1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 * Algorithm testing framework and tests.
   4 *
   5 * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
   6 * Copyright (c) 2002 Jean-Francois Dive <jef@linuxbe.org>
   7 * Copyright (c) 2007 Nokia Siemens Networks
   8 * Copyright (c) 2008 Herbert Xu <herbert@gondor.apana.org.au>
   9 * Copyright (c) 2019 Google LLC
  10 *
  11 * Updated RFC4106 AES-GCM testing.
  12 *    Authors: Aidan O'Mahony (aidan.o.mahony@intel.com)
  13 *             Adrian Hoban <adrian.hoban@intel.com>
  14 *             Gabriele Paoloni <gabriele.paoloni@intel.com>
  15 *             Tadeusz Struk (tadeusz.struk@intel.com)
  16 *    Copyright (c) 2010, Intel Corporation.
 
 
 
 
 
 
  17 */
  18
  19#include <crypto/aead.h>
  20#include <crypto/hash.h>
  21#include <crypto/skcipher.h>
  22#include <linux/err.h>
  23#include <linux/fips.h>
  24#include <linux/module.h>
  25#include <linux/once.h>
  26#include <linux/random.h>
  27#include <linux/scatterlist.h>
  28#include <linux/slab.h>
  29#include <linux/string.h>
  30#include <crypto/rng.h>
  31#include <crypto/drbg.h>
  32#include <crypto/akcipher.h>
  33#include <crypto/kpp.h>
  34#include <crypto/acompress.h>
  35#include <crypto/internal/simd.h>
  36
  37#include "internal.h"
  38
  39static bool notests;
  40module_param(notests, bool, 0644);
  41MODULE_PARM_DESC(notests, "disable crypto self-tests");
  42
  43static bool panic_on_fail;
  44module_param(panic_on_fail, bool, 0444);
  45
  46#ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
  47static bool noextratests;
  48module_param(noextratests, bool, 0644);
  49MODULE_PARM_DESC(noextratests, "disable expensive crypto self-tests");
  50
  51static unsigned int fuzz_iterations = 100;
  52module_param(fuzz_iterations, uint, 0644);
  53MODULE_PARM_DESC(fuzz_iterations, "number of fuzz test iterations");
  54
  55DEFINE_PER_CPU(bool, crypto_simd_disabled_for_test);
  56EXPORT_PER_CPU_SYMBOL_GPL(crypto_simd_disabled_for_test);
  57#endif
  58
  59#ifdef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS
  60
  61/* a perfect nop */
  62int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
  63{
  64	return 0;
  65}
  66
  67#else
  68
  69#include "testmgr.h"
  70
  71/*
  72 * Need slab memory for testing (size in number of pages).
  73 */
  74#define XBUFSIZE	8
  75
  76/*
 
 
 
 
 
 
 
 
 
 
 
 
  77* Used by test_cipher()
  78*/
  79#define ENCRYPT 1
  80#define DECRYPT 0
  81
 
 
 
 
 
  82struct aead_test_suite {
  83	const struct aead_testvec *vecs;
  84	unsigned int count;
 
 
  85};
  86
  87struct cipher_test_suite {
  88	const struct cipher_testvec *vecs;
  89	unsigned int count;
 
 
  90};
  91
  92struct comp_test_suite {
  93	struct {
  94		const struct comp_testvec *vecs;
  95		unsigned int count;
  96	} comp, decomp;
  97};
  98
  99struct hash_test_suite {
 100	const struct hash_testvec *vecs;
 101	unsigned int count;
 102};
 103
 104struct cprng_test_suite {
 105	const struct cprng_testvec *vecs;
 106	unsigned int count;
 107};
 108
 109struct drbg_test_suite {
 110	const struct drbg_testvec *vecs;
 111	unsigned int count;
 112};
 113
 114struct akcipher_test_suite {
 115	const struct akcipher_testvec *vecs;
 116	unsigned int count;
 117};
 118
 119struct kpp_test_suite {
 120	const struct kpp_testvec *vecs;
 121	unsigned int count;
 122};
 123
 124struct alg_test_desc {
 125	const char *alg;
 126	const char *generic_driver;
 127	int (*test)(const struct alg_test_desc *desc, const char *driver,
 128		    u32 type, u32 mask);
 129	int fips_allowed;	/* set if alg is allowed in fips mode */
 130
 131	union {
 132		struct aead_test_suite aead;
 133		struct cipher_test_suite cipher;
 134		struct comp_test_suite comp;
 
 135		struct hash_test_suite hash;
 136		struct cprng_test_suite cprng;
 137		struct drbg_test_suite drbg;
 138		struct akcipher_test_suite akcipher;
 139		struct kpp_test_suite kpp;
 140	} suite;
 141};
 142
 
 
 143static void hexdump(unsigned char *buf, unsigned int len)
 144{
 145	print_hex_dump(KERN_CONT, "", DUMP_PREFIX_OFFSET,
 146			16, 1,
 147			buf, len, false);
 148}
 149
 150static int __testmgr_alloc_buf(char *buf[XBUFSIZE], int order)
 
 
 
 
 
 
 
 
 
 
 
 151{
 152	int i;
 153
 154	for (i = 0; i < XBUFSIZE; i++) {
 155		buf[i] = (char *)__get_free_pages(GFP_KERNEL, order);
 156		if (!buf[i])
 157			goto err_free_buf;
 158	}
 159
 160	return 0;
 161
 162err_free_buf:
 163	while (i-- > 0)
 164		free_pages((unsigned long)buf[i], order);
 165
 166	return -ENOMEM;
 167}
 168
 169static int testmgr_alloc_buf(char *buf[XBUFSIZE])
 170{
 171	return __testmgr_alloc_buf(buf, 0);
 172}
 173
 174static void __testmgr_free_buf(char *buf[XBUFSIZE], int order)
 175{
 176	int i;
 177
 178	for (i = 0; i < XBUFSIZE; i++)
 179		free_pages((unsigned long)buf[i], order);
 180}
 181
 182static void testmgr_free_buf(char *buf[XBUFSIZE])
 
