testmgr.c 145 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215421642174218421942204221422242234224422542264227422842294230423142324233423442354236423742384239424042414242424342444245424642474248424942504251425242534254425542564257425842594260426142624263426442654266426742684269427042714272427342744275427642774278427942804281428242834284428542864287428842894290429142924293429442954296429742984299430043014302430343044305430643074308430943104311431243134314431543164317431843194320432143224323432443254326432743284329433043314332433343344335433643374338433943404341434243434344434543464347434843494350435143524353435443554356435743584359436043614362436343644365436643674368436943704371437243734374437543764377437843794380438143824383438443854386438743884389439043914392439343944395439643974398439944004401440244034404440544064407440844094410441144124413441444154416441744184419442044214422442344244425442644274428442944304431443244334434443544364437443844394440444144424443444444454446444744484449445044514452445344544455445644574458445944604461446244634464446544664467446844694470447144724473447444754476447744784479448044814482448344844485448644874488448944904491449244934494449544964497449844994500450145024503450445054506450745084509451045114512451345144515451645174518451945204521452245234524452545264527452845294530453145324533453445354536453745384539454045414542454345444545454645474548454945504551455245534554455545564557455845594560456145624563456445654566456745684569457045714572457345744575457645774578457945804581458245834584458545864587458845894590459145924593459445954596459745984599460046014602460346044605460646074608460946104611461246134614461546164617461846194620462146224623462446254626462746284629463046314632463346344635463646374638463946404641464246434644464546464647464846494650465146524653465446554656465746584659466046614662466346644665466646674668466946704671467246734674467546764677467846794680468146824683468446854686468746884689469046914692469346944695469646974698469947004701470247034704470547064707470847094710471147124713471447154716471747184719472047214722472347244725472647274728472947304731473247334734473547364737473847394740474147424743474447454746474747484749475047514752475347544755475647574758475947604761476247634764476547664767476847694770477147724773477447754776477747784779478047814782478347844785478647874788478947904791479247934794479547964797479847994800480148024803480448054806480748084809481048114812481348144815481648174818481948204821482248234824482548264827482848294830483148324833483448354836483748384839484048414842484348444845484648474848484948504851485248534854485548564857485848594860486148624863486448654866486748684869487048714872487348744875487648774878487948804881488248834884488548864887488848894890489148924893489448954896489748984899490049014902490349044905490649074908490949104911491249134914491549164917491849194920492149224923492449254926492749284929493049314932493349344935493649374938493949404941494249434944494549464947494849494950495149524953495449554956495749584959496049614962496349644965496649674968496949704971497249734974497549764977497849794980498149824983498449854986498749884989499049914992499349944995499649974998499950005001500250035004500550065007500850095010501150125013501450155016501750185019502050215022502350245025502650275028502950305031503250335034503550365037503850395040504150425043504450455046504750485049505050515052505350545055505650575058505950605061506250635064506550665067506850695070507150725073507450755076507750785079508050815082508350845085508650875088508950905091509250935094509550965097509850995100510151025103510451055106510751085109511051115112511351145115511651175118511951205121512251235124512551265127512851295130513151325133513451355136513751385139514051415142514351445145514651475148514951505151515251535154515551565157515851595160516151625163516451655166516751685169517051715172517351745175517651775178517951805181518251835184518551865187518851895190519151925193519451955196519751985199520052015202520352045205520652075208520952105211521252135214521552165217521852195220522152225223522452255226522752285229523052315232523352345235523652375238523952405241524252435244524552465247524852495250525152525253525452555256525752585259526052615262526352645265526652675268526952705271527252735274527552765277527852795280528152825283528452855286528752885289529052915292529352945295529652975298529953005301530253035304530553065307530853095310531153125313531453155316531753185319532053215322532353245325532653275328532953305331533253335334533553365337533853395340534153425343534453455346534753485349535053515352535353545355535653575358535953605361536253635364536553665367536853695370537153725373537453755376537753785379538053815382538353845385538653875388538953905391539253935394539553965397539853995400540154025403540454055406540754085409541054115412541354145415541654175418541954205421542254235424542554265427542854295430543154325433543454355436543754385439544054415442544354445445544654475448544954505451545254535454545554565457545854595460546154625463546454655466546754685469547054715472547354745475547654775478547954805481548254835484548554865487548854895490549154925493549454955496549754985499550055015502550355045505550655075508550955105511551255135514551555165517551855195520552155225523552455255526552755285529553055315532553355345535553655375538553955405541554255435544554555465547554855495550555155525553555455555556555755585559556055615562556355645565556655675568556955705571557255735574557555765577557855795580558155825583558455855586558755885589559055915592559355945595559655975598559956005601560256035604560556065607560856095610561156125613561456155616561756185619562056215622562356245625562656275628562956305631563256335634563556365637563856395640564156425643564456455646564756485649565056515652565356545655565656575658565956605661566256635664566556665667566856695670567156725673567456755676567756785679568056815682568356845685568656875688568956905691569256935694569556965697569856995700570157025703
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * Algorithm testing framework and tests.
  4. *
  5. * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
  6. * Copyright (c) 2002 Jean-Francois Dive <jef@linuxbe.org>
  7. * Copyright (c) 2007 Nokia Siemens Networks
  8. * Copyright (c) 2008 Herbert Xu <herbert@gondor.apana.org.au>
  9. * Copyright (c) 2019 Google LLC
  10. *
  11. * Updated RFC4106 AES-GCM testing.
  12. * Authors: Aidan O'Mahony (aidan.o.mahony@intel.com)
  13. * Adrian Hoban <adrian.hoban@intel.com>
  14. * Gabriele Paoloni <gabriele.paoloni@intel.com>
  15. * Tadeusz Struk (tadeusz.struk@intel.com)
  16. * Copyright (c) 2010, Intel Corporation.
  17. */
  18. #include <crypto/aead.h>
  19. #include <crypto/hash.h>
  20. #include <crypto/skcipher.h>
  21. #include <linux/err.h>
  22. #include <linux/fips.h>
  23. #include <linux/module.h>
  24. #include <linux/once.h>
  25. #include <linux/random.h>
  26. #include <linux/scatterlist.h>
  27. #include <linux/slab.h>
  28. #include <linux/string.h>
  29. #include <linux/uio.h>
  30. #include <crypto/rng.h>
  31. #include <crypto/drbg.h>
  32. #include <crypto/akcipher.h>
  33. #include <crypto/kpp.h>
  34. #include <crypto/acompress.h>
  35. #include <crypto/internal/cipher.h>
  36. #include <crypto/internal/simd.h>
  37. #include "internal.h"
  38. MODULE_IMPORT_NS(CRYPTO_INTERNAL);
  39. static bool notests;
  40. module_param(notests, bool, 0644);
  41. MODULE_PARM_DESC(notests, "disable crypto self-tests");
  42. static bool panic_on_fail;
  43. module_param(panic_on_fail, bool, 0444);
  44. #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
  45. static bool noextratests;
  46. module_param(noextratests, bool, 0644);
  47. MODULE_PARM_DESC(noextratests, "disable expensive crypto self-tests");
  48. static unsigned int fuzz_iterations = 100;
  49. module_param(fuzz_iterations, uint, 0644);
  50. MODULE_PARM_DESC(fuzz_iterations, "number of fuzz test iterations");
  51. DEFINE_PER_CPU(bool, crypto_simd_disabled_for_test);
  52. EXPORT_PER_CPU_SYMBOL_GPL(crypto_simd_disabled_for_test);
  53. #endif
  54. #ifdef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS
  55. /* a perfect nop */
  56. int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
  57. {
  58. return 0;
  59. }
  60. #else
  61. #include "testmgr.h"
  62. /*
  63. * Need slab memory for testing (size in number of pages).
  64. */
  65. #define XBUFSIZE 8
  66. /*
  67. * Used by test_cipher()
  68. */
  69. #define ENCRYPT 1
  70. #define DECRYPT 0
  71. struct aead_test_suite {
  72. const struct aead_testvec *vecs;
  73. unsigned int count;
  74. /*
  75. * Set if trying to decrypt an inauthentic ciphertext with this
  76. * algorithm might result in EINVAL rather than EBADMSG, due to other
  77. * validation the algorithm does on the inputs such as length checks.
  78. */
  79. unsigned int einval_allowed : 1;
  80. /*
  81. * Set if this algorithm requires that the IV be located at the end of
  82. * the AAD buffer, in addition to being given in the normal way. The
  83. * behavior when the two IV copies differ is implementation-defined.
  84. */
  85. unsigned int aad_iv : 1;
  86. };
  87. struct cipher_test_suite {
  88. const struct cipher_testvec *vecs;
  89. unsigned int count;
  90. };
  91. struct comp_test_suite {
  92. struct {
  93. const struct comp_testvec *vecs;
  94. unsigned int count;
  95. } comp, decomp;
  96. };
  97. struct hash_test_suite {
  98. const struct hash_testvec *vecs;
  99. unsigned int count;
  100. };
  101. struct cprng_test_suite {
  102. const struct cprng_testvec *vecs;
  103. unsigned int count;
  104. };
  105. struct drbg_test_suite {
  106. const struct drbg_testvec *vecs;
  107. unsigned int count;
  108. };
  109. struct akcipher_test_suite {
  110. const struct akcipher_testvec *vecs;
  111. unsigned int count;
  112. };
  113. struct kpp_test_suite {
  114. const struct kpp_testvec *vecs;
  115. unsigned int count;
  116. };
  117. struct alg_test_desc {
  118. const char *alg;
  119. const char *generic_driver;
  120. int (*test)(const struct alg_test_desc *desc, const char *driver,
  121. u32 type, u32 mask);
  122. int fips_allowed; /* set if alg is allowed in fips mode */
  123. union {
  124. struct aead_test_suite aead;
  125. struct cipher_test_suite cipher;
  126. struct comp_test_suite comp;
  127. struct hash_test_suite hash;
  128. struct cprng_test_suite cprng;
  129. struct drbg_test_suite drbg;
  130. struct akcipher_test_suite akcipher;
  131. struct kpp_test_suite kpp;
  132. } suite;
  133. };
  134. static void hexdump(unsigned char *buf, unsigned int len)
  135. {
  136. print_hex_dump(KERN_CONT, "", DUMP_PREFIX_OFFSET,
  137. 16, 1,
  138. buf, len, false);
  139. }
  140. static int __testmgr_alloc_buf(char *buf[XBUFSIZE], int order)
  141. {
  142. int i;
  143. for (i = 0; i < XBUFSIZE; i++) {
  144. buf[i] = (char *)__get_free_pages(GFP_KERNEL, order);
  145. if (!buf[i])
  146. goto err_free_buf;
  147. }
  148. return 0;
  149. err_free_buf:
  150. while (i-- > 0)
  151. free_pages((unsigned long)buf[i], order);
  152. return -ENOMEM;
  153. }
  154. static int testmgr_alloc_buf(char *buf[XBUFSIZE])
  155. {
  156. return __testmgr_alloc_buf(buf, 0);
  157. }
  158. static void __testmgr_free_buf(char *buf[XBUFSIZE], int order)
  159. {
  160. int i;
  161. for (i = 0; i < XBUFSIZE; i++)
  162. free_pages((unsigned long)buf[i], order);
  163. }
  164. static void testmgr_free_buf(char *buf[XBUFSIZE])
  165. {
  166. __testmgr_free_buf(buf, 0);
  167. }
  168. #define TESTMGR_POISON_BYTE 0xfe
  169. #define TESTMGR_POISON_LEN 16
  170. static inline void testmgr_poison(void *addr, size_t len)
  171. {
  172. memset(addr, TESTMGR_POISON_BYTE, len);
  173. }
  174. /* Is the memory region still fully poisoned? */
  175. static inline bool testmgr_is_poison(const void *addr, size_t len)
  176. {
  177. return memchr_inv(addr, TESTMGR_POISON_BYTE, len) == NULL;
  178. }
  179. /* flush type for hash algorithms */
  180. enum flush_type {
  181. /* merge with update of previous buffer(s) */
  182. FLUSH_TYPE_NONE = 0,
  183. /* update with previous buffer(s) before doing this one */
  184. FLUSH_TYPE_FLUSH,
  185. /* likewise, but also export and re-import the intermediate state */
  186. FLUSH_TYPE_REIMPORT,
  187. };
  188. /* finalization function for hash algorithms */
  189. enum finalization_type {
  190. FINALIZATION_TYPE_FINAL, /* use final() */
  191. FINALIZATION_TYPE_FINUP, /* use finup() */
  192. FINALIZATION_TYPE_DIGEST, /* use digest() */
  193. };
  194. #define TEST_SG_TOTAL 10000
  195. /**
  196. * struct test_sg_division - description of a scatterlist entry
  197. *
  198. * This struct describes one entry of a scatterlist being constructed to check a
  199. * crypto test vector.
  200. *
  201. * @proportion_of_total: length of this chunk relative to the total length,
  202. * given as a proportion out of TEST_SG_TOTAL so that it
  203. * scales to fit any test vector
  204. * @offset: byte offset into a 2-page buffer at which this chunk will start
  205. * @offset_relative_to_alignmask: if true, add the algorithm's alignmask to the
  206. * @offset
  207. * @flush_type: for hashes, whether an update() should be done now vs.
  208. * continuing to accumulate data
  209. * @nosimd: if doing the pending update(), do it with SIMD disabled?
  210. */
  211. struct test_sg_division {
  212. unsigned int proportion_of_total;
  213. unsigned int offset;
  214. bool offset_relative_to_alignmask;
  215. enum flush_type flush_type;
  216. bool nosimd;
  217. };
  218. /**
  219. * struct testvec_config - configuration for testing a crypto test vector
  220. *
  221. * This struct describes the data layout and other parameters with which each
  222. * crypto test vector can be tested.
  223. *
  224. * @name: name of this config, logged for debugging purposes if a test fails
  225. * @inplace: operate on the data in-place, if applicable for the algorithm type?
  226. * @req_flags: extra request_flags, e.g. CRYPTO_TFM_REQ_MAY_SLEEP
  227. * @src_divs: description of how to arrange the source scatterlist
  228. * @dst_divs: description of how to arrange the dst scatterlist, if applicable
  229. * for the algorithm type. Defaults to @src_divs if unset.
  230. * @iv_offset: misalignment of the IV in the range [0..MAX_ALGAPI_ALIGNMASK+1],
  231. * where 0 is aligned to a 2*(MAX_ALGAPI_ALIGNMASK+1) byte boundary
  232. * @iv_offset_relative_to_alignmask: if true, add the algorithm's alignmask to
  233. * the @iv_offset
  234. * @key_offset: misalignment of the key, where 0 is default alignment
  235. * @key_offset_relative_to_alignmask: if true, add the algorithm's alignmask to
  236. * the @key_offset
  237. * @finalization_type: what finalization function to use for hashes
  238. * @nosimd: execute with SIMD disabled? Requires !CRYPTO_TFM_REQ_MAY_SLEEP.
  239. */
  240. struct testvec_config {
  241. const char *name;
  242. bool inplace;
  243. u32 req_flags;
  244. struct test_sg_division src_divs[XBUFSIZE];
  245. struct test_sg_division dst_divs[XBUFSIZE];
  246. unsigned int iv_offset;
  247. unsigned int key_offset;
  248. bool iv_offset_relative_to_alignmask;
  249. bool key_offset_relative_to_alignmask;
  250. enum finalization_type finalization_type;
  251. bool nosimd;
  252. };
  253. #define TESTVEC_CONFIG_NAMELEN 192
  254. /*
  255. * The following are the lists of testvec_configs to test for each algorithm
  256. * type when the basic crypto self-tests are enabled, i.e. when
  257. * CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is unset. They aim to provide good test
  258. * coverage, while keeping the test time much shorter than the full fuzz tests
  259. * so that the basic tests can be enabled in a wider range of circumstances.
  260. */
  261. /* Configs for skciphers and aeads */
  262. static const struct testvec_config default_cipher_testvec_configs[] = {
  263. {
  264. .name = "in-place",
  265. .inplace = true,
  266. .src_divs = { { .proportion_of_total = 10000 } },
  267. }, {
  268. .name = "out-of-place",
  269. .src_divs = { { .proportion_of_total = 10000 } },
  270. }, {
  271. .name = "unaligned buffer, offset=1",
  272. .src_divs = { { .proportion_of_total = 10000, .offset = 1 } },
  273. .iv_offset = 1,
  274. .key_offset = 1,
  275. }, {
  276. .name = "buffer aligned only to alignmask",
  277. .src_divs = {
  278. {
  279. .proportion_of_total = 10000,
  280. .offset = 1,
  281. .offset_relative_to_alignmask = true,
  282. },
  283. },
  284. .iv_offset = 1,
  285. .iv_offset_relative_to_alignmask = true,
  286. .key_offset = 1,
  287. .key_offset_relative_to_alignmask = true,
  288. }, {
  289. .name = "two even aligned splits",
  290. .src_divs = {
  291. { .proportion_of_total = 5000 },
  292. { .proportion_of_total = 5000 },
  293. },
  294. }, {
  295. .name = "uneven misaligned splits, may sleep",
  296. .req_flags = CRYPTO_TFM_REQ_MAY_SLEEP,
  297. .src_divs = {
  298. { .proportion_of_total = 1900, .offset = 33 },
  299. { .proportion_of_total = 3300, .offset = 7 },
  300. { .proportion_of_total = 4800, .offset = 18 },
  301. },
  302. .iv_offset = 3,
  303. .key_offset = 3,
  304. }, {
  305. .name = "misaligned splits crossing pages, inplace",
  306. .inplace = true,
  307. .src_divs = {
  308. {
  309. .proportion_of_total = 7500,
  310. .offset = PAGE_SIZE - 32
  311. }, {
  312. .proportion_of_total = 2500,
  313. .offset = PAGE_SIZE - 7
  314. },
  315. },
  316. }
  317. };
  318. static const struct testvec_config default_hash_testvec_configs[] = {
  319. {
  320. .name = "init+update+final aligned buffer",
  321. .src_divs = { { .proportion_of_total = 10000 } },
  322. .finalization_type = FINALIZATION_TYPE_FINAL,
  323. }, {
  324. .name = "init+finup aligned buffer",
  325. .src_divs = { { .proportion_of_total = 10000 } },
  326. .finalization_type = FINALIZATION_TYPE_FINUP,
  327. }, {
  328. .name = "digest aligned buffer",
  329. .src_divs = { { .proportion_of_total = 10000 } },
  330. .finalization_type = FINALIZATION_TYPE_DIGEST,
  331. }, {
  332. .name = "init+update+final misaligned buffer",
  333. .src_divs = { { .proportion_of_total = 10000, .offset = 1 } },
  334. .finalization_type = FINALIZATION_TYPE_FINAL,
  335. .key_offset = 1,
  336. }, {
  337. .name = "digest buffer aligned only to alignmask",
  338. .src_divs = {
  339. {
  340. .proportion_of_total = 10000,
  341. .offset = 1,
  342. .offset_relative_to_alignmask = true,
  343. },
  344. },
  345. .finalization_type = FINALIZATION_TYPE_DIGEST,
  346. .key_offset = 1,
  347. .key_offset_relative_to_alignmask = true,
  348. }, {
  349. .name = "init+update+update+final two even splits",
  350. .src_divs = {
  351. { .proportion_of_total = 5000 },
  352. {
  353. .proportion_of_total = 5000,
  354. .flush_type = FLUSH_TYPE_FLUSH,
  355. },
  356. },
  357. .finalization_type = FINALIZATION_TYPE_FINAL,
  358. }, {
  359. .name = "digest uneven misaligned splits, may sleep",
  360. .req_flags = CRYPTO_TFM_REQ_MAY_SLEEP,
  361. .src_divs = {
  362. { .proportion_of_total = 1900, .offset = 33 },
  363. { .proportion_of_total = 3300, .offset = 7 },
  364. { .proportion_of_total = 4800, .offset = 18 },
  365. },
  366. .finalization_type = FINALIZATION_TYPE_DIGEST,
  367. }, {
  368. .name = "digest misaligned splits crossing pages",
  369. .src_divs = {
  370. {
  371. .proportion_of_total = 7500,
  372. .offset = PAGE_SIZE - 32,
  373. }, {
  374. .proportion_of_total = 2500,
  375. .offset = PAGE_SIZE - 7,
  376. },
  377. },
  378. .finalization_type = FINALIZATION_TYPE_DIGEST,
  379. }, {
  380. .name = "import/export",
  381. .src_divs = {
  382. {
  383. .proportion_of_total = 6500,
  384. .flush_type = FLUSH_TYPE_REIMPORT,
  385. }, {
  386. .proportion_of_total = 3500,
  387. .flush_type = FLUSH_TYPE_REIMPORT,
  388. },
  389. },
  390. .finalization_type = FINALIZATION_TYPE_FINAL,
  391. }
  392. };
  393. static unsigned int count_test_sg_divisions(const struct test_sg_division *divs)
  394. {
  395. unsigned int remaining = TEST_SG_TOTAL;
  396. unsigned int ndivs = 0;
  397. do {
  398. remaining -= divs[ndivs++].proportion_of_total;
  399. } while (remaining);
  400. return ndivs;
  401. }
  402. #define SGDIVS_HAVE_FLUSHES BIT(0)
  403. #define SGDIVS_HAVE_NOSIMD BIT(1)
  404. static bool valid_sg_divisions(const struct test_sg_division *divs,
  405. unsigned int count, int *flags_ret)
  406. {
  407. unsigned int total = 0;
  408. unsigned int i;
  409. for (i = 0; i < count && total != TEST_SG_TOTAL; i++) {
  410. if (divs[i].proportion_of_total <= 0 ||
  411. divs[i].proportion_of_total > TEST_SG_TOTAL - total)
  412. return false;
  413. total += divs[i].proportion_of_total;
  414. if (divs[i].flush_type != FLUSH_TYPE_NONE)
  415. *flags_ret |= SGDIVS_HAVE_FLUSHES;
  416. if (divs[i].nosimd)
  417. *flags_ret |= SGDIVS_HAVE_NOSIMD;
  418. }
  419. return total == TEST_SG_TOTAL &&
  420. memchr_inv(&divs[i], 0, (count - i) * sizeof(divs[0])) == NULL;
  421. }
  422. /*
  423. * Check whether the given testvec_config is valid. This isn't strictly needed
  424. * since every testvec_config should be valid, but check anyway so that people
  425. * don't unknowingly add broken configs that don't do what they wanted.
  426. */
  427. static bool valid_testvec_config(const struct testvec_config *cfg)
  428. {
  429. int flags = 0;
  430. if (cfg->name == NULL)
  431. return false;
  432. if (!valid_sg_divisions(cfg->src_divs, ARRAY_SIZE(cfg->src_divs),
  433. &flags))
  434. return false;
  435. if (cfg->dst_divs[0].proportion_of_total) {
  436. if (!valid_sg_divisions(cfg->dst_divs,
  437. ARRAY_SIZE(cfg->dst_divs), &flags))
  438. return false;
  439. } else {
  440. if (memchr_inv(cfg->dst_divs, 0, sizeof(cfg->dst_divs)))
  441. return false;
  442. /* defaults to dst_divs=src_divs */
  443. }
  444. if (cfg->iv_offset +
  445. (cfg->iv_offset_relative_to_alignmask ? MAX_ALGAPI_ALIGNMASK : 0) >
  446. MAX_ALGAPI_ALIGNMASK + 1)
  447. return false;
  448. if ((flags & (SGDIVS_HAVE_FLUSHES | SGDIVS_HAVE_NOSIMD)) &&
  449. cfg->finalization_type == FINALIZATION_TYPE_DIGEST)
  450. return false;
  451. if ((cfg->nosimd || (flags & SGDIVS_HAVE_NOSIMD)) &&
  452. (cfg->req_flags & CRYPTO_TFM_REQ_MAY_SLEEP))
  453. return false;
  454. return true;
  455. }
  456. struct test_sglist {
  457. char *bufs[XBUFSIZE];
  458. struct scatterlist sgl[XBUFSIZE];
  459. struct scatterlist sgl_saved[XBUFSIZE];
  460. struct scatterlist *sgl_ptr;
  461. unsigned int nents;
  462. };
  463. static int init_test_sglist(struct test_sglist *tsgl)
  464. {
  465. return __testmgr_alloc_buf(tsgl->bufs, 1 /* two pages per buffer */);
  466. }
  467. static void destroy_test_sglist(struct test_sglist *tsgl)
  468. {
  469. return __testmgr_free_buf(tsgl->bufs, 1 /* two pages per buffer */);
  470. }
  471. /**
  472. * build_test_sglist() - build a scatterlist for a crypto test
  473. *
  474. * @tsgl: the scatterlist to build. @tsgl->bufs[] contains an array of 2-page
  475. * buffers which the scatterlist @tsgl->sgl[] will be made to point into.
  476. * @divs: the layout specification on which the scatterlist will be based
  477. * @alignmask: the algorithm's alignmask
  478. * @total_len: the total length of the scatterlist to build in bytes
  479. * @data: if non-NULL, the buffers will be filled with this data until it ends.
  480. * Otherwise the buffers will be poisoned. In both cases, some bytes
  481. * past the end of each buffer will be poisoned to help detect overruns.
  482. * @out_divs: if non-NULL, the test_sg_division to which each scatterlist entry
  483. * corresponds will be returned here. This will match @divs except
  484. * that divisions resolving to a length of 0 are omitted as they are
  485. * not included in the scatterlist.
  486. *
  487. * Return: 0 or a -errno value
  488. */
  489. static int build_test_sglist(struct test_sglist *tsgl,
  490. const struct test_sg_division *divs,
  491. const unsigned int alignmask,
  492. const unsigned int total_len,
  493. struct iov_iter *data,
  494. const struct test_sg_division *out_divs[XBUFSIZE])
  495. {
  496. struct {
  497. const struct test_sg_division *div;
  498. size_t length;
  499. } partitions[XBUFSIZE];
  500. const unsigned int ndivs = count_test_sg_divisions(divs);
  501. unsigned int len_remaining = total_len;
  502. unsigned int i;
  503. BUILD_BUG_ON(ARRAY_SIZE(partitions) != ARRAY_SIZE(tsgl->sgl));
  504. if (WARN_ON(ndivs > ARRAY_SIZE(partitions)))
  505. return -EINVAL;
  506. /* Calculate the (div, length) pairs */
  507. tsgl->nents = 0;
  508. for (i = 0; i < ndivs; i++) {
  509. unsigned int len_this_sg =
  510. min(len_remaining,
  511. (total_len * divs[i].proportion_of_total +
  512. TEST_SG_TOTAL / 2) / TEST_SG_TOTAL);
  513. if (len_this_sg != 0) {
  514. partitions[tsgl->nents].div = &divs[i];
  515. partitions[tsgl->nents].length = len_this_sg;
  516. tsgl->nents++;
  517. len_remaining -= len_this_sg;
  518. }
  519. }
  520. if (tsgl->nents == 0) {
  521. partitions[tsgl->nents].div = &divs[0];
  522. partitions[tsgl->nents].length = 0;
  523. tsgl->nents++;
  524. }
  525. partitions[tsgl->nents - 1].length += len_remaining;
  526. /* Set up the sgl entries and fill the data or poison */
  527. sg_init_table(tsgl->sgl, tsgl->nents);
  528. for (i = 0; i < tsgl->nents; i++) {
  529. unsigned int offset = partitions[i].div->offset;
  530. void *addr;
  531. if (partitions[i].div->offset_relative_to_alignmask)
  532. offset += alignmask;
  533. while (offset + partitions[i].length + TESTMGR_POISON_LEN >
  534. 2 * PAGE_SIZE) {
  535. if (WARN_ON(offset <= 0))
  536. return -EINVAL;
  537. offset /= 2;
  538. }
  539. addr = &tsgl->bufs[i][offset];
  540. sg_set_buf(&tsgl->sgl[i], addr, partitions[i].length);
  541. if (out_divs)
  542. out_divs[i] = partitions[i].div;
  543. if (data) {
  544. size_t copy_len, copied;
  545. copy_len = min(partitions[i].length, data->count);
  546. copied = copy_from_iter(addr, copy_len, data);
  547. if (WARN_ON(copied != copy_len))
  548. return -EINVAL;
  549. testmgr_poison(addr + copy_len, partitions[i].length +
  550. TESTMGR_POISON_LEN - copy_len);
  551. } else {
  552. testmgr_poison(addr, partitions[i].length +
  553. TESTMGR_POISON_LEN);
  554. }
  555. }
  556. sg_mark_end(&tsgl->sgl[tsgl->nents - 1]);
  557. tsgl->sgl_ptr = tsgl->sgl;
  558. memcpy(tsgl->sgl_saved, tsgl->sgl, tsgl->nents * sizeof(tsgl->sgl[0]));
  559. return 0;
  560. }
  561. /*
  562. * Verify that a scatterlist crypto operation produced the correct output.
