1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * Algorithm testing framework and tests.
5 * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
6 * Copyright (c) 2002 Jean-Francois Dive <jef@linuxbe.org>
7 * Copyright (c) 2007 Nokia Siemens Networks
8 * Copyright (c) 2008 Herbert Xu <herbert@gondor.apana.org.au>
9 * Copyright (c) 2019 Google LLC
11 * Updated RFC4106 AES-GCM testing.
12 * Authors: Aidan O'Mahony (aidan.o.mahony@intel.com)
13 * Adrian Hoban <adrian.hoban@intel.com>
14 * Gabriele Paoloni <gabriele.paoloni@intel.com>
15 * Tadeusz Struk (tadeusz.struk@intel.com)
16 * Copyright (c) 2010, Intel Corporation.
19 #include <crypto/aead.h>
20 #include <crypto/hash.h>
21 #include <crypto/skcipher.h>
22 #include <linux/err.h>
23 #include <linux/fips.h>
24 #include <linux/module.h>
25 #include <linux/once.h>
26 #include <linux/random.h>
27 #include <linux/scatterlist.h>
28 #include <linux/slab.h>
29 #include <linux/string.h>
30 #include <linux/uio.h>
31 #include <crypto/rng.h>
32 #include <crypto/drbg.h>
33 #include <crypto/akcipher.h>
34 #include <crypto/kpp.h>
35 #include <crypto/acompress.h>
36 #include <crypto/internal/cipher.h>
37 #include <crypto/internal/simd.h>
41 MODULE_IMPORT_NS(CRYPTO_INTERNAL);
44 module_param(notests, bool, 0644);
45 MODULE_PARM_DESC(notests, "disable crypto self-tests");
47 static bool panic_on_fail;
48 module_param(panic_on_fail, bool, 0444);
50 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
51 static bool noextratests;
52 module_param(noextratests, bool, 0644);
53 MODULE_PARM_DESC(noextratests, "disable expensive crypto self-tests");
55 static unsigned int fuzz_iterations = 100;
56 module_param(fuzz_iterations, uint, 0644);
57 MODULE_PARM_DESC(fuzz_iterations, "number of fuzz test iterations");
60 #ifdef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS
63 int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
73 * Need slab memory for testing (size in number of pages).
78 * Used by test_cipher()
83 struct aead_test_suite {
84 const struct aead_testvec *vecs;
88 * Set if trying to decrypt an inauthentic ciphertext with this
89 * algorithm might result in EINVAL rather than EBADMSG, due to other
90 * validation the algorithm does on the inputs such as length checks.
92 unsigned int einval_allowed : 1;
95 * Set if this algorithm requires that the IV be located at the end of
96 * the AAD buffer, in addition to being given in the normal way. The
97 * behavior when the two IV copies differ is implementation-defined.
99 unsigned int aad_iv : 1;
102 struct cipher_test_suite {
103 const struct cipher_testvec *vecs;
107 struct comp_test_suite {
109 const struct comp_testvec *vecs;
114 struct hash_test_suite {
115 const struct hash_testvec *vecs;
119 struct cprng_test_suite {
120 const struct cprng_testvec *vecs;
124 struct drbg_test_suite {
125 const struct drbg_testvec *vecs;
129 struct akcipher_test_suite {
130 const struct akcipher_testvec *vecs;
134 struct kpp_test_suite {
135 const struct kpp_testvec *vecs;
139 struct alg_test_desc {
141 const char *generic_driver;
142 int (*test)(const struct alg_test_desc *desc, const char *driver,
144 int fips_allowed; /* set if alg is allowed in fips mode */
147 struct aead_test_suite aead;
148 struct cipher_test_suite cipher;
149 struct comp_test_suite comp;
150 struct hash_test_suite hash;
151 struct cprng_test_suite cprng;
152 struct drbg_test_suite drbg;
153 struct akcipher_test_suite akcipher;
154 struct kpp_test_suite kpp;
158 static void hexdump(unsigned char *buf, unsigned int len)
160 print_hex_dump(KERN_CONT, "", DUMP_PREFIX_OFFSET,
165 static int __testmgr_alloc_buf(char *buf[XBUFSIZE], int order)
169 for (i = 0; i < XBUFSIZE; i++) {
170 buf[i] = (char *)__get_free_pages(GFP_KERNEL, order);
179 free_pages((unsigned long)buf[i], order);
184 static int testmgr_alloc_buf(char *buf[XBUFSIZE])
186 return __testmgr_alloc_buf(buf, 0);
189 static void __testmgr_free_buf(char *buf[XBUFSIZE], int order)
193 for (i = 0; i < XBUFSIZE; i++)
194 free_pages((unsigned long)buf[i], order);
197 static void testmgr_free_buf(char *buf[XBUFSIZE])
199 __testmgr_free_buf(buf, 0);
202 #define TESTMGR_POISON_BYTE 0xfe
203 #define TESTMGR_POISON_LEN 16
205 static inline void testmgr_poison(void *addr, size_t len)
207 memset(addr, TESTMGR_POISON_BYTE, len);
210 /* Is the memory region still fully poisoned? */
211 static inline bool testmgr_is_poison(const void *addr, size_t len)
213 return memchr_inv(addr, TESTMGR_POISON_BYTE, len) == NULL;
216 /* flush type for hash algorithms */
218 /* merge with update of previous buffer(s) */
221 /* update with previous buffer(s) before doing this one */
224 /* likewise, but also export and re-import the intermediate state */
228 /* finalization function for hash algorithms */
229 enum finalization_type {
230 FINALIZATION_TYPE_FINAL, /* use final() */
231 FINALIZATION_TYPE_FINUP, /* use finup() */
232 FINALIZATION_TYPE_DIGEST, /* use digest() */
236 * Whether the crypto operation will occur in-place, and if so whether the
237 * source and destination scatterlist pointers will coincide (req->src ==
238 * req->dst), or whether they'll merely point to two separate scatterlists
239 * (req->src != req->dst) that reference the same underlying memory.
241 * This is only relevant for algorithm types that support in-place operation.
249 #define TEST_SG_TOTAL 10000
252 * struct test_sg_division - description of a scatterlist entry
254 * This struct describes one entry of a scatterlist being constructed to check a
255 * crypto test vector.
257 * @proportion_of_total: length of this chunk relative to the total length,
258 * given as a proportion out of TEST_SG_TOTAL so that it
259 * scales to fit any test vector
260 * @offset: byte offset into a 2-page buffer at which this chunk will start
261 * @offset_relative_to_alignmask: if true, add the algorithm's alignmask to the
263 * @flush_type: for hashes, whether an update() should be done now vs.
264 * continuing to accumulate data
265 * @nosimd: if doing the pending update(), do it with SIMD disabled?
267 struct test_sg_division {
268 unsigned int proportion_of_total;
270 bool offset_relative_to_alignmask;
271 enum flush_type flush_type;
276 * struct testvec_config - configuration for testing a crypto test vector
278 * This struct describes the data layout and other parameters with which each
279 * crypto test vector can be tested.
281 * @name: name of this config, logged for debugging purposes if a test fails
282 * @inplace_mode: whether and how to operate on the data in-place, if applicable
283 * @req_flags: extra request_flags, e.g. CRYPTO_TFM_REQ_MAY_SLEEP
284 * @src_divs: description of how to arrange the source scatterlist
285 * @dst_divs: description of how to arrange the dst scatterlist, if applicable
286 * for the algorithm type. Defaults to @src_divs if unset.
287 * @iv_offset: misalignment of the IV in the range [0..MAX_ALGAPI_ALIGNMASK+1],
288 * where 0 is aligned to a 2*(MAX_ALGAPI_ALIGNMASK+1) byte boundary
289 * @iv_offset_relative_to_alignmask: if true, add the algorithm's alignmask to
291 * @key_offset: misalignment of the key, where 0 is default alignment
292 * @key_offset_relative_to_alignmask: if true, add the algorithm's alignmask to
294 * @finalization_type: what finalization function to use for hashes
295 * @nosimd: execute with SIMD disabled? Requires !CRYPTO_TFM_REQ_MAY_SLEEP.
296 * This applies to the parts of the operation that aren't controlled
297 * individually by @nosimd_setkey or @src_divs[].nosimd.
298 * @nosimd_setkey: set the key (if applicable) with SIMD disabled? Requires
299 * !CRYPTO_TFM_REQ_MAY_SLEEP.
301 struct testvec_config {
303 enum inplace_mode inplace_mode;
305 struct test_sg_division src_divs[XBUFSIZE];
306 struct test_sg_division dst_divs[XBUFSIZE];
307 unsigned int iv_offset;
308 unsigned int key_offset;
309 bool iv_offset_relative_to_alignmask;
310 bool key_offset_relative_to_alignmask;
311 enum finalization_type finalization_type;
316 #define TESTVEC_CONFIG_NAMELEN 192
319 * The following are the lists of testvec_configs to test for each algorithm
320 * type when the basic crypto self-tests are enabled, i.e. when
321 * CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is unset. They aim to provide good test
322 * coverage, while keeping the test time much shorter than the full fuzz tests
323 * so that the basic tests can be enabled in a wider range of circumstances.
326 /* Configs for skciphers and aeads */
327 static const struct testvec_config default_cipher_testvec_configs[] = {
329 .name = "in-place (one sglist)",
330 .inplace_mode = INPLACE_ONE_SGLIST,
331 .src_divs = { { .proportion_of_total = 10000 } },
333 .name = "in-place (two sglists)",
334 .inplace_mode = INPLACE_TWO_SGLISTS,
335 .src_divs = { { .proportion_of_total = 10000 } },
337 .name = "out-of-place",
338 .inplace_mode = OUT_OF_PLACE,
339 .src_divs = { { .proportion_of_total = 10000 } },
341 .name = "unaligned buffer, offset=1",
342 .src_divs = { { .proportion_of_total = 10000, .offset = 1 } },
346 .name = "buffer aligned only to alignmask",
349 .proportion_of_total = 10000,
351 .offset_relative_to_alignmask = true,
355 .iv_offset_relative_to_alignmask = true,
357 .key_offset_relative_to_alignmask = true,
359 .name = "two even aligned splits",
361 { .proportion_of_total = 5000 },
362 { .proportion_of_total = 5000 },
365 .name = "one src, two even splits dst",
366 .inplace_mode = OUT_OF_PLACE,
367 .src_divs = { { .proportion_of_total = 10000 } },
369 { .proportion_of_total = 5000 },
370 { .proportion_of_total = 5000 },
373 .name = "uneven misaligned splits, may sleep",
374 .req_flags = CRYPTO_TFM_REQ_MAY_SLEEP,
376 { .proportion_of_total = 1900, .offset = 33 },
377 { .proportion_of_total = 3300, .offset = 7 },
378 { .proportion_of_total = 4800, .offset = 18 },
383 .name = "misaligned splits crossing pages, inplace",
384 .inplace_mode = INPLACE_ONE_SGLIST,
387 .proportion_of_total = 7500,
388 .offset = PAGE_SIZE - 32
390 .proportion_of_total = 2500,
391 .offset = PAGE_SIZE - 7
397 static const struct testvec_config default_hash_testvec_configs[] = {
399 .name = "init+update+final aligned buffer",
400 .src_divs = { { .proportion_of_total = 10000 } },
401 .finalization_type = FINALIZATION_TYPE_FINAL,
403 .name = "init+finup aligned buffer",
404 .src_divs = { { .proportion_of_total = 10000 } },
405 .finalization_type = FINALIZATION_TYPE_FINUP,
407 .name = "digest aligned buffer",
408 .src_divs = { { .proportion_of_total = 10000 } },
409 .finalization_type = FINALIZATION_TYPE_DIGEST,
411 .name = "init+update+final misaligned buffer",
412 .src_divs = { { .proportion_of_total = 10000, .offset = 1 } },
413 .finalization_type = FINALIZATION_TYPE_FINAL,
416 .name = "digest misaligned buffer",
419 .proportion_of_total = 10000,
423 .finalization_type = FINALIZATION_TYPE_DIGEST,
426 .name = "init+update+update+final two even splits",
428 { .proportion_of_total = 5000 },
430 .proportion_of_total = 5000,
431 .flush_type = FLUSH_TYPE_FLUSH,
434 .finalization_type = FINALIZATION_TYPE_FINAL,
436 .name = "digest uneven misaligned splits, may sleep",
437 .req_flags = CRYPTO_TFM_REQ_MAY_SLEEP,
439 { .proportion_of_total = 1900, .offset = 33 },
440 { .proportion_of_total = 3300, .offset = 7 },
441 { .proportion_of_total = 4800, .offset = 18 },
443 .finalization_type = FINALIZATION_TYPE_DIGEST,
445 .name = "digest misaligned splits crossing pages",
448 .proportion_of_total = 7500,
449 .offset = PAGE_SIZE - 32,
451 .proportion_of_total = 2500,
452 .offset = PAGE_SIZE - 7,
455 .finalization_type = FINALIZATION_TYPE_DIGEST,
457 .name = "import/export",
460 .proportion_of_total = 6500,
461 .flush_type = FLUSH_TYPE_REIMPORT,
463 .proportion_of_total = 3500,
464 .flush_type = FLUSH_TYPE_REIMPORT,
467 .finalization_type = FINALIZATION_TYPE_FINAL,
471 static unsigned int count_test_sg_divisions(const struct test_sg_division *divs)
473 unsigned int remaining = TEST_SG_TOTAL;
474 unsigned int ndivs = 0;
477 remaining -= divs[ndivs++].proportion_of_total;
483 #define SGDIVS_HAVE_FLUSHES BIT(0)
484 #define SGDIVS_HAVE_NOSIMD BIT(1)
486 static bool valid_sg_divisions(const struct test_sg_division *divs,
487 unsigned int count, int *flags_ret)
489 unsigned int total = 0;
492 for (i = 0; i < count && total != TEST_SG_TOTAL; i++) {
493 if (divs[i].proportion_of_total <= 0 ||
494 divs[i].proportion_of_total > TEST_SG_TOTAL - total)
496 total += divs[i].proportion_of_total;
497 if (divs[i].flush_type != FLUSH_TYPE_NONE)
498 *flags_ret |= SGDIVS_HAVE_FLUSHES;
500 *flags_ret |= SGDIVS_HAVE_NOSIMD;
502 return total == TEST_SG_TOTAL &&
503 memchr_inv(&divs[i], 0, (count - i) * sizeof(divs[0])) == NULL;
507 * Check whether the given testvec_config is valid. This isn't strictly needed
508 * since every testvec_config should be valid, but check anyway so that people
509 * don't unknowingly add broken configs that don't do what they wanted.
511 static bool valid_testvec_config(const struct testvec_config *cfg)
515 if (cfg->name == NULL)
518 if (!valid_sg_divisions(cfg->src_divs, ARRAY_SIZE(cfg->src_divs),
522 if (cfg->dst_divs[0].proportion_of_total) {
523 if (!valid_sg_divisions(cfg->dst_divs,
524 ARRAY_SIZE(cfg->dst_divs), &flags))
527 if (memchr_inv(cfg->dst_divs, 0, sizeof(cfg->dst_divs)))
529 /* defaults to dst_divs=src_divs */
533 (cfg->iv_offset_relative_to_alignmask ? MAX_ALGAPI_ALIGNMASK : 0) >
534 MAX_ALGAPI_ALIGNMASK + 1)
537 if ((flags & (SGDIVS_HAVE_FLUSHES | SGDIVS_HAVE_NOSIMD)) &&
538 cfg->finalization_type == FINALIZATION_TYPE_DIGEST)
541 if ((cfg->nosimd || cfg->nosimd_setkey ||
542 (flags & SGDIVS_HAVE_NOSIMD)) &&
543 (cfg->req_flags & CRYPTO_TFM_REQ_MAY_SLEEP))
550 char *bufs[XBUFSIZE];
551 struct scatterlist sgl[XBUFSIZE];
552 struct scatterlist sgl_saved[XBUFSIZE];
553 struct scatterlist *sgl_ptr;
557 static int init_test_sglist(struct test_sglist *tsgl)
559 return __testmgr_alloc_buf(tsgl->bufs, 1 /* two pages per buffer */);
562 static void destroy_test_sglist(struct test_sglist *tsgl)
564 return __testmgr_free_buf(tsgl->bufs, 1 /* two pages per buffer */);
568 * build_test_sglist() - build a scatterlist for a crypto test
570 * @tsgl: the scatterlist to build. @tsgl->bufs[] contains an array of 2-page
571 * buffers which the scatterlist @tsgl->sgl[] will be made to point into.
572 * @divs: the layout specification on which the scatterlist will be based
573 * @alignmask: the algorithm's alignmask
574 * @total_len: the total length of the scatterlist to build in bytes
575 * @data: if non-NULL, the buffers will be filled with this data until it ends.
576 * Otherwise the buffers will be poisoned. In both cases, some bytes
577 * past the end of each buffer will be poisoned to help detect overruns.
578 * @out_divs: if non-NULL, the test_sg_division to which each scatterlist entry
579 * corresponds will be returned here. This will match @divs except
580 * that divisions resolving to a length of 0 are omitted as they are
581 * not included in the scatterlist.
583 * Return: 0 or a -errno value
585 static int build_test_sglist(struct test_sglist *tsgl,
586 const struct test_sg_division *divs,
587 const unsigned int alignmask,
588 const unsigned int total_len,
589 struct iov_iter *data,
590 const struct test_sg_division *out_divs[XBUFSIZE])
593 const struct test_sg_division *div;
595 } partitions[XBUFSIZE];
596 const unsigned int ndivs = count_test_sg_divisions(divs);
597 unsigned int len_remaining = total_len;
600 BUILD_BUG_ON(ARRAY_SIZE(partitions) != ARRAY_SIZE(tsgl->sgl));
601 if (WARN_ON(ndivs > ARRAY_SIZE(partitions)))
604 /* Calculate the (div, length) pairs */
606 for (i = 0; i < ndivs; i++) {
607 unsigned int len_this_sg =
609 (total_len * divs[i].proportion_of_total +
610 TEST_SG_TOTAL / 2) / TEST_SG_TOTAL);
612 if (len_this_sg != 0) {
613 partitions[tsgl->nents].div = &divs[i];
614 partitions[tsgl->nents].length = len_this_sg;
616 len_remaining -= len_this_sg;
619 if (tsgl->nents == 0) {
620 partitions[tsgl->nents].div = &divs[0];
621 partitions[tsgl->nents].length = 0;
624 partitions[tsgl->nents - 1].length += len_remaining;
626 /* Set up the sgl entries and fill the data or poison */
627 sg_init_table(tsgl->sgl, tsgl->nents);
628 for (i = 0; i < tsgl->nents; i++) {
629 unsigned int offset = partitions[i].div->offset;
632 if (partitions[i].div->offset_relative_to_alignmask)
635 while (offset + partitions[i].length + TESTMGR_POISON_LEN >
637 if (WARN_ON(offset <= 0))
642 addr = &tsgl->bufs[i][offset];
643 sg_set_buf(&tsgl->sgl[i], addr, partitions[i].length);
646 out_divs[i] = partitions[i].div;
649 size_t copy_len, copied;
651 copy_len = min(partitions[i].length, data->count);
652 copied = copy_from_iter(addr, copy_len, data);
653 if (WARN_ON(copied != copy_len))
655 testmgr_poison(addr + copy_len, partitions[i].length +
656 TESTMGR_POISON_LEN - copy_len);
658 testmgr_poison(addr, partitions[i].length +
663 sg_mark_end(&tsgl->sgl[tsgl->nents - 1]);
664 tsgl->sgl_ptr = tsgl->sgl;
665 memcpy(tsgl->sgl_saved, tsgl->sgl, tsgl->nents * sizeof(tsgl->sgl[0]));
670 * Verify that a scatterlist crypto operation produced the correct output.
672 * @tsgl: scatterlist containing the actual output
673 * @expected_output: buffer containing the expected output
674 * @len_to_check: length of @expected_output in bytes
675 * @unchecked_prefix_len: number of ignored bytes in @tsgl prior to real result
676 * @check_poison: verify that the poison bytes after each chunk are intact?
678 * Return: 0 if correct, -EINVAL if incorrect, -EOVERFLOW if buffer overrun.