 
 183{
 184	__testmgr_free_buf(buf, 0);
 185}
 186
 187#define TESTMGR_POISON_BYTE	0xfe
 188#define TESTMGR_POISON_LEN	16
 189
 190static inline void testmgr_poison(void *addr, size_t len)
 191{
 192	memset(addr, TESTMGR_POISON_BYTE, len);
 193}
 194
 195/* Is the memory region still fully poisoned? */
 196static inline bool testmgr_is_poison(const void *addr, size_t len)
 197{
 198	return memchr_inv(addr, TESTMGR_POISON_BYTE, len) == NULL;
 199}
 200
 201/* flush type for hash algorithms */
 202enum flush_type {
 203	/* merge with update of previous buffer(s) */
 204	FLUSH_TYPE_NONE = 0,
 205
 206	/* update with previous buffer(s) before doing this one */
 207	FLUSH_TYPE_FLUSH,
 208
 209	/* likewise, but also export and re-import the intermediate state */
 210	FLUSH_TYPE_REIMPORT,
 211};
 212
 213/* finalization function for hash algorithms */
 214enum finalization_type {
 215	FINALIZATION_TYPE_FINAL,	/* use final() */
 216	FINALIZATION_TYPE_FINUP,	/* use finup() */
 217	FINALIZATION_TYPE_DIGEST,	/* use digest() */
 218};
 219
 220#define TEST_SG_TOTAL	10000
 221
 222/**
 223 * struct test_sg_division - description of a scatterlist entry
 224 *
 225 * This struct describes one entry of a scatterlist being constructed to check a
 226 * crypto test vector.
 227 *
 228 * @proportion_of_total: length of this chunk relative to the total length,
 229 *			 given as a proportion out of TEST_SG_TOTAL so that it
 230 *			 scales to fit any test vector
 231 * @offset: byte offset into a 2-page buffer at which this chunk will start
 232 * @offset_relative_to_alignmask: if true, add the algorithm's alignmask to the
 233 *				  @offset
 234 * @flush_type: for hashes, whether an update() should be done now vs.
 235 *		continuing to accumulate data
 236 * @nosimd: if doing the pending update(), do it with SIMD disabled?
 237 */
 238struct test_sg_division {
 239	unsigned int proportion_of_total;
 240	unsigned int offset;
 241	bool offset_relative_to_alignmask;
 242	enum flush_type flush_type;
 243	bool nosimd;
 244};
 245
 246/**
 247 * struct testvec_config - configuration for testing a crypto test vector
 248 *
 249 * This struct describes the data layout and other parameters with which each
 250 * crypto test vector can be tested.
 251 *
 252 * @name: name of this config, logged for debugging purposes if a test fails
 253 * @inplace: operate on the data in-place, if applicable for the algorithm type?
 254 * @req_flags: extra request_flags, e.g. CRYPTO_TFM_REQ_MAY_SLEEP
 255 * @src_divs: description of how to arrange the source scatterlist
 256 * @dst_divs: description of how to arrange the dst scatterlist, if applicable
 257 *	      for the algorithm type.  Defaults to @src_divs if unset.
 258 * @iv_offset: misalignment of the IV in the range [0..MAX_ALGAPI_ALIGNMASK+1],
 259 *	       where 0 is aligned to a 2*(MAX_ALGAPI_ALIGNMASK+1) byte boundary
 260 * @iv_offset_relative_to_alignmask: if true, add the algorithm's alignmask to
 261 *				     the @iv_offset
 262 * @finalization_type: what finalization function to use for hashes
 263 * @nosimd: execute with SIMD disabled?  Requires !CRYPTO_TFM_REQ_MAY_SLEEP.
 264 */
 265struct testvec_config {
 266	const char *name;
 267	bool inplace;
 268	u32 req_flags;
 269	struct test_sg_division src_divs[XBUFSIZE];
 270	struct test_sg_division dst_divs[XBUFSIZE];
 271	unsigned int iv_offset;
 272	bool iv_offset_relative_to_alignmask;
 273	enum finalization_type finalization_type;
 274	bool nosimd;
 275};
 276
 277#define TESTVEC_CONFIG_NAMELEN	192
 278
 279/*
 280 * The following are the lists of testvec_configs to test for each algorithm
 281 * type when the basic crypto self-tests are enabled, i.e. when
 282 * CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is unset.  They aim to provide good test
 283 * coverage, while keeping the test time much shorter than the full fuzz tests
 284 * so that the basic tests can be enabled in a wider range of circumstances.
 285 */
 286
 287/* Configs for skciphers and aeads */
 288static const struct testvec_config default_cipher_testvec_configs[] = {
 289	{
 290		.name = "in-place",
 291		.inplace = true,
 292		.src_divs = { { .proportion_of_total = 10000 } },
 293	}, {
 294		.name = "out-of-place",
 295		.src_divs = { { .proportion_of_total = 10000 } },
 296	}, {
 297		.name = "unaligned buffer, offset=1",
 298		.src_divs = { { .proportion_of_total = 10000, .offset = 1 } },
 299		.iv_offset = 1,
 300	}, {
 301		.name = "buffer aligned only to alignmask",
 302		.src_divs = {
 303			{
 304				.proportion_of_total = 10000,
 305				.offset = 1,
 306				.offset_relative_to_alignmask = true,
 307			},
 308		},
 309		.iv_offset = 1,
 310		.iv_offset_relative_to_alignmask = true,
 311	}, {
 312		.name = "two even aligned splits",
 313		.src_divs = {
 314			{ .proportion_of_total = 5000 },
 315			{ .proportion_of_total = 5000 },
 316		},
 317	}, {
 318		.name = "uneven misaligned splits, may sleep",
 319		.req_flags = CRYPTO_TFM_REQ_MAY_SLEEP,
 320		.src_divs = {
 321			{ .proportion_of_total = 1900, .offset = 33 },
 322			{ .proportion_of_total = 3300, .offset = 7  },
 323			{ .proportion_of_total = 4800, .offset = 18 },
 324		},
 325		.iv_offset = 3,
 326	}, {
 327		.name = "misaligned splits crossing pages, inplace",
 328		.inplace = true,
 329		.src_divs = {
 330			{
 331				.proportion_of_total = 7500,
 332				.offset = PAGE_SIZE - 32
 333			}, {
 334				.proportion_of_total = 2500,
 335				.offset = PAGE_SIZE - 7
 336			},
 337		},
 338	}
 339};
 340
 341static const struct testvec_config default_hash_testvec_configs[] = {
 342	{
 343		.name = "init+update+final aligned buffer",
 344		.src_divs = { { .proportion_of_total = 10000 } },
 345		.finalization_type = FINALIZATION_TYPE_FINAL,
 346	}, {
 347		.name = "init+finup aligned buffer",
 348		.src_divs = { { .proportion_of_total = 10000 } },
 349		.finalization_type = FINALIZATION_TYPE_FINUP,
 350	}, {
 351		.name = "digest aligned buffer",
 352		.src_divs = { { .proportion_of_total = 10000 } },
 353		.finalization_type = FINALIZATION_TYPE_DIGEST,
 354	}, {
 355		.name = "init+update+final misaligned buffer",
 356		.src_divs = { { .proportion_of_total = 10000, .offset = 1 } },
 357		.finalization_type = FINALIZATION_TYPE_FINAL,
 358	}, {
 359		.name = "digest buffer aligned only to alignmask",
 360		.src_divs = {
 361			{
 362				.proportion_of_total = 10000,
 363				.offset = 1,
 364				.offset_relative_to_alignmask = true,
 365			},
 366		},
 367		.finalization_type = FINALIZATION_TYPE_DIGEST,
 368	}, {
 369		.name = "init+update+update+final two even splits",
 370		.src_divs = {
 371			{ .proportion_of_total = 5000 },
 372			{
 373				.proportion_of_total = 5000,
 374				.flush_type = FLUSH_TYPE_FLUSH,
 375			},
 376		},
 377		.finalization_type = FINALIZATION_TYPE_FINAL,
 378	}, {
 379		.name = "digest uneven misaligned splits, may sleep",
 380		.req_flags = CRYPTO_TFM_REQ_MAY_SLEEP,
 381		.src_divs = {
 382			{ .proportion_of_total = 1900, .offset = 33 },
 383			{ .proportion_of_total = 3300, .offset = 7  },
 384			{ .proportion_of_total = 4800, .offset = 18 },
 385		},
 386		.finalization_type = FINALIZATION_TYPE_DIGEST,
 387	}, {
 388		.name = "digest misaligned splits crossing pages",
 389		.src_divs = {
 390			{
 391				.proportion_of_total = 7500,
 392				.offset = PAGE_SIZE - 32,
 393			}, {
 394				.proportion_of_total = 2500,
 395				.offset = PAGE_SIZE - 7,
 396			},
 397		},
 398		.finalization_type = FINALIZATION_TYPE_DIGEST,
 399	}, {
 400		.name = "import/export",
 401		.src_divs = {
 402			{
 403				.proportion_of_total = 6500,
 404				.flush_type = FLUSH_TYPE_REIMPORT,
 405			}, {
 406				.proportion_of_total = 3500,
 407				.flush_type = FLUSH_TYPE_REIMPORT,
 408			},
 409		},
 410		.finalization_type = FINALIZATION_TYPE_FINAL,
 411	}
 412};
 413
 414static unsigned int count_test_sg_divisions(const struct test_sg_division *divs)
 415{
 416	unsigned int remaining = TEST_SG_TOTAL;
 417	unsigned int ndivs = 0;
 418
 419	do {
 420		remaining -= divs[ndivs++].proportion_of_total;
 421	} while (remaining);
 422
 423	return ndivs;
 424}
 425
 426#define SGDIVS_HAVE_FLUSHES	BIT(0)
 427#define SGDIVS_HAVE_NOSIMD	BIT(1)
 428
 429static bool valid_sg_divisions(const struct test_sg_division *divs,
 430			       unsigned int count, int *flags_ret)
 431{
 432	unsigned int total = 0;
 433	unsigned int i;
 434
 435	for (i = 0; i < count && total != TEST_SG_TOTAL; i++) {
 436		if (divs[i].proportion_of_total <= 0 ||
 437		    divs[i].proportion_of_total > TEST_SG_TOTAL - total)
 438			return false;
 439		total += divs[i].proportion_of_total;
 440		if (divs[i].flush_type != FLUSH_TYPE_NONE)
 441			*flags_ret |= SGDIVS_HAVE_FLUSHES;
 442		if (divs[i].nosimd)
 443			*flags_ret |= SGDIVS_HAVE_NOSIMD;
 444	}
 445	return total == TEST_SG_TOTAL &&
 446		memchr_inv(&divs[i], 0, (count - i) * sizeof(divs[0])) == NULL;
 447}
 448
 449/*
 450 * Check whether the given testvec_config is valid.  This isn't strictly needed
 451 * since every testvec_config should be valid, but check anyway so that people
 452 * don't unknowingly add broken configs that don't do what they wanted.
 453 */
 454static bool valid_testvec_config(const struct testvec_config *cfg)
 455{
 456	int flags = 0;
 457
 458	if (cfg->name == NULL)
 459		return false;
 460
 461	if (!valid_sg_divisions(cfg->src_divs, ARRAY_SIZE(cfg->src_divs),
 462				&flags))
 463		return false;
 464
 465	if (cfg->dst_divs[0].proportion_of_total) {
 466		if (!valid_sg_divisions(cfg->dst_divs,
 467					ARRAY_SIZE(cfg->dst_divs), &flags))
 468			return false;
 469	} else {
 470		if (memchr_inv(cfg->dst_divs, 0, sizeof(cfg->dst_divs)))
 471			return false;
 472		/* defaults to dst_divs=src_divs */
 473	}
 
