1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * Algorithm testing framework and tests.
5 * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
6 * Copyright (c) 2002 Jean-Francois Dive <jef@linuxbe.org>
7 * Copyright (c) 2007 Nokia Siemens Networks
8 * Copyright (c) 2008 Herbert Xu <herbert@gondor.apana.org.au>
9 * Copyright (c) 2019 Google LLC
11 * Updated RFC4106 AES-GCM testing.
12 * Authors: Aidan O'Mahony (aidan.o.mahony@intel.com)
13 * Adrian Hoban <adrian.hoban@intel.com>
14 * Gabriele Paoloni <gabriele.paoloni@intel.com>
15 * Tadeusz Struk (tadeusz.struk@intel.com)
16 * Copyright (c) 2010, Intel Corporation.
19 #include <crypto/aead.h>
20 #include <crypto/hash.h>
21 #include <crypto/skcipher.h>
22 #include <linux/err.h>
23 #include <linux/fips.h>
24 #include <linux/module.h>
25 #include <linux/once.h>
26 #include <linux/random.h>
27 #include <linux/scatterlist.h>
28 #include <linux/slab.h>
29 #include <linux/string.h>
30 #include <linux/uio.h>
31 #include <crypto/rng.h>
32 #include <crypto/drbg.h>
33 #include <crypto/akcipher.h>
34 #include <crypto/kpp.h>
35 #include <crypto/acompress.h>
36 #include <crypto/internal/cipher.h>
37 #include <crypto/internal/simd.h>
41 MODULE_IMPORT_NS(CRYPTO_INTERNAL
);
44 module_param(notests
, bool, 0644);
45 MODULE_PARM_DESC(notests
, "disable crypto self-tests");
47 static bool panic_on_fail
;
48 module_param(panic_on_fail
, bool, 0444);
50 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
51 static bool noextratests
;
52 module_param(noextratests
, bool, 0644);
53 MODULE_PARM_DESC(noextratests
, "disable expensive crypto self-tests");
55 static unsigned int fuzz_iterations
= 100;
56 module_param(fuzz_iterations
, uint
, 0644);
57 MODULE_PARM_DESC(fuzz_iterations
, "number of fuzz test iterations");
60 #ifdef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS
63 int alg_test(const char *driver
, const char *alg
, u32 type
, u32 mask
)
73 * Need slab memory for testing (size in number of pages).
78 * Used by test_cipher()
83 struct aead_test_suite
{
84 const struct aead_testvec
*vecs
;
88 * Set if trying to decrypt an inauthentic ciphertext with this
89 * algorithm might result in EINVAL rather than EBADMSG, due to other
90 * validation the algorithm does on the inputs such as length checks.
92 unsigned int einval_allowed
: 1;
95 * Set if this algorithm requires that the IV be located at the end of
96 * the AAD buffer, in addition to being given in the normal way. The
97 * behavior when the two IV copies differ is implementation-defined.
99 unsigned int aad_iv
: 1;
102 struct cipher_test_suite
{
103 const struct cipher_testvec
*vecs
;
107 struct comp_test_suite
{
109 const struct comp_testvec
*vecs
;
114 struct hash_test_suite
{
115 const struct hash_testvec
*vecs
;
119 struct cprng_test_suite
{
120 const struct cprng_testvec
*vecs
;
124 struct drbg_test_suite
{
125 const struct drbg_testvec
*vecs
;
129 struct akcipher_test_suite
{
130 const struct akcipher_testvec
*vecs
;
134 struct kpp_test_suite
{
135 const struct kpp_testvec
*vecs
;
139 struct alg_test_desc
{
141 const char *generic_driver
;
142 int (*test
)(const struct alg_test_desc
*desc
, const char *driver
,
144 int fips_allowed
; /* set if alg is allowed in fips mode */
147 struct aead_test_suite aead
;
148 struct cipher_test_suite cipher
;
149 struct comp_test_suite comp
;
150 struct hash_test_suite hash
;
151 struct cprng_test_suite cprng
;
152 struct drbg_test_suite drbg
;
153 struct akcipher_test_suite akcipher
;
154 struct kpp_test_suite kpp
;
158 static void hexdump(unsigned char *buf
, unsigned int len
)
160 print_hex_dump(KERN_CONT
, "", DUMP_PREFIX_OFFSET
,
165 static int __testmgr_alloc_buf(char *buf
[XBUFSIZE
], int order
)
169 for (i
= 0; i
< XBUFSIZE
; i
++) {
170 buf
[i
] = (char *)__get_free_pages(GFP_KERNEL
, order
);
179 free_pages((unsigned long)buf
[i
], order
);
184 static int testmgr_alloc_buf(char *buf
[XBUFSIZE
])
186 return __testmgr_alloc_buf(buf
, 0);
189 static void __testmgr_free_buf(char *buf
[XBUFSIZE
], int order
)
193 for (i
= 0; i
< XBUFSIZE
; i
++)
194 free_pages((unsigned long)buf
[i
], order
);
197 static void testmgr_free_buf(char *buf
[XBUFSIZE
])
199 __testmgr_free_buf(buf
, 0);
202 #define TESTMGR_POISON_BYTE 0xfe
203 #define TESTMGR_POISON_LEN 16
205 static inline void testmgr_poison(void *addr
, size_t len
)
207 memset(addr
, TESTMGR_POISON_BYTE
, len
);
210 /* Is the memory region still fully poisoned? */
211 static inline bool testmgr_is_poison(const void *addr
, size_t len
)
213 return memchr_inv(addr
, TESTMGR_POISON_BYTE
, len
) == NULL
;
216 /* flush type for hash algorithms */
218 /* merge with update of previous buffer(s) */
221 /* update with previous buffer(s) before doing this one */
224 /* likewise, but also export and re-import the intermediate state */
228 /* finalization function for hash algorithms */
229 enum finalization_type
{
230 FINALIZATION_TYPE_FINAL
, /* use final() */
231 FINALIZATION_TYPE_FINUP
, /* use finup() */
232 FINALIZATION_TYPE_DIGEST
, /* use digest() */
236 * Whether the crypto operation will occur in-place, and if so whether the
237 * source and destination scatterlist pointers will coincide (req->src ==
238 * req->dst), or whether they'll merely point to two separate scatterlists
239 * (req->src != req->dst) that reference the same underlying memory.
241 * This is only relevant for algorithm types that support in-place operation.
249 #define TEST_SG_TOTAL 10000
252 * struct test_sg_division - description of a scatterlist entry
254 * This struct describes one entry of a scatterlist being constructed to check a
255 * crypto test vector.
257 * @proportion_of_total: length of this chunk relative to the total length,
258 * given as a proportion out of TEST_SG_TOTAL so that it
259 * scales to fit any test vector
260 * @offset: byte offset into a 2-page buffer at which this chunk will start
261 * @offset_relative_to_alignmask: if true, add the algorithm's alignmask to the
263 * @flush_type: for hashes, whether an update() should be done now vs.
264 * continuing to accumulate data
265 * @nosimd: if doing the pending update(), do it with SIMD disabled?
267 struct test_sg_division
{
268 unsigned int proportion_of_total
;
270 bool offset_relative_to_alignmask
;
271 enum flush_type flush_type
;
276 * struct testvec_config - configuration for testing a crypto test vector
278 * This struct describes the data layout and other parameters with which each
279 * crypto test vector can be tested.
281 * @name: name of this config, logged for debugging purposes if a test fails
282 * @inplace_mode: whether and how to operate on the data in-place, if applicable
283 * @req_flags: extra request_flags, e.g. CRYPTO_TFM_REQ_MAY_SLEEP
284 * @src_divs: description of how to arrange the source scatterlist
285 * @dst_divs: description of how to arrange the dst scatterlist, if applicable
286 * for the algorithm type. Defaults to @src_divs if unset.
287 * @iv_offset: misalignment of the IV in the range [0..MAX_ALGAPI_ALIGNMASK+1],
288 * where 0 is aligned to a 2*(MAX_ALGAPI_ALIGNMASK+1) byte boundary
289 * @iv_offset_relative_to_alignmask: if true, add the algorithm's alignmask to
291 * @key_offset: misalignment of the key, where 0 is default alignment
292 * @key_offset_relative_to_alignmask: if true, add the algorithm's alignmask to
294 * @finalization_type: what finalization function to use for hashes
295 * @nosimd: execute with SIMD disabled? Requires !CRYPTO_TFM_REQ_MAY_SLEEP.
297 struct testvec_config
{
299 enum inplace_mode inplace_mode
;
301 struct test_sg_division src_divs
[XBUFSIZE
];
302 struct test_sg_division dst_divs
[XBUFSIZE
];
303 unsigned int iv_offset
;
304 unsigned int key_offset
;
305 bool iv_offset_relative_to_alignmask
;
306 bool key_offset_relative_to_alignmask
;
307 enum finalization_type finalization_type
;
311 #define TESTVEC_CONFIG_NAMELEN 192
314 * The following are the lists of testvec_configs to test for each algorithm
315 * type when the basic crypto self-tests are enabled, i.e. when
316 * CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is unset. They aim to provide good test
317 * coverage, while keeping the test time much shorter than the full fuzz tests
318 * so that the basic tests can be enabled in a wider range of circumstances.
321 /* Configs for skciphers and aeads */
322 static const struct testvec_config default_cipher_testvec_configs
[] = {
324 .name
= "in-place (one sglist)",
325 .inplace_mode
= INPLACE_ONE_SGLIST
,
326 .src_divs
= { { .proportion_of_total
= 10000 } },
328 .name
= "in-place (two sglists)",
329 .inplace_mode
= INPLACE_TWO_SGLISTS
,
330 .src_divs
= { { .proportion_of_total
= 10000 } },
332 .name
= "out-of-place",
333 .inplace_mode
= OUT_OF_PLACE
,
334 .src_divs
= { { .proportion_of_total
= 10000 } },
336 .name
= "unaligned buffer, offset=1",
337 .src_divs
= { { .proportion_of_total
= 10000, .offset
= 1 } },
341 .name
= "buffer aligned only to alignmask",
344 .proportion_of_total
= 10000,
346 .offset_relative_to_alignmask
= true,
350 .iv_offset_relative_to_alignmask
= true,
352 .key_offset_relative_to_alignmask
= true,
354 .name
= "two even aligned splits",
356 { .proportion_of_total
= 5000 },
357 { .proportion_of_total
= 5000 },
360 .name
= "uneven misaligned splits, may sleep",
361 .req_flags
= CRYPTO_TFM_REQ_MAY_SLEEP
,
363 { .proportion_of_total
= 1900, .offset
= 33 },
364 { .proportion_of_total
= 3300, .offset
= 7 },
365 { .proportion_of_total
= 4800, .offset
= 18 },
370 .name
= "misaligned splits crossing pages, inplace",
371 .inplace_mode
= INPLACE_ONE_SGLIST
,
374 .proportion_of_total
= 7500,
375 .offset
= PAGE_SIZE
- 32
377 .proportion_of_total
= 2500,
378 .offset
= PAGE_SIZE
- 7
384 static const struct testvec_config default_hash_testvec_configs
[] = {
386 .name
= "init+update+final aligned buffer",
387 .src_divs
= { { .proportion_of_total
= 10000 } },
388 .finalization_type
= FINALIZATION_TYPE_FINAL
,
390 .name
= "init+finup aligned buffer",
391 .src_divs
= { { .proportion_of_total
= 10000 } },
392 .finalization_type
= FINALIZATION_TYPE_FINUP
,
394 .name
= "digest aligned buffer",
395 .src_divs
= { { .proportion_of_total
= 10000 } },
396 .finalization_type
= FINALIZATION_TYPE_DIGEST
,
398 .name
= "init+update+final misaligned buffer",
399 .src_divs
= { { .proportion_of_total
= 10000, .offset
= 1 } },
400 .finalization_type
= FINALIZATION_TYPE_FINAL
,
403 .name
= "digest buffer aligned only to alignmask",
406 .proportion_of_total
= 10000,
408 .offset_relative_to_alignmask
= true,
411 .finalization_type
= FINALIZATION_TYPE_DIGEST
,
413 .key_offset_relative_to_alignmask
= true,
415 .name
= "init+update+update+final two even splits",
417 { .proportion_of_total
= 5000 },
419 .proportion_of_total
= 5000,
420 .flush_type
= FLUSH_TYPE_FLUSH
,
423 .finalization_type
= FINALIZATION_TYPE_FINAL
,
425 .name
= "digest uneven misaligned splits, may sleep",
426 .req_flags
= CRYPTO_TFM_REQ_MAY_SLEEP
,
428 { .proportion_of_total
= 1900, .offset
= 33 },
429 { .proportion_of_total
= 3300, .offset
= 7 },
430 { .proportion_of_total
= 4800, .offset
= 18 },
432 .finalization_type
= FINALIZATION_TYPE_DIGEST
,
434 .name
= "digest misaligned splits crossing pages",
437 .proportion_of_total
= 7500,
438 .offset
= PAGE_SIZE
- 32,
440 .proportion_of_total
= 2500,
441 .offset
= PAGE_SIZE
- 7,
444 .finalization_type
= FINALIZATION_TYPE_DIGEST
,
446 .name
= "import/export",
449 .proportion_of_total
= 6500,
450 .flush_type
= FLUSH_TYPE_REIMPORT
,
452 .proportion_of_total
= 3500,
453 .flush_type
= FLUSH_TYPE_REIMPORT
,
456 .finalization_type
= FINALIZATION_TYPE_FINAL
,
460 static unsigned int count_test_sg_divisions(const struct test_sg_division
*divs
)
462 unsigned int remaining
= TEST_SG_TOTAL
;
463 unsigned int ndivs
= 0;
466 remaining
-= divs
[ndivs
++].proportion_of_total
;
472 #define SGDIVS_HAVE_FLUSHES BIT(0)
473 #define SGDIVS_HAVE_NOSIMD BIT(1)
475 static bool valid_sg_divisions(const struct test_sg_division
*divs
,
476 unsigned int count
, int *flags_ret
)
478 unsigned int total
= 0;
481 for (i
= 0; i
< count
&& total
!= TEST_SG_TOTAL
; i
++) {
482 if (divs
[i
].proportion_of_total
<= 0 ||
483 divs
[i
].proportion_of_total
> TEST_SG_TOTAL
- total
)
485 total
+= divs
[i
].proportion_of_total
;
486 if (divs
[i
].flush_type
!= FLUSH_TYPE_NONE
)
487 *flags_ret
|= SGDIVS_HAVE_FLUSHES
;
489 *flags_ret
|= SGDIVS_HAVE_NOSIMD
;
491 return total
== TEST_SG_TOTAL
&&
492 memchr_inv(&divs
[i
], 0, (count
- i
) * sizeof(divs
[0])) == NULL
;
496 * Check whether the given testvec_config is valid. This isn't strictly needed
497 * since every testvec_config should be valid, but check anyway so that people
498 * don't unknowingly add broken configs that don't do what they wanted.
500 static bool valid_testvec_config(const struct testvec_config
*cfg
)
504 if (cfg
->name
== NULL
)
507 if (!valid_sg_divisions(cfg
->src_divs
, ARRAY_SIZE(cfg
->src_divs
),
511 if (cfg
->dst_divs
[0].proportion_of_total
) {
512 if (!valid_sg_divisions(cfg
->dst_divs
,
513 ARRAY_SIZE(cfg
->dst_divs
), &flags
))
516 if (memchr_inv(cfg
->dst_divs
, 0, sizeof(cfg
->dst_divs
)))
518 /* defaults to dst_divs=src_divs */
522 (cfg
->iv_offset_relative_to_alignmask
? MAX_ALGAPI_ALIGNMASK
: 0) >
523 MAX_ALGAPI_ALIGNMASK
+ 1)
526 if ((flags
& (SGDIVS_HAVE_FLUSHES
| SGDIVS_HAVE_NOSIMD
)) &&
527 cfg
->finalization_type
== FINALIZATION_TYPE_DIGEST
)
530 if ((cfg
->nosimd
|| (flags
& SGDIVS_HAVE_NOSIMD
)) &&
531 (cfg
->req_flags
& CRYPTO_TFM_REQ_MAY_SLEEP
))
538 char *bufs
[XBUFSIZE
];
539 struct scatterlist sgl
[XBUFSIZE
];
540 struct scatterlist sgl_saved
[XBUFSIZE
];
541 struct scatterlist
*sgl_ptr
;
545 static int init_test_sglist(struct test_sglist
*tsgl
)
547 return __testmgr_alloc_buf(tsgl
->bufs
, 1 /* two pages per buffer */);
550 static void destroy_test_sglist(struct test_sglist
*tsgl
)
552 return __testmgr_free_buf(tsgl
->bufs
, 1 /* two pages per buffer */);
556 * build_test_sglist() - build a scatterlist for a crypto test
558 * @tsgl: the scatterlist to build. @tsgl->bufs[] contains an array of 2-page
559 * buffers which the scatterlist @tsgl->sgl[] will be made to point into.
560 * @divs: the layout specification on which the scatterlist will be based
561 * @alignmask: the algorithm's alignmask
562 * @total_len: the total length of the scatterlist to build in bytes
563 * @data: if non-NULL, the buffers will be filled with this data until it ends.
564 * Otherwise the buffers will be poisoned. In both cases, some bytes
565 * past the end of each buffer will be poisoned to help detect overruns.
566 * @out_divs: if non-NULL, the test_sg_division to which each scatterlist entry
567 * corresponds will be returned here. This will match @divs except
568 * that divisions resolving to a length of 0 are omitted as they are
569 * not included in the scatterlist.
571 * Return: 0 or a -errno value
573 static int build_test_sglist(struct test_sglist
*tsgl
,
574 const struct test_sg_division
*divs
,
575 const unsigned int alignmask
,
576 const unsigned int total_len
,
577 struct iov_iter
*data
,
578 const struct test_sg_division
*out_divs
[XBUFSIZE
])
581 const struct test_sg_division
*div
;
583 } partitions
[XBUFSIZE
];
584 const unsigned int ndivs
= count_test_sg_divisions(divs
);
585 unsigned int len_remaining
= total_len
;
588 BUILD_BUG_ON(ARRAY_SIZE(partitions
) != ARRAY_SIZE(tsgl
->sgl
));
589 if (WARN_ON(ndivs
> ARRAY_SIZE(partitions
)))
592 /* Calculate the (div, length) pairs */
594 for (i
= 0; i
< ndivs
; i
++) {
595 unsigned int len_this_sg
=
597 (total_len
* divs
[i
].proportion_of_total
+
598 TEST_SG_TOTAL
/ 2) / TEST_SG_TOTAL
);
600 if (len_this_sg
!= 0) {
601 partitions
[tsgl
->nents
].div
= &divs
[i
];
602 partitions
[tsgl
->nents
].length
= len_this_sg
;
604 len_remaining
-= len_this_sg
;
607 if (tsgl
->nents
== 0) {
608 partitions
[tsgl
->nents
].div
= &divs
[0];
609 partitions
[tsgl
->nents
].length
= 0;
612 partitions
[tsgl
->nents
- 1].length
+= len_remaining
;
614 /* Set up the sgl entries and fill the data or poison */
615 sg_init_table(tsgl
->sgl
, tsgl
->nents
);
616 for (i
= 0; i
< tsgl
->nents
; i
++) {
617 unsigned int offset
= partitions
[i
].div
->offset
;
620 if (partitions
[i
].div
->offset_relative_to_alignmask
)
623 while (offset
+ partitions
[i
].length
+ TESTMGR_POISON_LEN
>
625 if (WARN_ON(offset
<= 0))
630 addr
= &tsgl
->bufs
[i
][offset
];
631 sg_set_buf(&tsgl
->sgl
[i
], addr
, partitions
[i
].length
);
634 out_divs
[i
] = partitions
[i
].div
;
637 size_t copy_len
, copied
;
639 copy_len
= min(partitions
[i
].length
, data
->count
);
640 copied
= copy_from_iter(addr
, copy_len
, data
);
641 if (WARN_ON(copied
!= copy_len
))
643 testmgr_poison(addr
+ copy_len
, partitions
[i
].length
+
644 TESTMGR_POISON_LEN
- copy_len
);
646 testmgr_poison(addr
, partitions
[i
].length
+
651 sg_mark_end(&tsgl
->sgl
[tsgl
->nents
- 1]);
652 tsgl
->sgl_ptr
= tsgl
->sgl
;
653 memcpy(tsgl
->sgl_saved
, tsgl
->sgl
, tsgl
->nents
* sizeof(tsgl
->sgl
[0]));
658 * Verify that a scatterlist crypto operation produced the correct output.
660 * @tsgl: scatterlist containing the actual output
661 * @expected_output: buffer containing the expected output
662 * @len_to_check: length of @expected_output in bytes
663 * @unchecked_prefix_len: number of ignored bytes in @tsgl prior to real result
664 * @check_poison: verify that the poison bytes after each chunk are intact?
666 * Return: 0 if correct, -EINVAL if incorrect, -EOVERFLOW if buffer overrun.