  563. *
  564. * @tsgl: scatterlist containing the actual output
  565. * @expected_output: buffer containing the expected output
  566. * @len_to_check: length of @expected_output in bytes
  567. * @unchecked_prefix_len: number of ignored bytes in @tsgl prior to real result
  568. * @check_poison: verify that the poison bytes after each chunk are intact?
  569. *
  570. * Return: 0 if correct, -EINVAL if incorrect, -EOVERFLOW if buffer overrun.
  571. */
  572. static int verify_correct_output(const struct test_sglist *tsgl,
  573. const char *expected_output,
  574. unsigned int len_to_check,
  575. unsigned int unchecked_prefix_len,
  576. bool check_poison)
  577. {
  578. unsigned int i;
  579. for (i = 0; i < tsgl->nents; i++) {
  580. struct scatterlist *sg = &tsgl->sgl_ptr[i];
  581. unsigned int len = sg->length;
  582. unsigned int offset = sg->offset;
  583. const char *actual_output;
  584. if (unchecked_prefix_len) {
  585. if (unchecked_prefix_len >= len) {
  586. unchecked_prefix_len -= len;
  587. continue;
  588. }
  589. offset += unchecked_prefix_len;
  590. len -= unchecked_prefix_len;
  591. unchecked_prefix_len = 0;
  592. }
  593. len = min(len, len_to_check);
  594. actual_output = page_address(sg_page(sg)) + offset;
  595. if (memcmp(expected_output, actual_output, len) != 0)
  596. return -EINVAL;
  597. if (check_poison &&
  598. !testmgr_is_poison(actual_output + len, TESTMGR_POISON_LEN))
  599. return -EOVERFLOW;
  600. len_to_check -= len;
  601. expected_output += len;
  602. }
  603. if (WARN_ON(len_to_check != 0))
  604. return -EINVAL;
  605. return 0;
  606. }
  607. static bool is_test_sglist_corrupted(const struct test_sglist *tsgl)
  608. {
  609. unsigned int i;
  610. for (i = 0; i < tsgl->nents; i++) {
  611. if (tsgl->sgl[i].page_link != tsgl->sgl_saved[i].page_link)
  612. return true;
  613. if (tsgl->sgl[i].offset != tsgl->sgl_saved[i].offset)
  614. return true;
  615. if (tsgl->sgl[i].length != tsgl->sgl_saved[i].length)
  616. return true;
  617. }
  618. return false;
  619. }
  620. struct cipher_test_sglists {
  621. struct test_sglist src;
  622. struct test_sglist dst;
  623. };
  624. static struct cipher_test_sglists *alloc_cipher_test_sglists(void)
  625. {
  626. struct cipher_test_sglists *tsgls;
  627. tsgls = kmalloc(sizeof(*tsgls), GFP_KERNEL);
  628. if (!tsgls)
  629. return NULL;
  630. if (init_test_sglist(&tsgls->src) != 0)
  631. goto fail_kfree;
  632. if (init_test_sglist(&tsgls->dst) != 0)
  633. goto fail_destroy_src;
  634. return tsgls;
  635. fail_destroy_src:
  636. destroy_test_sglist(&tsgls->src);
  637. fail_kfree:
  638. kfree(tsgls);
  639. return NULL;
  640. }
  641. static void free_cipher_test_sglists(struct cipher_test_sglists *tsgls)
  642. {
  643. if (tsgls) {
  644. destroy_test_sglist(&tsgls->src);
  645. destroy_test_sglist(&tsgls->dst);
  646. kfree(tsgls);
  647. }
  648. }
  649. /* Build the src and dst scatterlists for an skcipher or AEAD test */
  650. static int build_cipher_test_sglists(struct cipher_test_sglists *tsgls,
  651. const struct testvec_config *cfg,
  652. unsigned int alignmask,
  653. unsigned int src_total_len,
  654. unsigned int dst_total_len,
  655. const struct kvec *inputs,
  656. unsigned int nr_inputs)
  657. {
  658. struct iov_iter input;
  659. int err;
  660. iov_iter_kvec(&input, WRITE, inputs, nr_inputs, src_total_len);
  661. err = build_test_sglist(&tsgls->src, cfg->src_divs, alignmask,
  662. cfg->inplace ?
  663. max(dst_total_len, src_total_len) :
  664. src_total_len,
  665. &input, NULL);
  666. if (err)
  667. return err;
  668. if (cfg->inplace) {
  669. tsgls->dst.sgl_ptr = tsgls->src.sgl;
  670. tsgls->dst.nents = tsgls->src.nents;
  671. return 0;
  672. }
  673. return build_test_sglist(&tsgls->dst,
  674. cfg->dst_divs[0].proportion_of_total ?
  675. cfg->dst_divs : cfg->src_divs,
  676. alignmask, dst_total_len, NULL, NULL);
  677. }
  678. /*
  679. * Support for testing passing a misaligned key to setkey():
  680. *
  681. * If cfg->key_offset is set, copy the key into a new buffer at that offset,
  682. * optionally adding alignmask. Else, just use the key directly.
  683. */
  684. static int prepare_keybuf(const u8 *key, unsigned int ksize,
  685. const struct testvec_config *cfg,
  686. unsigned int alignmask,
  687. const u8 **keybuf_ret, const u8 **keyptr_ret)
  688. {
  689. unsigned int key_offset = cfg->key_offset;
  690. u8 *keybuf = NULL, *keyptr = (u8 *)key;
  691. if (key_offset != 0) {
  692. if (cfg->key_offset_relative_to_alignmask)
  693. key_offset += alignmask;
  694. keybuf = kmalloc(key_offset + ksize, GFP_KERNEL);
  695. if (!keybuf)
  696. return -ENOMEM;
  697. keyptr = keybuf + key_offset;
  698. memcpy(keyptr, key, ksize);
  699. }
  700. *keybuf_ret = keybuf;
  701. *keyptr_ret = keyptr;
  702. return 0;
  703. }
  704. /* Like setkey_f(tfm, key, ksize), but sometimes misalign the key */
  705. #define do_setkey(setkey_f, tfm, key, ksize, cfg, alignmask) \
  706. ({ \
  707. const u8 *keybuf, *keyptr; \
  708. int err; \
  709. \
  710. err = prepare_keybuf((key), (ksize), (cfg), (alignmask), \
  711. &keybuf, &keyptr); \
  712. if (err == 0) { \
  713. err = setkey_f((tfm), keyptr, (ksize)); \
  714. kfree(keybuf); \
  715. } \
  716. err; \
  717. })
  718. #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
  719. /* Generate a random length in range [0, max_len], but prefer smaller values */
  720. static unsigned int generate_random_length(unsigned int max_len)
  721. {
  722. unsigned int len = prandom_u32() % (max_len + 1);
  723. switch (prandom_u32() % 4) {
  724. case 0:
  725. return len % 64;
  726. case 1:
  727. return len % 256;
  728. case 2:
  729. return len % 1024;
  730. default:
  731. return len;
  732. }
  733. }
  734. /* Flip a random bit in the given nonempty data buffer */
  735. static void flip_random_bit(u8 *buf, size_t size)
  736. {
  737. size_t bitpos;
  738. bitpos = prandom_u32() % (size * 8);
  739. buf[bitpos / 8] ^= 1 << (bitpos % 8);
  740. }
  741. /* Flip a random byte in the given nonempty data buffer */
  742. static void flip_random_byte(u8 *buf, size_t size)
  743. {
  744. buf[prandom_u32() % size] ^= 0xff;
  745. }
  746. /* Sometimes make some random changes to the given nonempty data buffer */
  747. static void mutate_buffer(u8 *buf, size_t size)
  748. {
  749. size_t num_flips;
  750. size_t i;
  751. /* Sometimes flip some bits */
  752. if (prandom_u32() % 4 == 0) {
  753. num_flips = min_t(size_t, 1 << (prandom_u32() % 8), size * 8);
  754. for (i = 0; i < num_flips; i++)
  755. flip_random_bit(buf, size);
  756. }
  757. /* Sometimes flip some bytes */
  758. if (prandom_u32() % 4 == 0) {
  759. num_flips = min_t(size_t, 1 << (prandom_u32() % 8), size);
  760. for (i = 0; i < num_flips; i++)
  761. flip_random_byte(buf, size);
  762. }
  763. }
  764. /* Randomly generate 'count' bytes, but sometimes make them "interesting" */
  765. static void generate_random_bytes(u8 *buf, size_t count)
  766. {
  767. u8 b;
  768. u8 increment;
  769. size_t i;
  770. if (count == 0)
  771. return;
  772. switch (prandom_u32() % 8) { /* Choose a generation strategy */
  773. case 0:
  774. case 1:
  775. /* All the same byte, plus optional mutations */
  776. switch (prandom_u32() % 4) {
  777. case 0:
  778. b = 0x00;
  779. break;
  780. case 1:
  781. b = 0xff;
  782. break;
  783. default:
  784. b = (u8)prandom_u32();
  785. break;
  786. }
  787. memset(buf, b, count);
  788. mutate_buffer(buf, count);
  789. break;
  790. case 2:
  791. /* Ascending or descending bytes, plus optional mutations */
  792. increment = (u8)prandom_u32();
  793. b = (u8)prandom_u32();
  794. for (i = 0; i < count; i++, b += increment)
  795. buf[i] = b;
  796. mutate_buffer(buf, count);
  797. break;
  798. default:
  799. /* Fully random bytes */
  800. for (i = 0; i < count; i++)
  801. buf[i] = (u8)prandom_u32();
  802. }
  803. }
  804. static char *generate_random_sgl_divisions(struct test_sg_division *divs,
  805. size_t max_divs, char *p, char *end,
  806. bool gen_flushes, u32 req_flags)
  807. {
  808. struct test_sg_division *div = divs;
  809. unsigned int remaining = TEST_SG_TOTAL;
  810. do {
  811. unsigned int this_len;
  812. const char *flushtype_str;
  813. if (div == &divs[max_divs - 1] || prandom_u32() % 2 == 0)
  814. this_len = remaining;
  815. else
  816. this_len = 1 + (prandom_u32() % remaining);
  817. div->proportion_of_total = this_len;
  818. if (prandom_u32() % 4 == 0)
  819. div->offset = (PAGE_SIZE - 128) + (prandom_u32() % 128);
  820. else if (prandom_u32() % 2 == 0)
  821. div->offset = prandom_u32() % 32;
  822. else
  823. div->offset = prandom_u32() % PAGE_SIZE;
  824. if (prandom_u32() % 8 == 0)
  825. div->offset_relative_to_alignmask = true;
  826. div->flush_type = FLUSH_TYPE_NONE;
  827. if (gen_flushes) {
  828. switch (prandom_u32() % 4) {
  829. case 0:
  830. div->flush_type = FLUSH_TYPE_REIMPORT;
  831. break;
  832. case 1:
  833. div->flush_type = FLUSH_TYPE_FLUSH;
  834. break;
  835. }
  836. }
  837. if (div->flush_type != FLUSH_TYPE_NONE &&
  838. !(req_flags & CRYPTO_TFM_REQ_MAY_SLEEP) &&
  839. prandom_u32() % 2 == 0)
  840. div->nosimd = true;
  841. switch (div->flush_type) {
  842. case FLUSH_TYPE_FLUSH:
  843. if (div->nosimd)
  844. flushtype_str = "<flush,nosimd>";
  845. else
  846. flushtype_str = "<flush>";
  847. break;
  848. case FLUSH_TYPE_REIMPORT:
  849. if (div->nosimd)
  850. flushtype_str = "<reimport,nosimd>";
  851. else
  852. flushtype_str = "<reimport>";
  853. break;
  854. default:
  855. flushtype_str = "";
  856. break;
  857. }
  858. BUILD_BUG_ON(TEST_SG_TOTAL != 10000); /* for "%u.%u%%" */
  859. p += scnprintf(p, end - p, "%s%u.%u%%@%s+%u%s", flushtype_str,
  860. this_len / 100, this_len % 100,
  861. div->offset_relative_to_alignmask ?
  862. "alignmask" : "",
  863. div->offset, this_len == remaining ? "" : ", ");
  864. remaining -= this_len;
  865. div++;
  866. } while (remaining);
  867. return p;
  868. }
  869. /* Generate a random testvec_config for fuzz testing */
  870. static void generate_random_testvec_config(struct testvec_config *cfg,
  871. char *name, size_t max_namelen)
  872. {
  873. char *p = name;
  874. char * const end = name + max_namelen;
  875. memset(cfg, 0, sizeof(*cfg));
  876. cfg->name = name;
  877. p += scnprintf(p, end - p, "random:");
  878. if (prandom_u32() % 2 == 0) {
  879. cfg->inplace = true;
  880. p += scnprintf(p, end - p, " inplace");
  881. }
  882. if (prandom_u32() % 2 == 0) {
  883. cfg->req_flags |= CRYPTO_TFM_REQ_MAY_SLEEP;
  884. p += scnprintf(p, end - p, " may_sleep");
  885. }
  886. switch (prandom_u32() % 4) {
  887. case 0:
  888. cfg->finalization_type = FINALIZATION_TYPE_FINAL;
  889. p += scnprintf(p, end - p, " use_final");
  890. break;
  891. case 1:
  892. cfg->finalization_type = FINALIZATION_TYPE_FINUP;
  893. p += scnprintf(p, end - p, " use_finup");
  894. break;
  895. default:
  896. cfg->finalization_type = FINALIZATION_TYPE_DIGEST;
  897. p += scnprintf(p, end - p, " use_digest");
  898. break;
  899. }
  900. if (!(cfg->req_flags & CRYPTO_TFM_REQ_MAY_SLEEP) &&
  901. prandom_u32() % 2 == 0) {
  902. cfg->nosimd = true;
  903. p += scnprintf(p, end - p, " nosimd");
  904. }
  905. p += scnprintf(p, end - p, " src_divs=[");
  906. p = generate_random_sgl_divisions(cfg->src_divs,
  907. ARRAY_SIZE(cfg->src_divs), p, end,
  908. (cfg->finalization_type !=
  909. FINALIZATION_TYPE_DIGEST),
  910. cfg->req_flags);
  911. p += scnprintf(p, end - p, "]");
  912. if (!cfg->inplace && prandom_u32() % 2 == 0) {
  913. p += scnprintf(p, end - p, " dst_divs=[");
  914. p = generate_random_sgl_divisions(cfg->dst_divs,
  915. ARRAY_SIZE(cfg->dst_divs),
  916. p, end, false,
  917. cfg->req_flags);
  918. p += scnprintf(p, end - p, "]");
  919. }
  920. if (prandom_u32() % 2 == 0) {
  921. cfg->iv_offset = 1 + (prandom_u32() % MAX_ALGAPI_ALIGNMASK);
  922. p += scnprintf(p, end - p, " iv_offset=%u", cfg->iv_offset);
  923. }
  924. if (prandom_u32() % 2 == 0) {
  925. cfg->key_offset = 1 + (prandom_u32() % MAX_ALGAPI_ALIGNMASK);
  926. p += scnprintf(p, end - p, " key_offset=%u", cfg->key_offset);
  927. }
  928. WARN_ON_ONCE(!valid_testvec_config(cfg));
  929. }
  930. static void crypto_disable_simd_for_test(void)
  931. {
  932. preempt_disable();
  933. __this_cpu_write(crypto_simd_disabled_for_test, true);
  934. }
  935. static void crypto_reenable_simd_for_test(void)
  936. {
  937. __this_cpu_write(crypto_simd_disabled_for_test, false);
  938. preempt_enable();
  939. }
  940. /*
  941. * Given an algorithm name, build the name of the generic implementation of that
  942. * algorithm, assuming the usual naming convention. Specifically, this appends
  943. * "-generic" to every part of the name that is not a template name. Examples:
  944. *
  945. * aes => aes-generic
  946. * cbc(aes) => cbc(aes-generic)
  947. * cts(cbc(aes)) => cts(cbc(aes-generic))
  948. * rfc7539(chacha20,poly1305) => rfc7539(chacha20-generic,poly1305-generic)
  949. *
  950. * Return: 0 on success, or -ENAMETOOLONG if the generic name would be too long
  951. */
  952. static int build_generic_driver_name(const char *algname,
  953. char driver_name[CRYPTO_MAX_ALG_NAME])
  954. {
  955. const char *in = algname;
  956. char *out = driver_name;
  957. size_t len = strlen(algname);
  958. if (len >= CRYPTO_MAX_ALG_NAME)
  959. goto too_long;
  960. do {
  961. const char *in_saved = in;
  962. while (*in && *in != '(' && *in != ')' && *in != ',')
  963. *out++ = *in++;
  964. if (*in != '(' && in > in_saved) {
  965. len += 8;
  966. if (len >= CRYPTO_MAX_ALG_NAME)
  967. goto too_long;
  968. memcpy(out, "-generic", 8);
  969. out += 8;
  970. }
  971. } while ((*out++ = *in++) != '\0');
  972. return 0;
  973. too_long:
  974. pr_err("alg: generic driver name for \"%s\" would be too long\n",
  975. algname);
  976. return -ENAMETOOLONG;
  977. }
  978. #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
  979. static void crypto_disable_simd_for_test(void)
  980. {
  981. }
  982. static void crypto_reenable_simd_for_test(void)
  983. {
  984. }
  985. #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
  986. static int build_hash_sglist(struct test_sglist *tsgl,
  987. const struct hash_testvec *vec,
  988. const struct testvec_config *cfg,
  989. unsigned int alignmask,
  990. const struct test_sg_division *divs[XBUFSIZE])
  991. {
  992. struct kvec kv;
  993. struct iov_iter input;
  994. kv.iov_base = (void *)vec->plaintext;
  995. kv.iov_len = vec->psize;
  996. iov_iter_kvec(&input, WRITE, &kv, 1, vec->psize);
  997. return build_test_sglist(tsgl, cfg->src_divs, alignmask, vec->psize,
  998. &input, divs);
  999. }
  1000. static int check_hash_result(const char *type,
  1001. const u8 *result, unsigned int digestsize,
  1002. const struct hash_testvec *vec,
  1003. const char *vec_name,
  1004. const char *driver,
  1005. const struct testvec_config *cfg)
  1006. {
  1007. if (memcmp(result, vec->digest, digestsize) != 0) {
  1008. pr_err("alg: %s: %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
  1009. type, driver, vec_name, cfg->name);
  1010. return -EINVAL;
  1011. }
  1012. if (!testmgr_is_poison(&result[digestsize], TESTMGR_POISON_LEN)) {
  1013. pr_err("alg: %s: %s overran result buffer on test vector %s, cfg=\"%s\"\n",
  1014. type, driver, vec_name, cfg->name);
  1015. return -EOVERFLOW;
  1016. }
  1017. return 0;
  1018. }
  1019. static inline int check_shash_op(const char *op, int err,
  1020. const char *driver, const char *vec_name,
  1021. const struct testvec_config *cfg)
  1022. {
  1023. if (err)
  1024. pr_err("alg: shash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n",
  1025. driver, op, err, vec_name, cfg->name);
  1026. return err;
  1027. }
  1028. static inline const void *sg_data(struct scatterlist *sg)
  1029. {
  1030. return page_address(sg_page(sg)) + sg->offset;
  1031. }
  1032. /* Test one hash test vector in one configuration, using the shash API */
  1033. static int test_shash_vec_cfg(const char *driver,
  1034. const struct hash_testvec *vec,
  1035. const char *vec_name,
  1036. const struct testvec_config *cfg,
  1037. struct shash_desc *desc,
  1038. struct test_sglist *tsgl,
  1039. u8 *hashstate)
  1040. {
  1041. struct crypto_shash *tfm = desc->tfm;
  1042. const unsigned int alignmask = crypto_shash_alignmask(tfm);
  1043. const unsigned int digestsize = crypto_shash_digestsize(tfm);
  1044. const unsigned int statesize = crypto_shash_statesize(tfm);
  1045. const struct test_sg_division *divs[XBUFSIZE];
  1046. unsigned int i;
  1047. u8 result[HASH_MAX_DIGESTSIZE + TESTMGR_POISON_LEN];
  1048. int err;
  1049. /* Set the key, if specified */
  1050. if (vec->ksize) {
  1051. err = do_setkey(crypto_shash_setkey, tfm, vec->key, vec->ksize,
  1052. cfg, alignmask);
  1053. if (err) {
  1054. if (err == vec->setkey_error)
  1055. return 0;
  1056. pr_err("alg: shash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
  1057. driver, vec_name, vec->setkey_error, err,
  1058. crypto_shash_get_flags(tfm));
  1059. return err;
  1060. }
  1061. if (vec->setkey_error) {
  1062. pr_err("alg: shash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
  1063. driver, vec_name, vec->setkey_error);
  1064. return -EINVAL;
  1065. }
  1066. }
  1067. /* Build the scatterlist for the source data */
  1068. err = build_hash_sglist(tsgl, vec, cfg, alignmask, divs);
  1069. if (err) {
  1070. pr_err("alg: shash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n",
  1071. driver, vec_name, cfg->name);
  1072. return err;
  1073. }
  1074. /* Do the actual hashing */
  1075. testmgr_poison(desc->__ctx, crypto_shash_descsize(tfm));
  1076. testmgr_poison(result, digestsize + TESTMGR_POISON_LEN);
  1077. if (cfg->finalization_type == FINALIZATION_TYPE_DIGEST ||
  1078. vec->digest_error) {
  1079. /* Just using digest() */
  1080. if (tsgl->nents != 1)
  1081. return 0;
  1082. if (cfg->nosimd)
  1083. crypto_disable_simd_for_test();
  1084. err = crypto_shash_digest(desc, sg_data(&tsgl->sgl[0]),
  1085. tsgl->sgl[0].length, result);
  1086. if (cfg->nosimd)
  1087. crypto_reenable_simd_for_test();
  1088. if (err) {
  1089. if (err == vec->digest_error)
  1090. return 0;
  1091. pr_err("alg: shash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
  1092. driver, vec_name, vec->digest_error, err,
  1093. cfg->name);
  1094. return err;
  1095. }
  1096. if (vec->digest_error) {
  1097. pr_err("alg: shash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
  1098. driver, vec_name, vec->digest_error, cfg->name);
  1099. return -EINVAL;
  1100. }
  1101. goto result_ready;
  1102. }
  1103. /* Using init(), zero or more update(), then final() or finup() */
  1104. if (cfg->nosimd)
  1105. crypto_disable_simd_for_test();
  1106. err = crypto_shash_init(desc);
  1107. if (cfg->nosimd)
  1108. crypto_reenable_simd_for_test();
  1109. err = check_shash_op("init", err, driver, vec_name, cfg);
  1110. if (err)
  1111. return err;
  1112. for (i = 0; i < tsgl->nents; i++) {
  1113. if (i + 1 == tsgl->nents &&
  1114. cfg->finalization_type == FINALIZATION_TYPE_FINUP) {
  1115. if (divs[i]->nosimd)
  1116. crypto_disable_simd_for_test();
  1117. err = crypto_shash_finup(desc, sg_data(&tsgl->sgl[i]),
  1118. tsgl->sgl[i].length, result);
  1119. if (divs[i]->nosimd)
  1120. crypto_reenable_simd_for_test();
  1121. err = check_shash_op("finup", err, driver, vec_name,
  1122. cfg);
  1123. if (err)
  1124. return err;
  1125. goto result_ready;
  1126. }
  1127. if (divs[i]->nosimd)
  1128. crypto_disable_simd_for_test();
  1129. err = crypto_shash_update(desc, sg_data(&tsgl->sgl[i]),
  1130. tsgl->sgl[i].length);
  1131. if (divs[i]->nosimd)
  1132. crypto_reenable_simd_for_test();
  1133. err = check_shash_op("update", err, driver, vec_name, cfg);
  1134. if (err)
  1135. return err;
  1136. if (divs[i]->flush_type == FLUSH_TYPE_REIMPORT) {
  1137. /* Test ->export() and ->import() */
  1138. testmgr_poison(hashstate + statesize,
  1139. TESTMGR_POISON_LEN);
  1140. err = crypto_shash_export(desc, hashstate);
  1141. err = check_shash_op("export", err, driver, vec_name,
  1142. cfg);
  1143. if (err)
  1144. return err;
  1145. if (!testmgr_is_poison(hashstate + statesize,
  1146. TESTMGR_POISON_LEN)) {
  1147. pr_err("alg: shash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n",
  1148. driver, vec_name, cfg->name);
  1149. return -EOVERFLOW;
  1150. }
  1151. testmgr_poison(desc->__ctx, crypto_shash_descsize(tfm));
  1152. err = crypto_shash_import(desc, hashstate);
  1153. err = check_shash_op("import", err, driver, vec_name,
  1154. cfg);
  1155. if (err)
  1156. return err;
  1157. }
  1158. }
  1159. if (cfg->nosimd)
  1160. crypto_disable_simd_for_test();
  1161. err = crypto_shash_final(desc, result);
  1162. if (cfg->nosimd)
  1163. crypto_reenable_simd_for_test();
  1164. err = check_shash_op("final", err, driver, vec_name, cfg);
  1165. if (err)
  1166. return err;
  1167. result_ready:
  1168. return check_hash_result("shash", result, digestsize, vec, vec_name,
  1169. driver, cfg);
  1170. }
  1171. static int do_ahash_op(int (*op)(struct ahash_request *req),
  1172. struct ahash_request *req,
  1173. struct crypto_wait *wait, bool nosimd)
  1174. {
  1175. int err;
  1176. if (nosimd)
  1177. crypto_disable_simd_for_test();
  1178. err = op(req);
  1179. if (nosimd)
  1180. crypto_reenable_simd_for_test();
  1181. return crypto_wait_req(err, wait);
  1182. }
  1183. static int check_nonfinal_ahash_op(const char *op, int err,
  1184. u8 *result, unsigned int digestsize,
  1185. const char *driver, const char *vec_name,
  1186. const struct testvec_config *cfg)
  1187. {
  1188. if (err) {
  1189. pr_err("alg: ahash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n",
  1190. driver, op, err, vec_name, cfg->name);
  1191. return err;
  1192. }
  1193. if (!testmgr_is_poison(result, digestsize)) {
  1194. pr_err("alg: ahash: %s %s() used result buffer on test vector %s, cfg=\"%s\"\n",
  1195. driver, op, vec_name, cfg->name);
  1196. return -EINVAL;
  1197. }
  1198. return 0;
  1199. }
  1200. /* Test one hash test vector in one configuration, using the ahash API */
  1201. static int test_ahash_vec_cfg(const char *driver,
  1202. const struct hash_testvec *vec,
  1203. const char *vec_name,
  1204. const struct testvec_config *cfg,
  1205. struct ahash_request *req,
  1206. struct test_sglist *tsgl,
  1207. u8 *hashstate)
  1208. {
  1209. struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
  1210. const unsigned int alignmask = crypto_ahash_alignmask(tfm);
  1211. const unsigned int digestsize = crypto_ahash_digestsize(tfm);
  1212. const unsigned int statesize = crypto_ahash_statesize(tfm);
  1213. const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
  1214. const struct test_sg_division *divs[XBUFSIZE];
  1215. DECLARE_CRYPTO_WAIT(wait);
  1216. unsigned int i;
  1217. struct scatterlist *pending_sgl;
  1218. unsigned int pending_len;
  1219. u8 result[HASH_MAX_DIGESTSIZE + TESTMGR_POISON_LEN];
  1220. int err;
  1221. /* Set the key, if specified */
  1222. if (vec->ksize) {
  1223. err = do_setkey(crypto_ahash_setkey, tfm, vec->key, vec->ksize,
  1224. cfg, alignmask);
  1225. if (err) {
  1226. if (err == vec->setkey_error)
  1227. return 0;
  1228. pr_err("alg: ahash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
  1229. driver, vec_name, vec->setkey_error, err,
  1230. crypto_ahash_get_flags(tfm));
  1231. return err;
  1232. }
  1233. if (vec->setkey_error) {
  1234. pr_err("alg: ahash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
  1235. driver, vec_name, vec->setkey_error);
  1236. return -EINVAL;
  1237. }
  1238. }
  1239. /* Build the scatterlist for the source data */
  1240. err = build_hash_sglist(tsgl, vec, cfg, alignmask, divs);
  1241. if (err) {
  1242. pr_err("alg: ahash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n",
  1243. driver, vec_name, cfg->name);
  1244. return err;
  1245. }
  1246. /* Do the actual hashing */
  1247. testmgr_poison(req->__ctx, crypto_ahash_reqsize(tfm));
  1248. testmgr_poison(result, digestsize + TESTMGR_POISON_LEN);
  1249. if (cfg->finalization_type == FINALIZATION_TYPE_DIGEST ||
  1250. vec->digest_error) {
  1251. /* Just using digest() */
  1252. ahash_request_set_callback(req, req_flags, crypto_req_done,
  1253. &wait);
  1254. ahash_request_set_crypt(req, tsgl->sgl, result, vec->psize);
  1255. err = do_ahash_op(crypto_ahash_digest, req, &wait, cfg->nosimd);
  1256. if (err) {
  1257. if (err == vec->digest_error)
  1258. return 0;
  1259. pr_err("alg: ahash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
  1260. driver, vec_name, vec->digest_error, err,
  1261. cfg->name);
  1262. return err;
  1263. }
  1264. if (vec->digest_error) {
  1265. pr_err("alg: ahash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
  1266. driver, vec_name, vec->digest_error, cfg->name);
  1267. return -EINVAL;
  1268. }
  1269. goto result_ready;
  1270. }
  1271. /* Using init(), zero or more update(), then final() or finup() */
  1272. ahash_request_set_callback(req, req_flags, crypto_req_done, &wait);
  1273. ahash_request_set_crypt(req, NULL, result, 0);
  1274. err = do_ahash_op(crypto_ahash_init, req, &wait, cfg->nosimd);
  1275. err = check_nonfinal_ahash_op("init", err, result, digestsize,
  1276. driver, vec_name, cfg);
  1277. if (err)
  1278. return err;
  1279. pending_sgl = NULL;
  1280. pending_len = 0;
  1281. for (i = 0; i < tsgl->nents; i++) {
  1282. if (divs[i]->flush_type != FLUSH_TYPE_NONE &&
  1283. pending_sgl != NULL) {
  1284. /* update() with the pending data */
  1285. ahash_request_set_callback(req, req_flags,
  1286. crypto_req_done, &wait);
  1287. ahash_request_set_crypt(req, pending_sgl, result,
  1288. pending_len);
  1289. err = do_ahash_op(crypto_ahash_update, req, &wait,
  1290. divs[i]->nosimd);
  1291. err = check_nonfinal_ahash_op("update", err,
  1292. result, digestsize,
  1293. driver, vec_name, cfg);
  1294. if (err)
  1295. return err;
  1296. pending_sgl = NULL;
  1297. pending_len = 0;
  1298. }
  1299. if (divs[i]->flush_type == FLUSH_TYPE_REIMPORT) {
  1300. /* Test ->export() and ->import() */
  1301. testmgr_poison(hashstate + statesize,
  1302. TESTMGR_POISON_LEN);
  1303. err = crypto_ahash_export(req, hashstate);
  1304. err = check_nonfinal_ahash_op("export", err,
  1305. result, digestsize,
  1306. driver, vec_name, cfg);
  1307. if (err)
  1308. return err;
  1309. if (!testmgr_is_poison(hashstate + statesize,
  1310. TESTMGR_POISON_LEN)) {
  1311. pr_err("alg: ahash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n",
  1312. driver, vec_name, cfg->name);
  1313. return -EOVERFLOW;
  1314. }
  1315. testmgr_poison(req->__ctx, crypto_ahash_reqsize(tfm));
  1316. err = crypto_ahash_import(req, hashstate);
  1317. err = check_nonfinal_ahash_op("import", err,
  1318. result, digestsize,
  1319. driver, vec_name, cfg);
  1320. if (err)
  1321. return err;
  1322. }
  1323. if (pending_sgl == NULL)
  1324. pending_sgl = &tsgl->sgl[i];
  1325. pending_len += tsgl->sgl[i].length;
  1326. }
  1327. ahash_request_set_callback(req, req_flags, crypto_req_done, &wait);
  1328. ahash_request_set_crypt(req, pending_sgl, result, pending_len);
  1329. if (cfg->finalization_type == FINALIZATION_TYPE_FINAL) {
  1330. /* finish with update() and final() */
  1331. err = do_ahash_op(crypto_ahash_update, req, &wait, cfg->nosimd);
  1332. err = check_nonfinal_ahash_op("update", err, result, digestsize,
  1333. driver, vec_name, cfg);
  1334. if (err)
  1335. return err;
  1336. err = do_ahash_op(crypto_ahash_final, req, &wait, cfg->nosimd);
  1337. if (err) {
  1338. pr_err("alg: ahash: %s final() failed with err %d on test vector %s, cfg=\"%s\"\n",
  1339. driver, err, vec_name, cfg->name);
  1340. return err;
  1341. }
  1342. } else {
  1343. /* finish with finup() */
  1344. err = do_ahash_op(crypto_ahash_finup, req, &wait, cfg->nosimd);
  1345. if (err) {
  1346. pr_err("alg: ahash: %s finup() failed with err %d on test vector %s, cfg=\"%s\"\n",
  1347. driver, err, vec_name, cfg->name);
  1348. return err;
  1349. }
  1350. }
  1351. result_ready:
  1352. return check_hash_result("ahash", result, digestsize, vec, vec_name,
  1353. driver, cfg);
  1354. }
  1355. static int test_hash_vec_cfg(const char *driver,
  1356. const struct hash_testvec *vec,
  1357. const char *vec_name,
  1358. const struct testvec_config *cfg,
  1359. struct ahash_request *req,
  1360. struct shash_desc *desc,
  1361. struct test_sglist *tsgl,
  1362. u8 *hashstate)
  1363. {
  1364. int err;
  1365. /*
  1366. * For algorithms implemented as "shash", most bugs will be detected by
  1367. * both the shash and ahash tests. Test the shash API first so that the
  1368. * failures involve less indirection, so are easier to debug.