 
 474
 475	if (cfg->iv_offset +
 476	    (cfg->iv_offset_relative_to_alignmask ? MAX_ALGAPI_ALIGNMASK : 0) >
 477	    MAX_ALGAPI_ALIGNMASK + 1)
 478		return false;
 479
 480	if ((flags & (SGDIVS_HAVE_FLUSHES | SGDIVS_HAVE_NOSIMD)) &&
 481	    cfg->finalization_type == FINALIZATION_TYPE_DIGEST)
 482		return false;
 483
 484	if ((cfg->nosimd || (flags & SGDIVS_HAVE_NOSIMD)) &&
 485	    (cfg->req_flags & CRYPTO_TFM_REQ_MAY_SLEEP))
 486		return false;
 487
 488	return true;
 489}
 490
 491struct test_sglist {
 492	char *bufs[XBUFSIZE];
 493	struct scatterlist sgl[XBUFSIZE];
 494	struct scatterlist sgl_saved[XBUFSIZE];
 495	struct scatterlist *sgl_ptr;
 496	unsigned int nents;
 497};
 498
 499static int init_test_sglist(struct test_sglist *tsgl)
 500{
 501	return __testmgr_alloc_buf(tsgl->bufs, 1 /* two pages per buffer */);
 502}
 503
 504static void destroy_test_sglist(struct test_sglist *tsgl)
 505{
 506	return __testmgr_free_buf(tsgl->bufs, 1 /* two pages per buffer */);
 507}
 508
 509/**
 510 * build_test_sglist() - build a scatterlist for a crypto test
 511 *
 512 * @tsgl: the scatterlist to build.  @tsgl->bufs[] contains an array of 2-page
 513 *	  buffers which the scatterlist @tsgl->sgl[] will be made to point into.
 514 * @divs: the layout specification on which the scatterlist will be based
 515 * @alignmask: the algorithm's alignmask
 516 * @total_len: the total length of the scatterlist to build in bytes
 517 * @data: if non-NULL, the buffers will be filled with this data until it ends.
 518 *	  Otherwise the buffers will be poisoned.  In both cases, some bytes
 519 *	  past the end of each buffer will be poisoned to help detect overruns.
 520 * @out_divs: if non-NULL, the test_sg_division to which each scatterlist entry
 521 *	      corresponds will be returned here.  This will match @divs except
 522 *	      that divisions resolving to a length of 0 are omitted as they are
 523 *	      not included in the scatterlist.
 524 *
 525 * Return: 0 or a -errno value
 526 */
 527static int build_test_sglist(struct test_sglist *tsgl,
 528			     const struct test_sg_division *divs,
 529			     const unsigned int alignmask,
 530			     const unsigned int total_len,
 531			     struct iov_iter *data,
 532			     const struct test_sg_division *out_divs[XBUFSIZE])
 533{
 534	struct {
 535		const struct test_sg_division *div;
 536		size_t length;
 537	} partitions[XBUFSIZE];
 538	const unsigned int ndivs = count_test_sg_divisions(divs);
 539	unsigned int len_remaining = total_len;
 540	unsigned int i;
 541
 542	BUILD_BUG_ON(ARRAY_SIZE(partitions) != ARRAY_SIZE(tsgl->sgl));
 543	if (WARN_ON(ndivs > ARRAY_SIZE(partitions)))
 544		return -EINVAL;
 545
 546	/* Calculate the (div, length) pairs */
 547	tsgl->nents = 0;
 548	for (i = 0; i < ndivs; i++) {
 549		unsigned int len_this_sg =
 550			min(len_remaining,
 551			    (total_len * divs[i].proportion_of_total +
 552			     TEST_SG_TOTAL / 2) / TEST_SG_TOTAL);
 553
 554		if (len_this_sg != 0) {
 555			partitions[tsgl->nents].div = &divs[i];
 556			partitions[tsgl->nents].length = len_this_sg;
 557			tsgl->nents++;
 558			len_remaining -= len_this_sg;
 559		}
 560	}
 561	if (tsgl->nents == 0) {
 562		partitions[tsgl->nents].div = &divs[0];
 563		partitions[tsgl->nents].length = 0;
 564		tsgl->nents++;
 565	}
 566	partitions[tsgl->nents - 1].length += len_remaining;
 567
 568	/* Set up the sgl entries and fill the data or poison */
 569	sg_init_table(tsgl->sgl, tsgl->nents);
 570	for (i = 0; i < tsgl->nents; i++) {
 571		unsigned int offset = partitions[i].div->offset;
 572		void *addr;
 573
 574		if (partitions[i].div->offset_relative_to_alignmask)
 575			offset += alignmask;
 576
 577		while (offset + partitions[i].length + TESTMGR_POISON_LEN >
 578		       2 * PAGE_SIZE) {
 579			if (WARN_ON(offset <= 0))
 580				return -EINVAL;
 581			offset /= 2;
 582		}
 583
 584		addr = &tsgl->bufs[i][offset];
 585		sg_set_buf(&tsgl->sgl[i], addr, partitions[i].length);
 586
 587		if (out_divs)
 588			out_divs[i] = partitions[i].div;
 589
 590		if (data) {
 591			size_t copy_len, copied;
 592
 593			copy_len = min(partitions[i].length, data->count);
 594			copied = copy_from_iter(addr, copy_len, data);
 595			if (WARN_ON(copied != copy_len))
 596				return -EINVAL;
 597			testmgr_poison(addr + copy_len, partitions[i].length +
 598				       TESTMGR_POISON_LEN - copy_len);
 599		} else {
 600			testmgr_poison(addr, partitions[i].length +
 601				       TESTMGR_POISON_LEN);
 602		}
 603	}
 604
 605	sg_mark_end(&tsgl->sgl[tsgl->nents - 1]);
 606	tsgl->sgl_ptr = tsgl->sgl;
 607	memcpy(tsgl->sgl_saved, tsgl->sgl, tsgl->nents * sizeof(tsgl->sgl[0]));
 608	return 0;
 609}
 610
 611/*
 612 * Verify that a scatterlist crypto operation produced the correct output.
 613 *
 614 * @tsgl: scatterlist containing the actual output
 615 * @expected_output: buffer containing the expected output
 616 * @len_to_check: length of @expected_output in bytes
 617 * @unchecked_prefix_len: number of ignored bytes in @tsgl prior to real result
 618 * @check_poison: verify that the poison bytes after each chunk are intact?
 619 *
 620 * Return: 0 if correct, -EINVAL if incorrect, -EOVERFLOW if buffer overrun.
 621 */
 622static int verify_correct_output(const struct test_sglist *tsgl,
 623				 const char *expected_output,
 624				 unsigned int len_to_check,
 625				 unsigned int unchecked_prefix_len,
 626				 bool check_poison)
 627{
 628	unsigned int i;
 629
 630	for (i = 0; i < tsgl->nents; i++) {
 631		struct scatterlist *sg = &tsgl->sgl_ptr[i];
 632		unsigned int len = sg->length;
 633		unsigned int offset = sg->offset;
 634		const char *actual_output;
 635
 636		if (unchecked_prefix_len) {
 637			if (unchecked_prefix_len >= len) {
 638				unchecked_prefix_len -= len;
 639				continue;
 640			}
 641			offset += unchecked_prefix_len;
 642			len -= unchecked_prefix_len;
 643			unchecked_prefix_len = 0;
 644		}
 645		len = min(len, len_to_check);
 646		actual_output = page_address(sg_page(sg)) + offset;
 647		if (memcmp(expected_output, actual_output, len) != 0)
 648			return -EINVAL;
 649		if (check_poison &&
 650		    !testmgr_is_poison(actual_output + len, TESTMGR_POISON_LEN))
 651			return -EOVERFLOW;
 652		len_to_check -= len;
 653		expected_output += len;
 654	}
 655	if (WARN_ON(len_to_check != 0))
 656		return -EINVAL;
 657	return 0;
 658}
 659
 660static bool is_test_sglist_corrupted(const struct test_sglist *tsgl)
 661{
 662	unsigned int i;
 663
 664	for (i = 0; i < tsgl->nents; i++) {
 665		if (tsgl->sgl[i].page_link != tsgl->sgl_saved[i].page_link)
 666			return true;
 667		if (tsgl->sgl[i].offset != tsgl->sgl_saved[i].offset)
 668			return true;
 669		if (tsgl->sgl[i].length != tsgl->sgl_saved[i].length)
 670			return true;
 671	}
 672	return false;
 673}
 674
 675struct cipher_test_sglists {
 676	struct test_sglist src;
 677	struct test_sglist dst;
 678};
 679
 680static struct cipher_test_sglists *alloc_cipher_test_sglists(void)
 681{
 682	struct cipher_test_sglists *tsgls;
 683
 684	tsgls = kmalloc(sizeof(*tsgls), GFP_KERNEL);
 685	if (!tsgls)
 686		return NULL;
 687
 688	if (init_test_sglist(&tsgls->src) != 0)
 689		goto fail_kfree;
 690	if (init_test_sglist(&tsgls->dst) != 0)
 691		goto fail_destroy_src;
 692
 693	return tsgls;
 694
 695fail_destroy_src:
 696	destroy_test_sglist(&tsgls->src);
 697fail_kfree:
 698	kfree(tsgls);
 699	return NULL;
 700}
 701
 702static void free_cipher_test_sglists(struct cipher_test_sglists *tsgls)
 703{
 704	if (tsgls) {
 705		destroy_test_sglist(&tsgls->src);
 706		destroy_test_sglist(&tsgls->dst);
 707		kfree(tsgls);
 708	}
 709}
 710
 711/* Build the src and dst scatterlists for an skcipher or AEAD test */
 712static int build_cipher_test_sglists(struct cipher_test_sglists *tsgls,
 713				     const struct testvec_config *cfg,
 714				     unsigned int alignmask,
 715				     unsigned int src_total_len,
 716				     unsigned int dst_total_len,
 717				     const struct kvec *inputs,
 718				     unsigned int nr_inputs)
 719{
 720	struct iov_iter input;
 721	int err;
 722
 723	iov_iter_kvec(&input, WRITE, inputs, nr_inputs, src_total_len);
 724	err = build_test_sglist(&tsgls->src, cfg->src_divs, alignmask,
 725				cfg->inplace ?
 726					max(dst_total_len, src_total_len) :
 727					src_total_len,
 728				&input, NULL);
 729	if (err)
 730		return err;
 731
 732	if (cfg->inplace) {
 733		tsgls->dst.sgl_ptr = tsgls->src.sgl;
 734		tsgls->dst.nents = tsgls->src.nents;
 735		return 0;
 736	}
 737	return build_test_sglist(&tsgls->dst,
 738				 cfg->dst_divs[0].proportion_of_total ?
 739					cfg->dst_divs : cfg->src_divs,
 740				 alignmask, dst_total_len, NULL, NULL);
 741}
 742
 743#ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
 744
 745/* Generate a random length in range [0, max_len], but prefer smaller values */
 746static unsigned int generate_random_length(unsigned int max_len)
 747{
 748	unsigned int len = prandom_u32() % (max_len + 1);
 749
 750	switch (prandom_u32() % 4) {
 751	case 0:
 752		return len % 64;
 753	case 1:
 754		return len % 256;
 755	case 2:
 756		return len % 1024;
 757	default:
 758		return len;
 759	}
 760}
 761
 762/* Sometimes make some random changes to the given data buffer */
 763static void mutate_buffer(u8 *buf, size_t count)
 764{
 765	size_t num_flips;
 766	size_t i;
 767	size_t pos;
 768
 769	/* Sometimes flip some bits */
 770	if (prandom_u32() % 4 == 0) {
 771		num_flips = min_t(size_t, 1 << (prandom_u32() % 8), count * 8);
 772		for (i = 0; i < num_flips; i++) {
 773			pos = prandom_u32() % (count * 8);
 774			buf[pos / 8] ^= 1 << (pos % 8);
 775		}
 776	}
 777
 778	/* Sometimes flip some bytes */
 779	if (prandom_u32() % 4 == 0) {
 780		num_flips = min_t(size_t, 1 << (prandom_u32() % 8), count);
 781		for (i = 0; i < num_flips; i++)
 782			buf[prandom_u32() % count] ^= 0xff;
 
 
 
 783	}
 784}
 785
 786/* Randomly generate 'count' bytes, but sometimes make them "interesting" */
 787static void generate_random_bytes(u8 *buf, size_t count)
 788{
 789	u8 b;
 790	u8 increment;
 791	size_t i;
 792
 793	if (count == 0)
 794		return;
 795
 796	switch (prandom_u32() % 8) { /* Choose a generation strategy */
 797	case 0:
 798	case 1:
 799		/* All the same byte, plus optional mutations */
 800		switch (prandom_u32() % 4) {
 801		case 0:
 802			b = 0x00;
 803			break;
 804		case 1:
 805			b = 0xff;
 806			break;
 807		default:
 808			b = (u8)prandom_u32();
 809			break;
 810		}
 811		memset(buf, b, count);
 812		mutate_buffer(buf, count);
 813		break;
 814	case 2:
 815		/* Ascending or descending bytes, plus optional mutations */
 816		increment = (u8)prandom_u32();
 817		b = (u8)prandom_u32();
 818		for (i = 0; i < count; i++, b += increment)
 819			buf[i] = b;
 820		mutate_buffer(buf, count);
 821		break;
 822	default:
 823		/* Fully random bytes */
 824		for (i = 0; i < count; i++)
 825			buf[i] = (u8)prandom_u32();
 826	}
 827}
 828
 829static char *generate_random_sgl_divisions(struct test_sg_division *divs,
 830					   size_t max_divs, char *p, char *end,
 831					   bool gen_flushes, u32 req_flags)
 832{
 833	struct test_sg_division *div = divs;
 834	unsigned int remaining = TEST_SG_TOTAL;
 835
 836	do {
 837		unsigned int this_len;
 838		const char *flushtype_str;
 
 
 
 
 
 
 
 
 
 
 
 
 839
 840		if (div == &divs[max_divs - 1] || prandom_u32() % 2 == 0)
 841			this_len = remaining;
 842		else
 843			this_len = 1 + (prandom_u32() % remaining);
 844		div->proportion_of_total = this_len;
 
 
 
 
 
 
 