668 static int verify_correct_output(const struct test_sglist
*tsgl
,
669 const char *expected_output
,
670 unsigned int len_to_check
,
671 unsigned int unchecked_prefix_len
,
676 for (i
= 0; i
< tsgl
->nents
; i
++) {
677 struct scatterlist
*sg
= &tsgl
->sgl_ptr
[i
];
678 unsigned int len
= sg
->length
;
679 unsigned int offset
= sg
->offset
;
680 const char *actual_output
;
682 if (unchecked_prefix_len
) {
683 if (unchecked_prefix_len
>= len
) {
684 unchecked_prefix_len
-= len
;
687 offset
+= unchecked_prefix_len
;
688 len
-= unchecked_prefix_len
;
689 unchecked_prefix_len
= 0;
691 len
= min(len
, len_to_check
);
692 actual_output
= page_address(sg_page(sg
)) + offset
;
693 if (memcmp(expected_output
, actual_output
, len
) != 0)
696 !testmgr_is_poison(actual_output
+ len
, TESTMGR_POISON_LEN
))
699 expected_output
+= len
;
701 if (WARN_ON(len_to_check
!= 0))
706 static bool is_test_sglist_corrupted(const struct test_sglist
*tsgl
)
710 for (i
= 0; i
< tsgl
->nents
; i
++) {
711 if (tsgl
->sgl
[i
].page_link
!= tsgl
->sgl_saved
[i
].page_link
)
713 if (tsgl
->sgl
[i
].offset
!= tsgl
->sgl_saved
[i
].offset
)
715 if (tsgl
->sgl
[i
].length
!= tsgl
->sgl_saved
[i
].length
)
721 struct cipher_test_sglists
{
722 struct test_sglist src
;
723 struct test_sglist dst
;
726 static struct cipher_test_sglists
*alloc_cipher_test_sglists(void)
728 struct cipher_test_sglists
*tsgls
;
730 tsgls
= kmalloc(sizeof(*tsgls
), GFP_KERNEL
);
734 if (init_test_sglist(&tsgls
->src
) != 0)
736 if (init_test_sglist(&tsgls
->dst
) != 0)
737 goto fail_destroy_src
;
742 destroy_test_sglist(&tsgls
->src
);
748 static void free_cipher_test_sglists(struct cipher_test_sglists
*tsgls
)
751 destroy_test_sglist(&tsgls
->src
);
752 destroy_test_sglist(&tsgls
->dst
);
757 /* Build the src and dst scatterlists for an skcipher or AEAD test */
758 static int build_cipher_test_sglists(struct cipher_test_sglists
*tsgls
,
759 const struct testvec_config
*cfg
,
760 unsigned int alignmask
,
761 unsigned int src_total_len
,
762 unsigned int dst_total_len
,
763 const struct kvec
*inputs
,
764 unsigned int nr_inputs
)
766 struct iov_iter input
;
769 iov_iter_kvec(&input
, WRITE
, inputs
, nr_inputs
, src_total_len
);
770 err
= build_test_sglist(&tsgls
->src
, cfg
->src_divs
, alignmask
,
771 cfg
->inplace_mode
!= OUT_OF_PLACE
?
772 max(dst_total_len
, src_total_len
) :
779 * In-place crypto operations can use the same scatterlist for both the
780 * source and destination (req->src == req->dst), or can use separate
781 * scatterlists (req->src != req->dst) which point to the same
782 * underlying memory. Make sure to test both cases.
784 if (cfg
->inplace_mode
== INPLACE_ONE_SGLIST
) {
785 tsgls
->dst
.sgl_ptr
= tsgls
->src
.sgl
;
786 tsgls
->dst
.nents
= tsgls
->src
.nents
;
789 if (cfg
->inplace_mode
== INPLACE_TWO_SGLISTS
) {
791 * For now we keep it simple and only test the case where the
792 * two scatterlists have identical entries, rather than
793 * different entries that split up the same memory differently.
795 memcpy(tsgls
->dst
.sgl
, tsgls
->src
.sgl
,
796 tsgls
->src
.nents
* sizeof(tsgls
->src
.sgl
[0]));
797 memcpy(tsgls
->dst
.sgl_saved
, tsgls
->src
.sgl
,
798 tsgls
->src
.nents
* sizeof(tsgls
->src
.sgl
[0]));
799 tsgls
->dst
.sgl_ptr
= tsgls
->dst
.sgl
;
800 tsgls
->dst
.nents
= tsgls
->src
.nents
;
804 return build_test_sglist(&tsgls
->dst
,
805 cfg
->dst_divs
[0].proportion_of_total
?
806 cfg
->dst_divs
: cfg
->src_divs
,
807 alignmask
, dst_total_len
, NULL
, NULL
);
811 * Support for testing passing a misaligned key to setkey():
813 * If cfg->key_offset is set, copy the key into a new buffer at that offset,
814 * optionally adding alignmask. Else, just use the key directly.
816 static int prepare_keybuf(const u8
*key
, unsigned int ksize
,
817 const struct testvec_config
*cfg
,
818 unsigned int alignmask
,
819 const u8
**keybuf_ret
, const u8
**keyptr_ret
)
821 unsigned int key_offset
= cfg
->key_offset
;
822 u8
*keybuf
= NULL
, *keyptr
= (u8
*)key
;
824 if (key_offset
!= 0) {
825 if (cfg
->key_offset_relative_to_alignmask
)
826 key_offset
+= alignmask
;
827 keybuf
= kmalloc(key_offset
+ ksize
, GFP_KERNEL
);
830 keyptr
= keybuf
+ key_offset
;
831 memcpy(keyptr
, key
, ksize
);
833 *keybuf_ret
= keybuf
;
834 *keyptr_ret
= keyptr
;
838 /* Like setkey_f(tfm, key, ksize), but sometimes misalign the key */
839 #define do_setkey(setkey_f, tfm, key, ksize, cfg, alignmask) \
841 const u8 *keybuf, *keyptr; \
844 err = prepare_keybuf((key), (ksize), (cfg), (alignmask), \
847 err = setkey_f((tfm), keyptr, (ksize)); \
853 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
855 /* Generate a random length in range [0, max_len], but prefer smaller values */
856 static unsigned int generate_random_length(unsigned int max_len
)
858 unsigned int len
= prandom_u32() % (max_len
+ 1);
860 switch (prandom_u32() % 4) {
872 /* Flip a random bit in the given nonempty data buffer */
873 static void flip_random_bit(u8
*buf
, size_t size
)
877 bitpos
= prandom_u32() % (size
* 8);
878 buf
[bitpos
/ 8] ^= 1 << (bitpos
% 8);
881 /* Flip a random byte in the given nonempty data buffer */
882 static void flip_random_byte(u8
*buf
, size_t size
)
884 buf
[prandom_u32() % size
] ^= 0xff;
887 /* Sometimes make some random changes to the given nonempty data buffer */
888 static void mutate_buffer(u8
*buf
, size_t size
)
893 /* Sometimes flip some bits */
894 if (prandom_u32() % 4 == 0) {
895 num_flips
= min_t(size_t, 1 << (prandom_u32() % 8), size
* 8);
896 for (i
= 0; i
< num_flips
; i
++)
897 flip_random_bit(buf
, size
);
900 /* Sometimes flip some bytes */
901 if (prandom_u32() % 4 == 0) {
902 num_flips
= min_t(size_t, 1 << (prandom_u32() % 8), size
);
903 for (i
= 0; i
< num_flips
; i
++)
904 flip_random_byte(buf
, size
);
908 /* Randomly generate 'count' bytes, but sometimes make them "interesting" */
909 static void generate_random_bytes(u8
*buf
, size_t count
)
918 switch (prandom_u32() % 8) { /* Choose a generation strategy */
921 /* All the same byte, plus optional mutations */
922 switch (prandom_u32() % 4) {
930 b
= (u8
)prandom_u32();
933 memset(buf
, b
, count
);
934 mutate_buffer(buf
, count
);
937 /* Ascending or descending bytes, plus optional mutations */
938 increment
= (u8
)prandom_u32();
939 b
= (u8
)prandom_u32();
940 for (i
= 0; i
< count
; i
++, b
+= increment
)
942 mutate_buffer(buf
, count
);
945 /* Fully random bytes */
946 for (i
= 0; i
< count
; i
++)
947 buf
[i
] = (u8
)prandom_u32();
951 static char *generate_random_sgl_divisions(struct test_sg_division
*divs
,
952 size_t max_divs
, char *p
, char *end
,
953 bool gen_flushes
, u32 req_flags
)
955 struct test_sg_division
*div
= divs
;
956 unsigned int remaining
= TEST_SG_TOTAL
;
959 unsigned int this_len
;
960 const char *flushtype_str
;
962 if (div
== &divs
[max_divs
- 1] || prandom_u32() % 2 == 0)
963 this_len
= remaining
;
965 this_len
= 1 + (prandom_u32() % remaining
);
966 div
->proportion_of_total
= this_len
;
968 if (prandom_u32() % 4 == 0)
969 div
->offset
= (PAGE_SIZE
- 128) + (prandom_u32() % 128);
970 else if (prandom_u32() % 2 == 0)
971 div
->offset
= prandom_u32() % 32;
973 div
->offset
= prandom_u32() % PAGE_SIZE
;
974 if (prandom_u32() % 8 == 0)
975 div
->offset_relative_to_alignmask
= true;
977 div
->flush_type
= FLUSH_TYPE_NONE
;
979 switch (prandom_u32() % 4) {
981 div
->flush_type
= FLUSH_TYPE_REIMPORT
;
984 div
->flush_type
= FLUSH_TYPE_FLUSH
;
989 if (div
->flush_type
!= FLUSH_TYPE_NONE
&&
990 !(req_flags
& CRYPTO_TFM_REQ_MAY_SLEEP
) &&
991 prandom_u32() % 2 == 0)
994 switch (div
->flush_type
) {
995 case FLUSH_TYPE_FLUSH
:
997 flushtype_str
= "<flush,nosimd>";
999 flushtype_str
= "<flush>";
1001 case FLUSH_TYPE_REIMPORT
:
1003 flushtype_str
= "<reimport,nosimd>";
1005 flushtype_str
= "<reimport>";
1012 BUILD_BUG_ON(TEST_SG_TOTAL
!= 10000); /* for "%u.%u%%" */
1013 p
+= scnprintf(p
, end
- p
, "%s%u.%u%%@%s+%u%s", flushtype_str
,
1014 this_len
/ 100, this_len
% 100,
1015 div
->offset_relative_to_alignmask
?
1017 div
->offset
, this_len
== remaining
? "" : ", ");
1018 remaining
-= this_len
;
1020 } while (remaining
);
1025 /* Generate a random testvec_config for fuzz testing */
1026 static void generate_random_testvec_config(struct testvec_config
*cfg
,
1027 char *name
, size_t max_namelen
)
1030 char * const end
= name
+ max_namelen
;
1032 memset(cfg
, 0, sizeof(*cfg
));
1036 p
+= scnprintf(p
, end
- p
, "random:");
1038 switch (prandom_u32() % 4) {
1041 cfg
->inplace_mode
= OUT_OF_PLACE
;
1044 cfg
->inplace_mode
= INPLACE_ONE_SGLIST
;
1045 p
+= scnprintf(p
, end
- p
, " inplace_one_sglist");
1048 cfg
->inplace_mode
= INPLACE_TWO_SGLISTS
;
1049 p
+= scnprintf(p
, end
- p
, " inplace_two_sglists");
1053 if (prandom_u32() % 2 == 0) {
1054 cfg
->req_flags
|= CRYPTO_TFM_REQ_MAY_SLEEP
;
1055 p
+= scnprintf(p
, end
- p
, " may_sleep");
1058 switch (prandom_u32() % 4) {
1060 cfg
->finalization_type
= FINALIZATION_TYPE_FINAL
;
1061 p
+= scnprintf(p
, end
- p
, " use_final");
1064 cfg
->finalization_type
= FINALIZATION_TYPE_FINUP
;
1065 p
+= scnprintf(p
, end
- p
, " use_finup");
1068 cfg
->finalization_type
= FINALIZATION_TYPE_DIGEST
;
1069 p
+= scnprintf(p
, end
- p
, " use_digest");
1073 if (!(cfg
->req_flags
& CRYPTO_TFM_REQ_MAY_SLEEP
) &&
1074 prandom_u32() % 2 == 0) {
1076 p
+= scnprintf(p
, end
- p
, " nosimd");
1079 p
+= scnprintf(p
, end
- p
, " src_divs=[");
1080 p
= generate_random_sgl_divisions(cfg
->src_divs
,
1081 ARRAY_SIZE(cfg
->src_divs
), p
, end
,
1082 (cfg
->finalization_type
!=
1083 FINALIZATION_TYPE_DIGEST
),
1085 p
+= scnprintf(p
, end
- p
, "]");
1087 if (cfg
->inplace_mode
== OUT_OF_PLACE
&& prandom_u32() % 2 == 0) {
1088 p
+= scnprintf(p
, end
- p
, " dst_divs=[");
1089 p
= generate_random_sgl_divisions(cfg
->dst_divs
,
1090 ARRAY_SIZE(cfg
->dst_divs
),
1093 p
+= scnprintf(p
, end
- p
, "]");
1096 if (prandom_u32() % 2 == 0) {
1097 cfg
->iv_offset
= 1 + (prandom_u32() % MAX_ALGAPI_ALIGNMASK
);
1098 p
+= scnprintf(p
, end
- p
, " iv_offset=%u", cfg
->iv_offset
);
1101 if (prandom_u32() % 2 == 0) {
1102 cfg
->key_offset
= 1 + (prandom_u32() % MAX_ALGAPI_ALIGNMASK
);
1103 p
+= scnprintf(p
, end
- p
, " key_offset=%u", cfg
->key_offset
);
1106 WARN_ON_ONCE(!valid_testvec_config(cfg
));
1109 static void crypto_disable_simd_for_test(void)
1112 __this_cpu_write(crypto_simd_disabled_for_test
, true);
1115 static void crypto_reenable_simd_for_test(void)
1117 __this_cpu_write(crypto_simd_disabled_for_test
, false);
1122 * Given an algorithm name, build the name of the generic implementation of that
1123 * algorithm, assuming the usual naming convention. Specifically, this appends
1124 * "-generic" to every part of the name that is not a template name. Examples:
1126 * aes => aes-generic
1127 * cbc(aes) => cbc(aes-generic)
1128 * cts(cbc(aes)) => cts(cbc(aes-generic))
1129 * rfc7539(chacha20,poly1305) => rfc7539(chacha20-generic,poly1305-generic)
1131 * Return: 0 on success, or -ENAMETOOLONG if the generic name would be too long
1133 static int build_generic_driver_name(const char *algname
,
1134 char driver_name
[CRYPTO_MAX_ALG_NAME
])
1136 const char *in
= algname
;
1137 char *out
= driver_name
;
1138 size_t len
= strlen(algname
);
1140 if (len
>= CRYPTO_MAX_ALG_NAME
)
1143 const char *in_saved
= in
;
1145 while (*in
&& *in
!= '(' && *in
!= ')' && *in
!= ',')
1147 if (*in
!= '(' && in
> in_saved
) {
1149 if (len
>= CRYPTO_MAX_ALG_NAME
)
1151 memcpy(out
, "-generic", 8);
1154 } while ((*out
++ = *in
++) != '\0');
1158 pr_err("alg: generic driver name for \"%s\" would be too long\n",
1160 return -ENAMETOOLONG
;
1162 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1163 static void crypto_disable_simd_for_test(void)
1167 static void crypto_reenable_simd_for_test(void)
1170 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1172 static int build_hash_sglist(struct test_sglist
*tsgl
,
1173 const struct hash_testvec
*vec
,
1174 const struct testvec_config
*cfg
,
1175 unsigned int alignmask
,
1176 const struct test_sg_division
*divs
[XBUFSIZE
])
1179 struct iov_iter input
;
1181 kv
.iov_base
= (void *)vec
->plaintext
;
1182 kv
.iov_len
= vec
->psize
;
1183 iov_iter_kvec(&input
, WRITE
, &kv
, 1, vec
->psize
);
1184 return build_test_sglist(tsgl
, cfg
->src_divs
, alignmask
, vec
->psize
,
1188 static int check_hash_result(const char *type
,
1189 const u8
*result
, unsigned int digestsize
,
1190 const struct hash_testvec
*vec
,
1191 const char *vec_name
,
1193 const struct testvec_config
*cfg
)
1195 if (memcmp(result
, vec
->digest
, digestsize
) != 0) {
1196 pr_err("alg: %s: %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
1197 type
, driver
, vec_name
, cfg
->name
);
1200 if (!testmgr_is_poison(&result
[digestsize
], TESTMGR_POISON_LEN
)) {
1201 pr_err("alg: %s: %s overran result buffer on test vector %s, cfg=\"%s\"\n",
1202 type
, driver
, vec_name
, cfg
->name
);
1208 static inline int check_shash_op(const char *op
, int err
,
1209 const char *driver
, const char *vec_name
,
1210 const struct testvec_config
*cfg
)
1213 pr_err("alg: shash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n",
1214 driver
, op
, err
, vec_name
, cfg
->name
);
1218 /* Test one hash test vector in one configuration, using the shash API */
1219 static int test_shash_vec_cfg(const struct hash_testvec
*vec
,
1220 const char *vec_name
,
1221 const struct testvec_config
*cfg
,
1222 struct shash_desc
*desc
,
1223 struct test_sglist
*tsgl
,
1226 struct crypto_shash
*tfm
= desc
->tfm
;
1227 const unsigned int alignmask
= crypto_shash_alignmask(tfm
);
1228 const unsigned int digestsize
= crypto_shash_digestsize(tfm
);
1229 const unsigned int statesize
= crypto_shash_statesize(tfm
);
1230 const char *driver
= crypto_shash_driver_name(tfm
);
1231 const struct test_sg_division
*divs
[XBUFSIZE
];
1233 u8 result
[HASH_MAX_DIGESTSIZE
+ TESTMGR_POISON_LEN
];
1236 /* Set the key, if specified */
1238 err
= do_setkey(crypto_shash_setkey
, tfm
, vec
->key
, vec
->ksize
,
1241 if (err
== vec
->setkey_error
)
1243 pr_err("alg: shash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
1244 driver
, vec_name
, vec
->setkey_error
, err
,
1245 crypto_shash_get_flags(tfm
));
1248 if (vec
->setkey_error
) {
1249 pr_err("alg: shash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
1250 driver
, vec_name
, vec
->setkey_error
);
1255 /* Build the scatterlist for the source data */
1256 err
= build_hash_sglist(tsgl
, vec
, cfg
, alignmask
, divs
);
1258 pr_err("alg: shash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n",
1259 driver
, vec_name
, cfg
->name
);
1263 /* Do the actual hashing */
1265 testmgr_poison(desc
->__ctx
, crypto_shash_descsize(tfm
));
1266 testmgr_poison(result
, digestsize
+ TESTMGR_POISON_LEN
);
1268 if (cfg
->finalization_type
== FINALIZATION_TYPE_DIGEST
||
1269 vec
->digest_error
) {
1270 /* Just using digest() */
1271 if (tsgl
->nents
!= 1)
1274 crypto_disable_simd_for_test();
1275 err
= crypto_shash_digest(desc
, sg_virt(&tsgl
->sgl
[0]),
1276 tsgl
->sgl
[0].length
, result
);
1278 crypto_reenable_simd_for_test();
1280 if (err
== vec
->digest_error
)
1282 pr_err("alg: shash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
1283 driver
, vec_name
, vec
->digest_error
, err
,
1287 if (vec
->digest_error
) {
1288 pr_err("alg: shash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
1289 driver
, vec_name
, vec
->digest_error
, cfg
->name
);
1295 /* Using init(), zero or more update(), then final() or finup() */
1298 crypto_disable_simd_for_test();
1299 err
= crypto_shash_init(desc
);
1301 crypto_reenable_simd_for_test();
1302 err
= check_shash_op("init", err
, driver
, vec_name
, cfg
);
1306 for (i
= 0; i
< tsgl
->nents
; i
++) {
1307 if (i
+ 1 == tsgl
->nents
&&
1308 cfg
->finalization_type
== FINALIZATION_TYPE_FINUP
) {
1309 if (divs
[i
]->nosimd
)
1310 crypto_disable_simd_for_test();
1311 err
= crypto_shash_finup(desc
, sg_virt(&tsgl
->sgl
[i
]),
1312 tsgl
->sgl
[i
].length
, result
);
1313 if (divs
[i
]->nosimd
)
1314 crypto_reenable_simd_for_test();
1315 err
= check_shash_op("finup", err
, driver
, vec_name
,
1321 if (divs
[i
]->nosimd
)