680 static int verify_correct_output(const struct test_sglist *tsgl,
681 const char *expected_output,
682 unsigned int len_to_check,
683 unsigned int unchecked_prefix_len,
688 for (i = 0; i < tsgl->nents; i++) {
689 struct scatterlist *sg = &tsgl->sgl_ptr[i];
690 unsigned int len = sg->length;
691 unsigned int offset = sg->offset;
692 const char *actual_output;
694 if (unchecked_prefix_len) {
695 if (unchecked_prefix_len >= len) {
696 unchecked_prefix_len -= len;
699 offset += unchecked_prefix_len;
700 len -= unchecked_prefix_len;
701 unchecked_prefix_len = 0;
703 len = min(len, len_to_check);
704 actual_output = page_address(sg_page(sg)) + offset;
705 if (memcmp(expected_output, actual_output, len) != 0)
708 !testmgr_is_poison(actual_output + len, TESTMGR_POISON_LEN))
711 expected_output += len;
713 if (WARN_ON(len_to_check != 0))
718 static bool is_test_sglist_corrupted(const struct test_sglist *tsgl)
722 for (i = 0; i < tsgl->nents; i++) {
723 if (tsgl->sgl[i].page_link != tsgl->sgl_saved[i].page_link)
725 if (tsgl->sgl[i].offset != tsgl->sgl_saved[i].offset)
727 if (tsgl->sgl[i].length != tsgl->sgl_saved[i].length)
733 struct cipher_test_sglists {
734 struct test_sglist src;
735 struct test_sglist dst;
738 static struct cipher_test_sglists *alloc_cipher_test_sglists(void)
740 struct cipher_test_sglists *tsgls;
742 tsgls = kmalloc(sizeof(*tsgls), GFP_KERNEL);
746 if (init_test_sglist(&tsgls->src) != 0)
748 if (init_test_sglist(&tsgls->dst) != 0)
749 goto fail_destroy_src;
754 destroy_test_sglist(&tsgls->src);
760 static void free_cipher_test_sglists(struct cipher_test_sglists *tsgls)
763 destroy_test_sglist(&tsgls->src);
764 destroy_test_sglist(&tsgls->dst);
769 /* Build the src and dst scatterlists for an skcipher or AEAD test */
770 static int build_cipher_test_sglists(struct cipher_test_sglists *tsgls,
771 const struct testvec_config *cfg,
772 unsigned int alignmask,
773 unsigned int src_total_len,
774 unsigned int dst_total_len,
775 const struct kvec *inputs,
776 unsigned int nr_inputs)
778 struct iov_iter input;
781 iov_iter_kvec(&input, ITER_SOURCE, inputs, nr_inputs, src_total_len);
782 err = build_test_sglist(&tsgls->src, cfg->src_divs, alignmask,
783 cfg->inplace_mode != OUT_OF_PLACE ?
784 max(dst_total_len, src_total_len) :
791 * In-place crypto operations can use the same scatterlist for both the
792 * source and destination (req->src == req->dst), or can use separate
793 * scatterlists (req->src != req->dst) which point to the same
794 * underlying memory. Make sure to test both cases.
796 if (cfg->inplace_mode == INPLACE_ONE_SGLIST) {
797 tsgls->dst.sgl_ptr = tsgls->src.sgl;
798 tsgls->dst.nents = tsgls->src.nents;
801 if (cfg->inplace_mode == INPLACE_TWO_SGLISTS) {
803 * For now we keep it simple and only test the case where the
804 * two scatterlists have identical entries, rather than
805 * different entries that split up the same memory differently.
807 memcpy(tsgls->dst.sgl, tsgls->src.sgl,
808 tsgls->src.nents * sizeof(tsgls->src.sgl[0]));
809 memcpy(tsgls->dst.sgl_saved, tsgls->src.sgl,
810 tsgls->src.nents * sizeof(tsgls->src.sgl[0]));
811 tsgls->dst.sgl_ptr = tsgls->dst.sgl;
812 tsgls->dst.nents = tsgls->src.nents;
816 return build_test_sglist(&tsgls->dst,
817 cfg->dst_divs[0].proportion_of_total ?
818 cfg->dst_divs : cfg->src_divs,
819 alignmask, dst_total_len, NULL, NULL);
823 * Support for testing passing a misaligned key to setkey():
825 * If cfg->key_offset is set, copy the key into a new buffer at that offset,
826 * optionally adding alignmask. Else, just use the key directly.
828 static int prepare_keybuf(const u8 *key, unsigned int ksize,
829 const struct testvec_config *cfg,
830 unsigned int alignmask,
831 const u8 **keybuf_ret, const u8 **keyptr_ret)
833 unsigned int key_offset = cfg->key_offset;
834 u8 *keybuf = NULL, *keyptr = (u8 *)key;
836 if (key_offset != 0) {
837 if (cfg->key_offset_relative_to_alignmask)
838 key_offset += alignmask;
839 keybuf = kmalloc(key_offset + ksize, GFP_KERNEL);
842 keyptr = keybuf + key_offset;
843 memcpy(keyptr, key, ksize);
845 *keybuf_ret = keybuf;
846 *keyptr_ret = keyptr;
851 * Like setkey_f(tfm, key, ksize), but sometimes misalign the key.
852 * In addition, run the setkey function in no-SIMD context if requested.
854 #define do_setkey(setkey_f, tfm, key, ksize, cfg, alignmask) \
856 const u8 *keybuf, *keyptr; \
859 err = prepare_keybuf((key), (ksize), (cfg), (alignmask), \
862 if ((cfg)->nosimd_setkey) \
863 crypto_disable_simd_for_test(); \
864 err = setkey_f((tfm), keyptr, (ksize)); \
865 if ((cfg)->nosimd_setkey) \
866 crypto_reenable_simd_for_test(); \
872 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
875 * The fuzz tests use prandom instead of the normal Linux RNG since they don't
876 * need cryptographically secure random numbers. This greatly improves the
877 * performance of these tests, especially if they are run before the Linux RNG
878 * has been initialized or if they are run on a lockdep-enabled kernel.
881 static inline void init_rnd_state(struct rnd_state *rng)
883 prandom_seed_state(rng, get_random_u64());
886 static inline u8 prandom_u8(struct rnd_state *rng)
888 return prandom_u32_state(rng);
891 static inline u32 prandom_u32_below(struct rnd_state *rng, u32 ceil)
894 * This is slightly biased for non-power-of-2 values of 'ceil', but this
895 * isn't important here.
897 return prandom_u32_state(rng) % ceil;
900 static inline bool prandom_bool(struct rnd_state *rng)
902 return prandom_u32_below(rng, 2);
905 static inline u32 prandom_u32_inclusive(struct rnd_state *rng,
908 return floor + prandom_u32_below(rng, ceil - floor + 1);
911 /* Generate a random length in range [0, max_len], but prefer smaller values */
912 static unsigned int generate_random_length(struct rnd_state *rng,
913 unsigned int max_len)
915 unsigned int len = prandom_u32_below(rng, max_len + 1);
917 switch (prandom_u32_below(rng, 4)) {
930 if (len && prandom_u32_below(rng, 4) == 0)
931 len = rounddown_pow_of_two(len);
935 /* Flip a random bit in the given nonempty data buffer */
936 static void flip_random_bit(struct rnd_state *rng, u8 *buf, size_t size)
940 bitpos = prandom_u32_below(rng, size * 8);
941 buf[bitpos / 8] ^= 1 << (bitpos % 8);
944 /* Flip a random byte in the given nonempty data buffer */
945 static void flip_random_byte(struct rnd_state *rng, u8 *buf, size_t size)
947 buf[prandom_u32_below(rng, size)] ^= 0xff;
950 /* Sometimes make some random changes to the given nonempty data buffer */
951 static void mutate_buffer(struct rnd_state *rng, u8 *buf, size_t size)
956 /* Sometimes flip some bits */
957 if (prandom_u32_below(rng, 4) == 0) {
958 num_flips = min_t(size_t, 1 << prandom_u32_below(rng, 8),
960 for (i = 0; i < num_flips; i++)
961 flip_random_bit(rng, buf, size);
964 /* Sometimes flip some bytes */
965 if (prandom_u32_below(rng, 4) == 0) {
966 num_flips = min_t(size_t, 1 << prandom_u32_below(rng, 8), size);
967 for (i = 0; i < num_flips; i++)
968 flip_random_byte(rng, buf, size);
972 /* Randomly generate 'count' bytes, but sometimes make them "interesting" */
973 static void generate_random_bytes(struct rnd_state *rng, u8 *buf, size_t count)
982 switch (prandom_u32_below(rng, 8)) { /* Choose a generation strategy */
985 /* All the same byte, plus optional mutations */
986 switch (prandom_u32_below(rng, 4)) {
997 memset(buf, b, count);
998 mutate_buffer(rng, buf, count);
1001 /* Ascending or descending bytes, plus optional mutations */
1002 increment = prandom_u8(rng);
1003 b = prandom_u8(rng);
1004 for (i = 0; i < count; i++, b += increment)
1006 mutate_buffer(rng, buf, count);
1009 /* Fully random bytes */
1010 prandom_bytes_state(rng, buf, count);
1014 static char *generate_random_sgl_divisions(struct rnd_state *rng,
1015 struct test_sg_division *divs,
1016 size_t max_divs, char *p, char *end,
1017 bool gen_flushes, u32 req_flags)
1019 struct test_sg_division *div = divs;
1020 unsigned int remaining = TEST_SG_TOTAL;
1023 unsigned int this_len;
1024 const char *flushtype_str;
1026 if (div == &divs[max_divs - 1] || prandom_bool(rng))
1027 this_len = remaining;
1028 else if (prandom_u32_below(rng, 4) == 0)
1029 this_len = (remaining + 1) / 2;
1031 this_len = prandom_u32_inclusive(rng, 1, remaining);
1032 div->proportion_of_total = this_len;
1034 if (prandom_u32_below(rng, 4) == 0)
1035 div->offset = prandom_u32_inclusive(rng,
1038 else if (prandom_bool(rng))
1039 div->offset = prandom_u32_below(rng, 32);
1041 div->offset = prandom_u32_below(rng, PAGE_SIZE);
1042 if (prandom_u32_below(rng, 8) == 0)
1043 div->offset_relative_to_alignmask = true;
1045 div->flush_type = FLUSH_TYPE_NONE;
1047 switch (prandom_u32_below(rng, 4)) {
1049 div->flush_type = FLUSH_TYPE_REIMPORT;
1052 div->flush_type = FLUSH_TYPE_FLUSH;
1057 if (div->flush_type != FLUSH_TYPE_NONE &&
1058 !(req_flags & CRYPTO_TFM_REQ_MAY_SLEEP) &&
1062 switch (div->flush_type) {
1063 case FLUSH_TYPE_FLUSH:
1065 flushtype_str = "<flush,nosimd>";
1067 flushtype_str = "<flush>";
1069 case FLUSH_TYPE_REIMPORT:
1071 flushtype_str = "<reimport,nosimd>";
1073 flushtype_str = "<reimport>";
1080 BUILD_BUG_ON(TEST_SG_TOTAL != 10000); /* for "%u.%u%%" */
1081 p += scnprintf(p, end - p, "%s%u.%u%%@%s+%u%s", flushtype_str,
1082 this_len / 100, this_len % 100,
1083 div->offset_relative_to_alignmask ?
1085 div->offset, this_len == remaining ? "" : ", ");
1086 remaining -= this_len;
1088 } while (remaining);
1093 /* Generate a random testvec_config for fuzz testing */
1094 static void generate_random_testvec_config(struct rnd_state *rng,
1095 struct testvec_config *cfg,
1096 char *name, size_t max_namelen)
1099 char * const end = name + max_namelen;
1101 memset(cfg, 0, sizeof(*cfg));
1105 p += scnprintf(p, end - p, "random:");
1107 switch (prandom_u32_below(rng, 4)) {
1110 cfg->inplace_mode = OUT_OF_PLACE;
1113 cfg->inplace_mode = INPLACE_ONE_SGLIST;
1114 p += scnprintf(p, end - p, " inplace_one_sglist");
1117 cfg->inplace_mode = INPLACE_TWO_SGLISTS;
1118 p += scnprintf(p, end - p, " inplace_two_sglists");
1122 if (prandom_bool(rng)) {
1123 cfg->req_flags |= CRYPTO_TFM_REQ_MAY_SLEEP;
1124 p += scnprintf(p, end - p, " may_sleep");
1127 switch (prandom_u32_below(rng, 4)) {
1129 cfg->finalization_type = FINALIZATION_TYPE_FINAL;
1130 p += scnprintf(p, end - p, " use_final");
1133 cfg->finalization_type = FINALIZATION_TYPE_FINUP;
1134 p += scnprintf(p, end - p, " use_finup");
1137 cfg->finalization_type = FINALIZATION_TYPE_DIGEST;
1138 p += scnprintf(p, end - p, " use_digest");
1142 if (!(cfg->req_flags & CRYPTO_TFM_REQ_MAY_SLEEP)) {
1143 if (prandom_bool(rng)) {
1145 p += scnprintf(p, end - p, " nosimd");
1147 if (prandom_bool(rng)) {
1148 cfg->nosimd_setkey = true;
1149 p += scnprintf(p, end - p, " nosimd_setkey");
1153 p += scnprintf(p, end - p, " src_divs=[");
1154 p = generate_random_sgl_divisions(rng, cfg->src_divs,
1155 ARRAY_SIZE(cfg->src_divs), p, end,
1156 (cfg->finalization_type !=
1157 FINALIZATION_TYPE_DIGEST),
1159 p += scnprintf(p, end - p, "]");
1161 if (cfg->inplace_mode == OUT_OF_PLACE && prandom_bool(rng)) {
1162 p += scnprintf(p, end - p, " dst_divs=[");
1163 p = generate_random_sgl_divisions(rng, cfg->dst_divs,
1164 ARRAY_SIZE(cfg->dst_divs),
1167 p += scnprintf(p, end - p, "]");
1170 if (prandom_bool(rng)) {
1171 cfg->iv_offset = prandom_u32_inclusive(rng, 1,
1172 MAX_ALGAPI_ALIGNMASK);
1173 p += scnprintf(p, end - p, " iv_offset=%u", cfg->iv_offset);
1176 if (prandom_bool(rng)) {
1177 cfg->key_offset = prandom_u32_inclusive(rng, 1,
1178 MAX_ALGAPI_ALIGNMASK);
1179 p += scnprintf(p, end - p, " key_offset=%u", cfg->key_offset);
1182 WARN_ON_ONCE(!valid_testvec_config(cfg));
1185 static void crypto_disable_simd_for_test(void)
1188 __this_cpu_write(crypto_simd_disabled_for_test, true);
1191 static void crypto_reenable_simd_for_test(void)
1193 __this_cpu_write(crypto_simd_disabled_for_test, false);
1198 * Given an algorithm name, build the name of the generic implementation of that
1199 * algorithm, assuming the usual naming convention. Specifically, this appends
1200 * "-generic" to every part of the name that is not a template name. Examples:
1202 * aes => aes-generic
1203 * cbc(aes) => cbc(aes-generic)
1204 * cts(cbc(aes)) => cts(cbc(aes-generic))
1205 * rfc7539(chacha20,poly1305) => rfc7539(chacha20-generic,poly1305-generic)
1207 * Return: 0 on success, or -ENAMETOOLONG if the generic name would be too long
1209 static int build_generic_driver_name(const char *algname,
1210 char driver_name[CRYPTO_MAX_ALG_NAME])
1212 const char *in = algname;
1213 char *out = driver_name;
1214 size_t len = strlen(algname);
1216 if (len >= CRYPTO_MAX_ALG_NAME)
1219 const char *in_saved = in;
1221 while (*in && *in != '(' && *in != ')' && *in != ',')
1223 if (*in != '(' && in > in_saved) {
1225 if (len >= CRYPTO_MAX_ALG_NAME)
1227 memcpy(out, "-generic", 8);
1230 } while ((*out++ = *in++) != '\0');
1234 pr_err("alg: generic driver name for \"%s\" would be too long\n",
1236 return -ENAMETOOLONG;
1238 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1239 static void crypto_disable_simd_for_test(void)
1243 static void crypto_reenable_simd_for_test(void)
1246 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1248 static int build_hash_sglist(struct test_sglist *tsgl,
1249 const struct hash_testvec *vec,
1250 const struct testvec_config *cfg,
1251 unsigned int alignmask,
1252 const struct test_sg_division *divs[XBUFSIZE])
1255 struct iov_iter input;
1257 kv.iov_base = (void *)vec->plaintext;
1258 kv.iov_len = vec->psize;
1259 iov_iter_kvec(&input, ITER_SOURCE, &kv, 1, vec->psize);
1260 return build_test_sglist(tsgl, cfg->src_divs, alignmask, vec->psize,
1264 static int check_hash_result(const char *type,
1265 const u8 *result, unsigned int digestsize,
1266 const struct hash_testvec *vec,
1267 const char *vec_name,
1269 const struct testvec_config *cfg)
1271 if (memcmp(result, vec->digest, digestsize) != 0) {
1272 pr_err("alg: %s: %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
1273 type, driver, vec_name, cfg->name);
1276 if (!testmgr_is_poison(&result[digestsize], TESTMGR_POISON_LEN)) {
1277 pr_err("alg: %s: %s overran result buffer on test vector %s, cfg=\"%s\"\n",
1278 type, driver, vec_name, cfg->name);
1284 static inline int check_shash_op(const char *op, int err,
1285 const char *driver, const char *vec_name,
1286 const struct testvec_config *cfg)
1289 pr_err("alg: shash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n",
1290 driver, op, err, vec_name, cfg->name);
1294 /* Test one hash test vector in one configuration, using the shash API */
1295 static int test_shash_vec_cfg(const struct hash_testvec *vec,
1296 const char *vec_name,
1297 const struct testvec_config *cfg,
1298 struct shash_desc *desc,
1299 struct test_sglist *tsgl,
1302 struct crypto_shash *tfm = desc->tfm;
1303 const unsigned int digestsize = crypto_shash_digestsize(tfm);
1304 const unsigned int statesize = crypto_shash_statesize(tfm);
1305 const char *driver = crypto_shash_driver_name(tfm);
1306 const struct test_sg_division *divs[XBUFSIZE];
1308 u8 result[HASH_MAX_DIGESTSIZE + TESTMGR_POISON_LEN];
1311 /* Set the key, if specified */
1313 err = do_setkey(crypto_shash_setkey, tfm, vec->key, vec->ksize,
1316 if (err == vec->setkey_error)
1318 pr_err("alg: shash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
1319 driver, vec_name, vec->setkey_error, err,
1320 crypto_shash_get_flags(tfm));
1323 if (vec->setkey_error) {
1324 pr_err("alg: shash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
1325 driver, vec_name, vec->setkey_error);
1330 /* Build the scatterlist for the source data */
1331 err = build_hash_sglist(tsgl, vec, cfg, 0, divs);
1333 pr_err("alg: shash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n",
1334 driver, vec_name, cfg->name);
1338 /* Do the actual hashing */
1340 testmgr_poison(desc->__ctx, crypto_shash_descsize(tfm));
1341 testmgr_poison(result, digestsize + TESTMGR_POISON_LEN);
1343 if (cfg->finalization_type == FINALIZATION_TYPE_DIGEST ||
1344 vec->digest_error) {
1345 /* Just using digest() */
1346 if (tsgl->nents != 1)
1349 crypto_disable_simd_for_test();
1350 err = crypto_shash_digest(desc, sg_virt(&tsgl->sgl[0]),
1351 tsgl->sgl[0].length, result);
1353 crypto_reenable_simd_for_test();
1355 if (err == vec->digest_error)
1357 pr_err("alg: shash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
1358 driver, vec_name, vec->digest_error, err,
1362 if (vec->digest_error) {
1363 pr_err("alg: shash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