  1369. */
  1370. if (desc) {
  1371. err = test_shash_vec_cfg(driver, vec, vec_name, cfg, desc, tsgl,
  1372. hashstate);
  1373. if (err)
  1374. return err;
  1375. }
  1376. return test_ahash_vec_cfg(driver, vec, vec_name, cfg, req, tsgl,
  1377. hashstate);
  1378. }
  1379. static int test_hash_vec(const char *driver, const struct hash_testvec *vec,
  1380. unsigned int vec_num, struct ahash_request *req,
  1381. struct shash_desc *desc, struct test_sglist *tsgl,
  1382. u8 *hashstate)
  1383. {
  1384. char vec_name[16];
  1385. unsigned int i;
  1386. int err;
  1387. sprintf(vec_name, "%u", vec_num);
  1388. for (i = 0; i < ARRAY_SIZE(default_hash_testvec_configs); i++) {
  1389. err = test_hash_vec_cfg(driver, vec, vec_name,
  1390. &default_hash_testvec_configs[i],
  1391. req, desc, tsgl, hashstate);
  1392. if (err)
  1393. return err;
  1394. }
  1395. #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
  1396. if (!noextratests) {
  1397. struct testvec_config cfg;
  1398. char cfgname[TESTVEC_CONFIG_NAMELEN];
  1399. for (i = 0; i < fuzz_iterations; i++) {
  1400. generate_random_testvec_config(&cfg, cfgname,
  1401. sizeof(cfgname));
  1402. err = test_hash_vec_cfg(driver, vec, vec_name, &cfg,
  1403. req, desc, tsgl, hashstate);
  1404. if (err)
  1405. return err;
  1406. cond_resched();
  1407. }
  1408. }
  1409. #endif
  1410. return 0;
  1411. }
  1412. #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
  1413. /*
  1414. * Generate a hash test vector from the given implementation.
  1415. * Assumes the buffers in 'vec' were already allocated.
  1416. */
  1417. static void generate_random_hash_testvec(struct shash_desc *desc,
  1418. struct hash_testvec *vec,
  1419. unsigned int maxkeysize,
  1420. unsigned int maxdatasize,
  1421. char *name, size_t max_namelen)
  1422. {
  1423. /* Data */
  1424. vec->psize = generate_random_length(maxdatasize);
  1425. generate_random_bytes((u8 *)vec->plaintext, vec->psize);
  1426. /*
  1427. * Key: length in range [1, maxkeysize], but usually choose maxkeysize.
  1428. * If algorithm is unkeyed, then maxkeysize == 0 and set ksize = 0.
  1429. */
  1430. vec->setkey_error = 0;
  1431. vec->ksize = 0;
  1432. if (maxkeysize) {
  1433. vec->ksize = maxkeysize;
  1434. if (prandom_u32() % 4 == 0)
  1435. vec->ksize = 1 + (prandom_u32() % maxkeysize);
  1436. generate_random_bytes((u8 *)vec->key, vec->ksize);
  1437. vec->setkey_error = crypto_shash_setkey(desc->tfm, vec->key,
  1438. vec->ksize);
  1439. /* If the key couldn't be set, no need to continue to digest. */
  1440. if (vec->setkey_error)
  1441. goto done;
  1442. }
  1443. /* Digest */
  1444. vec->digest_error = crypto_shash_digest(desc, vec->plaintext,
  1445. vec->psize, (u8 *)vec->digest);
  1446. done:
  1447. snprintf(name, max_namelen, "\"random: psize=%u ksize=%u\"",
  1448. vec->psize, vec->ksize);
  1449. }
  1450. /*
  1451. * Test the hash algorithm represented by @req against the corresponding generic
  1452. * implementation, if one is available.
  1453. */
  1454. static int test_hash_vs_generic_impl(const char *driver,
  1455. const char *generic_driver,
  1456. unsigned int maxkeysize,
  1457. struct ahash_request *req,
  1458. struct shash_desc *desc,
  1459. struct test_sglist *tsgl,
  1460. u8 *hashstate)
  1461. {
  1462. struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
  1463. const unsigned int digestsize = crypto_ahash_digestsize(tfm);
  1464. const unsigned int blocksize = crypto_ahash_blocksize(tfm);
  1465. const unsigned int maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN;
  1466. const char *algname = crypto_hash_alg_common(tfm)->base.cra_name;
  1467. char _generic_driver[CRYPTO_MAX_ALG_NAME];
  1468. struct crypto_shash *generic_tfm = NULL;
  1469. struct shash_desc *generic_desc = NULL;
  1470. unsigned int i;
  1471. struct hash_testvec vec = { 0 };
  1472. char vec_name[64];
  1473. struct testvec_config *cfg;
  1474. char cfgname[TESTVEC_CONFIG_NAMELEN];
  1475. int err;
  1476. if (noextratests)
  1477. return 0;
  1478. if (!generic_driver) { /* Use default naming convention? */
  1479. err = build_generic_driver_name(algname, _generic_driver);
  1480. if (err)
  1481. return err;
  1482. generic_driver = _generic_driver;
  1483. }
  1484. if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */
  1485. return 0;
  1486. generic_tfm = crypto_alloc_shash(generic_driver, 0, 0);
  1487. if (IS_ERR(generic_tfm)) {
  1488. err = PTR_ERR(generic_tfm);
  1489. if (err == -ENOENT) {
  1490. pr_warn("alg: hash: skipping comparison tests for %s because %s is unavailable\n",
  1491. driver, generic_driver);
  1492. return 0;
  1493. }
  1494. pr_err("alg: hash: error allocating %s (generic impl of %s): %d\n",
  1495. generic_driver, algname, err);
  1496. return err;
  1497. }
  1498. cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
  1499. if (!cfg) {
  1500. err = -ENOMEM;
  1501. goto out;
  1502. }
  1503. generic_desc = kzalloc(sizeof(*desc) +
  1504. crypto_shash_descsize(generic_tfm), GFP_KERNEL);
  1505. if (!generic_desc) {
  1506. err = -ENOMEM;
  1507. goto out;
  1508. }
  1509. generic_desc->tfm = generic_tfm;
  1510. /* Check the algorithm properties for consistency. */
  1511. if (digestsize != crypto_shash_digestsize(generic_tfm)) {
  1512. pr_err("alg: hash: digestsize for %s (%u) doesn't match generic impl (%u)\n",
  1513. driver, digestsize,
  1514. crypto_shash_digestsize(generic_tfm));
  1515. err = -EINVAL;
  1516. goto out;
  1517. }
  1518. if (blocksize != crypto_shash_blocksize(generic_tfm)) {
  1519. pr_err("alg: hash: blocksize for %s (%u) doesn't match generic impl (%u)\n",
  1520. driver, blocksize, crypto_shash_blocksize(generic_tfm));
  1521. err = -EINVAL;
  1522. goto out;
  1523. }
  1524. /*
  1525. * Now generate test vectors using the generic implementation, and test
  1526. * the other implementation against them.
  1527. */
  1528. vec.key = kmalloc(maxkeysize, GFP_KERNEL);
  1529. vec.plaintext = kmalloc(maxdatasize, GFP_KERNEL);
  1530. vec.digest = kmalloc(digestsize, GFP_KERNEL);
  1531. if (!vec.key || !vec.plaintext || !vec.digest) {
  1532. err = -ENOMEM;
  1533. goto out;
  1534. }
  1535. for (i = 0; i < fuzz_iterations * 8; i++) {
  1536. generate_random_hash_testvec(generic_desc, &vec,
  1537. maxkeysize, maxdatasize,
  1538. vec_name, sizeof(vec_name));
  1539. generate_random_testvec_config(cfg, cfgname, sizeof(cfgname));
  1540. err = test_hash_vec_cfg(driver, &vec, vec_name, cfg,
  1541. req, desc, tsgl, hashstate);
  1542. if (err)
  1543. goto out;
  1544. cond_resched();
  1545. }
  1546. err = 0;
  1547. out:
  1548. kfree(cfg);
  1549. kfree(vec.key);
  1550. kfree(vec.plaintext);
  1551. kfree(vec.digest);
  1552. crypto_free_shash(generic_tfm);
  1553. kfree_sensitive(generic_desc);
  1554. return err;
  1555. }
  1556. #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
  1557. static int test_hash_vs_generic_impl(const char *driver,
  1558. const char *generic_driver,
  1559. unsigned int maxkeysize,
  1560. struct ahash_request *req,
  1561. struct shash_desc *desc,
  1562. struct test_sglist *tsgl,
  1563. u8 *hashstate)
  1564. {
  1565. return 0;
  1566. }
  1567. #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
  1568. static int alloc_shash(const char *driver, u32 type, u32 mask,
  1569. struct crypto_shash **tfm_ret,
  1570. struct shash_desc **desc_ret)
  1571. {
  1572. struct crypto_shash *tfm;
  1573. struct shash_desc *desc;
  1574. tfm = crypto_alloc_shash(driver, type, mask);
  1575. if (IS_ERR(tfm)) {
  1576. if (PTR_ERR(tfm) == -ENOENT) {
  1577. /*
  1578. * This algorithm is only available through the ahash
  1579. * API, not the shash API, so skip the shash tests.
  1580. */
  1581. return 0;
  1582. }
  1583. pr_err("alg: hash: failed to allocate shash transform for %s: %ld\n",
  1584. driver, PTR_ERR(tfm));
  1585. return PTR_ERR(tfm);
  1586. }
  1587. desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(tfm), GFP_KERNEL);
  1588. if (!desc) {
  1589. crypto_free_shash(tfm);
  1590. return -ENOMEM;
  1591. }
  1592. desc->tfm = tfm;
  1593. *tfm_ret = tfm;
  1594. *desc_ret = desc;
  1595. return 0;
  1596. }
  1597. static int __alg_test_hash(const struct hash_testvec *vecs,
  1598. unsigned int num_vecs, const char *driver,
  1599. u32 type, u32 mask,
  1600. const char *generic_driver, unsigned int maxkeysize)
  1601. {
  1602. struct crypto_ahash *atfm = NULL;
  1603. struct ahash_request *req = NULL;
  1604. struct crypto_shash *stfm = NULL;
  1605. struct shash_desc *desc = NULL;
  1606. struct test_sglist *tsgl = NULL;
  1607. u8 *hashstate = NULL;
  1608. unsigned int statesize;
  1609. unsigned int i;
  1610. int err;
  1611. /*
  1612. * Always test the ahash API. This works regardless of whether the
  1613. * algorithm is implemented as ahash or shash.
  1614. */
  1615. atfm = crypto_alloc_ahash(driver, type, mask);
  1616. if (IS_ERR(atfm)) {
  1617. pr_err("alg: hash: failed to allocate transform for %s: %ld\n",
  1618. driver, PTR_ERR(atfm));
  1619. return PTR_ERR(atfm);
  1620. }
  1621. req = ahash_request_alloc(atfm, GFP_KERNEL);
  1622. if (!req) {
  1623. pr_err("alg: hash: failed to allocate request for %s\n",
  1624. driver);
  1625. err = -ENOMEM;
  1626. goto out;
  1627. }
  1628. /*
  1629. * If available also test the shash API, to cover corner cases that may
  1630. * be missed by testing the ahash API only.
  1631. */
  1632. err = alloc_shash(driver, type, mask, &stfm, &desc);
  1633. if (err)
  1634. goto out;
  1635. tsgl = kmalloc(sizeof(*tsgl), GFP_KERNEL);
  1636. if (!tsgl || init_test_sglist(tsgl) != 0) {
  1637. pr_err("alg: hash: failed to allocate test buffers for %s\n",
  1638. driver);
  1639. kfree(tsgl);
  1640. tsgl = NULL;
  1641. err = -ENOMEM;
  1642. goto out;
  1643. }
  1644. statesize = crypto_ahash_statesize(atfm);
  1645. if (stfm)
  1646. statesize = max(statesize, crypto_shash_statesize(stfm));
  1647. hashstate = kmalloc(statesize + TESTMGR_POISON_LEN, GFP_KERNEL);
  1648. if (!hashstate) {
  1649. pr_err("alg: hash: failed to allocate hash state buffer for %s\n",
  1650. driver);
  1651. err = -ENOMEM;
  1652. goto out;
  1653. }
  1654. for (i = 0; i < num_vecs; i++) {
  1655. err = test_hash_vec(driver, &vecs[i], i, req, desc, tsgl,
  1656. hashstate);
  1657. if (err)
  1658. goto out;
  1659. cond_resched();
  1660. }
  1661. err = test_hash_vs_generic_impl(driver, generic_driver, maxkeysize, req,
  1662. desc, tsgl, hashstate);
  1663. out:
  1664. kfree(hashstate);
  1665. if (tsgl) {
  1666. destroy_test_sglist(tsgl);
  1667. kfree(tsgl);
  1668. }
  1669. kfree(desc);
  1670. crypto_free_shash(stfm);
  1671. ahash_request_free(req);
  1672. crypto_free_ahash(atfm);
  1673. return err;
  1674. }
  1675. static int alg_test_hash(const struct alg_test_desc *desc, const char *driver,
  1676. u32 type, u32 mask)
  1677. {
  1678. const struct hash_testvec *template = desc->suite.hash.vecs;
  1679. unsigned int tcount = desc->suite.hash.count;
  1680. unsigned int nr_unkeyed, nr_keyed;
  1681. unsigned int maxkeysize = 0;
  1682. int err;
  1683. /*
  1684. * For OPTIONAL_KEY algorithms, we have to do all the unkeyed tests
  1685. * first, before setting a key on the tfm. To make this easier, we
  1686. * require that the unkeyed test vectors (if any) are listed first.
  1687. */
  1688. for (nr_unkeyed = 0; nr_unkeyed < tcount; nr_unkeyed++) {
  1689. if (template[nr_unkeyed].ksize)
  1690. break;
  1691. }
  1692. for (nr_keyed = 0; nr_unkeyed + nr_keyed < tcount; nr_keyed++) {
  1693. if (!template[nr_unkeyed + nr_keyed].ksize) {
  1694. pr_err("alg: hash: test vectors for %s out of order, "
  1695. "unkeyed ones must come first\n", desc->alg);
  1696. return -EINVAL;
  1697. }
  1698. maxkeysize = max_t(unsigned int, maxkeysize,
  1699. template[nr_unkeyed + nr_keyed].ksize);
  1700. }
  1701. err = 0;
  1702. if (nr_unkeyed) {
  1703. err = __alg_test_hash(template, nr_unkeyed, driver, type, mask,
  1704. desc->generic_driver, maxkeysize);
  1705. template += nr_unkeyed;
  1706. }
  1707. if (!err && nr_keyed)
  1708. err = __alg_test_hash(template, nr_keyed, driver, type, mask,
  1709. desc->generic_driver, maxkeysize);
  1710. return err;
  1711. }
  1712. static int test_aead_vec_cfg(const char *driver, int enc,
  1713. const struct aead_testvec *vec,
  1714. const char *vec_name,
  1715. const struct testvec_config *cfg,
  1716. struct aead_request *req,
  1717. struct cipher_test_sglists *tsgls)
  1718. {
  1719. struct crypto_aead *tfm = crypto_aead_reqtfm(req);
  1720. const unsigned int alignmask = crypto_aead_alignmask(tfm);
  1721. const unsigned int ivsize = crypto_aead_ivsize(tfm);
  1722. const unsigned int authsize = vec->clen - vec->plen;
  1723. const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
  1724. const char *op = enc ? "encryption" : "decryption";
  1725. DECLARE_CRYPTO_WAIT(wait);
  1726. u8 _iv[3 * (MAX_ALGAPI_ALIGNMASK + 1) + MAX_IVLEN];
  1727. u8 *iv = PTR_ALIGN(&_iv[0], 2 * (MAX_ALGAPI_ALIGNMASK + 1)) +
  1728. cfg->iv_offset +
  1729. (cfg->iv_offset_relative_to_alignmask ? alignmask : 0);
  1730. struct kvec input[2];
  1731. int err;
  1732. /* Set the key */
  1733. if (vec->wk)
  1734. crypto_aead_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
  1735. else
  1736. crypto_aead_clear_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
  1737. err = do_setkey(crypto_aead_setkey, tfm, vec->key, vec->klen,
  1738. cfg, alignmask);
  1739. if (err && err != vec->setkey_error) {
  1740. pr_err("alg: aead: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
  1741. driver, vec_name, vec->setkey_error, err,
  1742. crypto_aead_get_flags(tfm));
  1743. return err;
  1744. }
  1745. if (!err && vec->setkey_error) {
  1746. pr_err("alg: aead: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
  1747. driver, vec_name, vec->setkey_error);
  1748. return -EINVAL;
  1749. }
  1750. /* Set the authentication tag size */
  1751. err = crypto_aead_setauthsize(tfm, authsize);
  1752. if (err && err != vec->setauthsize_error) {
  1753. pr_err("alg: aead: %s setauthsize failed on test vector %s; expected_error=%d, actual_error=%d\n",
  1754. driver, vec_name, vec->setauthsize_error, err);
  1755. return err;
  1756. }
  1757. if (!err && vec->setauthsize_error) {
  1758. pr_err("alg: aead: %s setauthsize unexpectedly succeeded on test vector %s; expected_error=%d\n",
  1759. driver, vec_name, vec->setauthsize_error);
  1760. return -EINVAL;
  1761. }
  1762. if (vec->setkey_error || vec->setauthsize_error)
  1763. return 0;
  1764. /* The IV must be copied to a buffer, as the algorithm may modify it */
  1765. if (WARN_ON(ivsize > MAX_IVLEN))
  1766. return -EINVAL;
  1767. if (vec->iv)
  1768. memcpy(iv, vec->iv, ivsize);
  1769. else
  1770. memset(iv, 0, ivsize);
  1771. /* Build the src/dst scatterlists */
  1772. input[0].iov_base = (void *)vec->assoc;
  1773. input[0].iov_len = vec->alen;
  1774. input[1].iov_base = enc ? (void *)vec->ptext : (void *)vec->ctext;
  1775. input[1].iov_len = enc ? vec->plen : vec->clen;
  1776. err = build_cipher_test_sglists(tsgls, cfg, alignmask,
  1777. vec->alen + (enc ? vec->plen :
  1778. vec->clen),
  1779. vec->alen + (enc ? vec->clen :
  1780. vec->plen),
  1781. input, 2);
  1782. if (err) {
  1783. pr_err("alg: aead: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n",
  1784. driver, op, vec_name, cfg->name);
  1785. return err;
  1786. }
  1787. /* Do the actual encryption or decryption */
  1788. testmgr_poison(req->__ctx, crypto_aead_reqsize(tfm));
  1789. aead_request_set_callback(req, req_flags, crypto_req_done, &wait);
  1790. aead_request_set_crypt(req, tsgls->src.sgl_ptr, tsgls->dst.sgl_ptr,
  1791. enc ? vec->plen : vec->clen, iv);
  1792. aead_request_set_ad(req, vec->alen);
  1793. if (cfg->nosimd)
  1794. crypto_disable_simd_for_test();
  1795. err = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);
  1796. if (cfg->nosimd)
  1797. crypto_reenable_simd_for_test();
  1798. err = crypto_wait_req(err, &wait);
  1799. /* Check that the algorithm didn't overwrite things it shouldn't have */
  1800. if (req->cryptlen != (enc ? vec->plen : vec->clen) ||
  1801. req->assoclen != vec->alen ||
  1802. req->iv != iv ||
  1803. req->src != tsgls->src.sgl_ptr ||
  1804. req->dst != tsgls->dst.sgl_ptr ||
  1805. crypto_aead_reqtfm(req) != tfm ||
  1806. req->base.complete != crypto_req_done ||
  1807. req->base.flags != req_flags ||
  1808. req->base.data != &wait) {
  1809. pr_err("alg: aead: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n",
  1810. driver, op, vec_name, cfg->name);
  1811. if (req->cryptlen != (enc ? vec->plen : vec->clen))
  1812. pr_err("alg: aead: changed 'req->cryptlen'\n");
  1813. if (req->assoclen != vec->alen)
  1814. pr_err("alg: aead: changed 'req->assoclen'\n");
  1815. if (req->iv != iv)
  1816. pr_err("alg: aead: changed 'req->iv'\n");
  1817. if (req->src != tsgls->src.sgl_ptr)
  1818. pr_err("alg: aead: changed 'req->src'\n");
  1819. if (req->dst != tsgls->dst.sgl_ptr)
  1820. pr_err("alg: aead: changed 'req->dst'\n");
  1821. if (crypto_aead_reqtfm(req) != tfm)
  1822. pr_err("alg: aead: changed 'req->base.tfm'\n");
  1823. if (req->base.complete != crypto_req_done)
  1824. pr_err("alg: aead: changed 'req->base.complete'\n");
  1825. if (req->base.flags != req_flags)
  1826. pr_err("alg: aead: changed 'req->base.flags'\n");
  1827. if (req->base.data != &wait)
  1828. pr_err("alg: aead: changed 'req->base.data'\n");
  1829. return -EINVAL;
  1830. }
  1831. if (is_test_sglist_corrupted(&tsgls->src)) {
  1832. pr_err("alg: aead: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n",
  1833. driver, op, vec_name, cfg->name);
  1834. return -EINVAL;
  1835. }
  1836. if (tsgls->dst.sgl_ptr != tsgls->src.sgl &&
  1837. is_test_sglist_corrupted(&tsgls->dst)) {
  1838. pr_err("alg: aead: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n",
  1839. driver, op, vec_name, cfg->name);
  1840. return -EINVAL;
  1841. }
  1842. /* Check for unexpected success or failure, or wrong error code */
  1843. if ((err == 0 && vec->novrfy) ||
  1844. (err != vec->crypt_error && !(err == -EBADMSG && vec->novrfy))) {
  1845. char expected_error[32];
  1846. if (vec->novrfy &&
  1847. vec->crypt_error != 0 && vec->crypt_error != -EBADMSG)
  1848. sprintf(expected_error, "-EBADMSG or %d",
  1849. vec->crypt_error);
  1850. else if (vec->novrfy)
  1851. sprintf(expected_error, "-EBADMSG");
  1852. else
  1853. sprintf(expected_error, "%d", vec->crypt_error);
  1854. if (err) {
  1855. pr_err("alg: aead: %s %s failed on test vector %s; expected_error=%s, actual_error=%d, cfg=\"%s\"\n",
  1856. driver, op, vec_name, expected_error, err,
  1857. cfg->name);
  1858. return err;
  1859. }
  1860. pr_err("alg: aead: %s %s unexpectedly succeeded on test vector %s; expected_error=%s, cfg=\"%s\"\n",
  1861. driver, op, vec_name, expected_error, cfg->name);
  1862. return -EINVAL;
  1863. }
  1864. if (err) /* Expectedly failed. */
  1865. return 0;
  1866. /* Check for the correct output (ciphertext or plaintext) */
  1867. err = verify_correct_output(&tsgls->dst, enc ? vec->ctext : vec->ptext,
  1868. enc ? vec->clen : vec->plen,
  1869. vec->alen, enc || !cfg->inplace);
  1870. if (err == -EOVERFLOW) {
  1871. pr_err("alg: aead: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n",
  1872. driver, op, vec_name, cfg->name);
  1873. return err;
  1874. }
  1875. if (err) {
  1876. pr_err("alg: aead: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
  1877. driver, op, vec_name, cfg->name);
  1878. return err;
  1879. }
  1880. return 0;
  1881. }
  1882. static int test_aead_vec(const char *driver, int enc,
  1883. const struct aead_testvec *vec, unsigned int vec_num,
  1884. struct aead_request *req,
  1885. struct cipher_test_sglists *tsgls)
  1886. {
  1887. char vec_name[16];
  1888. unsigned int i;
  1889. int err;
  1890. if (enc && vec->novrfy)
  1891. return 0;
  1892. sprintf(vec_name, "%u", vec_num);
  1893. for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) {
  1894. err = test_aead_vec_cfg(driver, enc, vec, vec_name,
  1895. &default_cipher_testvec_configs[i],
  1896. req, tsgls);
  1897. if (err)
  1898. return err;
  1899. }
  1900. #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
  1901. if (!noextratests) {
  1902. struct testvec_config cfg;
  1903. char cfgname[TESTVEC_CONFIG_NAMELEN];
  1904. for (i = 0; i < fuzz_iterations; i++) {
  1905. generate_random_testvec_config(&cfg, cfgname,
  1906. sizeof(cfgname));
  1907. err = test_aead_vec_cfg(driver, enc, vec, vec_name,
  1908. &cfg, req, tsgls);
  1909. if (err)
  1910. return err;
  1911. cond_resched();
  1912. }
  1913. }
  1914. #endif
  1915. return 0;
  1916. }
  1917. #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
  1918. struct aead_extra_tests_ctx {
  1919. struct aead_request *req;
  1920. struct crypto_aead *tfm;
  1921. const char *driver;
  1922. const struct alg_test_desc *test_desc;
  1923. struct cipher_test_sglists *tsgls;
  1924. unsigned int maxdatasize;
  1925. unsigned int maxkeysize;
  1926. struct aead_testvec vec;
  1927. char vec_name[64];
  1928. char cfgname[TESTVEC_CONFIG_NAMELEN];
  1929. struct testvec_config cfg;
  1930. };
  1931. /*
  1932. * Make at least one random change to a (ciphertext, AAD) pair. "Ciphertext"
  1933. * here means the full ciphertext including the authentication tag. The
  1934. * authentication tag (and hence also the ciphertext) is assumed to be nonempty.