1322 crypto_disable_simd_for_test();
1323 err
= crypto_shash_update(desc
, sg_virt(&tsgl
->sgl
[i
]),
1324 tsgl
->sgl
[i
].length
);
1325 if (divs
[i
]->nosimd
)
1326 crypto_reenable_simd_for_test();
1327 err
= check_shash_op("update", err
, driver
, vec_name
, cfg
);
1330 if (divs
[i
]->flush_type
== FLUSH_TYPE_REIMPORT
) {
1331 /* Test ->export() and ->import() */
1332 testmgr_poison(hashstate
+ statesize
,
1333 TESTMGR_POISON_LEN
);
1334 err
= crypto_shash_export(desc
, hashstate
);
1335 err
= check_shash_op("export", err
, driver
, vec_name
,
1339 if (!testmgr_is_poison(hashstate
+ statesize
,
1340 TESTMGR_POISON_LEN
)) {
1341 pr_err("alg: shash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n",
1342 driver
, vec_name
, cfg
->name
);
1345 testmgr_poison(desc
->__ctx
, crypto_shash_descsize(tfm
));
1346 err
= crypto_shash_import(desc
, hashstate
);
1347 err
= check_shash_op("import", err
, driver
, vec_name
,
1355 crypto_disable_simd_for_test();
1356 err
= crypto_shash_final(desc
, result
);
1358 crypto_reenable_simd_for_test();
1359 err
= check_shash_op("final", err
, driver
, vec_name
, cfg
);
1363 return check_hash_result("shash", result
, digestsize
, vec
, vec_name
,
1367 static int do_ahash_op(int (*op
)(struct ahash_request
*req
),
1368 struct ahash_request
*req
,
1369 struct crypto_wait
*wait
, bool nosimd
)
1374 crypto_disable_simd_for_test();
1379 crypto_reenable_simd_for_test();
1381 return crypto_wait_req(err
, wait
);
1384 static int check_nonfinal_ahash_op(const char *op
, int err
,
1385 u8
*result
, unsigned int digestsize
,
1386 const char *driver
, const char *vec_name
,
1387 const struct testvec_config
*cfg
)
1390 pr_err("alg: ahash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n",
1391 driver
, op
, err
, vec_name
, cfg
->name
);
1394 if (!testmgr_is_poison(result
, digestsize
)) {
1395 pr_err("alg: ahash: %s %s() used result buffer on test vector %s, cfg=\"%s\"\n",
1396 driver
, op
, vec_name
, cfg
->name
);
1402 /* Test one hash test vector in one configuration, using the ahash API */
1403 static int test_ahash_vec_cfg(const struct hash_testvec
*vec
,
1404 const char *vec_name
,
1405 const struct testvec_config
*cfg
,
1406 struct ahash_request
*req
,
1407 struct test_sglist
*tsgl
,
1410 struct crypto_ahash
*tfm
= crypto_ahash_reqtfm(req
);
1411 const unsigned int alignmask
= crypto_ahash_alignmask(tfm
);
1412 const unsigned int digestsize
= crypto_ahash_digestsize(tfm
);
1413 const unsigned int statesize
= crypto_ahash_statesize(tfm
);
1414 const char *driver
= crypto_ahash_driver_name(tfm
);
1415 const u32 req_flags
= CRYPTO_TFM_REQ_MAY_BACKLOG
| cfg
->req_flags
;
1416 const struct test_sg_division
*divs
[XBUFSIZE
];
1417 DECLARE_CRYPTO_WAIT(wait
);
1419 struct scatterlist
*pending_sgl
;
1420 unsigned int pending_len
;
1421 u8 result
[HASH_MAX_DIGESTSIZE
+ TESTMGR_POISON_LEN
];
1424 /* Set the key, if specified */
1426 err
= do_setkey(crypto_ahash_setkey
, tfm
, vec
->key
, vec
->ksize
,
1429 if (err
== vec
->setkey_error
)
1431 pr_err("alg: ahash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
1432 driver
, vec_name
, vec
->setkey_error
, err
,
1433 crypto_ahash_get_flags(tfm
));
1436 if (vec
->setkey_error
) {
1437 pr_err("alg: ahash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
1438 driver
, vec_name
, vec
->setkey_error
);
1443 /* Build the scatterlist for the source data */
1444 err
= build_hash_sglist(tsgl
, vec
, cfg
, alignmask
, divs
);
1446 pr_err("alg: ahash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n",
1447 driver
, vec_name
, cfg
->name
);
1451 /* Do the actual hashing */
1453 testmgr_poison(req
->__ctx
, crypto_ahash_reqsize(tfm
));
1454 testmgr_poison(result
, digestsize
+ TESTMGR_POISON_LEN
);
1456 if (cfg
->finalization_type
== FINALIZATION_TYPE_DIGEST
||
1457 vec
->digest_error
) {
1458 /* Just using digest() */
1459 ahash_request_set_callback(req
, req_flags
, crypto_req_done
,
1461 ahash_request_set_crypt(req
, tsgl
->sgl
, result
, vec
->psize
);
1462 err
= do_ahash_op(crypto_ahash_digest
, req
, &wait
, cfg
->nosimd
);
1464 if (err
== vec
->digest_error
)
1466 pr_err("alg: ahash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
1467 driver
, vec_name
, vec
->digest_error
, err
,
1471 if (vec
->digest_error
) {
1472 pr_err("alg: ahash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
1473 driver
, vec_name
, vec
->digest_error
, cfg
->name
);
1479 /* Using init(), zero or more update(), then final() or finup() */
1481 ahash_request_set_callback(req
, req_flags
, crypto_req_done
, &wait
);
1482 ahash_request_set_crypt(req
, NULL
, result
, 0);
1483 err
= do_ahash_op(crypto_ahash_init
, req
, &wait
, cfg
->nosimd
);
1484 err
= check_nonfinal_ahash_op("init", err
, result
, digestsize
,
1485 driver
, vec_name
, cfg
);
1491 for (i
= 0; i
< tsgl
->nents
; i
++) {
1492 if (divs
[i
]->flush_type
!= FLUSH_TYPE_NONE
&&
1493 pending_sgl
!= NULL
) {
1494 /* update() with the pending data */
1495 ahash_request_set_callback(req
, req_flags
,
1496 crypto_req_done
, &wait
);
1497 ahash_request_set_crypt(req
, pending_sgl
, result
,
1499 err
= do_ahash_op(crypto_ahash_update
, req
, &wait
,
1501 err
= check_nonfinal_ahash_op("update", err
,
1503 driver
, vec_name
, cfg
);
1509 if (divs
[i
]->flush_type
== FLUSH_TYPE_REIMPORT
) {
1510 /* Test ->export() and ->import() */
1511 testmgr_poison(hashstate
+ statesize
,
1512 TESTMGR_POISON_LEN
);
1513 err
= crypto_ahash_export(req
, hashstate
);
1514 err
= check_nonfinal_ahash_op("export", err
,
1516 driver
, vec_name
, cfg
);
1519 if (!testmgr_is_poison(hashstate
+ statesize
,
1520 TESTMGR_POISON_LEN
)) {
1521 pr_err("alg: ahash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n",
1522 driver
, vec_name
, cfg
->name
);
1526 testmgr_poison(req
->__ctx
, crypto_ahash_reqsize(tfm
));
1527 err
= crypto_ahash_import(req
, hashstate
);
1528 err
= check_nonfinal_ahash_op("import", err
,
1530 driver
, vec_name
, cfg
);
1534 if (pending_sgl
== NULL
)
1535 pending_sgl
= &tsgl
->sgl
[i
];
1536 pending_len
+= tsgl
->sgl
[i
].length
;
1539 ahash_request_set_callback(req
, req_flags
, crypto_req_done
, &wait
);
1540 ahash_request_set_crypt(req
, pending_sgl
, result
, pending_len
);
1541 if (cfg
->finalization_type
== FINALIZATION_TYPE_FINAL
) {
1542 /* finish with update() and final() */
1543 err
= do_ahash_op(crypto_ahash_update
, req
, &wait
, cfg
->nosimd
);
1544 err
= check_nonfinal_ahash_op("update", err
, result
, digestsize
,
1545 driver
, vec_name
, cfg
);
1548 err
= do_ahash_op(crypto_ahash_final
, req
, &wait
, cfg
->nosimd
);
1550 pr_err("alg: ahash: %s final() failed with err %d on test vector %s, cfg=\"%s\"\n",
1551 driver
, err
, vec_name
, cfg
->name
);
1555 /* finish with finup() */
1556 err
= do_ahash_op(crypto_ahash_finup
, req
, &wait
, cfg
->nosimd
);
1558 pr_err("alg: ahash: %s finup() failed with err %d on test vector %s, cfg=\"%s\"\n",
1559 driver
, err
, vec_name
, cfg
->name
);
1565 return check_hash_result("ahash", result
, digestsize
, vec
, vec_name
,
1569 static int test_hash_vec_cfg(const struct hash_testvec
*vec
,
1570 const char *vec_name
,
1571 const struct testvec_config
*cfg
,
1572 struct ahash_request
*req
,
1573 struct shash_desc
*desc
,
1574 struct test_sglist
*tsgl
,
1580 * For algorithms implemented as "shash", most bugs will be detected by
1581 * both the shash and ahash tests. Test the shash API first so that the
1582 * failures involve less indirection, so are easier to debug.
1586 err
= test_shash_vec_cfg(vec
, vec_name
, cfg
, desc
, tsgl
,
1592 return test_ahash_vec_cfg(vec
, vec_name
, cfg
, req
, tsgl
, hashstate
);
1595 static int test_hash_vec(const struct hash_testvec
*vec
, unsigned int vec_num
,
1596 struct ahash_request
*req
, struct shash_desc
*desc
,
1597 struct test_sglist
*tsgl
, u8
*hashstate
)
1603 sprintf(vec_name
, "%u", vec_num
);
1605 for (i
= 0; i
< ARRAY_SIZE(default_hash_testvec_configs
); i
++) {
1606 err
= test_hash_vec_cfg(vec
, vec_name
,
1607 &default_hash_testvec_configs
[i
],
1608 req
, desc
, tsgl
, hashstate
);
1613 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
1614 if (!noextratests
) {
1615 struct testvec_config cfg
;
1616 char cfgname
[TESTVEC_CONFIG_NAMELEN
];
1618 for (i
= 0; i
< fuzz_iterations
; i
++) {
1619 generate_random_testvec_config(&cfg
, cfgname
,
1621 err
= test_hash_vec_cfg(vec
, vec_name
, &cfg
,
1622 req
, desc
, tsgl
, hashstate
);
1632 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
1634 * Generate a hash test vector from the given implementation.
1635 * Assumes the buffers in 'vec' were already allocated.
1637 static void generate_random_hash_testvec(struct shash_desc
*desc
,
1638 struct hash_testvec
*vec
,
1639 unsigned int maxkeysize
,
1640 unsigned int maxdatasize
,
1641 char *name
, size_t max_namelen
)
1644 vec
->psize
= generate_random_length(maxdatasize
);
1645 generate_random_bytes((u8
*)vec
->plaintext
, vec
->psize
);
1648 * Key: length in range [1, maxkeysize], but usually choose maxkeysize.
1649 * If algorithm is unkeyed, then maxkeysize == 0 and set ksize = 0.
1651 vec
->setkey_error
= 0;
1654 vec
->ksize
= maxkeysize
;
1655 if (prandom_u32() % 4 == 0)
1656 vec
->ksize
= 1 + (prandom_u32() % maxkeysize
);
1657 generate_random_bytes((u8
*)vec
->key
, vec
->ksize
);
1659 vec
->setkey_error
= crypto_shash_setkey(desc
->tfm
, vec
->key
,
1661 /* If the key couldn't be set, no need to continue to digest. */
1662 if (vec
->setkey_error
)
1667 vec
->digest_error
= crypto_shash_digest(desc
, vec
->plaintext
,
1668 vec
->psize
, (u8
*)vec
->digest
);
1670 snprintf(name
, max_namelen
, "\"random: psize=%u ksize=%u\"",
1671 vec
->psize
, vec
->ksize
);
1675 * Test the hash algorithm represented by @req against the corresponding generic
1676 * implementation, if one is available.
1678 static int test_hash_vs_generic_impl(const char *generic_driver
,
1679 unsigned int maxkeysize
,
1680 struct ahash_request
*req
,
1681 struct shash_desc
*desc
,
1682 struct test_sglist
*tsgl
,
1685 struct crypto_ahash
*tfm
= crypto_ahash_reqtfm(req
);
1686 const unsigned int digestsize
= crypto_ahash_digestsize(tfm
);
1687 const unsigned int blocksize
= crypto_ahash_blocksize(tfm
);
1688 const unsigned int maxdatasize
= (2 * PAGE_SIZE
) - TESTMGR_POISON_LEN
;
1689 const char *algname
= crypto_hash_alg_common(tfm
)->base
.cra_name
;
1690 const char *driver
= crypto_ahash_driver_name(tfm
);
1691 char _generic_driver
[CRYPTO_MAX_ALG_NAME
];
1692 struct crypto_shash
*generic_tfm
= NULL
;
1693 struct shash_desc
*generic_desc
= NULL
;
1695 struct hash_testvec vec
= { 0 };
1697 struct testvec_config
*cfg
;
1698 char cfgname
[TESTVEC_CONFIG_NAMELEN
];
1704 if (!generic_driver
) { /* Use default naming convention? */
1705 err
= build_generic_driver_name(algname
, _generic_driver
);
1708 generic_driver
= _generic_driver
;
1711 if (strcmp(generic_driver
, driver
) == 0) /* Already the generic impl? */
1714 generic_tfm
= crypto_alloc_shash(generic_driver
, 0, 0);
1715 if (IS_ERR(generic_tfm
)) {
1716 err
= PTR_ERR(generic_tfm
);
1717 if (err
== -ENOENT
) {
1718 pr_warn("alg: hash: skipping comparison tests for %s because %s is unavailable\n",
1719 driver
, generic_driver
);
1722 pr_err("alg: hash: error allocating %s (generic impl of %s): %d\n",
1723 generic_driver
, algname
, err
);
1727 cfg
= kzalloc(sizeof(*cfg
), GFP_KERNEL
);
1733 generic_desc
= kzalloc(sizeof(*desc
) +
1734 crypto_shash_descsize(generic_tfm
), GFP_KERNEL
);
1735 if (!generic_desc
) {
1739 generic_desc
->tfm
= generic_tfm
;
1741 /* Check the algorithm properties for consistency. */
1743 if (digestsize
!= crypto_shash_digestsize(generic_tfm
)) {
1744 pr_err("alg: hash: digestsize for %s (%u) doesn't match generic impl (%u)\n",
1746 crypto_shash_digestsize(generic_tfm
));
1751 if (blocksize
!= crypto_shash_blocksize(generic_tfm
)) {
1752 pr_err("alg: hash: blocksize for %s (%u) doesn't match generic impl (%u)\n",
1753 driver
, blocksize
, crypto_shash_blocksize(generic_tfm
));
1759 * Now generate test vectors using the generic implementation, and test
1760 * the other implementation against them.
1763 vec
.key
= kmalloc(maxkeysize
, GFP_KERNEL
);
1764 vec
.plaintext
= kmalloc(maxdatasize
, GFP_KERNEL
);
1765 vec
.digest
= kmalloc(digestsize
, GFP_KERNEL
);
1766 if (!vec
.key
|| !vec
.plaintext
|| !vec
.digest
) {
1771 for (i
= 0; i
< fuzz_iterations
* 8; i
++) {
1772 generate_random_hash_testvec(generic_desc
, &vec
,
1773 maxkeysize
, maxdatasize
,
1774 vec_name
, sizeof(vec_name
));
1775 generate_random_testvec_config(cfg
, cfgname
, sizeof(cfgname
));
1777 err
= test_hash_vec_cfg(&vec
, vec_name
, cfg
,
1778 req
, desc
, tsgl
, hashstate
);
1787 kfree(vec
.plaintext
);
1789 crypto_free_shash(generic_tfm
);
1790 kfree_sensitive(generic_desc
);
1793 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1794 static int test_hash_vs_generic_impl(const char *generic_driver
,
1795 unsigned int maxkeysize
,
1796 struct ahash_request
*req
,
1797 struct shash_desc
*desc
,
1798 struct test_sglist
*tsgl
,
1803 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1805 static int alloc_shash(const char *driver
, u32 type
, u32 mask
,
1806 struct crypto_shash
**tfm_ret
,
1807 struct shash_desc
**desc_ret
)
1809 struct crypto_shash
*tfm
;
1810 struct shash_desc
*desc
;
1812 tfm
= crypto_alloc_shash(driver
, type
, mask
);
1814 if (PTR_ERR(tfm
) == -ENOENT
) {
1816 * This algorithm is only available through the ahash
1817 * API, not the shash API, so skip the shash tests.
1821 pr_err("alg: hash: failed to allocate shash transform for %s: %ld\n",
1822 driver
, PTR_ERR(tfm
));
1823 return PTR_ERR(tfm
);
1826 desc
= kmalloc(sizeof(*desc
) + crypto_shash_descsize(tfm
), GFP_KERNEL
);
1828 crypto_free_shash(tfm
);
1838 static int __alg_test_hash(const struct hash_testvec
*vecs
,
1839 unsigned int num_vecs
, const char *driver
,
1841 const char *generic_driver
, unsigned int maxkeysize
)
1843 struct crypto_ahash
*atfm
= NULL
;
1844 struct ahash_request
*req
= NULL
;
1845 struct crypto_shash
*stfm
= NULL
;
1846 struct shash_desc
*desc
= NULL
;
1847 struct test_sglist
*tsgl
= NULL
;
1848 u8
*hashstate
= NULL
;
1849 unsigned int statesize
;
1854 * Always test the ahash API. This works regardless of whether the
1855 * algorithm is implemented as ahash or shash.
1858 atfm
= crypto_alloc_ahash(driver
, type
, mask
);
1860 pr_err("alg: hash: failed to allocate transform for %s: %ld\n",
1861 driver
, PTR_ERR(atfm
));
1862 return PTR_ERR(atfm
);
1864 driver
= crypto_ahash_driver_name(atfm
);
1866 req
= ahash_request_alloc(atfm
, GFP_KERNEL
);
1868 pr_err("alg: hash: failed to allocate request for %s\n",
1875 * If available also test the shash API, to cover corner cases that may
1876 * be missed by testing the ahash API only.
1878 err
= alloc_shash(driver
, type
, mask
, &stfm
, &desc
);
1882 tsgl
= kmalloc(sizeof(*tsgl
), GFP_KERNEL
);
1883 if (!tsgl
|| init_test_sglist(tsgl
) != 0) {
1884 pr_err("alg: hash: failed to allocate test buffers for %s\n",
1892 statesize
= crypto_ahash_statesize(atfm
);
1894 statesize
= max(statesize
, crypto_shash_statesize(stfm
));
1895 hashstate
= kmalloc(statesize
+ TESTMGR_POISON_LEN
, GFP_KERNEL
);
1897 pr_err("alg: hash: failed to allocate hash state buffer for %s\n",
1903 for (i
= 0; i
< num_vecs
; i
++) {
1904 if (fips_enabled
&& vecs
[i
].fips_skip
)
1907 err
= test_hash_vec(&vecs
[i
], i
, req
, desc
, tsgl
, hashstate
);
1912 err
= test_hash_vs_generic_impl(generic_driver
, maxkeysize
, req
,
1913 desc
, tsgl
, hashstate
);
1917 destroy_test_sglist(tsgl
);
1921 crypto_free_shash(stfm
);
1922 ahash_request_free(req
);
1923 crypto_free_ahash(atfm
);
1927 static int alg_test_hash(const struct alg_test_desc
*desc
, const char *driver
,
1930 const struct hash_testvec
*template = desc
->suite
.hash
.vecs
;
1931 unsigned int tcount
= desc
->suite
.hash
.count
;
1932 unsigned int nr_unkeyed
, nr_keyed
;
1933 unsigned int maxkeysize
= 0;
1937 * For OPTIONAL_KEY algorithms, we have to do all the unkeyed tests
1938 * first, before setting a key on the tfm. To make this easier, we
1939 * require that the unkeyed test vectors (if any) are listed first.