1364 driver, vec_name, vec->digest_error, cfg->name);
1370 /* Using init(), zero or more update(), then final() or finup() */
1373 crypto_disable_simd_for_test();
1374 err = crypto_shash_init(desc);
1376 crypto_reenable_simd_for_test();
1377 err = check_shash_op("init", err, driver, vec_name, cfg);
1381 for (i = 0; i < tsgl->nents; i++) {
1382 if (i + 1 == tsgl->nents &&
1383 cfg->finalization_type == FINALIZATION_TYPE_FINUP) {
1384 if (divs[i]->nosimd)
1385 crypto_disable_simd_for_test();
1386 err = crypto_shash_finup(desc, sg_virt(&tsgl->sgl[i]),
1387 tsgl->sgl[i].length, result);
1388 if (divs[i]->nosimd)
1389 crypto_reenable_simd_for_test();
1390 err = check_shash_op("finup", err, driver, vec_name,
1396 if (divs[i]->nosimd)
1397 crypto_disable_simd_for_test();
1398 err = crypto_shash_update(desc, sg_virt(&tsgl->sgl[i]),
1399 tsgl->sgl[i].length);
1400 if (divs[i]->nosimd)
1401 crypto_reenable_simd_for_test();
1402 err = check_shash_op("update", err, driver, vec_name, cfg);
1405 if (divs[i]->flush_type == FLUSH_TYPE_REIMPORT) {
1406 /* Test ->export() and ->import() */
1407 testmgr_poison(hashstate + statesize,
1408 TESTMGR_POISON_LEN);
1409 err = crypto_shash_export(desc, hashstate);
1410 err = check_shash_op("export", err, driver, vec_name,
1414 if (!testmgr_is_poison(hashstate + statesize,
1415 TESTMGR_POISON_LEN)) {
1416 pr_err("alg: shash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n",
1417 driver, vec_name, cfg->name);
1420 testmgr_poison(desc->__ctx, crypto_shash_descsize(tfm));
1421 err = crypto_shash_import(desc, hashstate);
1422 err = check_shash_op("import", err, driver, vec_name,
1430 crypto_disable_simd_for_test();
1431 err = crypto_shash_final(desc, result);
1433 crypto_reenable_simd_for_test();
1434 err = check_shash_op("final", err, driver, vec_name, cfg);
1438 return check_hash_result("shash", result, digestsize, vec, vec_name,
1442 static int do_ahash_op(int (*op)(struct ahash_request *req),
1443 struct ahash_request *req,
1444 struct crypto_wait *wait, bool nosimd)
1449 crypto_disable_simd_for_test();
1454 crypto_reenable_simd_for_test();
1456 return crypto_wait_req(err, wait);
1459 static int check_nonfinal_ahash_op(const char *op, int err,
1460 u8 *result, unsigned int digestsize,
1461 const char *driver, const char *vec_name,
1462 const struct testvec_config *cfg)
1465 pr_err("alg: ahash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n",
1466 driver, op, err, vec_name, cfg->name);
1469 if (!testmgr_is_poison(result, digestsize)) {
1470 pr_err("alg: ahash: %s %s() used result buffer on test vector %s, cfg=\"%s\"\n",
1471 driver, op, vec_name, cfg->name);
1477 /* Test one hash test vector in one configuration, using the ahash API */
1478 static int test_ahash_vec_cfg(const struct hash_testvec *vec,
1479 const char *vec_name,
1480 const struct testvec_config *cfg,
1481 struct ahash_request *req,
1482 struct test_sglist *tsgl,
1485 struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
1486 const unsigned int digestsize = crypto_ahash_digestsize(tfm);
1487 const unsigned int statesize = crypto_ahash_statesize(tfm);
1488 const char *driver = crypto_ahash_driver_name(tfm);
1489 const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
1490 const struct test_sg_division *divs[XBUFSIZE];
1491 DECLARE_CRYPTO_WAIT(wait);
1493 struct scatterlist *pending_sgl;
1494 unsigned int pending_len;
1495 u8 result[HASH_MAX_DIGESTSIZE + TESTMGR_POISON_LEN];
1498 /* Set the key, if specified */
1500 err = do_setkey(crypto_ahash_setkey, tfm, vec->key, vec->ksize,
1503 if (err == vec->setkey_error)
1505 pr_err("alg: ahash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
1506 driver, vec_name, vec->setkey_error, err,
1507 crypto_ahash_get_flags(tfm));
1510 if (vec->setkey_error) {
1511 pr_err("alg: ahash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
1512 driver, vec_name, vec->setkey_error);
1517 /* Build the scatterlist for the source data */
1518 err = build_hash_sglist(tsgl, vec, cfg, 0, divs);
1520 pr_err("alg: ahash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n",
1521 driver, vec_name, cfg->name);
1525 /* Do the actual hashing */
1527 testmgr_poison(req->__ctx, crypto_ahash_reqsize(tfm));
1528 testmgr_poison(result, digestsize + TESTMGR_POISON_LEN);
1530 if (cfg->finalization_type == FINALIZATION_TYPE_DIGEST ||
1531 vec->digest_error) {
1532 /* Just using digest() */
1533 ahash_request_set_callback(req, req_flags, crypto_req_done,
1535 ahash_request_set_crypt(req, tsgl->sgl, result, vec->psize);
1536 err = do_ahash_op(crypto_ahash_digest, req, &wait, cfg->nosimd);
1538 if (err == vec->digest_error)
1540 pr_err("alg: ahash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
1541 driver, vec_name, vec->digest_error, err,
1545 if (vec->digest_error) {
1546 pr_err("alg: ahash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
1547 driver, vec_name, vec->digest_error, cfg->name);
1553 /* Using init(), zero or more update(), then final() or finup() */
1555 ahash_request_set_callback(req, req_flags, crypto_req_done, &wait);
1556 ahash_request_set_crypt(req, NULL, result, 0);
1557 err = do_ahash_op(crypto_ahash_init, req, &wait, cfg->nosimd);
1558 err = check_nonfinal_ahash_op("init", err, result, digestsize,
1559 driver, vec_name, cfg);
1565 for (i = 0; i < tsgl->nents; i++) {
1566 if (divs[i]->flush_type != FLUSH_TYPE_NONE &&
1567 pending_sgl != NULL) {
1568 /* update() with the pending data */
1569 ahash_request_set_callback(req, req_flags,
1570 crypto_req_done, &wait);
1571 ahash_request_set_crypt(req, pending_sgl, result,
1573 err = do_ahash_op(crypto_ahash_update, req, &wait,
1575 err = check_nonfinal_ahash_op("update", err,
1577 driver, vec_name, cfg);
1583 if (divs[i]->flush_type == FLUSH_TYPE_REIMPORT) {
1584 /* Test ->export() and ->import() */
1585 testmgr_poison(hashstate + statesize,
1586 TESTMGR_POISON_LEN);
1587 err = crypto_ahash_export(req, hashstate);
1588 err = check_nonfinal_ahash_op("export", err,
1590 driver, vec_name, cfg);
1593 if (!testmgr_is_poison(hashstate + statesize,
1594 TESTMGR_POISON_LEN)) {
1595 pr_err("alg: ahash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n",
1596 driver, vec_name, cfg->name);
1600 testmgr_poison(req->__ctx, crypto_ahash_reqsize(tfm));
1601 err = crypto_ahash_import(req, hashstate);
1602 err = check_nonfinal_ahash_op("import", err,
1604 driver, vec_name, cfg);
1608 if (pending_sgl == NULL)
1609 pending_sgl = &tsgl->sgl[i];
1610 pending_len += tsgl->sgl[i].length;
1613 ahash_request_set_callback(req, req_flags, crypto_req_done, &wait);
1614 ahash_request_set_crypt(req, pending_sgl, result, pending_len);
1615 if (cfg->finalization_type == FINALIZATION_TYPE_FINAL) {
1616 /* finish with update() and final() */
1617 err = do_ahash_op(crypto_ahash_update, req, &wait, cfg->nosimd);
1618 err = check_nonfinal_ahash_op("update", err, result, digestsize,
1619 driver, vec_name, cfg);
1622 err = do_ahash_op(crypto_ahash_final, req, &wait, cfg->nosimd);
1624 pr_err("alg: ahash: %s final() failed with err %d on test vector %s, cfg=\"%s\"\n",
1625 driver, err, vec_name, cfg->name);
1629 /* finish with finup() */
1630 err = do_ahash_op(crypto_ahash_finup, req, &wait, cfg->nosimd);
1632 pr_err("alg: ahash: %s finup() failed with err %d on test vector %s, cfg=\"%s\"\n",
1633 driver, err, vec_name, cfg->name);
1639 return check_hash_result("ahash", result, digestsize, vec, vec_name,
1643 static int test_hash_vec_cfg(const struct hash_testvec *vec,
1644 const char *vec_name,
1645 const struct testvec_config *cfg,
1646 struct ahash_request *req,
1647 struct shash_desc *desc,
1648 struct test_sglist *tsgl,
1654 * For algorithms implemented as "shash", most bugs will be detected by
1655 * both the shash and ahash tests. Test the shash API first so that the
1656 * failures involve less indirection, so are easier to debug.
1660 err = test_shash_vec_cfg(vec, vec_name, cfg, desc, tsgl,
1666 return test_ahash_vec_cfg(vec, vec_name, cfg, req, tsgl, hashstate);
1669 static int test_hash_vec(const struct hash_testvec *vec, unsigned int vec_num,
1670 struct ahash_request *req, struct shash_desc *desc,
1671 struct test_sglist *tsgl, u8 *hashstate)
1677 sprintf(vec_name, "%u", vec_num);
1679 for (i = 0; i < ARRAY_SIZE(default_hash_testvec_configs); i++) {
1680 err = test_hash_vec_cfg(vec, vec_name,
1681 &default_hash_testvec_configs[i],
1682 req, desc, tsgl, hashstate);
1687 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
1688 if (!noextratests) {
1689 struct rnd_state rng;
1690 struct testvec_config cfg;
1691 char cfgname[TESTVEC_CONFIG_NAMELEN];
1693 init_rnd_state(&rng);
1695 for (i = 0; i < fuzz_iterations; i++) {
1696 generate_random_testvec_config(&rng, &cfg, cfgname,
1698 err = test_hash_vec_cfg(vec, vec_name, &cfg,
1699 req, desc, tsgl, hashstate);
1709 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
1711 * Generate a hash test vector from the given implementation.
1712 * Assumes the buffers in 'vec' were already allocated.
1714 static void generate_random_hash_testvec(struct rnd_state *rng,
1715 struct shash_desc *desc,
1716 struct hash_testvec *vec,
1717 unsigned int maxkeysize,
1718 unsigned int maxdatasize,
1719 char *name, size_t max_namelen)
1722 vec->psize = generate_random_length(rng, maxdatasize);
1723 generate_random_bytes(rng, (u8 *)vec->plaintext, vec->psize);
1726 * Key: length in range [1, maxkeysize], but usually choose maxkeysize.
1727 * If algorithm is unkeyed, then maxkeysize == 0 and set ksize = 0.
1729 vec->setkey_error = 0;
1732 vec->ksize = maxkeysize;
1733 if (prandom_u32_below(rng, 4) == 0)
1734 vec->ksize = prandom_u32_inclusive(rng, 1, maxkeysize);
1735 generate_random_bytes(rng, (u8 *)vec->key, vec->ksize);
1737 vec->setkey_error = crypto_shash_setkey(desc->tfm, vec->key,
1739 /* If the key couldn't be set, no need to continue to digest. */
1740 if (vec->setkey_error)
1745 vec->digest_error = crypto_shash_digest(desc, vec->plaintext,
1746 vec->psize, (u8 *)vec->digest);
1748 snprintf(name, max_namelen, "\"random: psize=%u ksize=%u\"",
1749 vec->psize, vec->ksize);
1753 * Test the hash algorithm represented by @req against the corresponding generic
1754 * implementation, if one is available.
1756 static int test_hash_vs_generic_impl(const char *generic_driver,
1757 unsigned int maxkeysize,
1758 struct ahash_request *req,
1759 struct shash_desc *desc,
1760 struct test_sglist *tsgl,
1763 struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
1764 const unsigned int digestsize = crypto_ahash_digestsize(tfm);
1765 const unsigned int blocksize = crypto_ahash_blocksize(tfm);
1766 const unsigned int maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN;
1767 const char *algname = crypto_hash_alg_common(tfm)->base.cra_name;
1768 const char *driver = crypto_ahash_driver_name(tfm);
1769 struct rnd_state rng;
1770 char _generic_driver[CRYPTO_MAX_ALG_NAME];
1771 struct crypto_shash *generic_tfm = NULL;
1772 struct shash_desc *generic_desc = NULL;
1774 struct hash_testvec vec = { 0 };
1776 struct testvec_config *cfg;
1777 char cfgname[TESTVEC_CONFIG_NAMELEN];
1783 init_rnd_state(&rng);
1785 if (!generic_driver) { /* Use default naming convention? */
1786 err = build_generic_driver_name(algname, _generic_driver);
1789 generic_driver = _generic_driver;
1792 if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */
1795 generic_tfm = crypto_alloc_shash(generic_driver, 0, 0);
1796 if (IS_ERR(generic_tfm)) {
1797 err = PTR_ERR(generic_tfm);
1798 if (err == -ENOENT) {
1799 pr_warn("alg: hash: skipping comparison tests for %s because %s is unavailable\n",
1800 driver, generic_driver);
1803 pr_err("alg: hash: error allocating %s (generic impl of %s): %d\n",
1804 generic_driver, algname, err);
1808 cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
1814 generic_desc = kzalloc(sizeof(*desc) +
1815 crypto_shash_descsize(generic_tfm), GFP_KERNEL);
1816 if (!generic_desc) {
1820 generic_desc->tfm = generic_tfm;
1822 /* Check the algorithm properties for consistency. */
1824 if (digestsize != crypto_shash_digestsize(generic_tfm)) {
1825 pr_err("alg: hash: digestsize for %s (%u) doesn't match generic impl (%u)\n",
1827 crypto_shash_digestsize(generic_tfm));
1832 if (blocksize != crypto_shash_blocksize(generic_tfm)) {
1833 pr_err("alg: hash: blocksize for %s (%u) doesn't match generic impl (%u)\n",
1834 driver, blocksize, crypto_shash_blocksize(generic_tfm));
1840 * Now generate test vectors using the generic implementation, and test
1841 * the other implementation against them.
1844 vec.key = kmalloc(maxkeysize, GFP_KERNEL);
1845 vec.plaintext = kmalloc(maxdatasize, GFP_KERNEL);
1846 vec.digest = kmalloc(digestsize, GFP_KERNEL);
1847 if (!vec.key || !vec.plaintext || !vec.digest) {
1852 for (i = 0; i < fuzz_iterations * 8; i++) {
1853 generate_random_hash_testvec(&rng, generic_desc, &vec,
1854 maxkeysize, maxdatasize,
1855 vec_name, sizeof(vec_name));
1856 generate_random_testvec_config(&rng, cfg, cfgname,
1859 err = test_hash_vec_cfg(&vec, vec_name, cfg,
1860 req, desc, tsgl, hashstate);
1869 kfree(vec.plaintext);
1871 crypto_free_shash(generic_tfm);
1872 kfree_sensitive(generic_desc);
1875 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1876 static int test_hash_vs_generic_impl(const char *generic_driver,
1877 unsigned int maxkeysize,
1878 struct ahash_request *req,
1879 struct shash_desc *desc,
1880 struct test_sglist *tsgl,
1885 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1887 static int alloc_shash(const char *driver, u32 type, u32 mask,
1888 struct crypto_shash **tfm_ret,
1889 struct shash_desc **desc_ret)
1891 struct crypto_shash *tfm;
1892 struct shash_desc *desc;
1894 tfm = crypto_alloc_shash(driver, type, mask);
1896 if (PTR_ERR(tfm) == -ENOENT) {
1898 * This algorithm is only available through the ahash
1899 * API, not the shash API, so skip the shash tests.
1903 pr_err("alg: hash: failed to allocate shash transform for %s: %ld\n",
1904 driver, PTR_ERR(tfm));
1905 return PTR_ERR(tfm);
1908 desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(tfm), GFP_KERNEL);
1910 crypto_free_shash(tfm);
1920 static int __alg_test_hash(const struct hash_testvec *vecs,
1921 unsigned int num_vecs, const char *driver,
1923 const char *generic_driver, unsigned int maxkeysize)
1925 struct crypto_ahash *atfm = NULL;
1926 struct ahash_request *req = NULL;
1927 struct crypto_shash *stfm = NULL;
1928 struct shash_desc *desc = NULL;
1929 struct test_sglist *tsgl = NULL;
1930 u8 *hashstate = NULL;
1931 unsigned int statesize;
1936 * Always test the ahash API. This works regardless of whether the
1937 * algorithm is implemented as ahash or shash.
1940 atfm = crypto_alloc_ahash(driver, type, mask);
1942 if (PTR_ERR(atfm) == -ENOENT)
1944 pr_err("alg: hash: failed to allocate transform for %s: %ld\n",
1945 driver, PTR_ERR(atfm));
1946 return PTR_ERR(atfm);
1948 driver = crypto_ahash_driver_name(atfm);
1950 req = ahash_request_alloc(atfm, GFP_KERNEL);
1952 pr_err("alg: hash: failed to allocate request for %s\n",
1959 * If available also test the shash API, to cover corner cases that may
1960 * be missed by testing the ahash API only.
1962 err = alloc_shash(driver, type, mask, &stfm, &desc);
1966 tsgl = kmalloc(sizeof(*tsgl), GFP_KERNEL);
1967 if (!tsgl || init_test_sglist(tsgl) != 0) {
1968 pr_err("alg: hash: failed to allocate test buffers for %s\n",
1976 statesize = crypto_ahash_statesize(atfm);
1978 statesize = max(statesize, crypto_shash_statesize(stfm));
1979 hashstate = kmalloc(statesize + TESTMGR_POISON_LEN, GFP_KERNEL);
1981 pr_err("alg: hash: failed to allocate hash state buffer for %s\n",
1987 for (i = 0; i < num_vecs; i++) {
1988 if (fips_enabled && vecs[i].fips_skip)
1991 err = test_hash_vec(&vecs[i], i, req, desc, tsgl, hashstate);
1996 err = test_hash_vs_generic_impl(generic_driver, maxkeysize, req,
1997 desc, tsgl, hashstate);
2001 destroy_test_sglist(tsgl);
2005 crypto_free_shash(stfm);
2006 ahash_request_free(req);
2007 crypto_free_ahash(atfm);
2011 static int alg_test_hash(const struct alg_test_desc *desc, const char *driver,
2014 const struct hash_testvec *template = desc->suite.hash.vecs;
2015 unsigned int tcount = desc->suite.hash.count;
2016 unsigned int nr_unkeyed, nr_keyed;
2017 unsigned int maxkeysize = 0;
2021 * For OPTIONAL_KEY algorithms, we have to do all the unkeyed tests
2022 * first, before setting a key on the tfm. To make this easier, we
2023 * require that the unkeyed test vectors (if any) are listed first.
