);
5740
5741 while (start < end) {
5742 int i = (start + end) / 2;
5743 int diff = strcmp(alg_test_descs[i].alg, alg);
5744
5745 if (diff > 0) {
5746 end = i;
5747 continue;
5748 }
5749
5750 if (diff < 0) {
5751 start = i + 1;
5752 continue;
5753 }
5754
5755 return i;
5756 }
5757
5758 return -1;
5759}
5760
5761static int alg_fips_disabled(const char *driver, const char *alg)
5762{
5763 pr_info("alg: %s (%s) is disabled due to FIPS\n", alg, driver);
5764
5765 return -ECANCELED;
5766}
5767
5768int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
5769{
5770 int i;
5771 int j;
5772 int rc;
5773
5774 if (!fips_enabled && notests) {
5775 printk_once(KERN_INFO "alg: self-tests disabled\n");
5776 return 0;
5777 }
5778
5779 DO_ONCE(testmgr_onetime_init);
5780
5781 if ((type & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_CIPHER) {
5782 char nalg[CRYPTO_MAX_ALG_NAME];
5783
5784 if (snprintf(nalg, sizeof(nalg), "ecb(%s)", alg) >=
5785 sizeof(nalg))
5786 return -ENAMETOOLONG;
5787
5788 i = alg_find_test(nalg);
5789 if (i < 0)
5790 goto notest;
5791
5792 if (fips_enabled && !alg_test_descs[i].fips_allowed)
5793 goto non_fips_alg;
5794
5795 rc = alg_test_cipher(alg_test_descs + i, driver, type, mask);
5796 goto test_done;
5797 }
5798
5799 i = alg_find_test(alg);
5800 j = alg_find_test(driver);
5801 if (i < 0 && j < 0)
5802 goto notest;
5803
5804 if (fips_enabled) {
5805 if (j >= 0 && !alg_test_descs[j].fips_allowed)
5806 return -EINVAL;
5807
5808 if (i >= 0 && !alg_test_descs[i].fips_allowed)
5809 goto non_fips_alg;
5810 }
5811
5812 rc = 0;
5813 if (i >= 0)
5814 rc |= alg_test_descs[i].test(alg_test_descs + i, driver,
5815 type, mask);
5816 if (j >= 0 && j != i)
5817 rc |= alg_test_descs[j].test(alg_test_descs + j, driver,
5818 type, mask);
5819
5820test_done:
5821 if (rc) {
5822 if (fips_enabled) {
5823 fips_fail_notify();
5824 panic("alg: self-tests for %s (%s) failed in fips mode!\n",
5825 driver, alg);
5826 }
5827 pr_warn("alg: self-tests for %s using %s failed (rc=%d)",
5828 alg, driver, rc);
5829 WARN(rc != -ENOENT,
5830 "alg: self-tests for %s using %s failed (rc=%d)",
5831 alg, driver, rc);
5832 } else {
5833 if (fips_enabled)
5834 pr_info("alg: self-tests for %s (%s) passed\n",
5835 driver, alg);
5836 }
5837
5838 return rc;
5839
5840notest:
5841 if ((type & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_LSKCIPHER) {
5842 char nalg[CRYPTO_MAX_ALG_NAME];
5843
5844 if (snprintf(nalg, sizeof(nalg), "ecb(%s)", alg) >=
5845 sizeof(nalg))
5846 goto notest2;
5847
5848 i = alg_find_test(nalg);
5849 if (i < 0)
5850 goto notest2;
5851
5852 if (fips_enabled && !alg_test_descs[i].fips_allowed)
5853 goto non_fips_alg;
5854
5855 rc = alg_test_skcipher(alg_test_descs + i, driver, type, mask);
5856 goto test_done;
5857 }
5858
5859notest2:
5860 printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver);
5861
5862 if (type & CRYPTO_ALG_FIPS_INTERNAL)
5863 return alg_fips_disabled(driver, alg);
5864
5865 return 0;
5866non_fips_alg:
5867 return alg_fips_disabled(driver, alg);
5868}
5869
5870#endif /* CONFIG_CRYPTO_SELFTESTS */
5871
5872EXPORT_SYMBOL_GPL(alg_test);
5873