1942 for (nr_unkeyed
= 0; nr_unkeyed
< tcount
; nr_unkeyed
++) {
1943 if (template[nr_unkeyed
].ksize
)
1946 for (nr_keyed
= 0; nr_unkeyed
+ nr_keyed
< tcount
; nr_keyed
++) {
1947 if (!template[nr_unkeyed
+ nr_keyed
].ksize
) {
1948 pr_err("alg: hash: test vectors for %s out of order, "
1949 "unkeyed ones must come first\n", desc
->alg
);
1952 maxkeysize
= max_t(unsigned int, maxkeysize
,
1953 template[nr_unkeyed
+ nr_keyed
].ksize
);
1958 err
= __alg_test_hash(template, nr_unkeyed
, driver
, type
, mask
,
1959 desc
->generic_driver
, maxkeysize
);
1960 template += nr_unkeyed
;
1963 if (!err
&& nr_keyed
)
1964 err
= __alg_test_hash(template, nr_keyed
, driver
, type
, mask
,
1965 desc
->generic_driver
, maxkeysize
);
1970 static int test_aead_vec_cfg(int enc
, const struct aead_testvec
*vec
,
1971 const char *vec_name
,
1972 const struct testvec_config
*cfg
,
1973 struct aead_request
*req
,
1974 struct cipher_test_sglists
*tsgls
)
1976 struct crypto_aead
*tfm
= crypto_aead_reqtfm(req
);
1977 const unsigned int alignmask
= crypto_aead_alignmask(tfm
);
1978 const unsigned int ivsize
= crypto_aead_ivsize(tfm
);
1979 const unsigned int authsize
= vec
->clen
- vec
->plen
;
1980 const char *driver
= crypto_aead_driver_name(tfm
);
1981 const u32 req_flags
= CRYPTO_TFM_REQ_MAY_BACKLOG
| cfg
->req_flags
;
1982 const char *op
= enc
? "encryption" : "decryption";
1983 DECLARE_CRYPTO_WAIT(wait
);
1984 u8 _iv
[3 * (MAX_ALGAPI_ALIGNMASK
+ 1) + MAX_IVLEN
];
1985 u8
*iv
= PTR_ALIGN(&_iv
[0], 2 * (MAX_ALGAPI_ALIGNMASK
+ 1)) +
1987 (cfg
->iv_offset_relative_to_alignmask
? alignmask
: 0);
1988 struct kvec input
[2];
1993 crypto_aead_set_flags(tfm
, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS
);
1995 crypto_aead_clear_flags(tfm
, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS
);
1997 err
= do_setkey(crypto_aead_setkey
, tfm
, vec
->key
, vec
->klen
,
1999 if (err
&& err
!= vec
->setkey_error
) {
2000 pr_err("alg: aead: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
2001 driver
, vec_name
, vec
->setkey_error
, err
,
2002 crypto_aead_get_flags(tfm
));
2005 if (!err
&& vec
->setkey_error
) {
2006 pr_err("alg: aead: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
2007 driver
, vec_name
, vec
->setkey_error
);
2011 /* Set the authentication tag size */
2012 err
= crypto_aead_setauthsize(tfm
, authsize
);
2013 if (err
&& err
!= vec
->setauthsize_error
) {
2014 pr_err("alg: aead: %s setauthsize failed on test vector %s; expected_error=%d, actual_error=%d\n",
2015 driver
, vec_name
, vec
->setauthsize_error
, err
);
2018 if (!err
&& vec
->setauthsize_error
) {
2019 pr_err("alg: aead: %s setauthsize unexpectedly succeeded on test vector %s; expected_error=%d\n",
2020 driver
, vec_name
, vec
->setauthsize_error
);
2024 if (vec
->setkey_error
|| vec
->setauthsize_error
)
2027 /* The IV must be copied to a buffer, as the algorithm may modify it */
2028 if (WARN_ON(ivsize
> MAX_IVLEN
))
2031 memcpy(iv
, vec
->iv
, ivsize
);
2033 memset(iv
, 0, ivsize
);
2035 /* Build the src/dst scatterlists */
2036 input
[0].iov_base
= (void *)vec
->assoc
;
2037 input
[0].iov_len
= vec
->alen
;
2038 input
[1].iov_base
= enc
? (void *)vec
->ptext
: (void *)vec
->ctext
;
2039 input
[1].iov_len
= enc
? vec
->plen
: vec
->clen
;
2040 err
= build_cipher_test_sglists(tsgls
, cfg
, alignmask
,
2041 vec
->alen
+ (enc
? vec
->plen
:
2043 vec
->alen
+ (enc
? vec
->clen
:
2047 pr_err("alg: aead: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n",
2048 driver
, op
, vec_name
, cfg
->name
);
2052 /* Do the actual encryption or decryption */
2053 testmgr_poison(req
->__ctx
, crypto_aead_reqsize(tfm
));
2054 aead_request_set_callback(req
, req_flags
, crypto_req_done
, &wait
);
2055 aead_request_set_crypt(req
, tsgls
->src
.sgl_ptr
, tsgls
->dst
.sgl_ptr
,
2056 enc
? vec
->plen
: vec
->clen
, iv
);
2057 aead_request_set_ad(req
, vec
->alen
);
2059 crypto_disable_simd_for_test();
2060 err
= enc
? crypto_aead_encrypt(req
) : crypto_aead_decrypt(req
);
2062 crypto_reenable_simd_for_test();
2063 err
= crypto_wait_req(err
, &wait
);
2065 /* Check that the algorithm didn't overwrite things it shouldn't have */
2066 if (req
->cryptlen
!= (enc
? vec
->plen
: vec
->clen
) ||
2067 req
->assoclen
!= vec
->alen
||
2069 req
->src
!= tsgls
->src
.sgl_ptr
||
2070 req
->dst
!= tsgls
->dst
.sgl_ptr
||
2071 crypto_aead_reqtfm(req
) != tfm
||
2072 req
->base
.complete
!= crypto_req_done
||
2073 req
->base
.flags
!= req_flags
||
2074 req
->base
.data
!= &wait
) {
2075 pr_err("alg: aead: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n",
2076 driver
, op
, vec_name
, cfg
->name
);
2077 if (req
->cryptlen
!= (enc
? vec
->plen
: vec
->clen
))
2078 pr_err("alg: aead: changed 'req->cryptlen'\n");
2079 if (req
->assoclen
!= vec
->alen
)
2080 pr_err("alg: aead: changed 'req->assoclen'\n");
2082 pr_err("alg: aead: changed 'req->iv'\n");
2083 if (req
->src
!= tsgls
->src
.sgl_ptr
)
2084 pr_err("alg: aead: changed 'req->src'\n");
2085 if (req
->dst
!= tsgls
->dst
.sgl_ptr
)
2086 pr_err("alg: aead: changed 'req->dst'\n");
2087 if (crypto_aead_reqtfm(req
) != tfm
)
2088 pr_err("alg: aead: changed 'req->base.tfm'\n");
2089 if (req
->base
.complete
!= crypto_req_done
)
2090 pr_err("alg: aead: changed 'req->base.complete'\n");
2091 if (req
->base
.flags
!= req_flags
)
2092 pr_err("alg: aead: changed 'req->base.flags'\n");
2093 if (req
->base
.data
!= &wait
)
2094 pr_err("alg: aead: changed 'req->base.data'\n");
2097 if (is_test_sglist_corrupted(&tsgls
->src
)) {
2098 pr_err("alg: aead: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n",
2099 driver
, op
, vec_name
, cfg
->name
);
2102 if (tsgls
->dst
.sgl_ptr
!= tsgls
->src
.sgl
&&
2103 is_test_sglist_corrupted(&tsgls
->dst
)) {
2104 pr_err("alg: aead: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n",
2105 driver
, op
, vec_name
, cfg
->name
);
2109 /* Check for unexpected success or failure, or wrong error code */
2110 if ((err
== 0 && vec
->novrfy
) ||
2111 (err
!= vec
->crypt_error
&& !(err
== -EBADMSG
&& vec
->novrfy
))) {
2112 char expected_error
[32];
2115 vec
->crypt_error
!= 0 && vec
->crypt_error
!= -EBADMSG
)
2116 sprintf(expected_error
, "-EBADMSG or %d",
2118 else if (vec
->novrfy
)
2119 sprintf(expected_error
, "-EBADMSG");
2121 sprintf(expected_error
, "%d", vec
->crypt_error
);
2123 pr_err("alg: aead: %s %s failed on test vector %s; expected_error=%s, actual_error=%d, cfg=\"%s\"\n",
2124 driver
, op
, vec_name
, expected_error
, err
,
2128 pr_err("alg: aead: %s %s unexpectedly succeeded on test vector %s; expected_error=%s, cfg=\"%s\"\n",
2129 driver
, op
, vec_name
, expected_error
, cfg
->name
);
2132 if (err
) /* Expectedly failed. */
2135 /* Check for the correct output (ciphertext or plaintext) */
2136 err
= verify_correct_output(&tsgls
->dst
, enc
? vec
->ctext
: vec
->ptext
,
2137 enc
? vec
->clen
: vec
->plen
,
2139 enc
|| cfg
->inplace_mode
== OUT_OF_PLACE
);
2140 if (err
== -EOVERFLOW
) {
2141 pr_err("alg: aead: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n",
2142 driver
, op
, vec_name
, cfg
->name
);
2146 pr_err("alg: aead: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
2147 driver
, op
, vec_name
, cfg
->name
);
2154 static int test_aead_vec(int enc
, const struct aead_testvec
*vec
,
2155 unsigned int vec_num
, struct aead_request
*req
,
2156 struct cipher_test_sglists
*tsgls
)
2162 if (enc
&& vec
->novrfy
)
2165 sprintf(vec_name
, "%u", vec_num
);
2167 for (i
= 0; i
< ARRAY_SIZE(default_cipher_testvec_configs
); i
++) {
2168 err
= test_aead_vec_cfg(enc
, vec
, vec_name
,
2169 &default_cipher_testvec_configs
[i
],
2175 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2176 if (!noextratests
) {
2177 struct testvec_config cfg
;
2178 char cfgname
[TESTVEC_CONFIG_NAMELEN
];
2180 for (i
= 0; i
< fuzz_iterations
; i
++) {
2181 generate_random_testvec_config(&cfg
, cfgname
,
2183 err
= test_aead_vec_cfg(enc
, vec
, vec_name
,
2194 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2196 struct aead_extra_tests_ctx
{
2197 struct aead_request
*req
;
2198 struct crypto_aead
*tfm
;
2199 const struct alg_test_desc
*test_desc
;
2200 struct cipher_test_sglists
*tsgls
;
2201 unsigned int maxdatasize
;
2202 unsigned int maxkeysize
;
2204 struct aead_testvec vec
;
2206 char cfgname
[TESTVEC_CONFIG_NAMELEN
];
2207 struct testvec_config cfg
;
2211 * Make at least one random change to a (ciphertext, AAD) pair. "Ciphertext"
2212 * here means the full ciphertext including the authentication tag. The
2213 * authentication tag (and hence also the ciphertext) is assumed to be nonempty.
2215 static void mutate_aead_message(struct aead_testvec
*vec
, bool aad_iv
,
2216 unsigned int ivsize
)
2218 const unsigned int aad_tail_size
= aad_iv
? ivsize
: 0;
2219 const unsigned int authsize
= vec
->clen
- vec
->plen
;
2221 if (prandom_u32() % 2 == 0 && vec
->alen
> aad_tail_size
) {
2222 /* Mutate the AAD */
2223 flip_random_bit((u8
*)vec
->assoc
, vec
->alen
- aad_tail_size
);
2224 if (prandom_u32() % 2 == 0)
2227 if (prandom_u32() % 2 == 0) {
2228 /* Mutate auth tag (assuming it's at the end of ciphertext) */
2229 flip_random_bit((u8
*)vec
->ctext
+ vec
->plen
, authsize
);
2231 /* Mutate any part of the ciphertext */
2232 flip_random_bit((u8
*)vec
->ctext
, vec
->clen
);
2237 * Minimum authentication tag size in bytes at which we assume that we can
2238 * reliably generate inauthentic messages, i.e. not generate an authentic
2239 * message by chance.
2241 #define MIN_COLLISION_FREE_AUTHSIZE 8
2243 static void generate_aead_message(struct aead_request
*req
,
2244 const struct aead_test_suite
*suite
,
2245 struct aead_testvec
*vec
,
2246 bool prefer_inauthentic
)
2248 struct crypto_aead
*tfm
= crypto_aead_reqtfm(req
);
2249 const unsigned int ivsize
= crypto_aead_ivsize(tfm
);
2250 const unsigned int authsize
= vec
->clen
- vec
->plen
;
2251 const bool inauthentic
= (authsize
>= MIN_COLLISION_FREE_AUTHSIZE
) &&
2252 (prefer_inauthentic
|| prandom_u32() % 4 == 0);
2254 /* Generate the AAD. */
2255 generate_random_bytes((u8
*)vec
->assoc
, vec
->alen
);
2256 if (suite
->aad_iv
&& vec
->alen
>= ivsize
)
2257 /* Avoid implementation-defined behavior. */
2258 memcpy((u8
*)vec
->assoc
+ vec
->alen
- ivsize
, vec
->iv
, ivsize
);
2260 if (inauthentic
&& prandom_u32() % 2 == 0) {
2261 /* Generate a random ciphertext. */
2262 generate_random_bytes((u8
*)vec
->ctext
, vec
->clen
);
2265 struct scatterlist src
[2], dst
;
2267 DECLARE_CRYPTO_WAIT(wait
);
2269 /* Generate a random plaintext and encrypt it. */
2270 sg_init_table(src
, 2);
2272 sg_set_buf(&src
[i
++], vec
->assoc
, vec
->alen
);
2274 generate_random_bytes((u8
*)vec
->ptext
, vec
->plen
);
2275 sg_set_buf(&src
[i
++], vec
->ptext
, vec
->plen
);
2277 sg_init_one(&dst
, vec
->ctext
, vec
->alen
+ vec
->clen
);
2278 memcpy(iv
, vec
->iv
, ivsize
);
2279 aead_request_set_callback(req
, 0, crypto_req_done
, &wait
);
2280 aead_request_set_crypt(req
, src
, &dst
, vec
->plen
, iv
);
2281 aead_request_set_ad(req
, vec
->alen
);
2282 vec
->crypt_error
= crypto_wait_req(crypto_aead_encrypt(req
),
2284 /* If encryption failed, we're done. */
2285 if (vec
->crypt_error
!= 0)
2287 memmove((u8
*)vec
->ctext
, vec
->ctext
+ vec
->alen
, vec
->clen
);
2291 * Mutate the authentic (ciphertext, AAD) pair to get an
2294 mutate_aead_message(vec
, suite
->aad_iv
, ivsize
);
2297 if (suite
->einval_allowed
)
2298 vec
->crypt_error
= -EINVAL
;
2302 * Generate an AEAD test vector 'vec' using the implementation specified by
2303 * 'req'. The buffers in 'vec' must already be allocated.
2305 * If 'prefer_inauthentic' is true, then this function will generate inauthentic
2306 * test vectors (i.e. vectors with 'vec->novrfy=1') more often.
2308 static void generate_random_aead_testvec(struct aead_request
*req
,
2309 struct aead_testvec
*vec
,
2310 const struct aead_test_suite
*suite
,
2311 unsigned int maxkeysize
,
2312 unsigned int maxdatasize
,
2313 char *name
, size_t max_namelen
,
2314 bool prefer_inauthentic
)
2316 struct crypto_aead
*tfm
= crypto_aead_reqtfm(req
);
2317 const unsigned int ivsize
= crypto_aead_ivsize(tfm
);
2318 const unsigned int maxauthsize
= crypto_aead_maxauthsize(tfm
);
2319 unsigned int authsize
;
2320 unsigned int total_len
;
2322 /* Key: length in [0, maxkeysize], but usually choose maxkeysize */
2323 vec
->klen
= maxkeysize
;
2324 if (prandom_u32() % 4 == 0)
2325 vec
->klen
= prandom_u32() % (maxkeysize
+ 1);
2326 generate_random_bytes((u8
*)vec
->key
, vec
->klen
);
2327 vec
->setkey_error
= crypto_aead_setkey(tfm
, vec
->key
, vec
->klen
);
2330 generate_random_bytes((u8
*)vec
->iv
, ivsize
);
2332 /* Tag length: in [0, maxauthsize], but usually choose maxauthsize */
2333 authsize
= maxauthsize
;
2334 if (prandom_u32() % 4 == 0)
2335 authsize
= prandom_u32() % (maxauthsize
+ 1);
2336 if (prefer_inauthentic
&& authsize
< MIN_COLLISION_FREE_AUTHSIZE
)
2337 authsize
= MIN_COLLISION_FREE_AUTHSIZE
;
2338 if (WARN_ON(authsize
> maxdatasize
))
2339 authsize
= maxdatasize
;
2340 maxdatasize
-= authsize
;
2341 vec
->setauthsize_error
= crypto_aead_setauthsize(tfm
, authsize
);
2343 /* AAD, plaintext, and ciphertext lengths */
2344 total_len
= generate_random_length(maxdatasize
);
2345 if (prandom_u32() % 4 == 0)
2348 vec
->alen
= generate_random_length(total_len
);
2349 vec
->plen
= total_len
- vec
->alen
;
2350 vec
->clen
= vec
->plen
+ authsize
;
2353 * Generate the AAD, plaintext, and ciphertext. Not applicable if the
2354 * key or the authentication tag size couldn't be set.
2357 vec
->crypt_error
= 0;
2358 if (vec
->setkey_error
== 0 && vec
->setauthsize_error
== 0)
2359 generate_aead_message(req
, suite
, vec
, prefer_inauthentic
);
2360 snprintf(name
, max_namelen
,
2361 "\"random: alen=%u plen=%u authsize=%u klen=%u novrfy=%d\"",
2362 vec
->alen
, vec
->plen
, authsize
, vec
->klen
, vec
->novrfy
);
2365 static void try_to_generate_inauthentic_testvec(
2366 struct aead_extra_tests_ctx
*ctx
)
2370 for (i
= 0; i
< 10; i
++) {
2371 generate_random_aead_testvec(ctx
->req
, &ctx
->vec
,
2372 &ctx
->test_desc
->suite
.aead
,
2373 ctx
->maxkeysize
, ctx
->maxdatasize
,
2375 sizeof(ctx
->vec_name
), true);
2376 if (ctx
->vec
.novrfy
)
2382 * Generate inauthentic test vectors (i.e. ciphertext, AAD pairs that aren't the
2383 * result of an encryption with the key) and verify that decryption fails.
2385 static int test_aead_inauthentic_inputs(struct aead_extra_tests_ctx
*ctx
)
2390 for (i
= 0; i
< fuzz_iterations
* 8; i
++) {
2392 * Since this part of the tests isn't comparing the
2393 * implementation to another, there's no point in testing any
2394 * test vectors other than inauthentic ones (vec.novrfy=1) here.
2396 * If we're having trouble generating such a test vector, e.g.
2397 * if the algorithm keeps rejecting the generated keys, don't
2398 * retry forever; just continue on.
2400 try_to_generate_inauthentic_testvec(ctx
);
2401 if (ctx
->vec
.novrfy
) {
2402 generate_random_testvec_config(&ctx
->cfg
, ctx
->cfgname
,
2403 sizeof(ctx
->cfgname
));
2404 err
= test_aead_vec_cfg(DECRYPT
, &ctx
->vec
,
2405 ctx
->vec_name
, &ctx
->cfg
,
2406 ctx
->req
, ctx
->tsgls
);
2416 * Test the AEAD algorithm against the corresponding generic implementation, if
2419 static int test_aead_vs_generic_impl(struct aead_extra_tests_ctx
*ctx
)
2421 struct crypto_aead
*tfm
= ctx
->tfm
;
2422 const char *algname
= crypto_aead_alg(tfm
)->base
.cra_name
;
2423 const char *driver
= crypto_aead_driver_name(tfm
);
2424 const char *generic_driver
= ctx
->test_desc
->generic_driver
;
2425 char _generic_driver
[CRYPTO_MAX_ALG_NAME
];
2426 struct crypto_aead
*generic_tfm
= NULL
;
2427 struct aead_request
*generic_req
= NULL
;
2431 if (!generic_driver
) { /* Use default naming convention? */
2432 err
= build_generic_driver_name(algname
, _generic_driver
);
2435 generic_driver
= _generic_driver
;
2438 if (strcmp(generic_driver
, driver
) == 0) /* Already the generic impl? */
2441 generic_tfm
= crypto_alloc_aead(generic_driver
, 0, 0);
2442 if (IS_ERR(generic_tfm
)) {
2443 err
= PTR_ERR(generic_tfm
);
2444 if (err
== -ENOENT
) {
2445 pr_warn("alg: aead: skipping comparison tests for %s because %s is unavailable\n",
2446 driver
, generic_driver
);
2449 pr_err("alg: aead: error allocating %s (generic impl of %s): %d\n",
2450 generic_driver
, algname
, err
);
2454 generic_req
= aead_request_alloc(generic_tfm
, GFP_KERNEL
);
2460 /* Check the algorithm properties for consistency. */
2462 if (crypto_aead_maxauthsize(tfm
) !=
2463 crypto_aead_maxauthsize(generic_tfm
)) {
2464 pr_err("alg: aead: maxauthsize for %s (%u) doesn't match generic impl (%u)\n",
2465 driver
, crypto_aead_maxauthsize(tfm
),
2466 crypto_aead_maxauthsize(generic_tfm
));
2471 if (crypto_aead_ivsize(tfm
) != crypto_aead_ivsize(generic_tfm
)) {
2472 pr_err("alg: aead: ivsize for %s (%u) doesn't match generic impl (%u)\n",
2473 driver
, crypto_aead_ivsize(tfm
),
2474 crypto_aead_ivsize(generic_tfm
));
2479 if (crypto_aead_blocksize(tfm
) != crypto_aead_blocksize(generic_tfm
)) {
2480 pr_err("alg: aead: blocksize for %s (%u) doesn't match generic impl (%u)\n",
2481 driver
, crypto_aead_blocksize(tfm
),
2482 crypto_aead_blocksize(generic_tfm
));
2488 * Now generate test vectors using the generic implementation, and test
2489 * the other implementation against them.