2026 for (nr_unkeyed = 0; nr_unkeyed < tcount; nr_unkeyed++) {
2027 if (template[nr_unkeyed].ksize)
2030 for (nr_keyed = 0; nr_unkeyed + nr_keyed < tcount; nr_keyed++) {
2031 if (!template[nr_unkeyed + nr_keyed].ksize) {
2032 pr_err("alg: hash: test vectors for %s out of order, "
2033 "unkeyed ones must come first\n", desc->alg);
2036 maxkeysize = max_t(unsigned int, maxkeysize,
2037 template[nr_unkeyed + nr_keyed].ksize);
2042 err = __alg_test_hash(template, nr_unkeyed, driver, type, mask,
2043 desc->generic_driver, maxkeysize);
2044 template += nr_unkeyed;
2047 if (!err && nr_keyed)
2048 err = __alg_test_hash(template, nr_keyed, driver, type, mask,
2049 desc->generic_driver, maxkeysize);
2054 static int test_aead_vec_cfg(int enc, const struct aead_testvec *vec,
2055 const char *vec_name,
2056 const struct testvec_config *cfg,
2057 struct aead_request *req,
2058 struct cipher_test_sglists *tsgls)
2060 struct crypto_aead *tfm = crypto_aead_reqtfm(req);
2061 const unsigned int alignmask = crypto_aead_alignmask(tfm);
2062 const unsigned int ivsize = crypto_aead_ivsize(tfm);
2063 const unsigned int authsize = vec->clen - vec->plen;
2064 const char *driver = crypto_aead_driver_name(tfm);
2065 const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
2066 const char *op = enc ? "encryption" : "decryption";
2067 DECLARE_CRYPTO_WAIT(wait);
2068 u8 _iv[3 * (MAX_ALGAPI_ALIGNMASK + 1) + MAX_IVLEN];
2069 u8 *iv = PTR_ALIGN(&_iv[0], 2 * (MAX_ALGAPI_ALIGNMASK + 1)) +
2071 (cfg->iv_offset_relative_to_alignmask ? alignmask : 0);
2072 struct kvec input[2];
2077 crypto_aead_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2079 crypto_aead_clear_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2081 err = do_setkey(crypto_aead_setkey, tfm, vec->key, vec->klen,
2083 if (err && err != vec->setkey_error) {
2084 pr_err("alg: aead: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
2085 driver, vec_name, vec->setkey_error, err,
2086 crypto_aead_get_flags(tfm));
2089 if (!err && vec->setkey_error) {
2090 pr_err("alg: aead: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
2091 driver, vec_name, vec->setkey_error);
2095 /* Set the authentication tag size */
2096 err = crypto_aead_setauthsize(tfm, authsize);
2097 if (err && err != vec->setauthsize_error) {
2098 pr_err("alg: aead: %s setauthsize failed on test vector %s; expected_error=%d, actual_error=%d\n",
2099 driver, vec_name, vec->setauthsize_error, err);
2102 if (!err && vec->setauthsize_error) {
2103 pr_err("alg: aead: %s setauthsize unexpectedly succeeded on test vector %s; expected_error=%d\n",
2104 driver, vec_name, vec->setauthsize_error);
2108 if (vec->setkey_error || vec->setauthsize_error)
2111 /* The IV must be copied to a buffer, as the algorithm may modify it */
2112 if (WARN_ON(ivsize > MAX_IVLEN))
2115 memcpy(iv, vec->iv, ivsize);
2117 memset(iv, 0, ivsize);
2119 /* Build the src/dst scatterlists */
2120 input[0].iov_base = (void *)vec->assoc;
2121 input[0].iov_len = vec->alen;
2122 input[1].iov_base = enc ? (void *)vec->ptext : (void *)vec->ctext;
2123 input[1].iov_len = enc ? vec->plen : vec->clen;
2124 err = build_cipher_test_sglists(tsgls, cfg, alignmask,
2125 vec->alen + (enc ? vec->plen :
2127 vec->alen + (enc ? vec->clen :
2131 pr_err("alg: aead: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n",
2132 driver, op, vec_name, cfg->name);
2136 /* Do the actual encryption or decryption */
2137 testmgr_poison(req->__ctx, crypto_aead_reqsize(tfm));
2138 aead_request_set_callback(req, req_flags, crypto_req_done, &wait);
2139 aead_request_set_crypt(req, tsgls->src.sgl_ptr, tsgls->dst.sgl_ptr,
2140 enc ? vec->plen : vec->clen, iv);
2141 aead_request_set_ad(req, vec->alen);
2143 crypto_disable_simd_for_test();
2144 err = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);
2146 crypto_reenable_simd_for_test();
2147 err = crypto_wait_req(err, &wait);
2149 /* Check that the algorithm didn't overwrite things it shouldn't have */
2150 if (req->cryptlen != (enc ? vec->plen : vec->clen) ||
2151 req->assoclen != vec->alen ||
2153 req->src != tsgls->src.sgl_ptr ||
2154 req->dst != tsgls->dst.sgl_ptr ||
2155 crypto_aead_reqtfm(req) != tfm ||
2156 req->base.complete != crypto_req_done ||
2157 req->base.flags != req_flags ||
2158 req->base.data != &wait) {
2159 pr_err("alg: aead: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n",
2160 driver, op, vec_name, cfg->name);
2161 if (req->cryptlen != (enc ? vec->plen : vec->clen))
2162 pr_err("alg: aead: changed 'req->cryptlen'\n");
2163 if (req->assoclen != vec->alen)
2164 pr_err("alg: aead: changed 'req->assoclen'\n");
2166 pr_err("alg: aead: changed 'req->iv'\n");
2167 if (req->src != tsgls->src.sgl_ptr)
2168 pr_err("alg: aead: changed 'req->src'\n");
2169 if (req->dst != tsgls->dst.sgl_ptr)
2170 pr_err("alg: aead: changed 'req->dst'\n");
2171 if (crypto_aead_reqtfm(req) != tfm)
2172 pr_err("alg: aead: changed 'req->base.tfm'\n");
2173 if (req->base.complete != crypto_req_done)
2174 pr_err("alg: aead: changed 'req->base.complete'\n");
2175 if (req->base.flags != req_flags)
2176 pr_err("alg: aead: changed 'req->base.flags'\n");
2177 if (req->base.data != &wait)
2178 pr_err("alg: aead: changed 'req->base.data'\n");
2181 if (is_test_sglist_corrupted(&tsgls->src)) {
2182 pr_err("alg: aead: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n",
2183 driver, op, vec_name, cfg->name);
2186 if (tsgls->dst.sgl_ptr != tsgls->src.sgl &&
2187 is_test_sglist_corrupted(&tsgls->dst)) {
2188 pr_err("alg: aead: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n",
2189 driver, op, vec_name, cfg->name);
2193 /* Check for unexpected success or failure, or wrong error code */
2194 if ((err == 0 && vec->novrfy) ||
2195 (err != vec->crypt_error && !(err == -EBADMSG && vec->novrfy))) {
2196 char expected_error[32];
2199 vec->crypt_error != 0 && vec->crypt_error != -EBADMSG)
2200 sprintf(expected_error, "-EBADMSG or %d",
2202 else if (vec->novrfy)
2203 sprintf(expected_error, "-EBADMSG");
2205 sprintf(expected_error, "%d", vec->crypt_error);
2207 pr_err("alg: aead: %s %s failed on test vector %s; expected_error=%s, actual_error=%d, cfg=\"%s\"\n",
2208 driver, op, vec_name, expected_error, err,
2212 pr_err("alg: aead: %s %s unexpectedly succeeded on test vector %s; expected_error=%s, cfg=\"%s\"\n",
2213 driver, op, vec_name, expected_error, cfg->name);
2216 if (err) /* Expectedly failed. */
2219 /* Check for the correct output (ciphertext or plaintext) */
2220 err = verify_correct_output(&tsgls->dst, enc ? vec->ctext : vec->ptext,
2221 enc ? vec->clen : vec->plen,
2223 enc || cfg->inplace_mode == OUT_OF_PLACE);
2224 if (err == -EOVERFLOW) {
2225 pr_err("alg: aead: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n",
2226 driver, op, vec_name, cfg->name);
2230 pr_err("alg: aead: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
2231 driver, op, vec_name, cfg->name);
2238 static int test_aead_vec(int enc, const struct aead_testvec *vec,
2239 unsigned int vec_num, struct aead_request *req,
2240 struct cipher_test_sglists *tsgls)
2246 if (enc && vec->novrfy)
2249 sprintf(vec_name, "%u", vec_num);
2251 for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) {
2252 err = test_aead_vec_cfg(enc, vec, vec_name,
2253 &default_cipher_testvec_configs[i],
2259 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2260 if (!noextratests) {
2261 struct rnd_state rng;
2262 struct testvec_config cfg;
2263 char cfgname[TESTVEC_CONFIG_NAMELEN];
2265 init_rnd_state(&rng);
2267 for (i = 0; i < fuzz_iterations; i++) {
2268 generate_random_testvec_config(&rng, &cfg, cfgname,
2270 err = test_aead_vec_cfg(enc, vec, vec_name,
2281 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2283 struct aead_extra_tests_ctx {
2284 struct rnd_state rng;
2285 struct aead_request *req;
2286 struct crypto_aead *tfm;
2287 const struct alg_test_desc *test_desc;
2288 struct cipher_test_sglists *tsgls;
2289 unsigned int maxdatasize;
2290 unsigned int maxkeysize;
2292 struct aead_testvec vec;
2294 char cfgname[TESTVEC_CONFIG_NAMELEN];
2295 struct testvec_config cfg;
2299 * Make at least one random change to a (ciphertext, AAD) pair. "Ciphertext"
2300 * here means the full ciphertext including the authentication tag. The
2301 * authentication tag (and hence also the ciphertext) is assumed to be nonempty.
2303 static void mutate_aead_message(struct rnd_state *rng,
2304 struct aead_testvec *vec, bool aad_iv,
2305 unsigned int ivsize)
2307 const unsigned int aad_tail_size = aad_iv ? ivsize : 0;
2308 const unsigned int authsize = vec->clen - vec->plen;
2310 if (prandom_bool(rng) && vec->alen > aad_tail_size) {
2311 /* Mutate the AAD */
2312 flip_random_bit(rng, (u8 *)vec->assoc,
2313 vec->alen - aad_tail_size);
2314 if (prandom_bool(rng))
2317 if (prandom_bool(rng)) {
2318 /* Mutate auth tag (assuming it's at the end of ciphertext) */
2319 flip_random_bit(rng, (u8 *)vec->ctext + vec->plen, authsize);
2321 /* Mutate any part of the ciphertext */
2322 flip_random_bit(rng, (u8 *)vec->ctext, vec->clen);
2327 * Minimum authentication tag size in bytes at which we assume that we can
2328 * reliably generate inauthentic messages, i.e. not generate an authentic
2329 * message by chance.
2331 #define MIN_COLLISION_FREE_AUTHSIZE 8
2333 static void generate_aead_message(struct rnd_state *rng,
2334 struct aead_request *req,
2335 const struct aead_test_suite *suite,
2336 struct aead_testvec *vec,
2337 bool prefer_inauthentic)
2339 struct crypto_aead *tfm = crypto_aead_reqtfm(req);
2340 const unsigned int ivsize = crypto_aead_ivsize(tfm);
2341 const unsigned int authsize = vec->clen - vec->plen;
2342 const bool inauthentic = (authsize >= MIN_COLLISION_FREE_AUTHSIZE) &&
2343 (prefer_inauthentic ||
2344 prandom_u32_below(rng, 4) == 0);
2346 /* Generate the AAD. */
2347 generate_random_bytes(rng, (u8 *)vec->assoc, vec->alen);
2348 if (suite->aad_iv && vec->alen >= ivsize)
2349 /* Avoid implementation-defined behavior. */
2350 memcpy((u8 *)vec->assoc + vec->alen - ivsize, vec->iv, ivsize);
2352 if (inauthentic && prandom_bool(rng)) {
2353 /* Generate a random ciphertext. */
2354 generate_random_bytes(rng, (u8 *)vec->ctext, vec->clen);
2357 struct scatterlist src[2], dst;
2359 DECLARE_CRYPTO_WAIT(wait);
2361 /* Generate a random plaintext and encrypt it. */
2362 sg_init_table(src, 2);
2364 sg_set_buf(&src[i++], vec->assoc, vec->alen);
2366 generate_random_bytes(rng, (u8 *)vec->ptext, vec->plen);
2367 sg_set_buf(&src[i++], vec->ptext, vec->plen);
2369 sg_init_one(&dst, vec->ctext, vec->alen + vec->clen);
2370 memcpy(iv, vec->iv, ivsize);
2371 aead_request_set_callback(req, 0, crypto_req_done, &wait);
2372 aead_request_set_crypt(req, src, &dst, vec->plen, iv);
2373 aead_request_set_ad(req, vec->alen);
2374 vec->crypt_error = crypto_wait_req(crypto_aead_encrypt(req),
2376 /* If encryption failed, we're done. */
2377 if (vec->crypt_error != 0)
2379 memmove((u8 *)vec->ctext, vec->ctext + vec->alen, vec->clen);
2383 * Mutate the authentic (ciphertext, AAD) pair to get an
2386 mutate_aead_message(rng, vec, suite->aad_iv, ivsize);
2389 if (suite->einval_allowed)
2390 vec->crypt_error = -EINVAL;
2394 * Generate an AEAD test vector 'vec' using the implementation specified by
2395 * 'req'. The buffers in 'vec' must already be allocated.
2397 * If 'prefer_inauthentic' is true, then this function will generate inauthentic
2398 * test vectors (i.e. vectors with 'vec->novrfy=1') more often.
2400 static void generate_random_aead_testvec(struct rnd_state *rng,
2401 struct aead_request *req,
2402 struct aead_testvec *vec,
2403 const struct aead_test_suite *suite,
2404 unsigned int maxkeysize,
2405 unsigned int maxdatasize,
2406 char *name, size_t max_namelen,
2407 bool prefer_inauthentic)
2409 struct crypto_aead *tfm = crypto_aead_reqtfm(req);
2410 const unsigned int ivsize = crypto_aead_ivsize(tfm);
2411 const unsigned int maxauthsize = crypto_aead_maxauthsize(tfm);
2412 unsigned int authsize;
2413 unsigned int total_len;
2415 /* Key: length in [0, maxkeysize], but usually choose maxkeysize */
2416 vec->klen = maxkeysize;
2417 if (prandom_u32_below(rng, 4) == 0)
2418 vec->klen = prandom_u32_below(rng, maxkeysize + 1);
2419 generate_random_bytes(rng, (u8 *)vec->key, vec->klen);
2420 vec->setkey_error = crypto_aead_setkey(tfm, vec->key, vec->klen);
2423 generate_random_bytes(rng, (u8 *)vec->iv, ivsize);
2425 /* Tag length: in [0, maxauthsize], but usually choose maxauthsize */
2426 authsize = maxauthsize;
2427 if (prandom_u32_below(rng, 4) == 0)
2428 authsize = prandom_u32_below(rng, maxauthsize + 1);
2429 if (prefer_inauthentic && authsize < MIN_COLLISION_FREE_AUTHSIZE)
2430 authsize = MIN_COLLISION_FREE_AUTHSIZE;
2431 if (WARN_ON(authsize > maxdatasize))
2432 authsize = maxdatasize;
2433 maxdatasize -= authsize;
2434 vec->setauthsize_error = crypto_aead_setauthsize(tfm, authsize);
2436 /* AAD, plaintext, and ciphertext lengths */
2437 total_len = generate_random_length(rng, maxdatasize);
2438 if (prandom_u32_below(rng, 4) == 0)
2441 vec->alen = generate_random_length(rng, total_len);
2442 vec->plen = total_len - vec->alen;
2443 vec->clen = vec->plen + authsize;
2446 * Generate the AAD, plaintext, and ciphertext. Not applicable if the
2447 * key or the authentication tag size couldn't be set.
2450 vec->crypt_error = 0;
2451 if (vec->setkey_error == 0 && vec->setauthsize_error == 0)
2452 generate_aead_message(rng, req, suite, vec, prefer_inauthentic);
2453 snprintf(name, max_namelen,
2454 "\"random: alen=%u plen=%u authsize=%u klen=%u novrfy=%d\"",
2455 vec->alen, vec->plen, authsize, vec->klen, vec->novrfy);
2458 static void try_to_generate_inauthentic_testvec(
2459 struct aead_extra_tests_ctx *ctx)
2463 for (i = 0; i < 10; i++) {
2464 generate_random_aead_testvec(&ctx->rng, ctx->req, &ctx->vec,
2465 &ctx->test_desc->suite.aead,
2466 ctx->maxkeysize, ctx->maxdatasize,
2468 sizeof(ctx->vec_name), true);
2469 if (ctx->vec.novrfy)
2475 * Generate inauthentic test vectors (i.e. ciphertext, AAD pairs that aren't the
2476 * result of an encryption with the key) and verify that decryption fails.
2478 static int test_aead_inauthentic_inputs(struct aead_extra_tests_ctx *ctx)
2483 for (i = 0; i < fuzz_iterations * 8; i++) {
2485 * Since this part of the tests isn't comparing the
2486 * implementation to another, there's no point in testing any
2487 * test vectors other than inauthentic ones (vec.novrfy=1) here.
2489 * If we're having trouble generating such a test vector, e.g.
2490 * if the algorithm keeps rejecting the generated keys, don't
2491 * retry forever; just continue on.
2493 try_to_generate_inauthentic_testvec(ctx);
2494 if (ctx->vec.novrfy) {
2495 generate_random_testvec_config(&ctx->rng, &ctx->cfg,
2497 sizeof(ctx->cfgname));
2498 err = test_aead_vec_cfg(DECRYPT, &ctx->vec,
2499 ctx->vec_name, &ctx->cfg,
2500 ctx->req, ctx->tsgls);
2510 * Test the AEAD algorithm against the corresponding generic implementation, if
2513 static int test_aead_vs_generic_impl(struct aead_extra_tests_ctx *ctx)
2515 struct crypto_aead *tfm = ctx->tfm;
2516 const char *algname = crypto_aead_alg(tfm)->base.cra_name;
2517 const char *driver = crypto_aead_driver_name(tfm);
2518 const char *generic_driver = ctx->test_desc->generic_driver;
2519 char _generic_driver[CRYPTO_MAX_ALG_NAME];
2520 struct crypto_aead *generic_tfm = NULL;
2521 struct aead_request *generic_req = NULL;
2525 if (!generic_driver) { /* Use default naming convention? */
2526 err = build_generic_driver_name(algname, _generic_driver);
2529 generic_driver = _generic_driver;
2532 if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */
2535 generic_tfm = crypto_alloc_aead(generic_driver, 0, 0);
2536 if (IS_ERR(generic_tfm)) {
2537 err = PTR_ERR(generic_tfm);
2538 if (err == -ENOENT) {
2539 pr_warn("alg: aead: skipping comparison tests for %s because %s is unavailable\n",
2540 driver, generic_driver);
2543 pr_err("alg: aead: error allocating %s (generic impl of %s): %d\n",
2544 generic_driver, algname, err);
2548 generic_req = aead_request_alloc(generic_tfm, GFP_KERNEL);
2554 /* Check the algorithm properties for consistency. */
2556 if (crypto_aead_maxauthsize(tfm) !=
2557 crypto_aead_maxauthsize(generic_tfm)) {
2558 pr_err("alg: aead: maxauthsize for %s (%u) doesn't match generic impl (%u)\n",
2559 driver, crypto_aead_maxauthsize(tfm),
2560 crypto_aead_maxauthsize(generic_tfm));
2565 if (crypto_aead_ivsize(tfm) != crypto_aead_ivsize(generic_tfm)) {
2566 pr_err("alg: aead: ivsize for %s (%u) doesn't match generic impl (%u)\n",
2567 driver, crypto_aead_ivsize(tfm),
2568 crypto_aead_ivsize(generic_tfm));
2573 if (crypto_aead_blocksize(tfm) != crypto_aead_blocksize(generic_tfm)) {
2574 pr_err("alg: aead: blocksize for %s (%u) doesn't match generic impl (%u)\n",
2575 driver, crypto_aead_blocksize(tfm),
2576 crypto_aead_blocksize(generic_tfm));
2582 * Now generate test vectors using the generic implementation, and test
2583 * the other implementation against them.