  1935. */
  1936. static void mutate_aead_message(struct aead_testvec *vec, bool aad_iv,
  1937. unsigned int ivsize)
  1938. {
  1939. const unsigned int aad_tail_size = aad_iv ? ivsize : 0;
  1940. const unsigned int authsize = vec->clen - vec->plen;
  1941. if (prandom_u32() % 2 == 0 && vec->alen > aad_tail_size) {
  1942. /* Mutate the AAD */
  1943. flip_random_bit((u8 *)vec->assoc, vec->alen - aad_tail_size);
  1944. if (prandom_u32() % 2 == 0)
  1945. return;
  1946. }
  1947. if (prandom_u32() % 2 == 0) {
  1948. /* Mutate auth tag (assuming it's at the end of ciphertext) */
  1949. flip_random_bit((u8 *)vec->ctext + vec->plen, authsize);
  1950. } else {
  1951. /* Mutate any part of the ciphertext */
  1952. flip_random_bit((u8 *)vec->ctext, vec->clen);
  1953. }
  1954. }
  1955. /*
  1956. * Minimum authentication tag size in bytes at which we assume that we can
  1957. * reliably generate inauthentic messages, i.e. not generate an authentic
  1958. * message by chance.
  1959. */
  1960. #define MIN_COLLISION_FREE_AUTHSIZE 8
  1961. static void generate_aead_message(struct aead_request *req,
  1962. const struct aead_test_suite *suite,
  1963. struct aead_testvec *vec,
  1964. bool prefer_inauthentic)
  1965. {
  1966. struct crypto_aead *tfm = crypto_aead_reqtfm(req);
  1967. const unsigned int ivsize = crypto_aead_ivsize(tfm);
  1968. const unsigned int authsize = vec->clen - vec->plen;
  1969. const bool inauthentic = (authsize >= MIN_COLLISION_FREE_AUTHSIZE) &&
  1970. (prefer_inauthentic || prandom_u32() % 4 == 0);
  1971. /* Generate the AAD. */
  1972. generate_random_bytes((u8 *)vec->assoc, vec->alen);
  1973. if (suite->aad_iv && vec->alen >= ivsize)
  1974. /* Avoid implementation-defined behavior. */
  1975. memcpy((u8 *)vec->assoc + vec->alen - ivsize, vec->iv, ivsize);
  1976. if (inauthentic && prandom_u32() % 2 == 0) {
  1977. /* Generate a random ciphertext. */
  1978. generate_random_bytes((u8 *)vec->ctext, vec->clen);
  1979. } else {
  1980. int i = 0;
  1981. struct scatterlist src[2], dst;
  1982. u8 iv[MAX_IVLEN];
  1983. DECLARE_CRYPTO_WAIT(wait);
  1984. /* Generate a random plaintext and encrypt it. */
  1985. sg_init_table(src, 2);
  1986. if (vec->alen)
  1987. sg_set_buf(&src[i++], vec->assoc, vec->alen);
  1988. if (vec->plen) {
  1989. generate_random_bytes((u8 *)vec->ptext, vec->plen);
  1990. sg_set_buf(&src[i++], vec->ptext, vec->plen);
  1991. }
  1992. sg_init_one(&dst, vec->ctext, vec->alen + vec->clen);
  1993. memcpy(iv, vec->iv, ivsize);
  1994. aead_request_set_callback(req, 0, crypto_req_done, &wait);
  1995. aead_request_set_crypt(req, src, &dst, vec->plen, iv);
  1996. aead_request_set_ad(req, vec->alen);
  1997. vec->crypt_error = crypto_wait_req(crypto_aead_encrypt(req),
  1998. &wait);
  1999. /* If encryption failed, we're done. */
  2000. if (vec->crypt_error != 0)
  2001. return;
  2002. memmove((u8 *)vec->ctext, vec->ctext + vec->alen, vec->clen);
  2003. if (!inauthentic)
  2004. return;
  2005. /*
  2006. * Mutate the authentic (ciphertext, AAD) pair to get an
  2007. * inauthentic one.
  2008. */
  2009. mutate_aead_message(vec, suite->aad_iv, ivsize);
  2010. }
  2011. vec->novrfy = 1;
  2012. if (suite->einval_allowed)
  2013. vec->crypt_error = -EINVAL;
  2014. }
  2015. /*
  2016. * Generate an AEAD test vector 'vec' using the implementation specified by
  2017. * 'req'. The buffers in 'vec' must already be allocated.
  2018. *
  2019. * If 'prefer_inauthentic' is true, then this function will generate inauthentic
  2020. * test vectors (i.e. vectors with 'vec->novrfy=1') more often.
  2021. */
  2022. static void generate_random_aead_testvec(struct aead_request *req,
  2023. struct aead_testvec *vec,
  2024. const struct aead_test_suite *suite,
  2025. unsigned int maxkeysize,
  2026. unsigned int maxdatasize,
  2027. char *name, size_t max_namelen,
  2028. bool prefer_inauthentic)
  2029. {
  2030. struct crypto_aead *tfm = crypto_aead_reqtfm(req);
  2031. const unsigned int ivsize = crypto_aead_ivsize(tfm);
  2032. const unsigned int maxauthsize = crypto_aead_maxauthsize(tfm);
  2033. unsigned int authsize;
  2034. unsigned int total_len;
  2035. /* Key: length in [0, maxkeysize], but usually choose maxkeysize */
  2036. vec->klen = maxkeysize;
  2037. if (prandom_u32() % 4 == 0)
  2038. vec->klen = prandom_u32() % (maxkeysize + 1);
  2039. generate_random_bytes((u8 *)vec->key, vec->klen);
  2040. vec->setkey_error = crypto_aead_setkey(tfm, vec->key, vec->klen);
  2041. /* IV */
  2042. generate_random_bytes((u8 *)vec->iv, ivsize);
  2043. /* Tag length: in [0, maxauthsize], but usually choose maxauthsize */
  2044. authsize = maxauthsize;
  2045. if (prandom_u32() % 4 == 0)
  2046. authsize = prandom_u32() % (maxauthsize + 1);
  2047. if (prefer_inauthentic && authsize < MIN_COLLISION_FREE_AUTHSIZE)
  2048. authsize = MIN_COLLISION_FREE_AUTHSIZE;
  2049. if (WARN_ON(authsize > maxdatasize))
  2050. authsize = maxdatasize;
  2051. maxdatasize -= authsize;
  2052. vec->setauthsize_error = crypto_aead_setauthsize(tfm, authsize);
  2053. /* AAD, plaintext, and ciphertext lengths */
  2054. total_len = generate_random_length(maxdatasize);
  2055. if (prandom_u32() % 4 == 0)
  2056. vec->alen = 0;
  2057. else
  2058. vec->alen = generate_random_length(total_len);
  2059. vec->plen = total_len - vec->alen;
  2060. vec->clen = vec->plen + authsize;
  2061. /*
  2062. * Generate the AAD, plaintext, and ciphertext. Not applicable if the
  2063. * key or the authentication tag size couldn't be set.
  2064. */
  2065. vec->novrfy = 0;
  2066. vec->crypt_error = 0;
  2067. if (vec->setkey_error == 0 && vec->setauthsize_error == 0)
  2068. generate_aead_message(req, suite, vec, prefer_inauthentic);
  2069. snprintf(name, max_namelen,
  2070. "\"random: alen=%u plen=%u authsize=%u klen=%u novrfy=%d\"",
  2071. vec->alen, vec->plen, authsize, vec->klen, vec->novrfy);
  2072. }
  2073. static void try_to_generate_inauthentic_testvec(
  2074. struct aead_extra_tests_ctx *ctx)
  2075. {
  2076. int i;
  2077. for (i = 0; i < 10; i++) {
  2078. generate_random_aead_testvec(ctx->req, &ctx->vec,
  2079. &ctx->test_desc->suite.aead,
  2080. ctx->maxkeysize, ctx->maxdatasize,
  2081. ctx->vec_name,
  2082. sizeof(ctx->vec_name), true);
  2083. if (ctx->vec.novrfy)
  2084. return;
  2085. }
  2086. }
  2087. /*
  2088. * Generate inauthentic test vectors (i.e. ciphertext, AAD pairs that aren't the
  2089. * result of an encryption with the key) and verify that decryption fails.
  2090. */
  2091. static int test_aead_inauthentic_inputs(struct aead_extra_tests_ctx *ctx)
  2092. {
  2093. unsigned int i;
  2094. int err;
  2095. for (i = 0; i < fuzz_iterations * 8; i++) {
  2096. /*
  2097. * Since this part of the tests isn't comparing the
  2098. * implementation to another, there's no point in testing any
  2099. * test vectors other than inauthentic ones (vec.novrfy=1) here.
  2100. *
  2101. * If we're having trouble generating such a test vector, e.g.
  2102. * if the algorithm keeps rejecting the generated keys, don't
  2103. * retry forever; just continue on.
  2104. */
  2105. try_to_generate_inauthentic_testvec(ctx);
  2106. if (ctx->vec.novrfy) {
  2107. generate_random_testvec_config(&ctx->cfg, ctx->cfgname,
  2108. sizeof(ctx->cfgname));
  2109. err = test_aead_vec_cfg(ctx->driver, DECRYPT, &ctx->vec,
  2110. ctx->vec_name, &ctx->cfg,
  2111. ctx->req, ctx->tsgls);
  2112. if (err)
  2113. return err;
  2114. }
  2115. cond_resched();
  2116. }
  2117. return 0;
  2118. }
  2119. /*
  2120. * Test the AEAD algorithm against the corresponding generic implementation, if
  2121. * one is available.
  2122. */
  2123. static int test_aead_vs_generic_impl(struct aead_extra_tests_ctx *ctx)
  2124. {
  2125. struct crypto_aead *tfm = ctx->tfm;
  2126. const char *algname = crypto_aead_alg(tfm)->base.cra_name;
  2127. const char *driver = ctx->driver;
  2128. const char *generic_driver = ctx->test_desc->generic_driver;
  2129. char _generic_driver[CRYPTO_MAX_ALG_NAME];
  2130. struct crypto_aead *generic_tfm = NULL;
  2131. struct aead_request *generic_req = NULL;
  2132. unsigned int i;
  2133. int err;
  2134. if (!generic_driver) { /* Use default naming convention? */
  2135. err = build_generic_driver_name(algname, _generic_driver);
  2136. if (err)
  2137. return err;
  2138. generic_driver = _generic_driver;
  2139. }
  2140. if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */
  2141. return 0;
  2142. generic_tfm = crypto_alloc_aead(generic_driver, 0, 0);
  2143. if (IS_ERR(generic_tfm)) {
  2144. err = PTR_ERR(generic_tfm);
  2145. if (err == -ENOENT) {
  2146. pr_warn("alg: aead: skipping comparison tests for %s because %s is unavailable\n",
  2147. driver, generic_driver);
  2148. return 0;
  2149. }
  2150. pr_err("alg: aead: error allocating %s (generic impl of %s): %d\n",
  2151. generic_driver, algname, err);
  2152. return err;
  2153. }
  2154. generic_req = aead_request_alloc(generic_tfm, GFP_KERNEL);
  2155. if (!generic_req) {
  2156. err = -ENOMEM;
  2157. goto out;
  2158. }
  2159. /* Check the algorithm properties for consistency. */
  2160. if (crypto_aead_maxauthsize(tfm) !=
  2161. crypto_aead_maxauthsize(generic_tfm)) {
  2162. pr_err("alg: aead: maxauthsize for %s (%u) doesn't match generic impl (%u)\n",
  2163. driver, crypto_aead_maxauthsize(tfm),
  2164. crypto_aead_maxauthsize(generic_tfm));
  2165. err = -EINVAL;
  2166. goto out;
  2167. }
  2168. if (crypto_aead_ivsize(tfm) != crypto_aead_ivsize(generic_tfm)) {
  2169. pr_err("alg: aead: ivsize for %s (%u) doesn't match generic impl (%u)\n",
  2170. driver, crypto_aead_ivsize(tfm),
  2171. crypto_aead_ivsize(generic_tfm));
  2172. err = -EINVAL;
  2173. goto out;
  2174. }
  2175. if (crypto_aead_blocksize(tfm) != crypto_aead_blocksize(generic_tfm)) {
  2176. pr_err("alg: aead: blocksize for %s (%u) doesn't match generic impl (%u)\n",
  2177. driver, crypto_aead_blocksize(tfm),
  2178. crypto_aead_blocksize(generic_tfm));
  2179. err = -EINVAL;
  2180. goto out;
  2181. }
  2182. /*
  2183. * Now generate test vectors using the generic implementation, and test
  2184. * the other implementation against them.
  2185. */
  2186. for (i = 0; i < fuzz_iterations * 8; i++) {
  2187. generate_random_aead_testvec(generic_req, &ctx->vec,
  2188. &ctx->test_desc->suite.aead,
  2189. ctx->maxkeysize, ctx->maxdatasize,
  2190. ctx->vec_name,
  2191. sizeof(ctx->vec_name), false);
  2192. generate_random_testvec_config(&ctx->cfg, ctx->cfgname,
  2193. sizeof(ctx->cfgname));
  2194. if (!ctx->vec.novrfy) {
  2195. err = test_aead_vec_cfg(driver, ENCRYPT, &ctx->vec,
  2196. ctx->vec_name, &ctx->cfg,
  2197. ctx->req, ctx->tsgls);
  2198. if (err)
  2199. goto out;
  2200. }
  2201. if (ctx->vec.crypt_error == 0 || ctx->vec.novrfy) {
  2202. err = test_aead_vec_cfg(driver, DECRYPT, &ctx->vec,
  2203. ctx->vec_name, &ctx->cfg,
  2204. ctx->req, ctx->tsgls);
  2205. if (err)
  2206. goto out;
  2207. }
  2208. cond_resched();
  2209. }
  2210. err = 0;
  2211. out:
  2212. crypto_free_aead(generic_tfm);
  2213. aead_request_free(generic_req);
  2214. return err;
  2215. }
  2216. static int test_aead_extra(const char *driver,
  2217. const struct alg_test_desc *test_desc,
  2218. struct aead_request *req,
  2219. struct cipher_test_sglists *tsgls)
  2220. {
  2221. struct aead_extra_tests_ctx *ctx;
  2222. unsigned int i;
  2223. int err;
  2224. if (noextratests)
  2225. return 0;
  2226. ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
  2227. if (!ctx)
  2228. return -ENOMEM;
  2229. ctx->req = req;
  2230. ctx->tfm = crypto_aead_reqtfm(req);
  2231. ctx->driver = driver;
  2232. ctx->test_desc = test_desc;
  2233. ctx->tsgls = tsgls;
  2234. ctx->maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN;
  2235. ctx->maxkeysize = 0;
  2236. for (i = 0; i < test_desc->suite.aead.count; i++)
  2237. ctx->maxkeysize = max_t(unsigned int, ctx->maxkeysize,
  2238. test_desc->suite.aead.vecs[i].klen);
  2239. ctx->vec.key = kmalloc(ctx->maxkeysize, GFP_KERNEL);
  2240. ctx->vec.iv = kmalloc(crypto_aead_ivsize(ctx->tfm), GFP_KERNEL);
  2241. ctx->vec.assoc = kmalloc(ctx->maxdatasize, GFP_KERNEL);
  2242. ctx->vec.ptext = kmalloc(ctx->maxdatasize, GFP_KERNEL);
  2243. ctx->vec.ctext = kmalloc(ctx->maxdatasize, GFP_KERNEL);
  2244. if (!ctx->vec.key || !ctx->vec.iv || !ctx->vec.assoc ||
  2245. !ctx->vec.ptext || !ctx->vec.ctext) {
  2246. err = -ENOMEM;
  2247. goto out;
  2248. }
  2249. err = test_aead_vs_generic_impl(ctx);
  2250. if (err)
  2251. goto out;
  2252. err = test_aead_inauthentic_inputs(ctx);
  2253. out:
  2254. kfree(ctx->vec.key);
  2255. kfree(ctx->vec.iv);
  2256. kfree(ctx->vec.assoc);
  2257. kfree(ctx->vec.ptext);
  2258. kfree(ctx->vec.ctext);
  2259. kfree(ctx);
  2260. return err;
  2261. }
  2262. #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
  2263. static int test_aead_extra(const char *driver,
  2264. const struct alg_test_desc *test_desc,
  2265. struct aead_request *req,
  2266. struct cipher_test_sglists *tsgls)
  2267. {
  2268. return 0;
  2269. }
  2270. #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
  2271. static int test_aead(const char *driver, int enc,
  2272. const struct aead_test_suite *suite,
  2273. struct aead_request *req,
  2274. struct cipher_test_sglists *tsgls)
  2275. {
  2276. unsigned int i;
  2277. int err;
  2278. for (i = 0; i < suite->count; i++) {
  2279. err = test_aead_vec(driver, enc, &suite->vecs[i], i, req,
  2280. tsgls);
  2281. if (err)
  2282. return err;
  2283. cond_resched();
  2284. }
  2285. return 0;
  2286. }
  2287. static int alg_test_aead(const struct alg_test_desc *desc, const char *driver,
  2288. u32 type, u32 mask)
  2289. {
  2290. const struct aead_test_suite *suite = &desc->suite.aead;
  2291. struct crypto_aead *tfm;
  2292. struct aead_request *req = NULL;
  2293. struct cipher_test_sglists *tsgls = NULL;
  2294. int err;
  2295. if (suite->count <= 0) {
  2296. pr_err("alg: aead: empty test suite for %s\n", driver);
  2297. return -EINVAL;
  2298. }
  2299. tfm = crypto_alloc_aead(driver, type, mask);
  2300. if (IS_ERR(tfm)) {
  2301. pr_err("alg: aead: failed to allocate transform for %s: %ld\n",
  2302. driver, PTR_ERR(tfm));
  2303. return PTR_ERR(tfm);
  2304. }
  2305. req = aead_request_alloc(tfm, GFP_KERNEL);
  2306. if (!req) {
  2307. pr_err("alg: aead: failed to allocate request for %s\n",
  2308. driver);
  2309. err = -ENOMEM;
  2310. goto out;
  2311. }
  2312. tsgls = alloc_cipher_test_sglists();
  2313. if (!tsgls) {
  2314. pr_err("alg: aead: failed to allocate test buffers for %s\n",
  2315. driver);
  2316. err = -ENOMEM;
  2317. goto out;
  2318. }
  2319. err = test_aead(driver, ENCRYPT, suite, req, tsgls);
  2320. if (err)
  2321. goto out;
  2322. err = test_aead(driver, DECRYPT, suite, req, tsgls);
  2323. if (err)
  2324. goto out;
  2325. err = test_aead_extra(driver, desc, req, tsgls);
  2326. out:
  2327. free_cipher_test_sglists(tsgls);
  2328. aead_request_free(req);
  2329. crypto_free_aead(tfm);
  2330. return err;
  2331. }
  2332. static int test_cipher(struct crypto_cipher *tfm, int enc,
  2333. const struct cipher_testvec *template,
  2334. unsigned int tcount)
  2335. {
  2336. const char *algo = crypto_tfm_alg_driver_name(crypto_cipher_tfm(tfm));
  2337. unsigned int i, j, k;
  2338. char *q;
  2339. const char *e;
  2340. const char *input, *result;
  2341. void *data;
  2342. char *xbuf[XBUFSIZE];
  2343. int ret = -ENOMEM;
  2344. if (testmgr_alloc_buf(xbuf))
  2345. goto out_nobuf;
  2346. if (enc == ENCRYPT)
  2347. e = "encryption";
  2348. else
  2349. e = "decryption";
  2350. j = 0;
  2351. for (i = 0; i < tcount; i++) {
  2352. if (fips_enabled && template[i].fips_skip)
  2353. continue;
  2354. input = enc ? template[i].ptext : template[i].ctext;
  2355. result = enc ? template[i].ctext : template[i].ptext;
  2356. j++;
  2357. ret = -EINVAL;
  2358. if (WARN_ON(template[i].len > PAGE_SIZE))
  2359. goto out;
  2360. data = xbuf[0];
  2361. memcpy(data, input, template[i].len);
  2362. crypto_cipher_clear_flags(tfm, ~0);
  2363. if (template[i].wk)
  2364. crypto_cipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
  2365. ret = crypto_cipher_setkey(tfm, template[i].key,
  2366. template[i].klen);
  2367. if (ret) {
  2368. if (ret == template[i].setkey_error)
  2369. continue;
  2370. pr_err("alg: cipher: %s setkey failed on test vector %u; expected_error=%d, actual_error=%d, flags=%#x\n",
  2371. algo, j, template[i].setkey_error, ret,
  2372. crypto_cipher_get_flags(tfm));
  2373. goto out;
  2374. }
  2375. if (template[i].setkey_error) {
  2376. pr_err("alg: cipher: %s setkey unexpectedly succeeded on test vector %u; expected_error=%d\n",
  2377. algo, j, template[i].setkey_error);
  2378. ret = -EINVAL;
  2379. goto out;
  2380. }
  2381. for (k = 0; k < template[i].len;
  2382. k += crypto_cipher_blocksize(tfm)) {
  2383. if (enc)
  2384. crypto_cipher_encrypt_one(tfm, data + k,
  2385. data + k);
  2386. else
  2387. crypto_cipher_decrypt_one(tfm, data + k,
  2388. data + k);
  2389. }
  2390. q = data;
  2391. if (memcmp(q, result, template[i].len)) {
  2392. printk(KERN_ERR "alg: cipher: Test %d failed "
  2393. "on %s for %s\n", j, e, algo);
  2394. hexdump(q, template[i].len);
  2395. ret = -EINVAL;
  2396. goto out;
  2397. }
  2398. }
  2399. ret = 0;
  2400. out:
  2401. testmgr_free_buf(xbuf);
  2402. out_nobuf:
  2403. return ret;
  2404. }
  2405. static int test_skcipher_vec_cfg(const char *driver, int enc,
  2406. const struct cipher_testvec *vec,
  2407. const char *vec_name,
  2408. const struct testvec_config *cfg,
  2409. struct skcipher_request *req,
  2410. struct cipher_test_sglists *tsgls)
  2411. {
  2412. struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
  2413. const unsigned int alignmask = crypto_skcipher_alignmask(tfm);
  2414. const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
  2415. const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
  2416. const char *op = enc ? "encryption" : "decryption";
  2417. DECLARE_CRYPTO_WAIT(wait);
  2418. u8 _iv[3 * (MAX_ALGAPI_ALIGNMASK + 1) + MAX_IVLEN];
  2419. u8 *iv = PTR_ALIGN(&_iv[0], 2 * (MAX_ALGAPI_ALIGNMASK + 1)) +
  2420. cfg->iv_offset +
  2421. (cfg->iv_offset_relative_to_alignmask ? alignmask : 0);
  2422. struct kvec input;
  2423. int err;
  2424. /* Set the key */
  2425. if (vec->wk)
  2426. crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
  2427. else
  2428. crypto_skcipher_clear_flags(tfm,
  2429. CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
  2430. err = do_setkey(crypto_skcipher_setkey, tfm, vec->key, vec->klen,
  2431. cfg, alignmask);
  2432. if (err) {
  2433. if (err == vec->setkey_error)
  2434. return 0;
  2435. pr_err("alg: skcipher: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
  2436. driver, vec_name, vec->setkey_error, err,
  2437. crypto_skcipher_get_flags(tfm));
  2438. return err;
  2439. }
  2440. if (vec->setkey_error) {
  2441. pr_err("alg: skcipher: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
  2442. driver, vec_name, vec->setkey_error);
  2443. return -EINVAL;
  2444. }
  2445. /* The IV must be copied to a buffer, as the algorithm may modify it */
  2446. if (ivsize) {
  2447. if (WARN_ON(ivsize > MAX_IVLEN))
  2448. return -EINVAL;
  2449. if (vec->generates_iv && !enc)
  2450. memcpy(iv, vec->iv_out, ivsize);
  2451. else if (vec->iv)
  2452. memcpy(iv, vec->iv, ivsize);
  2453. else
  2454. memset(iv, 0, ivsize);
  2455. } else {
  2456. if (vec->generates_iv) {
  2457. pr_err("alg: skcipher: %s has ivsize=0 but test vector %s generates IV!\n",
  2458. driver, vec_name);
  2459. return -EINVAL;
  2460. }
  2461. iv = NULL;
  2462. }
  2463. /* Build the src/dst scatterlists */
  2464. input.iov_base = enc ? (void *)vec->ptext : (void *)vec->ctext;
  2465. input.iov_len = vec->len;
  2466. err = build_cipher_test_sglists(tsgls, cfg, alignmask,
  2467. vec->len, vec->len, &input, 1);
  2468. if (err) {
  2469. pr_err("alg: skcipher: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n",
  2470. driver, op, vec_name, cfg->name);
  2471. return err;
  2472. }
  2473. /* Do the actual encryption or decryption */
  2474. testmgr_poison(req->__ctx, crypto_skcipher_reqsize(tfm));
  2475. skcipher_request_set_callback(req, req_flags, crypto_req_done, &wait);
  2476. skcipher_request_set_crypt(req, tsgls->src.sgl_ptr, tsgls->dst.sgl_ptr,
  2477. vec->len, iv);
  2478. if (cfg->nosimd)
  2479. crypto_disable_simd_for_test();
  2480. err = enc ? crypto_skcipher_encrypt(req) : crypto_skcipher_decrypt(req);
  2481. if (cfg->nosimd)
  2482. crypto_reenable_simd_for_test();
  2483. err = crypto_wait_req(err, &wait);
  2484. /* Check that the algorithm didn't overwrite things it shouldn't have */
  2485. if (req->cryptlen != vec->len ||
  2486. req->iv != iv ||
  2487. req->src != tsgls->src.sgl_ptr ||
  2488. req->dst != tsgls->dst.sgl_ptr ||
  2489. crypto_skcipher_reqtfm(req) != tfm ||
  2490. req->base.complete != crypto_req_done ||
  2491. req->base.flags != req_flags ||
  2492. req->base.data != &wait) {
  2493. pr_err("alg: skcipher: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n",
  2494. driver, op, vec_name, cfg->name);
  2495. if (req->cryptlen != vec->len)
  2496. pr_err("alg: skcipher: changed 'req->cryptlen'\n");
  2497. if (req->iv != iv)
  2498. pr_err("alg: skcipher: changed 'req->iv'\n");
  2499. if (req->src != tsgls->src.sgl_ptr)
  2500. pr_err("alg: skcipher: changed 'req->src'\n");
  2501. if (req->dst != tsgls->dst.sgl_ptr)
  2502. pr_err("alg: skcipher: changed 'req->dst'\n");
  2503. if (crypto_skcipher_reqtfm(req) != tfm)
  2504. pr_err("alg: skcipher: changed 'req->base.tfm'\n");
  2505. if (req->base.complete != crypto_req_done)
  2506. pr_err("alg: skcipher: changed 'req->base.complete'\n");
  2507. if (req->base.flags != req_flags)
  2508. pr_err("alg: skcipher: changed 'req->base.flags'\n");
  2509. if (req->base.data != &wait)
  2510. pr_err("alg: skcipher: changed 'req->base.data'\n");
  2511. return -EINVAL;
  2512. }
  2513. if (is_test_sglist_corrupted(&tsgls->src)) {
  2514. pr_err("alg: skcipher: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n",
  2515. driver, op, vec_name, cfg->name);
  2516. return -EINVAL;
  2517. }
  2518. if (tsgls->dst.sgl_ptr != tsgls->src.sgl &&
  2519. is_test_sglist_corrupted(&tsgls->dst)) {
  2520. pr_err("alg: skcipher: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n",
  2521. driver, op, vec_name, cfg->name);
  2522. return -EINVAL;
  2523. }
  2524. /* Check for success or failure */
  2525. if (err) {
  2526. if (err == vec->crypt_error)
  2527. return 0;
  2528. pr_err("alg: skcipher: %s %s failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
  2529. driver, op, vec_name, vec->crypt_error, err, cfg->name);
  2530. return err;
  2531. }
  2532. if (vec->crypt_error) {
  2533. pr_err("alg: skcipher: %s %s unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
  2534. driver, op, vec_name, vec->crypt_error, cfg->name);
  2535. return -EINVAL;
  2536. }
  2537. /* Check for the correct output (ciphertext or plaintext) */
  2538. err = verify_correct_output(&tsgls->dst, enc ? vec->ctext : vec->ptext,
  2539. vec->len, 0, true);
  2540. if (err == -EOVERFLOW) {
  2541. pr_err("alg: skcipher: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n",
  2542. driver, op, vec_name, cfg->name);
  2543. return err;
  2544. }
  2545. if (err) {
  2546. pr_err("alg: skcipher: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
  2547. driver, op, vec_name, cfg->name);
  2548. return err;
  2549. }
  2550. /* If applicable, check that the algorithm generated the correct IV */
  2551. if (vec->iv_out && memcmp(iv, vec->iv_out, ivsize) != 0) {
  2552. pr_err("alg: skcipher: %s %s test failed (wrong output IV) on test vector %s, cfg=\"%s\"\n",
  2553. driver, op, vec_name, cfg->name);
  2554. hexdump(iv, ivsize);
  2555. return -EINVAL;
  2556. }
  2557. return 0;
  2558. }
  2559. static int test_skcipher_vec(const char *driver, int enc,
  2560. const struct cipher_testvec *vec,
  2561. unsigned int vec_num,
  2562. struct skcipher_request *req,
  2563. struct cipher_test_sglists *tsgls)
  2564. {
  2565. char vec_name[16];
  2566. unsigned int i;
  2567. int err;
  2568. if (fips_enabled && vec->fips_skip)
  2569. return 0;
  2570. sprintf(vec_name, "%u", vec_num);
  2571. for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) {
  2572. err = test_skcipher_vec_cfg(driver, enc, vec, vec_name,
  2573. &default_cipher_testvec_configs[i],
  2574. req, tsgls);
  2575. if (err)
  2576. return err;
  2577. }
  2578. #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
  2579. if (!noextratests) {
  2580. struct testvec_config cfg;
  2581. char cfgname[TESTVEC_CONFIG_NAMELEN];
  2582. for (i = 0; i < fuzz_iterations; i++) {
  2583. generate_random_testvec_config(&cfg, cfgname,
  2584. sizeof(cfgname));
  2585. err = test_skcipher_vec_cfg(driver, enc, vec, vec_name,
  2586. &cfg, req, tsgls);
  2587. if (err)
  2588. return err;
  2589. cond_resched();
  2590. }
  2591. }
  2592. #endif
  2593. return 0;
  2594. }
  2595. #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
  2596. /*
  2597. * Generate a symmetric cipher test vector from the given implementation.