2491 for (i
= 0; i
< fuzz_iterations
* 8; i
++) {
2492 generate_random_aead_testvec(generic_req
, &ctx
->vec
,
2493 &ctx
->test_desc
->suite
.aead
,
2494 ctx
->maxkeysize
, ctx
->maxdatasize
,
2496 sizeof(ctx
->vec_name
), false);
2497 generate_random_testvec_config(&ctx
->cfg
, ctx
->cfgname
,
2498 sizeof(ctx
->cfgname
));
2499 if (!ctx
->vec
.novrfy
) {
2500 err
= test_aead_vec_cfg(ENCRYPT
, &ctx
->vec
,
2501 ctx
->vec_name
, &ctx
->cfg
,
2502 ctx
->req
, ctx
->tsgls
);
2506 if (ctx
->vec
.crypt_error
== 0 || ctx
->vec
.novrfy
) {
2507 err
= test_aead_vec_cfg(DECRYPT
, &ctx
->vec
,
2508 ctx
->vec_name
, &ctx
->cfg
,
2509 ctx
->req
, ctx
->tsgls
);
2517 crypto_free_aead(generic_tfm
);
2518 aead_request_free(generic_req
);
2522 static int test_aead_extra(const struct alg_test_desc
*test_desc
,
2523 struct aead_request
*req
,
2524 struct cipher_test_sglists
*tsgls
)
2526 struct aead_extra_tests_ctx
*ctx
;
2533 ctx
= kzalloc(sizeof(*ctx
), GFP_KERNEL
);
2537 ctx
->tfm
= crypto_aead_reqtfm(req
);
2538 ctx
->test_desc
= test_desc
;
2540 ctx
->maxdatasize
= (2 * PAGE_SIZE
) - TESTMGR_POISON_LEN
;
2541 ctx
->maxkeysize
= 0;
2542 for (i
= 0; i
< test_desc
->suite
.aead
.count
; i
++)
2543 ctx
->maxkeysize
= max_t(unsigned int, ctx
->maxkeysize
,
2544 test_desc
->suite
.aead
.vecs
[i
].klen
);
2546 ctx
->vec
.key
= kmalloc(ctx
->maxkeysize
, GFP_KERNEL
);
2547 ctx
->vec
.iv
= kmalloc(crypto_aead_ivsize(ctx
->tfm
), GFP_KERNEL
);
2548 ctx
->vec
.assoc
= kmalloc(ctx
->maxdatasize
, GFP_KERNEL
);
2549 ctx
->vec
.ptext
= kmalloc(ctx
->maxdatasize
, GFP_KERNEL
);
2550 ctx
->vec
.ctext
= kmalloc(ctx
->maxdatasize
, GFP_KERNEL
);
2551 if (!ctx
->vec
.key
|| !ctx
->vec
.iv
|| !ctx
->vec
.assoc
||
2552 !ctx
->vec
.ptext
|| !ctx
->vec
.ctext
) {
2557 err
= test_aead_vs_generic_impl(ctx
);
2561 err
= test_aead_inauthentic_inputs(ctx
);
2563 kfree(ctx
->vec
.key
);
2565 kfree(ctx
->vec
.assoc
);
2566 kfree(ctx
->vec
.ptext
);
2567 kfree(ctx
->vec
.ctext
);
2571 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
2572 static int test_aead_extra(const struct alg_test_desc
*test_desc
,
2573 struct aead_request
*req
,
2574 struct cipher_test_sglists
*tsgls
)
2578 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
2580 static int test_aead(int enc
, const struct aead_test_suite
*suite
,
2581 struct aead_request
*req
,
2582 struct cipher_test_sglists
*tsgls
)
2587 for (i
= 0; i
< suite
->count
; i
++) {
2588 err
= test_aead_vec(enc
, &suite
->vecs
[i
], i
, req
, tsgls
);
2596 static int alg_test_aead(const struct alg_test_desc
*desc
, const char *driver
,
2599 const struct aead_test_suite
*suite
= &desc
->suite
.aead
;
2600 struct crypto_aead
*tfm
;
2601 struct aead_request
*req
= NULL
;
2602 struct cipher_test_sglists
*tsgls
= NULL
;
2605 if (suite
->count
<= 0) {
2606 pr_err("alg: aead: empty test suite for %s\n", driver
);
2610 tfm
= crypto_alloc_aead(driver
, type
, mask
);
2612 pr_err("alg: aead: failed to allocate transform for %s: %ld\n",
2613 driver
, PTR_ERR(tfm
));
2614 return PTR_ERR(tfm
);
2616 driver
= crypto_aead_driver_name(tfm
);
2618 req
= aead_request_alloc(tfm
, GFP_KERNEL
);
2620 pr_err("alg: aead: failed to allocate request for %s\n",
2626 tsgls
= alloc_cipher_test_sglists();
2628 pr_err("alg: aead: failed to allocate test buffers for %s\n",
2634 err
= test_aead(ENCRYPT
, suite
, req
, tsgls
);
2638 err
= test_aead(DECRYPT
, suite
, req
, tsgls
);
2642 err
= test_aead_extra(desc
, req
, tsgls
);
2644 free_cipher_test_sglists(tsgls
);
2645 aead_request_free(req
);
2646 crypto_free_aead(tfm
);
2650 static int test_cipher(struct crypto_cipher
*tfm
, int enc
,
2651 const struct cipher_testvec
*template,
2652 unsigned int tcount
)
2654 const char *algo
= crypto_tfm_alg_driver_name(crypto_cipher_tfm(tfm
));
2655 unsigned int i
, j
, k
;
2658 const char *input
, *result
;
2660 char *xbuf
[XBUFSIZE
];
2663 if (testmgr_alloc_buf(xbuf
))
2672 for (i
= 0; i
< tcount
; i
++) {
2674 if (fips_enabled
&& template[i
].fips_skip
)
2677 input
= enc
? template[i
].ptext
: template[i
].ctext
;
2678 result
= enc
? template[i
].ctext
: template[i
].ptext
;
2682 if (WARN_ON(template[i
].len
> PAGE_SIZE
))
2686 memcpy(data
, input
, template[i
].len
);
2688 crypto_cipher_clear_flags(tfm
, ~0);
2690 crypto_cipher_set_flags(tfm
, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS
);
2692 ret
= crypto_cipher_setkey(tfm
, template[i
].key
,
2695 if (ret
== template[i
].setkey_error
)
2697 pr_err("alg: cipher: %s setkey failed on test vector %u; expected_error=%d, actual_error=%d, flags=%#x\n",
2698 algo
, j
, template[i
].setkey_error
, ret
,
2699 crypto_cipher_get_flags(tfm
));
2702 if (template[i
].setkey_error
) {
2703 pr_err("alg: cipher: %s setkey unexpectedly succeeded on test vector %u; expected_error=%d\n",
2704 algo
, j
, template[i
].setkey_error
);
2709 for (k
= 0; k
< template[i
].len
;
2710 k
+= crypto_cipher_blocksize(tfm
)) {
2712 crypto_cipher_encrypt_one(tfm
, data
+ k
,
2715 crypto_cipher_decrypt_one(tfm
, data
+ k
,
2720 if (memcmp(q
, result
, template[i
].len
)) {
2721 printk(KERN_ERR
"alg: cipher: Test %d failed "
2722 "on %s for %s\n", j
, e
, algo
);
2723 hexdump(q
, template[i
].len
);
2732 testmgr_free_buf(xbuf
);
2737 static int test_skcipher_vec_cfg(int enc
, const struct cipher_testvec
*vec
,
2738 const char *vec_name
,
2739 const struct testvec_config
*cfg
,
2740 struct skcipher_request
*req
,
2741 struct cipher_test_sglists
*tsgls
)
2743 struct crypto_skcipher
*tfm
= crypto_skcipher_reqtfm(req
);
2744 const unsigned int alignmask
= crypto_skcipher_alignmask(tfm
);
2745 const unsigned int ivsize
= crypto_skcipher_ivsize(tfm
);
2746 const char *driver
= crypto_skcipher_driver_name(tfm
);
2747 const u32 req_flags
= CRYPTO_TFM_REQ_MAY_BACKLOG
| cfg
->req_flags
;
2748 const char *op
= enc
? "encryption" : "decryption";
2749 DECLARE_CRYPTO_WAIT(wait
);
2750 u8 _iv
[3 * (MAX_ALGAPI_ALIGNMASK
+ 1) + MAX_IVLEN
];
2751 u8
*iv
= PTR_ALIGN(&_iv
[0], 2 * (MAX_ALGAPI_ALIGNMASK
+ 1)) +
2753 (cfg
->iv_offset_relative_to_alignmask
? alignmask
: 0);
2759 crypto_skcipher_set_flags(tfm
, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS
);
2761 crypto_skcipher_clear_flags(tfm
,
2762 CRYPTO_TFM_REQ_FORBID_WEAK_KEYS
);
2763 err
= do_setkey(crypto_skcipher_setkey
, tfm
, vec
->key
, vec
->klen
,
2766 if (err
== vec
->setkey_error
)
2768 pr_err("alg: skcipher: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
2769 driver
, vec_name
, vec
->setkey_error
, err
,
2770 crypto_skcipher_get_flags(tfm
));
2773 if (vec
->setkey_error
) {
2774 pr_err("alg: skcipher: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
2775 driver
, vec_name
, vec
->setkey_error
);
2779 /* The IV must be copied to a buffer, as the algorithm may modify it */
2781 if (WARN_ON(ivsize
> MAX_IVLEN
))
2783 if (vec
->generates_iv
&& !enc
)
2784 memcpy(iv
, vec
->iv_out
, ivsize
);
2786 memcpy(iv
, vec
->iv
, ivsize
);
2788 memset(iv
, 0, ivsize
);
2790 if (vec
->generates_iv
) {
2791 pr_err("alg: skcipher: %s has ivsize=0 but test vector %s generates IV!\n",
2798 /* Build the src/dst scatterlists */
2799 input
.iov_base
= enc
? (void *)vec
->ptext
: (void *)vec
->ctext
;
2800 input
.iov_len
= vec
->len
;
2801 err
= build_cipher_test_sglists(tsgls
, cfg
, alignmask
,
2802 vec
->len
, vec
->len
, &input
, 1);
2804 pr_err("alg: skcipher: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n",
2805 driver
, op
, vec_name
, cfg
->name
);
2809 /* Do the actual encryption or decryption */
2810 testmgr_poison(req
->__ctx
, crypto_skcipher_reqsize(tfm
));
2811 skcipher_request_set_callback(req
, req_flags
, crypto_req_done
, &wait
);
2812 skcipher_request_set_crypt(req
, tsgls
->src
.sgl_ptr
, tsgls
->dst
.sgl_ptr
,
2815 crypto_disable_simd_for_test();
2816 err
= enc
? crypto_skcipher_encrypt(req
) : crypto_skcipher_decrypt(req
);
2818 crypto_reenable_simd_for_test();
2819 err
= crypto_wait_req(err
, &wait
);
2821 /* Check that the algorithm didn't overwrite things it shouldn't have */
2822 if (req
->cryptlen
!= vec
->len
||
2824 req
->src
!= tsgls
->src
.sgl_ptr
||
2825 req
->dst
!= tsgls
->dst
.sgl_ptr
||
2826 crypto_skcipher_reqtfm(req
) != tfm
||
2827 req
->base
.complete
!= crypto_req_done
||
2828 req
->base
.flags
!= req_flags
||
2829 req
->base
.data
!= &wait
) {
2830 pr_err("alg: skcipher: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n",
2831 driver
, op
, vec_name
, cfg
->name
);
2832 if (req
->cryptlen
!= vec
->len
)
2833 pr_err("alg: skcipher: changed 'req->cryptlen'\n");
2835 pr_err("alg: skcipher: changed 'req->iv'\n");
2836 if (req
->src
!= tsgls
->src
.sgl_ptr
)
2837 pr_err("alg: skcipher: changed 'req->src'\n");
2838 if (req
->dst
!= tsgls
->dst
.sgl_ptr
)
2839 pr_err("alg: skcipher: changed 'req->dst'\n");
2840 if (crypto_skcipher_reqtfm(req
) != tfm
)
2841 pr_err("alg: skcipher: changed 'req->base.tfm'\n");
2842 if (req
->base
.complete
!= crypto_req_done
)
2843 pr_err("alg: skcipher: changed 'req->base.complete'\n");
2844 if (req
->base
.flags
!= req_flags
)
2845 pr_err("alg: skcipher: changed 'req->base.flags'\n");
2846 if (req
->base
.data
!= &wait
)
2847 pr_err("alg: skcipher: changed 'req->base.data'\n");
2850 if (is_test_sglist_corrupted(&tsgls
->src
)) {
2851 pr_err("alg: skcipher: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n",
2852 driver
, op
, vec_name
, cfg
->name
);
2855 if (tsgls
->dst
.sgl_ptr
!= tsgls
->src
.sgl
&&
2856 is_test_sglist_corrupted(&tsgls
->dst
)) {
2857 pr_err("alg: skcipher: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n",
2858 driver
, op
, vec_name
, cfg
->name
);
2862 /* Check for success or failure */
2864 if (err
== vec
->crypt_error
)
2866 pr_err("alg: skcipher: %s %s failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
2867 driver
, op
, vec_name
, vec
->crypt_error
, err
, cfg
->name
);
2870 if (vec
->crypt_error
) {
2871 pr_err("alg: skcipher: %s %s unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
2872 driver
, op
, vec_name
, vec
->crypt_error
, cfg
->name
);
2876 /* Check for the correct output (ciphertext or plaintext) */
2877 err
= verify_correct_output(&tsgls
->dst
, enc
? vec
->ctext
: vec
->ptext
,
2879 if (err
== -EOVERFLOW
) {
2880 pr_err("alg: skcipher: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n",
2881 driver
, op
, vec_name
, cfg
->name
);
2885 pr_err("alg: skcipher: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
2886 driver
, op
, vec_name
, cfg
->name
);
2890 /* If applicable, check that the algorithm generated the correct IV */
2891 if (vec
->iv_out
&& memcmp(iv
, vec
->iv_out
, ivsize
) != 0) {
2892 pr_err("alg: skcipher: %s %s test failed (wrong output IV) on test vector %s, cfg=\"%s\"\n",
2893 driver
, op
, vec_name
, cfg
->name
);
2894 hexdump(iv
, ivsize
);
2901 static int test_skcipher_vec(int enc
, const struct cipher_testvec
*vec
,
2902 unsigned int vec_num
,
2903 struct skcipher_request
*req
,
2904 struct cipher_test_sglists
*tsgls
)
2910 if (fips_enabled
&& vec
->fips_skip
)
2913 sprintf(vec_name
, "%u", vec_num
);
2915 for (i
= 0; i
< ARRAY_SIZE(default_cipher_testvec_configs
); i
++) {
2916 err
= test_skcipher_vec_cfg(enc
, vec
, vec_name
,
2917 &default_cipher_testvec_configs
[i
],
2923 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2924 if (!noextratests
) {
2925 struct testvec_config cfg
;
2926 char cfgname
[TESTVEC_CONFIG_NAMELEN
];
2928 for (i
= 0; i
< fuzz_iterations
; i
++) {
2929 generate_random_testvec_config(&cfg
, cfgname
,
2931 err
= test_skcipher_vec_cfg(enc
, vec
, vec_name
,
2942 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2944 * Generate a symmetric cipher test vector from the given implementation.
2945 * Assumes the buffers in 'vec' were already allocated.
2947 static void generate_random_cipher_testvec(struct skcipher_request
*req
,
2948 struct cipher_testvec
*vec
,
2949 unsigned int maxdatasize
,
2950 char *name
, size_t max_namelen
)
2952 struct crypto_skcipher
*tfm
= crypto_skcipher_reqtfm(req
);
2953 const unsigned int maxkeysize
= crypto_skcipher_max_keysize(tfm
);
2954 const unsigned int ivsize
= crypto_skcipher_ivsize(tfm
);
2955 struct scatterlist src
, dst
;
2957 DECLARE_CRYPTO_WAIT(wait
);
2959 /* Key: length in [0, maxkeysize], but usually choose maxkeysize */
2960 vec
->klen
= maxkeysize
;
2961 if (prandom_u32() % 4 == 0)
2962 vec
->klen
= prandom_u32() % (maxkeysize
+ 1);
2963 generate_random_bytes((u8
*)vec
->key
, vec
->klen
);
2964 vec
->setkey_error
= crypto_skcipher_setkey(tfm
, vec
->key
, vec
->klen
);
2967 generate_random_bytes((u8
*)vec
->iv
, ivsize
);
2970 vec
->len
= generate_random_length(maxdatasize
);
2971 generate_random_bytes((u8
*)vec
->ptext
, vec
->len
);
2973 /* If the key couldn't be set, no need to continue to encrypt. */
2974 if (vec
->setkey_error
)
2978 sg_init_one(&src
, vec
->ptext
, vec
->len
);
2979 sg_init_one(&dst
, vec
->ctext
, vec
->len
);
2980 memcpy(iv
, vec
->iv
, ivsize
);
2981 skcipher_request_set_callback(req
, 0, crypto_req_done
, &wait
);
2982 skcipher_request_set_crypt(req
, &src
, &dst
, vec
->len
, iv
);
2983 vec
->crypt_error
= crypto_wait_req(crypto_skcipher_encrypt(req
), &wait
);
2984 if (vec
->crypt_error
!= 0) {
2986 * The only acceptable error here is for an invalid length, so
2987 * skcipher decryption should fail with the same error too.
2988 * We'll test for this. But to keep the API usage well-defined,
2989 * explicitly initialize the ciphertext buffer too.
2991 memset((u8
*)vec
->ctext
, 0, vec
->len
);
2994 snprintf(name
, max_namelen
, "\"random: len=%u klen=%u\"",
2995 vec
->len
, vec
->klen
);
2999 * Test the skcipher algorithm represented by @req against the corresponding
3000 * generic implementation, if one is available.
3002 static int test_skcipher_vs_generic_impl(const char *generic_driver
,
3003 struct skcipher_request
*req
,
3004 struct cipher_test_sglists
*tsgls
)
3006 struct crypto_skcipher
*tfm
= crypto_skcipher_reqtfm(req
);
3007 const unsigned int maxkeysize
= crypto_skcipher_max_keysize(tfm
);
3008 const unsigned int ivsize
= crypto_skcipher_ivsize(tfm
);
3009 const unsigned int blocksize
= crypto_skcipher_blocksize(tfm
);
3010 const unsigned int maxdatasize
= (2 * PAGE_SIZE
) - TESTMGR_POISON_LEN
;
3011 const char *algname
= crypto_skcipher_alg(tfm
)->base
.cra_name
;
3012 const char *driver
= crypto_skcipher_driver_name(tfm
);
3013 char _generic_driver
[CRYPTO_MAX_ALG_NAME
];
3014 struct crypto_skcipher
*generic_tfm
= NULL
;
3015 struct skcipher_request
*generic_req
= NULL
;
3017 struct cipher_testvec vec
= { 0 };
3019 struct testvec_config
*cfg
;
3020 char cfgname
[TESTVEC_CONFIG_NAMELEN
];
3026 /* Keywrap isn't supported here yet as it handles its IV differently. */
3027 if (strncmp(algname
, "kw(", 3) == 0)
3030 if (!generic_driver
) { /* Use default naming convention? */
3031 err
= build_generic_driver_name(algname
, _generic_driver
);
3034 generic_driver
= _generic_driver
;
3037 if (strcmp(generic_driver
, driver
) == 0) /* Already the generic impl? */
3040 generic_tfm
= crypto_alloc_skcipher(generic_driver
, 0, 0);
3041 if (IS_ERR(generic_tfm
)) {
3042 err
= PTR_ERR(generic_tfm
);
3043 if (err
== -ENOENT
) {
3044 pr_warn("alg: skcipher: skipping comparison tests for %s because %s is unavailable\n",
3045 driver
, generic_driver
);
3048 pr_err("alg: skcipher: error allocating %s (generic impl of %s): %d\n",
3049 generic_driver
, algname
, err
);
3053 cfg
= kzalloc(sizeof(*cfg
), GFP_KERNEL
);
3059 generic_req
= skcipher_request_alloc(generic_tfm
, GFP_KERNEL
);
3065 /* Check the algorithm properties for consistency. */
3067 if (crypto_skcipher_min_keysize(tfm
) !=
3068 crypto_skcipher_min_keysize(generic_tfm
)) {
3069 pr_err("alg: skcipher: min keysize for %s (%u) doesn't match generic impl (%u)\n",
3070 driver
, crypto_skcipher_min_keysize(tfm
),
3071 crypto_skcipher_min_keysize(generic_tfm
));
3076 if (maxkeysize
!= crypto_skcipher_max_keysize(generic_tfm
)) {
3077 pr_err("alg: skcipher: max keysize for %s (%u) doesn't match generic impl (%u)\n",
3079 crypto_skcipher_max_keysize(generic_tfm
));
3084 if (ivsize
!= crypto_skcipher_ivsize(generic_tfm
)) {
3085 pr_err("alg: skcipher: ivsize for %s (%u) doesn't match generic impl (%u)\n",
3086 driver
, ivsize
, crypto_skcipher_ivsize(generic_tfm
));
3091 if (blocksize
!= crypto_skcipher_blocksize(generic_tfm
)) {
3092 pr_err("alg: skcipher: blocksize for %s (%u) doesn't match generic impl (%u)\n",
3094 crypto_skcipher_blocksize(generic_tfm
));
3100 * Now generate test vectors using the generic implementation, and test
3101 * the other implementation against them.