2585 for (i = 0; i < fuzz_iterations * 8; i++) {
2586 generate_random_aead_testvec(&ctx->rng, generic_req, &ctx->vec,
2587 &ctx->test_desc->suite.aead,
2588 ctx->maxkeysize, ctx->maxdatasize,
2590 sizeof(ctx->vec_name), false);
2591 generate_random_testvec_config(&ctx->rng, &ctx->cfg,
2593 sizeof(ctx->cfgname));
2594 if (!ctx->vec.novrfy) {
2595 err = test_aead_vec_cfg(ENCRYPT, &ctx->vec,
2596 ctx->vec_name, &ctx->cfg,
2597 ctx->req, ctx->tsgls);
2601 if (ctx->vec.crypt_error == 0 || ctx->vec.novrfy) {
2602 err = test_aead_vec_cfg(DECRYPT, &ctx->vec,
2603 ctx->vec_name, &ctx->cfg,
2604 ctx->req, ctx->tsgls);
2612 crypto_free_aead(generic_tfm);
2613 aead_request_free(generic_req);
2617 static int test_aead_extra(const struct alg_test_desc *test_desc,
2618 struct aead_request *req,
2619 struct cipher_test_sglists *tsgls)
2621 struct aead_extra_tests_ctx *ctx;
2628 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2631 init_rnd_state(&ctx->rng);
2633 ctx->tfm = crypto_aead_reqtfm(req);
2634 ctx->test_desc = test_desc;
2636 ctx->maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN;
2637 ctx->maxkeysize = 0;
2638 for (i = 0; i < test_desc->suite.aead.count; i++)
2639 ctx->maxkeysize = max_t(unsigned int, ctx->maxkeysize,
2640 test_desc->suite.aead.vecs[i].klen);
2642 ctx->vec.key = kmalloc(ctx->maxkeysize, GFP_KERNEL);
2643 ctx->vec.iv = kmalloc(crypto_aead_ivsize(ctx->tfm), GFP_KERNEL);
2644 ctx->vec.assoc = kmalloc(ctx->maxdatasize, GFP_KERNEL);
2645 ctx->vec.ptext = kmalloc(ctx->maxdatasize, GFP_KERNEL);
2646 ctx->vec.ctext = kmalloc(ctx->maxdatasize, GFP_KERNEL);
2647 if (!ctx->vec.key || !ctx->vec.iv || !ctx->vec.assoc ||
2648 !ctx->vec.ptext || !ctx->vec.ctext) {
2653 err = test_aead_vs_generic_impl(ctx);
2657 err = test_aead_inauthentic_inputs(ctx);
2659 kfree(ctx->vec.key);
2661 kfree(ctx->vec.assoc);
2662 kfree(ctx->vec.ptext);
2663 kfree(ctx->vec.ctext);
2667 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
2668 static int test_aead_extra(const struct alg_test_desc *test_desc,
2669 struct aead_request *req,
2670 struct cipher_test_sglists *tsgls)
2674 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
2676 static int test_aead(int enc, const struct aead_test_suite *suite,
2677 struct aead_request *req,
2678 struct cipher_test_sglists *tsgls)
2683 for (i = 0; i < suite->count; i++) {
2684 err = test_aead_vec(enc, &suite->vecs[i], i, req, tsgls);
2692 static int alg_test_aead(const struct alg_test_desc *desc, const char *driver,
2695 const struct aead_test_suite *suite = &desc->suite.aead;
2696 struct crypto_aead *tfm;
2697 struct aead_request *req = NULL;
2698 struct cipher_test_sglists *tsgls = NULL;
2701 if (suite->count <= 0) {
2702 pr_err("alg: aead: empty test suite for %s\n", driver);
2706 tfm = crypto_alloc_aead(driver, type, mask);
2708 if (PTR_ERR(tfm) == -ENOENT)
2710 pr_err("alg: aead: failed to allocate transform for %s: %ld\n",
2711 driver, PTR_ERR(tfm));
2712 return PTR_ERR(tfm);
2714 driver = crypto_aead_driver_name(tfm);
2716 req = aead_request_alloc(tfm, GFP_KERNEL);
2718 pr_err("alg: aead: failed to allocate request for %s\n",
2724 tsgls = alloc_cipher_test_sglists();
2726 pr_err("alg: aead: failed to allocate test buffers for %s\n",
2732 err = test_aead(ENCRYPT, suite, req, tsgls);
2736 err = test_aead(DECRYPT, suite, req, tsgls);
2740 err = test_aead_extra(desc, req, tsgls);
2742 free_cipher_test_sglists(tsgls);
2743 aead_request_free(req);
2744 crypto_free_aead(tfm);
2748 static int test_cipher(struct crypto_cipher *tfm, int enc,
2749 const struct cipher_testvec *template,
2750 unsigned int tcount)
2752 const char *algo = crypto_tfm_alg_driver_name(crypto_cipher_tfm(tfm));
2753 unsigned int i, j, k;
2756 const char *input, *result;
2758 char *xbuf[XBUFSIZE];
2761 if (testmgr_alloc_buf(xbuf))
2770 for (i = 0; i < tcount; i++) {
2772 if (fips_enabled && template[i].fips_skip)
2775 input = enc ? template[i].ptext : template[i].ctext;
2776 result = enc ? template[i].ctext : template[i].ptext;
2780 if (WARN_ON(template[i].len > PAGE_SIZE))
2784 memcpy(data, input, template[i].len);
2786 crypto_cipher_clear_flags(tfm, ~0);
2788 crypto_cipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2790 ret = crypto_cipher_setkey(tfm, template[i].key,
2793 if (ret == template[i].setkey_error)
2795 pr_err("alg: cipher: %s setkey failed on test vector %u; expected_error=%d, actual_error=%d, flags=%#x\n",
2796 algo, j, template[i].setkey_error, ret,
2797 crypto_cipher_get_flags(tfm));
2800 if (template[i].setkey_error) {
2801 pr_err("alg: cipher: %s setkey unexpectedly succeeded on test vector %u; expected_error=%d\n",
2802 algo, j, template[i].setkey_error);
2807 for (k = 0; k < template[i].len;
2808 k += crypto_cipher_blocksize(tfm)) {
2810 crypto_cipher_encrypt_one(tfm, data + k,
2813 crypto_cipher_decrypt_one(tfm, data + k,
2818 if (memcmp(q, result, template[i].len)) {
2819 printk(KERN_ERR "alg: cipher: Test %d failed "
2820 "on %s for %s\n", j, e, algo);
2821 hexdump(q, template[i].len);
2830 testmgr_free_buf(xbuf);
2835 static int test_skcipher_vec_cfg(int enc, const struct cipher_testvec *vec,
2836 const char *vec_name,
2837 const struct testvec_config *cfg,
2838 struct skcipher_request *req,
2839 struct cipher_test_sglists *tsgls)
2841 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
2842 const unsigned int alignmask = crypto_skcipher_alignmask(tfm);
2843 const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
2844 const char *driver = crypto_skcipher_driver_name(tfm);
2845 const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
2846 const char *op = enc ? "encryption" : "decryption";
2847 DECLARE_CRYPTO_WAIT(wait);
2848 u8 _iv[3 * (MAX_ALGAPI_ALIGNMASK + 1) + MAX_IVLEN];
2849 u8 *iv = PTR_ALIGN(&_iv[0], 2 * (MAX_ALGAPI_ALIGNMASK + 1)) +
2851 (cfg->iv_offset_relative_to_alignmask ? alignmask : 0);
2857 crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2859 crypto_skcipher_clear_flags(tfm,
2860 CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2861 err = do_setkey(crypto_skcipher_setkey, tfm, vec->key, vec->klen,
2864 if (err == vec->setkey_error)
2866 pr_err("alg: skcipher: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
2867 driver, vec_name, vec->setkey_error, err,
2868 crypto_skcipher_get_flags(tfm));
2871 if (vec->setkey_error) {
2872 pr_err("alg: skcipher: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
2873 driver, vec_name, vec->setkey_error);
2877 /* The IV must be copied to a buffer, as the algorithm may modify it */
2879 if (WARN_ON(ivsize > MAX_IVLEN))
2881 if (vec->generates_iv && !enc)
2882 memcpy(iv, vec->iv_out, ivsize);
2884 memcpy(iv, vec->iv, ivsize);
2886 memset(iv, 0, ivsize);
2888 if (vec->generates_iv) {
2889 pr_err("alg: skcipher: %s has ivsize=0 but test vector %s generates IV!\n",
2896 /* Build the src/dst scatterlists */
2897 input.iov_base = enc ? (void *)vec->ptext : (void *)vec->ctext;
2898 input.iov_len = vec->len;
2899 err = build_cipher_test_sglists(tsgls, cfg, alignmask,
2900 vec->len, vec->len, &input, 1);
2902 pr_err("alg: skcipher: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n",
2903 driver, op, vec_name, cfg->name);
2907 /* Do the actual encryption or decryption */
2908 testmgr_poison(req->__ctx, crypto_skcipher_reqsize(tfm));
2909 skcipher_request_set_callback(req, req_flags, crypto_req_done, &wait);
2910 skcipher_request_set_crypt(req, tsgls->src.sgl_ptr, tsgls->dst.sgl_ptr,
2913 crypto_disable_simd_for_test();
2914 err = enc ? crypto_skcipher_encrypt(req) : crypto_skcipher_decrypt(req);
2916 crypto_reenable_simd_for_test();
2917 err = crypto_wait_req(err, &wait);
2919 /* Check that the algorithm didn't overwrite things it shouldn't have */
2920 if (req->cryptlen != vec->len ||
2922 req->src != tsgls->src.sgl_ptr ||
2923 req->dst != tsgls->dst.sgl_ptr ||
2924 crypto_skcipher_reqtfm(req) != tfm ||
2925 req->base.complete != crypto_req_done ||
2926 req->base.flags != req_flags ||
2927 req->base.data != &wait) {
2928 pr_err("alg: skcipher: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n",
2929 driver, op, vec_name, cfg->name);
2930 if (req->cryptlen != vec->len)
2931 pr_err("alg: skcipher: changed 'req->cryptlen'\n");
2933 pr_err("alg: skcipher: changed 'req->iv'\n");
2934 if (req->src != tsgls->src.sgl_ptr)
2935 pr_err("alg: skcipher: changed 'req->src'\n");
2936 if (req->dst != tsgls->dst.sgl_ptr)
2937 pr_err("alg: skcipher: changed 'req->dst'\n");
2938 if (crypto_skcipher_reqtfm(req) != tfm)
2939 pr_err("alg: skcipher: changed 'req->base.tfm'\n");
2940 if (req->base.complete != crypto_req_done)
2941 pr_err("alg: skcipher: changed 'req->base.complete'\n");
2942 if (req->base.flags != req_flags)
2943 pr_err("alg: skcipher: changed 'req->base.flags'\n");
2944 if (req->base.data != &wait)
2945 pr_err("alg: skcipher: changed 'req->base.data'\n");
2948 if (is_test_sglist_corrupted(&tsgls->src)) {
2949 pr_err("alg: skcipher: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n",
2950 driver, op, vec_name, cfg->name);
2953 if (tsgls->dst.sgl_ptr != tsgls->src.sgl &&
2954 is_test_sglist_corrupted(&tsgls->dst)) {
2955 pr_err("alg: skcipher: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n",
2956 driver, op, vec_name, cfg->name);
2960 /* Check for success or failure */
2962 if (err == vec->crypt_error)
2964 pr_err("alg: skcipher: %s %s failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
2965 driver, op, vec_name, vec->crypt_error, err, cfg->name);
2968 if (vec->crypt_error) {
2969 pr_err("alg: skcipher: %s %s unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
2970 driver, op, vec_name, vec->crypt_error, cfg->name);
2974 /* Check for the correct output (ciphertext or plaintext) */
2975 err = verify_correct_output(&tsgls->dst, enc ? vec->ctext : vec->ptext,
2977 if (err == -EOVERFLOW) {
2978 pr_err("alg: skcipher: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n",
2979 driver, op, vec_name, cfg->name);
2983 pr_err("alg: skcipher: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
2984 driver, op, vec_name, cfg->name);
2988 /* If applicable, check that the algorithm generated the correct IV */
2989 if (vec->iv_out && memcmp(iv, vec->iv_out, ivsize) != 0) {
2990 pr_err("alg: skcipher: %s %s test failed (wrong output IV) on test vector %s, cfg=\"%s\"\n",
2991 driver, op, vec_name, cfg->name);
2992 hexdump(iv, ivsize);
2999 static int test_skcipher_vec(int enc, const struct cipher_testvec *vec,
3000 unsigned int vec_num,
3001 struct skcipher_request *req,
3002 struct cipher_test_sglists *tsgls)
3008 if (fips_enabled && vec->fips_skip)
3011 sprintf(vec_name, "%u", vec_num);
3013 for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) {
3014 err = test_skcipher_vec_cfg(enc, vec, vec_name,
3015 &default_cipher_testvec_configs[i],
3021 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
3022 if (!noextratests) {
3023 struct rnd_state rng;
3024 struct testvec_config cfg;
3025 char cfgname[TESTVEC_CONFIG_NAMELEN];
3027 init_rnd_state(&rng);
3029 for (i = 0; i < fuzz_iterations; i++) {
3030 generate_random_testvec_config(&rng, &cfg, cfgname,
3032 err = test_skcipher_vec_cfg(enc, vec, vec_name,
3043 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
3045 * Generate a symmetric cipher test vector from the given implementation.
3046 * Assumes the buffers in 'vec' were already allocated.
3048 static void generate_random_cipher_testvec(struct rnd_state *rng,
3049 struct skcipher_request *req,
3050 struct cipher_testvec *vec,
3051 unsigned int maxdatasize,
3052 char *name, size_t max_namelen)
3054 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
3055 const unsigned int maxkeysize = crypto_skcipher_max_keysize(tfm);
3056 const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
3057 struct scatterlist src, dst;
3059 DECLARE_CRYPTO_WAIT(wait);
3061 /* Key: length in [0, maxkeysize], but usually choose maxkeysize */
3062 vec->klen = maxkeysize;
3063 if (prandom_u32_below(rng, 4) == 0)
3064 vec->klen = prandom_u32_below(rng, maxkeysize + 1);
3065 generate_random_bytes(rng, (u8 *)vec->key, vec->klen);
3066 vec->setkey_error = crypto_skcipher_setkey(tfm, vec->key, vec->klen);
3069 generate_random_bytes(rng, (u8 *)vec->iv, ivsize);
3072 vec->len = generate_random_length(rng, maxdatasize);
3073 generate_random_bytes(rng, (u8 *)vec->ptext, vec->len);
3075 /* If the key couldn't be set, no need to continue to encrypt. */
3076 if (vec->setkey_error)
3080 sg_init_one(&src, vec->ptext, vec->len);
3081 sg_init_one(&dst, vec->ctext, vec->len);
3082 memcpy(iv, vec->iv, ivsize);
3083 skcipher_request_set_callback(req, 0, crypto_req_done, &wait);
3084 skcipher_request_set_crypt(req, &src, &dst, vec->len, iv);
3085 vec->crypt_error = crypto_wait_req(crypto_skcipher_encrypt(req), &wait);
3086 if (vec->crypt_error != 0) {
3088 * The only acceptable error here is for an invalid length, so
3089 * skcipher decryption should fail with the same error too.
3090 * We'll test for this. But to keep the API usage well-defined,
3091 * explicitly initialize the ciphertext buffer too.
3093 memset((u8 *)vec->ctext, 0, vec->len);
3096 snprintf(name, max_namelen, "\"random: len=%u klen=%u\"",
3097 vec->len, vec->klen);
3101 * Test the skcipher algorithm represented by @req against the corresponding
3102 * generic implementation, if one is available.
3104 static int test_skcipher_vs_generic_impl(const char *generic_driver,
3105 struct skcipher_request *req,
3106 struct cipher_test_sglists *tsgls)
3108 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
3109 const unsigned int maxkeysize = crypto_skcipher_max_keysize(tfm);
3110 const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
3111 const unsigned int blocksize = crypto_skcipher_blocksize(tfm);
3112 const unsigned int maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN;
3113 const char *algname = crypto_skcipher_alg(tfm)->base.cra_name;
3114 const char *driver = crypto_skcipher_driver_name(tfm);
3115 struct rnd_state rng;
3116 char _generic_driver[CRYPTO_MAX_ALG_NAME];
3117 struct crypto_skcipher *generic_tfm = NULL;
3118 struct skcipher_request *generic_req = NULL;
3120 struct cipher_testvec vec = { 0 };
3122 struct testvec_config *cfg;
3123 char cfgname[TESTVEC_CONFIG_NAMELEN];
3129 /* Keywrap isn't supported here yet as it handles its IV differently. */
3130 if (strncmp(algname, "kw(", 3) == 0)
3133 init_rnd_state(&rng);
3135 if (!generic_driver) { /* Use default naming convention? */
3136 err = build_generic_driver_name(algname, _generic_driver);
3139 generic_driver = _generic_driver;
3142 if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */
3145 generic_tfm = crypto_alloc_skcipher(generic_driver, 0, 0);
3146 if (IS_ERR(generic_tfm)) {
3147 err = PTR_ERR(generic_tfm);
3148 if (err == -ENOENT) {
3149 pr_warn("alg: skcipher: skipping comparison tests for %s because %s is unavailable\n",
3150 driver, generic_driver);
3153 pr_err("alg: skcipher: error allocating %s (generic impl of %s): %d\n",
3154 generic_driver, algname, err);
3158 cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
3164 generic_req = skcipher_request_alloc(generic_tfm, GFP_KERNEL);
3170 /* Check the algorithm properties for consistency. */
3172 if (crypto_skcipher_min_keysize(tfm) !=
3173 crypto_skcipher_min_keysize(generic_tfm)) {
3174 pr_err("alg: skcipher: min keysize for %s (%u) doesn't match generic impl (%u)\n",
3175 driver, crypto_skcipher_min_keysize(tfm),
3176 crypto_skcipher_min_keysize(generic_tfm));
3181 if (maxkeysize != crypto_skcipher_max_keysize(generic_tfm)) {
3182 pr_err("alg: skcipher: max keysize for %s (%u) doesn't match generic impl (%u)\n",
3184 crypto_skcipher_max_keysize(generic_tfm));
3189 if (ivsize != crypto_skcipher_ivsize(generic_tfm)) {
3190 pr_err("alg: skcipher: ivsize for %s (%u) doesn't match generic impl (%u)\n",
3191 driver, ivsize, crypto_skcipher_ivsize(generic_tfm));
3196 if (blocksize != crypto_skcipher_blocksize(generic_tfm)) {
3197 pr_err("alg: skcipher: blocksize for %s (%u) doesn't match generic impl (%u)\n",
3199 crypto_skcipher_blocksize(generic_tfm));
3205 * Now generate test vectors using the generic implementation, and test
3206 * the other implementation against them.