 
 845
 846		if (prandom_u32() % 4 == 0)
 847			div->offset = (PAGE_SIZE - 128) + (prandom_u32() % 128);
 848		else if (prandom_u32() % 2 == 0)
 849			div->offset = prandom_u32() % 32;
 850		else
 851			div->offset = prandom_u32() % PAGE_SIZE;
 852		if (prandom_u32() % 8 == 0)
 853			div->offset_relative_to_alignmask = true;
 854
 855		div->flush_type = FLUSH_TYPE_NONE;
 856		if (gen_flushes) {
 857			switch (prandom_u32() % 4) {
 858			case 0:
 859				div->flush_type = FLUSH_TYPE_REIMPORT;
 860				break;
 861			case 1:
 862				div->flush_type = FLUSH_TYPE_FLUSH;
 863				break;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 864			}
 865		}
 866
 867		if (div->flush_type != FLUSH_TYPE_NONE &&
 868		    !(req_flags & CRYPTO_TFM_REQ_MAY_SLEEP) &&
 869		    prandom_u32() % 2 == 0)
 870			div->nosimd = true;
 871
 872		switch (div->flush_type) {
 873		case FLUSH_TYPE_FLUSH:
 874			if (div->nosimd)
 875				flushtype_str = "<flush,nosimd>";
 876			else
 877				flushtype_str = "<flush>";
 878			break;
 879		case FLUSH_TYPE_REIMPORT:
 880			if (div->nosimd)
 881				flushtype_str = "<reimport,nosimd>";
 882			else
 883				flushtype_str = "<reimport>";
 884			break;
 885		default:
 886			flushtype_str = "";
 887			break;
 888		}
 889
 890		BUILD_BUG_ON(TEST_SG_TOTAL != 10000); /* for "%u.%u%%" */
 891		p += scnprintf(p, end - p, "%s%u.%u%%@%s+%u%s", flushtype_str,
 892			       this_len / 100, this_len % 100,
 893			       div->offset_relative_to_alignmask ?
 894					"alignmask" : "",
 895			       div->offset, this_len == remaining ? "" : ", ");
 896		remaining -= this_len;
 897		div++;
 898	} while (remaining);
 899
 900	return p;
 901}
 902
 903/* Generate a random testvec_config for fuzz testing */
 904static void generate_random_testvec_config(struct testvec_config *cfg,
 905					   char *name, size_t max_namelen)
 906{
 907	char *p = name;
 908	char * const end = name + max_namelen;
 909
 910	memset(cfg, 0, sizeof(*cfg));
 911
 912	cfg->name = name;
 913
 914	p += scnprintf(p, end - p, "random:");
 915
 916	if (prandom_u32() % 2 == 0) {
 917		cfg->inplace = true;
 918		p += scnprintf(p, end - p, " inplace");
 919	}
 920
 921	if (prandom_u32() % 2 == 0) {
 922		cfg->req_flags |= CRYPTO_TFM_REQ_MAY_SLEEP;
 923		p += scnprintf(p, end - p, " may_sleep");
 924	}
 925
 926	switch (prandom_u32() % 4) {
 927	case 0:
 928		cfg->finalization_type = FINALIZATION_TYPE_FINAL;
 929		p += scnprintf(p, end - p, " use_final");
 930		break;
 931	case 1:
 932		cfg->finalization_type = FINALIZATION_TYPE_FINUP;
 933		p += scnprintf(p, end - p, " use_finup");
 934		break;
 935	default:
 936		cfg->finalization_type = FINALIZATION_TYPE_DIGEST;
 937		p += scnprintf(p, end - p, " use_digest");
 938		break;
 939	}
 940
 941	if (!(cfg->req_flags & CRYPTO_TFM_REQ_MAY_SLEEP) &&
 942	    prandom_u32() % 2 == 0) {
 943		cfg->nosimd = true;
 944		p += scnprintf(p, end - p, " nosimd");
 945	}
 946
 947	p += scnprintf(p, end - p, " src_divs=[");
 948	p = generate_random_sgl_divisions(cfg->src_divs,
 949					  ARRAY_SIZE(cfg->src_divs), p, end,
 950					  (cfg->finalization_type !=
 951					   FINALIZATION_TYPE_DIGEST),
 952					  cfg->req_flags);
 953	p += scnprintf(p, end - p, "]");
 954
 955	if (!cfg->inplace && prandom_u32() % 2 == 0) {
 956		p += scnprintf(p, end - p, " dst_divs=[");
 957		p = generate_random_sgl_divisions(cfg->dst_divs,
 958						  ARRAY_SIZE(cfg->dst_divs),
 959						  p, end, false,
 960						  cfg->req_flags);
 961		p += scnprintf(p, end - p, "]");
 962	}
 963
 964	if (prandom_u32() % 2 == 0) {
 965		cfg->iv_offset = 1 + (prandom_u32() % MAX_ALGAPI_ALIGNMASK);
 966		p += scnprintf(p, end - p, " iv_offset=%u", cfg->iv_offset);
 967	}
 968
 969	WARN_ON_ONCE(!valid_testvec_config(cfg));
 970}
 971
 972static void crypto_disable_simd_for_test(void)
 973{
 974	preempt_disable();
 975	__this_cpu_write(crypto_simd_disabled_for_test, true);
 976}
 977
 978static void crypto_reenable_simd_for_test(void)
 979{
 980	__this_cpu_write(crypto_simd_disabled_for_test, false);
 981	preempt_enable();
 982}
 983
 984/*
 985 * Given an algorithm name, build the name of the generic implementation of that
 986 * algorithm, assuming the usual naming convention.  Specifically, this appends
 987 * "-generic" to every part of the name that is not a template name.  Examples:
 988 *
 989 *	aes => aes-generic
 990 *	cbc(aes) => cbc(aes-generic)
 991 *	cts(cbc(aes)) => cts(cbc(aes-generic))
 992 *	rfc7539(chacha20,poly1305) => rfc7539(chacha20-generic,poly1305-generic)
 993 *
 994 * Return: 0 on success, or -ENAMETOOLONG if the generic name would be too long
 995 */
 996static int build_generic_driver_name(const char *algname,
 997				     char driver_name[CRYPTO_MAX_ALG_NAME])
 998{
 999	const char *in = algname;
1000	char *out = driver_name;
1001	size_t len = strlen(algname);
1002
1003	if (len >= CRYPTO_MAX_ALG_NAME)
1004		goto too_long;
1005	do {
1006		const char *in_saved = in;
1007
1008		while (*in && *in != '(' && *in != ')' && *in != ',')
1009			*out++ = *in++;
1010		if (*in != '(' && in > in_saved) {
1011			len += 8;
1012			if (len >= CRYPTO_MAX_ALG_NAME)
1013				goto too_long;
1014			memcpy(out, "-generic", 8);
1015			out += 8;
1016		}
1017	} while ((*out++ = *in++) != '\0');
1018	return 0;
1019
1020too_long:
1021	pr_err("alg: generic driver name for \"%s\" would be too long\n",
1022	       algname);
1023	return -ENAMETOOLONG;
1024}
1025#else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1026static void crypto_disable_simd_for_test(void)
1027{
1028}
1029
1030static void crypto_reenable_simd_for_test(void)
1031{
1032}
1033#endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1034
1035static int build_hash_sglist(struct test_sglist *tsgl,
1036			     const struct hash_testvec *vec,
1037			     const struct testvec_config *cfg,
1038			     unsigned int alignmask,
1039			     const struct test_sg_division *divs[XBUFSIZE])
1040{
1041	struct kvec kv;
1042	struct iov_iter input;
1043
1044	kv.iov_base = (void *)vec->plaintext;
1045	kv.iov_len = vec->psize;
1046	iov_iter_kvec(&input, WRITE, &kv, 1, vec->psize);
1047	return build_test_sglist(tsgl, cfg->src_divs, alignmask, vec->psize,
1048				 &input, divs);
1049}
1050
1051static int check_hash_result(const char *type,
1052			     const u8 *result, unsigned int digestsize,
1053			     const struct hash_testvec *vec,
1054			     const char *vec_name,
1055			     const char *driver,
1056			     const struct testvec_config *cfg)
1057{
1058	if (memcmp(result, vec->digest, digestsize) != 0) {
1059		pr_err("alg: %s: %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
1060		       type, driver, vec_name, cfg->name);
1061		return -EINVAL;
1062	}
1063	if (!testmgr_is_poison(&result[digestsize], TESTMGR_POISON_LEN)) {
1064		pr_err("alg: %s: %s overran result buffer on test vector %s, cfg=\"%s\"\n",
1065		       type, driver, vec_name, cfg->name);
1066		return -EOVERFLOW;
1067	}
1068	return 0;
1069}
1070
1071static inline int check_shash_op(const char *op, int err,
1072				 const char *driver, const char *vec_name,
1073				 const struct testvec_config *cfg)
1074{
1075	if (err)
1076		pr_err("alg: shash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n",
1077		       driver, op, err, vec_name, cfg->name);
1078	return err;
1079}
1080
1081static inline const void *sg_data(struct scatterlist *sg)
1082{
1083	return page_address(sg_page(sg)) + sg->offset;
1084}
1085
1086/* Test one hash test vector in one configuration, using the shash API */
1087static int test_shash_vec_cfg(const char *driver,
1088			      const struct hash_testvec *vec,
1089			      const char *vec_name,
1090			      const struct testvec_config *cfg,
1091			      struct shash_desc *desc,
1092			      struct test_sglist *tsgl,
1093			      u8 *hashstate)
1094{
1095	struct crypto_shash *tfm = desc->tfm;
1096	const unsigned int alignmask = crypto_shash_alignmask(tfm);
1097	const unsigned int digestsize = crypto_shash_digestsize(tfm);
1098	const unsigned int statesize = crypto_shash_statesize(tfm);
1099	const struct test_sg_division *divs[XBUFSIZE];
1100	unsigned int i;
1101	u8 result[HASH_MAX_DIGESTSIZE + TESTMGR_POISON_LEN];
1102	int err;
1103
1104	/* Set the key, if specified */
1105	if (vec->ksize) {
1106		err = crypto_shash_setkey(tfm, vec->key, vec->ksize);
1107		if (err) {
1108			if (err == vec->setkey_error)
1109				return 0;
1110			pr_err("alg: shash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
1111			       driver, vec_name, vec->setkey_error, err,
1112			       crypto_shash_get_flags(tfm));
1113			return err;
1114		}
1115		if (vec->setkey_error) {
1116			pr_err("alg: shash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
1117			       driver, vec_name, vec->setkey_error);
1118			return -EINVAL;
1119		}
1120	}
1121
1122	/* Build the scatterlist for the source data */
1123	err = build_hash_sglist(tsgl, vec, cfg, alignmask, divs);
1124	if (err) {
1125		pr_err("alg: shash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n",
1126		       driver, vec_name, cfg->name);
1127		return err;
1128	}
1129
1130	/* Do the actual hashing */
1131
1132	testmgr_poison(desc->__ctx, crypto_shash_descsize(tfm));
1133	testmgr_poison(result, digestsize + TESTMGR_POISON_LEN);
1134
1135	if (cfg->finalization_type == FINALIZATION_TYPE_DIGEST ||
1136	    vec->digest_error) {
1137		/* Just using digest() */
1138		if (tsgl->nents != 1)
1139			return 0;
1140		if (cfg->nosimd)
1141			crypto_disable_simd_for_test();
1142		err = crypto_shash_digest(desc, sg_data(&tsgl->sgl[0]),
1143					  tsgl->sgl[0].length, result);
1144		if (cfg->nosimd)
1145			crypto_reenable_simd_for_test();
1146		if (err) {
1147			if (err == vec->digest_error)
1148				return 0;
1149			pr_err("alg: shash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
1150			       driver, vec_name, vec->digest_error, err,
1151			       cfg->name);