  2598. * Assumes the buffers in 'vec' were already allocated.
  2599. */
  2600. static void generate_random_cipher_testvec(struct skcipher_request *req,
  2601. struct cipher_testvec *vec,
  2602. unsigned int maxdatasize,
  2603. char *name, size_t max_namelen)
  2604. {
  2605. struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
  2606. const unsigned int maxkeysize = crypto_skcipher_max_keysize(tfm);
  2607. const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
  2608. struct scatterlist src, dst;
  2609. u8 iv[MAX_IVLEN];
  2610. DECLARE_CRYPTO_WAIT(wait);
  2611. /* Key: length in [0, maxkeysize], but usually choose maxkeysize */
  2612. vec->klen = maxkeysize;
  2613. if (prandom_u32() % 4 == 0)
  2614. vec->klen = prandom_u32() % (maxkeysize + 1);
  2615. generate_random_bytes((u8 *)vec->key, vec->klen);
  2616. vec->setkey_error = crypto_skcipher_setkey(tfm, vec->key, vec->klen);
  2617. /* IV */
  2618. generate_random_bytes((u8 *)vec->iv, ivsize);
  2619. /* Plaintext */
  2620. vec->len = generate_random_length(maxdatasize);
  2621. generate_random_bytes((u8 *)vec->ptext, vec->len);
  2622. /* If the key couldn't be set, no need to continue to encrypt. */
  2623. if (vec->setkey_error)
  2624. goto done;
  2625. /* Ciphertext */
  2626. sg_init_one(&src, vec->ptext, vec->len);
  2627. sg_init_one(&dst, vec->ctext, vec->len);
  2628. memcpy(iv, vec->iv, ivsize);
  2629. skcipher_request_set_callback(req, 0, crypto_req_done, &wait);
  2630. skcipher_request_set_crypt(req, &src, &dst, vec->len, iv);
  2631. vec->crypt_error = crypto_wait_req(crypto_skcipher_encrypt(req), &wait);
  2632. if (vec->crypt_error != 0) {
  2633. /*
  2634. * The only acceptable error here is for an invalid length, so
  2635. * skcipher decryption should fail with the same error too.
  2636. * We'll test for this. But to keep the API usage well-defined,
  2637. * explicitly initialize the ciphertext buffer too.
  2638. */
  2639. memset((u8 *)vec->ctext, 0, vec->len);
  2640. }
  2641. done:
  2642. snprintf(name, max_namelen, "\"random: len=%u klen=%u\"",
  2643. vec->len, vec->klen);
  2644. }
  2645. /*
  2646. * Test the skcipher algorithm represented by @req against the corresponding
  2647. * generic implementation, if one is available.
  2648. */
  2649. static int test_skcipher_vs_generic_impl(const char *driver,
  2650. const char *generic_driver,
  2651. struct skcipher_request *req,
  2652. struct cipher_test_sglists *tsgls)
  2653. {
  2654. struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
  2655. const unsigned int maxkeysize = crypto_skcipher_max_keysize(tfm);
  2656. const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
  2657. const unsigned int blocksize = crypto_skcipher_blocksize(tfm);
  2658. const unsigned int maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN;
  2659. const char *algname = crypto_skcipher_alg(tfm)->base.cra_name;
  2660. char _generic_driver[CRYPTO_MAX_ALG_NAME];
  2661. struct crypto_skcipher *generic_tfm = NULL;
  2662. struct skcipher_request *generic_req = NULL;
  2663. unsigned int i;
  2664. struct cipher_testvec vec = { 0 };
  2665. char vec_name[64];
  2666. struct testvec_config *cfg;
  2667. char cfgname[TESTVEC_CONFIG_NAMELEN];
  2668. int err;
  2669. if (noextratests)
  2670. return 0;
  2671. /* Keywrap isn't supported here yet as it handles its IV differently. */
  2672. if (strncmp(algname, "kw(", 3) == 0)
  2673. return 0;
  2674. if (!generic_driver) { /* Use default naming convention? */
  2675. err = build_generic_driver_name(algname, _generic_driver);
  2676. if (err)
  2677. return err;
  2678. generic_driver = _generic_driver;
  2679. }
  2680. if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */
  2681. return 0;
  2682. generic_tfm = crypto_alloc_skcipher(generic_driver, 0, 0);
  2683. if (IS_ERR(generic_tfm)) {
  2684. err = PTR_ERR(generic_tfm);
  2685. if (err == -ENOENT) {
  2686. pr_warn("alg: skcipher: skipping comparison tests for %s because %s is unavailable\n",
  2687. driver, generic_driver);
  2688. return 0;
  2689. }
  2690. pr_err("alg: skcipher: error allocating %s (generic impl of %s): %d\n",
  2691. generic_driver, algname, err);
  2692. return err;
  2693. }
  2694. cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
  2695. if (!cfg) {
  2696. err = -ENOMEM;
  2697. goto out;
  2698. }
  2699. generic_req = skcipher_request_alloc(generic_tfm, GFP_KERNEL);
  2700. if (!generic_req) {
  2701. err = -ENOMEM;
  2702. goto out;
  2703. }
  2704. /* Check the algorithm properties for consistency. */
  2705. if (crypto_skcipher_min_keysize(tfm) !=
  2706. crypto_skcipher_min_keysize(generic_tfm)) {
  2707. pr_err("alg: skcipher: min keysize for %s (%u) doesn't match generic impl (%u)\n",
  2708. driver, crypto_skcipher_min_keysize(tfm),
  2709. crypto_skcipher_min_keysize(generic_tfm));
  2710. err = -EINVAL;
  2711. goto out;
  2712. }
  2713. if (maxkeysize != crypto_skcipher_max_keysize(generic_tfm)) {
  2714. pr_err("alg: skcipher: max keysize for %s (%u) doesn't match generic impl (%u)\n",
  2715. driver, maxkeysize,
  2716. crypto_skcipher_max_keysize(generic_tfm));
  2717. err = -EINVAL;
  2718. goto out;
  2719. }
  2720. if (ivsize != crypto_skcipher_ivsize(generic_tfm)) {
  2721. pr_err("alg: skcipher: ivsize for %s (%u) doesn't match generic impl (%u)\n",
  2722. driver, ivsize, crypto_skcipher_ivsize(generic_tfm));
  2723. err = -EINVAL;
  2724. goto out;
  2725. }
  2726. if (blocksize != crypto_skcipher_blocksize(generic_tfm)) {
  2727. pr_err("alg: skcipher: blocksize for %s (%u) doesn't match generic impl (%u)\n",
  2728. driver, blocksize,
  2729. crypto_skcipher_blocksize(generic_tfm));
  2730. err = -EINVAL;
  2731. goto out;
  2732. }
  2733. /*
  2734. * Now generate test vectors using the generic implementation, and test
  2735. * the other implementation against them.
  2736. */
  2737. vec.key = kmalloc(maxkeysize, GFP_KERNEL);
  2738. vec.iv = kmalloc(ivsize, GFP_KERNEL);
  2739. vec.ptext = kmalloc(maxdatasize, GFP_KERNEL);
  2740. vec.ctext = kmalloc(maxdatasize, GFP_KERNEL);
  2741. if (!vec.key || !vec.iv || !vec.ptext || !vec.ctext) {
  2742. err = -ENOMEM;
  2743. goto out;
  2744. }
  2745. for (i = 0; i < fuzz_iterations * 8; i++) {
  2746. generate_random_cipher_testvec(generic_req, &vec, maxdatasize,
  2747. vec_name, sizeof(vec_name));
  2748. generate_random_testvec_config(cfg, cfgname, sizeof(cfgname));
  2749. err = test_skcipher_vec_cfg(driver, ENCRYPT, &vec, vec_name,
  2750. cfg, req, tsgls);
  2751. if (err)
  2752. goto out;
  2753. err = test_skcipher_vec_cfg(driver, DECRYPT, &vec, vec_name,
  2754. cfg, req, tsgls);
  2755. if (err)
  2756. goto out;
  2757. cond_resched();
  2758. }
  2759. err = 0;
  2760. out:
  2761. kfree(cfg);
  2762. kfree(vec.key);
  2763. kfree(vec.iv);
  2764. kfree(vec.ptext);
  2765. kfree(vec.ctext);
  2766. crypto_free_skcipher(generic_tfm);
  2767. skcipher_request_free(generic_req);
  2768. return err;
  2769. }
  2770. #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
  2771. static int test_skcipher_vs_generic_impl(const char *driver,
  2772. const char *generic_driver,
  2773. struct skcipher_request *req,
  2774. struct cipher_test_sglists *tsgls)
  2775. {
  2776. return 0;
  2777. }
  2778. #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
  2779. static int test_skcipher(const char *driver, int enc,
  2780. const struct cipher_test_suite *suite,
  2781. struct skcipher_request *req,
  2782. struct cipher_test_sglists *tsgls)
  2783. {
  2784. unsigned int i;
  2785. int err;
  2786. for (i = 0; i < suite->count; i++) {
  2787. err = test_skcipher_vec(driver, enc, &suite->vecs[i], i, req,
  2788. tsgls);
  2789. if (err)
  2790. return err;
  2791. cond_resched();
  2792. }
  2793. return 0;
  2794. }
  2795. static int alg_test_skcipher(const struct alg_test_desc *desc,
  2796. const char *driver, u32 type, u32 mask)
  2797. {
  2798. const struct cipher_test_suite *suite = &desc->suite.cipher;
  2799. struct crypto_skcipher *tfm;
  2800. struct skcipher_request *req = NULL;
  2801. struct cipher_test_sglists *tsgls = NULL;
  2802. int err;
  2803. if (suite->count <= 0) {
  2804. pr_err("alg: skcipher: empty test suite for %s\n", driver);
  2805. return -EINVAL;
  2806. }
  2807. tfm = crypto_alloc_skcipher(driver, type, mask);
  2808. if (IS_ERR(tfm)) {
  2809. pr_err("alg: skcipher: failed to allocate transform for %s: %ld\n",
  2810. driver, PTR_ERR(tfm));
  2811. return PTR_ERR(tfm);
  2812. }
  2813. req = skcipher_request_alloc(tfm, GFP_KERNEL);
  2814. if (!req) {
  2815. pr_err("alg: skcipher: failed to allocate request for %s\n",
  2816. driver);
  2817. err = -ENOMEM;
  2818. goto out;
  2819. }
  2820. tsgls = alloc_cipher_test_sglists();
  2821. if (!tsgls) {
  2822. pr_err("alg: skcipher: failed to allocate test buffers for %s\n",
  2823. driver);
  2824. err = -ENOMEM;
  2825. goto out;
  2826. }
  2827. err = test_skcipher(driver, ENCRYPT, suite, req, tsgls);
  2828. if (err)
  2829. goto out;
  2830. err = test_skcipher(driver, DECRYPT, suite, req, tsgls);
  2831. if (err)
  2832. goto out;
  2833. err = test_skcipher_vs_generic_impl(driver, desc->generic_driver, req,
  2834. tsgls);
  2835. out:
  2836. free_cipher_test_sglists(tsgls);
  2837. skcipher_request_free(req);
  2838. crypto_free_skcipher(tfm);
  2839. return err;
  2840. }
  2841. static int test_comp(struct crypto_comp *tfm,
  2842. const struct comp_testvec *ctemplate,
  2843. const struct comp_testvec *dtemplate,
  2844. int ctcount, int dtcount)
  2845. {
  2846. const char *algo = crypto_tfm_alg_driver_name(crypto_comp_tfm(tfm));
  2847. char *output, *decomp_output;
  2848. unsigned int i;
  2849. int ret;
  2850. output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
  2851. if (!output)
  2852. return -ENOMEM;
  2853. decomp_output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
  2854. if (!decomp_output) {
  2855. kfree(output);
  2856. return -ENOMEM;
  2857. }
  2858. for (i = 0; i < ctcount; i++) {
  2859. int ilen;
  2860. unsigned int dlen = COMP_BUF_SIZE;
  2861. memset(output, 0, COMP_BUF_SIZE);
  2862. memset(decomp_output, 0, COMP_BUF_SIZE);
  2863. ilen = ctemplate[i].inlen;
  2864. ret = crypto_comp_compress(tfm, ctemplate[i].input,
  2865. ilen, output, &dlen);
  2866. if (ret) {
  2867. printk(KERN_ERR "alg: comp: compression failed "
  2868. "on test %d for %s: ret=%d\n", i + 1, algo,
  2869. -ret);
  2870. goto out;
  2871. }
  2872. ilen = dlen;
  2873. dlen = COMP_BUF_SIZE;
  2874. ret = crypto_comp_decompress(tfm, output,
  2875. ilen, decomp_output, &dlen);
  2876. if (ret) {
  2877. pr_err("alg: comp: compression failed: decompress: on test %d for %s failed: ret=%d\n",
  2878. i + 1, algo, -ret);
  2879. goto out;
  2880. }
  2881. if (dlen != ctemplate[i].inlen) {
  2882. printk(KERN_ERR "alg: comp: Compression test %d "
  2883. "failed for %s: output len = %d\n", i + 1, algo,
  2884. dlen);
  2885. ret = -EINVAL;
  2886. goto out;
  2887. }
  2888. if (memcmp(decomp_output, ctemplate[i].input,
  2889. ctemplate[i].inlen)) {
  2890. pr_err("alg: comp: compression failed: output differs: on test %d for %s\n",
  2891. i + 1, algo);
  2892. hexdump(decomp_output, dlen);
  2893. ret = -EINVAL;
  2894. goto out;
  2895. }
  2896. }
  2897. for (i = 0; i < dtcount; i++) {
  2898. int ilen;
  2899. unsigned int dlen = COMP_BUF_SIZE;
  2900. memset(decomp_output, 0, COMP_BUF_SIZE);
  2901. ilen = dtemplate[i].inlen;
  2902. ret = crypto_comp_decompress(tfm, dtemplate[i].input,
  2903. ilen, decomp_output, &dlen);
  2904. if (ret) {
  2905. printk(KERN_ERR "alg: comp: decompression failed "
  2906. "on test %d for %s: ret=%d\n", i + 1, algo,
  2907. -ret);
  2908. goto out;
  2909. }
  2910. if (dlen != dtemplate[i].outlen) {
  2911. printk(KERN_ERR "alg: comp: Decompression test %d "
  2912. "failed for %s: output len = %d\n", i + 1, algo,
  2913. dlen);
  2914. ret = -EINVAL;
  2915. goto out;
  2916. }
  2917. if (memcmp(decomp_output, dtemplate[i].output, dlen)) {
  2918. printk(KERN_ERR "alg: comp: Decompression test %d "
  2919. "failed for %s\n", i + 1, algo);
  2920. hexdump(decomp_output, dlen);
  2921. ret = -EINVAL;
  2922. goto out;
  2923. }
  2924. }
  2925. ret = 0;
  2926. out:
  2927. kfree(decomp_output);
  2928. kfree(output);
  2929. return ret;
  2930. }
  2931. static int test_acomp(struct crypto_acomp *tfm,
  2932. const struct comp_testvec *ctemplate,
  2933. const struct comp_testvec *dtemplate,
  2934. int ctcount, int dtcount)
  2935. {
  2936. const char *algo = crypto_tfm_alg_driver_name(crypto_acomp_tfm(tfm));
  2937. unsigned int i;
  2938. char *output, *decomp_out;
  2939. int ret;
  2940. struct scatterlist src, dst;
  2941. struct acomp_req *req;
  2942. struct crypto_wait wait;
  2943. output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
  2944. if (!output)
  2945. return -ENOMEM;
  2946. decomp_out = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
  2947. if (!decomp_out) {
  2948. kfree(output);
  2949. return -ENOMEM;
  2950. }
  2951. for (i = 0; i < ctcount; i++) {
  2952. unsigned int dlen = COMP_BUF_SIZE;
  2953. int ilen = ctemplate[i].inlen;
  2954. void *input_vec;
  2955. input_vec = kmemdup(ctemplate[i].input, ilen, GFP_KERNEL);
  2956. if (!input_vec) {
  2957. ret = -ENOMEM;
  2958. goto out;
  2959. }
  2960. memset(output, 0, dlen);
  2961. crypto_init_wait(&wait);
  2962. sg_init_one(&src, input_vec, ilen);
  2963. sg_init_one(&dst, output, dlen);
  2964. req = acomp_request_alloc(tfm);
  2965. if (!req) {
  2966. pr_err("alg: acomp: request alloc failed for %s\n",
  2967. algo);
  2968. kfree(input_vec);
  2969. ret = -ENOMEM;
  2970. goto out;
  2971. }
  2972. acomp_request_set_params(req, &src, &dst, ilen, dlen);
  2973. acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
  2974. crypto_req_done, &wait);
  2975. ret = crypto_wait_req(crypto_acomp_compress(req), &wait);
  2976. if (ret) {
  2977. pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
  2978. i + 1, algo, -ret);
  2979. kfree(input_vec);
  2980. acomp_request_free(req);
  2981. goto out;
  2982. }
  2983. ilen = req->dlen;
  2984. dlen = COMP_BUF_SIZE;
  2985. sg_init_one(&src, output, ilen);
  2986. sg_init_one(&dst, decomp_out, dlen);
  2987. crypto_init_wait(&wait);
  2988. acomp_request_set_params(req, &src, &dst, ilen, dlen);
  2989. ret = crypto_wait_req(crypto_acomp_decompress(req), &wait);
  2990. if (ret) {
  2991. pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
  2992. i + 1, algo, -ret);
  2993. kfree(input_vec);
  2994. acomp_request_free(req);
  2995. goto out;
  2996. }
  2997. if (req->dlen != ctemplate[i].inlen) {
  2998. pr_err("alg: acomp: Compression test %d failed for %s: output len = %d\n",
  2999. i + 1, algo, req->dlen);
  3000. ret = -EINVAL;
  3001. kfree(input_vec);
  3002. acomp_request_free(req);
  3003. goto out;
  3004. }
  3005. if (memcmp(input_vec, decomp_out, req->dlen)) {
  3006. pr_err("alg: acomp: Compression test %d failed for %s\n",
  3007. i + 1, algo);
  3008. hexdump(output, req->dlen);
  3009. ret = -EINVAL;
  3010. kfree(input_vec);
  3011. acomp_request_free(req);
  3012. goto out;
  3013. }
  3014. kfree(input_vec);
  3015. acomp_request_free(req);
  3016. }
  3017. for (i = 0; i < dtcount; i++) {
  3018. unsigned int dlen = COMP_BUF_SIZE;
  3019. int ilen = dtemplate[i].inlen;
  3020. void *input_vec;
  3021. input_vec = kmemdup(dtemplate[i].input, ilen, GFP_KERNEL);
  3022. if (!input_vec) {
  3023. ret = -ENOMEM;
  3024. goto out;
  3025. }
  3026. memset(output, 0, dlen);
  3027. crypto_init_wait(&wait);
  3028. sg_init_one(&src, input_vec, ilen);
  3029. sg_init_one(&dst, output, dlen);
  3030. req = acomp_request_alloc(tfm);
  3031. if (!req) {
  3032. pr_err("alg: acomp: request alloc failed for %s\n",
  3033. algo);
  3034. kfree(input_vec);
  3035. ret = -ENOMEM;
  3036. goto out;
  3037. }
  3038. acomp_request_set_params(req, &src, &dst, ilen, dlen);
  3039. acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
  3040. crypto_req_done, &wait);
  3041. ret = crypto_wait_req(crypto_acomp_decompress(req), &wait);
  3042. if (ret) {
  3043. pr_err("alg: acomp: decompression failed on test %d for %s: ret=%d\n",
  3044. i + 1, algo, -ret);
  3045. kfree(input_vec);
  3046. acomp_request_free(req);
  3047. goto out;
  3048. }
  3049. if (req->dlen != dtemplate[i].outlen) {
  3050. pr_err("alg: acomp: Decompression test %d failed for %s: output len = %d\n",
  3051. i + 1, algo, req->dlen);
  3052. ret = -EINVAL;
  3053. kfree(input_vec);
  3054. acomp_request_free(req);
  3055. goto out;
  3056. }
  3057. if (memcmp(output, dtemplate[i].output, req->dlen)) {
  3058. pr_err("alg: acomp: Decompression test %d failed for %s\n",
  3059. i + 1, algo);
  3060. hexdump(output, req->dlen);
  3061. ret = -EINVAL;
  3062. kfree(input_vec);
  3063. acomp_request_free(req);
  3064. goto out;
  3065. }
  3066. kfree(input_vec);
  3067. acomp_request_free(req);
  3068. }
  3069. ret = 0;
  3070. out:
  3071. kfree(decomp_out);
  3072. kfree(output);
  3073. return ret;
  3074. }
  3075. static int test_cprng(struct crypto_rng *tfm,
  3076. const struct cprng_testvec *template,
  3077. unsigned int tcount)
  3078. {
  3079. const char *algo = crypto_tfm_alg_driver_name(crypto_rng_tfm(tfm));
  3080. int err = 0, i, j, seedsize;
  3081. u8 *seed;
  3082. char result[32];
  3083. seedsize = crypto_rng_seedsize(tfm);
  3084. seed = kmalloc(seedsize, GFP_KERNEL);
  3085. if (!seed) {
  3086. printk(KERN_ERR "alg: cprng: Failed to allocate seed space "
  3087. "for %s\n", algo);
  3088. return -ENOMEM;
  3089. }
  3090. for (i = 0; i < tcount; i++) {
  3091. memset(result, 0, 32);
  3092. memcpy(seed, template[i].v, template[i].vlen);
  3093. memcpy(seed + template[i].vlen, template[i].key,
  3094. template[i].klen);
  3095. memcpy(seed + template[i].vlen + template[i].klen,
  3096. template[i].dt, template[i].dtlen);
  3097. err = crypto_rng_reset(tfm, seed, seedsize);
  3098. if (err) {
  3099. printk(KERN_ERR "alg: cprng: Failed to reset rng "
  3100. "for %s\n", algo);
  3101. goto out;
  3102. }
  3103. for (j = 0; j < template[i].loops; j++) {
  3104. err = crypto_rng_get_bytes(tfm, result,
  3105. template[i].rlen);
  3106. if (err < 0) {
  3107. printk(KERN_ERR "alg: cprng: Failed to obtain "
  3108. "the correct amount of random data for "
  3109. "%s (requested %d)\n", algo,
  3110. template[i].rlen);
  3111. goto out;
  3112. }
  3113. }
  3114. err = memcmp(result, template[i].result,
  3115. template[i].rlen);
  3116. if (err) {
  3117. printk(KERN_ERR "alg: cprng: Test %d failed for %s\n",
  3118. i, algo);
  3119. hexdump(result, template[i].rlen);
  3120. err = -EINVAL;
  3121. goto out;
  3122. }
  3123. }
  3124. out:
  3125. kfree(seed);
  3126. return err;
  3127. }
  3128. static int alg_test_cipher(const struct alg_test_desc *desc,
  3129. const char *driver, u32 type, u32 mask)
  3130. {
  3131. const struct cipher_test_suite *suite = &desc->suite.cipher;
  3132. struct crypto_cipher *tfm;
  3133. int err;
  3134. tfm = crypto_alloc_cipher(driver, type, mask);
  3135. if (IS_ERR(tfm)) {
  3136. printk(KERN_ERR "alg: cipher: Failed to load transform for "
  3137. "%s: %ld\n", driver, PTR_ERR(tfm));
  3138. return PTR_ERR(tfm);
  3139. }
  3140. err = test_cipher(tfm, ENCRYPT, suite->vecs, suite->count);
  3141. if (!err)
  3142. err = test_cipher(tfm, DECRYPT, suite->vecs, suite->count);
  3143. crypto_free_cipher(tfm);
  3144. return err;
  3145. }
  3146. static int alg_test_comp(const struct alg_test_desc *desc, const char *driver,
  3147. u32 type, u32 mask)
  3148. {
  3149. struct crypto_comp *comp;
  3150. struct crypto_acomp *acomp;
  3151. int err;
  3152. u32 algo_type = type & CRYPTO_ALG_TYPE_ACOMPRESS_MASK;
  3153. if (algo_type == CRYPTO_ALG_TYPE_ACOMPRESS) {
  3154. acomp = crypto_alloc_acomp(driver, type, mask);
  3155. if (IS_ERR(acomp)) {
  3156. pr_err("alg: acomp: Failed to load transform for %s: %ld\n",
  3157. driver, PTR_ERR(acomp));
  3158. return PTR_ERR(acomp);
  3159. }
  3160. err = test_acomp(acomp, desc->suite.comp.comp.vecs,
  3161. desc->suite.comp.decomp.vecs,
  3162. desc->suite.comp.comp.count,
  3163. desc->suite.comp.decomp.count);
  3164. crypto_free_acomp(acomp);
  3165. } else {
  3166. comp = crypto_alloc_comp(driver, type, mask);
  3167. if (IS_ERR(comp)) {
  3168. pr_err("alg: comp: Failed to load transform for %s: %ld\n",
  3169. driver, PTR_ERR(comp));
  3170. return PTR_ERR(comp);
  3171. }
  3172. err = test_comp(comp, desc->suite.comp.comp.vecs,
  3173. desc->suite.comp.decomp.vecs,
  3174. desc->suite.comp.comp.count,
  3175. desc->suite.comp.decomp.count);
  3176. crypto_free_comp(comp);
  3177. }
  3178. return err;
  3179. }
  3180. static int alg_test_crc32c(const struct alg_test_desc *desc,
  3181. const char *driver, u32 type, u32 mask)
  3182. {
  3183. struct crypto_shash *tfm;
  3184. __le32 val;
  3185. int err;
  3186. err = alg_test_hash(desc, driver, type, mask);
  3187. if (err)
  3188. return err;
  3189. tfm = crypto_alloc_shash(driver, type, mask);
  3190. if (IS_ERR(tfm)) {
  3191. if (PTR_ERR(tfm) == -ENOENT) {
  3192. /*
  3193. * This crc32c implementation is only available through
  3194. * ahash API, not the shash API, so the remaining part
  3195. * of the test is not applicable to it.