3209 vec.key = kmalloc(maxkeysize, GFP_KERNEL);
3210 vec.iv = kmalloc(ivsize, GFP_KERNEL);
3211 vec.ptext = kmalloc(maxdatasize, GFP_KERNEL);
3212 vec.ctext = kmalloc(maxdatasize, GFP_KERNEL);
3213 if (!vec.key || !vec.iv || !vec.ptext || !vec.ctext) {
3218 for (i = 0; i < fuzz_iterations * 8; i++) {
3219 generate_random_cipher_testvec(&rng, generic_req, &vec,
3221 vec_name, sizeof(vec_name));
3222 generate_random_testvec_config(&rng, cfg, cfgname,
3225 err = test_skcipher_vec_cfg(ENCRYPT, &vec, vec_name,
3229 err = test_skcipher_vec_cfg(DECRYPT, &vec, vec_name,
3242 crypto_free_skcipher(generic_tfm);
3243 skcipher_request_free(generic_req);
3246 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
3247 static int test_skcipher_vs_generic_impl(const char *generic_driver,
3248 struct skcipher_request *req,
3249 struct cipher_test_sglists *tsgls)
3253 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
3255 static int test_skcipher(int enc, const struct cipher_test_suite *suite,
3256 struct skcipher_request *req,
3257 struct cipher_test_sglists *tsgls)
3262 for (i = 0; i < suite->count; i++) {
3263 err = test_skcipher_vec(enc, &suite->vecs[i], i, req, tsgls);
3271 static int alg_test_skcipher(const struct alg_test_desc *desc,
3272 const char *driver, u32 type, u32 mask)
3274 const struct cipher_test_suite *suite = &desc->suite.cipher;
3275 struct crypto_skcipher *tfm;
3276 struct skcipher_request *req = NULL;
3277 struct cipher_test_sglists *tsgls = NULL;
3280 if (suite->count <= 0) {
3281 pr_err("alg: skcipher: empty test suite for %s\n", driver);
3285 tfm = crypto_alloc_skcipher(driver, type, mask);
3287 if (PTR_ERR(tfm) == -ENOENT)
3289 pr_err("alg: skcipher: failed to allocate transform for %s: %ld\n",
3290 driver, PTR_ERR(tfm));
3291 return PTR_ERR(tfm);
3293 driver = crypto_skcipher_driver_name(tfm);
3295 req = skcipher_request_alloc(tfm, GFP_KERNEL);
3297 pr_err("alg: skcipher: failed to allocate request for %s\n",
3303 tsgls = alloc_cipher_test_sglists();
3305 pr_err("alg: skcipher: failed to allocate test buffers for %s\n",
3311 err = test_skcipher(ENCRYPT, suite, req, tsgls);
3315 err = test_skcipher(DECRYPT, suite, req, tsgls);
3319 err = test_skcipher_vs_generic_impl(desc->generic_driver, req, tsgls);
3321 free_cipher_test_sglists(tsgls);
3322 skcipher_request_free(req);
3323 crypto_free_skcipher(tfm);
3327 static int test_comp(struct crypto_comp *tfm,
3328 const struct comp_testvec *ctemplate,
3329 const struct comp_testvec *dtemplate,
3330 int ctcount, int dtcount)
3332 const char *algo = crypto_tfm_alg_driver_name(crypto_comp_tfm(tfm));
3333 char *output, *decomp_output;
3337 output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
3341 decomp_output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
3342 if (!decomp_output) {
3347 for (i = 0; i < ctcount; i++) {
3349 unsigned int dlen = COMP_BUF_SIZE;
3351 memset(output, 0, COMP_BUF_SIZE);
3352 memset(decomp_output, 0, COMP_BUF_SIZE);
3354 ilen = ctemplate[i].inlen;
3355 ret = crypto_comp_compress(tfm, ctemplate[i].input,
3356 ilen, output, &dlen);
3358 printk(KERN_ERR "alg: comp: compression failed "
3359 "on test %d for %s: ret=%d\n", i + 1, algo,
3365 dlen = COMP_BUF_SIZE;
3366 ret = crypto_comp_decompress(tfm, output,
3367 ilen, decomp_output, &dlen);
3369 pr_err("alg: comp: compression failed: decompress: on test %d for %s failed: ret=%d\n",
3374 if (dlen != ctemplate[i].inlen) {
3375 printk(KERN_ERR "alg: comp: Compression test %d "
3376 "failed for %s: output len = %d\n", i + 1, algo,
3382 if (memcmp(decomp_output, ctemplate[i].input,
3383 ctemplate[i].inlen)) {
3384 pr_err("alg: comp: compression failed: output differs: on test %d for %s\n",
3386 hexdump(decomp_output, dlen);
3392 for (i = 0; i < dtcount; i++) {
3394 unsigned int dlen = COMP_BUF_SIZE;
3396 memset(decomp_output, 0, COMP_BUF_SIZE);
3398 ilen = dtemplate[i].inlen;
3399 ret = crypto_comp_decompress(tfm, dtemplate[i].input,
3400 ilen, decomp_output, &dlen);
3402 printk(KERN_ERR "alg: comp: decompression failed "
3403 "on test %d for %s: ret=%d\n", i + 1, algo,
3408 if (dlen != dtemplate[i].outlen) {
3409 printk(KERN_ERR "alg: comp: Decompression test %d "
3410 "failed for %s: output len = %d\n", i + 1, algo,
3416 if (memcmp(decomp_output, dtemplate[i].output, dlen)) {
3417 printk(KERN_ERR "alg: comp: Decompression test %d "
3418 "failed for %s\n", i + 1, algo);
3419 hexdump(decomp_output, dlen);
3428 kfree(decomp_output);
3433 static int test_acomp(struct crypto_acomp *tfm,
3434 const struct comp_testvec *ctemplate,
3435 const struct comp_testvec *dtemplate,
3436 int ctcount, int dtcount)
3438 const char *algo = crypto_tfm_alg_driver_name(crypto_acomp_tfm(tfm));
3440 char *output, *decomp_out;
3442 struct scatterlist src, dst;
3443 struct acomp_req *req;
3444 struct crypto_wait wait;
3446 output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
3450 decomp_out = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
3456 for (i = 0; i < ctcount; i++) {
3457 unsigned int dlen = COMP_BUF_SIZE;
3458 int ilen = ctemplate[i].inlen;
3461 input_vec = kmemdup(ctemplate[i].input, ilen, GFP_KERNEL);
3467 memset(output, 0, dlen);
3468 crypto_init_wait(&wait);
3469 sg_init_one(&src, input_vec, ilen);
3470 sg_init_one(&dst, output, dlen);
3472 req = acomp_request_alloc(tfm);
3474 pr_err("alg: acomp: request alloc failed for %s\n",
3481 acomp_request_set_params(req, &src, &dst, ilen, dlen);
3482 acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3483 crypto_req_done, &wait);
3485 ret = crypto_wait_req(crypto_acomp_compress(req), &wait);
3487 pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
3490 acomp_request_free(req);
3495 dlen = COMP_BUF_SIZE;
3496 sg_init_one(&src, output, ilen);
3497 sg_init_one(&dst, decomp_out, dlen);
3498 crypto_init_wait(&wait);
3499 acomp_request_set_params(req, &src, &dst, ilen, dlen);
3501 ret = crypto_wait_req(crypto_acomp_decompress(req), &wait);
3503 pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
3506 acomp_request_free(req);
3510 if (req->dlen != ctemplate[i].inlen) {
3511 pr_err("alg: acomp: Compression test %d failed for %s: output len = %d\n",
3512 i + 1, algo, req->dlen);
3515 acomp_request_free(req);
3519 if (memcmp(input_vec, decomp_out, req->dlen)) {
3520 pr_err("alg: acomp: Compression test %d failed for %s\n",
3522 hexdump(output, req->dlen);
3525 acomp_request_free(req);
3529 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
3530 crypto_init_wait(&wait);
3531 sg_init_one(&src, input_vec, ilen);
3532 acomp_request_set_params(req, &src, NULL, ilen, 0);
3534 ret = crypto_wait_req(crypto_acomp_compress(req), &wait);
3536 pr_err("alg: acomp: compression failed on NULL dst buffer test %d for %s: ret=%d\n",
3539 acomp_request_free(req);
3545 acomp_request_free(req);
3548 for (i = 0; i < dtcount; i++) {
3549 unsigned int dlen = COMP_BUF_SIZE;
3550 int ilen = dtemplate[i].inlen;
3553 input_vec = kmemdup(dtemplate[i].input, ilen, GFP_KERNEL);
3559 memset(output, 0, dlen);
3560 crypto_init_wait(&wait);
3561 sg_init_one(&src, input_vec, ilen);
3562 sg_init_one(&dst, output, dlen);
3564 req = acomp_request_alloc(tfm);
3566 pr_err("alg: acomp: request alloc failed for %s\n",
3573 acomp_request_set_params(req, &src, &dst, ilen, dlen);
3574 acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3575 crypto_req_done, &wait);
3577 ret = crypto_wait_req(crypto_acomp_decompress(req), &wait);
3579 pr_err("alg: acomp: decompression failed on test %d for %s: ret=%d\n",
3582 acomp_request_free(req);
3586 if (req->dlen != dtemplate[i].outlen) {
3587 pr_err("alg: acomp: Decompression test %d failed for %s: output len = %d\n",
3588 i + 1, algo, req->dlen);
3591 acomp_request_free(req);
3595 if (memcmp(output, dtemplate[i].output, req->dlen)) {
3596 pr_err("alg: acomp: Decompression test %d failed for %s\n",
3598 hexdump(output, req->dlen);
3601 acomp_request_free(req);
3605 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
3606 crypto_init_wait(&wait);
3607 acomp_request_set_params(req, &src, NULL, ilen, 0);
3609 ret = crypto_wait_req(crypto_acomp_decompress(req), &wait);
3611 pr_err("alg: acomp: decompression failed on NULL dst buffer test %d for %s: ret=%d\n",
3614 acomp_request_free(req);
3620 acomp_request_free(req);
3631 static int test_cprng(struct crypto_rng *tfm,
3632 const struct cprng_testvec *template,
3633 unsigned int tcount)
3635 const char *algo = crypto_tfm_alg_driver_name(crypto_rng_tfm(tfm));
3636 int err = 0, i, j, seedsize;
3640 seedsize = crypto_rng_seedsize(tfm);
3642 seed = kmalloc(seedsize, GFP_KERNEL);
3644 printk(KERN_ERR "alg: cprng: Failed to allocate seed space "
3649 for (i = 0; i < tcount; i++) {
3650 memset(result, 0, 32);
3652 memcpy(seed, template[i].v, template[i].vlen);
3653 memcpy(seed + template[i].vlen, template[i].key,
3655 memcpy(seed + template[i].vlen + template[i].klen,
3656 template[i].dt, template[i].dtlen);
3658 err = crypto_rng_reset(tfm, seed, seedsize);
3660 printk(KERN_ERR "alg: cprng: Failed to reset rng "
3665 for (j = 0; j < template[i].loops; j++) {
3666 err = crypto_rng_get_bytes(tfm, result,
3669 printk(KERN_ERR "alg: cprng: Failed to obtain "
3670 "the correct amount of random data for "
3671 "%s (requested %d)\n", algo,
3677 err = memcmp(result, template[i].result,
3680 printk(KERN_ERR "alg: cprng: Test %d failed for %s\n",
3682 hexdump(result, template[i].rlen);
3693 static int alg_test_cipher(const struct alg_test_desc *desc,
3694 const char *driver, u32 type, u32 mask)
3696 const struct cipher_test_suite *suite = &desc->suite.cipher;
3697 struct crypto_cipher *tfm;
3700 tfm = crypto_alloc_cipher(driver, type, mask);
3702 if (PTR_ERR(tfm) == -ENOENT)
3704 printk(KERN_ERR "alg: cipher: Failed to load transform for "
3705 "%s: %ld\n", driver, PTR_ERR(tfm));
3706 return PTR_ERR(tfm);
3709 err = test_cipher(tfm, ENCRYPT, suite->vecs, suite->count);
3711 err = test_cipher(tfm, DECRYPT, suite->vecs, suite->count);
3713 crypto_free_cipher(tfm);
3717 static int alg_test_comp(const struct alg_test_desc *desc, const char *driver,
3720 struct crypto_comp *comp;
3721 struct crypto_acomp *acomp;
3723 u32 algo_type = type & CRYPTO_ALG_TYPE_ACOMPRESS_MASK;
3725 if (algo_type == CRYPTO_ALG_TYPE_ACOMPRESS) {
3726 acomp = crypto_alloc_acomp(driver, type, mask);
3727 if (IS_ERR(acomp)) {
3728 if (PTR_ERR(acomp) == -ENOENT)
3730 pr_err("alg: acomp: Failed to load transform for %s: %ld\n",
3731 driver, PTR_ERR(acomp));
3732 return PTR_ERR(acomp);
3734 err = test_acomp(acomp, desc->suite.comp.comp.vecs,
3735 desc->suite.comp.decomp.vecs,
3736 desc->suite.comp.comp.count,
3737 desc->suite.comp.decomp.count);
3738 crypto_free_acomp(acomp);
3740 comp = crypto_alloc_comp(driver, type, mask);
3742 if (PTR_ERR(comp) == -ENOENT)
3744 pr_err("alg: comp: Failed to load transform for %s: %ld\n",
3745 driver, PTR_ERR(comp));
3746 return PTR_ERR(comp);
3749 err = test_comp(comp, desc->suite.comp.comp.vecs,
3750 desc->suite.comp.decomp.vecs,
3751 desc->suite.comp.comp.count,
3752 desc->suite.comp.decomp.count);
3754 crypto_free_comp(comp);
3759 static int alg_test_crc32c(const struct alg_test_desc *desc,
3760 const char *driver, u32 type, u32 mask)
3762 struct crypto_shash *tfm;
3766 err = alg_test_hash(desc, driver, type, mask);
3770 tfm = crypto_alloc_shash(driver, type, mask);
3772 if (PTR_ERR(tfm) == -ENOENT) {
3774 * This crc32c implementation is only available through
3775 * ahash API, not the shash API, so the remaining part
3776 * of the test is not applicable to it.
3780 printk(KERN_ERR "alg: crc32c: Failed to load transform for %s: "
3781 "%ld\n", driver, PTR_ERR(tfm));
3782 return PTR_ERR(tfm);
3784 driver = crypto_shash_driver_name(tfm);
3787 SHASH_DESC_ON_STACK(shash, tfm);
3788 u32 *ctx = (u32 *)shash_desc_ctx(shash);
3793 err = crypto_shash_final(shash, (u8 *)&val);
3795 printk(KERN_ERR "alg: crc32c: Operation failed for "
3796 "%s: %d\n", driver, err);
3800 if (val != cpu_to_le32(~420553207)) {
3801 pr_err("alg: crc32c: Test failed for %s: %u\n",
3802 driver, le32_to_cpu(val));
3807 crypto_free_shash(tfm);
3812 static int alg_test_cprng(const struct alg_test_desc *desc, const char *driver,
3815 struct crypto_rng *rng;
3818 rng = crypto_alloc_rng(driver, type, mask);
3820 if (PTR_ERR(rng) == -ENOENT)
3822 printk(KERN_ERR "alg: cprng: Failed to load transform for %s: "
3823 "%ld\n", driver, PTR_ERR(rng));
3824 return PTR_ERR(rng);
3827 err = test_cprng(rng, desc->suite.cprng.vecs, desc->suite.cprng.count);
3829 crypto_free_rng(rng);
3835 static int drbg_cavs_test(const struct drbg_testvec *test, int pr,
3836 const char *driver, u32 type, u32 mask)
3839 struct crypto_rng *drng;
3840 struct drbg_test_data test_data;
3841 struct drbg_string addtl, pers, testentropy;
3842 unsigned char *buf = kzalloc(test->expectedlen, GFP_KERNEL);
3847 drng = crypto_alloc_rng(driver, type, mask);
3849 if (PTR_ERR(drng) == -ENOENT)
3851 printk(KERN_ERR "alg: drbg: could not allocate DRNG handle for "
3854 kfree_sensitive(buf);
3855 return PTR_ERR(drng);
3858 test_data.testentropy = &testentropy;
3859 drbg_string_fill(&testentropy, test->entropy, test->entropylen);
3860 drbg_string_fill(&pers, test->pers, test->perslen);
3861 ret = crypto_drbg_reset_test(drng, &pers, &test_data);
3863 printk(KERN_ERR "alg: drbg: Failed to reset rng\n");
3867 drbg_string_fill(&addtl, test->addtla, test->addtllen);
3869 drbg_string_fill(&testentropy, test->entpra, test->entprlen);
3870 ret = crypto_drbg_get_bytes_addtl_test(drng,
3871 buf, test->expectedlen, &addtl, &test_data);
3873 ret = crypto_drbg_get_bytes_addtl(drng,
3874 buf, test->expectedlen, &addtl);
3877 printk(KERN_ERR "alg: drbg: could not obtain random data for "
3878 "driver %s\n", driver);
3882 drbg_string_fill(&addtl, test->addtlb, test->addtllen);
3884 drbg_string_fill(&testentropy, test->entprb, test->entprlen);
3885 ret = crypto_drbg_get_bytes_addtl_test(drng,
3886 buf, test->expectedlen, &addtl, &test_data);
3888 ret = crypto_drbg_get_bytes_addtl(drng,
3889 buf, test->expectedlen, &addtl);
3892 printk(KERN_ERR "alg: drbg: could not obtain random data for "
3893 "driver %s\n", driver);
3897 ret = memcmp(test->expected, buf, test->expectedlen);
3900 crypto_free_rng(drng);
3901 kfree_sensitive(buf);
3906 static int alg_test_drbg(const struct alg_test_desc *desc, const char *driver,
3912 const struct drbg_testvec *template = desc->suite.drbg.vecs;
3913 unsigned int tcount = desc->suite.drbg.count;
3915 if (0 == memcmp(driver, "drbg_pr_", 8))
3918 for (i = 0; i < tcount; i++) {
3919 err = drbg_cavs_test(&template[i], pr, driver, type, mask);
3921 printk(KERN_ERR "alg: drbg: Test %d failed for %s\n",
3931 static int do_test_kpp(struct crypto_kpp *tfm, const struct kpp_testvec *vec,
3934 struct kpp_request *req;
3935 void *input_buf = NULL;
3936 void *output_buf = NULL;
3937 void *a_public = NULL;
3939 void *shared_secret = NULL;
3940 struct crypto_wait wait;
3941 unsigned int out_len_max;
3943 struct scatterlist src, dst;
3945 req = kpp_request_alloc(tfm, GFP_KERNEL);
3949 crypto_init_wait(&wait);
3951 err = crypto_kpp_set_secret(tfm, vec->secret, vec->secret_size);
3955 out_len_max = crypto_kpp_maxsize(tfm);
3956 output_buf = kzalloc(out_len_max, GFP_KERNEL);
3962 /* Use appropriate parameter as base */
3963 kpp_request_set_input(req, NULL, 0);
3964 sg_init_one(&dst, output_buf, out_len_max);
3965 kpp_request_set_output(req, &dst, out_len_max);
3966 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3967 crypto_req_done, &wait);
3969 /* Compute party A's public key */
3970 err = crypto_wait_req(crypto_kpp_generate_public_key(req), &wait);
3972 pr_err("alg: %s: Party A: generate public key test failed. err %d\n",
3978 /* Save party A's public key */
3979 a_public = kmemdup(sg_virt(req->dst), out_len_max, GFP_KERNEL);
3985 /* Verify calculated public key */
3986 if (memcmp(vec->expected_a_public, sg_virt(req->dst),
3987 vec->expected_a_public_size)) {
3988 pr_err("alg: %s: Party A: generate public key test failed. Invalid output\n",
3995 /* Calculate shared secret key by using counter part (b) public key. */
3996 input_buf = kmemdup(vec->b_public, vec->b_public_size, GFP_KERNEL);
4002 sg_init_one(&src, input_buf, vec->b_public_size);
4003 sg_init_one(&dst, output_buf, out_len_max);
4004 kpp_request_set_input(req, &src, vec->b_public_size);
4005 kpp_request_set_output(req, &dst, out_len_max);
4006 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
4007 crypto_req_done, &wait);
4008 err = crypto_wait_req(crypto_kpp_compute_shared_secret(req), &wait);
4010 pr_err("alg: %s: Party A: compute shared secret test failed. err %d\n",
4016 /* Save the shared secret obtained by party A */
4017 a_ss = kmemdup(sg_virt(req->dst), vec->expected_ss_size, GFP_KERNEL);
4024 * Calculate party B's shared secret by using party A's
4027 err = crypto_kpp_set_secret(tfm, vec->b_secret,
4028 vec->b_secret_size);
4032 sg_init_one(&src, a_public, vec->expected_a_public_size);
4033 sg_init_one(&dst, output_buf, out_len_max);
4034 kpp_request_set_input(req, &src, vec->expected_a_public_size);
4035 kpp_request_set_output(req, &dst, out_len_max);
4036 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
4037 crypto_req_done, &wait);
4038 err = crypto_wait_req(crypto_kpp_compute_shared_secret(req),
4041 pr_err("alg: %s: Party B: compute shared secret failed. err %d\n",
4046 shared_secret = a_ss;
4048 shared_secret = (void *)vec->expected_ss;
4052 * verify shared secret from which the user will derive
4053 * secret key by executing whatever hash it has chosen
4055 if (memcmp(shared_secret, sg_virt(req->dst),
4056 vec->expected_ss_size)) {
4057 pr_err("alg: %s: compute shared secret test failed. Invalid output\n",
4069 kpp_request_free(req);
4073 static int test_kpp(struct crypto_kpp *tfm, const char *alg,
4074 const struct kpp_testvec *vecs, unsigned int tcount)
4078 for (i = 0; i < tcount; i++) {
4079 ret = do_test_kpp(tfm, vecs++, alg);
4081 pr_err("alg: %s: test failed on vector %d, err=%d\n",
4089 static int alg_test_kpp(const struct alg_test_desc *desc, const char *driver,
4092 struct crypto_kpp *tfm;
4095 tfm = crypto_alloc_kpp(driver, type, mask);
4097 if (PTR_ERR(tfm) == -ENOENT)
4099 pr_err("alg: kpp: Failed to load tfm for %s: %ld\n",
4100 driver, PTR_ERR(tfm));
4101 return PTR_ERR(tfm);
4103 if (desc->suite.kpp.vecs)
4104 err = test_kpp(tfm, desc->alg, desc->suite.kpp.vecs,
4105 desc->suite.kpp.count);
4107 crypto_free_kpp(tfm);
4111 static u8 *test_pack_u32(u8 *dst, u32 val)
4113 memcpy(dst, &val, sizeof(val));
4114 return dst + sizeof(val);
4117 static int test_akcipher_one(struct crypto_akcipher *tfm,
4118 const struct akcipher_testvec *vecs)
4120 char *xbuf[XBUFSIZE];
4121 struct akcipher_request *req;
4122 void *outbuf_enc = NULL;
4123 void *outbuf_dec = NULL;
4124 struct crypto_wait wait;
4125 unsigned int out_len_max, out_len = 0;
4127 struct scatterlist src, dst, src_tab[3];
4129 unsigned int m_size, c_size;
4133 if (testmgr_alloc_buf(xbuf))
4136 req = akcipher_request_alloc(tfm, GFP_KERNEL);
4140 crypto_init_wait(&wait);
4142 key = kmalloc(vecs->key_len + sizeof(u32) * 2 + vecs->param_len,
4146 memcpy(key, vecs->key, vecs->key_len);
4147 ptr = key + vecs->key_len;
4148 ptr = test_pack_u32(ptr, vecs->algo);
4149 ptr = test_pack_u32(ptr, vecs->param_len);
4150 memcpy(ptr, vecs->params, vecs->param_len);
4152 if (vecs->public_key_vec)
4153 err = crypto_akcipher_set_pub_key(tfm, key, vecs->key_len);
4155 err = crypto_akcipher_set_priv_key(tfm, key, vecs->key_len);
4160 * First run test which do not require a private key, such as
4161 * encrypt or verify.
4164 out_len_max = crypto_akcipher_maxsize(tfm);
4165 outbuf_enc = kzalloc(out_len_max, GFP_KERNEL);
4169 if (!vecs->siggen_sigver_test) {
4171 m_size = vecs->m_size;
4173 c_size = vecs->c_size;
4176 /* Swap args so we could keep plaintext (digest)
4177 * in vecs->m, and cooked signature in vecs->c.
