1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * Algorithm testing framework and tests.
5 * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
6 * Copyright (c) 2002 Jean-Francois Dive <jef@linuxbe.org>
7 * Copyright (c) 2007 Nokia Siemens Networks
8 * Copyright (c) 2008 Herbert Xu <herbert@gondor.apana.org.au>
9 * Copyright (c) 2019 Google LLC
11 * Updated RFC4106 AES-GCM testing.
12 * Authors: Aidan O'Mahony (aidan.o.mahony@intel.com)
13 * Adrian Hoban <adrian.hoban@intel.com>
14 * Gabriele Paoloni <gabriele.paoloni@intel.com>
15 * Tadeusz Struk (tadeusz.struk@intel.com)
16 * Copyright (c) 2010, Intel Corporation.
19 #include <crypto/aead.h>
20 #include <crypto/hash.h>
21 #include <crypto/skcipher.h>
22 #include <linux/err.h>
23 #include <linux/fips.h>
24 #include <linux/module.h>
25 #include <linux/once.h>
26 #include <linux/random.h>
27 #include <linux/scatterlist.h>
28 #include <linux/slab.h>
29 #include <linux/string.h>
30 #include <linux/uio.h>
31 #include <crypto/rng.h>
32 #include <crypto/drbg.h>
33 #include <crypto/akcipher.h>
34 #include <crypto/kpp.h>
35 #include <crypto/acompress.h>
36 #include <crypto/internal/cipher.h>
37 #include <crypto/internal/simd.h>
41 MODULE_IMPORT_NS(CRYPTO_INTERNAL
);
44 module_param(notests
, bool, 0644);
45 MODULE_PARM_DESC(notests
, "disable crypto self-tests");
47 static bool panic_on_fail
;
48 module_param(panic_on_fail
, bool, 0444);
50 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
51 static bool noextratests
;
52 module_param(noextratests
, bool, 0644);
53 MODULE_PARM_DESC(noextratests
, "disable expensive crypto self-tests");
55 static unsigned int fuzz_iterations
= 100;
56 module_param(fuzz_iterations
, uint
, 0644);
57 MODULE_PARM_DESC(fuzz_iterations
, "number of fuzz test iterations");
60 #ifdef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS
63 int alg_test(const char *driver
, const char *alg
, u32 type
, u32 mask
)
73 * Need slab memory for testing (size in number of pages).
78 * Used by test_cipher()
83 struct aead_test_suite
{
84 const struct aead_testvec
*vecs
;
88 * Set if trying to decrypt an inauthentic ciphertext with this
89 * algorithm might result in EINVAL rather than EBADMSG, due to other
90 * validation the algorithm does on the inputs such as length checks.
92 unsigned int einval_allowed
: 1;
95 * Set if this algorithm requires that the IV be located at the end of
96 * the AAD buffer, in addition to being given in the normal way. The
97 * behavior when the two IV copies differ is implementation-defined.
99 unsigned int aad_iv
: 1;
102 struct cipher_test_suite
{
103 const struct cipher_testvec
*vecs
;
107 struct comp_test_suite
{
109 const struct comp_testvec
*vecs
;
114 struct hash_test_suite
{
115 const struct hash_testvec
*vecs
;
119 struct cprng_test_suite
{
120 const struct cprng_testvec
*vecs
;
124 struct drbg_test_suite
{
125 const struct drbg_testvec
*vecs
;
129 struct akcipher_test_suite
{
130 const struct akcipher_testvec
*vecs
;
134 struct kpp_test_suite
{
135 const struct kpp_testvec
*vecs
;
139 struct alg_test_desc
{
141 const char *generic_driver
;
142 int (*test
)(const struct alg_test_desc
*desc
, const char *driver
,
144 int fips_allowed
; /* set if alg is allowed in fips mode */
147 struct aead_test_suite aead
;
148 struct cipher_test_suite cipher
;
149 struct comp_test_suite comp
;
150 struct hash_test_suite hash
;
151 struct cprng_test_suite cprng
;
152 struct drbg_test_suite drbg
;
153 struct akcipher_test_suite akcipher
;
154 struct kpp_test_suite kpp
;
158 static void hexdump(unsigned char *buf
, unsigned int len
)
160 print_hex_dump(KERN_CONT
, "", DUMP_PREFIX_OFFSET
,
165 static int __testmgr_alloc_buf(char *buf
[XBUFSIZE
], int order
)
169 for (i
= 0; i
< XBUFSIZE
; i
++) {
170 buf
[i
] = (char *)__get_free_pages(GFP_KERNEL
, order
);
179 free_pages((unsigned long)buf
[i
], order
);
184 static int testmgr_alloc_buf(char *buf
[XBUFSIZE
])
186 return __testmgr_alloc_buf(buf
, 0);
189 static void __testmgr_free_buf(char *buf
[XBUFSIZE
], int order
)
193 for (i
= 0; i
< XBUFSIZE
; i
++)
194 free_pages((unsigned long)buf
[i
], order
);
197 static void testmgr_free_buf(char *buf
[XBUFSIZE
])
199 __testmgr_free_buf(buf
, 0);
202 #define TESTMGR_POISON_BYTE 0xfe
203 #define TESTMGR_POISON_LEN 16
205 static inline void testmgr_poison(void *addr
, size_t len
)
207 memset(addr
, TESTMGR_POISON_BYTE
, len
);
210 /* Is the memory region still fully poisoned? */
211 static inline bool testmgr_is_poison(const void *addr
, size_t len
)
213 return memchr_inv(addr
, TESTMGR_POISON_BYTE
, len
) == NULL
;
216 /* flush type for hash algorithms */
218 /* merge with update of previous buffer(s) */
221 /* update with previous buffer(s) before doing this one */
224 /* likewise, but also export and re-import the intermediate state */
228 /* finalization function for hash algorithms */
229 enum finalization_type
{
230 FINALIZATION_TYPE_FINAL
, /* use final() */
231 FINALIZATION_TYPE_FINUP
, /* use finup() */
232 FINALIZATION_TYPE_DIGEST
, /* use digest() */
236 * Whether the crypto operation will occur in-place, and if so whether the
237 * source and destination scatterlist pointers will coincide (req->src ==
238 * req->dst), or whether they'll merely point to two separate scatterlists
239 * (req->src != req->dst) that reference the same underlying memory.
241 * This is only relevant for algorithm types that support in-place operation.
249 #define TEST_SG_TOTAL 10000
252 * struct test_sg_division - description of a scatterlist entry
254 * This struct describes one entry of a scatterlist being constructed to check a
255 * crypto test vector.
257 * @proportion_of_total: length of this chunk relative to the total length,
258 * given as a proportion out of TEST_SG_TOTAL so that it
259 * scales to fit any test vector
260 * @offset: byte offset into a 2-page buffer at which this chunk will start
261 * @offset_relative_to_alignmask: if true, add the algorithm's alignmask to the
263 * @flush_type: for hashes, whether an update() should be done now vs.
264 * continuing to accumulate data
265 * @nosimd: if doing the pending update(), do it with SIMD disabled?
267 struct test_sg_division
{
268 unsigned int proportion_of_total
;
270 bool offset_relative_to_alignmask
;
271 enum flush_type flush_type
;
276 * struct testvec_config - configuration for testing a crypto test vector
278 * This struct describes the data layout and other parameters with which each
279 * crypto test vector can be tested.
281 * @name: name of this config, logged for debugging purposes if a test fails
282 * @inplace_mode: whether and how to operate on the data in-place, if applicable
283 * @req_flags: extra request_flags, e.g. CRYPTO_TFM_REQ_MAY_SLEEP
284 * @src_divs: description of how to arrange the source scatterlist
285 * @dst_divs: description of how to arrange the dst scatterlist, if applicable
286 * for the algorithm type. Defaults to @src_divs if unset.
287 * @iv_offset: misalignment of the IV in the range [0..MAX_ALGAPI_ALIGNMASK+1],
288 * where 0 is aligned to a 2*(MAX_ALGAPI_ALIGNMASK+1) byte boundary
289 * @iv_offset_relative_to_alignmask: if true, add the algorithm's alignmask to
291 * @key_offset: misalignment of the key, where 0 is default alignment
292 * @key_offset_relative_to_alignmask: if true, add the algorithm's alignmask to
294 * @finalization_type: what finalization function to use for hashes
295 * @nosimd: execute with SIMD disabled? Requires !CRYPTO_TFM_REQ_MAY_SLEEP.
297 struct testvec_config
{
299 enum inplace_mode inplace_mode
;
301 struct test_sg_division src_divs
[XBUFSIZE
];
302 struct test_sg_division dst_divs
[XBUFSIZE
];
303 unsigned int iv_offset
;
304 unsigned int key_offset
;
305 bool iv_offset_relative_to_alignmask
;
306 bool key_offset_relative_to_alignmask
;
307 enum finalization_type finalization_type
;
311 #define TESTVEC_CONFIG_NAMELEN 192
314 * The following are the lists of testvec_configs to test for each algorithm
315 * type when the basic crypto self-tests are enabled, i.e. when
316 * CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is unset. They aim to provide good test
317 * coverage, while keeping the test time much shorter than the full fuzz tests
318 * so that the basic tests can be enabled in a wider range of circumstances.
321 /* Configs for skciphers and aeads */
322 static const struct testvec_config default_cipher_testvec_configs
[] = {
324 .name
= "in-place (one sglist)",
325 .inplace_mode
= INPLACE_ONE_SGLIST
,
326 .src_divs
= { { .proportion_of_total
= 10000 } },
328 .name
= "in-place (two sglists)",
329 .inplace_mode
= INPLACE_TWO_SGLISTS
,
330 .src_divs
= { { .proportion_of_total
= 10000 } },
332 .name
= "out-of-place",
333 .inplace_mode
= OUT_OF_PLACE
,
334 .src_divs
= { { .proportion_of_total
= 10000 } },
336 .name
= "unaligned buffer, offset=1",
337 .src_divs
= { { .proportion_of_total
= 10000, .offset
= 1 } },
341 .name
= "buffer aligned only to alignmask",
344 .proportion_of_total
= 10000,
346 .offset_relative_to_alignmask
= true,
350 .iv_offset_relative_to_alignmask
= true,
352 .key_offset_relative_to_alignmask
= true,
354 .name
= "two even aligned splits",
356 { .proportion_of_total
= 5000 },
357 { .proportion_of_total
= 5000 },
360 .name
= "one src, two even splits dst",
361 .inplace_mode
= OUT_OF_PLACE
,
362 .src_divs
= { { .proportion_of_total
= 10000 } },
364 { .proportion_of_total
= 5000 },
365 { .proportion_of_total
= 5000 },
368 .name
= "uneven misaligned splits, may sleep",
369 .req_flags
= CRYPTO_TFM_REQ_MAY_SLEEP
,
371 { .proportion_of_total
= 1900, .offset
= 33 },
372 { .proportion_of_total
= 3300, .offset
= 7 },
373 { .proportion_of_total
= 4800, .offset
= 18 },
378 .name
= "misaligned splits crossing pages, inplace",
379 .inplace_mode
= INPLACE_ONE_SGLIST
,
382 .proportion_of_total
= 7500,
383 .offset
= PAGE_SIZE
- 32
385 .proportion_of_total
= 2500,
386 .offset
= PAGE_SIZE
- 7
392 static const struct testvec_config default_hash_testvec_configs
[] = {
394 .name
= "init+update+final aligned buffer",
395 .src_divs
= { { .proportion_of_total
= 10000 } },
396 .finalization_type
= FINALIZATION_TYPE_FINAL
,
398 .name
= "init+finup aligned buffer",
399 .src_divs
= { { .proportion_of_total
= 10000 } },
400 .finalization_type
= FINALIZATION_TYPE_FINUP
,
402 .name
= "digest aligned buffer",
403 .src_divs
= { { .proportion_of_total
= 10000 } },
404 .finalization_type
= FINALIZATION_TYPE_DIGEST
,
406 .name
= "init+update+final misaligned buffer",
407 .src_divs
= { { .proportion_of_total
= 10000, .offset
= 1 } },
408 .finalization_type
= FINALIZATION_TYPE_FINAL
,
411 .name
= "digest buffer aligned only to alignmask",
414 .proportion_of_total
= 10000,
416 .offset_relative_to_alignmask
= true,
419 .finalization_type
= FINALIZATION_TYPE_DIGEST
,
421 .key_offset_relative_to_alignmask
= true,
423 .name
= "init+update+update+final two even splits",
425 { .proportion_of_total
= 5000 },
427 .proportion_of_total
= 5000,
428 .flush_type
= FLUSH_TYPE_FLUSH
,
431 .finalization_type
= FINALIZATION_TYPE_FINAL
,
433 .name
= "digest uneven misaligned splits, may sleep",
434 .req_flags
= CRYPTO_TFM_REQ_MAY_SLEEP
,
436 { .proportion_of_total
= 1900, .offset
= 33 },
437 { .proportion_of_total
= 3300, .offset
= 7 },
438 { .proportion_of_total
= 4800, .offset
= 18 },
440 .finalization_type
= FINALIZATION_TYPE_DIGEST
,
442 .name
= "digest misaligned splits crossing pages",
445 .proportion_of_total
= 7500,
446 .offset
= PAGE_SIZE
- 32,
448 .proportion_of_total
= 2500,
449 .offset
= PAGE_SIZE
- 7,
452 .finalization_type
= FINALIZATION_TYPE_DIGEST
,
454 .name
= "import/export",
457 .proportion_of_total
= 6500,
458 .flush_type
= FLUSH_TYPE_REIMPORT
,
460 .proportion_of_total
= 3500,
461 .flush_type
= FLUSH_TYPE_REIMPORT
,
464 .finalization_type
= FINALIZATION_TYPE_FINAL
,
468 static unsigned int count_test_sg_divisions(const struct test_sg_division
*divs
)
470 unsigned int remaining
= TEST_SG_TOTAL
;
471 unsigned int ndivs
= 0;
474 remaining
-= divs
[ndivs
++].proportion_of_total
;
480 #define SGDIVS_HAVE_FLUSHES BIT(0)
481 #define SGDIVS_HAVE_NOSIMD BIT(1)
483 static bool valid_sg_divisions(const struct test_sg_division
*divs
,
484 unsigned int count
, int *flags_ret
)
486 unsigned int total
= 0;
489 for (i
= 0; i
< count
&& total
!= TEST_SG_TOTAL
; i
++) {
490 if (divs
[i
].proportion_of_total
<= 0 ||
491 divs
[i
].proportion_of_total
> TEST_SG_TOTAL
- total
)
493 total
+= divs
[i
].proportion_of_total
;
494 if (divs
[i
].flush_type
!= FLUSH_TYPE_NONE
)
495 *flags_ret
|= SGDIVS_HAVE_FLUSHES
;
497 *flags_ret
|= SGDIVS_HAVE_NOSIMD
;
499 return total
== TEST_SG_TOTAL
&&
500 memchr_inv(&divs
[i
], 0, (count
- i
) * sizeof(divs
[0])) == NULL
;
504 * Check whether the given testvec_config is valid. This isn't strictly needed
505 * since every testvec_config should be valid, but check anyway so that people
506 * don't unknowingly add broken configs that don't do what they wanted.
508 static bool valid_testvec_config(const struct testvec_config
*cfg
)
512 if (cfg
->name
== NULL
)
515 if (!valid_sg_divisions(cfg
->src_divs
, ARRAY_SIZE(cfg
->src_divs
),
519 if (cfg
->dst_divs
[0].proportion_of_total
) {
520 if (!valid_sg_divisions(cfg
->dst_divs
,
521 ARRAY_SIZE(cfg
->dst_divs
), &flags
))
524 if (memchr_inv(cfg
->dst_divs
, 0, sizeof(cfg
->dst_divs
)))
526 /* defaults to dst_divs=src_divs */
530 (cfg
->iv_offset_relative_to_alignmask
? MAX_ALGAPI_ALIGNMASK
: 0) >
531 MAX_ALGAPI_ALIGNMASK
+ 1)
534 if ((flags
& (SGDIVS_HAVE_FLUSHES
| SGDIVS_HAVE_NOSIMD
)) &&
535 cfg
->finalization_type
== FINALIZATION_TYPE_DIGEST
)
538 if ((cfg
->nosimd
|| (flags
& SGDIVS_HAVE_NOSIMD
)) &&
539 (cfg
->req_flags
& CRYPTO_TFM_REQ_MAY_SLEEP
))
546 char *bufs
[XBUFSIZE
];
547 struct scatterlist sgl
[XBUFSIZE
];
548 struct scatterlist sgl_saved
[XBUFSIZE
];
549 struct scatterlist
*sgl_ptr
;
553 static int init_test_sglist(struct test_sglist
*tsgl
)
555 return __testmgr_alloc_buf(tsgl
->bufs
, 1 /* two pages per buffer */);
558 static void destroy_test_sglist(struct test_sglist
*tsgl
)
560 return __testmgr_free_buf(tsgl
->bufs
, 1 /* two pages per buffer */);
564 * build_test_sglist() - build a scatterlist for a crypto test
566 * @tsgl: the scatterlist to build. @tsgl->bufs[] contains an array of 2-page
567 * buffers which the scatterlist @tsgl->sgl[] will be made to point into.
568 * @divs: the layout specification on which the scatterlist will be based
569 * @alignmask: the algorithm's alignmask
570 * @total_len: the total length of the scatterlist to build in bytes
571 * @data: if non-NULL, the buffers will be filled with this data until it ends.
572 * Otherwise the buffers will be poisoned. In both cases, some bytes
573 * past the end of each buffer will be poisoned to help detect overruns.
574 * @out_divs: if non-NULL, the test_sg_division to which each scatterlist entry
575 * corresponds will be returned here. This will match @divs except
576 * that divisions resolving to a length of 0 are omitted as they are
577 * not included in the scatterlist.
579 * Return: 0 or a -errno value
581 static int build_test_sglist(struct test_sglist
*tsgl
,
582 const struct test_sg_division
*divs
,
583 const unsigned int alignmask
,
584 const unsigned int total_len
,
585 struct iov_iter
*data
,
586 const struct test_sg_division
*out_divs
[XBUFSIZE
])
589 const struct test_sg_division
*div
;
591 } partitions
[XBUFSIZE
];
592 const unsigned int ndivs
= count_test_sg_divisions(divs
);
593 unsigned int len_remaining
= total_len
;
596 BUILD_BUG_ON(ARRAY_SIZE(partitions
) != ARRAY_SIZE(tsgl
->sgl
));
597 if (WARN_ON(ndivs
> ARRAY_SIZE(partitions
)))
600 /* Calculate the (div, length) pairs */
602 for (i
= 0; i
< ndivs
; i
++) {
603 unsigned int len_this_sg
=
605 (total_len
* divs
[i
].proportion_of_total
+
606 TEST_SG_TOTAL
/ 2) / TEST_SG_TOTAL
);
608 if (len_this_sg
!= 0) {
609 partitions
[tsgl
->nents
].div
= &divs
[i
];
610 partitions
[tsgl
->nents
].length
= len_this_sg
;
612 len_remaining
-= len_this_sg
;
615 if (tsgl
->nents
== 0) {
616 partitions
[tsgl
->nents
].div
= &divs
[0];
617 partitions
[tsgl
->nents
].length
= 0;
620 partitions
[tsgl
->nents
- 1].length
+= len_remaining
;
622 /* Set up the sgl entries and fill the data or poison */
623 sg_init_table(tsgl
->sgl
, tsgl
->nents
);
624 for (i
= 0; i
< tsgl
->nents
; i
++) {
625 unsigned int offset
= partitions
[i
].div
->offset
;
628 if (partitions
[i
].div
->offset_relative_to_alignmask
)
631 while (offset
+ partitions
[i
].length
+ TESTMGR_POISON_LEN
>
633 if (WARN_ON(offset
<= 0))
638 addr
= &tsgl
->bufs
[i
][offset
];
639 sg_set_buf(&tsgl
->sgl
[i
], addr
, partitions
[i
].length
);
642 out_divs
[i
] = partitions
[i
].div
;
645 size_t copy_len
, copied
;
647 copy_len
= min(partitions
[i
].length
, data
->count
);
648 copied
= copy_from_iter(addr
, copy_len
, data
);
649 if (WARN_ON(copied
!= copy_len
))
651 testmgr_poison(addr
+ copy_len
, partitions
[i
].length
+
652 TESTMGR_POISON_LEN
- copy_len
);
654 testmgr_poison(addr
, partitions
[i
].length
+
659 sg_mark_end(&tsgl
->sgl
[tsgl
->nents
- 1]);
660 tsgl
->sgl_ptr
= tsgl
->sgl
;
661 memcpy(tsgl
->sgl_saved
, tsgl
->sgl
, tsgl
->nents
* sizeof(tsgl
->sgl
[0]));
666 * Verify that a scatterlist crypto operation produced the correct output.
668 * @tsgl: scatterlist containing the actual output
669 * @expected_output: buffer containing the expected output
670 * @len_to_check: length of @expected_output in bytes
671 * @unchecked_prefix_len: number of ignored bytes in @tsgl prior to real result
672 * @check_poison: verify that the poison bytes after each chunk are intact?
674 * Return: 0 if correct, -EINVAL if incorrect, -EOVERFLOW if buffer overrun.