1152			return err;
1153		}
1154		if (vec->digest_error) {
1155			pr_err("alg: shash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
1156			       driver, vec_name, vec->digest_error, cfg->name);
1157			return -EINVAL;
1158		}
1159		goto result_ready;
1160	}
1161
1162	/* Using init(), zero or more update(), then final() or finup() */
1163
1164	if (cfg->nosimd)
1165		crypto_disable_simd_for_test();
1166	err = crypto_shash_init(desc);
1167	if (cfg->nosimd)
1168		crypto_reenable_simd_for_test();
1169	err = check_shash_op("init", err, driver, vec_name, cfg);
1170	if (err)
1171		return err;
1172
1173	for (i = 0; i < tsgl->nents; i++) {
1174		if (i + 1 == tsgl->nents &&
1175		    cfg->finalization_type == FINALIZATION_TYPE_FINUP) {
1176			if (divs[i]->nosimd)
1177				crypto_disable_simd_for_test();
1178			err = crypto_shash_finup(desc, sg_data(&tsgl->sgl[i]),
1179						 tsgl->sgl[i].length, result);
1180			if (divs[i]->nosimd)
1181				crypto_reenable_simd_for_test();
1182			err = check_shash_op("finup", err, driver, vec_name,
1183					     cfg);
1184			if (err)
1185				return err;
1186			goto result_ready;
1187		}
1188		if (divs[i]->nosimd)
1189			crypto_disable_simd_for_test();
1190		err = crypto_shash_update(desc, sg_data(&tsgl->sgl[i]),
1191					  tsgl->sgl[i].length);
1192		if (divs[i]->nosimd)
1193			crypto_reenable_simd_for_test();
1194		err = check_shash_op("update", err, driver, vec_name, cfg);
1195		if (err)
1196			return err;
1197		if (divs[i]->flush_type == FLUSH_TYPE_REIMPORT) {
1198			/* Test ->export() and ->import() */
1199			testmgr_poison(hashstate + statesize,
1200				       TESTMGR_POISON_LEN);
1201			err = crypto_shash_export(desc, hashstate);
1202			err = check_shash_op("export", err, driver, vec_name,
1203					     cfg);
1204			if (err)
1205				return err;
1206			if (!testmgr_is_poison(hashstate + statesize,
1207					       TESTMGR_POISON_LEN)) {
1208				pr_err("alg: shash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n",
1209				       driver, vec_name, cfg->name);
1210				return -EOVERFLOW;
1211			}
1212			testmgr_poison(desc->__ctx, crypto_shash_descsize(tfm));
1213			err = crypto_shash_import(desc, hashstate);
1214			err = check_shash_op("import", err, driver, vec_name,
1215					     cfg);
1216			if (err)
1217				return err;
1218		}
1219	}
1220
1221	if (cfg->nosimd)
1222		crypto_disable_simd_for_test();
1223	err = crypto_shash_final(desc, result);
1224	if (cfg->nosimd)
1225		crypto_reenable_simd_for_test();
1226	err = check_shash_op("final", err, driver, vec_name, cfg);
1227	if (err)
1228		return err;
1229result_ready:
1230	return check_hash_result("shash", result, digestsize, vec, vec_name,
1231				 driver, cfg);
1232}
1233
1234static int do_ahash_op(int (*op)(struct ahash_request *req),
1235		       struct ahash_request *req,
1236		       struct crypto_wait *wait, bool nosimd)
1237{
1238	int err;
1239
1240	if (nosimd)
1241		crypto_disable_simd_for_test();
1242
1243	err = op(req);
1244
1245	if (nosimd)
1246		crypto_reenable_simd_for_test();
1247
1248	return crypto_wait_req(err, wait);
1249}
1250
1251static int check_nonfinal_ahash_op(const char *op, int err,
1252				   u8 *result, unsigned int digestsize,
1253				   const char *driver, const char *vec_name,
1254				   const struct testvec_config *cfg)
1255{
1256	if (err) {
1257		pr_err("alg: ahash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n",
1258		       driver, op, err, vec_name, cfg->name);
1259		return err;
1260	}
1261	if (!testmgr_is_poison(result, digestsize)) {
1262		pr_err("alg: ahash: %s %s() used result buffer on test vector %s, cfg=\"%s\"\n",
1263		       driver, op, vec_name, cfg->name);
1264		return -EINVAL;
1265	}
1266	return 0;
1267}
1268
1269/* Test one hash test vector in one configuration, using the ahash API */
1270static int test_ahash_vec_cfg(const char *driver,
1271			      const struct hash_testvec *vec,
1272			      const char *vec_name,
1273			      const struct testvec_config *cfg,
1274			      struct ahash_request *req,
1275			      struct test_sglist *tsgl,
1276			      u8 *hashstate)
1277{
1278	struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
1279	const unsigned int alignmask = crypto_ahash_alignmask(tfm);
1280	const unsigned int digestsize = crypto_ahash_digestsize(tfm);
1281	const unsigned int statesize = crypto_ahash_statesize(tfm);
1282	const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
1283	const struct test_sg_division *divs[XBUFSIZE];
1284	DECLARE_CRYPTO_WAIT(wait);
1285	unsigned int i;
1286	struct scatterlist *pending_sgl;
1287	unsigned int pending_len;
1288	u8 result[HASH_MAX_DIGESTSIZE + TESTMGR_POISON_LEN];
1289	int err;
1290
1291	/* Set the key, if specified */
1292	if (vec->ksize) {
1293		err = crypto_ahash_setkey(tfm, vec->key, vec->ksize);
1294		if (err) {
1295			if (err == vec->setkey_error)
1296				return 0;
1297			pr_err("alg: ahash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
1298			       driver, vec_name, vec->setkey_error, err,
1299			       crypto_ahash_get_flags(tfm));
1300			return err;
1301		}
1302		if (vec->setkey_error) {
1303			pr_err("alg: ahash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
1304			       driver, vec_name, vec->setkey_error);
1305			return -EINVAL;
1306		}
1307	}
1308
1309	/* Build the scatterlist for the source data */
1310	err = build_hash_sglist(tsgl, vec, cfg, alignmask, divs);
1311	if (err) {
1312		pr_err("alg: ahash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n",
1313		       driver, vec_name, cfg->name);
1314		return err;
1315	}
1316
1317	/* Do the actual hashing */
1318
1319	testmgr_poison(req->__ctx, crypto_ahash_reqsize(tfm));
1320	testmgr_poison(result, digestsize + TESTMGR_POISON_LEN);
1321
1322	if (cfg->finalization_type == FINALIZATION_TYPE_DIGEST ||
1323	    vec->digest_error) {
1324		/* Just using digest() */
1325		ahash_request_set_callback(req, req_flags, crypto_req_done,
1326					   &wait);
1327		ahash_request_set_crypt(req, tsgl->sgl, result, vec->psize);
1328		err = do_ahash_op(crypto_ahash_digest, req, &wait, cfg->nosimd);
1329		if (err) {
1330			if (err == vec->digest_error)
1331				return 0;
1332			pr_err("alg: ahash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
1333			       driver, vec_name, vec->digest_error, err,
1334			       cfg->name);
1335			return err;
1336		}
1337		if (vec->digest_error) {
1338			pr_err("alg: ahash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
1339			       driver, vec_name, vec->digest_error, cfg->name);
1340			return -EINVAL;
1341		}
1342		goto result_ready;
1343	}
1344
1345	/* Using init(), zero or more update(), then final() or finup() */
1346
1347	ahash_request_set_callback(req, req_flags, crypto_req_done, &wait);
1348	ahash_request_set_crypt(req, NULL, result, 0);
1349	err = do_ahash_op(crypto_ahash_init, req, &wait, cfg->nosimd);
1350	err = check_nonfinal_ahash_op("init", err, result, digestsize,
1351				      driver, vec_name, cfg);
1352	if (err)
1353		return err;
1354
1355	pending_sgl = NULL;
1356	pending_len = 0;
1357	for (i = 0; i < tsgl->nents; i++) {
1358		if (divs[i]->flush_type != FLUSH_TYPE_NONE &&
1359		    pending_sgl != NULL) {
1360			/* update() with the pending data */
1361			ahash_request_set_callback(req, req_flags,
1362						   crypto_req_done, &wait);
1363			ahash_request_set_crypt(req, pending_sgl, result,
1364						pending_len);
1365			err = do_ahash_op(crypto_ahash_update, req, &wait,
1366					  divs[i]->nosimd);
1367			err = check_nonfinal_ahash_op("update", err,
1368						      result, digestsize,
1369						      driver, vec_name, cfg);
1370			if (err)
1371				return err;
1372			pending_sgl = NULL;
1373			pending_len = 0;
1374		}
1375		if (divs[i]->flush_type == FLUSH_TYPE_REIMPORT) {
1376			/* Test ->export() and ->import() */
1377			testmgr_poison(hashstate + statesize,
1378				       TESTMGR_POISON_LEN);
1379			err = crypto_ahash_export(req, hashstate);
1380			err = check_nonfinal_ahash_op("export", err,
1381						      result, digestsize,
1382						      driver, vec_name, cfg);
1383			if (err)
1384				return err;
1385			if (!testmgr_is_poison(hashstate + statesize,
1386					       TESTMGR_POISON_LEN)) {
1387				pr_err("alg: ahash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n",
1388				       driver, vec_name, cfg->name);
1389				return -EOVERFLOW;
1390			}
1391
1392			testmgr_poison(req->__ctx, crypto_ahash_reqsize(tfm));
1393			err = crypto_ahash_import(req, hashstate);
1394			err = check_nonfinal_ahash_op("import", err,
1395						      result, digestsize,
1396						      driver, vec_name, cfg);
1397			if (err)
1398				return err;
1399		}
1400		if (pending_sgl == NULL)
1401			pending_sgl = &tsgl->sgl[i];
1402		pending_len += tsgl->sgl[i].length;
1403	}
1404
1405	ahash_request_set_callback(req, req_flags, crypto_req_done, &wait);
1406	ahash_request_set_crypt(req, pending_sgl, result, pending_len);
1407	if (cfg->finalization_type == FINALIZATION_TYPE_FINAL) {
1408		/* finish with update() and final() */
1409		err = do_ahash_op(crypto_ahash_update, req, &wait, cfg->nosimd);
1410		err = check_nonfinal_ahash_op("update", err, result, digestsize,
1411					      driver, vec_name, cfg);
1412		if (err)
1413			return err;
1414		err = do_ahash_op(crypto_ahash_final, req, &wait, cfg->nosimd);
1415		if (err) {
1416			pr_err("alg: ahash: %s final() failed with err %d on test vector %s, cfg=\"%s\"\n",
1417			       driver, err, vec_name, cfg->name);
1418			return err;
1419		}
1420	} else {
1421		/* finish with finup() */
1422		err = do_ahash_op(crypto_ahash_finup, req, &wait, cfg->nosimd);
1423		if (err) {
1424			pr_err("alg: ahash: %s finup() failed with err %d on test vector %s, cfg=\"%s\"\n",
1425			       driver, err, vec_name, cfg->name);
1426			return err;
1427		}
1428	}
1429
1430result_ready:
1431	return check_hash_result("ahash", result, digestsize, vec, vec_name,
1432				 driver, cfg);
 