3104 vec
.key
= kmalloc(maxkeysize
, GFP_KERNEL
);
3105 vec
.iv
= kmalloc(ivsize
, GFP_KERNEL
);
3106 vec
.ptext
= kmalloc(maxdatasize
, GFP_KERNEL
);
3107 vec
.ctext
= kmalloc(maxdatasize
, GFP_KERNEL
);
3108 if (!vec
.key
|| !vec
.iv
|| !vec
.ptext
|| !vec
.ctext
) {
3113 for (i
= 0; i
< fuzz_iterations
* 8; i
++) {
3114 generate_random_cipher_testvec(generic_req
, &vec
, maxdatasize
,
3115 vec_name
, sizeof(vec_name
));
3116 generate_random_testvec_config(cfg
, cfgname
, sizeof(cfgname
));
3118 err
= test_skcipher_vec_cfg(ENCRYPT
, &vec
, vec_name
,
3122 err
= test_skcipher_vec_cfg(DECRYPT
, &vec
, vec_name
,
3135 crypto_free_skcipher(generic_tfm
);
3136 skcipher_request_free(generic_req
);
3139 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
3140 static int test_skcipher_vs_generic_impl(const char *generic_driver
,
3141 struct skcipher_request
*req
,
3142 struct cipher_test_sglists
*tsgls
)
3146 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
3148 static int test_skcipher(int enc
, const struct cipher_test_suite
*suite
,
3149 struct skcipher_request
*req
,
3150 struct cipher_test_sglists
*tsgls
)
3155 for (i
= 0; i
< suite
->count
; i
++) {
3156 err
= test_skcipher_vec(enc
, &suite
->vecs
[i
], i
, req
, tsgls
);
3164 static int alg_test_skcipher(const struct alg_test_desc
*desc
,
3165 const char *driver
, u32 type
, u32 mask
)
3167 const struct cipher_test_suite
*suite
= &desc
->suite
.cipher
;
3168 struct crypto_skcipher
*tfm
;
3169 struct skcipher_request
*req
= NULL
;
3170 struct cipher_test_sglists
*tsgls
= NULL
;
3173 if (suite
->count
<= 0) {
3174 pr_err("alg: skcipher: empty test suite for %s\n", driver
);
3178 tfm
= crypto_alloc_skcipher(driver
, type
, mask
);
3180 pr_err("alg: skcipher: failed to allocate transform for %s: %ld\n",
3181 driver
, PTR_ERR(tfm
));
3182 return PTR_ERR(tfm
);
3184 driver
= crypto_skcipher_driver_name(tfm
);
3186 req
= skcipher_request_alloc(tfm
, GFP_KERNEL
);
3188 pr_err("alg: skcipher: failed to allocate request for %s\n",
3194 tsgls
= alloc_cipher_test_sglists();
3196 pr_err("alg: skcipher: failed to allocate test buffers for %s\n",
3202 err
= test_skcipher(ENCRYPT
, suite
, req
, tsgls
);
3206 err
= test_skcipher(DECRYPT
, suite
, req
, tsgls
);
3210 err
= test_skcipher_vs_generic_impl(desc
->generic_driver
, req
, tsgls
);
3212 free_cipher_test_sglists(tsgls
);
3213 skcipher_request_free(req
);
3214 crypto_free_skcipher(tfm
);
3218 static int test_comp(struct crypto_comp
*tfm
,
3219 const struct comp_testvec
*ctemplate
,
3220 const struct comp_testvec
*dtemplate
,
3221 int ctcount
, int dtcount
)
3223 const char *algo
= crypto_tfm_alg_driver_name(crypto_comp_tfm(tfm
));
3224 char *output
, *decomp_output
;
3228 output
= kmalloc(COMP_BUF_SIZE
, GFP_KERNEL
);
3232 decomp_output
= kmalloc(COMP_BUF_SIZE
, GFP_KERNEL
);
3233 if (!decomp_output
) {
3238 for (i
= 0; i
< ctcount
; i
++) {
3240 unsigned int dlen
= COMP_BUF_SIZE
;
3242 memset(output
, 0, COMP_BUF_SIZE
);
3243 memset(decomp_output
, 0, COMP_BUF_SIZE
);
3245 ilen
= ctemplate
[i
].inlen
;
3246 ret
= crypto_comp_compress(tfm
, ctemplate
[i
].input
,
3247 ilen
, output
, &dlen
);
3249 printk(KERN_ERR
"alg: comp: compression failed "
3250 "on test %d for %s: ret=%d\n", i
+ 1, algo
,
3256 dlen
= COMP_BUF_SIZE
;
3257 ret
= crypto_comp_decompress(tfm
, output
,
3258 ilen
, decomp_output
, &dlen
);
3260 pr_err("alg: comp: compression failed: decompress: on test %d for %s failed: ret=%d\n",
3265 if (dlen
!= ctemplate
[i
].inlen
) {
3266 printk(KERN_ERR
"alg: comp: Compression test %d "
3267 "failed for %s: output len = %d\n", i
+ 1, algo
,
3273 if (memcmp(decomp_output
, ctemplate
[i
].input
,
3274 ctemplate
[i
].inlen
)) {
3275 pr_err("alg: comp: compression failed: output differs: on test %d for %s\n",
3277 hexdump(decomp_output
, dlen
);
3283 for (i
= 0; i
< dtcount
; i
++) {
3285 unsigned int dlen
= COMP_BUF_SIZE
;
3287 memset(decomp_output
, 0, COMP_BUF_SIZE
);
3289 ilen
= dtemplate
[i
].inlen
;
3290 ret
= crypto_comp_decompress(tfm
, dtemplate
[i
].input
,
3291 ilen
, decomp_output
, &dlen
);
3293 printk(KERN_ERR
"alg: comp: decompression failed "
3294 "on test %d for %s: ret=%d\n", i
+ 1, algo
,
3299 if (dlen
!= dtemplate
[i
].outlen
) {
3300 printk(KERN_ERR
"alg: comp: Decompression test %d "
3301 "failed for %s: output len = %d\n", i
+ 1, algo
,
3307 if (memcmp(decomp_output
, dtemplate
[i
].output
, dlen
)) {
3308 printk(KERN_ERR
"alg: comp: Decompression test %d "
3309 "failed for %s\n", i
+ 1, algo
);
3310 hexdump(decomp_output
, dlen
);
3319 kfree(decomp_output
);
3324 static int test_acomp(struct crypto_acomp
*tfm
,
3325 const struct comp_testvec
*ctemplate
,
3326 const struct comp_testvec
*dtemplate
,
3327 int ctcount
, int dtcount
)
3329 const char *algo
= crypto_tfm_alg_driver_name(crypto_acomp_tfm(tfm
));
3331 char *output
, *decomp_out
;
3333 struct scatterlist src
, dst
;
3334 struct acomp_req
*req
;
3335 struct crypto_wait wait
;
3337 output
= kmalloc(COMP_BUF_SIZE
, GFP_KERNEL
);
3341 decomp_out
= kmalloc(COMP_BUF_SIZE
, GFP_KERNEL
);
3347 for (i
= 0; i
< ctcount
; i
++) {
3348 unsigned int dlen
= COMP_BUF_SIZE
;
3349 int ilen
= ctemplate
[i
].inlen
;
3352 input_vec
= kmemdup(ctemplate
[i
].input
, ilen
, GFP_KERNEL
);
3358 memset(output
, 0, dlen
);
3359 crypto_init_wait(&wait
);
3360 sg_init_one(&src
, input_vec
, ilen
);
3361 sg_init_one(&dst
, output
, dlen
);
3363 req
= acomp_request_alloc(tfm
);
3365 pr_err("alg: acomp: request alloc failed for %s\n",
3372 acomp_request_set_params(req
, &src
, &dst
, ilen
, dlen
);
3373 acomp_request_set_callback(req
, CRYPTO_TFM_REQ_MAY_BACKLOG
,
3374 crypto_req_done
, &wait
);
3376 ret
= crypto_wait_req(crypto_acomp_compress(req
), &wait
);
3378 pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
3381 acomp_request_free(req
);
3386 dlen
= COMP_BUF_SIZE
;
3387 sg_init_one(&src
, output
, ilen
);
3388 sg_init_one(&dst
, decomp_out
, dlen
);
3389 crypto_init_wait(&wait
);
3390 acomp_request_set_params(req
, &src
, &dst
, ilen
, dlen
);
3392 ret
= crypto_wait_req(crypto_acomp_decompress(req
), &wait
);
3394 pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
3397 acomp_request_free(req
);
3401 if (req
->dlen
!= ctemplate
[i
].inlen
) {
3402 pr_err("alg: acomp: Compression test %d failed for %s: output len = %d\n",
3403 i
+ 1, algo
, req
->dlen
);
3406 acomp_request_free(req
);
3410 if (memcmp(input_vec
, decomp_out
, req
->dlen
)) {
3411 pr_err("alg: acomp: Compression test %d failed for %s\n",
3413 hexdump(output
, req
->dlen
);
3416 acomp_request_free(req
);
3421 acomp_request_free(req
);
3424 for (i
= 0; i
< dtcount
; i
++) {
3425 unsigned int dlen
= COMP_BUF_SIZE
;
3426 int ilen
= dtemplate
[i
].inlen
;
3429 input_vec
= kmemdup(dtemplate
[i
].input
, ilen
, GFP_KERNEL
);
3435 memset(output
, 0, dlen
);
3436 crypto_init_wait(&wait
);
3437 sg_init_one(&src
, input_vec
, ilen
);
3438 sg_init_one(&dst
, output
, dlen
);
3440 req
= acomp_request_alloc(tfm
);
3442 pr_err("alg: acomp: request alloc failed for %s\n",
3449 acomp_request_set_params(req
, &src
, &dst
, ilen
, dlen
);
3450 acomp_request_set_callback(req
, CRYPTO_TFM_REQ_MAY_BACKLOG
,
3451 crypto_req_done
, &wait
);
3453 ret
= crypto_wait_req(crypto_acomp_decompress(req
), &wait
);
3455 pr_err("alg: acomp: decompression failed on test %d for %s: ret=%d\n",
3458 acomp_request_free(req
);
3462 if (req
->dlen
!= dtemplate
[i
].outlen
) {
3463 pr_err("alg: acomp: Decompression test %d failed for %s: output len = %d\n",
3464 i
+ 1, algo
, req
->dlen
);
3467 acomp_request_free(req
);
3471 if (memcmp(output
, dtemplate
[i
].output
, req
->dlen
)) {
3472 pr_err("alg: acomp: Decompression test %d failed for %s\n",
3474 hexdump(output
, req
->dlen
);
3477 acomp_request_free(req
);
3482 acomp_request_free(req
);
3493 static int test_cprng(struct crypto_rng
*tfm
,
3494 const struct cprng_testvec
*template,
3495 unsigned int tcount
)
3497 const char *algo
= crypto_tfm_alg_driver_name(crypto_rng_tfm(tfm
));
3498 int err
= 0, i
, j
, seedsize
;
3502 seedsize
= crypto_rng_seedsize(tfm
);
3504 seed
= kmalloc(seedsize
, GFP_KERNEL
);
3506 printk(KERN_ERR
"alg: cprng: Failed to allocate seed space "
3511 for (i
= 0; i
< tcount
; i
++) {
3512 memset(result
, 0, 32);
3514 memcpy(seed
, template[i
].v
, template[i
].vlen
);
3515 memcpy(seed
+ template[i
].vlen
, template[i
].key
,
3517 memcpy(seed
+ template[i
].vlen
+ template[i
].klen
,
3518 template[i
].dt
, template[i
].dtlen
);
3520 err
= crypto_rng_reset(tfm
, seed
, seedsize
);
3522 printk(KERN_ERR
"alg: cprng: Failed to reset rng "
3527 for (j
= 0; j
< template[i
].loops
; j
++) {
3528 err
= crypto_rng_get_bytes(tfm
, result
,
3531 printk(KERN_ERR
"alg: cprng: Failed to obtain "
3532 "the correct amount of random data for "
3533 "%s (requested %d)\n", algo
,
3539 err
= memcmp(result
, template[i
].result
,
3542 printk(KERN_ERR
"alg: cprng: Test %d failed for %s\n",
3544 hexdump(result
, template[i
].rlen
);
3555 static int alg_test_cipher(const struct alg_test_desc
*desc
,
3556 const char *driver
, u32 type
, u32 mask
)
3558 const struct cipher_test_suite
*suite
= &desc
->suite
.cipher
;
3559 struct crypto_cipher
*tfm
;
3562 tfm
= crypto_alloc_cipher(driver
, type
, mask
);
3564 printk(KERN_ERR
"alg: cipher: Failed to load transform for "
3565 "%s: %ld\n", driver
, PTR_ERR(tfm
));
3566 return PTR_ERR(tfm
);
3569 err
= test_cipher(tfm
, ENCRYPT
, suite
->vecs
, suite
->count
);
3571 err
= test_cipher(tfm
, DECRYPT
, suite
->vecs
, suite
->count
);
3573 crypto_free_cipher(tfm
);
3577 static int alg_test_comp(const struct alg_test_desc
*desc
, const char *driver
,
3580 struct crypto_comp
*comp
;
3581 struct crypto_acomp
*acomp
;
3583 u32 algo_type
= type
& CRYPTO_ALG_TYPE_ACOMPRESS_MASK
;
3585 if (algo_type
== CRYPTO_ALG_TYPE_ACOMPRESS
) {
3586 acomp
= crypto_alloc_acomp(driver
, type
, mask
);
3587 if (IS_ERR(acomp
)) {
3588 pr_err("alg: acomp: Failed to load transform for %s: %ld\n",
3589 driver
, PTR_ERR(acomp
));
3590 return PTR_ERR(acomp
);
3592 err
= test_acomp(acomp
, desc
->suite
.comp
.comp
.vecs
,
3593 desc
->suite
.comp
.decomp
.vecs
,
3594 desc
->suite
.comp
.comp
.count
,
3595 desc
->suite
.comp
.decomp
.count
);
3596 crypto_free_acomp(acomp
);
3598 comp
= crypto_alloc_comp(driver
, type
, mask
);
3600 pr_err("alg: comp: Failed to load transform for %s: %ld\n",
3601 driver
, PTR_ERR(comp
));
3602 return PTR_ERR(comp
);
3605 err
= test_comp(comp
, desc
->suite
.comp
.comp
.vecs
,
3606 desc
->suite
.comp
.decomp
.vecs
,
3607 desc
->suite
.comp
.comp
.count
,
3608 desc
->suite
.comp
.decomp
.count
);
3610 crypto_free_comp(comp
);
3615 static int alg_test_crc32c(const struct alg_test_desc
*desc
,
3616 const char *driver
, u32 type
, u32 mask
)
3618 struct crypto_shash
*tfm
;
3622 err
= alg_test_hash(desc
, driver
, type
, mask
);
3626 tfm
= crypto_alloc_shash(driver
, type
, mask
);
3628 if (PTR_ERR(tfm
) == -ENOENT
) {
3630 * This crc32c implementation is only available through
3631 * ahash API, not the shash API, so the remaining part
3632 * of the test is not applicable to it.
3636 printk(KERN_ERR
"alg: crc32c: Failed to load transform for %s: "
3637 "%ld\n", driver
, PTR_ERR(tfm
));
3638 return PTR_ERR(tfm
);
3640 driver
= crypto_shash_driver_name(tfm
);
3643 SHASH_DESC_ON_STACK(shash
, tfm
);
3644 u32
*ctx
= (u32
*)shash_desc_ctx(shash
);
3649 err
= crypto_shash_final(shash
, (u8
*)&val
);
3651 printk(KERN_ERR
"alg: crc32c: Operation failed for "
3652 "%s: %d\n", driver
, err
);
3656 if (val
!= cpu_to_le32(~420553207)) {
3657 pr_err("alg: crc32c: Test failed for %s: %u\n",
3658 driver
, le32_to_cpu(val
));
3663 crypto_free_shash(tfm
);
3668 static int alg_test_cprng(const struct alg_test_desc
*desc
, const char *driver
,
3671 struct crypto_rng
*rng
;
3674 rng
= crypto_alloc_rng(driver
, type
, mask
);
3676 printk(KERN_ERR
"alg: cprng: Failed to load transform for %s: "
3677 "%ld\n", driver
, PTR_ERR(rng
));
3678 return PTR_ERR(rng
);
3681 err
= test_cprng(rng
, desc
->suite
.cprng
.vecs
, desc
->suite
.cprng
.count
);
3683 crypto_free_rng(rng
);
3689 static int drbg_cavs_test(const struct drbg_testvec
*test
, int pr
,
3690 const char *driver
, u32 type
, u32 mask
)
3693 struct crypto_rng
*drng
;
3694 struct drbg_test_data test_data
;
3695 struct drbg_string addtl
, pers
, testentropy
;
3696 unsigned char *buf
= kzalloc(test
->expectedlen
, GFP_KERNEL
);
3701 drng
= crypto_alloc_rng(driver
, type
, mask
);
3703 printk(KERN_ERR
"alg: drbg: could not allocate DRNG handle for "
3705 kfree_sensitive(buf
);
3709 test_data
.testentropy
= &testentropy
;
3710 drbg_string_fill(&testentropy
, test
->entropy
, test
->entropylen
);
3711 drbg_string_fill(&pers
, test
->pers
, test
->perslen
);
3712 ret
= crypto_drbg_reset_test(drng
, &pers
, &test_data
);
3714 printk(KERN_ERR
"alg: drbg: Failed to reset rng\n");
3718 drbg_string_fill(&addtl
, test
->addtla
, test
->addtllen
);
3720 drbg_string_fill(&testentropy
, test
->entpra
, test
->entprlen
);
3721 ret
= crypto_drbg_get_bytes_addtl_test(drng
,
3722 buf
, test
->expectedlen
, &addtl
, &test_data
);
3724 ret
= crypto_drbg_get_bytes_addtl(drng
,
3725 buf
, test
->expectedlen
, &addtl
);
3728 printk(KERN_ERR
"alg: drbg: could not obtain random data for "
3729 "driver %s\n", driver
);
3733 drbg_string_fill(&addtl
, test
->addtlb
, test
->addtllen
);
3735 drbg_string_fill(&testentropy
, test
->entprb
, test
->entprlen
);
3736 ret
= crypto_drbg_get_bytes_addtl_test(drng
,
3737 buf
, test
->expectedlen
, &addtl
, &test_data
);
3739 ret
= crypto_drbg_get_bytes_addtl(drng
,
3740 buf
, test
->expectedlen
, &addtl
);
3743 printk(KERN_ERR
"alg: drbg: could not obtain random data for "
3744 "driver %s\n", driver
);
3748 ret
= memcmp(test
->expected
, buf
, test
->expectedlen
);
3751 crypto_free_rng(drng
);
3752 kfree_sensitive(buf
);
3757 static int alg_test_drbg(const struct alg_test_desc
*desc
, const char *driver
,
3763 const struct drbg_testvec
*template = desc
->suite
.drbg
.vecs
;
3764 unsigned int tcount
= desc
->suite
.drbg
.count
;
3766 if (0 == memcmp(driver
, "drbg_pr_", 8))
3769 for (i
= 0; i
< tcount
; i
++) {
3770 err
= drbg_cavs_test(&template[i
], pr
, driver
, type
, mask
);
3772 printk(KERN_ERR
"alg: drbg: Test %d failed for %s\n",
3782 static int do_test_kpp(struct crypto_kpp
*tfm
, const struct kpp_testvec
*vec
,
3785 struct kpp_request
*req
;
3786 void *input_buf
= NULL
;
3787 void *output_buf
= NULL
;
3788 void *a_public
= NULL
;
3790 void *shared_secret
= NULL
;
3791 struct crypto_wait wait
;
3792 unsigned int out_len_max
;
3794 struct scatterlist src
, dst
;
3796 req
= kpp_request_alloc(tfm
, GFP_KERNEL
);
3800 crypto_init_wait(&wait
);
3802 err
= crypto_kpp_set_secret(tfm
, vec
->secret
, vec
->secret_size
);
3806 out_len_max
= crypto_kpp_maxsize(tfm
);
3807 output_buf
= kzalloc(out_len_max
, GFP_KERNEL
);
3813 /* Use appropriate parameter as base */
3814 kpp_request_set_input(req
, NULL
, 0);
3815 sg_init_one(&dst
, output_buf
, out_len_max
);
3816 kpp_request_set_output(req
, &dst
, out_len_max
);
3817 kpp_request_set_callback(req
, CRYPTO_TFM_REQ_MAY_BACKLOG
,
3818 crypto_req_done
, &wait
);
3820 /* Compute party A's public key */
3821 err
= crypto_wait_req(crypto_kpp_generate_public_key(req
), &wait
);
3823 pr_err("alg: %s: Party A: generate public key test failed. err %d\n",
3829 /* Save party A's public key */
3830 a_public
= kmemdup(sg_virt(req
->dst
), out_len_max
, GFP_KERNEL
);
3836 /* Verify calculated public key */
3837 if (memcmp(vec
->expected_a_public
, sg_virt(req
->dst
),
3838 vec
->expected_a_public_size
)) {
3839 pr_err("alg: %s: Party A: generate public key test failed. Invalid output\n",
3846 /* Calculate shared secret key by using counter part (b) public key. */
3847 input_buf
= kmemdup(vec
->b_public
, vec
->b_public_size
, GFP_KERNEL
);
3853 sg_init_one(&src
, input_buf
, vec
->b_public_size
);
3854 sg_init_one(&dst
, output_buf
, out_len_max
);
3855 kpp_request_set_input(req
, &src
, vec
->b_public_size
);
3856 kpp_request_set_output(req
, &dst
, out_len_max
);
3857 kpp_request_set_callback(req
, CRYPTO_TFM_REQ_MAY_BACKLOG
,
3858 crypto_req_done
, &wait
);
3859 err
= crypto_wait_req(crypto_kpp_compute_shared_secret(req
), &wait
);
3861 pr_err("alg: %s: Party A: compute shared secret test failed. err %d\n",
3867 /* Save the shared secret obtained by party A */
3868 a_ss
= kmemdup(sg_virt(req
->dst
), vec
->expected_ss_size
, GFP_KERNEL
);
3875 * Calculate party B's shared secret by using party A's
3878 err
= crypto_kpp_set_secret(tfm
, vec
->b_secret
,
3879 vec
->b_secret_size
);
3883 sg_init_one(&src
, a_public
, vec
->expected_a_public_size
);
3884 sg_init_one(&dst
, output_buf
, out_len_max
);
3885 kpp_request_set_input(req
, &src
, vec
->expected_a_public_size
);
3886 kpp_request_set_output(req
, &dst
, out_len_max
);
3887 kpp_request_set_callback(req
, CRYPTO_TFM_REQ_MAY_BACKLOG
,
3888 crypto_req_done
, &wait
);
3889 err
= crypto_wait_req(crypto_kpp_compute_shared_secret(req
),
3892 pr_err("alg: %s: Party B: compute shared secret failed. err %d\n",
3897 shared_secret
= a_ss
;
3899 shared_secret
= (void *)vec
->expected_ss
;
3903 * verify shared secret from which the user will derive
3904 * secret key by executing whatever hash it has chosen
3906 if (memcmp(shared_secret
, sg_virt(req
->dst
),
3907 vec
->expected_ss_size
)) {
3908 pr_err("alg: %s: compute shared secret test failed. Invalid output\n",
3920 kpp_request_free(req
);
3924 static int test_kpp(struct crypto_kpp
*tfm
, const char *alg
,
3925 const struct kpp_testvec
*vecs
, unsigned int tcount
)
3929 for (i
= 0; i
< tcount
; i
++) {
3930 ret
= do_test_kpp(tfm
, vecs
++, alg
);
3932 pr_err("alg: %s: test failed on vector %d, err=%d\n",
3940 static int alg_test_kpp(const struct alg_test_desc
*desc
, const char *driver
,
3943 struct crypto_kpp
*tfm
;
3946 tfm
= crypto_alloc_kpp(driver
, type
, mask
);
3948 pr_err("alg: kpp: Failed to load tfm for %s: %ld\n",
3949 driver
, PTR_ERR(tfm
));
3950 return PTR_ERR(tfm
);
3952 if (desc
->suite
.kpp
.vecs
)
3953 err
= test_kpp(tfm
, desc
->alg
, desc
->suite
.kpp
.vecs
,
3954 desc
->suite
.kpp
.count
);
3956 crypto_free_kpp(tfm
);
3960 static u8
*test_pack_u32(u8
*dst
, u32 val
)
3962 memcpy(dst
, &val
, sizeof(val
));
3963 return dst
+ sizeof(val
);
3966 static int test_akcipher_one(struct crypto_akcipher
*tfm
,
3967 const struct akcipher_testvec
*vecs
)
3969 char *xbuf
[XBUFSIZE
];
3970 struct akcipher_request
*req
;
3971 void *outbuf_enc
= NULL
;
3972 void *outbuf_dec
= NULL
;
3973 struct crypto_wait wait
;
3974 unsigned int out_len_max
, out_len
= 0;
3976 struct scatterlist src
, dst
, src_tab
[3];
3978 unsigned int m_size
, c_size
;
3982 if (testmgr_alloc_buf(xbuf
))
3985 req
= akcipher_request_alloc(tfm
, GFP_KERNEL
);
3989 crypto_init_wait(&wait
);
3991 key
= kmalloc(vecs
->key_len
+ sizeof(u32
) * 2 + vecs
->param_len
,
3995 memcpy(key
, vecs
->key
, vecs
->key_len
);
3996 ptr
= key
+ vecs
->key_len
;
3997 ptr
= test_pack_u32(ptr
, vecs
->algo
);
3998 ptr
= test_pack_u32(ptr
, vecs
->param_len
);
3999 memcpy(ptr
, vecs
->params
, vecs
->param_len
);
4001 if (vecs
->public_key_vec
)
4002 err
= crypto_akcipher_set_pub_key(tfm
, key
, vecs
->key_len
);
4004 err
= crypto_akcipher_set_priv_key(tfm
, key
, vecs
->key_len
);
4009 * First run test which do not require a private key, such as
4010 * encrypt or verify.
4013 out_len_max
= crypto_akcipher_maxsize(tfm
);
4014 outbuf_enc
= kzalloc(out_len_max
, GFP_KERNEL
);
4018 if (!vecs
->siggen_sigver_test
) {
4020 m_size
= vecs
->m_size
;
4022 c_size
= vecs
->c_size
;
4025 /* Swap args so we could keep plaintext (digest)
4026 * in vecs->m, and cooked signature in vecs->c.