  3196. */
  3197. return 0;
  3198. }
  3199. printk(KERN_ERR "alg: crc32c: Failed to load transform for %s: "
  3200. "%ld\n", driver, PTR_ERR(tfm));
  3201. return PTR_ERR(tfm);
  3202. }
  3203. do {
  3204. SHASH_DESC_ON_STACK(shash, tfm);
  3205. u32 *ctx = (u32 *)shash_desc_ctx(shash);
  3206. shash->tfm = tfm;
  3207. *ctx = 420553207;
  3208. err = crypto_shash_final(shash, (u8 *)&val);
  3209. if (err) {
  3210. printk(KERN_ERR "alg: crc32c: Operation failed for "
  3211. "%s: %d\n", driver, err);
  3212. break;
  3213. }
  3214. if (val != cpu_to_le32(~420553207)) {
  3215. pr_err("alg: crc32c: Test failed for %s: %u\n",
  3216. driver, le32_to_cpu(val));
  3217. err = -EINVAL;
  3218. }
  3219. } while (0);
  3220. crypto_free_shash(tfm);
  3221. return err;
  3222. }
  3223. static int alg_test_cprng(const struct alg_test_desc *desc, const char *driver,
  3224. u32 type, u32 mask)
  3225. {
  3226. struct crypto_rng *rng;
  3227. int err;
  3228. rng = crypto_alloc_rng(driver, type, mask);
  3229. if (IS_ERR(rng)) {
  3230. printk(KERN_ERR "alg: cprng: Failed to load transform for %s: "
  3231. "%ld\n", driver, PTR_ERR(rng));
  3232. return PTR_ERR(rng);
  3233. }
  3234. err = test_cprng(rng, desc->suite.cprng.vecs, desc->suite.cprng.count);
  3235. crypto_free_rng(rng);
  3236. return err;
  3237. }
  3238. static int drbg_cavs_test(const struct drbg_testvec *test, int pr,
  3239. const char *driver, u32 type, u32 mask)
  3240. {
  3241. int ret = -EAGAIN;
  3242. struct crypto_rng *drng;
  3243. struct drbg_test_data test_data;
  3244. struct drbg_string addtl, pers, testentropy;
  3245. unsigned char *buf = kzalloc(test->expectedlen, GFP_KERNEL);
  3246. if (!buf)
  3247. return -ENOMEM;
  3248. drng = crypto_alloc_rng(driver, type, mask);
  3249. if (IS_ERR(drng)) {
  3250. printk(KERN_ERR "alg: drbg: could not allocate DRNG handle for "
  3251. "%s\n", driver);
  3252. kfree_sensitive(buf);
  3253. return -ENOMEM;
  3254. }
  3255. test_data.testentropy = &testentropy;
  3256. drbg_string_fill(&testentropy, test->entropy, test->entropylen);
  3257. drbg_string_fill(&pers, test->pers, test->perslen);
  3258. ret = crypto_drbg_reset_test(drng, &pers, &test_data);
  3259. if (ret) {
  3260. printk(KERN_ERR "alg: drbg: Failed to reset rng\n");
  3261. goto outbuf;
  3262. }
  3263. drbg_string_fill(&addtl, test->addtla, test->addtllen);
  3264. if (pr) {
  3265. drbg_string_fill(&testentropy, test->entpra, test->entprlen);
  3266. ret = crypto_drbg_get_bytes_addtl_test(drng,
  3267. buf, test->expectedlen, &addtl, &test_data);
  3268. } else {
  3269. ret = crypto_drbg_get_bytes_addtl(drng,
  3270. buf, test->expectedlen, &addtl);
  3271. }
  3272. if (ret < 0) {
  3273. printk(KERN_ERR "alg: drbg: could not obtain random data for "
  3274. "driver %s\n", driver);
  3275. goto outbuf;
  3276. }
  3277. drbg_string_fill(&addtl, test->addtlb, test->addtllen);
  3278. if (pr) {
  3279. drbg_string_fill(&testentropy, test->entprb, test->entprlen);
  3280. ret = crypto_drbg_get_bytes_addtl_test(drng,
  3281. buf, test->expectedlen, &addtl, &test_data);
  3282. } else {
  3283. ret = crypto_drbg_get_bytes_addtl(drng,
  3284. buf, test->expectedlen, &addtl);
  3285. }
  3286. if (ret < 0) {
  3287. printk(KERN_ERR "alg: drbg: could not obtain random data for "
  3288. "driver %s\n", driver);
  3289. goto outbuf;
  3290. }
  3291. ret = memcmp(test->expected, buf, test->expectedlen);
  3292. outbuf:
  3293. crypto_free_rng(drng);
  3294. kfree_sensitive(buf);
  3295. return ret;
  3296. }
  3297. static int alg_test_drbg(const struct alg_test_desc *desc, const char *driver,
  3298. u32 type, u32 mask)
  3299. {
  3300. int err = 0;
  3301. int pr = 0;
  3302. int i = 0;
  3303. const struct drbg_testvec *template = desc->suite.drbg.vecs;
  3304. unsigned int tcount = desc->suite.drbg.count;
  3305. if (0 == memcmp(driver, "drbg_pr_", 8))
  3306. pr = 1;
  3307. for (i = 0; i < tcount; i++) {
  3308. err = drbg_cavs_test(&template[i], pr, driver, type, mask);
  3309. if (err) {
  3310. printk(KERN_ERR "alg: drbg: Test %d failed for %s\n",
  3311. i, driver);
  3312. err = -EINVAL;
  3313. break;
  3314. }
  3315. }
  3316. return err;
  3317. }
  3318. static int do_test_kpp(struct crypto_kpp *tfm, const struct kpp_testvec *vec,
  3319. const char *alg)
  3320. {
  3321. struct kpp_request *req;
  3322. void *input_buf = NULL;
  3323. void *output_buf = NULL;
  3324. void *a_public = NULL;
  3325. void *a_ss = NULL;
  3326. void *shared_secret = NULL;
  3327. struct crypto_wait wait;
  3328. unsigned int out_len_max;
  3329. int err = -ENOMEM;
  3330. struct scatterlist src, dst;
  3331. req = kpp_request_alloc(tfm, GFP_KERNEL);
  3332. if (!req)
  3333. return err;
  3334. crypto_init_wait(&wait);
  3335. err = crypto_kpp_set_secret(tfm, vec->secret, vec->secret_size);
  3336. if (err < 0)
  3337. goto free_req;
  3338. out_len_max = crypto_kpp_maxsize(tfm);
  3339. output_buf = kzalloc(out_len_max, GFP_KERNEL);
  3340. if (!output_buf) {
  3341. err = -ENOMEM;
  3342. goto free_req;
  3343. }
  3344. /* Use appropriate parameter as base */
  3345. kpp_request_set_input(req, NULL, 0);
  3346. sg_init_one(&dst, output_buf, out_len_max);
  3347. kpp_request_set_output(req, &dst, out_len_max);
  3348. kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
  3349. crypto_req_done, &wait);
  3350. /* Compute party A's public key */
  3351. err = crypto_wait_req(crypto_kpp_generate_public_key(req), &wait);
  3352. if (err) {
  3353. pr_err("alg: %s: Party A: generate public key test failed. err %d\n",
  3354. alg, err);
  3355. goto free_output;
  3356. }
  3357. if (vec->genkey) {
  3358. /* Save party A's public key */
  3359. a_public = kmemdup(sg_virt(req->dst), out_len_max, GFP_KERNEL);
  3360. if (!a_public) {
  3361. err = -ENOMEM;
  3362. goto free_output;
  3363. }
  3364. } else {
  3365. /* Verify calculated public key */
  3366. if (memcmp(vec->expected_a_public, sg_virt(req->dst),
  3367. vec->expected_a_public_size)) {
  3368. pr_err("alg: %s: Party A: generate public key test failed. Invalid output\n",
  3369. alg);
  3370. err = -EINVAL;
  3371. goto free_output;
  3372. }
  3373. }
  3374. /* Calculate shared secret key by using counter part (b) public key. */
  3375. input_buf = kmemdup(vec->b_public, vec->b_public_size, GFP_KERNEL);
  3376. if (!input_buf) {
  3377. err = -ENOMEM;
  3378. goto free_output;
  3379. }
  3380. sg_init_one(&src, input_buf, vec->b_public_size);
  3381. sg_init_one(&dst, output_buf, out_len_max);
  3382. kpp_request_set_input(req, &src, vec->b_public_size);
  3383. kpp_request_set_output(req, &dst, out_len_max);
  3384. kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
  3385. crypto_req_done, &wait);
  3386. err = crypto_wait_req(crypto_kpp_compute_shared_secret(req), &wait);
  3387. if (err) {
  3388. pr_err("alg: %s: Party A: compute shared secret test failed. err %d\n",
  3389. alg, err);
  3390. goto free_all;
  3391. }
  3392. if (vec->genkey) {
  3393. /* Save the shared secret obtained by party A */
  3394. a_ss = kmemdup(sg_virt(req->dst), vec->expected_ss_size, GFP_KERNEL);
  3395. if (!a_ss) {
  3396. err = -ENOMEM;
  3397. goto free_all;
  3398. }
  3399. /*
  3400. * Calculate party B's shared secret by using party A's
  3401. * public key.
  3402. */
  3403. err = crypto_kpp_set_secret(tfm, vec->b_secret,
  3404. vec->b_secret_size);
  3405. if (err < 0)
  3406. goto free_all;
  3407. sg_init_one(&src, a_public, vec->expected_a_public_size);
  3408. sg_init_one(&dst, output_buf, out_len_max);
  3409. kpp_request_set_input(req, &src, vec->expected_a_public_size);
  3410. kpp_request_set_output(req, &dst, out_len_max);
  3411. kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
  3412. crypto_req_done, &wait);
  3413. err = crypto_wait_req(crypto_kpp_compute_shared_secret(req),
  3414. &wait);
  3415. if (err) {
  3416. pr_err("alg: %s: Party B: compute shared secret failed. err %d\n",
  3417. alg, err);
  3418. goto free_all;
  3419. }
  3420. shared_secret = a_ss;
  3421. } else {
  3422. shared_secret = (void *)vec->expected_ss;
  3423. }
  3424. /*
  3425. * verify shared secret from which the user will derive
  3426. * secret key by executing whatever hash it has chosen
  3427. */
  3428. if (memcmp(shared_secret, sg_virt(req->dst),
  3429. vec->expected_ss_size)) {
  3430. pr_err("alg: %s: compute shared secret test failed. Invalid output\n",
  3431. alg);
  3432. err = -EINVAL;
  3433. }
  3434. free_all:
  3435. kfree(a_ss);
  3436. kfree(input_buf);
  3437. free_output:
  3438. kfree(a_public);
  3439. kfree(output_buf);
  3440. free_req:
  3441. kpp_request_free(req);
  3442. return err;
  3443. }
  3444. static int test_kpp(struct crypto_kpp *tfm, const char *alg,
  3445. const struct kpp_testvec *vecs, unsigned int tcount)
  3446. {
  3447. int ret, i;
  3448. for (i = 0; i < tcount; i++) {
  3449. ret = do_test_kpp(tfm, vecs++, alg);
  3450. if (ret) {
  3451. pr_err("alg: %s: test failed on vector %d, err=%d\n",
  3452. alg, i + 1, ret);
  3453. return ret;
  3454. }
  3455. }
  3456. return 0;
  3457. }
  3458. static int alg_test_kpp(const struct alg_test_desc *desc, const char *driver,
  3459. u32 type, u32 mask)
  3460. {
  3461. struct crypto_kpp *tfm;
  3462. int err = 0;
  3463. tfm = crypto_alloc_kpp(driver, type, mask);
  3464. if (IS_ERR(tfm)) {
  3465. pr_err("alg: kpp: Failed to load tfm for %s: %ld\n",
  3466. driver, PTR_ERR(tfm));
  3467. return PTR_ERR(tfm);
  3468. }
  3469. if (desc->suite.kpp.vecs)
  3470. err = test_kpp(tfm, desc->alg, desc->suite.kpp.vecs,
  3471. desc->suite.kpp.count);
  3472. crypto_free_kpp(tfm);
  3473. return err;
  3474. }
  3475. static u8 *test_pack_u32(u8 *dst, u32 val)
  3476. {
  3477. memcpy(dst, &val, sizeof(val));
  3478. return dst + sizeof(val);
  3479. }
  3480. static int test_akcipher_one(struct crypto_akcipher *tfm,
  3481. const struct akcipher_testvec *vecs)
  3482. {
  3483. char *xbuf[XBUFSIZE];
  3484. struct akcipher_request *req;
  3485. void *outbuf_enc = NULL;
  3486. void *outbuf_dec = NULL;
  3487. struct crypto_wait wait;
  3488. unsigned int out_len_max, out_len = 0;
  3489. int err = -ENOMEM;
  3490. struct scatterlist src, dst, src_tab[3];
  3491. const char *m, *c;
  3492. unsigned int m_size, c_size;
  3493. const char *op;
  3494. u8 *key, *ptr;
  3495. if (testmgr_alloc_buf(xbuf))
  3496. return err;
  3497. req = akcipher_request_alloc(tfm, GFP_KERNEL);
  3498. if (!req)
  3499. goto free_xbuf;
  3500. crypto_init_wait(&wait);
  3501. key = kmalloc(vecs->key_len + sizeof(u32) * 2 + vecs->param_len,
  3502. GFP_KERNEL);
  3503. if (!key)
  3504. goto free_req;
  3505. memcpy(key, vecs->key, vecs->key_len);
  3506. ptr = key + vecs->key_len;
  3507. ptr = test_pack_u32(ptr, vecs->algo);
  3508. ptr = test_pack_u32(ptr, vecs->param_len);
  3509. memcpy(ptr, vecs->params, vecs->param_len);
  3510. if (vecs->public_key_vec)
  3511. err = crypto_akcipher_set_pub_key(tfm, key, vecs->key_len);
  3512. else
  3513. err = crypto_akcipher_set_priv_key(tfm, key, vecs->key_len);
  3514. if (err)
  3515. goto free_key;
  3516. /*
  3517. * First run test which do not require a private key, such as
  3518. * encrypt or verify.
  3519. */
  3520. err = -ENOMEM;
  3521. out_len_max = crypto_akcipher_maxsize(tfm);
  3522. outbuf_enc = kzalloc(out_len_max, GFP_KERNEL);
  3523. if (!outbuf_enc)
  3524. goto free_key;
  3525. if (!vecs->siggen_sigver_test) {
  3526. m = vecs->m;
  3527. m_size = vecs->m_size;
  3528. c = vecs->c;
  3529. c_size = vecs->c_size;
  3530. op = "encrypt";
  3531. } else {
  3532. /* Swap args so we could keep plaintext (digest)
  3533. * in vecs->m, and cooked signature in vecs->c.
  3534. */
  3535. m = vecs->c; /* signature */
  3536. m_size = vecs->c_size;
  3537. c = vecs->m; /* digest */
  3538. c_size = vecs->m_size;
  3539. op = "verify";
  3540. }
  3541. err = -E2BIG;
  3542. if (WARN_ON(m_size > PAGE_SIZE))
  3543. goto free_all;
  3544. memcpy(xbuf[0], m, m_size);
  3545. sg_init_table(src_tab, 3);
  3546. sg_set_buf(&src_tab[0], xbuf[0], 8);
  3547. sg_set_buf(&src_tab[1], xbuf[0] + 8, m_size - 8);
  3548. if (vecs->siggen_sigver_test) {
  3549. if (WARN_ON(c_size > PAGE_SIZE))
  3550. goto free_all;
  3551. memcpy(xbuf[1], c, c_size);
  3552. sg_set_buf(&src_tab[2], xbuf[1], c_size);
  3553. akcipher_request_set_crypt(req, src_tab, NULL, m_size, c_size);
  3554. } else {
  3555. sg_init_one(&dst, outbuf_enc, out_len_max);
  3556. akcipher_request_set_crypt(req, src_tab, &dst, m_size,
  3557. out_len_max);
  3558. }
  3559. akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
  3560. crypto_req_done, &wait);
  3561. err = crypto_wait_req(vecs->siggen_sigver_test ?
  3562. /* Run asymmetric signature verification */
  3563. crypto_akcipher_verify(req) :
  3564. /* Run asymmetric encrypt */
  3565. crypto_akcipher_encrypt(req), &wait);
  3566. if (err) {
  3567. pr_err("alg: akcipher: %s test failed. err %d\n", op, err);
  3568. goto free_all;
  3569. }
  3570. if (!vecs->siggen_sigver_test && c) {
  3571. if (req->dst_len != c_size) {
  3572. pr_err("alg: akcipher: %s test failed. Invalid output len\n",
  3573. op);
  3574. err = -EINVAL;
  3575. goto free_all;
  3576. }
  3577. /* verify that encrypted message is equal to expected */
  3578. if (memcmp(c, outbuf_enc, c_size) != 0) {
  3579. pr_err("alg: akcipher: %s test failed. Invalid output\n",
  3580. op);
  3581. hexdump(outbuf_enc, c_size);
  3582. err = -EINVAL;
  3583. goto free_all;
  3584. }
  3585. }
  3586. /*
  3587. * Don't invoke (decrypt or sign) test which require a private key
  3588. * for vectors with only a public key.
  3589. */
  3590. if (vecs->public_key_vec) {
  3591. err = 0;
  3592. goto free_all;
  3593. }
  3594. outbuf_dec = kzalloc(out_len_max, GFP_KERNEL);
  3595. if (!outbuf_dec) {
  3596. err = -ENOMEM;
  3597. goto free_all;
  3598. }
  3599. if (!vecs->siggen_sigver_test && !c) {
  3600. c = outbuf_enc;
  3601. c_size = req->dst_len;
  3602. }
  3603. err = -E2BIG;
  3604. op = vecs->siggen_sigver_test ? "sign" : "decrypt";
  3605. if (WARN_ON(c_size > PAGE_SIZE))
  3606. goto free_all;
  3607. memcpy(xbuf[0], c, c_size);
  3608. sg_init_one(&src, xbuf[0], c_size);
  3609. sg_init_one(&dst, outbuf_dec, out_len_max);
  3610. crypto_init_wait(&wait);
  3611. akcipher_request_set_crypt(req, &src, &dst, c_size, out_len_max);
  3612. err = crypto_wait_req(vecs->siggen_sigver_test ?