676 static int verify_correct_output(const struct test_sglist
*tsgl
,
677 const char *expected_output
,
678 unsigned int len_to_check
,
679 unsigned int unchecked_prefix_len
,
684 for (i
= 0; i
< tsgl
->nents
; i
++) {
685 struct scatterlist
*sg
= &tsgl
->sgl_ptr
[i
];
686 unsigned int len
= sg
->length
;
687 unsigned int offset
= sg
->offset
;
688 const char *actual_output
;
690 if (unchecked_prefix_len
) {
691 if (unchecked_prefix_len
>= len
) {
692 unchecked_prefix_len
-= len
;
695 offset
+= unchecked_prefix_len
;
696 len
-= unchecked_prefix_len
;
697 unchecked_prefix_len
= 0;
699 len
= min(len
, len_to_check
);
700 actual_output
= page_address(sg_page(sg
)) + offset
;
701 if (memcmp(expected_output
, actual_output
, len
) != 0)
704 !testmgr_is_poison(actual_output
+ len
, TESTMGR_POISON_LEN
))
707 expected_output
+= len
;
709 if (WARN_ON(len_to_check
!= 0))
714 static bool is_test_sglist_corrupted(const struct test_sglist
*tsgl
)
718 for (i
= 0; i
< tsgl
->nents
; i
++) {
719 if (tsgl
->sgl
[i
].page_link
!= tsgl
->sgl_saved
[i
].page_link
)
721 if (tsgl
->sgl
[i
].offset
!= tsgl
->sgl_saved
[i
].offset
)
723 if (tsgl
->sgl
[i
].length
!= tsgl
->sgl_saved
[i
].length
)
729 struct cipher_test_sglists
{
730 struct test_sglist src
;
731 struct test_sglist dst
;
734 static struct cipher_test_sglists
*alloc_cipher_test_sglists(void)
736 struct cipher_test_sglists
*tsgls
;
738 tsgls
= kmalloc(sizeof(*tsgls
), GFP_KERNEL
);
742 if (init_test_sglist(&tsgls
->src
) != 0)
744 if (init_test_sglist(&tsgls
->dst
) != 0)
745 goto fail_destroy_src
;
750 destroy_test_sglist(&tsgls
->src
);
756 static void free_cipher_test_sglists(struct cipher_test_sglists
*tsgls
)
759 destroy_test_sglist(&tsgls
->src
);
760 destroy_test_sglist(&tsgls
->dst
);
765 /* Build the src and dst scatterlists for an skcipher or AEAD test */
766 static int build_cipher_test_sglists(struct cipher_test_sglists
*tsgls
,
767 const struct testvec_config
*cfg
,
768 unsigned int alignmask
,
769 unsigned int src_total_len
,
770 unsigned int dst_total_len
,
771 const struct kvec
*inputs
,
772 unsigned int nr_inputs
)
774 struct iov_iter input
;
777 iov_iter_kvec(&input
, ITER_SOURCE
, inputs
, nr_inputs
, src_total_len
);
778 err
= build_test_sglist(&tsgls
->src
, cfg
->src_divs
, alignmask
,
779 cfg
->inplace_mode
!= OUT_OF_PLACE
?
780 max(dst_total_len
, src_total_len
) :
787 * In-place crypto operations can use the same scatterlist for both the
788 * source and destination (req->src == req->dst), or can use separate
789 * scatterlists (req->src != req->dst) which point to the same
790 * underlying memory. Make sure to test both cases.
792 if (cfg
->inplace_mode
== INPLACE_ONE_SGLIST
) {
793 tsgls
->dst
.sgl_ptr
= tsgls
->src
.sgl
;
794 tsgls
->dst
.nents
= tsgls
->src
.nents
;
797 if (cfg
->inplace_mode
== INPLACE_TWO_SGLISTS
) {
799 * For now we keep it simple and only test the case where the
800 * two scatterlists have identical entries, rather than
801 * different entries that split up the same memory differently.
803 memcpy(tsgls
->dst
.sgl
, tsgls
->src
.sgl
,
804 tsgls
->src
.nents
* sizeof(tsgls
->src
.sgl
[0]));
805 memcpy(tsgls
->dst
.sgl_saved
, tsgls
->src
.sgl
,
806 tsgls
->src
.nents
* sizeof(tsgls
->src
.sgl
[0]));
807 tsgls
->dst
.sgl_ptr
= tsgls
->dst
.sgl
;
808 tsgls
->dst
.nents
= tsgls
->src
.nents
;
812 return build_test_sglist(&tsgls
->dst
,
813 cfg
->dst_divs
[0].proportion_of_total
?
814 cfg
->dst_divs
: cfg
->src_divs
,
815 alignmask
, dst_total_len
, NULL
, NULL
);
819 * Support for testing passing a misaligned key to setkey():
821 * If cfg->key_offset is set, copy the key into a new buffer at that offset,
822 * optionally adding alignmask. Else, just use the key directly.
824 static int prepare_keybuf(const u8
*key
, unsigned int ksize
,
825 const struct testvec_config
*cfg
,
826 unsigned int alignmask
,
827 const u8
**keybuf_ret
, const u8
**keyptr_ret
)
829 unsigned int key_offset
= cfg
->key_offset
;
830 u8
*keybuf
= NULL
, *keyptr
= (u8
*)key
;
832 if (key_offset
!= 0) {
833 if (cfg
->key_offset_relative_to_alignmask
)
834 key_offset
+= alignmask
;
835 keybuf
= kmalloc(key_offset
+ ksize
, GFP_KERNEL
);
838 keyptr
= keybuf
+ key_offset
;
839 memcpy(keyptr
, key
, ksize
);
841 *keybuf_ret
= keybuf
;
842 *keyptr_ret
= keyptr
;
846 /* Like setkey_f(tfm, key, ksize), but sometimes misalign the key */
847 #define do_setkey(setkey_f, tfm, key, ksize, cfg, alignmask) \
849 const u8 *keybuf, *keyptr; \
852 err = prepare_keybuf((key), (ksize), (cfg), (alignmask), \
855 err = setkey_f((tfm), keyptr, (ksize)); \
861 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
864 * The fuzz tests use prandom instead of the normal Linux RNG since they don't
865 * need cryptographically secure random numbers. This greatly improves the
866 * performance of these tests, especially if they are run before the Linux RNG
867 * has been initialized or if they are run on a lockdep-enabled kernel.
870 static inline void init_rnd_state(struct rnd_state
*rng
)
872 prandom_seed_state(rng
, get_random_u64());
875 static inline u8
prandom_u8(struct rnd_state
*rng
)
877 return prandom_u32_state(rng
);
880 static inline u32
prandom_u32_below(struct rnd_state
*rng
, u32 ceil
)
883 * This is slightly biased for non-power-of-2 values of 'ceil', but this
884 * isn't important here.
886 return prandom_u32_state(rng
) % ceil
;
889 static inline bool prandom_bool(struct rnd_state
*rng
)
891 return prandom_u32_below(rng
, 2);
894 static inline u32
prandom_u32_inclusive(struct rnd_state
*rng
,
897 return floor
+ prandom_u32_below(rng
, ceil
- floor
+ 1);
900 /* Generate a random length in range [0, max_len], but prefer smaller values */
901 static unsigned int generate_random_length(struct rnd_state
*rng
,
902 unsigned int max_len
)
904 unsigned int len
= prandom_u32_below(rng
, max_len
+ 1);
906 switch (prandom_u32_below(rng
, 4)) {
918 /* Flip a random bit in the given nonempty data buffer */
919 static void flip_random_bit(struct rnd_state
*rng
, u8
*buf
, size_t size
)
923 bitpos
= prandom_u32_below(rng
, size
* 8);
924 buf
[bitpos
/ 8] ^= 1 << (bitpos
% 8);
927 /* Flip a random byte in the given nonempty data buffer */
928 static void flip_random_byte(struct rnd_state
*rng
, u8
*buf
, size_t size
)
930 buf
[prandom_u32_below(rng
, size
)] ^= 0xff;
933 /* Sometimes make some random changes to the given nonempty data buffer */
934 static void mutate_buffer(struct rnd_state
*rng
, u8
*buf
, size_t size
)
939 /* Sometimes flip some bits */
940 if (prandom_u32_below(rng
, 4) == 0) {
941 num_flips
= min_t(size_t, 1 << prandom_u32_below(rng
, 8),
943 for (i
= 0; i
< num_flips
; i
++)
944 flip_random_bit(rng
, buf
, size
);
947 /* Sometimes flip some bytes */
948 if (prandom_u32_below(rng
, 4) == 0) {
949 num_flips
= min_t(size_t, 1 << prandom_u32_below(rng
, 8), size
);
950 for (i
= 0; i
< num_flips
; i
++)
951 flip_random_byte(rng
, buf
, size
);
955 /* Randomly generate 'count' bytes, but sometimes make them "interesting" */
956 static void generate_random_bytes(struct rnd_state
*rng
, u8
*buf
, size_t count
)
965 switch (prandom_u32_below(rng
, 8)) { /* Choose a generation strategy */
968 /* All the same byte, plus optional mutations */
969 switch (prandom_u32_below(rng
, 4)) {
980 memset(buf
, b
, count
);
981 mutate_buffer(rng
, buf
, count
);
984 /* Ascending or descending bytes, plus optional mutations */
985 increment
= prandom_u8(rng
);
987 for (i
= 0; i
< count
; i
++, b
+= increment
)
989 mutate_buffer(rng
, buf
, count
);
992 /* Fully random bytes */
993 prandom_bytes_state(rng
, buf
, count
);
997 static char *generate_random_sgl_divisions(struct rnd_state
*rng
,
998 struct test_sg_division
*divs
,
999 size_t max_divs
, char *p
, char *end
,
1000 bool gen_flushes
, u32 req_flags
)
1002 struct test_sg_division
*div
= divs
;
1003 unsigned int remaining
= TEST_SG_TOTAL
;
1006 unsigned int this_len
;
1007 const char *flushtype_str
;
1009 if (div
== &divs
[max_divs
- 1] || prandom_bool(rng
))
1010 this_len
= remaining
;
1012 this_len
= prandom_u32_inclusive(rng
, 1, remaining
);
1013 div
->proportion_of_total
= this_len
;
1015 if (prandom_u32_below(rng
, 4) == 0)
1016 div
->offset
= prandom_u32_inclusive(rng
,
1019 else if (prandom_bool(rng
))
1020 div
->offset
= prandom_u32_below(rng
, 32);
1022 div
->offset
= prandom_u32_below(rng
, PAGE_SIZE
);
1023 if (prandom_u32_below(rng
, 8) == 0)
1024 div
->offset_relative_to_alignmask
= true;
1026 div
->flush_type
= FLUSH_TYPE_NONE
;
1028 switch (prandom_u32_below(rng
, 4)) {
1030 div
->flush_type
= FLUSH_TYPE_REIMPORT
;
1033 div
->flush_type
= FLUSH_TYPE_FLUSH
;
1038 if (div
->flush_type
!= FLUSH_TYPE_NONE
&&
1039 !(req_flags
& CRYPTO_TFM_REQ_MAY_SLEEP
) &&
1043 switch (div
->flush_type
) {
1044 case FLUSH_TYPE_FLUSH
:
1046 flushtype_str
= "<flush,nosimd>";
1048 flushtype_str
= "<flush>";
1050 case FLUSH_TYPE_REIMPORT
:
1052 flushtype_str
= "<reimport,nosimd>";
1054 flushtype_str
= "<reimport>";
1061 BUILD_BUG_ON(TEST_SG_TOTAL
!= 10000); /* for "%u.%u%%" */
1062 p
+= scnprintf(p
, end
- p
, "%s%u.%u%%@%s+%u%s", flushtype_str
,
1063 this_len
/ 100, this_len
% 100,
1064 div
->offset_relative_to_alignmask
?
1066 div
->offset
, this_len
== remaining
? "" : ", ");
1067 remaining
-= this_len
;
1069 } while (remaining
);
1074 /* Generate a random testvec_config for fuzz testing */
1075 static void generate_random_testvec_config(struct rnd_state
*rng
,
1076 struct testvec_config
*cfg
,
1077 char *name
, size_t max_namelen
)
1080 char * const end
= name
+ max_namelen
;
1082 memset(cfg
, 0, sizeof(*cfg
));
1086 p
+= scnprintf(p
, end
- p
, "random:");
1088 switch (prandom_u32_below(rng
, 4)) {
1091 cfg
->inplace_mode
= OUT_OF_PLACE
;
1094 cfg
->inplace_mode
= INPLACE_ONE_SGLIST
;
1095 p
+= scnprintf(p
, end
- p
, " inplace_one_sglist");
1098 cfg
->inplace_mode
= INPLACE_TWO_SGLISTS
;
1099 p
+= scnprintf(p
, end
- p
, " inplace_two_sglists");
1103 if (prandom_bool(rng
)) {
1104 cfg
->req_flags
|= CRYPTO_TFM_REQ_MAY_SLEEP
;
1105 p
+= scnprintf(p
, end
- p
, " may_sleep");
1108 switch (prandom_u32_below(rng
, 4)) {
1110 cfg
->finalization_type
= FINALIZATION_TYPE_FINAL
;
1111 p
+= scnprintf(p
, end
- p
, " use_final");
1114 cfg
->finalization_type
= FINALIZATION_TYPE_FINUP
;
1115 p
+= scnprintf(p
, end
- p
, " use_finup");
1118 cfg
->finalization_type
= FINALIZATION_TYPE_DIGEST
;
1119 p
+= scnprintf(p
, end
- p
, " use_digest");
1123 if (!(cfg
->req_flags
& CRYPTO_TFM_REQ_MAY_SLEEP
) && prandom_bool(rng
)) {
1125 p
+= scnprintf(p
, end
- p
, " nosimd");
1128 p
+= scnprintf(p
, end
- p
, " src_divs=[");
1129 p
= generate_random_sgl_divisions(rng
, cfg
->src_divs
,
1130 ARRAY_SIZE(cfg
->src_divs
), p
, end
,
1131 (cfg
->finalization_type
!=
1132 FINALIZATION_TYPE_DIGEST
),
1134 p
+= scnprintf(p
, end
- p
, "]");
1136 if (cfg
->inplace_mode
== OUT_OF_PLACE
&& prandom_bool(rng
)) {
1137 p
+= scnprintf(p
, end
- p
, " dst_divs=[");
1138 p
= generate_random_sgl_divisions(rng
, cfg
->dst_divs
,
1139 ARRAY_SIZE(cfg
->dst_divs
),
1142 p
+= scnprintf(p
, end
- p
, "]");
1145 if (prandom_bool(rng
)) {
1146 cfg
->iv_offset
= prandom_u32_inclusive(rng
, 1,
1147 MAX_ALGAPI_ALIGNMASK
);
1148 p
+= scnprintf(p
, end
- p
, " iv_offset=%u", cfg
->iv_offset
);
1151 if (prandom_bool(rng
)) {
1152 cfg
->key_offset
= prandom_u32_inclusive(rng
, 1,
1153 MAX_ALGAPI_ALIGNMASK
);
1154 p
+= scnprintf(p
, end
- p
, " key_offset=%u", cfg
->key_offset
);
1157 WARN_ON_ONCE(!valid_testvec_config(cfg
));
1160 static void crypto_disable_simd_for_test(void)
1163 __this_cpu_write(crypto_simd_disabled_for_test
, true);
1166 static void crypto_reenable_simd_for_test(void)
1168 __this_cpu_write(crypto_simd_disabled_for_test
, false);
1173 * Given an algorithm name, build the name of the generic implementation of that
1174 * algorithm, assuming the usual naming convention. Specifically, this appends
1175 * "-generic" to every part of the name that is not a template name. Examples:
1177 * aes => aes-generic
1178 * cbc(aes) => cbc(aes-generic)
1179 * cts(cbc(aes)) => cts(cbc(aes-generic))
1180 * rfc7539(chacha20,poly1305) => rfc7539(chacha20-generic,poly1305-generic)
1182 * Return: 0 on success, or -ENAMETOOLONG if the generic name would be too long
1184 static int build_generic_driver_name(const char *algname
,
1185 char driver_name
[CRYPTO_MAX_ALG_NAME
])
1187 const char *in
= algname
;
1188 char *out
= driver_name
;
1189 size_t len
= strlen(algname
);
1191 if (len
>= CRYPTO_MAX_ALG_NAME
)
1194 const char *in_saved
= in
;
1196 while (*in
&& *in
!= '(' && *in
!= ')' && *in
!= ',')
1198 if (*in
!= '(' && in
> in_saved
) {
1200 if (len
>= CRYPTO_MAX_ALG_NAME
)
1202 memcpy(out
, "-generic", 8);
1205 } while ((*out
++ = *in
++) != '\0');
1209 pr_err("alg: generic driver name for \"%s\" would be too long\n",
1211 return -ENAMETOOLONG
;
1213 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1214 static void crypto_disable_simd_for_test(void)
1218 static void crypto_reenable_simd_for_test(void)
1221 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1223 static int build_hash_sglist(struct test_sglist
*tsgl
,
1224 const struct hash_testvec
*vec
,
1225 const struct testvec_config
*cfg
,
1226 unsigned int alignmask
,
1227 const struct test_sg_division
*divs
[XBUFSIZE
])
1230 struct iov_iter input
;
1232 kv
.iov_base
= (void *)vec
->plaintext
;
1233 kv
.iov_len
= vec
->psize
;
1234 iov_iter_kvec(&input
, ITER_SOURCE
, &kv
, 1, vec
->psize
);
1235 return build_test_sglist(tsgl
, cfg
->src_divs
, alignmask
, vec
->psize
,
1239 static int check_hash_result(const char *type
,
1240 const u8
*result
, unsigned int digestsize
,
1241 const struct hash_testvec
*vec
,
1242 const char *vec_name
,
1244 const struct testvec_config
*cfg
)
1246 if (memcmp(result
, vec
->digest
, digestsize
) != 0) {
1247 pr_err("alg: %s: %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
1248 type
, driver
, vec_name
, cfg
->name
);
1251 if (!testmgr_is_poison(&result
[digestsize
], TESTMGR_POISON_LEN
)) {
1252 pr_err("alg: %s: %s overran result buffer on test vector %s, cfg=\"%s\"\n",
1253 type
, driver
, vec_name
, cfg
->name
);
1259 static inline int check_shash_op(const char *op
, int err
,
1260 const char *driver
, const char *vec_name
,
1261 const struct testvec_config
*cfg
)
1264 pr_err("alg: shash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n",
1265 driver
, op
, err
, vec_name
, cfg
->name
);
1269 /* Test one hash test vector in one configuration, using the shash API */
1270 static int test_shash_vec_cfg(const struct hash_testvec
*vec
,
1271 const char *vec_name
,
1272 const struct testvec_config
*cfg
,
1273 struct shash_desc
*desc
,
1274 struct test_sglist
*tsgl
,
1277 struct crypto_shash
*tfm
= desc
->tfm
;
1278 const unsigned int alignmask
= crypto_shash_alignmask(tfm
);
1279 const unsigned int digestsize
= crypto_shash_digestsize(tfm
);
1280 const unsigned int statesize
= crypto_shash_statesize(tfm
);
1281 const char *driver
= crypto_shash_driver_name(tfm
);
1282 const struct test_sg_division
*divs
[XBUFSIZE
];
1284 u8 result
[HASH_MAX_DIGESTSIZE
+ TESTMGR_POISON_LEN
];
1287 /* Set the key, if specified */
1289 err
= do_setkey(crypto_shash_setkey
, tfm
, vec
->key
, vec
->ksize
,
1292 if (err
== vec
->setkey_error
)
1294 pr_err("alg: shash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
1295 driver
, vec_name
, vec
->setkey_error
, err
,
1296 crypto_shash_get_flags(tfm
));
1299 if (vec
->setkey_error
) {
1300 pr_err("alg: shash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
1301 driver
, vec_name
, vec
->setkey_error
);
1306 /* Build the scatterlist for the source data */
1307 err
= build_hash_sglist(tsgl
, vec
, cfg
, alignmask
, divs
);
1309 pr_err("alg: shash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n",
1310 driver
, vec_name
, cfg
->name
);
1314 /* Do the actual hashing */
1316 testmgr_poison(desc
->__ctx
, crypto_shash_descsize(tfm
));
1317 testmgr_poison(result
, digestsize
+ TESTMGR_POISON_LEN
);
1319 if (cfg
->finalization_type
== FINALIZATION_TYPE_DIGEST
||
1320 vec
->digest_error
) {
1321 /* Just using digest() */
1322 if (tsgl
->nents
!= 1)
1325 crypto_disable_simd_for_test();
1326 err
= crypto_shash_digest(desc
, sg_virt(&tsgl
->sgl
[0]),
1327 tsgl
->sgl
[0].length
, result
);
1329 crypto_reenable_simd_for_test();
1331 if (err
== vec
->digest_error
)
1333 pr_err("alg: shash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
1334 driver
, vec_name
, vec
->digest_error
, err
,
1338 if (vec
->digest_error
) {
1339 pr_err("alg: shash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
1340 driver
, vec_name
, vec
->digest_error
, cfg
->name
);
1346 /* Using init(), zero or more update(), then final() or finup() */
1349 crypto_disable_simd_for_test();
1350 err
= crypto_shash_init(desc
);
1352 crypto_reenable_simd_for_test();
1353 err