4179 m = vecs->c; /* signature */
4180 m_size = vecs->c_size;
4181 c = vecs->m; /* digest */
4182 c_size = vecs->m_size;
4187 if (WARN_ON(m_size > PAGE_SIZE))
4189 memcpy(xbuf[0], m, m_size);
4191 sg_init_table(src_tab, 3);
4192 sg_set_buf(&src_tab[0], xbuf[0], 8);
4193 sg_set_buf(&src_tab[1], xbuf[0] + 8, m_size - 8);
4194 if (vecs->siggen_sigver_test) {
4195 if (WARN_ON(c_size > PAGE_SIZE))
4197 memcpy(xbuf[1], c, c_size);
4198 sg_set_buf(&src_tab[2], xbuf[1], c_size);
4199 akcipher_request_set_crypt(req, src_tab, NULL, m_size, c_size);
4201 sg_init_one(&dst, outbuf_enc, out_len_max);
4202 akcipher_request_set_crypt(req, src_tab, &dst, m_size,
4205 akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
4206 crypto_req_done, &wait);
4208 err = crypto_wait_req(vecs->siggen_sigver_test ?
4209 /* Run asymmetric signature verification */
4210 crypto_akcipher_verify(req) :
4211 /* Run asymmetric encrypt */
4212 crypto_akcipher_encrypt(req), &wait);
4214 pr_err("alg: akcipher: %s test failed. err %d\n", op, err);
4217 if (!vecs->siggen_sigver_test && c) {
4218 if (req->dst_len != c_size) {
4219 pr_err("alg: akcipher: %s test failed. Invalid output len\n",
4224 /* verify that encrypted message is equal to expected */
4225 if (memcmp(c, outbuf_enc, c_size) != 0) {
4226 pr_err("alg: akcipher: %s test failed. Invalid output\n",
4228 hexdump(outbuf_enc, c_size);
4235 * Don't invoke (decrypt or sign) test which require a private key
4236 * for vectors with only a public key.
4238 if (vecs->public_key_vec) {
4242 outbuf_dec = kzalloc(out_len_max, GFP_KERNEL);
4248 if (!vecs->siggen_sigver_test && !c) {
4250 c_size = req->dst_len;
4254 op = vecs->siggen_sigver_test ? "sign" : "decrypt";
4255 if (WARN_ON(c_size > PAGE_SIZE))
4257 memcpy(xbuf[0], c, c_size);
4259 sg_init_one(&src, xbuf[0], c_size);
4260 sg_init_one(&dst, outbuf_dec, out_len_max);
4261 crypto_init_wait(&wait);
4262 akcipher_request_set_crypt(req, &src, &dst, c_size, out_len_max);
4264 err = crypto_wait_req(vecs->siggen_sigver_test ?
4265 /* Run asymmetric signature generation */
4266 crypto_akcipher_sign(req) :
4267 /* Run asymmetric decrypt */
4268 crypto_akcipher_decrypt(req), &wait);
4270 pr_err("alg: akcipher: %s test failed. err %d\n", op, err);
4273 out_len = req->dst_len;
4274 if (out_len < m_size) {
4275 pr_err("alg: akcipher: %s test failed. Invalid output len %u\n",
4280 /* verify that decrypted message is equal to the original msg */
4281 if (memchr_inv(outbuf_dec, 0, out_len - m_size) ||
4282 memcmp(m, outbuf_dec + out_len - m_size, m_size)) {
4283 pr_err("alg: akcipher: %s test failed. Invalid output\n", op);
4284 hexdump(outbuf_dec, out_len);
4293 akcipher_request_free(req);
4295 testmgr_free_buf(xbuf);
4299 static int test_akcipher(struct crypto_akcipher *tfm, const char *alg,
4300 const struct akcipher_testvec *vecs,
4301 unsigned int tcount)
4304 crypto_tfm_alg_driver_name(crypto_akcipher_tfm(tfm));
4307 for (i = 0; i < tcount; i++) {
4308 ret = test_akcipher_one(tfm, vecs++);
4312 pr_err("alg: akcipher: test %d failed for %s, err=%d\n",
4319 static int alg_test_akcipher(const struct alg_test_desc *desc,
4320 const char *driver, u32 type, u32 mask)
4322 struct crypto_akcipher *tfm;
4325 tfm = crypto_alloc_akcipher(driver, type, mask);
4327 if (PTR_ERR(tfm) == -ENOENT)
4329 pr_err("alg: akcipher: Failed to load tfm for %s: %ld\n",
4330 driver, PTR_ERR(tfm));
4331 return PTR_ERR(tfm);
4333 if (desc->suite.akcipher.vecs)
4334 err = test_akcipher(tfm, desc->alg, desc->suite.akcipher.vecs,
4335 desc->suite.akcipher.count);
4337 crypto_free_akcipher(tfm);
4341 static int alg_test_null(const struct alg_test_desc *desc,
4342 const char *driver, u32 type, u32 mask)
4347 #define ____VECS(tv) .vecs = tv, .count = ARRAY_SIZE(tv)
4348 #define __VECS(tv) { ____VECS(tv) }
4350 /* Please keep this list sorted by algorithm name. */
4351 static const struct alg_test_desc alg_test_descs[] = {
4353 .alg = "adiantum(xchacha12,aes)",
4354 .generic_driver = "adiantum(xchacha12-generic,aes-generic,nhpoly1305-generic)",
4355 .test = alg_test_skcipher,
4357 .cipher = __VECS(adiantum_xchacha12_aes_tv_template)
4360 .alg = "adiantum(xchacha20,aes)",
4361 .generic_driver = "adiantum(xchacha20-generic,aes-generic,nhpoly1305-generic)",
4362 .test = alg_test_skcipher,
4364 .cipher = __VECS(adiantum_xchacha20_aes_tv_template)
4368 .test = alg_test_aead,
4370 .aead = __VECS(aegis128_tv_template)
4373 .alg = "ansi_cprng",
4374 .test = alg_test_cprng,
4376 .cprng = __VECS(ansi_cprng_aes_tv_template)
4379 .alg = "authenc(hmac(md5),ecb(cipher_null))",
4380 .test = alg_test_aead,
4382 .aead = __VECS(hmac_md5_ecb_cipher_null_tv_template)
4385 .alg = "authenc(hmac(sha1),cbc(aes))",
4386 .test = alg_test_aead,
4389 .aead = __VECS(hmac_sha1_aes_cbc_tv_temp)
4392 .alg = "authenc(hmac(sha1),cbc(des))",
4393 .test = alg_test_aead,
4395 .aead = __VECS(hmac_sha1_des_cbc_tv_temp)
4398 .alg = "authenc(hmac(sha1),cbc(des3_ede))",
4399 .test = alg_test_aead,
4401 .aead = __VECS(hmac_sha1_des3_ede_cbc_tv_temp)
4404 .alg = "authenc(hmac(sha1),ctr(aes))",
4405 .test = alg_test_null,
4408 .alg = "authenc(hmac(sha1),ecb(cipher_null))",
4409 .test = alg_test_aead,
4411 .aead = __VECS(hmac_sha1_ecb_cipher_null_tv_temp)
4414 .alg = "authenc(hmac(sha1),rfc3686(ctr(aes)))",
4415 .test = alg_test_null,
4418 .alg = "authenc(hmac(sha224),cbc(des))",
4419 .test = alg_test_aead,
4421 .aead = __VECS(hmac_sha224_des_cbc_tv_temp)
4424 .alg = "authenc(hmac(sha224),cbc(des3_ede))",
4425 .test = alg_test_aead,
4427 .aead = __VECS(hmac_sha224_des3_ede_cbc_tv_temp)
4430 .alg = "authenc(hmac(sha256),cbc(aes))",
4431 .test = alg_test_aead,
4434 .aead = __VECS(hmac_sha256_aes_cbc_tv_temp)
4437 .alg = "authenc(hmac(sha256),cbc(des))",
4438 .test = alg_test_aead,
4440 .aead = __VECS(hmac_sha256_des_cbc_tv_temp)
4443 .alg = "authenc(hmac(sha256),cbc(des3_ede))",
4444 .test = alg_test_aead,
4446 .aead = __VECS(hmac_sha256_des3_ede_cbc_tv_temp)
4449 .alg = "authenc(hmac(sha256),ctr(aes))",
4450 .test = alg_test_null,
4453 .alg = "authenc(hmac(sha256),rfc3686(ctr(aes)))",
4454 .test = alg_test_null,
4457 .alg = "authenc(hmac(sha384),cbc(des))",
4458 .test = alg_test_aead,
4460 .aead = __VECS(hmac_sha384_des_cbc_tv_temp)
4463 .alg = "authenc(hmac(sha384),cbc(des3_ede))",
4464 .test = alg_test_aead,
4466 .aead = __VECS(hmac_sha384_des3_ede_cbc_tv_temp)
4469 .alg = "authenc(hmac(sha384),ctr(aes))",
4470 .test = alg_test_null,
4473 .alg = "authenc(hmac(sha384),rfc3686(ctr(aes)))",
4474 .test = alg_test_null,
4477 .alg = "authenc(hmac(sha512),cbc(aes))",
4479 .test = alg_test_aead,
4481 .aead = __VECS(hmac_sha512_aes_cbc_tv_temp)
4484 .alg = "authenc(hmac(sha512),cbc(des))",
4485 .test = alg_test_aead,
4487 .aead = __VECS(hmac_sha512_des_cbc_tv_temp)
4490 .alg = "authenc(hmac(sha512),cbc(des3_ede))",
4491 .test = alg_test_aead,
4493 .aead = __VECS(hmac_sha512_des3_ede_cbc_tv_temp)
4496 .alg = "authenc(hmac(sha512),ctr(aes))",
4497 .test = alg_test_null,
4500 .alg = "authenc(hmac(sha512),rfc3686(ctr(aes)))",
4501 .test = alg_test_null,
4504 .alg = "blake2b-160",
4505 .test = alg_test_hash,
4508 .hash = __VECS(blake2b_160_tv_template)
4511 .alg = "blake2b-256",
4512 .test = alg_test_hash,
4515 .hash = __VECS(blake2b_256_tv_template)
4518 .alg = "blake2b-384",
4519 .test = alg_test_hash,
4522 .hash = __VECS(blake2b_384_tv_template)
4525 .alg = "blake2b-512",
4526 .test = alg_test_hash,
4529 .hash = __VECS(blake2b_512_tv_template)
4533 .test = alg_test_skcipher,
4536 .cipher = __VECS(aes_cbc_tv_template)
4539 .alg = "cbc(anubis)",
4540 .test = alg_test_skcipher,
4542 .cipher = __VECS(anubis_cbc_tv_template)
4546 .test = alg_test_skcipher,
4548 .cipher = __VECS(aria_cbc_tv_template)
4551 .alg = "cbc(blowfish)",
4552 .test = alg_test_skcipher,
4554 .cipher = __VECS(bf_cbc_tv_template)
4557 .alg = "cbc(camellia)",
4558 .test = alg_test_skcipher,
4560 .cipher = __VECS(camellia_cbc_tv_template)
4563 .alg = "cbc(cast5)",
4564 .test = alg_test_skcipher,
4566 .cipher = __VECS(cast5_cbc_tv_template)
4569 .alg = "cbc(cast6)",
4570 .test = alg_test_skcipher,
4572 .cipher = __VECS(cast6_cbc_tv_template)
4576 .test = alg_test_skcipher,
4578 .cipher = __VECS(des_cbc_tv_template)
4581 .alg = "cbc(des3_ede)",
4582 .test = alg_test_skcipher,
4584 .cipher = __VECS(des3_ede_cbc_tv_template)
4587 /* Same as cbc(aes) except the key is stored in
4588 * hardware secure memory which we reference by index
4591 .test = alg_test_null,
4594 /* Same as cbc(sm4) except the key is stored in
4595 * hardware secure memory which we reference by index
4598 .test = alg_test_null,
4600 .alg = "cbc(serpent)",
4601 .test = alg_test_skcipher,
4603 .cipher = __VECS(serpent_cbc_tv_template)
4607 .test = alg_test_skcipher,
4609 .cipher = __VECS(sm4_cbc_tv_template)
4612 .alg = "cbc(twofish)",
4613 .test = alg_test_skcipher,
4615 .cipher = __VECS(tf_cbc_tv_template)
4618 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
4619 .alg = "cbc-paes-s390",
4621 .test = alg_test_skcipher,
4623 .cipher = __VECS(aes_cbc_tv_template)
4627 .alg = "cbcmac(aes)",
4628 .test = alg_test_hash,
4630 .hash = __VECS(aes_cbcmac_tv_template)
4633 .alg = "cbcmac(sm4)",
4634 .test = alg_test_hash,
4636 .hash = __VECS(sm4_cbcmac_tv_template)
4640 .generic_driver = "ccm_base(ctr(aes-generic),cbcmac(aes-generic))",
4641 .test = alg_test_aead,
4645 ____VECS(aes_ccm_tv_template),
4646 .einval_allowed = 1,
4651 .generic_driver = "ccm_base(ctr(sm4-generic),cbcmac(sm4-generic))",
4652 .test = alg_test_aead,
4655 ____VECS(sm4_ccm_tv_template),
4656 .einval_allowed = 1,
4661 .test = alg_test_skcipher,
4663 .cipher = __VECS(chacha20_tv_template)
4668 .test = alg_test_hash,
4670 .hash = __VECS(aes_cmac128_tv_template)
4673 .alg = "cmac(camellia)",
4674 .test = alg_test_hash,
4676 .hash = __VECS(camellia_cmac128_tv_template)
4679 .alg = "cmac(des3_ede)",
4680 .test = alg_test_hash,
4682 .hash = __VECS(des3_ede_cmac64_tv_template)
4686 .test = alg_test_hash,
4688 .hash = __VECS(sm4_cmac128_tv_template)
4691 .alg = "compress_null",
4692 .test = alg_test_null,
4695 .test = alg_test_hash,
4698 .hash = __VECS(crc32_tv_template)
4702 .test = alg_test_crc32c,
4705 .hash = __VECS(crc32c_tv_template)
4708 .alg = "crc64-rocksoft",
4709 .test = alg_test_hash,
4712 .hash = __VECS(crc64_rocksoft_tv_template)
4716 .test = alg_test_hash,
4719 .hash = __VECS(crct10dif_tv_template)
4723 .test = alg_test_skcipher,
4726 .cipher = __VECS(aes_ctr_tv_template)
4730 .test = alg_test_skcipher,
4732 .cipher = __VECS(aria_ctr_tv_template)
4735 .alg = "ctr(blowfish)",
4736 .test = alg_test_skcipher,
4738 .cipher = __VECS(bf_ctr_tv_template)
4741 .alg = "ctr(camellia)",
4742 .test = alg_test_skcipher,
4744 .cipher = __VECS(camellia_ctr_tv_template)
4747 .alg = "ctr(cast5)",
4748 .test = alg_test_skcipher,
4750 .cipher = __VECS(cast5_ctr_tv_template)
4753 .alg = "ctr(cast6)",
4754 .test = alg_test_skcipher,
4756 .cipher = __VECS(cast6_ctr_tv_template)
4760 .test = alg_test_skcipher,
4762 .cipher = __VECS(des_ctr_tv_template)
4765 .alg = "ctr(des3_ede)",
4766 .test = alg_test_skcipher,
4768 .cipher = __VECS(des3_ede_ctr_tv_template)
4771 /* Same as ctr(aes) except the key is stored in
4772 * hardware secure memory which we reference by index
4775 .test = alg_test_null,
4779 /* Same as ctr(sm4) except the key is stored in
4780 * hardware secure memory which we reference by index
4783 .test = alg_test_null,
4785 .alg = "ctr(serpent)",
4786 .test = alg_test_skcipher,
4788 .cipher = __VECS(serpent_ctr_tv_template)
4792 .test = alg_test_skcipher,
4794 .cipher = __VECS(sm4_ctr_tv_template)
4797 .alg = "ctr(twofish)",
4798 .test = alg_test_skcipher,
4800 .cipher = __VECS(tf_ctr_tv_template)
4803 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
4804 .alg = "ctr-paes-s390",
4806 .test = alg_test_skcipher,
4808 .cipher = __VECS(aes_ctr_tv_template)
4812 .alg = "cts(cbc(aes))",
4813 .test = alg_test_skcipher,
4816 .cipher = __VECS(cts_mode_tv_template)
4819 /* Same as cts(cbc((aes)) except the key is stored in
4820 * hardware secure memory which we reference by index
4822 .alg = "cts(cbc(paes))",
4823 .test = alg_test_null,
4826 .alg = "cts(cbc(sm4))",
4827 .test = alg_test_skcipher,
4829 .cipher = __VECS(sm4_cts_tv_template)
4832 .alg = "curve25519",
4833 .test = alg_test_kpp,
4835 .kpp = __VECS(curve25519_tv_template)
4839 .test = alg_test_comp,
4843 .comp = __VECS(deflate_comp_tv_template),
4844 .decomp = __VECS(deflate_decomp_tv_template)
4848 .alg = "deflate-iaa",
4849 .test = alg_test_comp,
4853 .comp = __VECS(deflate_comp_tv_template),
4854 .decomp = __VECS(deflate_decomp_tv_template)
4859 .test = alg_test_kpp,
4861 .kpp = __VECS(dh_tv_template)
4864 .alg = "digest_null",
4865 .test = alg_test_null,
4867 .alg = "drbg_nopr_ctr_aes128",
4868 .test = alg_test_drbg,
4871 .drbg = __VECS(drbg_nopr_ctr_aes128_tv_template)
4874 .alg = "drbg_nopr_ctr_aes192",
4875 .test = alg_test_drbg,
4878 .drbg = __VECS(drbg_nopr_ctr_aes192_tv_template)
4881 .alg = "drbg_nopr_ctr_aes256",
4882 .test = alg_test_drbg,
4885 .drbg = __VECS(drbg_nopr_ctr_aes256_tv_template)
4888 .alg = "drbg_nopr_hmac_sha256",
4889 .test = alg_test_drbg,
4892 .drbg = __VECS(drbg_nopr_hmac_sha256_tv_template)
4896 * There is no need to specifically test the DRBG with every
4897 * backend cipher -- covered by drbg_nopr_hmac_sha512 test
4899 .alg = "drbg_nopr_hmac_sha384",
4900 .test = alg_test_null,
4902 .alg = "drbg_nopr_hmac_sha512",
4903 .test = alg_test_drbg,
4906 .drbg = __VECS(drbg_nopr_hmac_sha512_tv_template)
4909 .alg = "drbg_nopr_sha256",
4910 .test = alg_test_drbg,
4913 .drbg = __VECS(drbg_nopr_sha256_tv_template)
4916 /* covered by drbg_nopr_sha256 test */
4917 .alg = "drbg_nopr_sha384",
4918 .test = alg_test_null,
4920 .alg = "drbg_nopr_sha512",
4922 .test = alg_test_null,
4924 .alg = "drbg_pr_ctr_aes128",
4925 .test = alg_test_drbg,
4928 .drbg = __VECS(drbg_pr_ctr_aes128_tv_template)
4931 /* covered by drbg_pr_ctr_aes128 test */
4932 .alg = "drbg_pr_ctr_aes192",
4934 .test = alg_test_null,
4936 .alg = "drbg_pr_ctr_aes256",
4938 .test = alg_test_null,
4940 .alg = "drbg_pr_hmac_sha256",
4941 .test = alg_test_drbg,
4944 .drbg = __VECS(drbg_pr_hmac_sha256_tv_template)
4947 /* covered by drbg_pr_hmac_sha256 test */
4948 .alg = "drbg_pr_hmac_sha384",
4949 .test = alg_test_null,
4951 .alg = "drbg_pr_hmac_sha512",
4952 .test = alg_test_null,
4955 .alg = "drbg_pr_sha256",
4956 .test = alg_test_drbg,
4959 .drbg = __VECS(drbg_pr_sha256_tv_template)
4962 /* covered by drbg_pr_sha256 test */
4963 .alg = "drbg_pr_sha384",
4964 .test = alg_test_null,
4966 .alg = "drbg_pr_sha512",
4968 .test = alg_test_null,
4971 .test = alg_test_skcipher,
4974 .cipher = __VECS(aes_tv_template)
4977 .alg = "ecb(anubis)",
4978 .test = alg_test_skcipher,
4980 .cipher = __VECS(anubis_tv_template)
4984 .generic_driver = "arc4-generic",
4985 .test = alg_test_skcipher,
4987 .cipher = __VECS(arc4_tv_template)
4991 .test = alg_test_skcipher,
4993 .cipher = __VECS(aria_tv_template)
4996 .alg = "ecb(blowfish)",
4997 .test = alg_test_skcipher,
4999 .cipher = __VECS(bf_tv_template)
5002 .alg = "ecb(camellia)",
5003 .test = alg_test_skcipher,