  3613. /* Run asymmetric signature generation */
  3614. crypto_akcipher_sign(req) :
  3615. /* Run asymmetric decrypt */
  3616. crypto_akcipher_decrypt(req), &wait);
  3617. if (err) {
  3618. pr_err("alg: akcipher: %s test failed. err %d\n", op, err);
  3619. goto free_all;
  3620. }
  3621. out_len = req->dst_len;
  3622. if (out_len < m_size) {
  3623. pr_err("alg: akcipher: %s test failed. Invalid output len %u\n",
  3624. op, out_len);
  3625. err = -EINVAL;
  3626. goto free_all;
  3627. }
  3628. /* verify that decrypted message is equal to the original msg */
  3629. if (memchr_inv(outbuf_dec, 0, out_len - m_size) ||
  3630. memcmp(m, outbuf_dec + out_len - m_size, m_size)) {
  3631. pr_err("alg: akcipher: %s test failed. Invalid output\n", op);
  3632. hexdump(outbuf_dec, out_len);
  3633. err = -EINVAL;
  3634. }
  3635. free_all:
  3636. kfree(outbuf_dec);
  3637. kfree(outbuf_enc);
  3638. free_key:
  3639. kfree(key);
  3640. free_req:
  3641. akcipher_request_free(req);
  3642. free_xbuf:
  3643. testmgr_free_buf(xbuf);
  3644. return err;
  3645. }
  3646. static int test_akcipher(struct crypto_akcipher *tfm, const char *alg,
  3647. const struct akcipher_testvec *vecs,
  3648. unsigned int tcount)
  3649. {
  3650. const char *algo =
  3651. crypto_tfm_alg_driver_name(crypto_akcipher_tfm(tfm));
  3652. int ret, i;
  3653. for (i = 0; i < tcount; i++) {
  3654. ret = test_akcipher_one(tfm, vecs++);
  3655. if (!ret)
  3656. continue;
  3657. pr_err("alg: akcipher: test %d failed for %s, err=%d\n",
  3658. i + 1, algo, ret);
  3659. return ret;
  3660. }
  3661. return 0;
  3662. }
  3663. static int alg_test_akcipher(const struct alg_test_desc *desc,
  3664. const char *driver, u32 type, u32 mask)
  3665. {
  3666. struct crypto_akcipher *tfm;
  3667. int err = 0;
  3668. tfm = crypto_alloc_akcipher(driver, type, mask);
  3669. if (IS_ERR(tfm)) {
  3670. pr_err("alg: akcipher: Failed to load tfm for %s: %ld\n",
  3671. driver, PTR_ERR(tfm));
  3672. return PTR_ERR(tfm);
  3673. }
  3674. if (desc->suite.akcipher.vecs)
  3675. err = test_akcipher(tfm, desc->alg, desc->suite.akcipher.vecs,
  3676. desc->suite.akcipher.count);
  3677. crypto_free_akcipher(tfm);
  3678. return err;
  3679. }
  3680. static int alg_test_null(const struct alg_test_desc *desc,
  3681. const char *driver, u32 type, u32 mask)
  3682. {
  3683. return 0;
  3684. }
  3685. #define ____VECS(tv) .vecs = tv, .count = ARRAY_SIZE(tv)
  3686. #define __VECS(tv) { ____VECS(tv) }
  3687. /* Please keep this list sorted by algorithm name. */
  3688. static const struct alg_test_desc alg_test_descs[] = {
  3689. {
  3690. .alg = "adiantum(xchacha12,aes)",
  3691. .generic_driver = "adiantum(xchacha12-generic,aes-generic,nhpoly1305-generic)",
  3692. .test = alg_test_skcipher,
  3693. .suite = {
  3694. .cipher = __VECS(adiantum_xchacha12_aes_tv_template)
  3695. },
  3696. }, {
  3697. .alg = "adiantum(xchacha20,aes)",
  3698. .generic_driver = "adiantum(xchacha20-generic,aes-generic,nhpoly1305-generic)",
  3699. .test = alg_test_skcipher,
  3700. .suite = {
  3701. .cipher = __VECS(adiantum_xchacha20_aes_tv_template)
  3702. },
  3703. }, {
  3704. .alg = "aegis128",
  3705. .test = alg_test_aead,
  3706. .suite = {
  3707. .aead = __VECS(aegis128_tv_template)
  3708. }
  3709. }, {
  3710. .alg = "ansi_cprng",
  3711. .test = alg_test_cprng,
  3712. .suite = {
  3713. .cprng = __VECS(ansi_cprng_aes_tv_template)
  3714. }
  3715. }, {
  3716. .alg = "authenc(hmac(md5),ecb(cipher_null))",
  3717. .test = alg_test_aead,
  3718. .suite = {
  3719. .aead = __VECS(hmac_md5_ecb_cipher_null_tv_template)
  3720. }
  3721. }, {
  3722. .alg = "authenc(hmac(sha1),cbc(aes))",
  3723. .test = alg_test_aead,
  3724. .fips_allowed = 1,
  3725. .suite = {
  3726. .aead = __VECS(hmac_sha1_aes_cbc_tv_temp)
  3727. }
  3728. }, {
  3729. .alg = "authenc(hmac(sha1),cbc(des))",
  3730. .test = alg_test_aead,
  3731. .suite = {
  3732. .aead = __VECS(hmac_sha1_des_cbc_tv_temp)
  3733. }
  3734. }, {
  3735. .alg = "authenc(hmac(sha1),cbc(des3_ede))",
  3736. .test = alg_test_aead,
  3737. .fips_allowed = 1,
  3738. .suite = {
  3739. .aead = __VECS(hmac_sha1_des3_ede_cbc_tv_temp)
  3740. }
  3741. }, {
  3742. .alg = "authenc(hmac(sha1),ctr(aes))",
  3743. .test = alg_test_null,
  3744. .fips_allowed = 1,
  3745. }, {
  3746. .alg = "authenc(hmac(sha1),ecb(cipher_null))",
  3747. .test = alg_test_aead,
  3748. .suite = {
  3749. .aead = __VECS(hmac_sha1_ecb_cipher_null_tv_temp)
  3750. }
  3751. }, {
  3752. .alg = "authenc(hmac(sha1),rfc3686(ctr(aes)))",
  3753. .test = alg_test_null,
  3754. .fips_allowed = 1,
  3755. }, {
  3756. .alg = "authenc(hmac(sha224),cbc(des))",
  3757. .test = alg_test_aead,
  3758. .suite = {
  3759. .aead = __VECS(hmac_sha224_des_cbc_tv_temp)
  3760. }
  3761. }, {
  3762. .alg = "authenc(hmac(sha224),cbc(des3_ede))",
  3763. .test = alg_test_aead,
  3764. .fips_allowed = 1,
  3765. .suite = {
  3766. .aead = __VECS(hmac_sha224_des3_ede_cbc_tv_temp)
  3767. }
  3768. }, {
  3769. .alg = "authenc(hmac(sha256),cbc(aes))",
  3770. .test = alg_test_aead,
  3771. .fips_allowed = 1,
  3772. .suite = {
  3773. .aead = __VECS(hmac_sha256_aes_cbc_tv_temp)
  3774. }
  3775. }, {
  3776. .alg = "authenc(hmac(sha256),cbc(des))",
  3777. .test = alg_test_aead,
  3778. .suite = {
  3779. .aead = __VECS(hmac_sha256_des_cbc_tv_temp)
  3780. }
  3781. }, {
  3782. .alg = "authenc(hmac(sha256),cbc(des3_ede))",
  3783. .test = alg_test_aead,
  3784. .fips_allowed = 1,
  3785. .suite = {
  3786. .aead = __VECS(hmac_sha256_des3_ede_cbc_tv_temp)
  3787. }
  3788. }, {
  3789. .alg = "authenc(hmac(sha256),ctr(aes))",
  3790. .test = alg_test_null,
  3791. .fips_allowed = 1,
  3792. }, {
  3793. .alg = "authenc(hmac(sha256),rfc3686(ctr(aes)))",
  3794. .test = alg_test_null,
  3795. .fips_allowed = 1,
  3796. }, {
  3797. .alg = "authenc(hmac(sha384),cbc(des))",
  3798. .test = alg_test_aead,
  3799. .suite = {
  3800. .aead = __VECS(hmac_sha384_des_cbc_tv_temp)
  3801. }
  3802. }, {
  3803. .alg = "authenc(hmac(sha384),cbc(des3_ede))",
  3804. .test = alg_test_aead,
  3805. .fips_allowed = 1,
  3806. .suite = {
  3807. .aead = __VECS(hmac_sha384_des3_ede_cbc_tv_temp)
  3808. }
  3809. }, {
  3810. .alg = "authenc(hmac(sha384),ctr(aes))",
  3811. .test = alg_test_null,
  3812. .fips_allowed = 1,
  3813. }, {
  3814. .alg = "authenc(hmac(sha384),rfc3686(ctr(aes)))",
  3815. .test = alg_test_null,
  3816. .fips_allowed = 1,
  3817. }, {
  3818. .alg = "authenc(hmac(sha512),cbc(aes))",
  3819. .fips_allowed = 1,
  3820. .test = alg_test_aead,
  3821. .suite = {
  3822. .aead = __VECS(hmac_sha512_aes_cbc_tv_temp)
  3823. }
  3824. }, {
  3825. .alg = "authenc(hmac(sha512),cbc(des))",
  3826. .test = alg_test_aead,
  3827. .suite = {
  3828. .aead = __VECS(hmac_sha512_des_cbc_tv_temp)
  3829. }
  3830. }, {
  3831. .alg = "authenc(hmac(sha512),cbc(des3_ede))",
  3832. .test = alg_test_aead,
  3833. .fips_allowed = 1,
  3834. .suite = {
  3835. .aead = __VECS(hmac_sha512_des3_ede_cbc_tv_temp)
  3836. }
  3837. }, {
  3838. .alg = "authenc(hmac(sha512),ctr(aes))",
  3839. .test = alg_test_null,
  3840. .fips_allowed = 1,
  3841. }, {
  3842. .alg = "authenc(hmac(sha512),rfc3686(ctr(aes)))",
  3843. .test = alg_test_null,
  3844. .fips_allowed = 1,
  3845. }, {
  3846. .alg = "blake2b-160",
  3847. .test = alg_test_hash,
  3848. .fips_allowed = 0,
  3849. .suite = {
  3850. .hash = __VECS(blake2b_160_tv_template)
  3851. }
  3852. }, {
  3853. .alg = "blake2b-256",
  3854. .test = alg_test_hash,
  3855. .fips_allowed = 0,
  3856. .suite = {
  3857. .hash = __VECS(blake2b_256_tv_template)
  3858. }
  3859. }, {
  3860. .alg = "blake2b-384",
  3861. .test = alg_test_hash,
  3862. .fips_allowed = 0,
  3863. .suite = {
  3864. .hash = __VECS(blake2b_384_tv_template)
  3865. }
  3866. }, {
  3867. .alg = "blake2b-512",
  3868. .test = alg_test_hash,
  3869. .fips_allowed = 0,
  3870. .suite = {
  3871. .hash = __VECS(blake2b_512_tv_template)
  3872. }
  3873. }, {
  3874. .alg = "blake2s-128",
  3875. .test = alg_test_hash,
  3876. .suite = {
  3877. .hash = __VECS(blakes2s_128_tv_template)
  3878. }
  3879. }, {
  3880. .alg = "blake2s-160",
  3881. .test = alg_test_hash,
  3882. .suite = {
  3883. .hash = __VECS(blakes2s_160_tv_template)
  3884. }
  3885. }, {
  3886. .alg = "blake2s-224",
  3887. .test = alg_test_hash,
  3888. .suite = {
  3889. .hash = __VECS(blakes2s_224_tv_template)
  3890. }
  3891. }, {
  3892. .alg = "blake2s-256",
  3893. .test = alg_test_hash,
  3894. .suite = {
  3895. .hash = __VECS(blakes2s_256_tv_template)
  3896. }
  3897. }, {
  3898. .alg = "cbc(aes)",
  3899. .test = alg_test_skcipher,
  3900. .fips_allowed = 1,
  3901. .suite = {
  3902. .cipher = __VECS(aes_cbc_tv_template)
  3903. },
  3904. }, {
  3905. .alg = "cbc(anubis)",
  3906. .test = alg_test_skcipher,
  3907. .suite = {
  3908. .cipher = __VECS(anubis_cbc_tv_template)
  3909. },
  3910. }, {
  3911. .alg = "cbc(blowfish)",
  3912. .test = alg_test_skcipher,
  3913. .suite = {
  3914. .cipher = __VECS(bf_cbc_tv_template)
  3915. },
  3916. }, {
  3917. .alg = "cbc(camellia)",
  3918. .test = alg_test_skcipher,
  3919. .suite = {
  3920. .cipher = __VECS(camellia_cbc_tv_template)
  3921. },
  3922. }, {
  3923. .alg = "cbc(cast5)",
  3924. .test = alg_test_skcipher,
  3925. .suite = {
  3926. .cipher = __VECS(cast5_cbc_tv_template)
  3927. },
  3928. }, {
  3929. .alg = "cbc(cast6)",
  3930. .test = alg_test_skcipher,
  3931. .suite = {
  3932. .cipher = __VECS(cast6_cbc_tv_template)
  3933. },
  3934. }, {
  3935. .alg = "cbc(des)",
  3936. .test = alg_test_skcipher,
  3937. .suite = {
  3938. .cipher = __VECS(des_cbc_tv_template)
  3939. },
  3940. }, {
  3941. .alg = "cbc(des3_ede)",
  3942. .test = alg_test_skcipher,
  3943. .fips_allowed = 1,
  3944. .suite = {
  3945. .cipher = __VECS(des3_ede_cbc_tv_template)
  3946. },
  3947. }, {
  3948. /* Same as cbc(aes) except the key is stored in
  3949. * hardware secure memory which we reference by index
  3950. */
  3951. .alg = "cbc(paes)",
  3952. .test = alg_test_null,
  3953. .fips_allowed = 1,
  3954. }, {
  3955. /* Same as cbc(sm4) except the key is stored in
  3956. * hardware secure memory which we reference by index
  3957. */
  3958. .alg = "cbc(psm4)",
  3959. .test = alg_test_null,
  3960. }, {
  3961. .alg = "cbc(serpent)",
  3962. .test = alg_test_skcipher,
  3963. .suite = {
  3964. .cipher = __VECS(serpent_cbc_tv_template)
  3965. },
  3966. }, {
  3967. .alg = "cbc(sm4)",
  3968. .test = alg_test_skcipher,
  3969. .suite = {
  3970. .cipher = __VECS(sm4_cbc_tv_template)
  3971. }
  3972. }, {
  3973. .alg = "cbc(twofish)",
  3974. .test = alg_test_skcipher,
  3975. .suite = {
  3976. .cipher = __VECS(tf_cbc_tv_template)
  3977. },
  3978. }, {
  3979. #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
  3980. .alg = "cbc-paes-s390",
  3981. .fips_allowed = 1,
  3982. .test = alg_test_skcipher,
  3983. .suite = {
  3984. .cipher = __VECS(aes_cbc_tv_template)
  3985. }
  3986. }, {
  3987. #endif
  3988. .alg = "cbcmac(aes)",
  3989. .fips_allowed = 1,
  3990. .test = alg_test_hash,
  3991. .suite = {
  3992. .hash = __VECS(aes_cbcmac_tv_template)
  3993. }
  3994. }, {
  3995. .alg = "ccm(aes)",
  3996. .generic_driver = "ccm_base(ctr(aes-generic),cbcmac(aes-generic))",
  3997. .test = alg_test_aead,
  3998. .fips_allowed = 1,
  3999. .suite = {
  4000. .aead = {
  4001. ____VECS(aes_ccm_tv_template),
  4002. .einval_allowed = 1,
  4003. }
  4004. }
  4005. }, {
  4006. .alg = "cfb(aes)",
  4007. .test = alg_test_skcipher,
  4008. .fips_allowed = 1,
  4009. .suite = {
  4010. .cipher = __VECS(aes_cfb_tv_template)
  4011. },
  4012. }, {
  4013. .alg = "cfb(sm4)",
  4014. .test = alg_test_skcipher,
  4015. .suite = {
  4016. .cipher = __VECS(sm4_cfb_tv_template)
  4017. }
  4018. }, {
  4019. .alg = "chacha20",
  4020. .test = alg_test_skcipher,
  4021. .suite = {
  4022. .cipher = __VECS(chacha20_tv_template)
  4023. },
  4024. }, {
  4025. .alg = "cmac(aes)",
  4026. .fips_allowed = 1,
  4027. .test = alg_test_hash,
  4028. .suite = {
  4029. .hash = __VECS(aes_cmac128_tv_template)
  4030. }
  4031. }, {
  4032. .alg = "cmac(des3_ede)",
  4033. .fips_allowed = 1,
  4034. .test = alg_test_hash,
  4035. .suite = {
  4036. .hash = __VECS(des3_ede_cmac64_tv_template)
  4037. }
  4038. }, {
  4039. .alg = "compress_null",
  4040. .test = alg_test_null,
  4041. }, {
  4042. .alg = "crc32",
  4043. .test = alg_test_hash,
  4044. .fips_allowed = 1,
  4045. .suite = {
  4046. .hash = __VECS(crc32_tv_template)
  4047. }
  4048. }, {
  4049. .alg = "crc32c",
  4050. .test = alg_test_crc32c,
  4051. .fips_allowed = 1,
  4052. .suite = {
  4053. .hash = __VECS(crc32c_tv_template)
  4054. }
  4055. }, {
  4056. .alg = "crct10dif",
  4057. .test = alg_test_hash,
  4058. .fips_allowed = 1,
  4059. .suite = {
  4060. .hash = __VECS(crct10dif_tv_template)
  4061. }
  4062. }, {
  4063. .alg = "ctr(aes)",
  4064. .test = alg_test_skcipher,
  4065. .fips_allowed = 1,
  4066. .suite = {
  4067. .cipher = __VECS(aes_ctr_tv_template)
  4068. }
  4069. }, {
  4070. .alg = "ctr(blowfish)",
  4071. .test = alg_test_skcipher,
  4072. .suite = {
  4073. .cipher = __VECS(bf_ctr_tv_template)
  4074. }
  4075. }, {
  4076. .alg = "ctr(camellia)",
  4077. .test = alg_test_skcipher,
  4078. .suite = {
  4079. .cipher = __VECS(camellia_ctr_tv_template)
  4080. }
  4081. }, {
  4082. .alg = "ctr(cast5)",
  4083. .test = alg_test_skcipher,
  4084. .suite = {
  4085. .cipher = __VECS(cast5_ctr_tv_template)
  4086. }
  4087. }, {
  4088. .alg = "ctr(cast6)",
  4089. .test = alg_test_skcipher,
  4090. .suite = {
  4091. .cipher = __VECS(cast6_ctr_tv_template)
  4092. }
  4093. }, {
  4094. .alg = "ctr(des)",
  4095. .test = alg_test_skcipher,
  4096. .suite = {
  4097. .cipher = __VECS(des_ctr_tv_template)
  4098. }
  4099. }, {
  4100. .alg = "ctr(des3_ede)",
  4101. .test = alg_test_skcipher,
  4102. .fips_allowed = 1,
  4103. .suite = {
  4104. .cipher = __VECS(des3_ede_ctr_tv_template)
  4105. }
  4106. }, {
  4107. /* Same as ctr(aes) except the key is stored in
  4108. * hardware secure memory which we reference by index
  4109. */
  4110. .alg = "ctr(paes)",
  4111. .test = alg_test_null,
  4112. .fips_allowed = 1,
  4113. }, {
  4114. /* Same as ctr(sm4) except the key is stored in
  4115. * hardware secure memory which we reference by index
  4116. */
  4117. .alg = "ctr(psm4)",
  4118. .test = alg_test_null,
  4119. }, {
  4120. .alg = "ctr(serpent)",
  4121. .test = alg_test_skcipher,
  4122. .suite = {
  4123. .cipher = __VECS(serpent_ctr_tv_template)
  4124. }
  4125. }, {
  4126. .alg = "ctr(sm4)",
  4127. .test = alg_test_skcipher,
  4128. .suite = {
  4129. .cipher = __VECS(sm4_ctr_tv_template)
  4130. }
  4131. }, {
  4132. .alg = "ctr(twofish)",
  4133. .test = alg_test_skcipher,
  4134. .suite = {
  4135. .cipher = __VECS(tf_ctr_tv_template)
  4136. }
  4137. }, {
  4138. #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
  4139. .alg = "ctr-paes-s390",
  4140. .fips_allowed = 1,
  4141. .test = alg_test_skcipher,
  4142. .suite = {
  4143. .cipher = __VECS(aes_ctr_tv_template)
  4144. }
  4145. }, {
  4146. #endif
  4147. .alg = "cts(cbc(aes))",
  4148. .test = alg_test_skcipher,
  4149. .fips_allowed = 1,
  4150. .suite = {
  4151. .cipher = __VECS(cts_mode_tv_template)
  4152. }
  4153. }, {
  4154. /* Same as cts(cbc((aes)) except the key is stored in
  4155. * hardware secure memory which we reference by index
  4156. */
  4157. .alg = "cts(cbc(paes))",
  4158. .test = alg_test_null,
  4159. .fips_allowed = 1,
  4160. }, {
  4161. .alg = "curve25519",
  4162. .test = alg_test_kpp,
  4163. .suite = {
  4164. .kpp = __VECS(curve25519_tv_template)
  4165. }
  4166. }, {
  4167. .alg = "deflate",
  4168. .test = alg_test_comp,
  4169. .fips_allowed = 1,
  4170. .suite = {
  4171. .comp = {
  4172. .comp = __VECS(deflate_comp_tv_template),
  4173. .decomp = __VECS(deflate_decomp_tv_template)
  4174. }
  4175. }
  4176. }, {
  4177. .alg = "dh",
  4178. .test = alg_test_kpp,
  4179. .fips_allowed = 1,
  4180. .suite = {
  4181. .kpp = __VECS(dh_tv_template)
  4182. }
  4183. }, {
  4184. .alg = "digest_null",
  4185. .test = alg_test_null,
  4186. }, {
  4187. .alg = "drbg_nopr_ctr_aes128",
  4188. .test = alg_test_drbg,
  4189. .fips_allowed = 1,
  4190. .suite = {
  4191. .drbg = __VECS(drbg_nopr_ctr_aes128_tv_template)
  4192. }
  4193. }, {
  4194. .alg = "drbg_nopr_ctr_aes192",
  4195. .test = alg_test_drbg,
  4196. .fips_allowed = 1,
  4197. .suite = {
  4198. .drbg = __VECS(drbg_nopr_ctr_aes192_tv_template)
  4199. }
  4200. }, {
  4201. .alg = "drbg_nopr_ctr_aes256",
  4202. .test = alg_test_drbg,
  4203. .fips_allowed = 1,
  4204. .suite = {
  4205. .drbg = __VECS(drbg_nopr_ctr_aes256_tv_template)
  4206. }
  4207. }, {
  4208. /*
  4209. * There is no need to specifically test the DRBG with every
  4210. * backend cipher -- covered by drbg_nopr_hmac_sha256 test
  4211. */
  4212. .alg = "drbg_nopr_hmac_sha1",
  4213. .fips_allowed = 1,
  4214. .test = alg_test_null,
  4215. }, {
  4216. .alg = "drbg_nopr_hmac_sha256",
  4217. .test = alg_test_drbg,
  4218. .fips_allowed = 1,
  4219. .suite = {
  4220. .drbg = __VECS(drbg_nopr_hmac_sha256_tv_template)
  4221. }
  4222. }, {
  4223. /* covered by drbg_nopr_hmac_sha256 test */
  4224. .alg = "drbg_nopr_hmac_sha384",
  4225. .fips_allowed = 1,
  4226. .test = alg_test_null,
  4227. }, {
  4228. .alg = "drbg_nopr_hmac_sha512",
  4229. .test = alg_test_null,
  4230. .fips_allowed = 1,
  4231. }, {
  4232. .alg = "drbg_nopr_sha1",
  4233. .fips_allowed = 1,
  4234. .test = alg_test_null,
  4235. }, {
  4236. .alg = "drbg_nopr_sha256",
  4237. .test = alg_test_drbg,
  4238. .fips_allowed = 1,
  4239. .suite = {
  4240. .drbg = __VECS(drbg_nopr_sha256_tv_template)
  4241. }
  4242. }, {
  4243. /* covered by drbg_nopr_sha256 test */
  4244. .alg = "drbg_nopr_sha384",
  4245. .fips_allowed = 1,
  4246. .test = alg_test_null,
  4247. }, {
  4248. .alg = "drbg_nopr_sha512",
  4249. .fips_allowed = 1,
  4250. .test = alg_test_null,
  4251. }, {
  4252. .alg = "drbg_pr_ctr_aes128",
  4253. .test = alg_test_drbg,
  4254. .fips_allowed = 1,
  4255. .suite = {
  4256. .drbg = __VECS(drbg_pr_ctr_aes128_tv_template)
  4257. }
  4258. }, {
  4259. /* covered by drbg_pr_ctr_aes128 test */
  4260. .alg = "drbg_pr_ctr_aes192",
  4261. .fips_allowed = 1,
  4262. .test = alg_test_null,
  4263. }, {
  4264. .alg = "drbg_pr_ctr_aes256",
  4265. .fips_allowed = 1,
  4266. .test = alg_test_null,
  4267. }, {
  4268. .alg = "drbg_pr_hmac_sha1",
  4269. .fips_allowed = 1,
  4270. .test = alg_test_null,
  4271. }, {
  4272. .alg = "drbg_pr_hmac_sha256",
  4273. .test = alg_test_drbg,
  4274. .fips_allowed = 1,
  4275. .suite = {
  4276. .drbg = __VECS(drbg_pr_hmac_sha256_tv_template)
  4277. }
  4278. }, {
  4279. /* covered by drbg_pr_hmac_sha256 test */
  4280. .alg = "drbg_pr_hmac_sha384",
  4281. .fips_allowed = 1,
  4282. .test = alg_test_null,
  4283. }, {
  4284. .alg = "drbg_pr_hmac_sha512",
  4285. .test = alg_test_null,
  4286. .fips_allowed = 1,
  4287. }, {
  4288. .alg = "drbg_pr_sha1",
  4289. .fips_allowed = 1,
  4290. .test = alg_test_null,
  4291. }, {
  4292. .alg = "drbg_pr_sha256",
  4293. .test = alg_test_drbg,
  4294. .fips_allowed = 1,
  4295. .suite = {
  4296. .drbg = __VECS(drbg_pr_sha256_tv_template)
  4297. }
  4298. }, {
  4299. /* covered by drbg_pr_sha256 test */
  4300. .alg = "drbg_pr_sha384",
  4301. .fips_allowed = 1,
  4302. .test = alg_test_null,
  4303. }, {
  4304. .alg = "drbg_pr_sha512",
  4305. .fips_allowed = 1,
  4306. .test = alg_test_null,
  4307. }, {
  4308. .alg = "ecb(aes)",
  4309. .test = alg_test_skcipher,
  4310. .fips_allowed = 1,
  4311. .suite = {
  4312. .cipher = __VECS(aes_tv_template)
  4313. }
  4314. }, {
  4315. .alg = "ecb(anubis)",
  4316. .test = alg_test_skcipher,
  4317. .suite = {
  4318. .cipher = __VECS(anubis_tv_template)
  4319. }
  4320. }, {
  4321. .alg = "ecb(arc4)",
  4322. .generic_driver = "ecb(arc4)-generic",
  4323. .test = alg_test_skcipher,
  4324. .suite = {
  4325. .cipher = __VECS(arc4_tv_template)
  4326. }
  4327. }, {
  4328. .alg = "ecb(blowfish)",
  4329. .test = alg_test_skcipher,
  4330. .suite = {
  4331. .cipher = __VECS(bf_tv_template)
  4332. }
  4333. }, {
  4334. .alg = "ecb(camellia)",
  4335. .test = alg_test_skcipher,
  4336. .suite = {
  4337. .cipher = __VECS(camellia_tv_template)
  4338. }
  4339. }, {
  4340. .alg = "ecb(cast5)",
  4341. .test = alg_test_skcipher,
  4342. .suite = {
  4343. .cipher = __VECS(cast5_tv_template)
  4344. }
  4345. }, {
  4346. .alg = "ecb(cast6)",
  4347. .test = alg_test_skcipher,
  4348. .suite = {
  4349. .cipher = __VECS(cast6_tv_template)
  4350. }
  4351. }, {
  4352. .alg = "ecb(cipher_null)",
  4353. .test = alg_test_null,
  4354. .fips_allowed = 1,
  4355. }, {
  4356. .alg = "ecb(des)",
  4357. .test = alg_test_skcipher,
  4358. .suite = {
  4359. .cipher = __VECS(des_tv_template)
  4360. }
  4361. }, {
  4362. .alg = "ecb(des3_ede)",
  4363. .test = alg_test_skcipher,
  4364. .fips_allowed = 1,
  4365. .suite = {
  4366. .cipher = __VECS(des3_ede_tv_template)
  4367. }
  4368. }, {
  4369. .alg = "ecb(fcrypt)",
  4370. .test = alg_test_skcipher,
  4371. .suite = {
  4372. .cipher = {
  4373. .vecs = fcrypt_pcbc_tv_template,
  4374. .count = 1
  4375. }
  4376. }
  4377. }, {
  4378. .alg = "ecb(khazad)",
  4379. .test = alg_test_skcipher,
  4380. .suite = {
  4381. .cipher = __VECS(khazad_tv_template)
  4382. }
  4383. }, {
  4384. /* Same as ecb(aes) except the key is stored in
  4385. * hardware secure memory which we reference by index