= check_shash_op("init", err
, driver
, vec_name
, cfg
);
1357 for (i
= 0; i
< tsgl
->nents
; i
++) {
1358 if (i
+ 1 == tsgl
->nents
&&
1359 cfg
->finalization_type
== FINALIZATION_TYPE_FINUP
) {
1360 if (divs
[i
]->nosimd
)
1361 crypto_disable_simd_for_test();
1362 err
= crypto_shash_finup(desc
, sg_virt(&tsgl
->sgl
[i
]),
1363 tsgl
->sgl
[i
].length
, result
);
1364 if (divs
[i
]->nosimd
)
1365 crypto_reenable_simd_for_test();
1366 err
= check_shash_op("finup", err
, driver
, vec_name
,
1372 if (divs
[i
]->nosimd
)
1373 crypto_disable_simd_for_test();
1374 err
= crypto_shash_update(desc
, sg_virt(&tsgl
->sgl
[i
]),
1375 tsgl
->sgl
[i
].length
);
1376 if (divs
[i
]->nosimd
)
1377 crypto_reenable_simd_for_test();
1378 err
= check_shash_op("update", err
, driver
, vec_name
, cfg
);
1381 if (divs
[i
]->flush_type
== FLUSH_TYPE_REIMPORT
) {
1382 /* Test ->export() and ->import() */
1383 testmgr_poison(hashstate
+ statesize
,
1384 TESTMGR_POISON_LEN
);
1385 err
= crypto_shash_export(desc
, hashstate
);
1386 err
= check_shash_op("export", err
, driver
, vec_name
,
1390 if (!testmgr_is_poison(hashstate
+ statesize
,
1391 TESTMGR_POISON_LEN
)) {
1392 pr_err("alg: shash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n",
1393 driver
, vec_name
, cfg
->name
);
1396 testmgr_poison(desc
->__ctx
, crypto_shash_descsize(tfm
));
1397 err
= crypto_shash_import(desc
, hashstate
);
1398 err
= check_shash_op("import", err
, driver
, vec_name
,
1406 crypto_disable_simd_for_test();
1407 err
= crypto_shash_final(desc
, result
);
1409 crypto_reenable_simd_for_test();
1410 err
= check_shash_op("final", err
, driver
, vec_name
, cfg
);
1414 return check_hash_result("shash", result
, digestsize
, vec
, vec_name
,
1418 static int do_ahash_op(int (*op
)(struct ahash_request
*req
),
1419 struct ahash_request
*req
,
1420 struct crypto_wait
*wait
, bool nosimd
)
1425 crypto_disable_simd_for_test();
1430 crypto_reenable_simd_for_test();
1432 return crypto_wait_req(err
, wait
);
1435 static int check_nonfinal_ahash_op(const char *op
, int err
,
1436 u8
*result
, unsigned int digestsize
,
1437 const char *driver
, const char *vec_name
,
1438 const struct testvec_config
*cfg
)
1441 pr_err("alg: ahash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n",
1442 driver
, op
, err
, vec_name
, cfg
->name
);
1445 if (!testmgr_is_poison(result
, digestsize
)) {
1446 pr_err("alg: ahash: %s %s() used result buffer on test vector %s, cfg=\"%s\"\n",
1447 driver
, op
, vec_name
, cfg
->name
);
1453 /* Test one hash test vector in one configuration, using the ahash API */
1454 static int test_ahash_vec_cfg(const struct hash_testvec
*vec
,
1455 const char *vec_name
,
1456 const struct testvec_config
*cfg
,
1457 struct ahash_request
*req
,
1458 struct test_sglist
*tsgl
,
1461 struct crypto_ahash
*tfm
= crypto_ahash_reqtfm(req
);
1462 const unsigned int alignmask
= crypto_ahash_alignmask(tfm
);
1463 const unsigned int digestsize
= crypto_ahash_digestsize(tfm
);
1464 const unsigned int statesize
= crypto_ahash_statesize(tfm
);
1465 const char *driver
= crypto_ahash_driver_name(tfm
);
1466 const u32 req_flags
= CRYPTO_TFM_REQ_MAY_BACKLOG
| cfg
->req_flags
;
1467 const struct test_sg_division
*divs
[XBUFSIZE
];
1468 DECLARE_CRYPTO_WAIT(wait
);
1470 struct scatterlist
*pending_sgl
;
1471 unsigned int pending_len
;
1472 u8 result
[HASH_MAX_DIGESTSIZE
+ TESTMGR_POISON_LEN
];
1475 /* Set the key, if specified */
1477 err
= do_setkey(crypto_ahash_setkey
, tfm
, vec
->key
, vec
->ksize
,
1480 if (err
== vec
->setkey_error
)
1482 pr_err("alg: ahash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
1483 driver
, vec_name
, vec
->setkey_error
, err
,
1484 crypto_ahash_get_flags(tfm
));
1487 if (vec
->setkey_error
) {
1488 pr_err("alg: ahash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
1489 driver
, vec_name
, vec
->setkey_error
);
1494 /* Build the scatterlist for the source data */
1495 err
= build_hash_sglist(tsgl
, vec
, cfg
, alignmask
, divs
);
1497 pr_err("alg: ahash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n",
1498 driver
, vec_name
, cfg
->name
);
1502 /* Do the actual hashing */
1504 testmgr_poison(req
->__ctx
, crypto_ahash_reqsize(tfm
));
1505 testmgr_poison(result
, digestsize
+ TESTMGR_POISON_LEN
);
1507 if (cfg
->finalization_type
== FINALIZATION_TYPE_DIGEST
||
1508 vec
->digest_error
) {
1509 /* Just using digest() */
1510 ahash_request_set_callback(req
, req_flags
, crypto_req_done
,
1512 ahash_request_set_crypt(req
, tsgl
->sgl
, result
, vec
->psize
);
1513 err
= do_ahash_op(crypto_ahash_digest
, req
, &wait
, cfg
->nosimd
);
1515 if (err
== vec
->digest_error
)
1517 pr_err("alg: ahash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
1518 driver
, vec_name
, vec
->digest_error
, err
,
1522 if (vec
->digest_error
) {
1523 pr_err("alg: ahash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
1524 driver
, vec_name
, vec
->digest_error
, cfg
->name
);
1530 /* Using init(), zero or more update(), then final() or finup() */
1532 ahash_request_set_callback(req
, req_flags
, crypto_req_done
, &wait
);
1533 ahash_request_set_crypt(req
, NULL
, result
, 0);
1534 err
= do_ahash_op(crypto_ahash_init
, req
, &wait
, cfg
->nosimd
);
1535 err
= check_nonfinal_ahash_op("init", err
, result
, digestsize
,
1536 driver
, vec_name
, cfg
);
1542 for (i
= 0; i
< tsgl
->nents
; i
++) {
1543 if (divs
[i
]->flush_type
!= FLUSH_TYPE_NONE
&&
1544 pending_sgl
!= NULL
) {
1545 /* update() with the pending data */
1546 ahash_request_set_callback(req
, req_flags
,
1547 crypto_req_done
, &wait
);
1548 ahash_request_set_crypt(req
, pending_sgl
, result
,
1550 err
= do_ahash_op(crypto_ahash_update
, req
, &wait
,
1552 err
= check_nonfinal_ahash_op("update", err
,
1554 driver
, vec_name
, cfg
);
1560 if (divs
[i
]->flush_type
== FLUSH_TYPE_REIMPORT
) {
1561 /* Test ->export() and ->import() */
1562 testmgr_poison(hashstate
+ statesize
,
1563 TESTMGR_POISON_LEN
);
1564 err
= crypto_ahash_export(req
, hashstate
);
1565 err
= check_nonfinal_ahash_op("export", err
,
1567 driver
, vec_name
, cfg
);
1570 if (!testmgr_is_poison(hashstate
+ statesize
,
1571 TESTMGR_POISON_LEN
)) {
1572 pr_err("alg: ahash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n",
1573 driver
, vec_name
, cfg
->name
);
1577 testmgr_poison(req
->__ctx
, crypto_ahash_reqsize(tfm
));
1578 err
= crypto_ahash_import(req
, hashstate
);
1579 err
= check_nonfinal_ahash_op("import", err
,
1581 driver
, vec_name
, cfg
);
1585 if (pending_sgl
== NULL
)
1586 pending_sgl
= &tsgl
->sgl
[i
];
1587 pending_len
+= tsgl
->sgl
[i
].length
;
1590 ahash_request_set_callback(req
, req_flags
, crypto_req_done
, &wait
);
1591 ahash_request_set_crypt(req
, pending_sgl
, result
, pending_len
);
1592 if (cfg
->finalization_type
== FINALIZATION_TYPE_FINAL
) {
1593 /* finish with update() and final() */
1594 err
= do_ahash_op(crypto_ahash_update
, req
, &wait
, cfg
->nosimd
);
1595 err
= check_nonfinal_ahash_op("update", err
, result
, digestsize
,
1596 driver
, vec_name
, cfg
);
1599 err
= do_ahash_op(crypto_ahash_final
, req
, &wait
, cfg
->nosimd
);
1601 pr_err("alg: ahash: %s final() failed with err %d on test vector %s, cfg=\"%s\"\n",
1602 driver
, err
, vec_name
, cfg
->name
);
1606 /* finish with finup() */
1607 err
= do_ahash_op(crypto_ahash_finup
, req
, &wait
, cfg
->nosimd
);
1609 pr_err("alg: ahash: %s finup() failed with err %d on test vector %s, cfg=\"%s\"\n",
1610 driver
, err
, vec_name
, cfg
->name
);
1616 return check_hash_result("ahash", result
, digestsize
, vec
, vec_name
,
1620 static int test_hash_vec_cfg(const struct hash_testvec
*vec
,
1621 const char *vec_name
,
1622 const struct testvec_config
*cfg
,
1623 struct ahash_request
*req
,
1624 struct shash_desc
*desc
,
1625 struct test_sglist
*tsgl
,
1631 * For algorithms implemented as "shash", most bugs will be detected by
1632 * both the shash and ahash tests. Test the shash API first so that the
1633 * failures involve less indirection, so are easier to debug.
1637 err
= test_shash_vec_cfg(vec
, vec_name
, cfg
, desc
, tsgl
,
1643 return test_ahash_vec_cfg(vec
, vec_name
, cfg
, req
, tsgl
, hashstate
);
1646 static int test_hash_vec(const struct hash_testvec
*vec
, unsigned int vec_num
,
1647 struct ahash_request
*req
, struct shash_desc
*desc
,
1648 struct test_sglist
*tsgl
, u8
*hashstate
)
1654 sprintf(vec_name
, "%u", vec_num
);
1656 for (i
= 0; i
< ARRAY_SIZE(default_hash_testvec_configs
); i
++) {
1657 err
= test_hash_vec_cfg(vec
, vec_name
,
1658 &default_hash_testvec_configs
[i
],
1659 req
, desc
, tsgl
, hashstate
);
1664 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
1665 if (!noextratests
) {
1666 struct rnd_state rng
;
1667 struct testvec_config cfg
;
1668 char cfgname
[TESTVEC_CONFIG_NAMELEN
];
1670 init_rnd_state(&rng
);
1672 for (i
= 0; i
< fuzz_iterations
; i
++) {
1673 generate_random_testvec_config(&rng
, &cfg
, cfgname
,
1675 err
= test_hash_vec_cfg(vec
, vec_name
, &cfg
,
1676 req
, desc
, tsgl
, hashstate
);
1686 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
1688 * Generate a hash test vector from the given implementation.
1689 * Assumes the buffers in 'vec' were already allocated.
1691 static void generate_random_hash_testvec(struct rnd_state
*rng
,
1692 struct shash_desc
*desc
,
1693 struct hash_testvec
*vec
,
1694 unsigned int maxkeysize
,
1695 unsigned int maxdatasize
,
1696 char *name
, size_t max_namelen
)
1699 vec
->psize
= generate_random_length(rng
, maxdatasize
);
1700 generate_random_bytes(rng
, (u8
*)vec
->plaintext
, vec
->psize
);
1703 * Key: length in range [1, maxkeysize], but usually choose maxkeysize.
1704 * If algorithm is unkeyed, then maxkeysize == 0 and set ksize = 0.
1706 vec
->setkey_error
= 0;
1709 vec
->ksize
= maxkeysize
;
1710 if (prandom_u32_below(rng
, 4) == 0)
1711 vec
->ksize
= prandom_u32_inclusive(rng
, 1, maxkeysize
);
1712 generate_random_bytes(rng
, (u8
*)vec
->key
, vec
->ksize
);
1714 vec
->setkey_error
= crypto_shash_setkey(desc
->tfm
, vec
->key
,
1716 /* If the key couldn't be set, no need to continue to digest. */
1717 if (vec
->setkey_error
)
1722 vec
->digest_error
= crypto_shash_digest(desc
, vec
->plaintext
,
1723 vec
->psize
, (u8
*)vec
->digest
);
1725 snprintf(name
, max_namelen
, "\"random: psize=%u ksize=%u\"",
1726 vec
->psize
, vec
->ksize
);
1730 * Test the hash algorithm represented by @req against the corresponding generic
1731 * implementation, if one is available.
1733 static int test_hash_vs_generic_impl(const char *generic_driver
,
1734 unsigned int maxkeysize
,
1735 struct ahash_request
*req
,
1736 struct shash_desc
*desc
,
1737 struct test_sglist
*tsgl
,
1740 struct crypto_ahash
*tfm
= crypto_ahash_reqtfm(req
);
1741 const unsigned int digestsize
= crypto_ahash_digestsize(tfm
);
1742 const unsigned int blocksize
= crypto_ahash_blocksize(tfm
);
1743 const unsigned int maxdatasize
= (2 * PAGE_SIZE
) - TESTMGR_POISON_LEN
;
1744 const char *algname
= crypto_hash_alg_common(tfm
)->base
.cra_name
;
1745 const char *driver
= crypto_ahash_driver_name(tfm
);
1746 struct rnd_state rng
;
1747 char _generic_driver
[CRYPTO_MAX_ALG_NAME
];
1748 struct crypto_shash
*generic_tfm
= NULL
;
1749 struct shash_desc
*generic_desc
= NULL
;
1751 struct hash_testvec vec
= { 0 };
1753 struct testvec_config
*cfg
;
1754 char cfgname
[TESTVEC_CONFIG_NAMELEN
];
1760 init_rnd_state(&rng
);
1762 if (!generic_driver
) { /* Use default naming convention? */
1763 err
= build_generic_driver_name(algname
, _generic_driver
);
1766 generic_driver
= _generic_driver
;
1769 if (strcmp(generic_driver
, driver
) == 0) /* Already the generic impl? */
1772 generic_tfm
= crypto_alloc_shash(generic_driver
, 0, 0);
1773 if (IS_ERR(generic_tfm
)) {
1774 err
= PTR_ERR(generic_tfm
);
1775 if (err
== -ENOENT
) {
1776 pr_warn("alg: hash: skipping comparison tests for %s because %s is unavailable\n",
1777 driver
, generic_driver
);
1780 pr_err("alg: hash: error allocating %s (generic impl of %s): %d\n",
1781 generic_driver
, algname
, err
);
1785 cfg
= kzalloc(sizeof(*cfg
), GFP_KERNEL
);
1791 generic_desc
= kzalloc(sizeof(*desc
) +
1792 crypto_shash_descsize(generic_tfm
), GFP_KERNEL
);
1793 if (!generic_desc
) {
1797 generic_desc
->tfm
= generic_tfm
;
1799 /* Check the algorithm properties for consistency. */
1801 if (digestsize
!= crypto_shash_digestsize(generic_tfm
)) {
1802 pr_err("alg: hash: digestsize for %s (%u) doesn't match generic impl (%u)\n",
1804 crypto_shash_digestsize(generic_tfm
));
1809 if (blocksize
!= crypto_shash_blocksize(generic_tfm
)) {
1810 pr_err("alg: hash: blocksize for %s (%u) doesn't match generic impl (%u)\n",
1811 driver
, blocksize
, crypto_shash_blocksize(generic_tfm
));
1817 * Now generate test vectors using the generic implementation, and test
1818 * the other implementation against them.
1821 vec
.key
= kmalloc(maxkeysize
, GFP_KERNEL
);
1822 vec
.plaintext
= kmalloc(maxdatasize
, GFP_KERNEL
);
1823 vec
.digest
= kmalloc(digestsize
, GFP_KERNEL
);
1824 if (!vec
.key
|| !vec
.plaintext
|| !vec
.digest
) {
1829 for (i
= 0; i
< fuzz_iterations
* 8; i
++) {
1830 generate_random_hash_testvec(&rng
, generic_desc
, &vec
,
1831 maxkeysize
, maxdatasize
,
1832 vec_name
, sizeof(vec_name
));
1833 generate_random_testvec_config(&rng
, cfg
, cfgname
,
1836 err
= test_hash_vec_cfg(&vec
, vec_name
, cfg
,
1837 req
, desc
, tsgl
, hashstate
);
1846 kfree(vec
.plaintext
);
1848 crypto_free_shash(generic_tfm
);
1849 kfree_sensitive(generic_desc
);
1852 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1853 static int test_hash_vs_generic_impl(const char *generic_driver
,
1854 unsigned int maxkeysize
,
1855 struct ahash_request
*req
,
1856 struct shash_desc
*desc
,
1857 struct test_sglist
*tsgl
,
1862 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1864 static int alloc_shash(const char *driver
, u32 type
, u32 mask
,
1865 struct crypto_shash
**tfm_ret
,
1866 struct shash_desc
**desc_ret
)
1868 struct crypto_shash
*tfm
;
1869 struct shash_desc
*desc
;
1871 tfm
= crypto_alloc_shash(driver
, type
, mask
);
1873 if (PTR_ERR(tfm
) == -ENOENT
) {
1875 * This algorithm is only available through the ahash
1876 * API, not the shash API, so skip the shash tests.
1880 pr_err("alg: hash: failed to allocate shash transform for %s: %ld\n",
1881 driver
, PTR_ERR(tfm
));
1882 return PTR_ERR(tfm
);
1885 desc
= kmalloc(sizeof(*desc
) + crypto_shash_descsize(tfm
), GFP_KERNEL
);
1887 crypto_free_shash(tfm
);
1897 static int __alg_test_hash(const struct hash_testvec
*vecs
,
1898 unsigned int num_vecs
, const char *driver
,
1900 const char *generic_driver
, unsigned int maxkeysize
)
1902 struct crypto_ahash
*atfm
= NULL
;
1903 struct ahash_request
*req
= NULL
;
1904 struct crypto_shash
*stfm
= NULL
;
1905 struct shash_desc
*desc
= NULL
;
1906 struct test_sglist
*tsgl
= NULL
;
1907 u8
*hashstate
= NULL
;
1908 unsigned int statesize
;
1913 * Always test the ahash API. This works regardless of whether the
1914 * algorithm is implemented as ahash or shash.
1917 atfm
= crypto_alloc_ahash(driver
, type
, mask
);
1919 pr_err("alg: hash: failed to allocate transform for %s: %ld\n",
1920 driver
, PTR_ERR(atfm
));
1921 return PTR_ERR(atfm
);
1923 driver
= crypto_ahash_driver_name(atfm
);
1925 req
= ahash_request_alloc(atfm
, GFP_KERNEL
);
1927 pr_err("alg: hash: failed to allocate request for %s\n",
1934 * If available also test the shash API, to cover corner cases that may
1935 * be missed by testing the ahash API only.
1937 err
= alloc_shash(driver
, type
, mask
, &stfm
, &desc
);
1941 tsgl
= kmalloc(sizeof(*tsgl
), GFP_KERNEL
);
1942 if (!tsgl
|| init_test_sglist(tsgl
) != 0) {
1943 pr_err("alg: hash: failed to allocate test buffers for %s\n",
1951 statesize
= crypto_ahash_statesize(atfm
);
1953 statesize
= max(statesize
, crypto_shash_statesize(stfm
));
1954 hashstate
= kmalloc(statesize
+ TESTMGR_POISON_LEN
, GFP_KERNEL
);
1956 pr_err("alg: hash: failed to allocate hash state buffer for %s\n",
1962 for (i
= 0; i
< num_vecs
; i
++) {
1963 if (fips_enabled
&& vecs
[i
].fips_skip
)
1966 err
= test_hash_vec(&vecs
[i
], i
, req
, desc
, tsgl
, hashstate
);
1971 err
= test_hash_vs_generic_impl(generic_driver
, maxkeysize
, req
,
1972 desc
, tsgl
, hashstate
);
1976 destroy_test_sglist(tsgl
);
1980 crypto_free_shash(stfm
);
1981 ahash_request_free(req
);
1982 crypto_free_ahash(atfm
);
1986 static int alg_test_hash(const struct alg_test_desc
*desc
, const char *driver
,
1989 const struct hash_testvec
*template = desc
->suite
.hash
.vecs
;
1990 unsigned int tcount
= desc
->suite
.hash
.count
;
1991 unsigned int nr_unkeyed
, nr_keyed
;
1992 unsigned int maxkeysize
= 0;
1996 * For OPTIONAL_KEY algorithms, we have to do all the unkeyed tests
1997 * first, before setting a key on the tfm. To make this easier, we
1998 * require that the unkeyed test vectors (if any) are listed first.