 
 
1433}
1434
1435static int test_hash_vec_cfg(const char *driver,
1436			     const struct hash_testvec *vec,
1437			     const char *vec_name,
1438			     const struct testvec_config *cfg,
1439			     struct ahash_request *req,
1440			     struct shash_desc *desc,
1441			     struct test_sglist *tsgl,
1442			     u8 *hashstate)
1443{
1444	int err;
1445
1446	/*
1447	 * For algorithms implemented as "shash", most bugs will be detected by
1448	 * both the shash and ahash tests.  Test the shash API first so that the
1449	 * failures involve less indirection, so are easier to debug.
1450	 */
1451
1452	if (desc) {
1453		err = test_shash_vec_cfg(driver, vec, vec_name, cfg, desc, tsgl,
1454					 hashstate);
1455		if (err)
1456			return err;
1457	}
1458
1459	return test_ahash_vec_cfg(driver, vec, vec_name, cfg, req, tsgl,
1460				  hashstate);
1461}
1462
1463static int test_hash_vec(const char *driver, const struct hash_testvec *vec,
1464			 unsigned int vec_num, struct ahash_request *req,
1465			 struct shash_desc *desc, struct test_sglist *tsgl,
1466			 u8 *hashstate)
1467{
1468	char vec_name[16];
1469	unsigned int i;
1470	int err;
1471
1472	sprintf(vec_name, "%u", vec_num);
 
 
 
1473
1474	for (i = 0; i < ARRAY_SIZE(default_hash_testvec_configs); i++) {
1475		err = test_hash_vec_cfg(driver, vec, vec_name,
1476					&default_hash_testvec_configs[i],
1477					req, desc, tsgl, hashstate);
1478		if (err)
1479			return err;
 
1480	}
1481
1482#ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
1483	if (!noextratests) {
1484		struct testvec_config cfg;
1485		char cfgname[TESTVEC_CONFIG_NAMELEN];
1486
1487		for (i = 0; i < fuzz_iterations; i++) {
1488			generate_random_testvec_config(&cfg, cfgname,
1489						       sizeof(cfgname));
1490			err = test_hash_vec_cfg(driver, vec, vec_name, &cfg,
1491						req, desc, tsgl, hashstate);
1492			if (err)
1493				return err;
1494			cond_resched();
1495		}
1496	}
1497#endif
1498	return 0;
1499}
1500
1501#ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
1502/*
1503 * Generate a hash test vector from the given implementation.
1504 * Assumes the buffers in 'vec' were already allocated.
1505 */
1506static void generate_random_hash_testvec(struct shash_desc *desc,
1507					 struct hash_testvec *vec,
1508					 unsigned int maxkeysize,
1509					 unsigned int maxdatasize,
1510					 char *name, size_t max_namelen)
1511{
1512	/* Data */
1513	vec->psize = generate_random_length(maxdatasize);
1514	generate_random_bytes((u8 *)vec->plaintext, vec->psize);
1515
1516	/*
1517	 * Key: length in range [1, maxkeysize], but usually choose maxkeysize.
1518	 * If algorithm is unkeyed, then maxkeysize == 0 and set ksize = 0.
1519	 */
1520	vec->setkey_error = 0;
1521	vec->ksize = 0;
1522	if (maxkeysize) {
1523		vec->ksize = maxkeysize;
1524		if (prandom_u32() % 4 == 0)
1525			vec->ksize = 1 + (prandom_u32() % maxkeysize);
1526		generate_random_bytes((u8 *)vec->key, vec->ksize);
1527
1528		vec->setkey_error = crypto_shash_setkey(desc->tfm, vec->key,
1529							vec->ksize);
1530		/* If the key couldn't be set, no need to continue to digest. */
1531		if (vec->setkey_error)
1532			goto done;
1533	}
1534
1535	/* Digest */
1536	vec->digest_error = crypto_shash_digest(desc, vec->plaintext,
1537						vec->psize, (u8 *)vec->digest);
1538done:
1539	snprintf(name, max_namelen, "\"random: psize=%u ksize=%u\"",
1540		 vec->psize, vec->ksize);
1541}
1542
1543/*
1544 * Test the hash algorithm represented by @req against the corresponding generic
1545 * implementation, if one is available.
1546 */
1547static int test_hash_vs_generic_impl(const char *driver,
1548				     const char *generic_driver,
1549				     unsigned int maxkeysize,
1550				     struct ahash_request *req,
1551				     struct shash_desc *desc,
1552				     struct test_sglist *tsgl,
1553				     u8 *hashstate)
1554{
1555	struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
1556	const unsigned int digestsize = crypto_ahash_digestsize(tfm);
1557	const unsigned int blocksize = crypto_ahash_blocksize(tfm);
1558	const unsigned int maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN;
1559	const char *algname = crypto_hash_alg_common(tfm)->base.cra_name;
1560	char _generic_driver[CRYPTO_MAX_ALG_NAME];
1561	struct crypto_shash *generic_tfm = NULL;
1562	struct shash_desc *generic_desc = NULL;
1563	unsigned int i;
1564	struct hash_testvec vec = { 0 };
1565	char vec_name[64];
1566	struct testvec_config *cfg;
1567	char cfgname[TESTVEC_CONFIG_NAMELEN];
1568	int err;
1569
1570	if (noextratests)
1571		return 0;
1572
1573	if (!generic_driver) { /* Use default naming convention? */
1574		err = build_generic_driver_name(algname, _generic_driver);
1575		if (err)
1576			return err;
1577		generic_driver = _generic_driver;
1578	}
1579
1580	if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */
1581		return 0;
1582
1583	generic_tfm = crypto_alloc_shash(generic_driver, 0, 0);
1584	if (IS_ERR(generic_tfm)) {
1585		err = PTR_ERR(generic_tfm);
1586		if (err == -ENOENT) {
1587			pr_warn("alg: hash: skipping comparison tests for %s because %s is unavailable\n",
1588				driver, generic_driver);
1589			return 0;
1590		}
1591		pr_err("alg: hash: error allocating %s (generic impl of %s): %d\n",
1592		       generic_driver, algname, err);
1593		return err;
1594	}
1595
1596	cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
1597	if (!cfg) {
1598		err = -ENOMEM;
1599		goto out;
1600	}
 
 
 
 
 
 
 
 
 
1601
1602	generic_desc = kzalloc(sizeof(*desc) +
1603			       crypto_shash_descsize(generic_tfm), GFP_KERNEL);
1604	if (!generic_desc) {
1605		err = -ENOMEM;
1606		goto out;
1607	}
1608	generic_desc->tfm = generic_tfm;
1609
1610	/* Check the algorithm properties for consistency. */
 
 
 
1611
1612	if (digestsize != crypto_shash_digestsize(generic_tfm)) {
1613		pr_err("alg: hash: digestsize for %s (%u) doesn't match generic impl (%u)\n",
1614		       driver, digestsize,
1615		       crypto_shash_digestsize(generic_tfm));
1616		err = -EINVAL;
1617		goto out;
1618	}
1619
1620	if (blocksize != crypto_shash_blocksize(generic_tfm)) {
1621		pr_err("alg: hash: blocksize for %s (%u) doesn't match generic impl (%u)\n",
1622		       driver, blocksize, crypto_shash_blocksize(generic_tfm));
1623		err = -EINVAL;
1624		goto out;
1625	}
1626
1627	/*
1628	 * Now generate test vectors using the generic implementation, and test
1629	 * the other implementation against them.
1630	 */
1631
1632	vec.key = kmalloc(maxkeysize, GFP_KERNEL);
1633	vec.plaintext = kmalloc(maxdatasize, GFP_KERNEL);
1634	vec.digest = kmalloc(digestsize, GFP_KERNEL);
1635	if (!vec.key || !vec.plaintext || !vec.digest) {
1636		err = -ENOMEM;
1637		goto out;
1638	}
1639
1640	for (i = 0; i < fuzz_iterations * 8; i++) {
1641		generate_random_hash_testvec(generic_desc, &vec,
1642					     maxkeysize, maxdatasize,
1643					     vec_name, sizeof(vec_name));
1644		generate_random_testvec_config(cfg, cfgname, sizeof(cfgname));
1645
1646		err = test_hash_vec_cfg(driver, &vec, vec_name, cfg,
1647					req, desc, tsgl, hashstate);
1648		if (err)
1649			goto out;
1650		cond_resched();
1651	}
1652	err = 0;
1653out:
1654	kfree(cfg);
1655	kfree(vec.key);
1656	kfree(vec.plaintext);
1657	kfree(vec.digest);
1658	crypto_free_shash(generic_tfm);
1659	kzfree(generic_desc);
1660	return err;
1661}
1662#else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1663static int test_hash_vs_generic_impl(const char *driver,
1664				     const char *generic_driver,
1665				     unsigned int maxkeysize,
1666				     struct ahash_request *req,
1667				     struct shash_desc *desc,
1668				     struct test_sglist *tsgl,
1669				     u8 *hashstate)
1670{
1671	return 0;
1672}
1673#endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1674
1675static int alloc_shash(const char *driver, u32 type, u32 mask,
1676		       struct crypto_shash **tfm_ret,
1677		       struct shash_desc **desc_ret)
1678{
1679	struct crypto_shash *tfm;
1680	struct shash_desc *desc;
1681
1682	tfm = crypto_alloc_shash(driver, type, mask);
1683	if (IS_ERR(tfm)) {
1684		if (PTR_ERR(tfm) == -ENOENT) {
1685			/*
1686			 * This algorithm is only available through the ahash
1687			 * API, not the shash API, so skip the shash tests.
1688			 */
1689			return 0;
1690		}
1691		pr_err("alg: hash: failed to allocate shash transform for %s: %ld\n",
1692		       driver, PTR_ERR(tfm));
1693		return PTR_ERR(tfm);
1694	}
1695
1696	desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(tfm), GFP_KERNEL);
1697	if (!desc) {
1698		crypto_free_shash(tfm);
1699		return -ENOMEM;
1700	}
1701	desc->tfm = tfm;
1702
1703	*tfm_ret = tfm;
1704	*desc_ret = desc;
1705	return 0;
1706}
1707
1708static int __alg_test_hash(const struct hash_testvec *vecs,
1709			   unsigned int num_vecs, const char *driver,
1710			   u32 type, u32 mask,
1711			   const char *generic_driver, unsigned int maxkeysize)
1712{
1713	struct crypto_ahash *atfm = NULL;
1714	struct ahash_request *req = NULL;
1715	struct crypto_shash *stfm = NULL;
1716	struct shash_desc *desc = NULL;
1717	struct test_sglist *tsgl = NULL;
1718	u8 *hashstate = NULL;
1719	unsigned int statesize;
1720	unsigned int i;
1721	int err;
1722
1723	/*
1724	 * Always test the ahash API.  This works regardless of whether the
1725	 * algorithm is implemented as ahash or shash.
1726	 */
1727
1728	atfm = crypto_alloc_ahash(driver, type, mask);
1729	if (IS_ERR(atfm)) {
1730		pr_err("alg: hash: failed to allocate transform for %s: %ld\n",
1731		       driver, PTR_ERR(atfm));
1732		return PTR_ERR(atfm);
1733	}
 