5005 .cipher = __VECS(camellia_tv_template)
5008 .alg = "ecb(cast5)",
5009 .test = alg_test_skcipher,
5011 .cipher = __VECS(cast5_tv_template)
5014 .alg = "ecb(cast6)",
5015 .test = alg_test_skcipher,
5017 .cipher = __VECS(cast6_tv_template)
5020 .alg = "ecb(cipher_null)",
5021 .test = alg_test_null,
5025 .test = alg_test_skcipher,
5027 .cipher = __VECS(des_tv_template)
5030 .alg = "ecb(des3_ede)",
5031 .test = alg_test_skcipher,
5033 .cipher = __VECS(des3_ede_tv_template)
5036 .alg = "ecb(fcrypt)",
5037 .test = alg_test_skcipher,
5040 .vecs = fcrypt_pcbc_tv_template,
5045 .alg = "ecb(khazad)",
5046 .test = alg_test_skcipher,
5048 .cipher = __VECS(khazad_tv_template)
5051 /* Same as ecb(aes) except the key is stored in
5052 * hardware secure memory which we reference by index
5055 .test = alg_test_null,
5059 .test = alg_test_skcipher,
5061 .cipher = __VECS(seed_tv_template)
5064 .alg = "ecb(serpent)",
5065 .test = alg_test_skcipher,
5067 .cipher = __VECS(serpent_tv_template)
5071 .test = alg_test_skcipher,
5073 .cipher = __VECS(sm4_tv_template)
5077 .test = alg_test_skcipher,
5079 .cipher = __VECS(tea_tv_template)
5082 .alg = "ecb(twofish)",
5083 .test = alg_test_skcipher,
5085 .cipher = __VECS(tf_tv_template)
5089 .test = alg_test_skcipher,
5091 .cipher = __VECS(xeta_tv_template)
5095 .test = alg_test_skcipher,
5097 .cipher = __VECS(xtea_tv_template)
5100 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
5101 .alg = "ecb-paes-s390",
5103 .test = alg_test_skcipher,
5105 .cipher = __VECS(aes_tv_template)
5109 .alg = "ecdh-nist-p192",
5110 .test = alg_test_kpp,
5112 .kpp = __VECS(ecdh_p192_tv_template)
5115 .alg = "ecdh-nist-p256",
5116 .test = alg_test_kpp,
5119 .kpp = __VECS(ecdh_p256_tv_template)
5122 .alg = "ecdh-nist-p384",
5123 .test = alg_test_kpp,
5126 .kpp = __VECS(ecdh_p384_tv_template)
5129 .alg = "ecdsa-nist-p192",
5130 .test = alg_test_akcipher,
5132 .akcipher = __VECS(ecdsa_nist_p192_tv_template)
5135 .alg = "ecdsa-nist-p256",
5136 .test = alg_test_akcipher,
5139 .akcipher = __VECS(ecdsa_nist_p256_tv_template)
5142 .alg = "ecdsa-nist-p384",
5143 .test = alg_test_akcipher,
5146 .akcipher = __VECS(ecdsa_nist_p384_tv_template)
5149 .alg = "ecdsa-nist-p521",
5150 .test = alg_test_akcipher,
5153 .akcipher = __VECS(ecdsa_nist_p521_tv_template)
5157 .test = alg_test_akcipher,
5159 .akcipher = __VECS(ecrdsa_tv_template)
5162 .alg = "essiv(authenc(hmac(sha256),cbc(aes)),sha256)",
5163 .test = alg_test_aead,
5166 .aead = __VECS(essiv_hmac_sha256_aes_cbc_tv_temp)
5169 .alg = "essiv(cbc(aes),sha256)",
5170 .test = alg_test_skcipher,
5173 .cipher = __VECS(essiv_aes_cbc_tv_template)
5176 #if IS_ENABLED(CONFIG_CRYPTO_DH_RFC7919_GROUPS)
5177 .alg = "ffdhe2048(dh)",
5178 .test = alg_test_kpp,
5181 .kpp = __VECS(ffdhe2048_dh_tv_template)
5184 .alg = "ffdhe3072(dh)",
5185 .test = alg_test_kpp,
5188 .kpp = __VECS(ffdhe3072_dh_tv_template)
5191 .alg = "ffdhe4096(dh)",
5192 .test = alg_test_kpp,
5195 .kpp = __VECS(ffdhe4096_dh_tv_template)
5198 .alg = "ffdhe6144(dh)",
5199 .test = alg_test_kpp,
5202 .kpp = __VECS(ffdhe6144_dh_tv_template)
5205 .alg = "ffdhe8192(dh)",
5206 .test = alg_test_kpp,
5209 .kpp = __VECS(ffdhe8192_dh_tv_template)
5212 #endif /* CONFIG_CRYPTO_DH_RFC7919_GROUPS */
5214 .generic_driver = "gcm_base(ctr(aes-generic),ghash-generic)",
5215 .test = alg_test_aead,
5218 .aead = __VECS(aes_gcm_tv_template)
5222 .generic_driver = "gcm_base(ctr(aria-generic),ghash-generic)",
5223 .test = alg_test_aead,
5225 .aead = __VECS(aria_gcm_tv_template)
5229 .generic_driver = "gcm_base(ctr(sm4-generic),ghash-generic)",
5230 .test = alg_test_aead,
5232 .aead = __VECS(sm4_gcm_tv_template)
5236 .test = alg_test_hash,
5238 .hash = __VECS(ghash_tv_template)
5241 .alg = "hctr2(aes)",
5243 "hctr2_base(xctr(aes-generic),polyval-generic)",
5244 .test = alg_test_skcipher,
5246 .cipher = __VECS(aes_hctr2_tv_template)
5250 .test = alg_test_hash,
5252 .hash = __VECS(hmac_md5_tv_template)
5255 .alg = "hmac(rmd160)",
5256 .test = alg_test_hash,
5258 .hash = __VECS(hmac_rmd160_tv_template)
5261 .alg = "hmac(sha1)",
5262 .test = alg_test_hash,
5265 .hash = __VECS(hmac_sha1_tv_template)
5268 .alg = "hmac(sha224)",
5269 .test = alg_test_hash,
5272 .hash = __VECS(hmac_sha224_tv_template)
5275 .alg = "hmac(sha256)",
5276 .test = alg_test_hash,
5279 .hash = __VECS(hmac_sha256_tv_template)
5282 .alg = "hmac(sha3-224)",
5283 .test = alg_test_hash,
5286 .hash = __VECS(hmac_sha3_224_tv_template)
5289 .alg = "hmac(sha3-256)",
5290 .test = alg_test_hash,
5293 .hash = __VECS(hmac_sha3_256_tv_template)
5296 .alg = "hmac(sha3-384)",
5297 .test = alg_test_hash,
5300 .hash = __VECS(hmac_sha3_384_tv_template)
5303 .alg = "hmac(sha3-512)",
5304 .test = alg_test_hash,
5307 .hash = __VECS(hmac_sha3_512_tv_template)
5310 .alg = "hmac(sha384)",
5311 .test = alg_test_hash,
5314 .hash = __VECS(hmac_sha384_tv_template)
5317 .alg = "hmac(sha512)",
5318 .test = alg_test_hash,
5321 .hash = __VECS(hmac_sha512_tv_template)
5325 .test = alg_test_hash,
5327 .hash = __VECS(hmac_sm3_tv_template)
5330 .alg = "hmac(streebog256)",
5331 .test = alg_test_hash,
5333 .hash = __VECS(hmac_streebog256_tv_template)
5336 .alg = "hmac(streebog512)",
5337 .test = alg_test_hash,
5339 .hash = __VECS(hmac_streebog512_tv_template)
5342 .alg = "jitterentropy_rng",
5344 .test = alg_test_null,
5347 .test = alg_test_skcipher,
5350 .cipher = __VECS(aes_kw_tv_template)
5354 .generic_driver = "lrw(ecb(aes-generic))",
5355 .test = alg_test_skcipher,
5357 .cipher = __VECS(aes_lrw_tv_template)
5360 .alg = "lrw(camellia)",
5361 .generic_driver = "lrw(ecb(camellia-generic))",
5362 .test = alg_test_skcipher,
5364 .cipher = __VECS(camellia_lrw_tv_template)
5367 .alg = "lrw(cast6)",
5368 .generic_driver = "lrw(ecb(cast6-generic))",
5369 .test = alg_test_skcipher,
5371 .cipher = __VECS(cast6_lrw_tv_template)
5374 .alg = "lrw(serpent)",
5375 .generic_driver = "lrw(ecb(serpent-generic))",
5376 .test = alg_test_skcipher,
5378 .cipher = __VECS(serpent_lrw_tv_template)
5381 .alg = "lrw(twofish)",
5382 .generic_driver = "lrw(ecb(twofish-generic))",
5383 .test = alg_test_skcipher,
5385 .cipher = __VECS(tf_lrw_tv_template)
5389 .test = alg_test_comp,
5393 .comp = __VECS(lz4_comp_tv_template),
5394 .decomp = __VECS(lz4_decomp_tv_template)
5399 .test = alg_test_comp,
5403 .comp = __VECS(lz4hc_comp_tv_template),
5404 .decomp = __VECS(lz4hc_decomp_tv_template)
5409 .test = alg_test_comp,
5413 .comp = __VECS(lzo_comp_tv_template),
5414 .decomp = __VECS(lzo_decomp_tv_template)
5419 .test = alg_test_comp,
5423 .comp = __VECS(lzorle_comp_tv_template),
5424 .decomp = __VECS(lzorle_decomp_tv_template)
5429 .test = alg_test_hash,
5431 .hash = __VECS(md4_tv_template)
5435 .test = alg_test_hash,
5437 .hash = __VECS(md5_tv_template)
5440 .alg = "michael_mic",
5441 .test = alg_test_hash,
5443 .hash = __VECS(michael_mic_tv_template)
5446 .alg = "nhpoly1305",
5447 .test = alg_test_hash,
5449 .hash = __VECS(nhpoly1305_tv_template)
5452 .alg = "pcbc(fcrypt)",
5453 .test = alg_test_skcipher,
5455 .cipher = __VECS(fcrypt_pcbc_tv_template)
5458 .alg = "pkcs1pad(rsa,sha224)",
5459 .test = alg_test_null,
5462 .alg = "pkcs1pad(rsa,sha256)",
5463 .test = alg_test_akcipher,
5466 .akcipher = __VECS(pkcs1pad_rsa_tv_template)
5469 .alg = "pkcs1pad(rsa,sha3-256)",
5470 .test = alg_test_null,
5473 .alg = "pkcs1pad(rsa,sha3-384)",
5474 .test = alg_test_null,
5477 .alg = "pkcs1pad(rsa,sha3-512)",
5478 .test = alg_test_null,
5481 .alg = "pkcs1pad(rsa,sha384)",
5482 .test = alg_test_null,
5485 .alg = "pkcs1pad(rsa,sha512)",
5486 .test = alg_test_null,
5490 .test = alg_test_hash,
5492 .hash = __VECS(poly1305_tv_template)
5496 .test = alg_test_hash,
5498 .hash = __VECS(polyval_tv_template)
5501 .alg = "rfc3686(ctr(aes))",
5502 .test = alg_test_skcipher,
5505 .cipher = __VECS(aes_ctr_rfc3686_tv_template)
5508 .alg = "rfc3686(ctr(sm4))",
5509 .test = alg_test_skcipher,
5511 .cipher = __VECS(sm4_ctr_rfc3686_tv_template)
5514 .alg = "rfc4106(gcm(aes))",
5515 .generic_driver = "rfc4106(gcm_base(ctr(aes-generic),ghash-generic))",
5516 .test = alg_test_aead,
5520 ____VECS(aes_gcm_rfc4106_tv_template),
5521 .einval_allowed = 1,
5526 .alg = "rfc4309(ccm(aes))",
5527 .generic_driver = "rfc4309(ccm_base(ctr(aes-generic),cbcmac(aes-generic)))",
5528 .test = alg_test_aead,
5532 ____VECS(aes_ccm_rfc4309_tv_template),
5533 .einval_allowed = 1,
5538 .alg = "rfc4543(gcm(aes))",
5539 .generic_driver = "rfc4543(gcm_base(ctr(aes-generic),ghash-generic))",
5540 .test = alg_test_aead,
5543 ____VECS(aes_gcm_rfc4543_tv_template),
5544 .einval_allowed = 1,
5549 .alg = "rfc7539(chacha20,poly1305)",
5550 .test = alg_test_aead,
5552 .aead = __VECS(rfc7539_tv_template)
5555 .alg = "rfc7539esp(chacha20,poly1305)",
5556 .test = alg_test_aead,
5559 ____VECS(rfc7539esp_tv_template),
5560 .einval_allowed = 1,
5566 .test = alg_test_hash,
5568 .hash = __VECS(rmd160_tv_template)
5572 .test = alg_test_akcipher,
5575 .akcipher = __VECS(rsa_tv_template)
5579 .test = alg_test_hash,
5582 .hash = __VECS(sha1_tv_template)
5586 .test = alg_test_hash,
5589 .hash = __VECS(sha224_tv_template)
5593 .test = alg_test_hash,
5596 .hash = __VECS(sha256_tv_template)
5600 .test = alg_test_hash,
5603 .hash = __VECS(sha3_224_tv_template)
5607 .test = alg_test_hash,
5610 .hash = __VECS(sha3_256_tv_template)
5614 .test = alg_test_hash,
5617 .hash = __VECS(sha3_384_tv_template)
5621 .test = alg_test_hash,
5624 .hash = __VECS(sha3_512_tv_template)
5628 .test = alg_test_hash,
5631 .hash = __VECS(sha384_tv_template)
5635 .test = alg_test_hash,
5638 .hash = __VECS(sha512_tv_template)
5642 .test = alg_test_hash,
5644 .hash = __VECS(sm3_tv_template)
5647 .alg = "streebog256",
5648 .test = alg_test_hash,
5650 .hash = __VECS(streebog256_tv_template)
5653 .alg = "streebog512",
5654 .test = alg_test_hash,
5656 .hash = __VECS(streebog512_tv_template)
5659 .alg = "vmac64(aes)",
5660 .test = alg_test_hash,
5662 .hash = __VECS(vmac64_aes_tv_template)
5666 .test = alg_test_hash,
5668 .hash = __VECS(wp256_tv_template)
5672 .test = alg_test_hash,
5674 .hash = __VECS(wp384_tv_template)
5678 .test = alg_test_hash,
5680 .hash = __VECS(wp512_tv_template)
5684 .test = alg_test_hash,
5686 .hash = __VECS(aes_xcbc128_tv_template)
5690 .test = alg_test_hash,
5692 .hash = __VECS(sm4_xcbc128_tv_template)
5696 .test = alg_test_skcipher,
5698 .cipher = __VECS(xchacha12_tv_template)
5702 .test = alg_test_skcipher,
5704 .cipher = __VECS(xchacha20_tv_template)
5708 .test = alg_test_skcipher,
5710 .cipher = __VECS(aes_xctr_tv_template)
5714 .generic_driver = "xts(ecb(aes-generic))",
5715 .test = alg_test_skcipher,
5718 .cipher = __VECS(aes_xts_tv_template)
5721 .alg = "xts(camellia)",
5722 .generic_driver = "xts(ecb(camellia-generic))",
5723 .test = alg_test_skcipher,
5725 .cipher = __VECS(camellia_xts_tv_template)
5728 .alg = "xts(cast6)",
5729 .generic_driver = "xts(ecb(cast6-generic))",
5730 .test = alg_test_skcipher,
5732 .cipher = __VECS(cast6_xts_tv_template)
5735 /* Same as xts(aes) except the key is stored in
5736 * hardware secure memory which we reference by index
5739 .test = alg_test_null,
5742 .alg = "xts(serpent)",
5743 .generic_driver = "xts(ecb(serpent-generic))",
5744 .test = alg_test_skcipher,
5746 .cipher = __VECS(serpent_xts_tv_template)
5750 .generic_driver = "xts(ecb(sm4-generic))",
5751 .test = alg_test_skcipher,
5753 .cipher = __VECS(sm4_xts_tv_template)
5756 .alg = "xts(twofish)",
5757 .generic_driver = "xts(ecb(twofish-generic))",
5758 .test = alg_test_skcipher,
5760 .cipher = __VECS(tf_xts_tv_template)
5763 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
5764 .alg = "xts-paes-s390",
5766 .test = alg_test_skcipher,
5768 .cipher = __VECS(aes_xts_tv_template)
5773 .test = alg_test_hash,
5776 .hash = __VECS(xxhash64_tv_template)
5780 .test = alg_test_comp,
5784 .comp = __VECS(zstd_comp_tv_template),
5785 .decomp = __VECS(zstd_decomp_tv_template)
5791 static void alg_check_test_descs_order(void)
5795 for (i = 1; i < ARRAY_SIZE(alg_test_descs); i++) {
5796 int diff = strcmp(alg_test_descs[i - 1].alg,
5797 alg_test_descs[i].alg);
5799 if (WARN_ON(diff > 0)) {
5800 pr_warn("testmgr: alg_test_descs entries in wrong order: '%s' before '%s'\n",
5801 alg_test_descs[i - 1].alg,
5802 alg_test_descs[i].alg);
5805 if (WARN_ON(diff == 0)) {
5806 pr_warn("testmgr: duplicate alg_test_descs entry: '%s'\n",
5807 alg_test_descs[i].alg);
5812 static void alg_check_testvec_configs(void)
5816 for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++)
5817 WARN_ON(!valid_testvec_config(
5818 &default_cipher_testvec_configs[i]));
5820 for (i = 0; i < ARRAY_SIZE(default_hash_testvec_configs); i++)
5821 WARN_ON(!valid_testvec_config(
5822 &default_hash_testvec_configs[i]));
5825 static void testmgr_onetime_init(void)
5827 alg_check_test_descs_order();
5828 alg_check_testvec_configs();
5830 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
5831 pr_warn("alg: extra crypto tests enabled. This is intended for developer use only.\n");
5835 static int alg_find_test(const char *alg)
5838 int end = ARRAY_SIZE(alg_test_descs);
5840 while (start < end) {
5841 int i = (start + end) / 2;
5842 int diff = strcmp(alg_test_descs[i].alg, alg);
5860 static int alg_fips_disabled(const char *driver, const char *alg)
5862 pr_info("alg: %s (%s) is disabled due to FIPS\n", alg, driver);
5867 int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
5873 if (!fips_enabled && notests) {
5874 printk_once(KERN_INFO "alg: self-tests disabled\n");
5878 DO_ONCE(testmgr_onetime_init);
5880 if ((type & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_CIPHER) {
5881 char nalg[CRYPTO_MAX_ALG_NAME];
5883 if (snprintf(nalg, sizeof(nalg), "ecb(%s)", alg) >=
5885 return -ENAMETOOLONG;
5887 i = alg_find_test(nalg);
5891 if (fips_enabled && !alg_test_descs[i].fips_allowed)
5894 rc = alg_test_cipher(alg_test_descs + i, driver, type, mask);
5898 i = alg_find_test(alg);
5899 j = alg_find_test(driver);
5904 if (j >= 0 && !alg_test_descs[j].fips_allowed)
5907 if (i >= 0 && !alg_test_descs[i].fips_allowed)
5913 rc |= alg_test_descs[i].test(alg_test_descs + i, driver,
5915 if (j >= 0 && j != i)
5916 rc |= alg_test_descs[j].test(alg_test_descs + j, driver,
5921 if (fips_enabled || panic_on_fail) {
5923 panic("alg: self-tests for %s (%s) failed in %s mode!\n",
5925 fips_enabled ? "fips" : "panic_on_fail");
5927 pr_warn("alg: self-tests for %s using %s failed (rc=%d)",
5930 "alg: self-tests for %s using %s failed (rc=%d)",
5934 pr_info("alg: self-tests for %s (%s) passed\n",
5941 if ((type & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_LSKCIPHER) {
5942 char nalg[CRYPTO_MAX_ALG_NAME];
5944 if (snprintf(nalg, sizeof(nalg), "ecb(%s)", alg) >=
5948 i = alg_find_test(nalg);
5952 if (fips_enabled && !alg_test_descs[i].fips_allowed)
5955 rc = alg_test_skcipher(alg_test_descs + i, driver, type, mask);
5960 printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver);
5962 if (type & CRYPTO_ALG_FIPS_INTERNAL)
5963 return alg_fips_disabled(driver, alg);
5967 return alg_fips_disabled(driver, alg);
5970 #endif /* CONFIG_CRYPTO_MANAGER_DISABLE_TESTS */
5972 EXPORT_SYMBOL_GPL(alg_test);