2001 for (nr_unkeyed
= 0; nr_unkeyed
< tcount
; nr_unkeyed
++) {
2002 if (template[nr_unkeyed
].ksize
)
2005 for (nr_keyed
= 0; nr_unkeyed
+ nr_keyed
< tcount
; nr_keyed
++) {
2006 if (!template[nr_unkeyed
+ nr_keyed
].ksize
) {
2007 pr_err("alg: hash: test vectors for %s out of order, "
2008 "unkeyed ones must come first\n", desc
->alg
);
2011 maxkeysize
= max_t(unsigned int, maxkeysize
,
2012 template[nr_unkeyed
+ nr_keyed
].ksize
);
2017 err
= __alg_test_hash(template, nr_unkeyed
, driver
, type
, mask
,
2018 desc
->generic_driver
, maxkeysize
);
2019 template += nr_unkeyed
;
2022 if (!err
&& nr_keyed
)
2023 err
= __alg_test_hash(template, nr_keyed
, driver
, type
, mask
,
2024 desc
->generic_driver
, maxkeysize
);
2029 static int test_aead_vec_cfg(int enc
, const struct aead_testvec
*vec
,
2030 const char *vec_name
,
2031 const struct testvec_config
*cfg
,
2032 struct aead_request
*req
,
2033 struct cipher_test_sglists
*tsgls
)
2035 struct crypto_aead
*tfm
= crypto_aead_reqtfm(req
);
2036 const unsigned int alignmask
= crypto_aead_alignmask(tfm
);
2037 const unsigned int ivsize
= crypto_aead_ivsize(tfm
);
2038 const unsigned int authsize
= vec
->clen
- vec
->plen
;
2039 const char *driver
= crypto_aead_driver_name(tfm
);
2040 const u32 req_flags
= CRYPTO_TFM_REQ_MAY_BACKLOG
| cfg
->req_flags
;
2041 const char *op
= enc
? "encryption" : "decryption";
2042 DECLARE_CRYPTO_WAIT(wait
);
2043 u8 _iv
[3 * (MAX_ALGAPI_ALIGNMASK
+ 1) + MAX_IVLEN
];
2044 u8
*iv
= PTR_ALIGN(&_iv
[0], 2 * (MAX_ALGAPI_ALIGNMASK
+ 1)) +
2046 (cfg
->iv_offset_relative_to_alignmask
? alignmask
: 0);
2047 struct kvec input
[2];
2052 crypto_aead_set_flags(tfm
, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS
);
2054 crypto_aead_clear_flags(tfm
, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS
);
2056 err
= do_setkey(crypto_aead_setkey
, tfm
, vec
->key
, vec
->klen
,
2058 if (err
&& err
!= vec
->setkey_error
) {
2059 pr_err("alg: aead: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
2060 driver
, vec_name
, vec
->setkey_error
, err
,
2061 crypto_aead_get_flags(tfm
));
2064 if (!err
&& vec
->setkey_error
) {
2065 pr_err("alg: aead: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
2066 driver
, vec_name
, vec
->setkey_error
);
2070 /* Set the authentication tag size */
2071 err
= crypto_aead_setauthsize(tfm
, authsize
);
2072 if (err
&& err
!= vec
->setauthsize_error
) {
2073 pr_err("alg: aead: %s setauthsize failed on test vector %s; expected_error=%d, actual_error=%d\n",
2074 driver
, vec_name
, vec
->setauthsize_error
, err
);
2077 if (!err
&& vec
->setauthsize_error
) {
2078 pr_err("alg: aead: %s setauthsize unexpectedly succeeded on test vector %s; expected_error=%d\n",
2079 driver
, vec_name
, vec
->setauthsize_error
);
2083 if (vec
->setkey_error
|| vec
->setauthsize_error
)
2086 /* The IV must be copied to a buffer, as the algorithm may modify it */
2087 if (WARN_ON(ivsize
> MAX_IVLEN
))
2090 memcpy(iv
, vec
->iv
, ivsize
);
2092 memset(iv
, 0, ivsize
);
2094 /* Build the src/dst scatterlists */
2095 input
[0].iov_base
= (void *)vec
->assoc
;
2096 input
[0].iov_len
= vec
->alen
;
2097 input
[1].iov_base
= enc
? (void *)vec
->ptext
: (void *)vec
->ctext
;
2098 input
[1].iov_len
= enc
? vec
->plen
: vec
->clen
;
2099 err
= build_cipher_test_sglists(tsgls
, cfg
, alignmask
,
2100 vec
->alen
+ (enc
? vec
->plen
:
2102 vec
->alen
+ (enc
? vec
->clen
:
2106 pr_err("alg: aead: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n",
2107 driver
, op
, vec_name
, cfg
->name
);
2111 /* Do the actual encryption or decryption */
2112 testmgr_poison(req
->__ctx
, crypto_aead_reqsize(tfm
));
2113 aead_request_set_callback(req
, req_flags
, crypto_req_done
, &wait
);
2114 aead_request_set_crypt(req
, tsgls
->src
.sgl_ptr
, tsgls
->dst
.sgl_ptr
,
2115 enc
? vec
->plen
: vec
->clen
, iv
);
2116 aead_request_set_ad(req
, vec
->alen
);
2118 crypto_disable_simd_for_test();
2119 err
= enc
? crypto_aead_encrypt(req
) : crypto_aead_decrypt(req
);
2121 crypto_reenable_simd_for_test();
2122 err
= crypto_wait_req(err
, &wait
);
2124 /* Check that the algorithm didn't overwrite things it shouldn't have */
2125 if (req
->cryptlen
!= (enc
? vec
->plen
: vec
->clen
) ||
2126 req
->assoclen
!= vec
->alen
||
2128 req
->src
!= tsgls
->src
.sgl_ptr
||
2129 req
->dst
!= tsgls
->dst
.sgl_ptr
||
2130 crypto_aead_reqtfm(req
) != tfm
||
2131 req
->base
.complete
!= crypto_req_done
||
2132 req
->base
.flags
!= req_flags
||
2133 req
->base
.data
!= &wait
) {
2134 pr_err("alg: aead: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n",
2135 driver
, op
, vec_name
, cfg
->name
);
2136 if (req
->cryptlen
!= (enc
? vec
->plen
: vec
->clen
))
2137 pr_err("alg: aead: changed 'req->cryptlen'\n");
2138 if (req
->assoclen
!= vec
->alen
)
2139 pr_err("alg: aead: changed 'req->assoclen'\n");
2141 pr_err("alg: aead: changed 'req->iv'\n");
2142 if (req
->src
!= tsgls
->src
.sgl_ptr
)
2143 pr_err("alg: aead: changed 'req->src'\n");
2144 if (req
->dst
!= tsgls
->dst
.sgl_ptr
)
2145 pr_err("alg: aead: changed 'req->dst'\n");
2146 if (crypto_aead_reqtfm(req
) != tfm
)
2147 pr_err("alg: aead: changed 'req->base.tfm'\n");
2148 if (req
->base
.complete
!= crypto_req_done
)
2149 pr_err("alg: aead: changed 'req->base.complete'\n");
2150 if (req
->base
.flags
!= req_flags
)
2151 pr_err("alg: aead: changed 'req->base.flags'\n");
2152 if (req
->base
.data
!= &wait
)
2153 pr_err("alg: aead: changed 'req->base.data'\n");
2156 if (is_test_sglist_corrupted(&tsgls
->src
)) {
2157 pr_err("alg: aead: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n",
2158 driver
, op
, vec_name
, cfg
->name
);
2161 if (tsgls
->dst
.sgl_ptr
!= tsgls
->src
.sgl
&&
2162 is_test_sglist_corrupted(&tsgls
->dst
)) {
2163 pr_err("alg: aead: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n",
2164 driver
, op
, vec_name
, cfg
->name
);
2168 /* Check for unexpected success or failure, or wrong error code */
2169 if ((err
== 0 && vec
->novrfy
) ||
2170 (err
!= vec
->crypt_error
&& !(err
== -EBADMSG
&& vec
->novrfy
))) {
2171 char expected_error
[32];
2174 vec
->crypt_error
!= 0 && vec
->crypt_error
!= -EBADMSG
)
2175 sprintf(expected_error
, "-EBADMSG or %d",
2177 else if (vec
->novrfy
)
2178 sprintf(expected_error
, "-EBADMSG");
2180 sprintf(expected_error
, "%d", vec
->crypt_error
);
2182 pr_err("alg: aead: %s %s failed on test vector %s; expected_error=%s, actual_error=%d, cfg=\"%s\"\n",
2183 driver
, op
, vec_name
, expected_error
, err
,
2187 pr_err("alg: aead: %s %s unexpectedly succeeded on test vector %s; expected_error=%s, cfg=\"%s\"\n",
2188 driver
, op
, vec_name
, expected_error
, cfg
->name
);
2191 if (err
) /* Expectedly failed. */
2194 /* Check for the correct output (ciphertext or plaintext) */
2195 err
= verify_correct_output(&tsgls
->dst
, enc
? vec
->ctext
: vec
->ptext
,
2196 enc
? vec
->clen
: vec
->plen
,
2198 enc
|| cfg
->inplace_mode
== OUT_OF_PLACE
);
2199 if (err
== -EOVERFLOW
) {
2200 pr_err("alg: aead: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n",
2201 driver
, op
, vec_name
, cfg
->name
);
2205 pr_err("alg: aead: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
2206 driver
, op
, vec_name
, cfg
->name
);
2213 static int test_aead_vec(int enc
, const struct aead_testvec
*vec
,
2214 unsigned int vec_num
, struct aead_request
*req
,
2215 struct cipher_test_sglists
*tsgls
)
2221 if (enc
&& vec
->novrfy
)
2224 sprintf(vec_name
, "%u", vec_num
);
2226 for (i
= 0; i
< ARRAY_SIZE(default_cipher_testvec_configs
); i
++) {
2227 err
= test_aead_vec_cfg(enc
, vec
, vec_name
,
2228 &default_cipher_testvec_configs
[i
],
2234 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2235 if (!noextratests
) {
2236 struct rnd_state rng
;
2237 struct testvec_config cfg
;
2238 char cfgname
[TESTVEC_CONFIG_NAMELEN
];
2240 init_rnd_state(&rng
);
2242 for (i
= 0; i
< fuzz_iterations
; i
++) {
2243 generate_random_testvec_config(&rng
, &cfg
, cfgname
,
2245 err
= test_aead_vec_cfg(enc
, vec
, vec_name
,
2256 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2258 struct aead_extra_tests_ctx
{
2259 struct rnd_state rng
;
2260 struct aead_request
*req
;
2261 struct crypto_aead
*tfm
;
2262 const struct alg_test_desc
*test_desc
;
2263 struct cipher_test_sglists
*tsgls
;
2264 unsigned int maxdatasize
;
2265 unsigned int maxkeysize
;
2267 struct aead_testvec vec
;
2269 char cfgname
[TESTVEC_CONFIG_NAMELEN
];
2270 struct testvec_config cfg
;
2274 * Make at least one random change to a (ciphertext, AAD) pair. "Ciphertext"
2275 * here means the full ciphertext including the authentication tag. The
2276 * authentication tag (and hence also the ciphertext) is assumed to be nonempty.
2278 static void mutate_aead_message(struct rnd_state
*rng
,
2279 struct aead_testvec
*vec
, bool aad_iv
,
2280 unsigned int ivsize
)
2282 const unsigned int aad_tail_size
= aad_iv
? ivsize
: 0;
2283 const unsigned int authsize
= vec
->clen
- vec
->plen
;
2285 if (prandom_bool(rng
) && vec
->alen
> aad_tail_size
) {
2286 /* Mutate the AAD */
2287 flip_random_bit(rng
, (u8
*)vec
->assoc
,
2288 vec
->alen
- aad_tail_size
);
2289 if (prandom_bool(rng
))
2292 if (prandom_bool(rng
)) {
2293 /* Mutate auth tag (assuming it's at the end of ciphertext) */
2294 flip_random_bit(rng
, (u8
*)vec
->ctext
+ vec
->plen
, authsize
);
2296 /* Mutate any part of the ciphertext */
2297 flip_random_bit(rng
, (u8
*)vec
->ctext
, vec
->clen
);
2302 * Minimum authentication tag size in bytes at which we assume that we can
2303 * reliably generate inauthentic messages, i.e. not generate an authentic
2304 * message by chance.
2306 #define MIN_COLLISION_FREE_AUTHSIZE 8
2308 static void generate_aead_message(struct rnd_state
*rng
,
2309 struct aead_request
*req
,
2310 const struct aead_test_suite
*suite
,
2311 struct aead_testvec
*vec
,
2312 bool prefer_inauthentic
)
2314 struct crypto_aead
*tfm
= crypto_aead_reqtfm(req
);
2315 const unsigned int ivsize
= crypto_aead_ivsize(tfm
);
2316 const unsigned int authsize
= vec
->clen
- vec
->plen
;
2317 const bool inauthentic
= (authsize
>= MIN_COLLISION_FREE_AUTHSIZE
) &&
2318 (prefer_inauthentic
||
2319 prandom_u32_below(rng
, 4) == 0);
2321 /* Generate the AAD. */
2322 generate_random_bytes(rng
, (u8
*)vec
->assoc
, vec
->alen
);
2323 if (suite
->aad_iv
&& vec
->alen
>= ivsize
)
2324 /* Avoid implementation-defined behavior. */
2325 memcpy((u8
*)vec
->assoc
+ vec
->alen
- ivsize
, vec
->iv
, ivsize
);
2327 if (inauthentic
&& prandom_bool(rng
)) {
2328 /* Generate a random ciphertext. */
2329 generate_random_bytes(rng
, (u8
*)vec
->ctext
, vec
->clen
);
2332 struct scatterlist src
[2], dst
;
2334 DECLARE_CRYPTO_WAIT(wait
);
2336 /* Generate a random plaintext and encrypt it. */
2337 sg_init_table(src
, 2);
2339 sg_set_buf(&src
[i
++], vec
->assoc
, vec
->alen
);
2341 generate_random_bytes(rng
, (u8
*)vec
->ptext
, vec
->plen
);
2342 sg_set_buf(&src
[i
++], vec
->ptext
, vec
->plen
);
2344 sg_init_one(&dst
, vec
->ctext
, vec
->alen
+ vec
->clen
);
2345 memcpy(iv
, vec
->iv
, ivsize
);
2346 aead_request_set_callback(req
, 0, crypto_req_done
, &wait
);
2347 aead_request_set_crypt(req
, src
, &dst
, vec
->plen
, iv
);
2348 aead_request_set_ad(req
, vec
->alen
);
2349 vec
->crypt_error
= crypto_wait_req(crypto_aead_encrypt(req
),
2351 /* If encryption failed, we're done. */
2352 if (vec
->crypt_error
!= 0)
2354 memmove((u8
*)vec
->ctext
, vec
->ctext
+ vec
->alen
, vec
->clen
);
2358 * Mutate the authentic (ciphertext, AAD) pair to get an
2361 mutate_aead_message(rng
, vec
, suite
->aad_iv
, ivsize
);
2364 if (suite
->einval_allowed
)
2365 vec
->crypt_error
= -EINVAL
;
2369 * Generate an AEAD test vector 'vec' using the implementation specified by
2370 * 'req'. The buffers in 'vec' must already be allocated.
2372 * If 'prefer_inauthentic' is true, then this function will generate inauthentic
2373 * test vectors (i.e. vectors with 'vec->novrfy=1') more often.
2375 static void generate_random_aead_testvec(struct rnd_state
*rng
,
2376 struct aead_request
*req
,
2377 struct aead_testvec
*vec
,
2378 const struct aead_test_suite
*suite
,
2379 unsigned int maxkeysize
,
2380 unsigned int maxdatasize
,
2381 char *name
, size_t max_namelen
,
2382 bool prefer_inauthentic
)
2384 struct crypto_aead
*tfm
= crypto_aead_reqtfm(req
);
2385 const unsigned int ivsize
= crypto_aead_ivsize(tfm
);
2386 const unsigned int maxauthsize
= crypto_aead_maxauthsize(tfm
);
2387 unsigned int authsize
;
2388 unsigned int total_len
;
2390 /* Key: length in [0, maxkeysize], but usually choose maxkeysize */
2391 vec
->klen
= maxkeysize
;
2392 if (prandom_u32_below(rng
, 4) == 0)
2393 vec
->klen
= prandom_u32_below(rng
, maxkeysize
+ 1);
2394 generate_random_bytes(rng
, (u8
*)vec
->key
, vec
->klen
);
2395 vec
->setkey_error
= crypto_aead_setkey(tfm
, vec
->key
, vec
->klen
);
2398 generate_random_bytes(rng
, (u8
*)vec
->iv
, ivsize
);
2400 /* Tag length: in [0, maxauthsize], but usually choose maxauthsize */
2401 authsize
= maxauthsize
;
2402 if (prandom_u32_below(rng
, 4) == 0)
2403 authsize
= prandom_u32_below(rng
, maxauthsize
+ 1);
2404 if (prefer_inauthentic
&& authsize
< MIN_COLLISION_FREE_AUTHSIZE
)
2405 authsize
= MIN_COLLISION_FREE_AUTHSIZE
;
2406 if (WARN_ON(authsize
> maxdatasize
))
2407 authsize
= maxdatasize
;
2408 maxdatasize
-= authsize
;
2409 vec
->setauthsize_error
= crypto_aead_setauthsize(tfm
, authsize
);
2411 /* AAD, plaintext, and ciphertext lengths */
2412 total_len
= generate_random_length(rng
, maxdatasize
);
2413 if (prandom_u32_below(rng
, 4) == 0)
2416 vec
->alen
= generate_random_length(rng
, total_len
);
2417 vec
->plen
= total_len
- vec
->alen
;
2418 vec
->clen
= vec
->plen
+ authsize
;
2421 * Generate the AAD, plaintext, and ciphertext. Not applicable if the
2422 * key or the authentication tag size couldn't be set.
2425 vec
->crypt_error
= 0;
2426 if (vec
->setkey_error
== 0 && vec
->setauthsize_error
== 0)
2427 generate_aead_message(rng
, req
, suite
, vec
, prefer_inauthentic
);
2428 snprintf(name
, max_namelen
,
2429 "\"random: alen=%u plen=%u authsize=%u klen=%u novrfy=%d\"",
2430 vec
->alen
, vec
->plen
, authsize
, vec
->klen
, vec
->novrfy
);
2433 static void try_to_generate_inauthentic_testvec(
2434 struct aead_extra_tests_ctx
*ctx
)
2438 for (i
= 0; i
< 10; i
++) {
2439 generate_random_aead_testvec(&ctx
->rng
, ctx
->req
, &ctx
->vec
,
2440 &ctx
->test_desc
->suite
.aead
,
2441 ctx
->maxkeysize
, ctx
->maxdatasize
,
2443 sizeof(ctx
->vec_name
), true);
2444 if (ctx
->vec
.novrfy
)
2450 * Generate inauthentic test vectors (i.e. ciphertext, AAD pairs that aren't the
2451 * result of an encryption with the key) and verify that decryption fails.
2453 static int test_aead_inauthentic_inputs(struct aead_extra_tests_ctx
*ctx
)
2458 for (i
= 0; i
< fuzz_iterations
* 8; i
++) {
2460 * Since this part of the tests isn't comparing the
2461 * implementation to another, there's no point in testing any
2462 * test vectors other than inauthentic ones (vec.novrfy=1) here.
2464 * If we're having trouble generating such a test vector, e.g.
2465 * if the algorithm keeps rejecting the generated keys, don't
2466 * retry forever; just continue on.
2468 try_to_generate_inauthentic_testvec(ctx
);
2469 if (ctx
->vec
.novrfy
) {
2470 generate_random_testvec_config(&ctx
->rng
, &ctx
->cfg
,
2472 sizeof(ctx
->cfgname
));
2473 err
= test_aead_vec_cfg(DECRYPT
, &ctx
->vec
,
2474 ctx
->vec_name
, &ctx
->cfg
,
2475 ctx
->req
, ctx
->tsgls
);
2485 * Test the AEAD algorithm against the corresponding generic implementation, if
2488 static int test_aead_vs_generic_impl(struct aead_extra_tests_ctx
*ctx
)
2490 struct crypto_aead
*tfm
= ctx
->tfm
;
2491 const char *algname
= crypto_aead_alg(tfm
)->base
.cra_name
;
2492 const char *driver
= crypto_aead_driver_name(tfm
);
2493 const char *generic_driver
= ctx
->test_desc
->generic_driver
;
2494 char _generic_driver
[CRYPTO_MAX_ALG_NAME
];
2495 struct crypto_aead
*generic_tfm
= NULL
;
2496 struct aead_request
*generic_req
= NULL
;
2500 if (!generic_driver
) { /* Use default naming convention? */
2501 err
= build_generic_driver_name(algname
, _generic_driver
);
2504 generic_driver
= _generic_driver
;
2507 if (strcmp(generic_driver
, driver
) == 0) /* Already the generic impl? */
2510 generic_tfm
= crypto_alloc_aead(generic_driver
, 0, 0);
2511 if (IS_ERR(generic_tfm
)) {
2512 err
= PTR_ERR(generic_tfm
);
2513 if (err
== -ENOENT
) {
2514 pr_warn("alg: aead: skipping comparison tests for %s because %s is unavailable\n",
2515 driver
, generic_driver
);
2518 pr_err("alg: aead: error allocating %s (generic impl of %s): %d\n",
2519 generic_driver
, algname
, err
);
2523 generic_req
= aead_request_alloc(generic_tfm
, GFP_KERNEL
);
2529 /* Check the algorithm properties for consistency. */
2531 if (crypto_aead_maxauthsize(tfm
) !=
2532 crypto_aead_maxauthsize(generic_tfm
)) {
2533 pr_err("alg: aead: maxauthsize for %s (%u) doesn't match generic impl (%u)\n",
2534 driver
, crypto_aead_maxauthsize(tfm
),
2535 crypto_aead_maxauthsize(generic_tfm
));
2540 if (crypto_aead_ivsize(tfm
) != crypto_aead_ivsize(generic_tfm
)) {
2541 pr_err("alg: aead: ivsize for %s (%u) doesn't match generic impl (%u)\n",
2542 driver
, crypto_aead_ivsize(tfm
),
2543 crypto_aead_ivsize(generic_tfm
));
2548 if (crypto_aead_blocksize(tfm
) != crypto_aead_blocksize(generic_tfm
)) {
2549 pr_err("alg: aead: blocksize for %s (%u) doesn't match generic impl (%u)\n",
2550 driver
, crypto_aead_blocksize(tfm
),
2551 crypto_aead_blocksize(generic_tfm
));
2557 * Now generate test vectors using the generic implementation, and test
2558 * the other implementation against them.