4028 m
= vecs
->c
; /* signature */
4029 m_size
= vecs
->c_size
;
4030 c
= vecs
->m
; /* digest */
4031 c_size
= vecs
->m_size
;
4036 if (WARN_ON(m_size
> PAGE_SIZE
))
4038 memcpy(xbuf
[0], m
, m_size
);
4040 sg_init_table(src_tab
, 3);
4041 sg_set_buf(&src_tab
[0], xbuf
[0], 8);
4042 sg_set_buf(&src_tab
[1], xbuf
[0] + 8, m_size
- 8);
4043 if (vecs
->siggen_sigver_test
) {
4044 if (WARN_ON(c_size
> PAGE_SIZE
))
4046 memcpy(xbuf
[1], c
, c_size
);
4047 sg_set_buf(&src_tab
[2], xbuf
[1], c_size
);
4048 akcipher_request_set_crypt(req
, src_tab
, NULL
, m_size
, c_size
);
4050 sg_init_one(&dst
, outbuf_enc
, out_len_max
);
4051 akcipher_request_set_crypt(req
, src_tab
, &dst
, m_size
,
4054 akcipher_request_set_callback(req
, CRYPTO_TFM_REQ_MAY_BACKLOG
,
4055 crypto_req_done
, &wait
);
4057 err
= crypto_wait_req(vecs
->siggen_sigver_test
?
4058 /* Run asymmetric signature verification */
4059 crypto_akcipher_verify(req
) :
4060 /* Run asymmetric encrypt */
4061 crypto_akcipher_encrypt(req
), &wait
);
4063 pr_err("alg: akcipher: %s test failed. err %d\n", op
, err
);
4066 if (!vecs
->siggen_sigver_test
&& c
) {
4067 if (req
->dst_len
!= c_size
) {
4068 pr_err("alg: akcipher: %s test failed. Invalid output len\n",
4073 /* verify that encrypted message is equal to expected */
4074 if (memcmp(c
, outbuf_enc
, c_size
) != 0) {
4075 pr_err("alg: akcipher: %s test failed. Invalid output\n",
4077 hexdump(outbuf_enc
, c_size
);
4084 * Don't invoke (decrypt or sign) test which require a private key
4085 * for vectors with only a public key.
4087 if (vecs
->public_key_vec
) {
4091 outbuf_dec
= kzalloc(out_len_max
, GFP_KERNEL
);
4097 if (!vecs
->siggen_sigver_test
&& !c
) {
4099 c_size
= req
->dst_len
;
4103 op
= vecs
->siggen_sigver_test
? "sign" : "decrypt";
4104 if (WARN_ON(c_size
> PAGE_SIZE
))
4106 memcpy(xbuf
[0], c
, c_size
);
4108 sg_init_one(&src
, xbuf
[0], c_size
);
4109 sg_init_one(&dst
, outbuf_dec
, out_len_max
);
4110 crypto_init_wait(&wait
);
4111 akcipher_request_set_crypt(req
, &src
, &dst
, c_size
, out_len_max
);
4113 err
= crypto_wait_req(vecs
->siggen_sigver_test
?
4114 /* Run asymmetric signature generation */
4115 crypto_akcipher_sign(req
) :
4116 /* Run asymmetric decrypt */
4117 crypto_akcipher_decrypt(req
), &wait
);
4119 pr_err("alg: akcipher: %s test failed. err %d\n", op
, err
);
4122 out_len
= req
->dst_len
;
4123 if (out_len
< m_size
) {
4124 pr_err("alg: akcipher: %s test failed. Invalid output len %u\n",
4129 /* verify that decrypted message is equal to the original msg */
4130 if (memchr_inv(outbuf_dec
, 0, out_len
- m_size
) ||
4131 memcmp(m
, outbuf_dec
+ out_len
- m_size
, m_size
)) {
4132 pr_err("alg: akcipher: %s test failed. Invalid output\n", op
);
4133 hexdump(outbuf_dec
, out_len
);
4142 akcipher_request_free(req
);
4144 testmgr_free_buf(xbuf
);
4148 static int test_akcipher(struct crypto_akcipher
*tfm
, const char *alg
,
4149 const struct akcipher_testvec
*vecs
,
4150 unsigned int tcount
)
4153 crypto_tfm_alg_driver_name(crypto_akcipher_tfm(tfm
));
4156 for (i
= 0; i
< tcount
; i
++) {
4157 ret
= test_akcipher_one(tfm
, vecs
++);
4161 pr_err("alg: akcipher: test %d failed for %s, err=%d\n",
4168 static int alg_test_akcipher(const struct alg_test_desc
*desc
,
4169 const char *driver
, u32 type
, u32 mask
)
4171 struct crypto_akcipher
*tfm
;
4174 tfm
= crypto_alloc_akcipher(driver
, type
, mask
);
4176 pr_err("alg: akcipher: Failed to load tfm for %s: %ld\n",
4177 driver
, PTR_ERR(tfm
));
4178 return PTR_ERR(tfm
);
4180 if (desc
->suite
.akcipher
.vecs
)
4181 err
= test_akcipher(tfm
, desc
->alg
, desc
->suite
.akcipher
.vecs
,
4182 desc
->suite
.akcipher
.count
);
4184 crypto_free_akcipher(tfm
);
4188 static int alg_test_null(const struct alg_test_desc
*desc
,
4189 const char *driver
, u32 type
, u32 mask
)
4194 #define ____VECS(tv) .vecs = tv, .count = ARRAY_SIZE(tv)
4195 #define __VECS(tv) { ____VECS(tv) }
4197 /* Please keep this list sorted by algorithm name. */
4198 static const struct alg_test_desc alg_test_descs
[] = {
4200 .alg
= "adiantum(xchacha12,aes)",
4201 .generic_driver
= "adiantum(xchacha12-generic,aes-generic,nhpoly1305-generic)",
4202 .test
= alg_test_skcipher
,
4204 .cipher
= __VECS(adiantum_xchacha12_aes_tv_template
)
4207 .alg
= "adiantum(xchacha20,aes)",
4208 .generic_driver
= "adiantum(xchacha20-generic,aes-generic,nhpoly1305-generic)",
4209 .test
= alg_test_skcipher
,
4211 .cipher
= __VECS(adiantum_xchacha20_aes_tv_template
)
4215 .test
= alg_test_aead
,
4217 .aead
= __VECS(aegis128_tv_template
)
4220 .alg
= "ansi_cprng",
4221 .test
= alg_test_cprng
,
4223 .cprng
= __VECS(ansi_cprng_aes_tv_template
)
4226 .alg
= "authenc(hmac(md5),ecb(cipher_null))",
4227 .test
= alg_test_aead
,
4229 .aead
= __VECS(hmac_md5_ecb_cipher_null_tv_template
)
4232 .alg
= "authenc(hmac(sha1),cbc(aes))",
4233 .test
= alg_test_aead
,
4236 .aead
= __VECS(hmac_sha1_aes_cbc_tv_temp
)
4239 .alg
= "authenc(hmac(sha1),cbc(des))",
4240 .test
= alg_test_aead
,
4242 .aead
= __VECS(hmac_sha1_des_cbc_tv_temp
)
4245 .alg
= "authenc(hmac(sha1),cbc(des3_ede))",
4246 .test
= alg_test_aead
,
4248 .aead
= __VECS(hmac_sha1_des3_ede_cbc_tv_temp
)
4251 .alg
= "authenc(hmac(sha1),ctr(aes))",
4252 .test
= alg_test_null
,
4255 .alg
= "authenc(hmac(sha1),ecb(cipher_null))",
4256 .test
= alg_test_aead
,
4258 .aead
= __VECS(hmac_sha1_ecb_cipher_null_tv_temp
)
4261 .alg
= "authenc(hmac(sha1),rfc3686(ctr(aes)))",
4262 .test
= alg_test_null
,
4265 .alg
= "authenc(hmac(sha224),cbc(des))",
4266 .test
= alg_test_aead
,
4268 .aead
= __VECS(hmac_sha224_des_cbc_tv_temp
)
4271 .alg
= "authenc(hmac(sha224),cbc(des3_ede))",
4272 .test
= alg_test_aead
,
4274 .aead
= __VECS(hmac_sha224_des3_ede_cbc_tv_temp
)
4277 .alg
= "authenc(hmac(sha256),cbc(aes))",
4278 .test
= alg_test_aead
,
4281 .aead
= __VECS(hmac_sha256_aes_cbc_tv_temp
)
4284 .alg
= "authenc(hmac(sha256),cbc(des))",
4285 .test
= alg_test_aead
,
4287 .aead
= __VECS(hmac_sha256_des_cbc_tv_temp
)
4290 .alg
= "authenc(hmac(sha256),cbc(des3_ede))",
4291 .test
= alg_test_aead
,
4293 .aead
= __VECS(hmac_sha256_des3_ede_cbc_tv_temp
)
4296 .alg
= "authenc(hmac(sha256),ctr(aes))",
4297 .test
= alg_test_null
,
4300 .alg
= "authenc(hmac(sha256),rfc3686(ctr(aes)))",
4301 .test
= alg_test_null
,
4304 .alg
= "authenc(hmac(sha384),cbc(des))",
4305 .test
= alg_test_aead
,
4307 .aead
= __VECS(hmac_sha384_des_cbc_tv_temp
)
4310 .alg
= "authenc(hmac(sha384),cbc(des3_ede))",
4311 .test
= alg_test_aead
,
4313 .aead
= __VECS(hmac_sha384_des3_ede_cbc_tv_temp
)
4316 .alg
= "authenc(hmac(sha384),ctr(aes))",
4317 .test
= alg_test_null
,
4320 .alg
= "authenc(hmac(sha384),rfc3686(ctr(aes)))",
4321 .test
= alg_test_null
,
4324 .alg
= "authenc(hmac(sha512),cbc(aes))",
4326 .test
= alg_test_aead
,
4328 .aead
= __VECS(hmac_sha512_aes_cbc_tv_temp
)
4331 .alg
= "authenc(hmac(sha512),cbc(des))",
4332 .test
= alg_test_aead
,
4334 .aead
= __VECS(hmac_sha512_des_cbc_tv_temp
)
4337 .alg
= "authenc(hmac(sha512),cbc(des3_ede))",
4338 .test
= alg_test_aead
,
4340 .aead
= __VECS(hmac_sha512_des3_ede_cbc_tv_temp
)
4343 .alg
= "authenc(hmac(sha512),ctr(aes))",
4344 .test
= alg_test_null
,
4347 .alg
= "authenc(hmac(sha512),rfc3686(ctr(aes)))",
4348 .test
= alg_test_null
,
4351 .alg
= "blake2b-160",
4352 .test
= alg_test_hash
,
4355 .hash
= __VECS(blake2b_160_tv_template
)
4358 .alg
= "blake2b-256",
4359 .test
= alg_test_hash
,
4362 .hash
= __VECS(blake2b_256_tv_template
)
4365 .alg
= "blake2b-384",
4366 .test
= alg_test_hash
,
4369 .hash
= __VECS(blake2b_384_tv_template
)
4372 .alg
= "blake2b-512",
4373 .test
= alg_test_hash
,
4376 .hash
= __VECS(blake2b_512_tv_template
)
4379 .alg
= "blake2s-128",
4380 .test
= alg_test_hash
,
4382 .hash
= __VECS(blakes2s_128_tv_template
)
4385 .alg
= "blake2s-160",
4386 .test
= alg_test_hash
,
4388 .hash
= __VECS(blakes2s_160_tv_template
)
4391 .alg
= "blake2s-224",
4392 .test
= alg_test_hash
,
4394 .hash
= __VECS(blakes2s_224_tv_template
)
4397 .alg
= "blake2s-256",
4398 .test
= alg_test_hash
,
4400 .hash
= __VECS(blakes2s_256_tv_template
)
4404 .test
= alg_test_skcipher
,
4407 .cipher
= __VECS(aes_cbc_tv_template
)
4410 .alg
= "cbc(anubis)",
4411 .test
= alg_test_skcipher
,
4413 .cipher
= __VECS(anubis_cbc_tv_template
)
4416 .alg
= "cbc(blowfish)",
4417 .test
= alg_test_skcipher
,
4419 .cipher
= __VECS(bf_cbc_tv_template
)
4422 .alg
= "cbc(camellia)",
4423 .test
= alg_test_skcipher
,
4425 .cipher
= __VECS(camellia_cbc_tv_template
)
4428 .alg
= "cbc(cast5)",
4429 .test
= alg_test_skcipher
,
4431 .cipher
= __VECS(cast5_cbc_tv_template
)
4434 .alg
= "cbc(cast6)",
4435 .test
= alg_test_skcipher
,
4437 .cipher
= __VECS(cast6_cbc_tv_template
)
4441 .test
= alg_test_skcipher
,
4443 .cipher
= __VECS(des_cbc_tv_template
)
4446 .alg
= "cbc(des3_ede)",
4447 .test
= alg_test_skcipher
,
4449 .cipher
= __VECS(des3_ede_cbc_tv_template
)
4452 /* Same as cbc(aes) except the key is stored in
4453 * hardware secure memory which we reference by index
4456 .test
= alg_test_null
,
4459 /* Same as cbc(sm4) except the key is stored in
4460 * hardware secure memory which we reference by index
4463 .test
= alg_test_null
,
4465 .alg
= "cbc(serpent)",
4466 .test
= alg_test_skcipher
,
4468 .cipher
= __VECS(serpent_cbc_tv_template
)
4472 .test
= alg_test_skcipher
,
4474 .cipher
= __VECS(sm4_cbc_tv_template
)
4477 .alg
= "cbc(twofish)",
4478 .test
= alg_test_skcipher
,
4480 .cipher
= __VECS(tf_cbc_tv_template
)
4483 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
4484 .alg
= "cbc-paes-s390",
4486 .test
= alg_test_skcipher
,
4488 .cipher
= __VECS(aes_cbc_tv_template
)
4492 .alg
= "cbcmac(aes)",
4494 .test
= alg_test_hash
,
4496 .hash
= __VECS(aes_cbcmac_tv_template
)
4499 .alg
= "cbcmac(sm4)",
4500 .test
= alg_test_hash
,
4502 .hash
= __VECS(sm4_cbcmac_tv_template
)
4506 .generic_driver
= "ccm_base(ctr(aes-generic),cbcmac(aes-generic))",
4507 .test
= alg_test_aead
,
4511 ____VECS(aes_ccm_tv_template
),
4512 .einval_allowed
= 1,
4517 .generic_driver
= "ccm_base(ctr(sm4-generic),cbcmac(sm4-generic))",
4518 .test
= alg_test_aead
,
4521 ____VECS(sm4_ccm_tv_template
),
4522 .einval_allowed
= 1,
4527 .test
= alg_test_skcipher
,
4530 .cipher
= __VECS(aes_cfb_tv_template
)
4534 .test
= alg_test_skcipher
,
4536 .cipher
= __VECS(sm4_cfb_tv_template
)
4540 .test
= alg_test_skcipher
,
4542 .cipher
= __VECS(chacha20_tv_template
)
4547 .test
= alg_test_hash
,
4549 .hash
= __VECS(aes_cmac128_tv_template
)
4552 .alg
= "cmac(des3_ede)",
4553 .test
= alg_test_hash
,
4555 .hash
= __VECS(des3_ede_cmac64_tv_template
)
4559 .test
= alg_test_hash
,
4561 .hash
= __VECS(sm4_cmac128_tv_template
)
4564 .alg
= "compress_null",
4565 .test
= alg_test_null
,
4568 .test
= alg_test_hash
,
4571 .hash
= __VECS(crc32_tv_template
)
4575 .test
= alg_test_crc32c
,
4578 .hash
= __VECS(crc32c_tv_template
)
4581 .alg
= "crc64-rocksoft",
4582 .test
= alg_test_hash
,
4585 .hash
= __VECS(crc64_rocksoft_tv_template
)
4589 .test
= alg_test_hash
,
4592 .hash
= __VECS(crct10dif_tv_template
)
4596 .test
= alg_test_skcipher
,
4599 .cipher
= __VECS(aes_ctr_tv_template
)
4602 .alg
= "ctr(blowfish)",
4603 .test
= alg_test_skcipher
,
4605 .cipher
= __VECS(bf_ctr_tv_template
)
4608 .alg
= "ctr(camellia)",
4609 .test
= alg_test_skcipher
,
4611 .cipher
= __VECS(camellia_ctr_tv_template
)
4614 .alg
= "ctr(cast5)",
4615 .test
= alg_test_skcipher
,
4617 .cipher
= __VECS(cast5_ctr_tv_template
)
4620 .alg
= "ctr(cast6)",
4621 .test
= alg_test_skcipher
,
4623 .cipher
= __VECS(cast6_ctr_tv_template
)
4627 .test
= alg_test_skcipher
,
4629 .cipher
= __VECS(des_ctr_tv_template
)
4632 .alg
= "ctr(des3_ede)",
4633 .test
= alg_test_skcipher
,
4635 .cipher
= __VECS(des3_ede_ctr_tv_template
)
4638 /* Same as ctr(aes) except the key is stored in
4639 * hardware secure memory which we reference by index
4642 .test
= alg_test_null
,
4646 /* Same as ctr(sm4) except the key is stored in
4647 * hardware secure memory which we reference by index
4650 .test
= alg_test_null
,
4652 .alg
= "ctr(serpent)",
4653 .test
= alg_test_skcipher
,
4655 .cipher
= __VECS(serpent_ctr_tv_template
)
4659 .test
= alg_test_skcipher
,
4661 .cipher
= __VECS(sm4_ctr_tv_template
)
4664 .alg
= "ctr(twofish)",
4665 .test
= alg_test_skcipher
,
4667 .cipher
= __VECS(tf_ctr_tv_template
)
4670 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
4671 .alg
= "ctr-paes-s390",
4673 .test
= alg_test_skcipher
,
4675 .cipher
= __VECS(aes_ctr_tv_template
)
4679 .alg
= "cts(cbc(aes))",
4680 .test
= alg_test_skcipher
,
4683 .cipher
= __VECS(cts_mode_tv_template
)
4686 /* Same as cts(cbc((aes)) except the key is stored in
4687 * hardware secure memory which we reference by index
4689 .alg
= "cts(cbc(paes))",
4690 .test
= alg_test_null
,
4693 .alg
= "curve25519",
4694 .test
= alg_test_kpp
,
4696 .kpp
= __VECS(curve25519_tv_template
)
4700 .test
= alg_test_comp
,
4704 .comp
= __VECS(deflate_comp_tv_template
),
4705 .decomp
= __VECS(deflate_decomp_tv_template
)
4710 .test
= alg_test_kpp
,
4712 .kpp
= __VECS(dh_tv_template
)
4715 .alg
= "digest_null",
4716 .test
= alg_test_null
,
4718 .alg
= "drbg_nopr_ctr_aes128",
4719 .test
= alg_test_drbg
,
4722 .drbg
= __VECS(drbg_nopr_ctr_aes128_tv_template
)
4725 .alg
= "drbg_nopr_ctr_aes192",
4726 .test
= alg_test_drbg
,
4729 .drbg
= __VECS(drbg_nopr_ctr_aes192_tv_template
)
4732 .alg
= "drbg_nopr_ctr_aes256",
4733 .test
= alg_test_drbg
,
4736 .drbg
= __VECS(drbg_nopr_ctr_aes256_tv_template
)
4740 * There is no need to specifically test the DRBG with every
4741 * backend cipher -- covered by drbg_nopr_hmac_sha256 test
4743 .alg
= "drbg_nopr_hmac_sha1",
4745 .test
= alg_test_null
,
4747 .alg
= "drbg_nopr_hmac_sha256",
4748 .test
= alg_test_drbg
,
4751 .drbg
= __VECS(drbg_nopr_hmac_sha256_tv_template
)
4754 /* covered by drbg_nopr_hmac_sha256 test */
4755 .alg
= "drbg_nopr_hmac_sha384",
4757 .test
= alg_test_null
,
4759 .alg
= "drbg_nopr_hmac_sha512",
4760 .test
= alg_test_drbg
,
4763 .drbg
= __VECS(drbg_nopr_hmac_sha512_tv_template
)
4766 .alg
= "drbg_nopr_sha1",
4768 .test
= alg_test_null
,
4770 .alg
= "drbg_nopr_sha256",
4771 .test
= alg_test_drbg
,
4774 .drbg
= __VECS(drbg_nopr_sha256_tv_template
)
4777 /* covered by drbg_nopr_sha256 test */
4778 .alg
= "drbg_nopr_sha384",
4780 .test
= alg_test_null
,
4782 .alg
= "drbg_nopr_sha512",
4784 .test
= alg_test_null
,
4786 .alg
= "drbg_pr_ctr_aes128",
4787 .test
= alg_test_drbg
,
4790 .drbg
= __VECS(drbg_pr_ctr_aes128_tv_template
)
4793 /* covered by drbg_pr_ctr_aes128 test */
4794 .alg
= "drbg_pr_ctr_aes192",
4796 .test
= alg_test_null
,
4798 .alg
= "drbg_pr_ctr_aes256",
4800 .test
= alg_test_null
,
4802 .alg
= "drbg_pr_hmac_sha1",
4804 .test
= alg_test_null
,
4806 .alg
= "drbg_pr_hmac_sha256",
4807 .test
= alg_test_drbg
,
4810 .drbg
= __VECS(drbg_pr_hmac_sha256_tv_template
)
4813 /* covered by drbg_pr_hmac_sha256 test */
4814 .alg
= "drbg_pr_hmac_sha384",
4816 .test
= alg_test_null
,
4818 .alg
= "drbg_pr_hmac_sha512",
4819 .test
= alg_test_null
,
4822 .alg
= "drbg_pr_sha1",
4824 .test
= alg_test_null
,
4826 .alg
= "drbg_pr_sha256",
4827 .test
= alg_test_drbg
,
4830 .drbg
= __VECS(drbg_pr_sha256_tv_template
)
4833 /* covered by drbg_pr_sha256 test */
4834 .alg
= "drbg_pr_sha384",
4836 .test
= alg_test_null
,
4838 .alg
= "drbg_pr_sha512",