  4386. */
  4387. .alg = "ecb(paes)",
  4388. .test = alg_test_null,
  4389. .fips_allowed = 1,
  4390. }, {
  4391. .alg = "ecb(seed)",
  4392. .test = alg_test_skcipher,
  4393. .suite = {
  4394. .cipher = __VECS(seed_tv_template)
  4395. }
  4396. }, {
  4397. .alg = "ecb(serpent)",
  4398. .test = alg_test_skcipher,
  4399. .suite = {
  4400. .cipher = __VECS(serpent_tv_template)
  4401. }
  4402. }, {
  4403. .alg = "ecb(sm4)",
  4404. .test = alg_test_skcipher,
  4405. .suite = {
  4406. .cipher = __VECS(sm4_tv_template)
  4407. }
  4408. }, {
  4409. .alg = "ecb(tea)",
  4410. .test = alg_test_skcipher,
  4411. .suite = {
  4412. .cipher = __VECS(tea_tv_template)
  4413. }
  4414. }, {
  4415. .alg = "ecb(tnepres)",
  4416. .test = alg_test_skcipher,
  4417. .suite = {
  4418. .cipher = __VECS(tnepres_tv_template)
  4419. }
  4420. }, {
  4421. .alg = "ecb(twofish)",
  4422. .test = alg_test_skcipher,
  4423. .suite = {
  4424. .cipher = __VECS(tf_tv_template)
  4425. }
  4426. }, {
  4427. .alg = "ecb(xeta)",
  4428. .test = alg_test_skcipher,
  4429. .suite = {
  4430. .cipher = __VECS(xeta_tv_template)
  4431. }
  4432. }, {
  4433. .alg = "ecb(xtea)",
  4434. .test = alg_test_skcipher,
  4435. .suite = {
  4436. .cipher = __VECS(xtea_tv_template)
  4437. }
  4438. }, {
  4439. #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
  4440. .alg = "ecb-paes-s390",
  4441. .fips_allowed = 1,
  4442. .test = alg_test_skcipher,
  4443. .suite = {
  4444. .cipher = __VECS(aes_tv_template)
  4445. }
  4446. }, {
  4447. #endif
  4448. .alg = "ecdh",
  4449. .test = alg_test_kpp,
  4450. .fips_allowed = 1,
  4451. .suite = {
  4452. .kpp = __VECS(ecdh_tv_template)
  4453. }
  4454. }, {
  4455. .alg = "ecrdsa",
  4456. .test = alg_test_akcipher,
  4457. .suite = {
  4458. .akcipher = __VECS(ecrdsa_tv_template)
  4459. }
  4460. }, {
  4461. .alg = "essiv(authenc(hmac(sha256),cbc(aes)),sha256)",
  4462. .test = alg_test_aead,
  4463. .fips_allowed = 1,
  4464. .suite = {
  4465. .aead = __VECS(essiv_hmac_sha256_aes_cbc_tv_temp)
  4466. }
  4467. }, {
  4468. .alg = "essiv(cbc(aes),sha256)",
  4469. .test = alg_test_skcipher,
  4470. .fips_allowed = 1,
  4471. .suite = {
  4472. .cipher = __VECS(essiv_aes_cbc_tv_template)
  4473. }
  4474. }, {
  4475. .alg = "gcm(aes)",
  4476. .generic_driver = "gcm_base(ctr(aes-generic),ghash-generic)",
  4477. .test = alg_test_aead,
  4478. .fips_allowed = 1,
  4479. .suite = {
  4480. .aead = __VECS(aes_gcm_tv_template)
  4481. }
  4482. }, {
  4483. .alg = "ghash",
  4484. .test = alg_test_hash,
  4485. .fips_allowed = 1,
  4486. .suite = {
  4487. .hash = __VECS(ghash_tv_template)
  4488. }
  4489. }, {
  4490. .alg = "hmac(md5)",
  4491. .test = alg_test_hash,
  4492. .suite = {
  4493. .hash = __VECS(hmac_md5_tv_template)
  4494. }
  4495. }, {
  4496. .alg = "hmac(rmd128)",
  4497. .test = alg_test_hash,
  4498. .suite = {
  4499. .hash = __VECS(hmac_rmd128_tv_template)
  4500. }
  4501. }, {
  4502. .alg = "hmac(rmd160)",
  4503. .test = alg_test_hash,
  4504. .suite = {
  4505. .hash = __VECS(hmac_rmd160_tv_template)
  4506. }
  4507. }, {
  4508. .alg = "hmac(sha1)",
  4509. .test = alg_test_hash,
  4510. .fips_allowed = 1,
  4511. .suite = {
  4512. .hash = __VECS(hmac_sha1_tv_template)
  4513. }
  4514. }, {
  4515. .alg = "hmac(sha224)",
  4516. .test = alg_test_hash,
  4517. .fips_allowed = 1,
  4518. .suite = {
  4519. .hash = __VECS(hmac_sha224_tv_template)
  4520. }
  4521. }, {
  4522. .alg = "hmac(sha256)",
  4523. .test = alg_test_hash,
  4524. .fips_allowed = 1,
  4525. .suite = {
  4526. .hash = __VECS(hmac_sha256_tv_template)
  4527. }
  4528. }, {
  4529. .alg = "hmac(sha3-224)",
  4530. .test = alg_test_hash,
  4531. .fips_allowed = 1,
  4532. .suite = {
  4533. .hash = __VECS(hmac_sha3_224_tv_template)
  4534. }
  4535. }, {
  4536. .alg = "hmac(sha3-256)",
  4537. .test = alg_test_hash,
  4538. .fips_allowed = 1,
  4539. .suite = {
  4540. .hash = __VECS(hmac_sha3_256_tv_template)
  4541. }
  4542. }, {
  4543. .alg = "hmac(sha3-384)",
  4544. .test = alg_test_hash,
  4545. .fips_allowed = 1,
  4546. .suite = {
  4547. .hash = __VECS(hmac_sha3_384_tv_template)
  4548. }
  4549. }, {
  4550. .alg = "hmac(sha3-512)",
  4551. .test = alg_test_hash,
  4552. .fips_allowed = 1,
  4553. .suite = {
  4554. .hash = __VECS(hmac_sha3_512_tv_template)
  4555. }
  4556. }, {
  4557. .alg = "hmac(sha384)",
  4558. .test = alg_test_hash,
  4559. .fips_allowed = 1,
  4560. .suite = {
  4561. .hash = __VECS(hmac_sha384_tv_template)
  4562. }
  4563. }, {
  4564. .alg = "hmac(sha512)",
  4565. .test = alg_test_hash,
  4566. .fips_allowed = 1,
  4567. .suite = {
  4568. .hash = __VECS(hmac_sha512_tv_template)
  4569. }
  4570. }, {
  4571. .alg = "hmac(sm3)",
  4572. .test = alg_test_hash,
  4573. .suite = {
  4574. .hash = __VECS(hmac_sm3_tv_template)
  4575. }
  4576. }, {
  4577. .alg = "hmac(streebog256)",
  4578. .test = alg_test_hash,
  4579. .suite = {
  4580. .hash = __VECS(hmac_streebog256_tv_template)
  4581. }
  4582. }, {
  4583. .alg = "hmac(streebog512)",
  4584. .test = alg_test_hash,
  4585. .suite = {
  4586. .hash = __VECS(hmac_streebog512_tv_template)
  4587. }
  4588. }, {
  4589. .alg = "jitterentropy_rng",
  4590. .fips_allowed = 1,
  4591. .test = alg_test_null,
  4592. }, {
  4593. .alg = "kw(aes)",
  4594. .test = alg_test_skcipher,
  4595. .fips_allowed = 1,
  4596. .suite = {
  4597. .cipher = __VECS(aes_kw_tv_template)
  4598. }
  4599. }, {
  4600. .alg = "lrw(aes)",
  4601. .generic_driver = "lrw(ecb(aes-generic))",
  4602. .test = alg_test_skcipher,
  4603. .suite = {
  4604. .cipher = __VECS(aes_lrw_tv_template)
  4605. }
  4606. }, {
  4607. .alg = "lrw(camellia)",
  4608. .generic_driver = "lrw(ecb(camellia-generic))",
  4609. .test = alg_test_skcipher,
  4610. .suite = {
  4611. .cipher = __VECS(camellia_lrw_tv_template)
  4612. }
  4613. }, {
  4614. .alg = "lrw(cast6)",
  4615. .generic_driver = "lrw(ecb(cast6-generic))",
  4616. .test = alg_test_skcipher,
  4617. .suite = {
  4618. .cipher = __VECS(cast6_lrw_tv_template)
  4619. }
  4620. }, {
  4621. .alg = "lrw(serpent)",
  4622. .generic_driver = "lrw(ecb(serpent-generic))",
  4623. .test = alg_test_skcipher,
  4624. .suite = {
  4625. .cipher = __VECS(serpent_lrw_tv_template)
  4626. }
  4627. }, {
  4628. .alg = "lrw(twofish)",
  4629. .generic_driver = "lrw(ecb(twofish-generic))",
  4630. .test = alg_test_skcipher,
  4631. .suite = {
  4632. .cipher = __VECS(tf_lrw_tv_template)
  4633. }
  4634. }, {
  4635. .alg = "lz4",
  4636. .test = alg_test_comp,
  4637. .fips_allowed = 1,
  4638. .suite = {
  4639. .comp = {
  4640. .comp = __VECS(lz4_comp_tv_template),
  4641. .decomp = __VECS(lz4_decomp_tv_template)
  4642. }
  4643. }
  4644. }, {
  4645. .alg = "lz4hc",
  4646. .test = alg_test_comp,
  4647. .fips_allowed = 1,
  4648. .suite = {
  4649. .comp = {
  4650. .comp = __VECS(lz4hc_comp_tv_template),
  4651. .decomp = __VECS(lz4hc_decomp_tv_template)
  4652. }
  4653. }
  4654. }, {
  4655. .alg = "lzo",
  4656. .test = alg_test_comp,
  4657. .fips_allowed = 1,
  4658. .suite = {
  4659. .comp = {
  4660. .comp = __VECS(lzo_comp_tv_template),
  4661. .decomp = __VECS(lzo_decomp_tv_template)
  4662. }
  4663. }
  4664. }, {
  4665. .alg = "lzo-rle",
  4666. .test = alg_test_comp,
  4667. .fips_allowed = 1,
  4668. .suite = {
  4669. .comp = {
  4670. .comp = __VECS(lzorle_comp_tv_template),
  4671. .decomp = __VECS(lzorle_decomp_tv_template)
  4672. }
  4673. }
  4674. }, {
  4675. .alg = "md4",
  4676. .test = alg_test_hash,
  4677. .suite = {
  4678. .hash = __VECS(md4_tv_template)
  4679. }
  4680. }, {
  4681. .alg = "md5",
  4682. .test = alg_test_hash,
  4683. .suite = {
  4684. .hash = __VECS(md5_tv_template)
  4685. }
  4686. }, {
  4687. .alg = "michael_mic",
  4688. .test = alg_test_hash,
  4689. .suite = {
  4690. .hash = __VECS(michael_mic_tv_template)
  4691. }
  4692. }, {
  4693. .alg = "nhpoly1305",
  4694. .test = alg_test_hash,
  4695. .suite = {
  4696. .hash = __VECS(nhpoly1305_tv_template)
  4697. }
  4698. }, {
  4699. .alg = "ofb(aes)",
  4700. .test = alg_test_skcipher,
  4701. .fips_allowed = 1,
  4702. .suite = {
  4703. .cipher = __VECS(aes_ofb_tv_template)
  4704. }
  4705. }, {
  4706. /* Same as ofb(aes) except the key is stored in
  4707. * hardware secure memory which we reference by index
  4708. */
  4709. .alg = "ofb(paes)",
  4710. .test = alg_test_null,
  4711. .fips_allowed = 1,
  4712. }, {
  4713. .alg = "ofb(sm4)",
  4714. .test = alg_test_skcipher,
  4715. .suite = {
  4716. .cipher = __VECS(sm4_ofb_tv_template)
  4717. }
  4718. }, {
  4719. .alg = "pcbc(fcrypt)",
  4720. .test = alg_test_skcipher,
  4721. .suite = {
  4722. .cipher = __VECS(fcrypt_pcbc_tv_template)
  4723. }
  4724. }, {
  4725. .alg = "pkcs1pad(rsa,sha224)",
  4726. .test = alg_test_null,
  4727. .fips_allowed = 1,
  4728. }, {
  4729. .alg = "pkcs1pad(rsa,sha256)",
  4730. .test = alg_test_akcipher,
  4731. .fips_allowed = 1,
  4732. .suite = {
  4733. .akcipher = __VECS(pkcs1pad_rsa_tv_template)
  4734. }
  4735. }, {
  4736. .alg = "pkcs1pad(rsa,sha384)",
  4737. .test = alg_test_null,
  4738. .fips_allowed = 1,
  4739. }, {
  4740. .alg = "pkcs1pad(rsa,sha512)",
  4741. .test = alg_test_null,
  4742. .fips_allowed = 1,
  4743. }, {
  4744. .alg = "poly1305",
  4745. .test = alg_test_hash,
  4746. .suite = {
  4747. .hash = __VECS(poly1305_tv_template)
  4748. }
  4749. }, {
  4750. .alg = "rfc3686(ctr(aes))",
  4751. .test = alg_test_skcipher,
  4752. .fips_allowed = 1,
  4753. .suite = {
  4754. .cipher = __VECS(aes_ctr_rfc3686_tv_template)
  4755. }
  4756. }, {
  4757. .alg = "rfc3686(ctr(sm4))",
  4758. .test = alg_test_skcipher,
  4759. .suite = {
  4760. .cipher = __VECS(sm4_ctr_rfc3686_tv_template)
  4761. }
  4762. }, {
  4763. .alg = "rfc4106(gcm(aes))",
  4764. .generic_driver = "rfc4106(gcm_base(ctr(aes-generic),ghash-generic))",
  4765. .test = alg_test_aead,
  4766. .fips_allowed = 1,
  4767. .suite = {
  4768. .aead = {
  4769. ____VECS(aes_gcm_rfc4106_tv_template),
  4770. .einval_allowed = 1,
  4771. .aad_iv = 1,
  4772. }
  4773. }
  4774. }, {
  4775. .alg = "rfc4309(ccm(aes))",
  4776. .generic_driver = "rfc4309(ccm_base(ctr(aes-generic),cbcmac(aes-generic)))",
  4777. .test = alg_test_aead,
  4778. .fips_allowed = 1,
  4779. .suite = {
  4780. .aead = {
  4781. ____VECS(aes_ccm_rfc4309_tv_template),
  4782. .einval_allowed = 1,
  4783. .aad_iv = 1,
  4784. }
  4785. }
  4786. }, {
  4787. .alg = "rfc4543(gcm(aes))",
  4788. .generic_driver = "rfc4543(gcm_base(ctr(aes-generic),ghash-generic))",
  4789. .test = alg_test_aead,
  4790. .suite = {
  4791. .aead = {
  4792. ____VECS(aes_gcm_rfc4543_tv_template),
  4793. .einval_allowed = 1,
  4794. .aad_iv = 1,
  4795. }
  4796. }
  4797. }, {
  4798. .alg = "rfc7539(chacha20,poly1305)",
  4799. .test = alg_test_aead,
  4800. .suite = {
  4801. .aead = __VECS(rfc7539_tv_template)
  4802. }
  4803. }, {
  4804. .alg = "rfc7539esp(chacha20,poly1305)",
  4805. .test = alg_test_aead,
  4806. .suite = {
  4807. .aead = {
  4808. ____VECS(rfc7539esp_tv_template),
  4809. .einval_allowed = 1,
  4810. .aad_iv = 1,
  4811. }
  4812. }
  4813. }, {
  4814. .alg = "rmd128",
  4815. .test = alg_test_hash,
  4816. .suite = {
  4817. .hash = __VECS(rmd128_tv_template)
  4818. }
  4819. }, {
  4820. .alg = "rmd160",
  4821. .test = alg_test_hash,
  4822. .suite = {
  4823. .hash = __VECS(rmd160_tv_template)
  4824. }
  4825. }, {
  4826. .alg = "rmd256",
  4827. .test = alg_test_hash,
  4828. .suite = {
  4829. .hash = __VECS(rmd256_tv_template)
  4830. }
  4831. }, {
  4832. .alg = "rmd320",
  4833. .test = alg_test_hash,
  4834. .suite = {
  4835. .hash = __VECS(rmd320_tv_template)
  4836. }
  4837. }, {
  4838. .alg = "rsa",
  4839. .test = alg_test_akcipher,
  4840. .fips_allowed = 1,
  4841. .suite = {
  4842. .akcipher = __VECS(rsa_tv_template)
  4843. }
  4844. }, {
  4845. .alg = "salsa20",
  4846. .test = alg_test_skcipher,
  4847. .suite = {
  4848. .cipher = __VECS(salsa20_stream_tv_template)
  4849. }
  4850. }, {
  4851. .alg = "sha1",
  4852. .test = alg_test_hash,
  4853. .fips_allowed = 1,
  4854. .suite = {
  4855. .hash = __VECS(sha1_tv_template)
  4856. }
  4857. }, {
  4858. .alg = "sha224",
  4859. .test = alg_test_hash,
  4860. .fips_allowed = 1,
  4861. .suite = {
  4862. .hash = __VECS(sha224_tv_template)
  4863. }
  4864. }, {
  4865. .alg = "sha256",
  4866. .test = alg_test_hash,
  4867. .fips_allowed = 1,
  4868. .suite = {
  4869. .hash = __VECS(sha256_tv_template)
  4870. }
  4871. }, {
  4872. .alg = "sha3-224",
  4873. .test = alg_test_hash,
  4874. .fips_allowed = 1,
  4875. .suite = {
  4876. .hash = __VECS(sha3_224_tv_template)
  4877. }
  4878. }, {
  4879. .alg = "sha3-256",
  4880. .test = alg_test_hash,
  4881. .fips_allowed = 1,
  4882. .suite = {
  4883. .hash = __VECS(sha3_256_tv_template)
  4884. }
  4885. }, {
  4886. .alg = "sha3-384",
  4887. .test = alg_test_hash,
  4888. .fips_allowed = 1,
  4889. .suite = {
  4890. .hash = __VECS(sha3_384_tv_template)
  4891. }
  4892. }, {
  4893. .alg = "sha3-512",
  4894. .test = alg_test_hash,
  4895. .fips_allowed = 1,
  4896. .suite = {
  4897. .hash = __VECS(sha3_512_tv_template)
  4898. }
  4899. }, {
  4900. .alg = "sha384",
  4901. .test = alg_test_hash,
  4902. .fips_allowed = 1,
  4903. .suite = {
  4904. .hash = __VECS(sha384_tv_template)
  4905. }
  4906. }, {
  4907. .alg = "sha512",
  4908. .test = alg_test_hash,
  4909. .fips_allowed = 1,
  4910. .suite = {
  4911. .hash = __VECS(sha512_tv_template)
  4912. }
  4913. }, {
  4914. .alg = "sm2",
  4915. .test = alg_test_akcipher,
  4916. .suite = {
  4917. .akcipher = __VECS(sm2_tv_template)
  4918. }
  4919. }, {
  4920. .alg = "sm3",
  4921. .test = alg_test_hash,
  4922. .suite = {
  4923. .hash = __VECS(sm3_tv_template)
  4924. }
  4925. }, {
  4926. .alg = "streebog256",
  4927. .test = alg_test_hash,
  4928. .suite = {
  4929. .hash = __VECS(streebog256_tv_template)
  4930. }
  4931. }, {
  4932. .alg = "streebog512",
  4933. .test = alg_test_hash,
  4934. .suite = {
  4935. .hash = __VECS(streebog512_tv_template)
  4936. }
  4937. }, {
  4938. .alg = "tgr128",
  4939. .test = alg_test_hash,
  4940. .suite = {
  4941. .hash = __VECS(tgr128_tv_template)
  4942. }
  4943. }, {
  4944. .alg = "tgr160",
  4945. .test = alg_test_hash,
  4946. .suite = {
  4947. .hash = __VECS(tgr160_tv_template)
  4948. }
  4949. }, {
  4950. .alg = "tgr192",
  4951. .test = alg_test_hash,
  4952. .suite = {
  4953. .hash = __VECS(tgr192_tv_template)
  4954. }
  4955. }, {
  4956. .alg = "vmac64(aes)",
  4957. .test = alg_test_hash,
  4958. .suite = {
  4959. .hash = __VECS(vmac64_aes_tv_template)
  4960. }
  4961. }, {
  4962. .alg = "wp256",
  4963. .test = alg_test_hash,
  4964. .suite = {
  4965. .hash = __VECS(wp256_tv_template)
  4966. }
  4967. }, {
  4968. .alg = "wp384",
  4969. .test = alg_test_hash,
  4970. .suite = {
  4971. .hash = __VECS(wp384_tv_template)
  4972. }
  4973. }, {
  4974. .alg = "wp512",
  4975. .test = alg_test_hash,
  4976. .suite = {
  4977. .hash = __VECS(wp512_tv_template)
  4978. }
  4979. }, {
  4980. .alg = "xcbc(aes)",
  4981. .test = alg_test_hash,
  4982. .suite = {
  4983. .hash = __VECS(aes_xcbc128_tv_template)
  4984. }
  4985. }, {
  4986. .alg = "xchacha12",
  4987. .test = alg_test_skcipher,
  4988. .suite = {
  4989. .cipher = __VECS(xchacha12_tv_template)
  4990. },
  4991. }, {
  4992. .alg = "xchacha20",
  4993. .test = alg_test_skcipher,
  4994. .suite = {
  4995. .cipher = __VECS(xchacha20_tv_template)
  4996. },
  4997. }, {
  4998. .alg = "xts(aes)",
  4999. .generic_driver = "xts(ecb(aes-generic))",
  5000. .test = alg_test_skcipher,
  5001. .fips_allowed = 1,
  5002. .suite = {
  5003. .cipher = __VECS(aes_xts_tv_template)
  5004. }
  5005. }, {
  5006. .alg = "xts(camellia)",
  5007. .generic_driver = "xts(ecb(camellia-generic))",
  5008. .test = alg_test_skcipher,
  5009. .suite = {
  5010. .cipher = __VECS(camellia_xts_tv_template)
  5011. }
  5012. }, {
  5013. .alg = "xts(cast6)",
  5014. .generic_driver = "xts(ecb(cast6-generic))",
  5015. .test = alg_test_skcipher,
  5016. .suite = {
  5017. .cipher = __VECS(cast6_xts_tv_template)
  5018. }
  5019. }, {
  5020. /* Same as xts(aes) except the key is stored in
  5021. * hardware secure memory which we reference by index
  5022. */
  5023. .alg = "xts(paes)",
  5024. .test = alg_test_null,
  5025. .fips_allowed = 1,
  5026. }, {
  5027. .alg = "xts(serpent)",
  5028. .generic_driver = "xts(ecb(serpent-generic))",
  5029. .test = alg_test_skcipher,
  5030. .suite = {
  5031. .cipher = __VECS(serpent_xts_tv_template)
  5032. }
  5033. }, {
  5034. .alg = "xts(twofish)",
  5035. .generic_driver = "xts(ecb(twofish-generic))",
  5036. .test = alg_test_skcipher,
  5037. .suite = {
  5038. .cipher = __VECS(tf_xts_tv_template)
  5039. }
  5040. }, {
  5041. #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
  5042. .alg = "xts-paes-s390",
  5043. .fips_allowed = 1,
  5044. .test = alg_test_skcipher,
  5045. .suite = {
  5046. .cipher = __VECS(aes_xts_tv_template)
  5047. }
  5048. }, {
  5049. #endif
  5050. .alg = "xts4096(paes)",
  5051. .test = alg_test_null,
  5052. .fips_allowed = 1,
  5053. }, {
  5054. .alg = "xts512(paes)",
  5055. .test = alg_test_null,
  5056. .fips_allowed = 1,
  5057. }, {
  5058. .alg = "xxhash64",
  5059. .test = alg_test_hash,
  5060. .fips_allowed = 1,
  5061. .suite = {
  5062. .hash = __VECS(xxhash64_tv_template)
  5063. }
  5064. }, {
  5065. .alg = "zlib-deflate",
  5066. .test = alg_test_comp,
  5067. .fips_allowed = 1,
  5068. .suite = {
  5069. .comp = {
  5070. .comp = __VECS(zlib_deflate_comp_tv_template),
  5071. .decomp = __VECS(zlib_deflate_decomp_tv_template)
  5072. }
  5073. }
  5074. }, {
  5075. .alg = "zstd",
  5076. .test = alg_test_comp,
  5077. .fips_allowed = 1,
  5078. .suite = {
  5079. .comp = {
  5080. .comp = __VECS(zstd_comp_tv_template),
  5081. .decomp = __VECS(zstd_decomp_tv_template)
  5082. }
  5083. }
  5084. }
  5085. };
  5086. static void alg_check_test_descs_order(void)
  5087. {
  5088. int i;
  5089. for (i = 1; i < ARRAY_SIZE(alg_test_descs); i++) {
  5090. int diff = strcmp(alg_test_descs[i - 1].alg,
  5091. alg_test_descs[i].alg);
  5092. if (WARN_ON(diff > 0)) {
  5093. pr_warn("testmgr: alg_test_descs entries in wrong order: '%s' before '%s'\n",
  5094. alg_test_descs[i - 1].alg,
  5095. alg_test_descs[i].alg);
  5096. }
  5097. if (WARN_ON(diff == 0)) {
  5098. pr_warn("testmgr: duplicate alg_test_descs entry: '%s'\n",
  5099. alg_test_descs[i].alg);
  5100. }
  5101. }
  5102. }
  5103. static void alg_check_testvec_configs(void)
  5104. {
  5105. int i;
  5106. for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++)
  5107. WARN_ON(!valid_testvec_config(
  5108. &default_cipher_testvec_configs[i]));
  5109. for (i = 0; i < ARRAY_SIZE(default_hash_testvec_configs); i++)
  5110. WARN_ON(!valid_testvec_config(
  5111. &default_hash_testvec_configs[i]));
  5112. }
  5113. static void testmgr_onetime_init(void)
  5114. {
  5115. alg_check_test_descs_order();
  5116. alg_check_testvec_configs();
  5117. #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
  5118. pr_warn("alg: extra crypto tests enabled. This is intended for developer use only.\n");
  5119. #endif
  5120. }
  5121. static int alg_find_test(const char *alg)
  5122. {
  5123. int start = 0;
  5124. int end = ARRAY_SIZE(alg_test_descs);
  5125. while (start < end) {
  5126. int i = (start + end) / 2;
  5127. int diff = strcmp(alg_test_descs[i].alg, alg);
  5128. if (diff > 0) {
  5129. end = i;
  5130. continue;
  5131. }
  5132. if (diff < 0) {
  5133. start = i + 1;
  5134. continue;
  5135. }
  5136. return i;
  5137. }
  5138. return -1;
  5139. }
  5140. int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
  5141. {
  5142. int i;
  5143. int j;
  5144. int rc;
  5145. if (!fips_enabled && notests) {
  5146. printk_once(KERN_INFO "alg: self-tests disabled\n");
  5147. return 0;
  5148. }
  5149. DO_ONCE(testmgr_onetime_init);
  5150. if ((type & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_CIPHER) {
  5151. char nalg[CRYPTO_MAX_ALG_NAME];
  5152. if (snprintf(nalg, sizeof(nalg), "ecb(%s)", alg) >=
  5153. sizeof(nalg))
  5154. return -ENAMETOOLONG;
  5155. i = alg_find_test(nalg);
  5156. if (i < 0)
  5157. goto notest;
  5158. if (fips_enabled && !alg_test_descs[i].fips_allowed)
  5159. goto non_fips_alg;
  5160. rc = alg_test_cipher(alg_test_descs + i, driver, type, mask);
  5161. goto test_done;
  5162. }
  5163. i = alg_find_test(alg);
  5164. j = alg_find_test(driver);
  5165. if (i < 0 && j < 0)
  5166. goto notest;
  5167. if (fips_enabled && ((i >= 0 && !alg_test_descs[i].fips_allowed) ||
  5168. (j >= 0 && !alg_test_descs[j].fips_allowed)))
  5169. goto non_fips_alg;
  5170. rc = 0;
  5171. if (i >= 0)
  5172. rc |= alg_test_descs[i].test(alg_test_descs + i, driver,
  5173. type, mask);
  5174. if (j >= 0 && j != i)
  5175. rc |= alg_test_descs[j].test(alg_test_descs + j, driver,
  5176. type, mask);
  5177. test_done:
  5178. if (rc && (fips_enabled || panic_on_fail)) {
  5179. fips_fail_notify();
  5180. panic("alg: self-tests for %s (%s) failed in %s mode!\n",
  5181. driver, alg, fips_enabled ? "fips" : "panic_on_fail");
  5182. }
  5183. if (fips_enabled && !rc)
  5184. pr_info("alg: self-tests for %s (%s) passed\n", driver, alg);
  5185. return rc;
  5186. notest:
  5187. printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver);
  5188. return 0;
  5189. non_fips_alg:
  5190. return -EINVAL;
  5191. }
  5192. #endif /* CONFIG_CRYPTO_MANAGER_DISABLE_TESTS */
  5193. EXPORT_SYMBOL_GPL(alg_test);