2560 for (i
= 0; i
< fuzz_iterations
* 8; i
++) {
2561 generate_random_aead_testvec(&ctx
->rng
, generic_req
, &ctx
->vec
,
2562 &ctx
->test_desc
->suite
.aead
,
2563 ctx
->maxkeysize
, ctx
->maxdatasize
,
2565 sizeof(ctx
->vec_name
), false);
2566 generate_random_testvec_config(&ctx
->rng
, &ctx
->cfg
,
2568 sizeof(ctx
->cfgname
));
2569 if (!ctx
->vec
.novrfy
) {
2570 err
= test_aead_vec_cfg(ENCRYPT
, &ctx
->vec
,
2571 ctx
->vec_name
, &ctx
->cfg
,
2572 ctx
->req
, ctx
->tsgls
);
2576 if (ctx
->vec
.crypt_error
== 0 || ctx
->vec
.novrfy
) {
2577 err
= test_aead_vec_cfg(DECRYPT
, &ctx
->vec
,
2578 ctx
->vec_name
, &ctx
->cfg
,
2579 ctx
->req
, ctx
->tsgls
);
2587 crypto_free_aead(generic_tfm
);
2588 aead_request_free(generic_req
);
2592 static int test_aead_extra(const struct alg_test_desc
*test_desc
,
2593 struct aead_request
*req
,
2594 struct cipher_test_sglists
*tsgls
)
2596 struct aead_extra_tests_ctx
*ctx
;
2603 ctx
= kzalloc(sizeof(*ctx
), GFP_KERNEL
);
2606 init_rnd_state(&ctx
->rng
);
2608 ctx
->tfm
= crypto_aead_reqtfm(req
);
2609 ctx
->test_desc
= test_desc
;
2611 ctx
->maxdatasize
= (2 * PAGE_SIZE
) - TESTMGR_POISON_LEN
;
2612 ctx
->maxkeysize
= 0;
2613 for (i
= 0; i
< test_desc
->suite
.aead
.count
; i
++)
2614 ctx
->maxkeysize
= max_t(unsigned int, ctx
->maxkeysize
,
2615 test_desc
->suite
.aead
.vecs
[i
].klen
);
2617 ctx
->vec
.key
= kmalloc(ctx
->maxkeysize
, GFP_KERNEL
);
2618 ctx
->vec
.iv
= kmalloc(crypto_aead_ivsize(ctx
->tfm
), GFP_KERNEL
);
2619 ctx
->vec
.assoc
= kmalloc(ctx
->maxdatasize
, GFP_KERNEL
);
2620 ctx
->vec
.ptext
= kmalloc(ctx
->maxdatasize
, GFP_KERNEL
);
2621 ctx
->vec
.ctext
= kmalloc(ctx
->maxdatasize
, GFP_KERNEL
);
2622 if (!ctx
->vec
.key
|| !ctx
->vec
.iv
|| !ctx
->vec
.assoc
||
2623 !ctx
->vec
.ptext
|| !ctx
->vec
.ctext
) {
2628 err
= test_aead_vs_generic_impl(ctx
);
2632 err
= test_aead_inauthentic_inputs(ctx
);
2634 kfree(ctx
->vec
.key
);
2636 kfree(ctx
->vec
.assoc
);
2637 kfree(ctx
->vec
.ptext
);
2638 kfree(ctx
->vec
.ctext
);
2642 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
2643 static int test_aead_extra(const struct alg_test_desc
*test_desc
,
2644 struct aead_request
*req
,
2645 struct cipher_test_sglists
*tsgls
)
2649 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
2651 static int test_aead(int enc
, const struct aead_test_suite
*suite
,
2652 struct aead_request
*req
,
2653 struct cipher_test_sglists
*tsgls
)
2658 for (i
= 0; i
< suite
->count
; i
++) {
2659 err
= test_aead_vec(enc
, &suite
->vecs
[i
], i
, req
, tsgls
);
2667 static int alg_test_aead(const struct alg_test_desc
*desc
, const char *driver
,
2670 const struct aead_test_suite
*suite
= &desc
->suite
.aead
;
2671 struct crypto_aead
*tfm
;
2672 struct aead_request
*req
= NULL
;
2673 struct cipher_test_sglists
*tsgls
= NULL
;
2676 if (suite
->count
<= 0) {
2677 pr_err("alg: aead: empty test suite for %s\n", driver
);
2681 tfm
= crypto_alloc_aead(driver
, type
, mask
);
2683 pr_err("alg: aead: failed to allocate transform for %s: %ld\n",
2684 driver
, PTR_ERR(tfm
));
2685 return PTR_ERR(tfm
);
2687 driver
= crypto_aead_driver_name(tfm
);
2689 req
= aead_request_alloc(tfm
, GFP_KERNEL
);
2691 pr_err("alg: aead: failed to allocate request for %s\n",
2697 tsgls
= alloc_cipher_test_sglists();
2699 pr_err("alg: aead: failed to allocate test buffers for %s\n",
2705 err
= test_aead(ENCRYPT
, suite
, req
, tsgls
);
2709 err
= test_aead(DECRYPT
, suite
, req
, tsgls
);
2713 err
= test_aead_extra(desc
, req
, tsgls
);
2715 free_cipher_test_sglists(tsgls
);
2716 aead_request_free(req
);
2717 crypto_free_aead(tfm
);
2721 static int test_cipher(struct crypto_cipher
*tfm
, int enc
,
2722 const struct cipher_testvec
*template,
2723 unsigned int tcount
)
2725 const char *algo
= crypto_tfm_alg_driver_name(crypto_cipher_tfm(tfm
));
2726 unsigned int i
, j
, k
;
2729 const char *input
, *result
;
2731 char *xbuf
[XBUFSIZE
];
2734 if (testmgr_alloc_buf(xbuf
))
2743 for (i
= 0; i
< tcount
; i
++) {
2745 if (fips_enabled
&& template[i
].fips_skip
)
2748 input
= enc
? template[i
].ptext
: template[i
].ctext
;
2749 result
= enc
? template[i
].ctext
: template[i
].ptext
;
2753 if (WARN_ON(template[i
].len
> PAGE_SIZE
))
2757 memcpy(data
, input
, template[i
].len
);
2759 crypto_cipher_clear_flags(tfm
, ~0);
2761 crypto_cipher_set_flags(tfm
, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS
);
2763 ret
= crypto_cipher_setkey(tfm
, template[i
].key
,
2766 if (ret
== template[i
].setkey_error
)
2768 pr_err("alg: cipher: %s setkey failed on test vector %u; expected_error=%d, actual_error=%d, flags=%#x\n",
2769 algo
, j
, template[i
].setkey_error
, ret
,
2770 crypto_cipher_get_flags(tfm
));
2773 if (template[i
].setkey_error
) {
2774 pr_err("alg: cipher: %s setkey unexpectedly succeeded on test vector %u; expected_error=%d\n",
2775 algo
, j
, template[i
].setkey_error
);
2780 for (k
= 0; k
< template[i
].len
;
2781 k
+= crypto_cipher_blocksize(tfm
)) {
2783 crypto_cipher_encrypt_one(tfm
, data
+ k
,
2786 crypto_cipher_decrypt_one(tfm
, data
+ k
,
2791 if (memcmp(q
, result
, template[i
].len
)) {
2792 printk(KERN_ERR
"alg: cipher: Test %d failed "
2793 "on %s for %s\n", j
, e
, algo
);
2794 hexdump(q
, template[i
].len
);
2803 testmgr_free_buf(xbuf
);
2808 static int test_skcipher_vec_cfg(int enc
, const struct cipher_testvec
*vec
,
2809 const char *vec_name
,
2810 const struct testvec_config
*cfg
,
2811 struct skcipher_request
*req
,
2812 struct cipher_test_sglists
*tsgls
)
2814 struct crypto_skcipher
*tfm
= crypto_skcipher_reqtfm(req
);
2815 const unsigned int alignmask
= crypto_skcipher_alignmask(tfm
);
2816 const unsigned int ivsize
= crypto_skcipher_ivsize(tfm
);
2817 const char *driver
= crypto_skcipher_driver_name(tfm
);
2818 const u32 req_flags
= CRYPTO_TFM_REQ_MAY_BACKLOG
| cfg
->req_flags
;
2819 const char *op
= enc
? "encryption" : "decryption";
2820 DECLARE_CRYPTO_WAIT(wait
);
2821 u8 _iv
[3 * (MAX_ALGAPI_ALIGNMASK
+ 1) + MAX_IVLEN
];
2822 u8
*iv
= PTR_ALIGN(&_iv
[0], 2 * (MAX_ALGAPI_ALIGNMASK
+ 1)) +
2824 (cfg
->iv_offset_relative_to_alignmask
? alignmask
: 0);
2830 crypto_skcipher_set_flags(tfm
, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS
);
2832 crypto_skcipher_clear_flags(tfm
,
2833 CRYPTO_TFM_REQ_FORBID_WEAK_KEYS
);
2834 err
= do_setkey(crypto_skcipher_setkey
, tfm
, vec
->key
, vec
->klen
,
2837 if (err
== vec
->setkey_error
)
2839 pr_err("alg: skcipher: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
2840 driver
, vec_name
, vec
->setkey_error
, err
,
2841 crypto_skcipher_get_flags(tfm
));
2844 if (vec
->setkey_error
) {
2845 pr_err("alg: skcipher: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
2846 driver
, vec_name
, vec
->setkey_error
);
2850 /* The IV must be copied to a buffer, as the algorithm may modify it */
2852 if (WARN_ON(ivsize
> MAX_IVLEN
))
2854 if (vec
->generates_iv
&& !enc
)
2855 memcpy(iv
, vec
->iv_out
, ivsize
);
2857 memcpy(iv
, vec
->iv
, ivsize
);
2859 memset(iv
, 0, ivsize
);
2861 if (vec
->generates_iv
) {
2862 pr_err("alg: skcipher: %s has ivsize=0 but test vector %s generates IV!\n",
2869 /* Build the src/dst scatterlists */
2870 input
.iov_base
= enc
? (void *)vec
->ptext
: (void *)vec
->ctext
;
2871 input
.iov_len
= vec
->len
;
2872 err
= build_cipher_test_sglists(tsgls
, cfg
, alignmask
,
2873 vec
->len
, vec
->len
, &input
, 1);
2875 pr_err("alg: skcipher: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n",
2876 driver
, op
, vec_name
, cfg
->name
);
2880 /* Do the actual encryption or decryption */
2881 testmgr_poison(req
->__ctx
, crypto_skcipher_reqsize(tfm
));
2882 skcipher_request_set_callback(req
, req_flags
, crypto_req_done
, &wait
);
2883 skcipher_request_set_crypt(req
, tsgls
->src
.sgl_ptr
, tsgls
->dst
.sgl_ptr
,
2886 crypto_disable_simd_for_test();
2887 err
= enc
? crypto_skcipher_encrypt(req
) : crypto_skcipher_decrypt(req
);
2889 crypto_reenable_simd_for_test();
2890 err
= crypto_wait_req(err
, &wait
);
2892 /* Check that the algorithm didn't overwrite things it shouldn't have */
2893 if (req
->cryptlen
!= vec
->len
||
2895 req
->src
!= tsgls
->src
.sgl_ptr
||
2896 req
->dst
!= tsgls
->dst
.sgl_ptr
||
2897 crypto_skcipher_reqtfm(req
) != tfm
||
2898 req
->base
.complete
!= crypto_req_done
||
2899 req
->base
.flags
!= req_flags
||
2900 req
->base
.data
!= &wait
) {
2901 pr_err("alg: skcipher: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n",
2902 driver
, op
, vec_name
, cfg
->name
);
2903 if (req
->cryptlen
!= vec
->len
)
2904 pr_err("alg: skcipher: changed 'req->cryptlen'\n");
2906 pr_err("alg: skcipher: changed 'req->iv'\n");
2907 if (req
->src
!= tsgls
->src
.sgl_ptr
)
2908 pr_err("alg: skcipher: changed 'req->src'\n");
2909 if (req
->dst
!= tsgls
->dst
.sgl_ptr
)
2910 pr_err("alg: skcipher: changed 'req->dst'\n");
2911 if (crypto_skcipher_reqtfm(req
) != tfm
)
2912 pr_err("alg: skcipher: changed 'req->base.tfm'\n");
2913 if (req
->base
.complete
!= crypto_req_done
)
2914 pr_err("alg: skcipher: changed 'req->base.complete'\n");
2915 if (req
->base
.flags
!= req_flags
)
2916 pr_err("alg: skcipher: changed 'req->base.flags'\n");
2917 if (req
->base
.data
!= &wait
)
2918 pr_err("alg: skcipher: changed 'req->base.data'\n");
2921 if (is_test_sglist_corrupted(&tsgls
->src
)) {
2922 pr_err("alg: skcipher: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n",
2923 driver
, op
, vec_name
, cfg
->name
);
2926 if (tsgls
->dst
.sgl_ptr
!= tsgls
->src
.sgl
&&
2927 is_test_sglist_corrupted(&tsgls
->dst
)) {
2928 pr_err("alg: skcipher: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n",
2929 driver
, op
, vec_name
, cfg
->name
);
2933 /* Check for success or failure */
2935 if (err
== vec
->crypt_error
)
2937 pr_err("alg: skcipher: %s %s failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
2938 driver
, op
, vec_name
, vec
->crypt_error
, err
, cfg
->name
);
2941 if (vec
->crypt_error
) {
2942 pr_err("alg: skcipher: %s %s unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
2943 driver
, op
, vec_name
, vec
->crypt_error
, cfg
->name
);
2947 /* Check for the correct output (ciphertext or plaintext) */
2948 err
= verify_correct_output(&tsgls
->dst
, enc
? vec
->ctext
: vec
->ptext
,
2950 if (err
== -EOVERFLOW
) {
2951 pr_err("alg: skcipher: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n",
2952 driver
, op
, vec_name
, cfg
->name
);
2956 pr_err("alg: skcipher: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
2957 driver
, op
, vec_name
, cfg
->name
);
2961 /* If applicable, check that the algorithm generated the correct IV */
2962 if (vec
->iv_out
&& memcmp(iv
, vec
->iv_out
, ivsize
) != 0) {
2963 pr_err("alg: skcipher: %s %s test failed (wrong output IV) on test vector %s, cfg=\"%s\"\n",
2964 driver
, op
, vec_name
, cfg
->name
);
2965 hexdump(iv
, ivsize
);
2972 static int test_skcipher_vec(int enc
, const struct cipher_testvec
*vec
,
2973 unsigned int vec_num
,
2974 struct skcipher_request
*req
,
2975 struct cipher_test_sglists
*tsgls
)
2981 if (fips_enabled
&& vec
->fips_skip
)
2984 sprintf(vec_name
, "%u", vec_num
);
2986 for (i
= 0; i
< ARRAY_SIZE(default_cipher_testvec_configs
); i
++) {
2987 err
= test_skcipher_vec_cfg(enc
, vec
, vec_name
,
2988 &default_cipher_testvec_configs
[i
],
2994 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2995 if (!noextratests
) {
2996 struct rnd_state rng
;
2997 struct testvec_config cfg
;
2998 char cfgname
[TESTVEC_CONFIG_NAMELEN
];
3000 init_rnd_state(&rng
);
3002 for (i
= 0; i
< fuzz_iterations
; i
++) {
3003 generate_random_testvec_config(&rng
, &cfg
, cfgname
,
3005 err
= test_skcipher_vec_cfg(enc
, vec
, vec_name
,
3016 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
3018 * Generate a symmetric cipher test vector from the given implementation.
3019 * Assumes the buffers in 'vec' were already allocated.
3021 static void generate_random_cipher_testvec(struct rnd_state
*rng
,
3022 struct skcipher_request
*req
,
3023 struct cipher_testvec
*vec
,
3024 unsigned int maxdatasize
,
3025 char *name
, size_t max_namelen
)
3027 struct crypto_skcipher
*tfm
= crypto_skcipher_reqtfm(req
);
3028 const unsigned int maxkeysize
= crypto_skcipher_max_keysize(tfm
);
3029 const unsigned int ivsize
= crypto_skcipher_ivsize(tfm
);
3030 struct scatterlist src
, dst
;
3032 DECLARE_CRYPTO_WAIT(wait
);
3034 /* Key: length in [0, maxkeysize], but usually choose maxkeysize */
3035 vec
->klen
= maxkeysize
;
3036 if (prandom_u32_below(rng
, 4) == 0)
3037 vec
->klen
= prandom_u32_below(rng
, maxkeysize
+ 1);
3038 generate_random_bytes(rng
, (u8
*)vec
->key
, vec
->klen
);
3039 vec
->setkey_error
= crypto_skcipher_setkey(tfm
, vec
->key
, vec
->klen
);
3042 generate_random_bytes(rng
, (u8
*)vec
->iv
, ivsize
);
3045 vec
->len
= generate_random_length(rng
, maxdatasize
);
3046 generate_random_bytes(rng
, (u8
*)vec
->ptext
, vec
->len
);
3048 /* If the key couldn't be set, no need to continue to encrypt. */
3049 if (vec
->setkey_error
)
3053 sg_init_one(&src
, vec
->ptext
, vec
->len
);
3054 sg_init_one(&dst
, vec
->ctext
, vec
->len
);
3055 memcpy(iv
, vec
->iv
, ivsize
);
3056 skcipher_request_set_callback(req
, 0, crypto_req_done
, &wait
);
3057 skcipher_request_set_crypt(req
, &src
, &dst
, vec
->len
, iv
);
3058 vec
->crypt_error
= crypto_wait_req(crypto_skcipher_encrypt(req
), &wait
);
3059 if (vec
->crypt_error
!= 0) {
3061 * The only acceptable error here is for an invalid length, so
3062 * skcipher decryption should fail with the same error too.
3063 * We'll test for this. But to keep the API usage well-defined,
3064 * explicitly initialize the ciphertext buffer too.
3066 memset((u8
*)vec
->ctext
, 0, vec
->len
);
3069 snprintf(name
, max_namelen
, "\"random: len=%u klen=%u\"",
3070 vec
->len
, vec
->klen
);
3074 * Test the skcipher algorithm represented by @req against the corresponding
3075 * generic implementation, if one is available.
3077 static int test_skcipher_vs_generic_impl(const char *generic_driver
,
3078 struct skcipher_request
*req
,
3079 struct cipher_test_sglists
*tsgls
)
3081 struct crypto_skcipher
*tfm
= crypto_skcipher_reqtfm(req
);
3082 const unsigned int maxkeysize
= crypto_skcipher_max_keysize(tfm
);
3083 const unsigned int ivsize
= crypto_skcipher_ivsize(tfm
);
3084 const unsigned int blocksize
= crypto_skcipher_blocksize(tfm
);
3085 const unsigned int maxdatasize
= (2 * PAGE_SIZE
) - TESTMGR_POISON_LEN
;
3086 const char *algname
= crypto_skcipher_alg(tfm
)->base
.cra_name
;
3087 const char *driver
= crypto_skcipher_driver_name(tfm
);
3088 struct rnd_state rng
;
3089 char _generic_driver
[CRYPTO_MAX_ALG_NAME
];
3090 struct crypto_skcipher
*generic_tfm
= NULL
;
3091 struct skcipher_request
*generic_req
= NULL
;
3093 struct cipher_testvec vec
= { 0 };
3095 struct testvec_config
*cfg
;
3096 char cfgname
[TESTVEC_CONFIG_NAMELEN
];
3102 /* Keywrap isn't supported here yet as it handles its IV differently. */
3103 if (strncmp(algname
, "kw(", 3) == 0)
3106 init_rnd_state(&rng
);
3108 if (!generic_driver
) { /* Use default naming convention? */
3109 err
= build_generic_driver_name(algname
, _generic_driver
);
3112 generic_driver
= _generic_driver
;
3115 if (strcmp(generic_driver
, driver
) == 0) /* Already the generic impl? */
3118 generic_tfm
= crypto_alloc_skcipher(generic_driver
, 0, 0);
3119 if (IS_ERR(generic_tfm
)) {
3120 err
= PTR_ERR(generic_tfm
);
3121 if (err
== -ENOENT
) {
3122 pr_warn("alg: skcipher: skipping comparison tests for %s because %s is unavailable\n",
3123 driver
, generic_driver
);
3126 pr_err("alg: skcipher: error allocating %s (generic impl of %s): %d\n",
3127 generic_driver
, algname
, err
);
3131 cfg
= kzalloc(sizeof(*cfg
), GFP_KERNEL
);
3137 generic_req
= skcipher_request_alloc(generic_tfm
, GFP_KERNEL
);
3143 /* Check the algorithm properties for consistency. */
3145 if (crypto_skcipher_min_keysize(tfm
) !=
3146 crypto_skcipher_min_keysize(generic_tfm
)) {
3147 pr_err("alg: skcipher: min keysize for %s (%u) doesn't match generic impl (%u)\n",
3148 driver
, crypto_skcipher_min_keysize(tfm
),
3149 crypto_skcipher_min_keysize(generic_tfm
));
3154 if (maxkeysize
!= crypto_skcipher_max_keysize(generic_tfm
)) {
3155 pr_err("alg: skcipher: max keysize for %s (%u) doesn't match generic impl (%u)\n",
3157 crypto_skcipher_max_keysize(generic_tfm
));
3162 if (ivsize
!= crypto_skcipher_ivsize(generic_tfm
)) {
3163 pr_err("alg: skcipher: ivsize for %s (%u) doesn't match generic impl (%u)\n",
3164 driver
, ivsize
, crypto_skcipher_ivsize(generic_tfm
));
3169 if (blocksize
!= crypto_skcipher_blocksize(generic_tfm
)) {
3170 pr_err("alg: skcipher: blocksize for %s (%u) doesn't match generic impl (%u)\n",
3172 crypto_skcipher_blocksize(generic_tfm
));
3178 * Now generate test vectors using the generic implementation, and test
3179 * the other implementation against them.