4840 .test
= alg_test_null
,
4843 .test
= alg_test_skcipher
,
4846 .cipher
= __VECS(aes_tv_template
)
4849 .alg
= "ecb(anubis)",
4850 .test
= alg_test_skcipher
,
4852 .cipher
= __VECS(anubis_tv_template
)
4856 .generic_driver
= "ecb(arc4)-generic",
4857 .test
= alg_test_skcipher
,
4859 .cipher
= __VECS(arc4_tv_template
)
4862 .alg
= "ecb(blowfish)",
4863 .test
= alg_test_skcipher
,
4865 .cipher
= __VECS(bf_tv_template
)
4868 .alg
= "ecb(camellia)",
4869 .test
= alg_test_skcipher
,
4871 .cipher
= __VECS(camellia_tv_template
)
4874 .alg
= "ecb(cast5)",
4875 .test
= alg_test_skcipher
,
4877 .cipher
= __VECS(cast5_tv_template
)
4880 .alg
= "ecb(cast6)",
4881 .test
= alg_test_skcipher
,
4883 .cipher
= __VECS(cast6_tv_template
)
4886 .alg
= "ecb(cipher_null)",
4887 .test
= alg_test_null
,
4891 .test
= alg_test_skcipher
,
4893 .cipher
= __VECS(des_tv_template
)
4896 .alg
= "ecb(des3_ede)",
4897 .test
= alg_test_skcipher
,
4899 .cipher
= __VECS(des3_ede_tv_template
)
4902 .alg
= "ecb(fcrypt)",
4903 .test
= alg_test_skcipher
,
4906 .vecs
= fcrypt_pcbc_tv_template
,
4911 .alg
= "ecb(khazad)",
4912 .test
= alg_test_skcipher
,
4914 .cipher
= __VECS(khazad_tv_template
)
4917 /* Same as ecb(aes) except the key is stored in
4918 * hardware secure memory which we reference by index
4921 .test
= alg_test_null
,
4925 .test
= alg_test_skcipher
,
4927 .cipher
= __VECS(seed_tv_template
)
4930 .alg
= "ecb(serpent)",
4931 .test
= alg_test_skcipher
,
4933 .cipher
= __VECS(serpent_tv_template
)
4937 .test
= alg_test_skcipher
,
4939 .cipher
= __VECS(sm4_tv_template
)
4943 .test
= alg_test_skcipher
,
4945 .cipher
= __VECS(tea_tv_template
)
4948 .alg
= "ecb(twofish)",
4949 .test
= alg_test_skcipher
,
4951 .cipher
= __VECS(tf_tv_template
)
4955 .test
= alg_test_skcipher
,
4957 .cipher
= __VECS(xeta_tv_template
)
4961 .test
= alg_test_skcipher
,
4963 .cipher
= __VECS(xtea_tv_template
)
4966 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
4967 .alg
= "ecb-paes-s390",
4969 .test
= alg_test_skcipher
,
4971 .cipher
= __VECS(aes_tv_template
)
4975 .alg
= "ecdh-nist-p192",
4976 .test
= alg_test_kpp
,
4978 .kpp
= __VECS(ecdh_p192_tv_template
)
4981 .alg
= "ecdh-nist-p256",
4982 .test
= alg_test_kpp
,
4985 .kpp
= __VECS(ecdh_p256_tv_template
)
4988 .alg
= "ecdh-nist-p384",
4989 .test
= alg_test_kpp
,
4992 .kpp
= __VECS(ecdh_p384_tv_template
)
4995 .alg
= "ecdsa-nist-p192",
4996 .test
= alg_test_akcipher
,
4998 .akcipher
= __VECS(ecdsa_nist_p192_tv_template
)
5001 .alg
= "ecdsa-nist-p256",
5002 .test
= alg_test_akcipher
,
5004 .akcipher
= __VECS(ecdsa_nist_p256_tv_template
)
5007 .alg
= "ecdsa-nist-p384",
5008 .test
= alg_test_akcipher
,
5010 .akcipher
= __VECS(ecdsa_nist_p384_tv_template
)
5014 .test
= alg_test_akcipher
,
5016 .akcipher
= __VECS(ecrdsa_tv_template
)
5019 .alg
= "essiv(authenc(hmac(sha256),cbc(aes)),sha256)",
5020 .test
= alg_test_aead
,
5023 .aead
= __VECS(essiv_hmac_sha256_aes_cbc_tv_temp
)
5026 .alg
= "essiv(cbc(aes),sha256)",
5027 .test
= alg_test_skcipher
,
5030 .cipher
= __VECS(essiv_aes_cbc_tv_template
)
5033 #if IS_ENABLED(CONFIG_CRYPTO_DH_RFC7919_GROUPS)
5034 .alg
= "ffdhe2048(dh)",
5035 .test
= alg_test_kpp
,
5038 .kpp
= __VECS(ffdhe2048_dh_tv_template
)
5041 .alg
= "ffdhe3072(dh)",
5042 .test
= alg_test_kpp
,
5045 .kpp
= __VECS(ffdhe3072_dh_tv_template
)
5048 .alg
= "ffdhe4096(dh)",
5049 .test
= alg_test_kpp
,
5052 .kpp
= __VECS(ffdhe4096_dh_tv_template
)
5055 .alg
= "ffdhe6144(dh)",
5056 .test
= alg_test_kpp
,
5059 .kpp
= __VECS(ffdhe6144_dh_tv_template
)
5062 .alg
= "ffdhe8192(dh)",
5063 .test
= alg_test_kpp
,
5066 .kpp
= __VECS(ffdhe8192_dh_tv_template
)
5069 #endif /* CONFIG_CRYPTO_DH_RFC7919_GROUPS */
5071 .generic_driver
= "gcm_base(ctr(aes-generic),ghash-generic)",
5072 .test
= alg_test_aead
,
5075 .aead
= __VECS(aes_gcm_tv_template
)
5079 .generic_driver
= "gcm_base(ctr(sm4-generic),ghash-generic)",
5080 .test
= alg_test_aead
,
5082 .aead
= __VECS(sm4_gcm_tv_template
)
5086 .test
= alg_test_hash
,
5089 .hash
= __VECS(ghash_tv_template
)
5093 .test
= alg_test_hash
,
5095 .hash
= __VECS(hmac_md5_tv_template
)
5098 .alg
= "hmac(rmd160)",
5099 .test
= alg_test_hash
,
5101 .hash
= __VECS(hmac_rmd160_tv_template
)
5104 .alg
= "hmac(sha1)",
5105 .test
= alg_test_hash
,
5108 .hash
= __VECS(hmac_sha1_tv_template
)
5111 .alg
= "hmac(sha224)",
5112 .test
= alg_test_hash
,
5115 .hash
= __VECS(hmac_sha224_tv_template
)
5118 .alg
= "hmac(sha256)",
5119 .test
= alg_test_hash
,
5122 .hash
= __VECS(hmac_sha256_tv_template
)
5125 .alg
= "hmac(sha3-224)",
5126 .test
= alg_test_hash
,
5129 .hash
= __VECS(hmac_sha3_224_tv_template
)
5132 .alg
= "hmac(sha3-256)",
5133 .test
= alg_test_hash
,
5136 .hash
= __VECS(hmac_sha3_256_tv_template
)
5139 .alg
= "hmac(sha3-384)",
5140 .test
= alg_test_hash
,
5143 .hash
= __VECS(hmac_sha3_384_tv_template
)
5146 .alg
= "hmac(sha3-512)",
5147 .test
= alg_test_hash
,
5150 .hash
= __VECS(hmac_sha3_512_tv_template
)
5153 .alg
= "hmac(sha384)",
5154 .test
= alg_test_hash
,
5157 .hash
= __VECS(hmac_sha384_tv_template
)
5160 .alg
= "hmac(sha512)",
5161 .test
= alg_test_hash
,
5164 .hash
= __VECS(hmac_sha512_tv_template
)
5168 .test
= alg_test_hash
,
5170 .hash
= __VECS(hmac_sm3_tv_template
)
5173 .alg
= "hmac(streebog256)",
5174 .test
= alg_test_hash
,
5176 .hash
= __VECS(hmac_streebog256_tv_template
)
5179 .alg
= "hmac(streebog512)",
5180 .test
= alg_test_hash
,
5182 .hash
= __VECS(hmac_streebog512_tv_template
)
5185 .alg
= "jitterentropy_rng",
5187 .test
= alg_test_null
,
5190 .test
= alg_test_skcipher
,
5193 .cipher
= __VECS(aes_kw_tv_template
)
5197 .generic_driver
= "lrw(ecb(aes-generic))",
5198 .test
= alg_test_skcipher
,
5200 .cipher
= __VECS(aes_lrw_tv_template
)
5203 .alg
= "lrw(camellia)",
5204 .generic_driver
= "lrw(ecb(camellia-generic))",
5205 .test
= alg_test_skcipher
,
5207 .cipher
= __VECS(camellia_lrw_tv_template
)
5210 .alg
= "lrw(cast6)",
5211 .generic_driver
= "lrw(ecb(cast6-generic))",
5212 .test
= alg_test_skcipher
,
5214 .cipher
= __VECS(cast6_lrw_tv_template
)
5217 .alg
= "lrw(serpent)",
5218 .generic_driver
= "lrw(ecb(serpent-generic))",
5219 .test
= alg_test_skcipher
,
5221 .cipher
= __VECS(serpent_lrw_tv_template
)
5224 .alg
= "lrw(twofish)",
5225 .generic_driver
= "lrw(ecb(twofish-generic))",
5226 .test
= alg_test_skcipher
,
5228 .cipher
= __VECS(tf_lrw_tv_template
)
5232 .test
= alg_test_comp
,
5236 .comp
= __VECS(lz4_comp_tv_template
),
5237 .decomp
= __VECS(lz4_decomp_tv_template
)
5242 .test
= alg_test_comp
,
5246 .comp
= __VECS(lz4hc_comp_tv_template
),
5247 .decomp
= __VECS(lz4hc_decomp_tv_template
)
5252 .test
= alg_test_comp
,
5256 .comp
= __VECS(lzo_comp_tv_template
),
5257 .decomp
= __VECS(lzo_decomp_tv_template
)
5262 .test
= alg_test_comp
,
5266 .comp
= __VECS(lzorle_comp_tv_template
),
5267 .decomp
= __VECS(lzorle_decomp_tv_template
)
5272 .test
= alg_test_hash
,
5274 .hash
= __VECS(md4_tv_template
)
5278 .test
= alg_test_hash
,
5280 .hash
= __VECS(md5_tv_template
)
5283 .alg
= "michael_mic",
5284 .test
= alg_test_hash
,
5286 .hash
= __VECS(michael_mic_tv_template
)
5289 .alg
= "nhpoly1305",
5290 .test
= alg_test_hash
,
5292 .hash
= __VECS(nhpoly1305_tv_template
)
5296 .test
= alg_test_skcipher
,
5299 .cipher
= __VECS(aes_ofb_tv_template
)
5302 /* Same as ofb(aes) except the key is stored in
5303 * hardware secure memory which we reference by index
5306 .test
= alg_test_null
,
5310 .test
= alg_test_skcipher
,
5312 .cipher
= __VECS(sm4_ofb_tv_template
)
5315 .alg
= "pcbc(fcrypt)",
5316 .test
= alg_test_skcipher
,
5318 .cipher
= __VECS(fcrypt_pcbc_tv_template
)
5321 .alg
= "pkcs1pad(rsa,sha224)",
5322 .test
= alg_test_null
,
5325 .alg
= "pkcs1pad(rsa,sha256)",
5326 .test
= alg_test_akcipher
,
5329 .akcipher
= __VECS(pkcs1pad_rsa_tv_template
)
5332 .alg
= "pkcs1pad(rsa,sha384)",
5333 .test
= alg_test_null
,
5336 .alg
= "pkcs1pad(rsa,sha512)",
5337 .test
= alg_test_null
,
5341 .test
= alg_test_hash
,
5343 .hash
= __VECS(poly1305_tv_template
)
5346 .alg
= "rfc3686(ctr(aes))",
5347 .test
= alg_test_skcipher
,
5350 .cipher
= __VECS(aes_ctr_rfc3686_tv_template
)
5353 .alg
= "rfc3686(ctr(sm4))",
5354 .test
= alg_test_skcipher
,
5356 .cipher
= __VECS(sm4_ctr_rfc3686_tv_template
)
5359 .alg
= "rfc4106(gcm(aes))",
5360 .generic_driver
= "rfc4106(gcm_base(ctr(aes-generic),ghash-generic))",
5361 .test
= alg_test_aead
,
5365 ____VECS(aes_gcm_rfc4106_tv_template
),
5366 .einval_allowed
= 1,
5371 .alg
= "rfc4309(ccm(aes))",
5372 .generic_driver
= "rfc4309(ccm_base(ctr(aes-generic),cbcmac(aes-generic)))",
5373 .test
= alg_test_aead
,
5377 ____VECS(aes_ccm_rfc4309_tv_template
),
5378 .einval_allowed
= 1,
5383 .alg
= "rfc4543(gcm(aes))",
5384 .generic_driver
= "rfc4543(gcm_base(ctr(aes-generic),ghash-generic))",
5385 .test
= alg_test_aead
,
5388 ____VECS(aes_gcm_rfc4543_tv_template
),
5389 .einval_allowed
= 1,
5394 .alg
= "rfc7539(chacha20,poly1305)",
5395 .test
= alg_test_aead
,
5397 .aead
= __VECS(rfc7539_tv_template
)
5400 .alg
= "rfc7539esp(chacha20,poly1305)",
5401 .test
= alg_test_aead
,
5404 ____VECS(rfc7539esp_tv_template
),
5405 .einval_allowed
= 1,
5411 .test
= alg_test_hash
,
5413 .hash
= __VECS(rmd160_tv_template
)
5417 .test
= alg_test_akcipher
,
5420 .akcipher
= __VECS(rsa_tv_template
)
5424 .test
= alg_test_hash
,
5427 .hash
= __VECS(sha1_tv_template
)
5431 .test
= alg_test_hash
,
5434 .hash
= __VECS(sha224_tv_template
)
5438 .test
= alg_test_hash
,
5441 .hash
= __VECS(sha256_tv_template
)
5445 .test
= alg_test_hash
,
5448 .hash
= __VECS(sha3_224_tv_template
)
5452 .test
= alg_test_hash
,
5455 .hash
= __VECS(sha3_256_tv_template
)
5459 .test
= alg_test_hash
,
5462 .hash
= __VECS(sha3_384_tv_template
)
5466 .test
= alg_test_hash
,
5469 .hash
= __VECS(sha3_512_tv_template
)
5473 .test
= alg_test_hash
,
5476 .hash
= __VECS(sha384_tv_template
)
5480 .test
= alg_test_hash
,
5483 .hash
= __VECS(sha512_tv_template
)
5487 .test
= alg_test_akcipher
,
5489 .akcipher
= __VECS(sm2_tv_template
)
5493 .test
= alg_test_hash
,
5495 .hash
= __VECS(sm3_tv_template
)
5498 .alg
= "streebog256",
5499 .test
= alg_test_hash
,
5501 .hash
= __VECS(streebog256_tv_template
)
5504 .alg
= "streebog512",
5505 .test
= alg_test_hash
,
5507 .hash
= __VECS(streebog512_tv_template
)
5510 .alg
= "vmac64(aes)",
5511 .test
= alg_test_hash
,
5513 .hash
= __VECS(vmac64_aes_tv_template
)
5517 .test
= alg_test_hash
,
5519 .hash
= __VECS(wp256_tv_template
)
5523 .test
= alg_test_hash
,
5525 .hash
= __VECS(wp384_tv_template
)
5529 .test
= alg_test_hash
,
5531 .hash
= __VECS(wp512_tv_template
)
5535 .test
= alg_test_hash
,
5537 .hash
= __VECS(aes_xcbc128_tv_template
)
5541 .test
= alg_test_skcipher
,
5543 .cipher
= __VECS(xchacha12_tv_template
)
5547 .test
= alg_test_skcipher
,
5549 .cipher
= __VECS(xchacha20_tv_template
)
5553 .generic_driver
= "xts(ecb(aes-generic))",
5554 .test
= alg_test_skcipher
,
5557 .cipher
= __VECS(aes_xts_tv_template
)
5560 .alg
= "xts(camellia)",
5561 .generic_driver
= "xts(ecb(camellia-generic))",
5562 .test
= alg_test_skcipher
,
5564 .cipher
= __VECS(camellia_xts_tv_template
)
5567 .alg
= "xts(cast6)",
5568 .generic_driver
= "xts(ecb(cast6-generic))",
5569 .test
= alg_test_skcipher
,
5571 .cipher
= __VECS(cast6_xts_tv_template
)
5574 /* Same as xts(aes) except the key is stored in
5575 * hardware secure memory which we reference by index
5578 .test
= alg_test_null
,
5581 .alg
= "xts(serpent)",
5582 .generic_driver
= "xts(ecb(serpent-generic))",
5583 .test
= alg_test_skcipher
,
5585 .cipher
= __VECS(serpent_xts_tv_template
)
5588 .alg
= "xts(twofish)",
5589 .generic_driver
= "xts(ecb(twofish-generic))",
5590 .test
= alg_test_skcipher
,
5592 .cipher
= __VECS(tf_xts_tv_template
)
5595 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
5596 .alg
= "xts-paes-s390",
5598 .test
= alg_test_skcipher
,
5600 .cipher
= __VECS(aes_xts_tv_template
)
5604 .alg
= "xts4096(paes)",
5605 .test
= alg_test_null
,
5608 .alg
= "xts512(paes)",
5609 .test
= alg_test_null
,
5613 .test
= alg_test_hash
,
5616 .hash
= __VECS(xxhash64_tv_template
)
5619 .alg
= "zlib-deflate",
5620 .test
= alg_test_comp
,
5624 .comp
= __VECS(zlib_deflate_comp_tv_template
),
5625 .decomp
= __VECS(zlib_deflate_decomp_tv_template
)
5630 .test
= alg_test_comp
,
5634 .comp
= __VECS(zstd_comp_tv_template
),
5635 .decomp
= __VECS(zstd_decomp_tv_template
)
5641 static void alg_check_test_descs_order(void)
5645 for (i
= 1; i
< ARRAY_SIZE(alg_test_descs
); i
++) {
5646 int diff
= strcmp(alg_test_descs
[i
- 1].alg
,
5647 alg_test_descs
[i
].alg
);
5649 if (WARN_ON(diff
> 0)) {
5650 pr_warn("testmgr: alg_test_descs entries in wrong order: '%s' before '%s'\n",
5651 alg_test_descs
[i
- 1].alg
,
5652 alg_test_descs
[i
].alg
);
5655 if (WARN_ON(diff
== 0)) {
5656 pr_warn("testmgr: duplicate alg_test_descs entry: '%s'\n",
5657 alg_test_descs
[i
].alg
);
5662 static void alg_check_testvec_configs(void)
5666 for (i
= 0; i
< ARRAY_SIZE(default_cipher_testvec_configs
); i
++)
5667 WARN_ON(!valid_testvec_config(
5668 &default_cipher_testvec_configs
[i
]));
5670 for (i
= 0; i
< ARRAY_SIZE(default_hash_testvec_configs
); i
++)
5671 WARN_ON(!valid_testvec_config(
5672 &default_hash_testvec_configs
[i
]));
5675 static void testmgr_onetime_init(void)
5677 alg_check_test_descs_order();
5678 alg_check_testvec_configs();
5680 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
5681 pr_warn("alg: extra crypto tests enabled. This is intended for developer use only.\n");
5685 static int alg_find_test(const char *alg
)
5688 int end
= ARRAY_SIZE(alg_test_descs
);
5690 while (start
< end
) {
5691 int i
= (start
+ end
) / 2;
5692 int diff
= strcmp(alg_test_descs
[i
].alg
, alg
);
5710 static int alg_fips_disabled(const char *driver
, const char *alg
)
5712 pr_info("alg: %s (%s) is disabled due to FIPS\n", alg
, driver
);
5717 int alg_test(const char *driver
, const char *alg
, u32 type
, u32 mask
)
5723 if (!fips_enabled
&& notests
) {
5724 printk_once(KERN_INFO
"alg: self-tests disabled\n");
5728 DO_ONCE(testmgr_onetime_init
);
5730 if ((type
& CRYPTO_ALG_TYPE_MASK
) == CRYPTO_ALG_TYPE_CIPHER
) {
5731 char nalg
[CRYPTO_MAX_ALG_NAME
];
5733 if (snprintf(nalg
, sizeof(nalg
), "ecb(%s)", alg
) >=
5735 return -ENAMETOOLONG
;
5737 i
= alg_find_test(nalg
);
5741 if (fips_enabled
&& !alg_test_descs
[i
].fips_allowed
)
5744 rc
= alg_test_cipher(alg_test_descs
+ i
, driver
, type
, mask
);
5748 i
= alg_find_test(alg
);
5749 j
= alg_find_test(driver
);
5754 if (j
>= 0 && !alg_test_descs
[j
].fips_allowed
)
5757 if (i
>= 0 && !alg_test_descs
[i
].fips_allowed
)
5763 rc
|= alg_test_descs
[i
].test(alg_test_descs
+ i
, driver
,
5765 if (j
>= 0 && j
!= i
)
5766 rc
|= alg_test_descs
[j
].test(alg_test_descs
+ j
, driver
,
5771 if (fips_enabled
|| panic_on_fail
) {
5773 panic("alg: self-tests for %s (%s) failed in %s mode!\n",
5775 fips_enabled
? "fips" : "panic_on_fail");
5777 WARN(1, "alg: self-tests for %s (%s) failed (rc=%d)",
5781 pr_info("alg: self-tests for %s (%s) passed\n",
5788 printk(KERN_INFO
"alg: No test for %s (%s)\n", alg
, driver
);
5790 if (type
& CRYPTO_ALG_FIPS_INTERNAL
)
5791 return alg_fips_disabled(driver
, alg
);
5795 return alg_fips_disabled(driver
, alg
);
5798 #endif /* CONFIG_CRYPTO_MANAGER_DISABLE_TESTS */
5800 EXPORT_SYMBOL_GPL(alg_test
);