 
 
 
1734
1735	req = ahash_request_alloc(atfm, GFP_KERNEL);
1736	if (!req) {
1737		pr_err("alg: hash: failed to allocate request for %s\n",
1738		       driver);
1739		err = -ENOMEM;
1740		goto out;
1741	}
1742
1743	/*
1744	 * If available also test the shash API, to cover corner cases that may
1745	 * be missed by testing the ahash API only.
1746	 */
1747	err = alloc_shash(driver, type, mask, &stfm, &desc);
1748	if (err)
1749		goto out;
 
 
 
 
 
1750
1751	tsgl = kmalloc(sizeof(*tsgl), GFP_KERNEL);
1752	if (!tsgl || init_test_sglist(tsgl) != 0) {
1753		pr_err("alg: hash: failed to allocate test buffers for %s\n",
1754		       driver);
1755		kfree(tsgl);
1756		tsgl = NULL;
1757		err = -ENOMEM;
1758		goto out;
1759	}
1760
1761	statesize = crypto_ahash_statesize(atfm);
1762	if (stfm)
1763		statesize = max(statesize, crypto_shash_statesize(stfm));
1764	hashstate = kmalloc(statesize + TESTMGR_POISON_LEN, GFP_KERNEL);
1765	if (!hashstate) {
1766		pr_err("alg: hash: failed to allocate hash state buffer for %s\n",
1767		       driver);
1768		err = -ENOMEM;
1769		goto out;
1770	}
1771
1772	for (i = 0; i < num_vecs; i++) {
1773		err = test_hash_vec(driver, &vecs[i], i, req, desc, tsgl,
1774				    hashstate);
1775		if (err)
1776			goto out;
1777		cond_resched();
1778	}
1779	err = test_hash_vs_generic_impl(driver, generic_driver, maxkeysize, req,
1780					desc, tsgl, hashstate);
1781out:
1782	kfree(hashstate);
1783	if (tsgl) {
1784		destroy_test_sglist(tsgl);
1785		kfree(tsgl);
1786	}
1787	kfree(desc);
1788	crypto_free_shash(stfm);
1789	ahash_request_free(req);
1790	crypto_free_ahash(atfm);
1791	return err;
1792}
1793
1794static int alg_test_hash(const struct alg_test_desc *desc, const char *driver,
1795			 u32 type, u32 mask)
1796{
1797	const struct hash_testvec *template = desc->suite.hash.vecs;
1798	unsigned int tcount = desc->suite.hash.count;
1799	unsigned int nr_unkeyed, nr_keyed;
1800	unsigned int maxkeysize = 0;
1801	int err;
1802
1803	/*
1804	 * For OPTIONAL_KEY algorithms, we have to do all the unkeyed tests
1805	 * first, before setting a key on the tfm.  To make this easier, we
1806	 * require that the unkeyed test vectors (if any) are listed first.
1807	 */
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1808
1809	for (nr_unkeyed = 0; nr_unkeyed < tcount; nr_unkeyed++) {
1810		if (template[nr_unkeyed].ksize)
1811			break;
1812	}
1813	for (nr_keyed = 0; nr_unkeyed + nr_keyed < tcount; nr_keyed++) {
1814		if (!template[nr_unkeyed + nr_keyed].ksize) {
1815			pr_err("alg: hash: test vectors for %s out of order, "
1816			       "unkeyed ones must come first\n", desc->alg);
1817			return -EINVAL;
1818		}
1819		maxkeysize = max_t(unsigned int, maxkeysize,
1820				   template[nr_unkeyed + nr_keyed].ksize);
1821	}
1822
1823	err = 0;
1824	if (nr_unkeyed) {
1825		err = __alg_test_hash(template, nr_unkeyed, driver, type, mask,
1826				      desc->generic_driver, maxkeysize);
1827		template += nr_unkeyed;
1828	}
1829
1830	if (!err && nr_keyed)
1831		err = __alg_test_hash(template, nr_keyed, driver, type, mask,
1832				      desc->generic_driver, maxkeysize);
1833
1834	return err;
1835}
1836
1837static int test_aead_vec_cfg(const char *driver, int enc,
1838			     const struct aead_testvec *vec,
1839			     const char *vec_name,
1840			     const struct testvec_config *cfg,
1841			     struct aead_request *req,
1842			     struct cipher_test_sglists *tsgls)
1843{
1844	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
1845	const unsigned int alignmask = crypto_aead_alignmask(tfm);
1846	const unsigned int ivsize = crypto_aead_ivsize(tfm);
1847	const unsigned int authsize = vec->clen - vec->plen;
1848	const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
1849	const char *op = enc ? "encryption" : "decryption";
1850	DECLARE_CRYPTO_WAIT(wait);
1851	u8 _iv[3 * (MAX_ALGAPI_ALIGNMASK + 1) + MAX_IVLEN];
1852	u8 *iv = PTR_ALIGN(&_iv[0], 2 * (MAX_ALGAPI_ALIGNMASK + 1)) +
1853		 cfg->iv_offset +
1854		 (cfg->iv_offset_relative_to_alignmask ? alignmask : 0);
1855	struct kvec input[2];
1856	int expected_error;
1857	int err;
1858
1859	/* Set the key */
1860	if (vec->wk)
1861		crypto_aead_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
1862	else
1863		crypto_aead_clear_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
1864	err = crypto_aead_setkey(tfm, vec->key, vec->klen);
1865	if (err && err != vec->setkey_error) {
1866		pr_err("alg: aead: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
1867		       driver, vec_name, vec->setkey_error, err,
1868		       crypto_aead_get_flags(tfm));
1869		return err;
1870	}
1871	if (!err && vec->setkey_error) {
1872		pr_err("alg: aead: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
1873		       driver, vec_name, vec->setkey_error);
1874		return -EINVAL;
1875	}
1876
1877	/* Set the authentication tag size */
1878	err = crypto_aead_setauthsize(tfm, authsize);
1879	if (err && err != vec->setauthsize_error) {
1880		pr_err("alg: aead: %s setauthsize failed on test vector %s; expected_error=%d, actual_error=%d\n",
1881		       driver, vec_name, vec->setauthsize_error, err);
1882		return err;
1883	}
1884	if (!err && vec->setauthsize_error) {
1885		pr_err("alg: aead: %s setauthsize unexpectedly succeeded on test vector %s; expected_error=%d\n",
1886		       driver, vec_name, vec->setauthsize_error);
1887		return -EINVAL;
1888	}
 
1889
1890	if (vec->setkey_error || vec->setauthsize_error)
1891		return 0;
1892
1893	/* The IV must be copied to a buffer, as the algorithm may modify it */
1894	if (WARN_ON(ivsize > MAX_IVLEN))
1895		return -EINVAL;
1896	if (vec->iv)
1897		memcpy(iv, vec->iv, ivsize);
1898	else
1899		memset(iv, 0, ivsize);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1900
1901	/* Build the src/dst scatterlists */
1902	input[0].iov_base = (void *)vec->assoc;
1903	input[0].iov_len = vec->alen;
1904	input[1].iov_base = enc ? (void *)vec->ptext : (void *)vec->ctext;
1905	input[1].iov_len = enc ? vec->plen : vec->clen;
1906	err = build_cipher_test_sglists(tsgls, cfg, alignmask,
1907					vec->alen + (enc ? vec->plen :
1908						     vec->clen),
1909					vec->alen + (enc ? vec->clen :
1910						     vec->plen),
1911					input, 2);
1912	if (err) {
1913		pr_err("alg: aead: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n",
1914		       driver, op, vec_name, cfg->name);
1915		return err;
1916	}
1917
1918	/* Do the actual encryption or decryption */
1919	testmgr_poison(req->__ctx, crypto_aead_reqsize(tfm));
1920	aead_request_set_callback(req, req_flags, crypto_req_done, &wait);
1921	aead_request_set_crypt(req, tsgls->src.sgl_ptr, tsgls->dst.sgl_ptr,
1922			       enc ? vec->plen : vec->clen, iv);
1923	aead_request_set_ad(req, vec->alen);
1924	if (cfg->nosimd)
1925		crypto_disable_simd_for_test();
1926	err = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);
1927	if (cfg->nosimd)
1928		crypto_reenable_simd_for_test();
1929	err = crypto_wait_req(err, &wait);
1930
1931	/* Check that the algorithm didn't overwrite things it shouldn't have */
1932	if (req->cryptlen != (enc ? vec->plen : vec->clen) ||
1933	    req->assoclen != vec->alen ||
1934	    req->iv != iv ||
1935	    req->src != tsgls->src.sgl_ptr ||
1936	    req->dst != tsgls->dst.sgl_ptr ||
1937	    crypto_aead_reqtfm(req) != tfm ||
1938	    req->base.complete != crypto_req_done ||
1939	    req->base.flags != req_flags ||
1940	    req->base.data != &wait) {
1941		pr_err("alg: aead: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n",
1942		       driver, op, vec_name, cfg->name);
1943		if (req->cryptlen != (enc ? vec->plen : vec->clen))
1944			pr_err("alg: aead: changed 'req->cryptlen'\n");
1945		if (req->assoclen != vec->alen)
1946			pr_err("alg: aead: changed 'req->assoclen'\n");
1947		if (req->iv != iv)
1948			pr_err("alg: aead: changed 'req->iv'\n");
1949		if (req->src != tsgls->src.sgl_ptr)
1950			pr_err("alg: aead: changed 'req->src'\n");
1951		if (req->dst != tsgls->dst.sgl_ptr)
1952			pr_err("alg: aead: changed 'req->dst'\n");
1953		if (crypto_aead_reqtfm(req) != tfm)
1954			pr_err("alg: aead: changed 'req->base.tfm'\n");
1955		if (req->base.complete != crypto_req_done)
1956			pr_err("alg: aead: changed 'req->base.complete'\n");
1957		if (req->base.flags != req_flags)
1958			pr_err("alg: aead: changed 'req->base.flags'\n");
1959		if (req->base.data != &wait)
1960			pr_err("alg: aead: changed 'req->base.data'\n");
1961		return -EINVAL;
1962	}
1963	if (is_test_sglist_corrupted(&tsgls->src)) {
1964		pr_err("alg: aead: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n",
1965		       driver, op, vec_name, cfg->name);
1966		return -EINVAL;
1967	}
1968	if (tsgls->dst.sgl_ptr != tsgls->src.sgl &&
1969	    is_test_sglist_corrupted(&tsgls->dst)) {
1970		pr_err("alg: aead: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n",
1971		       driver, op, vec_name, cfg->name);
1972		return -EINVAL;
1973	}
1974
1975	/* Check for success or failure */
1976	expected_error = vec->novrfy ? -EBADMSG : vec->crypt_error;
1977	if (err) {
1978		if (err == expected_error)
1979			return 0;
1980		pr_err("alg: aead: %s %s failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
1981		       driver, op, vec_name, expected_error, err, cfg->name);
1982		return err;
1983	}
1984	if (expected_error) {
1985		pr_err("alg: aead: %s %s unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
1986		       driver, op, vec_name, expected_error, cfg->name);
1987		return -EINVAL;
1988	}
1989
1990	/* Check for the correct output (ciphertext or plaintext) */
1991	err = verify_correct_output(&tsgls->dst, enc ? vec->ctext : vec->ptext,
1992				    enc ? vec->clen : vec->plen,
1993				    vec->alen, enc || !cfg->inplace);
1994	if (err == -EOVERFLOW) {
1995		pr_err("alg: aead: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n",
1996		       driver, op, vec_name, cfg->name);
1997		return err;
1998	}
1999	if (err) {
2000		pr_err("alg: aead: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
2001		       driver, op, vec_name, cfg->name);
2002		return err;
2003	}
2004
2005	return 0;
2006}
 