3182 vec
.key
= kmalloc(maxkeysize
, GFP_KERNEL
);
3183 vec
.iv
= kmalloc(ivsize
, GFP_KERNEL
);
3184 vec
.ptext
= kmalloc(maxdatasize
, GFP_KERNEL
);
3185 vec
.ctext
= kmalloc(maxdatasize
, GFP_KERNEL
);
3186 if (!vec
.key
|| !vec
.iv
|| !vec
.ptext
|| !vec
.ctext
) {
3191 for (i
= 0; i
< fuzz_iterations
* 8; i
++) {
3192 generate_random_cipher_testvec(&rng
, generic_req
, &vec
,
3194 vec_name
, sizeof(vec_name
));
3195 generate_random_testvec_config(&rng
, cfg
, cfgname
,
3198 err
= test_skcipher_vec_cfg(ENCRYPT
, &vec
, vec_name
,
3202 err
= test_skcipher_vec_cfg(DECRYPT
, &vec
, vec_name
,
3215 crypto_free_skcipher(generic_tfm
);
3216 skcipher_request_free(generic_req
);
3219 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
3220 static int test_skcipher_vs_generic_impl(const char *generic_driver
,
3221 struct skcipher_request
*req
,
3222 struct cipher_test_sglists
*tsgls
)
3226 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
3228 static int test_skcipher(int enc
, const struct cipher_test_suite
*suite
,
3229 struct skcipher_request
*req
,
3230 struct cipher_test_sglists
*tsgls
)
3235 for (i
= 0; i
< suite
->count
; i
++) {
3236 err
= test_skcipher_vec(enc
, &suite
->vecs
[i
], i
, req
, tsgls
);
3244 static int alg_test_skcipher(const struct alg_test_desc
*desc
,
3245 const char *driver
, u32 type
, u32 mask
)
3247 const struct cipher_test_suite
*suite
= &desc
->suite
.cipher
;
3248 struct crypto_skcipher
*tfm
;
3249 struct skcipher_request
*req
= NULL
;
3250 struct cipher_test_sglists
*tsgls
= NULL
;
3253 if (suite
->count
<= 0) {
3254 pr_err("alg: skcipher: empty test suite for %s\n", driver
);
3258 tfm
= crypto_alloc_skcipher(driver
, type
, mask
);
3260 pr_err("alg: skcipher: failed to allocate transform for %s: %ld\n",
3261 driver
, PTR_ERR(tfm
));
3262 return PTR_ERR(tfm
);
3264 driver
= crypto_skcipher_driver_name(tfm
);
3266 req
= skcipher_request_alloc(tfm
, GFP_KERNEL
);
3268 pr_err("alg: skcipher: failed to allocate request for %s\n",
3274 tsgls
= alloc_cipher_test_sglists();
3276 pr_err("alg: skcipher: failed to allocate test buffers for %s\n",
3282 err
= test_skcipher(ENCRYPT
, suite
, req
, tsgls
);
3286 err
= test_skcipher(DECRYPT
, suite
, req
, tsgls
);
3290 err
= test_skcipher_vs_generic_impl(desc
->generic_driver
, req
, tsgls
);
3292 free_cipher_test_sglists(tsgls
);
3293 skcipher_request_free(req
);
3294 crypto_free_skcipher(tfm
);
3298 static int test_comp(struct crypto_comp
*tfm
,
3299 const struct comp_testvec
*ctemplate
,
3300 const struct comp_testvec
*dtemplate
,
3301 int ctcount
, int dtcount
)
3303 const char *algo
= crypto_tfm_alg_driver_name(crypto_comp_tfm(tfm
));
3304 char *output
, *decomp_output
;
3308 output
= kmalloc(COMP_BUF_SIZE
, GFP_KERNEL
);
3312 decomp_output
= kmalloc(COMP_BUF_SIZE
, GFP_KERNEL
);
3313 if (!decomp_output
) {
3318 for (i
= 0; i
< ctcount
; i
++) {
3320 unsigned int dlen
= COMP_BUF_SIZE
;
3322 memset(output
, 0, COMP_BUF_SIZE
);
3323 memset(decomp_output
, 0, COMP_BUF_SIZE
);
3325 ilen
= ctemplate
[i
].inlen
;
3326 ret
= crypto_comp_compress(tfm
, ctemplate
[i
].input
,
3327 ilen
, output
, &dlen
);
3329 printk(KERN_ERR
"alg: comp: compression failed "
3330 "on test %d for %s: ret=%d\n", i
+ 1, algo
,
3336 dlen
= COMP_BUF_SIZE
;
3337 ret
= crypto_comp_decompress(tfm
, output
,
3338 ilen
, decomp_output
, &dlen
);
3340 pr_err("alg: comp: compression failed: decompress: on test %d for %s failed: ret=%d\n",
3345 if (dlen
!= ctemplate
[i
].inlen
) {
3346 printk(KERN_ERR
"alg: comp: Compression test %d "
3347 "failed for %s: output len = %d\n", i
+ 1, algo
,
3353 if (memcmp(decomp_output
, ctemplate
[i
].input
,
3354 ctemplate
[i
].inlen
)) {
3355 pr_err("alg: comp: compression failed: output differs: on test %d for %s\n",
3357 hexdump(decomp_output
, dlen
);
3363 for (i
= 0; i
< dtcount
; i
++) {
3365 unsigned int dlen
= COMP_BUF_SIZE
;
3367 memset(decomp_output
, 0, COMP_BUF_SIZE
);
3369 ilen
= dtemplate
[i
].inlen
;
3370 ret
= crypto_comp_decompress(tfm
, dtemplate
[i
].input
,
3371 ilen
, decomp_output
, &dlen
);
3373 printk(KERN_ERR
"alg: comp: decompression failed "
3374 "on test %d for %s: ret=%d\n", i
+ 1, algo
,
3379 if (dlen
!= dtemplate
[i
].outlen
) {
3380 printk(KERN_ERR
"alg: comp: Decompression test %d "
3381 "failed for %s: output len = %d\n", i
+ 1, algo
,
3387 if (memcmp(decomp_output
, dtemplate
[i
].output
, dlen
)) {
3388 printk(KERN_ERR
"alg: comp: Decompression test %d "
3389 "failed for %s\n", i
+ 1, algo
);
3390 hexdump(decomp_output
, dlen
);
3399 kfree(decomp_output
);
3404 static int test_acomp(struct crypto_acomp
*tfm
,
3405 const struct comp_testvec
*ctemplate
,
3406 const struct comp_testvec
*dtemplate
,
3407 int ctcount
, int dtcount
)
3409 const char *algo
= crypto_tfm_alg_driver_name(crypto_acomp_tfm(tfm
));
3411 char *output
, *decomp_out
;
3413 struct scatterlist src
, dst
;
3414 struct acomp_req
*req
;
3415 struct crypto_wait wait
;
3417 output
= kmalloc(COMP_BUF_SIZE
, GFP_KERNEL
);
3421 decomp_out
= kmalloc(COMP_BUF_SIZE
, GFP_KERNEL
);
3427 for (i
= 0; i
< ctcount
; i
++) {
3428 unsigned int dlen
= COMP_BUF_SIZE
;
3429 int ilen
= ctemplate
[i
].inlen
;
3432 input_vec
= kmemdup(ctemplate
[i
].input
, ilen
, GFP_KERNEL
);
3438 memset(output
, 0, dlen
);
3439 crypto_init_wait(&wait
);
3440 sg_init_one(&src
, input_vec
, ilen
);
3441 sg_init_one(&dst
, output
, dlen
);
3443 req
= acomp_request_alloc(tfm
);
3445 pr_err("alg: acomp: request alloc failed for %s\n",
3452 acomp_request_set_params(req
, &src
, &dst
, ilen
, dlen
);
3453 acomp_request_set_callback(req
, CRYPTO_TFM_REQ_MAY_BACKLOG
,
3454 crypto_req_done
, &wait
);
3456 ret
= crypto_wait_req(crypto_acomp_compress(req
), &wait
);
3458 pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
3461 acomp_request_free(req
);
3466 dlen
= COMP_BUF_SIZE
;
3467 sg_init_one(&src
, output
, ilen
);
3468 sg_init_one(&dst
, decomp_out
, dlen
);
3469 crypto_init_wait(&wait
);
3470 acomp_request_set_params(req
, &src
, &dst
, ilen
, dlen
);
3472 ret
= crypto_wait_req(crypto_acomp_decompress(req
), &wait
);
3474 pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
3477 acomp_request_free(req
);
3481 if (req
->dlen
!= ctemplate
[i
].inlen
) {
3482 pr_err("alg: acomp: Compression test %d failed for %s: output len = %d\n",
3483 i
+ 1, algo
, req
->dlen
);
3486 acomp_request_free(req
);
3490 if (memcmp(input_vec
, decomp_out
, req
->dlen
)) {
3491 pr_err("alg: acomp: Compression test %d failed for %s\n",
3493 hexdump(output
, req
->dlen
);
3496 acomp_request_free(req
);
3500 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
3501 crypto_init_wait(&wait
);
3502 sg_init_one(&src
, input_vec
, ilen
);
3503 acomp_request_set_params(req
, &src
, NULL
, ilen
, 0);
3505 ret
= crypto_wait_req(crypto_acomp_compress(req
), &wait
);
3507 pr_err("alg: acomp: compression failed on NULL dst buffer test %d for %s: ret=%d\n",
3510 acomp_request_free(req
);
3516 acomp_request_free(req
);
3519 for (i
= 0; i
< dtcount
; i
++) {
3520 unsigned int dlen
= COMP_BUF_SIZE
;
3521 int ilen
= dtemplate
[i
].inlen
;
3524 input_vec
= kmemdup(dtemplate
[i
].input
, ilen
, GFP_KERNEL
);
3530 memset(output
, 0, dlen
);
3531 crypto_init_wait(&wait
);
3532 sg_init_one(&src
, input_vec
, ilen
);
3533 sg_init_one(&dst
, output
, dlen
);
3535 req
= acomp_request_alloc(tfm
);
3537 pr_err("alg: acomp: request alloc failed for %s\n",
3544 acomp_request_set_params(req
, &src
, &dst
, ilen
, dlen
);
3545 acomp_request_set_callback(req
, CRYPTO_TFM_REQ_MAY_BACKLOG
,
3546 crypto_req_done
, &wait
);
3548 ret
= crypto_wait_req(crypto_acomp_decompress(req
), &wait
);
3550 pr_err("alg: acomp: decompression failed on test %d for %s: ret=%d\n",
3553 acomp_request_free(req
);
3557 if (req
->dlen
!= dtemplate
[i
].outlen
) {
3558 pr_err("alg: acomp: Decompression test %d failed for %s: output len = %d\n",
3559 i
+ 1, algo
, req
->dlen
);
3562 acomp_request_free(req
);
3566 if (memcmp(output
, dtemplate
[i
].output
, req
->dlen
)) {
3567 pr_err("alg: acomp: Decompression test %d failed for %s\n",
3569 hexdump(output
, req
->dlen
);
3572 acomp_request_free(req
);
3576 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
3577 crypto_init_wait(&wait
);
3578 acomp_request_set_params(req
, &src
, NULL
, ilen
, 0);
3580 ret
= crypto_wait_req(crypto_acomp_decompress(req
), &wait
);
3582 pr_err("alg: acomp: decompression failed on NULL dst buffer test %d for %s: ret=%d\n",
3585 acomp_request_free(req
);
3591 acomp_request_free(req
);
3602 static int test_cprng(struct crypto_rng
*tfm
,
3603 const struct cprng_testvec
*template,
3604 unsigned int tcount
)
3606 const char *algo
= crypto_tfm_alg_driver_name(crypto_rng_tfm(tfm
));
3607 int err
= 0, i
, j
, seedsize
;
3611 seedsize
= crypto_rng_seedsize(tfm
);
3613 seed
= kmalloc(seedsize
, GFP_KERNEL
);
3615 printk(KERN_ERR
"alg: cprng: Failed to allocate seed space "
3620 for (i
= 0; i
< tcount
; i
++) {
3621 memset(result
, 0, 32);
3623 memcpy(seed
, template[i
].v
, template[i
].vlen
);
3624 memcpy(seed
+ template[i
].vlen
, template[i
].key
,
3626 memcpy(seed
+ template[i
].vlen
+ template[i
].klen
,
3627 template[i
].dt
, template[i
].dtlen
);
3629 err
= crypto_rng_reset(tfm
, seed
, seedsize
);
3631 printk(KERN_ERR
"alg: cprng: Failed to reset rng "
3636 for (j
= 0; j
< template[i
].loops
; j
++) {
3637 err
= crypto_rng_get_bytes(tfm
, result
,
3640 printk(KERN_ERR
"alg: cprng: Failed to obtain "
3641 "the correct amount of random data for "
3642 "%s (requested %d)\n", algo
,
3648 err
= memcmp(result
, template[i
].result
,
3651 printk(KERN_ERR
"alg: cprng: Test %d failed for %s\n",
3653 hexdump(result
, template[i
].rlen
);
3664 static int alg_test_cipher(const struct alg_test_desc
*desc
,
3665 const char *driver
, u32 type
, u32 mask
)
3667 const struct cipher_test_suite
*suite
= &desc
->suite
.cipher
;
3668 struct crypto_cipher
*tfm
;
3671 tfm
= crypto_alloc_cipher(driver
, type
, mask
);
3673 printk(KERN_ERR
"alg: cipher: Failed to load transform for "
3674 "%s: %ld\n", driver
, PTR_ERR(tfm
));
3675 return PTR_ERR(tfm
);
3678 err
= test_cipher(tfm
, ENCRYPT
, suite
->vecs
, suite
->count
);
3680 err
= test_cipher(tfm
, DECRYPT
, suite
->vecs
, suite
->count
);
3682 crypto_free_cipher(tfm
);
3686 static int alg_test_comp(const struct alg_test_desc
*desc
, const char *driver
,
3689 struct crypto_comp
*comp
;
3690 struct crypto_acomp
*acomp
;
3692 u32 algo_type
= type
& CRYPTO_ALG_TYPE_ACOMPRESS_MASK
;
3694 if (algo_type
== CRYPTO_ALG_TYPE_ACOMPRESS
) {
3695 acomp
= crypto_alloc_acomp(driver
, type
, mask
);
3696 if (IS_ERR(acomp
)) {
3697 pr_err("alg: acomp: Failed to load transform for %s: %ld\n",
3698 driver
, PTR_ERR(acomp
));
3699 return PTR_ERR(acomp
);
3701 err
= test_acomp(acomp
, desc
->suite
.comp
.comp
.vecs
,
3702 desc
->suite
.comp
.decomp
.vecs
,
3703 desc
->suite
.comp
.comp
.count
,
3704 desc
->suite
.comp
.decomp
.count
);
3705 crypto_free_acomp(acomp
);
3707 comp
= crypto_alloc_comp(driver
, type
, mask
);
3709 pr_err("alg: comp: Failed to load transform for %s: %ld\n",
3710 driver
, PTR_ERR(comp
));
3711 return PTR_ERR(comp
);
3714 err
= test_comp(comp
, desc
->suite
.comp
.comp
.vecs
,
3715 desc
->suite
.comp
.decomp
.vecs
,
3716 desc
->suite
.comp
.comp
.count
,
3717 desc
->suite
.comp
.decomp
.count
);
3719 crypto_free_comp(comp
);
3724 static int alg_test_crc32c(const struct alg_test_desc
*desc
,
3725 const char *driver
, u32 type
, u32 mask
)
3727 struct crypto_shash
*tfm
;
3731 err
= alg_test_hash(desc
, driver
, type
, mask
);
3735 tfm
= crypto_alloc_shash(driver
, type
, mask
);
3737 if (PTR_ERR(tfm
) == -ENOENT
) {
3739 * This crc32c implementation is only available through
3740 * ahash API, not the shash API, so the remaining part
3741 * of the test is not applicable to it.
3745 printk(KERN_ERR
"alg: crc32c: Failed to load transform for %s: "
3746 "%ld\n", driver
, PTR_ERR(tfm
));
3747 return PTR_ERR(tfm
);
3749 driver
= crypto_shash_driver_name(tfm
);
3752 SHASH_DESC_ON_STACK(shash
, tfm
);
3753 u32
*ctx
= (u32
*)shash_desc_ctx(shash
);
3758 err
= crypto_shash_final(shash
, (u8
*)&val
);
3760 printk(KERN_ERR
"alg: crc32c: Operation failed for "
3761 "%s: %d\n", driver
, err
);
3765 if (val
!= cpu_to_le32(~420553207)) {
3766 pr_err("alg: crc32c: Test failed for %s: %u\n",
3767 driver
, le32_to_cpu(val
));
3772 crypto_free_shash(tfm
);
3777 static int alg_test_cprng(const struct alg_test_desc
*desc
, const char *driver
,
3780 struct crypto_rng
*rng
;
3783 rng
= crypto_alloc_rng(driver
, type
, mask
);
3785 printk(KERN_ERR
"alg: cprng: Failed to load transform for %s: "
3786 "%ld\n", driver
, PTR_ERR(rng
));
3787 return PTR_ERR(rng
);
3790 err
= test_cprng(rng
, desc
->suite
.cprng
.vecs
, desc
->suite
.cprng
.count
);
3792 crypto_free_rng(rng
);
3798 static int drbg_cavs_test(const struct drbg_testvec
*test
, int pr
,
3799 const char *driver
, u32 type
, u32 mask
)
3802 struct crypto_rng
*drng
;
3803 struct drbg_test_data test_data
;
3804 struct drbg_string addtl
, pers
, testentropy
;
3805 unsigned char *buf
= kzalloc(test
->expectedlen
, GFP_KERNEL
);
3810 drng
= crypto_alloc_rng(driver
, type
, mask
);
3812 printk(KERN_ERR
"alg: drbg: could not allocate DRNG handle for "
3814 kfree_sensitive(buf
);
3818 test_data
.testentropy
= &testentropy
;
3819 drbg_string_fill(&testentropy
, test
->entropy
, test
->entropylen
);
3820 drbg_string_fill(&pers
, test
->pers
, test
->perslen
);
3821 ret
= crypto_drbg_reset_test(drng
, &pers
, &test_data
);
3823 printk(KERN_ERR
"alg: drbg: Failed to reset rng\n");
3827 drbg_string_fill(&addtl
, test
->addtla
, test
->addtllen
);
3829 drbg_string_fill(&testentropy
, test
->entpra
, test
->entprlen
);
3830 ret
= crypto_drbg_get_bytes_addtl_test(drng
,
3831 buf
, test
->expectedlen
, &addtl
, &test_data
);
3833 ret
= crypto_drbg_get_bytes_addtl(drng
,
3834 buf
, test
->expectedlen
, &addtl
);
3837 printk(KERN_ERR
"alg: drbg: could not obtain random data for "
3838 "driver %s\n", driver
);
3842 drbg_string_fill(&addtl
, test
->addtlb
, test
->addtllen
);
3844 drbg_string_fill(&testentropy
, test
->entprb
, test
->entprlen
);
3845 ret
= crypto_drbg_get_bytes_addtl_test(drng
,
3846 buf
, test
->expectedlen
, &addtl
, &test_data
);
3848 ret
= crypto_drbg_get_bytes_addtl(drng
,
3849 buf
, test
->expectedlen
, &addtl
);
3852 printk(KERN_ERR
"alg: drbg: could not obtain random data for "
3853 "driver %s\n", driver
);
3857 ret
= memcmp(test
->expected
, buf
, test
->expectedlen
);
3860 crypto_free_rng(drng
);
3861 kfree_sensitive(buf
);
3866 static int alg_test_drbg(const struct alg_test_desc
*desc
, const char *driver
,
3872 const struct drbg_testvec
*template = desc
->suite
.drbg
.vecs
;
3873 unsigned int tcount
= desc
->suite
.drbg
.count
;
3875 if (0 == memcmp(driver
, "drbg_pr_", 8))
3878 for (i
= 0; i
< tcount
; i
++) {
3879 err
= drbg_cavs_test(&template[i
], pr
, driver
, type
, mask
);
3881 printk(KERN_ERR
"alg: drbg: Test %d failed for %s\n",
3891 static int do_test_kpp(struct crypto_kpp
*tfm
, const struct kpp_testvec
*vec
,
3894 struct kpp_request
*req
;
3895 void *input_buf
= NULL
;
3896 void *output_buf
= NULL
;
3897 void *a_public
= NULL
;
3899 void *shared_secret
= NULL
;
3900 struct crypto_wait wait
;
3901 unsigned int out_len_max
;
3903 struct scatterlist src
, dst
;
3905 req
= kpp_request_alloc(tfm
, GFP_KERNEL
);
3909 crypto_init_wait(&wait
);
3911 err
= crypto_kpp_set_secret(tfm
, vec
->secret
, vec
->secret_size
);
3915 out_len_max
= crypto_kpp_maxsize(tfm
);
3916 output_buf
= kzalloc(out_len_max
, GFP_KERNEL
);
3922 /* Use appropriate parameter as base */
3923 kpp_request_set_input(req
, NULL
, 0);
3924 sg_init_one(&dst
, output_buf
, out_len_max
);
3925 kpp_request_set_output(req
, &dst
, out_len_max
);
3926 kpp_request_set_callback(req
, CRYPTO_TFM_REQ_MAY_BACKLOG
,
3927 crypto_req_done
, &wait
);
3929 /* Compute party A's public key */
3930 err
= crypto_wait_req(crypto_kpp_generate_public_key(req
), &wait
);
3932 pr_err("alg: %s: Party A: generate public key test failed. err %d\n",
3938 /* Save party A's public key */
3939 a_public
= kmemdup(sg_virt(req
->dst
), out_len_max
, GFP_KERNEL
);
3945 /* Verify calculated public key */
3946 if (memcmp(vec
->expected_a_public
, sg_virt(req
->dst
),
3947 vec
->expected_a_public_size
)) {
3948 pr_err("alg: %s: Party A: generate public key test failed. Invalid output\n",
3955 /* Calculate shared secret key by using counter part (b) public key. */
3956 input_buf
= kmemdup(vec
->b_public
, vec
->b_public_size
, GFP_KERNEL
);
3962 sg_init_one(&src
, input_buf
, vec
->b_public_size
);
3963 sg_init_one(&dst
, output_buf
, out_len_max
);
3964 kpp_request_set_input(req
, &src
, vec
->b_public_size
);
3965 kpp_request_set_output(req
, &dst
, out_len_max
);
3966 kpp_request_set_callback(req
, CRYPTO_TFM_REQ_MAY_BACKLOG
,
3967 crypto_req_done
, &wait
);
3968 err
= crypto_wait_req(crypto_kpp_compute_shared_secret(req
), &wait
);
3970 pr_err("alg: %s: Party A: compute shared secret test failed. err %d\n",
3976 /* Save the shared secret obtained by party A */
3977 a_ss
= kmemdup(sg_virt(req
->dst
), vec
->expected_ss_size
, GFP_KERNEL
);
3984 * Calculate party B's shared secret by using party A's
3987 err
= crypto_kpp_set_secret(tfm
, vec
->b_secret
,
3988 vec
->b_secret_size
);
3992 sg_init_one(&src
, a_public
, vec
->expected_a_public_size
);
3993 sg_init_one(&dst
, output_buf
, out_len_max
);
3994 kpp_request_set_input(req
, &src
, vec
->expected_a_public_size
);
3995 kpp_request_set_output(req
, &dst
, out_len_max
);
3996 kpp_request_set_callback(req
, CRYPTO_TFM_REQ_MAY_BACKLOG
,
3997 crypto_req_done
, &wait
);
3998 err
= crypto_wait_req(crypto_kpp_compute_shared_secret(req
),
4001 pr_err("alg: %s: Party B: compute shared secret failed. err %d\n",
4006 shared_secret
= a_ss
;
4008 shared_secret
= (void *)vec
->expected_ss
;
4012 * verify shared secret from which the user will derive
4013 * secret key by executing whatever hash it has chosen
4015 if (memcmp(shared_secret
, sg_virt(req
->dst
),
4016 vec
->expected_ss_size
)) {
4017 pr_err("alg: %s: compute shared secret test failed. Invalid output\n",
4029 kpp_request_free(req
);
4033 static int test_kpp(struct crypto_kpp
*tfm
, const char *alg
,
4034 const struct kpp_testvec
*vecs
, unsigned int tcount
)
4038 for (i
= 0; i
< tcount
; i
++) {
4039 ret
= do_test_kpp(tfm
, vecs
++, alg
);
4041 pr_err("alg: %s: test failed on vector %d, err=%d\n",
4049 static int alg_test_kpp(const struct alg_test_desc
*desc
, const char *driver
,
4052 struct crypto_kpp
*tfm
;
4055 tfm
= crypto_alloc_kpp(driver
, type
, mask
);
4057 pr_err("alg: kpp: Failed to load tfm for %s: %ld\n",
4058 driver
, PTR_ERR(tfm
));
4059 return PTR_ERR(tfm
);
4061 if (desc
->suite
.kpp
.vecs
)
4062 err
= test_kpp(tfm
, desc
->alg
, desc
->suite
.kpp
.vecs
,
4063 desc
->suite
.kpp
.count
);
4065 crypto_free_kpp(tfm
);
4069 static u8
*test_pack_u32(u8
*dst
, u32 val
)
4071 memcpy(dst
, &val
, sizeof(val
));
4072 return dst
+ sizeof(val
);
4075 static int test_akcipher_one(struct crypto_akcipher
*tfm
,
4076 const struct akcipher_testvec
*vecs
)
4078 char *xbuf
[XBUFSIZE
];
4079 struct akcipher_request
*req
;
4080 void *outbuf_enc
= NULL
;
4081 void *outbuf_dec
= NULL
;
4082 struct crypto_wait wait
;
4083 unsigned int out_len_max
, out_len
= 0;
4085 struct scatterlist src
, dst
, src_tab
[3];
4087 unsigned int m_size
, c_size
;
4091 if (testmgr_alloc_buf(xbuf
))
4094 req
= akcipher_request_alloc(tfm
, GFP_KERNEL
);
4098 crypto_init_wait(&wait
);
4100 key
= kmalloc(vecs
->key_len
+ sizeof(u32
) * 2 + vecs
->param_len
,
4104 memcpy(key
, vecs
->key
, vecs
->key_len
);
4105 ptr
= key
+ vecs
->key_len
;
4106 ptr
= test_pack_u32(ptr
, vecs
->algo
);
4107 ptr
= test_pack_u32(ptr
, vecs
->param_len
);
4108 memcpy(ptr
, vecs
->params
, vecs
->param_len
);
4110 if (vecs
->public_key_vec
)
4111 err
= crypto_akcipher_set_pub_key(tfm
, key
, vecs
->key_len
);
4113 err
= crypto_akcipher_set_priv_key(tfm
, key
, vecs
->key_len
);
4118 * First run test which do not require a private key, such as
4119 * encrypt or verify.
4122 out_len_max
= crypto_akcipher_maxsize(tfm
);
4123 outbuf_enc
= kzalloc(out_len_max
, GFP_KERNEL
);
4127 if (!vecs
->siggen_sigver_test
) {
4129 m_size
= vecs
->m_size
;
4131 c_size
= vecs
->c_size
;
4134 /* Swap args so we could keep plaintext (digest)
4135 * in vecs->m, and cooked signature in vecs->c.
4137 m
= vecs
->c
; /* signature */
4138 m_size
= vecs
->c_size
;
4139 c
= vecs
->m
; /* digest */
4140 c_size
= vecs
->m_size
;
4145 if (WARN_ON(m_size
> PAGE_SIZE
))
4147 memcpy(xbuf
[0], m
, m_size
);
4149 sg_init_table(src_tab
, 3);
4150 sg_set_buf(&src_tab
[0], xbuf
[0], 8);
4151 sg_set_buf(&src_tab
[1], xbuf
[0] + 8, m_size
- 8);
4152 if (vecs
->siggen_sigver_test
) {
4153 if (WARN_ON(c_size
> PAGE_SIZE
))
4155 memcpy(xbuf
[1], c
, c_size
);
4156 sg_set_buf(&src_tab
[2], xbuf
[1], c_size
);
4157 akcipher_request_set_crypt(req
, src_tab
, NULL
, m_size
, c_size
);
4159 sg_init_one(&dst
, outbuf_enc
, out_len_max
);
4160 akcipher_request_set_crypt(req
, src_tab
, &dst
, m_size
,
4163 akcipher_request_set_callback(req
, CRYPTO_TFM_REQ_MAY_BACKLOG
,
4164 crypto_req_done
, &wait
);
4166 err
= crypto_wait_req(vecs
->siggen_sigver_test
?
4167 /* Run asymmetric signature verification */
4168 crypto_akcipher_verify(req
) :
4169 /* Run asymmetric encrypt */
4170 crypto_akcipher_encrypt(req
), &wait
);
4172 pr_err("alg: akcipher: %s test failed. err %d\n", op
, err
);
4175 if (!vecs
->siggen_sigver_test
&& c
) {
4176 if (req
->dst_len
!= c_size
) {
4177 pr_err("alg: akcipher: %s test failed. Invalid output len\n",
4182 /* verify that encrypted message is equal to expected */
4183 if (memcmp(c
, outbuf_enc
, c_size
) != 0) {
4184 pr_err("alg: akcipher: %s test failed. Invalid output\n",
4186 hexdump(outbuf_enc
, c_size
);
4193 * Don't invoke (decrypt or sign) test which require a private key
4194 * for vectors with only a public key.
4196 if (vecs
->public_key_vec
) {
4200 outbuf_dec
= kzalloc(out_len_max
, GFP_KERNEL
);
4206 if (!vecs
->siggen_sigver_test
&& !c
) {
4208 c_size
= req
->dst_len
;
4212 op
= vecs
->siggen_sigver_test
? "sign" : "decrypt";
4213 if (WARN_ON(c_size
> PAGE_SIZE
))
4215 memcpy(xbuf
[0], c
, c_size
);
4217 sg_init_one(&src
, xbuf
[0], c_size
);
4218 sg_init_one(&dst
, outbuf_dec
, out_len_max
);
4219 crypto_init_wait(&wait
);
4220 akcipher_request_set_crypt(req
, &src
, &dst
, c_size
, out_len_max
);
4222 err
= crypto_wait_req(vecs
->siggen_sigver_test
?
4223 /* Run asymmetric signature generation */
4224 crypto_akcipher_sign(req
) :
4225 /* Run asymmetric decrypt */
4226 crypto_akcipher_decrypt(req
), &wait
);
4228 pr_err("alg: akcipher: %s test failed. err %d\n", op
, err
);
4231 out_len
= req
->dst_len
;
4232 if (out_len
< m_size
) {
4233 pr_err("alg: akcipher: %s test failed. Invalid output len %u\n",
4238 /* verify that decrypted message is equal to the original msg */
4239 if (memchr_inv(outbuf_dec
, 0, out_len
- m_size
) ||
4240 memcmp(m
, outbuf_dec
+ out_len
- m_size
, m_size
)) {
4241 pr_err("alg: akcipher: %s test failed. Invalid output\n", op
);
4242 hexdump(outbuf_dec
, out_len
);
4251 akcipher_request_free(req
);
4253 testmgr_free_buf(xbuf
);
4257 static int test_akcipher(struct crypto_akcipher
*tfm
, const char *alg
,
4258 const struct akcipher_testvec
*vecs
,
4259 unsigned int tcount
)
4262 crypto_tfm_alg_driver_name(crypto_akcipher_tfm(tfm
));
4265 for (i
= 0; i
< tcount
; i
++) {
4266 ret
= test_akcipher_one(tfm
, vecs
++);
4270 pr_err("alg: akcipher: test %d failed for %s, err=%d\n",
4277 static int alg_test_akcipher(const struct alg_test_desc
*desc
,
4278 const char *driver
, u32 type
, u32 mask
)
4280 struct crypto_akcipher
*tfm
;
4283 tfm
= crypto_alloc_akcipher(driver
, type
, mask
);
4285 pr_err("alg: akcipher: Failed to load tfm for %s: %ld\n",
4286 driver
, PTR_ERR(tfm
));
4287 return PTR_ERR(tfm
);
4289 if (desc
->suite
.akcipher
.vecs
)
4290 err
= test_akcipher(tfm
, desc
->alg
, desc
->suite
.akcipher
.vecs
,
4291 desc
->suite
.akcipher
.count
);
4293 crypto_free_akcipher(tfm
);
4297 static int alg_test_null(const struct alg_test_desc
*desc
,
4298 const char *driver
, u32 type
, u32 mask
)
4303 #define ____VECS(tv) .vecs = tv, .count = ARRAY_SIZE(tv)
4304 #define __VECS(tv) { ____VECS(tv) }
4306 /* Please keep this list sorted by algorithm name. */
4307 static const struct alg_test_desc alg_test_descs
[] = {
4309 .alg
= "adiantum(xchacha12,aes)",
4310 .generic_driver
= "adiantum(xchacha12-generic,aes-generic,nhpoly1305-generic)",
4311 .test
= alg_test_skcipher
,
4313 .cipher
= __VECS(adiantum_xchacha12_aes_tv_template
)
4316 .alg
= "adiantum(xchacha20,aes)",
4317 .generic_driver
= "adiantum(xchacha20-generic,aes-generic,nhpoly1305-generic)",
4318 .test
= alg_test_skcipher
,
4320 .cipher
= __VECS(adiantum_xchacha20_aes_tv_template
)
4324 .test
= alg_test_aead
,
4326 .aead
= __VECS(aegis128_tv_template
)
4329 .alg
= "ansi_cprng",
4330 .test
= alg_test_cprng
,
4332 .cprng
= __VECS(ansi_cprng_aes_tv_template
)
4335 .alg
= "authenc(hmac(md5),ecb(cipher_null))",
4336 .test
= alg_test_aead
,
4338 .aead
= __VECS(hmac_md5_ecb_cipher_null_tv_template
)
4341 .alg
= "authenc(hmac(sha1),cbc(aes))",
4342 .test
= alg_test_aead
,
4345 .aead
= __VECS(hmac_sha1_aes_cbc_tv_temp
)
4348 .alg
= "authenc(hmac(sha1),cbc(des))",
4349 .test
= alg_test_aead
,
4351 .aead
= __VECS(hmac_sha1_des_cbc_tv_temp
)
4354 .alg
= "authenc(hmac(sha1),cbc(des3_ede))",
4355 .test
= alg_test_aead
,
4357 .aead
= __VECS(hmac_sha1_des3_ede_cbc_tv_temp
)
4360 .alg
= "authenc(hmac(sha1),ctr(aes))",
4361 .test
= alg_test_null
,
4364 .alg
= "authenc(hmac(sha1),ecb(cipher_null))",
4365 .test
= alg_test_aead
,
4367 .aead
= __VECS(hmac_sha1_ecb_cipher_null_tv_temp
)
4370 .alg
= "authenc(hmac(sha1),rfc3686(ctr(aes)))",
4371 .test
= alg_test_null
,
4374 .alg
= "authenc(hmac(sha224),cbc(des))",
4375 .test
= alg_test_aead
,
4377 .aead
= __VECS(hmac_sha224_des_cbc_tv_temp
)
4380 .alg
= "authenc(hmac(sha224),cbc(des3_ede))",
4381 .test
= alg_test_aead
,
4383 .aead
= __VECS(hmac_sha224_des3_ede_cbc_tv_temp
)
4386 .alg
= "authenc(hmac(sha256),cbc(aes))",
4387 .test
= alg_test_aead
,
4390 .aead
= __VECS(hmac_sha256_aes_cbc_tv_temp
)
4393 .alg
= "authenc(hmac(sha256),cbc(des))",
4394 .test
= alg_test_aead
,
4396 .aead
= __VECS(hmac_sha256_des_cbc_tv_temp
)
4399 .alg
= "authenc(hmac(sha256),cbc(des3_ede))",
4400 .test
= alg_test_aead
,
4402 .aead
= __VECS(hmac_sha256_des3_ede_cbc_tv_temp
)
4405 .alg
= "authenc(hmac(sha256),ctr(aes))",
4406 .test
= alg_test_null
,
4409 .alg
= "authenc(hmac(sha256),rfc3686(ctr(aes)))",
4410 .test
= alg_test_null
,
4413 .alg
= "authenc(hmac(sha384),cbc(des))",
4414 .test
= alg_test_aead
,
4416 .aead
= __VECS(hmac_sha384_des_cbc_tv_temp
)
4419 .alg
= "authenc(hmac(sha384),cbc(des3_ede))",
4420 .test
= alg_test_aead
,
4422 .aead
= __VECS(hmac_sha384_des3_ede_cbc_tv_temp
)
4425 .alg
= "authenc(hmac(sha384),ctr(aes))",
4426 .test
= alg_test_null
,
4429 .alg
= "authenc(hmac(sha384),rfc3686(ctr(aes)))",
4430 .test
= alg_test_null
,
4433 .alg
= "authenc(hmac(sha512),cbc(aes))",
4435 .test
= alg_test_aead
,
4437 .aead
= __VECS(hmac_sha512_aes_cbc_tv_temp
)
4440 .alg
= "authenc(hmac(sha512),cbc(des))",
4441 .test
= alg_test_aead
,
4443 .aead
= __VECS(hmac_sha512_des_cbc_tv_temp
)
4446 .alg
= "authenc(hmac(sha512),cbc(des3_ede))",
4447 .test
= alg_test_aead
,
4449 .aead
= __VECS(hmac_sha512_des3_ede_cbc_tv_temp
)
4452 .alg
= "authenc(hmac(sha512),ctr(aes))",
4453 .test
= alg_test_null
,
4456 .alg
= "authenc(hmac(sha512),rfc3686(ctr(aes)))",
4457 .test
= alg_test_null
,
4460 .alg
= "blake2b-160",
4461 .test
= alg_test_hash
,
4464 .hash
= __VECS(blake2b_160_tv_template
)
4467 .alg
= "blake2b-256",
4468 .test
= alg_test_hash
,
4471 .hash
= __VECS(blake2b_256_tv_template
)
4474 .alg
= "blake2b-384",
4475 .test
= alg_test_hash
,
4478 .hash
= __VECS(blake2b_384_tv_template
)
4481 .alg
= "blake2b-512",
4482 .test
= alg_test_hash
,
4485 .hash
= __VECS(blake2b_512_tv_template
)
4489 .test
= alg_test_skcipher
,
4492 .cipher
= __VECS(aes_cbc_tv_template
)
4495 .alg
= "cbc(anubis)",
4496 .test
= alg_test_skcipher
,
4498 .cipher
= __VECS(anubis_cbc_tv_template
)
4502 .test
= alg_test_skcipher
,
4504 .cipher
= __VECS(aria_cbc_tv_template
)
4507 .alg
= "cbc(blowfish)",
4508 .test
= alg_test_skcipher
,
4510 .cipher
= __VECS(bf_cbc_tv_template
)
4513 .alg
= "cbc(camellia)",
4514 .test
= alg_test_skcipher
,
4516 .cipher
= __VECS(camellia_cbc_tv_template
)
4519 .alg
= "cbc(cast5)",
4520 .test
= alg_test_skcipher
,
4522 .cipher
= __VECS(cast5_cbc_tv_template
)
4525 .alg
= "cbc(cast6)",
4526 .test
= alg_test_skcipher
,
4528 .cipher
= __VECS(cast6_cbc_tv_template
)
4532 .test
= alg_test_skcipher
,
4534 .cipher
= __VECS(des_cbc_tv_template
)
4537 .alg
= "cbc(des3_ede)",
4538 .test
= alg_test_skcipher
,
4540 .cipher
= __VECS(des3_ede_cbc_tv_template
)
4543 /* Same as cbc(aes) except the key is stored in
4544 * hardware secure memory which we reference by index
4547 .test
= alg_test_null
,
4550 /* Same as cbc(sm4) except the key is stored in
4551 * hardware secure memory which we reference by index
4554 .test
= alg_test_null
,
4556 .alg
= "cbc(serpent)",
4557 .test
= alg_test_skcipher
,
4559 .cipher
= __VECS(serpent_cbc_tv_template
)
4563 .test
= alg_test_skcipher
,
4565 .cipher
= __VECS(sm4_cbc_tv_template
)
4568 .alg
= "cbc(twofish)",
4569 .test
= alg_test_skcipher
,
4571 .cipher
= __VECS(tf_cbc_tv_template
)
4574 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
4575 .alg
= "cbc-paes-s390",
4577 .test
= alg_test_skcipher
,
4579 .cipher
= __VECS(aes_cbc_tv_template
)
4583 .alg
= "cbcmac(aes)",
4584 .test
= alg_test_hash
,
4586 .hash
= __VECS(aes_cbcmac_tv_template
)
4589 .alg
= "cbcmac(sm4)",
4590 .test
= alg_test_hash
,
4592 .hash
= __VECS(sm4_cbcmac_tv_template
)
4596 .generic_driver
= "ccm_base(ctr(aes-generic),cbcmac(aes-generic))",
4597 .test
= alg_test_aead
,
4601 ____VECS(aes_ccm_tv_template
),
4602 .einval_allowed
= 1,
4607 .generic_driver
= "ccm_base(ctr(sm4-generic),cbcmac(sm4-generic))",
4608 .test
= alg_test_aead
,
4611 ____VECS(sm4_ccm_tv_template
),
4612 .einval_allowed
= 1,
4617 .test
= alg_test_skcipher
,
4620 .cipher
= __VECS(aes_cfb_tv_template
)
4624 .test
= alg_test_skcipher
,
4626 .cipher
= __VECS(aria_cfb_tv_template
)
4630 .test
= alg_test_skcipher
,
4632 .cipher
= __VECS(sm4_cfb_tv_template
)
4636 .test
= alg_test_skcipher
,
4638 .cipher
= __VECS(chacha20_tv_template
)
4643 .test
= alg_test_hash
,
4645 .hash
= __VECS(aes_cmac128_tv_template
)
4648 .alg
= "cmac(camellia)",
4649 .test
= alg_test_hash
,
4651 .hash
= __VECS(camellia_cmac128_tv_template
)
4654 .alg
= "cmac(des3_ede)",
4655 .test
= alg_test_hash
,
4657 .hash
= __VECS(des3_ede_cmac64_tv_template
)
4661 .test
= alg_test_hash
,
4663 .hash
= __VECS(sm4_cmac128_tv_template
)
4666 .alg
= "compress_null",
4667 .test
= alg_test_null
,
4670 .test
= alg_test_hash
,
4673 .hash
= __VECS(crc32_tv_template
)
4677 .test
= alg_test_crc32c
,
4680 .hash
= __VECS(crc32c_tv_template
)
4683 .alg
= "crc64-rocksoft",
4684 .test
= alg_test_hash
,
4687 .hash
= __VECS(crc64_rocksoft_tv_template
)
4691 .test
= alg_test_hash
,
4694 .hash
= __VECS(crct10dif_tv_template
)
4698 .test
= alg_test_skcipher
,
4701 .cipher
= __VECS(aes_ctr_tv_template
)
4705 .test
= alg_test_skcipher
,
4707 .cipher
= __VECS(aria_ctr_tv_template
)
4710 .alg
= "ctr(blowfish)",
4711 .test
= alg_test_skcipher
,
4713 .cipher
= __VECS(bf_ctr_tv_template
)
4716 .alg
= "ctr(camellia)",
4717 .test
= alg_test_skcipher
,
4719 .cipher
= __VECS(camellia_ctr_tv_template
)
4722 .alg
= "ctr(cast5)",
4723 .test
= alg_test_skcipher
,
4725 .cipher
= __VECS(cast5_ctr_tv_template
)
4728 .alg
= "ctr(cast6)",
4729 .test
= alg_test_skcipher
,
4731 .cipher
= __VECS(cast6_ctr_tv_template
)
4735 .test
= alg_test_skcipher
,
4737 .cipher
= __VECS(des_ctr_tv_template
)
4740 .alg
= "ctr(des3_ede)",
4741 .test
= alg_test_skcipher
,
4743 .cipher
= __VECS(des3_ede_ctr_tv_template
)
4746 /* Same as ctr(aes) except the key is stored in
4747 * hardware secure memory which we reference by index
4750 .test
= alg_test_null
,
4754 /* Same as ctr(sm4) except the key is stored in
4755 * hardware secure memory which we reference by index
4758 .test
= alg_test_null
,
4760 .alg
= "ctr(serpent)",
4761 .test
= alg_test_skcipher
,
4763 .cipher
= __VECS(serpent_ctr_tv_template
)
4767 .test
= alg_test_skcipher
,
4769 .cipher
= __VECS(sm4_ctr_tv_template
)
4772 .alg
= "ctr(twofish)",
4773 .test
= alg_test_skcipher
,
4775 .cipher
= __VECS(tf_ctr_tv_template
)
4778 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
4779 .alg
= "ctr-paes-s390",
4781 .test
= alg_test_skcipher
,
4783 .cipher
= __VECS(aes_ctr_tv_template
)
4787 .alg
= "cts(cbc(aes))",
4788 .test
= alg_test_skcipher
,
4791 .cipher
= __VECS(cts_mode_tv_template
)
4794 /* Same as cts(cbc((aes)) except the key is stored in
4795 * hardware secure memory which we reference by index
4797 .alg
= "cts(cbc(paes))",
4798 .test
= alg_test_null
,
4801 .alg
= "cts(cbc(sm4))",
4802 .test
= alg_test_skcipher
,
4804 .cipher
= __VECS(sm4_cts_tv_template
)
4807 .alg
= "curve25519",
4808 .test
= alg_test_kpp
,
4810 .kpp
= __VECS(curve25519_tv_template
)
4814 .test
= alg_test_comp
,
4818 .comp
= __VECS(deflate_comp_tv_template
),
4819 .decomp
= __VECS(deflate_decomp_tv_template
)
4824 .test
= alg_test_kpp
,
4826 .kpp
= __VECS(dh_tv_template
)
4829 .alg
= "digest_null",
4830 .test
= alg_test_null
,
4832 .alg
= "drbg_nopr_ctr_aes128",
4833 .test
= alg_test_drbg
,
4836 .drbg
= __VECS(drbg_nopr_ctr_aes128_tv_template
)
4839 .alg
= "drbg_nopr_ctr_aes192",
4840 .test
= alg_test_drbg
,
4843 .drbg
= __VECS(drbg_nopr_ctr_aes192_tv_template
)
4846 .alg
= "drbg_nopr_ctr_aes256",
4847 .test
= alg_test_drbg
,
4850 .drbg
= __VECS(drbg_nopr_ctr_aes256_tv_template
)
4854 * There is no need to specifically test the DRBG with every
4855 * backend cipher -- covered by drbg_nopr_hmac_sha256 test
4857 .alg
= "drbg_nopr_hmac_sha1",
4859 .test
= alg_test_null
,
4861 .alg
= "drbg_nopr_hmac_sha256",
4862 .test
= alg_test_drbg
,
4865 .drbg
= __VECS(drbg_nopr_hmac_sha256_tv_template
)
4868 /* covered by drbg_nopr_hmac_sha256 test */
4869 .alg
= "drbg_nopr_hmac_sha384",
4870 .test
= alg_test_null
,
4872 .alg
= "drbg_nopr_hmac_sha512",
4873 .test
= alg_test_drbg
,
4876 .drbg
= __VECS(drbg_nopr_hmac_sha512_tv_template
)
4879 .alg
= "drbg_nopr_sha1",
4881 .test
= alg_test_null
,
4883 .alg
= "drbg_nopr_sha256",
4884 .test
= alg_test_drbg
,
4887 .drbg
= __VECS(drbg_nopr_sha256_tv_template
)
4890 /* covered by drbg_nopr_sha256 test */
4891 .alg
= "drbg_nopr_sha384",
4892 .test
= alg_test_null
,
4894 .alg
= "drbg_nopr_sha512",
4896 .test
= alg_test_null
,
4898 .alg
= "drbg_pr_ctr_aes128",
4899 .test
= alg_test_drbg
,
4902 .drbg
= __VECS(drbg_pr_ctr_aes128_tv_template
)
4905 /* covered by drbg_pr_ctr_aes128 test */
4906 .alg
= "drbg_pr_ctr_aes192",
4908 .test
= alg_test_null
,
4910 .alg
= "drbg_pr_ctr_aes256",
4912 .test
= alg_test_null
,
4914 .alg
= "drbg_pr_hmac_sha1",
4916 .test
= alg_test_null
,
4918 .alg
= "drbg_pr_hmac_sha256",
4919 .test
= alg_test_drbg
,
4922 .drbg
= __VECS(drbg_pr_hmac_sha256_tv_template
)
4925 /* covered by drbg_pr_hmac_sha256 test */
4926 .alg
= "drbg_pr_hmac_sha384",
4927 .test
= alg_test_null
,
4929 .alg
= "drbg_pr_hmac_sha512",
4930 .test
= alg_test_null
,
4933 .alg
= "drbg_pr_sha1",
4935 .test
= alg_test_null
,
4937 .alg
= "drbg_pr_sha256",
4938 .test
= alg_test_drbg
,
4941 .drbg
= __VECS(drbg_pr_sha256_tv_template
)
4944 /* covered by drbg_pr_sha256 test */
4945 .alg
= "drbg_pr_sha384",
4946 .test
= alg_test_null
,
4948 .alg
= "drbg_pr_sha512",
4950 .test
= alg_test_null
,
4953 .test
= alg_test_skcipher
,
4956 .cipher
= __VECS(aes_tv_template
)
4959 .alg
= "ecb(anubis)",
4960 .test
= alg_test_skcipher
,
4962 .cipher
= __VECS(anubis_tv_template
)
4966 .generic_driver
= "ecb(arc4)-generic",
4967 .test
= alg_test_skcipher
,
4969 .cipher
= __VECS(arc4_tv_template
)
4973 .test
= alg_test_skcipher
,
4975 .cipher
= __VECS(aria_tv_template
)
4978 .alg
= "ecb(blowfish)",
4979 .test
= alg_test_skcipher
,
4981 .cipher
= __VECS(bf_tv_template
)
4984 .alg
= "ecb(camellia)",
4985 .test
= alg_test_skcipher
,
4987 .cipher
= __VECS(camellia_tv_template
)
4990 .alg
= "ecb(cast5)",
4991 .test
= alg_test_skcipher
,
4993 .cipher
= __VECS(cast5_tv_template
)
4996 .alg
= "ecb(cast6)",
4997 .test
= alg_test_skcipher
,
4999 .cipher
= __VECS(cast6_tv_template
)
5002 .alg
= "ecb(cipher_null)",
5003 .test
= alg_test_null
,
5007 .test
= alg_test_skcipher
,
5009 .cipher
= __VECS(des_tv_template
)
5012 .alg
= "ecb(des3_ede)",
5013 .test
= alg_test_skcipher
,
5015 .cipher
= __VECS(des3_ede_tv_template
)
5018 .alg
= "ecb(fcrypt)",
5019 .test
= alg_test_skcipher
,
5022 .vecs
= fcrypt_pcbc_tv_template
,
5027 .alg
= "ecb(khazad)",
5028 .test
= alg_test_skcipher
,
5030 .cipher
= __VECS(khazad_tv_template
)
5033 /* Same as ecb(aes) except the key is stored in
5034 * hardware secure memory which we reference by index
5037 .test
= alg_test_null
,
5041 .test
= alg_test_skcipher
,
5043 .cipher
= __VECS(seed_tv_template
)
5046 .alg
= "ecb(serpent)",
5047 .test
= alg_test_skcipher
,
5049 .cipher
= __VECS(serpent_tv_template
)
5053 .test
= alg_test_skcipher
,
5055 .cipher
= __VECS(sm4_tv_template
)
5059 .test
= alg_test_skcipher
,
5061 .cipher
= __VECS(tea_tv_template
)
5064 .alg
= "ecb(twofish)",
5065 .test
= alg_test_skcipher
,
5067 .cipher
= __VECS(tf_tv_template
)
5071 .test
= alg_test_skcipher
,
5073 .cipher
= __VECS(xeta_tv_template
)
5077 .test
= alg_test_skcipher
,
5079 .cipher
= __VECS(xtea_tv_template
)
5082 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
5083 .alg
= "ecb-paes-s390",
5085 .test
= alg_test_skcipher
,
5087 .cipher
= __VECS(aes_tv_template
)
5091 .alg
= "ecdh-nist-p192",
5092 .test
= alg_test_kpp
,
5094 .kpp
= __VECS(ecdh_p192_tv_template
)
5097 .alg
= "ecdh-nist-p256",
5098 .test
= alg_test_kpp
,
5101 .kpp
= __VECS(ecdh_p256_tv_template
)
5104 .alg
= "ecdh-nist-p384",
5105 .test
= alg_test_kpp
,
5108 .kpp
= __VECS(ecdh_p384_tv_template
)
5111 .alg
= "ecdsa-nist-p192",
5112 .test
= alg_test_akcipher
,
5114 .akcipher
= __VECS(ecdsa_nist_p192_tv_template
)
5117 .alg
= "ecdsa-nist-p256",
5118 .test
= alg_test_akcipher
,
5121 .akcipher
= __VECS(ecdsa_nist_p256_tv_template
)
5124 .alg
= "ecdsa-nist-p384",
5125 .test
= alg_test_akcipher
,
5128 .akcipher
= __VECS(ecdsa_nist_p384_tv_template
)
5132 .test
= alg_test_akcipher
,
5134 .akcipher
= __VECS(ecrdsa_tv_template
)
5137 .alg
= "essiv(authenc(hmac(sha256),cbc(aes)),sha256)",
5138 .test
= alg_test_aead
,
5141 .aead
= __VECS(essiv_hmac_sha256_aes_cbc_tv_temp
)
5144 .alg
= "essiv(cbc(aes),sha256)",
5145 .test
= alg_test_skcipher
,
5148 .cipher
= __VECS(essiv_aes_cbc_tv_template
)
5151 #if IS_ENABLED(CONFIG_CRYPTO_DH_RFC7919_GROUPS)
5152 .alg
= "ffdhe2048(dh)",
5153 .test
= alg_test_kpp
,
5156 .kpp
= __VECS(ffdhe2048_dh_tv_template
)
5159 .alg
= "ffdhe3072(dh)",
5160 .test
= alg_test_kpp
,
5163 .kpp
= __VECS(ffdhe3072_dh_tv_template
)
5166 .alg
= "ffdhe4096(dh)",
5167 .test
= alg_test_kpp
,
5170 .kpp
= __VECS(ffdhe4096_dh_tv_template
)
5173 .alg
= "ffdhe6144(dh)",
5174 .test
= alg_test_kpp
,
5177 .kpp
= __VECS(ffdhe6144_dh_tv_template
)
5180 .alg
= "ffdhe8192(dh)",
5181 .test
= alg_test_kpp
,
5184 .kpp
= __VECS(ffdhe8192_dh_tv_template
)
5187 #endif /* CONFIG_CRYPTO_DH_RFC7919_GROUPS */
5189 .generic_driver
= "gcm_base(ctr(aes-generic),ghash-generic)",
5190 .test
= alg_test_aead
,
5193 .aead
= __VECS(aes_gcm_tv_template
)
5197 .generic_driver
= "gcm_base(ctr(aria-generic),ghash-generic)",
5198 .test
= alg_test_aead
,
5200 .aead
= __VECS(aria_gcm_tv_template
)
5204 .generic_driver
= "gcm_base(ctr(sm4-generic),ghash-generic)",
5205 .test
= alg_test_aead
,
5207 .aead
= __VECS(sm4_gcm_tv_template
)
5211 .test
= alg_test_hash
,
5213 .hash
= __VECS(ghash_tv_template
)
5216 .alg
= "hctr2(aes)",
5218 "hctr2_base(xctr(aes-generic),polyval-generic)",
5219 .test
= alg_test_skcipher
,
5221 .cipher
= __VECS(aes_hctr2_tv_template
)
5225 .test
= alg_test_hash
,
5227 .hash
= __VECS(hmac_md5_tv_template
)
5230 .alg
= "hmac(rmd160)",
5231 .test
= alg_test_hash
,
5233 .hash
= __VECS(hmac_rmd160_tv_template
)
5236 .alg
= "hmac(sha1)",
5237 .test
= alg_test_hash
,
5240 .hash
= __VECS(hmac_sha1_tv_template
)
5243 .alg
= "hmac(sha224)",
5244 .test
= alg_test_hash
,
5247 .hash
= __VECS(hmac_sha224_tv_template
)
5250 .alg
= "hmac(sha256)",
5251 .test
= alg_test_hash
,
5254 .hash
= __VECS(hmac_sha256_tv_template
)
5257 .alg
= "hmac(sha3-224)",
5258 .test
= alg_test_hash
,
5261 .hash
= __VECS(hmac_sha3_224_tv_template
)
5264 .alg
= "hmac(sha3-256)",
5265 .test
= alg_test_hash
,
5268 .hash
= __VECS(hmac_sha3_256_tv_template
)
5271 .alg
= "hmac(sha3-384)",
5272 .test
= alg_test_hash
,
5275 .hash
= __VECS(hmac_sha3_384_tv_template
)
5278 .alg
= "hmac(sha3-512)",
5279 .test
= alg_test_hash
,
5282 .hash
= __VECS(hmac_sha3_512_tv_template
)
5285 .alg
= "hmac(sha384)",
5286 .test
= alg_test_hash
,
5289 .hash
= __VECS(hmac_sha384_tv_template
)
5292 .alg
= "hmac(sha512)",
5293 .test
= alg_test_hash
,
5296 .hash
= __VECS(hmac_sha512_tv_template
)
5300 .test
= alg_test_hash
,
5302 .hash
= __VECS(hmac_sm3_tv_template
)
5305 .alg
= "hmac(streebog256)",
5306 .test
= alg_test_hash
,
5308 .hash
= __VECS(hmac_streebog256_tv_template
)
5311 .alg
= "hmac(streebog512)",
5312 .test
= alg_test_hash
,
5314 .hash
= __VECS(hmac_streebog512_tv_template
)
5317 .alg
= "jitterentropy_rng",
5319 .test
= alg_test_null
,
5322 .test
= alg_test_skcipher
,
5325 .cipher
= __VECS(aes_kw_tv_template
)
5329 .generic_driver
= "lrw(ecb(aes-generic))",
5330 .test
= alg_test_skcipher
,
5332 .cipher
= __VECS(aes_lrw_tv_template
)
5335 .alg
= "lrw(camellia)",
5336 .generic_driver
= "lrw(ecb(camellia-generic))",
5337 .test
= alg_test_skcipher
,
5339 .cipher
= __VECS(camellia_lrw_tv_template
)
5342 .alg
= "lrw(cast6)",
5343 .generic_driver
= "lrw(ecb(cast6-generic))",
5344 .test
= alg_test_skcipher
,
5346 .cipher
= __VECS(cast6_lrw_tv_template
)
5349 .alg
= "lrw(serpent)",
5350 .generic_driver
= "lrw(ecb(serpent-generic))",
5351 .test
= alg_test_skcipher
,
5353 .cipher
= __VECS(serpent_lrw_tv_template
)
5356 .alg
= "lrw(twofish)",
5357 .generic_driver
= "lrw(ecb(twofish-generic))",
5358 .test
= alg_test_skcipher
,
5360 .cipher
= __VECS(tf_lrw_tv_template
)
5364 .test
= alg_test_comp
,
5368 .comp
= __VECS(lz4_comp_tv_template
),
5369 .decomp
= __VECS(lz4_decomp_tv_template
)
5374 .test
= alg_test_comp
,
5378 .comp
= __VECS(lz4hc_comp_tv_template
),
5379 .decomp
= __VECS(lz4hc_decomp_tv_template
)
5384 .test
= alg_test_comp
,
5388 .comp
= __VECS(lzo_comp_tv_template
),
5389 .decomp
= __VECS(lzo_decomp_tv_template
)
5394 .test
= alg_test_comp
,
5398 .comp
= __VECS(lzorle_comp_tv_template
),
5399 .decomp
= __VECS(lzorle_decomp_tv_template
)
5404 .test
= alg_test_hash
,
5406 .hash
= __VECS(md4_tv_template
)
5410 .test
= alg_test_hash
,
5412 .hash
= __VECS(md5_tv_template
)
5415 .alg
= "michael_mic",
5416 .test
= alg_test_hash
,
5418 .hash
= __VECS(michael_mic_tv_template
)
5421 .alg
= "nhpoly1305",
5422 .test
= alg_test_hash
,
5424 .hash
= __VECS(nhpoly1305_tv_template
)
5428 .test
= alg_test_skcipher
,
5431 .cipher
= __VECS(aes_ofb_tv_template
)
5434 /* Same as ofb(aes) except the key is stored in
5435 * hardware secure memory which we reference by index
5438 .test
= alg_test_null
,
5442 .test
= alg_test_skcipher
,
5444 .cipher
= __VECS(sm4_ofb_tv_template
)
5447 .alg
= "pcbc(fcrypt)",
5448 .test
= alg_test_skcipher
,
5450 .cipher
= __VECS(fcrypt_pcbc_tv_template
)
5453 .alg
= "pkcs1pad(rsa,sha224)",
5454 .test
= alg_test_null
,
5457 .alg
= "pkcs1pad(rsa,sha256)",
5458 .test
= alg_test_akcipher
,
5461 .akcipher
= __VECS(pkcs1pad_rsa_tv_template
)
5464 .alg
= "pkcs1pad(rsa,sha384)",
5465 .test
= alg_test_null
,
5468 .alg
= "pkcs1pad(rsa,sha512)",
5469 .test
= alg_test_null
,
5473 .test
= alg_test_hash
,
5475 .hash
= __VECS(poly1305_tv_template
)
5479 .test
= alg_test_hash
,
5481 .hash
= __VECS(polyval_tv_template
)
5484 .alg
= "rfc3686(ctr(aes))",
5485 .test
= alg_test_skcipher
,
5488 .cipher
= __VECS(aes_ctr_rfc3686_tv_template
)
5491 .alg
= "rfc3686(ctr(sm4))",
5492 .test
= alg_test_skcipher
,
5494 .cipher
= __VECS(sm4_ctr_rfc3686_tv_template
)
5497 .alg
= "rfc4106(gcm(aes))",
5498 .generic_driver
= "rfc4106(gcm_base(ctr(aes-generic),ghash-generic))",
5499 .test
= alg_test_aead
,
5503 ____VECS(aes_gcm_rfc4106_tv_template
),
5504 .einval_allowed
= 1,
5509 .alg
= "rfc4309(ccm(aes))",
5510 .generic_driver
= "rfc4309(ccm_base(ctr(aes-generic),cbcmac(aes-generic)))",
5511 .test
= alg_test_aead
,
5515 ____VECS(aes_ccm_rfc4309_tv_template
),
5516 .einval_allowed
= 1,
5521 .alg
= "rfc4543(gcm(aes))",
5522 .generic_driver
= "rfc4543(gcm_base(ctr(aes-generic),ghash-generic))",
5523 .test
= alg_test_aead
,
5526 ____VECS(aes_gcm_rfc4543_tv_template
),
5527 .einval_allowed
= 1,
5532 .alg
= "rfc7539(chacha20,poly1305)",
5533 .test
= alg_test_aead
,
5535 .aead
= __VECS(rfc7539_tv_template
)
5538 .alg
= "rfc7539esp(chacha20,poly1305)",
5539 .test
= alg_test_aead
,
5542 ____VECS(rfc7539esp_tv_template
),
5543 .einval_allowed
= 1,
5549 .test
= alg_test_hash
,
5551 .hash
= __VECS(rmd160_tv_template
)
5555 .test
= alg_test_akcipher
,
5558 .akcipher
= __VECS(rsa_tv_template
)
5562 .test
= alg_test_hash
,
5565 .hash
= __VECS(sha1_tv_template
)
5569 .test
= alg_test_hash
,
5572 .hash
= __VECS(sha224_tv_template
)
5576 .test
= alg_test_hash
,
5579 .hash
= __VECS(sha256_tv_template
)
5583 .test
= alg_test_hash
,
5586 .hash
= __VECS(sha3_224_tv_template
)
5590 .test
= alg_test_hash
,
5593 .hash
= __VECS(sha3_256_tv_template
)
5597 .test
= alg_test_hash
,
5600 .hash
= __VECS(sha3_384_tv_template
)
5604 .test
= alg_test_hash
,
5607 .hash
= __VECS(sha3_512_tv_template
)
5611 .test
= alg_test_hash
,
5614 .hash
= __VECS(sha384_tv_template
)
5618 .test
= alg_test_hash
,
5621 .hash
= __VECS(sha512_tv_template
)
5625 .test
= alg_test_akcipher
,
5627 .akcipher
= __VECS(sm2_tv_template
)
5631 .test
= alg_test_hash
,
5633 .hash
= __VECS(sm3_tv_template
)
5636 .alg
= "streebog256",
5637 .test
= alg_test_hash
,
5639 .hash
= __VECS(streebog256_tv_template
)
5642 .alg
= "streebog512",
5643 .test
= alg_test_hash
,
5645 .hash
= __VECS(streebog512_tv_template
)
5648 .alg
= "vmac64(aes)",
5649 .test
= alg_test_hash
,
5651 .hash
= __VECS(vmac64_aes_tv_template
)
5655 .test
= alg_test_hash
,
5657 .hash
= __VECS(wp256_tv_template
)
5661 .test
= alg_test_hash
,
5663 .hash
= __VECS(wp384_tv_template
)
5667 .test
= alg_test_hash
,
5669 .hash
= __VECS(wp512_tv_template
)
5673 .test
= alg_test_hash
,
5675 .hash
= __VECS(aes_xcbc128_tv_template
)
5679 .test
= alg_test_hash
,
5681 .hash
= __VECS(sm4_xcbc128_tv_template
)
5685 .test
= alg_test_skcipher
,
5687 .cipher
= __VECS(xchacha12_tv_template
)
5691 .test
= alg_test_skcipher
,
5693 .cipher
= __VECS(xchacha20_tv_template
)
5697 .test
= alg_test_skcipher
,
5699 .cipher
= __VECS(aes_xctr_tv_template
)
5703 .generic_driver
= "xts(ecb(aes-generic))",
5704 .test
= alg_test_skcipher
,
5707 .cipher
= __VECS(aes_xts_tv_template
)
5710 .alg
= "xts(camellia)",
5711 .generic_driver
= "xts(ecb(camellia-generic))",
5712 .test
= alg_test_skcipher
,
5714 .cipher
= __VECS(camellia_xts_tv_template
)
5717 .alg
= "xts(cast6)",
5718 .generic_driver
= "xts(ecb(cast6-generic))",
5719 .test
= alg_test_skcipher
,
5721 .cipher
= __VECS(cast6_xts_tv_template
)
5724 /* Same as xts(aes) except the key is stored in
5725 * hardware secure memory which we reference by index
5728 .test
= alg_test_null
,
5731 .alg
= "xts(serpent)",
5732 .generic_driver
= "xts(ecb(serpent-generic))",
5733 .test
= alg_test_skcipher
,
5735 .cipher
= __VECS(serpent_xts_tv_template
)
5739 .generic_driver
= "xts(ecb(sm4-generic))",
5740 .test
= alg_test_skcipher
,
5742 .cipher
= __VECS(sm4_xts_tv_template
)
5745 .alg
= "xts(twofish)",
5746 .generic_driver
= "xts(ecb(twofish-generic))",
5747 .test
= alg_test_skcipher
,
5749 .cipher
= __VECS(tf_xts_tv_template
)
5752 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
5753 .alg
= "xts-paes-s390",
5755 .test
= alg_test_skcipher
,
5757 .cipher
= __VECS(aes_xts_tv_template
)
5761 .alg
= "xts4096(paes)",
5762 .test
= alg_test_null
,
5765 .alg
= "xts512(paes)",
5766 .test
= alg_test_null
,
5770 .test
= alg_test_hash
,
5773 .hash
= __VECS(xxhash64_tv_template
)
5776 .alg
= "zlib-deflate",
5777 .test
= alg_test_comp
,
5781 .comp
= __VECS(zlib_deflate_comp_tv_template
),
5782 .decomp
= __VECS(zlib_deflate_decomp_tv_template
)
5787 .test
= alg_test_comp
,
5791 .comp
= __VECS(zstd_comp_tv_template
),
5792 .decomp
= __VECS(zstd_decomp_tv_template
)
5798 static void alg_check_test_descs_order(void)
5802 for (i
= 1; i
< ARRAY_SIZE(alg_test_descs
); i
++) {
5803 int diff
= strcmp(alg_test_descs
[i
- 1].alg
,
5804 alg_test_descs
[i
].alg
);
5806 if (WARN_ON(diff
> 0)) {
5807 pr_warn("testmgr: alg_test_descs entries in wrong order: '%s' before '%s'\n",
5808 alg_test_descs
[i
- 1].alg
,
5809 alg_test_descs
[i
].alg
);
5812 if (WARN_ON(diff
== 0)) {
5813 pr_warn("testmgr: duplicate alg_test_descs entry: '%s'\n",
5814 alg_test_descs
[i
].alg
);
5819 static void alg_check_testvec_configs(void)
5823 for (i
= 0; i
< ARRAY_SIZE(default_cipher_testvec_configs
); i
++)
5824 WARN_ON(!valid_testvec_config(
5825 &default_cipher_testvec_configs
[i
]));
5827 for (i
= 0; i
< ARRAY_SIZE(default_hash_testvec_configs
); i
++)
5828 WARN_ON(!valid_testvec_config(
5829 &default_hash_testvec_configs
[i
]));
5832 static void testmgr_onetime_init(void)
5834 alg_check_test_descs_order();
5835 alg_check_testvec_configs();
5837 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
5838 pr_warn("alg: extra crypto tests enabled. This is intended for developer use only.\n");
5842 static int alg_find_test(const char *alg
)
5845 int end
= ARRAY_SIZE(alg_test_descs
);
5847 while (start
< end
) {
5848 int i
= (start
+ end
) / 2;
5849 int diff
= strcmp(alg_test_descs
[i
].alg
, alg
);
5867 static int alg_fips_disabled(const char *driver
, const char *alg
)
5869 pr_info("alg: %s (%s) is disabled due to FIPS\n", alg
, driver
);
5874 int alg_test(const char *driver
, const char *alg
, u32 type
, u32 mask
)
5880 if (!fips_enabled
&& notests
) {
5881 printk_once(KERN_INFO
"alg: self-tests disabled\n");
5885 DO_ONCE(testmgr_onetime_init
);
5887 if ((type
& CRYPTO_ALG_TYPE_MASK
) == CRYPTO_ALG_TYPE_CIPHER
) {
5888 char nalg
[CRYPTO_MAX_ALG_NAME
];
5890 if (snprintf(nalg
, sizeof(nalg
), "ecb(%s)", alg
) >=
5892 return -ENAMETOOLONG
;
5894 i
= alg_find_test(nalg
);
5898 if (fips_enabled
&& !alg_test_descs
[i
].fips_allowed
)
5901 rc
= alg_test_cipher(alg_test_descs
+ i
, driver
, type
, mask
);
5905 i
= alg_find_test(alg
);
5906 j
= alg_find_test(driver
);
5911 if (j
>= 0 && !alg_test_descs
[j
].fips_allowed
)
5914 if (i
>= 0 && !alg_test_descs
[i
].fips_allowed
)
5920 rc
|= alg_test_descs
[i
].test(alg_test_descs
+ i
, driver
,
5922 if (j
>= 0 && j
!= i
)
5923 rc
|= alg_test_descs
[j
].test(alg_test_descs
+ j
, driver
,
5928 if (fips_enabled
|| panic_on_fail
) {
5930 panic("alg: self-tests for %s (%s) failed in %s mode!\n",
5932 fips_enabled
? "fips" : "panic_on_fail");
5934 pr_warn("alg: self-tests for %s using %s failed (rc=%d)",
5937 "alg: self-tests for %s using %s failed (rc=%d)",
5941 pr_info("alg: self-tests for %s (%s) passed\n",
5948 printk(KERN_INFO
"alg: No test for %s (%s)\n", alg
, driver
);
5950 if (type
& CRYPTO_ALG_FIPS_INTERNAL
)
5951 return alg_fips_disabled(driver
, alg
);
5955 return alg_fips_disabled(driver
, alg
);
5958 #endif /* CONFIG_CRYPTO_MANAGER_DISABLE_TESTS */
5960 EXPORT_SYMBOL_GPL(alg_test
);