2007
2008static int test_aead_vec(const char *driver, int enc,
2009			 const struct aead_testvec *vec, unsigned int vec_num,
2010			 struct aead_request *req,
2011			 struct cipher_test_sglists *tsgls)
2012{
2013	char vec_name[16];
2014	unsigned int i;
2015	int err;
2016
2017	if (enc && vec->novrfy)
2018		return 0;
 
2019
2020	sprintf(vec_name, "%u", vec_num);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2021
2022	for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) {
2023		err = test_aead_vec_cfg(driver, enc, vec, vec_name,
2024					&default_cipher_testvec_configs[i],
2025					req, tsgls);
2026		if (err)
2027			return err;
2028	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2029
2030#ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2031	if (!noextratests) {
2032		struct testvec_config cfg;
2033		char cfgname[TESTVEC_CONFIG_NAMELEN];
2034
2035		for (i = 0; i < fuzz_iterations; i++) {
2036			generate_random_testvec_config(&cfg, cfgname,
2037						       sizeof(cfgname));
2038			err = test_aead_vec_cfg(driver, enc, vec, vec_name,
2039						&cfg, req, tsgls);
2040			if (err)
2041				return err;
2042			cond_resched();
2043		}
2044	}
2045#endif
2046	return 0;
2047}
2048
2049#ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2050/*
2051 * Generate an AEAD test vector from the given implementation.
2052 * Assumes the buffers in 'vec' were already allocated.
2053 */
2054static void generate_random_aead_testvec(struct aead_request *req,
2055					 struct aead_testvec *vec,
2056					 unsigned int maxkeysize,
2057					 unsigned int maxdatasize,
2058					 char *name, size_t max_namelen)
2059{
2060	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
2061	const unsigned int ivsize = crypto_aead_ivsize(tfm);
2062	unsigned int maxauthsize = crypto_aead_alg(tfm)->maxauthsize;
2063	unsigned int authsize;
2064	unsigned int total_len;
2065	int i;
2066	struct scatterlist src[2], dst;
2067	u8 iv[MAX_IVLEN];
2068	DECLARE_CRYPTO_WAIT(wait);
2069
2070	/* Key: length in [0, maxkeysize], but usually choose maxkeysize */
2071	vec->klen = maxkeysize;
2072	if (prandom_u32() % 4 == 0)
2073		vec->klen = prandom_u32() % (maxkeysize + 1);
2074	generate_random_bytes((u8 *)vec->key, vec->klen);
2075	vec->setkey_error = crypto_aead_setkey(tfm, vec->key, vec->klen);
2076
2077	/* IV */
2078	generate_random_bytes((u8 *)vec->iv, ivsize);
2079
2080	/* Tag length: in [0, maxauthsize], but usually choose maxauthsize */
2081	authsize = maxauthsize;
2082	if (prandom_u32() % 4 == 0)
2083		authsize = prandom_u32() % (maxauthsize + 1);
2084	if (WARN_ON(authsize > maxdatasize))
2085		authsize = maxdatasize;
2086	maxdatasize -= authsize;
2087	vec->setauthsize_error = crypto_aead_setauthsize(tfm, authsize);
2088
2089	/* Plaintext and associated data */
2090	total_len = generate_random_length(maxdatasize);
2091	if (prandom_u32() % 4 == 0)
2092		vec->alen = 0;
2093	else
2094		vec->alen = generate_random_length(total_len);
2095	vec->plen = total_len - vec->alen;
2096	generate_random_bytes((u8 *)vec->assoc, vec->alen);
2097	generate_random_bytes((u8 *)vec->ptext, vec->plen);
2098
2099	vec->clen = vec->plen + authsize;
2100
2101	/*
2102	 * If the key or authentication tag size couldn't be set, no need to
2103	 * continue to encrypt.
2104	 */
2105	if (vec->setkey_error || vec->setauthsize_error)
2106		goto done;
2107
2108	/* Ciphertext */
2109	sg_init_table(src, 2);
2110	i = 0;
2111	if (vec->alen)
2112		sg_set_buf(&src[i++], vec->assoc, vec->alen);
2113	if (vec->plen)
2114		sg_set_buf(&src[i++], vec->ptext, vec->plen);
2115	sg_init_one(&dst, vec->ctext, vec->alen + vec->clen);
2116	memcpy(iv, vec->iv, ivsize);
2117	aead_request_set_callback(req, 0, crypto_req_done, &wait);
2118	aead_request_set_crypt(req, src, &dst, vec->plen, iv);
2119	aead_request_set_ad(req, vec->alen);
2120	vec->crypt_error = crypto_wait_req(crypto_aead_encrypt(req), &wait);
2121	if (vec->crypt_error == 0)
2122		memmove((u8 *)vec->ctext, vec->ctext + vec->alen, vec->clen);
2123done:
2124	snprintf(name, max_namelen,
2125		 "\"random: alen=%u plen=%u authsize=%u klen=%u\"",
2126		 vec->alen, vec->plen, authsize, vec->klen);
2127}
2128
2129/*
2130 * Test the AEAD algorithm represented by @req against the corresponding generic
2131 * implementation, if one is available.
2132 */
2133static int test_aead_vs_generic_impl(const char *driver,
2134				     const struct alg_test_desc *test_desc,
2135				     struct aead_request *req,
2136				     struct cipher_test_sglists *tsgls)
2137{
2138	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
2139	const unsigned int ivsize = crypto_aead_ivsize(tfm);
2140	const unsigned int maxauthsize = crypto_aead_alg(tfm)->maxauthsize;
2141	const unsigned int blocksize = crypto_aead_blocksize(tfm);
2142	const unsigned int maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN;
2143	const char *algname = crypto_aead_alg(tfm)->base.cra_name;
2144	const char *generic_driver = test_desc->generic_driver;
2145	char _generic_driver[CRYPTO_MAX_ALG_NAME];
2146	struct crypto_aead *generic_tfm = NULL;
2147	struct aead_request *generic_req = NULL;
2148	unsigned int maxkeysize;
2149	unsigned int i;
2150	struct aead_testvec vec = { 0 };
2151	char vec_name[64];
2152	struct testvec_config *cfg;
2153	char cfgname[TESTVEC_CONFIG_NAMELEN];
2154	int err;
2155
2156	if (noextratests)
2157		return 0;
2158
2159	if (!generic_driver) { /* Use default naming convention? */
2160		err = build_generic_driver_name(algname, _generic_driver);
2161		if (err)
2162			return err;
2163		generic_driver = _generic_driver;
2164	}
2165
2166	if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */
2167		return 0;
2168
2169	generic_tfm = crypto_alloc_aead(generic_driver, 0, 0);
2170	if (IS_ERR(generic_tfm)) {
2171		err = PTR_ERR(generic_tfm);
2172		if (err == -ENOENT) {
2173			pr_warn("alg: aead: skipping comparison tests for %s because %s is unavailable\n",
2174				driver, generic_driver);
2175			return 0;
2176		}
2177		pr_err("alg: aead: error allocating %s (generic impl of %s): %d\n",
2178		       generic_driver, algname, err);
2179		return err;
2180	}
2181
2182	cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
2183	if (!cfg) {
2184		err = -ENOMEM;
2185		goto out;
2186	}
2187
2188	generic_req = aead_request_alloc(generic_tfm, GFP_KERNEL);
2189	if (!generic_req) {
2190		err = -ENOMEM;
2191		goto out;
2192	}
2193
2194	/* Check the algorithm properties for consistency. */
2195
2196	if (maxauthsize != crypto_aead_alg(generic_tfm)->maxauthsize) {
2197		pr_err("alg: aead: maxauthsize for %s (%u) doesn't match generic impl (%u)\n",
2198		       driver, maxauthsize,
2199		       crypto_aead_alg(generic_tfm)->maxauthsize);
2200		err = -EINVAL;
2201		goto out;
2202	}
2203
2204	if (ivsize != crypto_aead_ivsize(generic_tfm)) {
2205		pr_err("alg: aead: ivsize for %s (%u) doesn't match generic impl (%u)\n",
2206		       driver, ivsize, crypto_aead_ivsize(generic_tfm));
2207		err = -EINVAL;
2208		goto out;
2209	}
2210
2211	if (blocksize != crypto_aead_blocksize(generic_tfm)) {
2212		pr_err("alg: aead: blocksize for %s (%u) doesn't match generic impl (%u)\n",
2213		       driver, blocksize, crypto_aead_blocksize(generic_tfm));
2214		err = -EINVAL;
2215		goto out;
2216	}
2217
2218	/*
2219	 * Now generate test vectors using the generic implementation, and test
2220	 * the other implementation against them.
2221	 */
2222
2223	maxkeysize = 0;
2224	for (i = 0; i < test_desc->suite.aead.count; i++)
2225		maxkeysize = max_t(unsigned int, maxkeysize,
2226				   test_desc->suite.aead.vecs[i].klen);
2227
2228	vec.key = kmalloc(maxkeysize, GFP_KERNEL);
2229	vec.iv = kmalloc(ivsize, GFP_KERNEL);
2230	vec.assoc = kmalloc(maxdatasize, GFP_KERNEL);
2231	vec.ptext = kmalloc(maxdatasize, GFP_KERNEL);
2232	vec.ctext = kmalloc(maxdatasize, GFP_KERNEL);
2233	if (!vec.key || !vec.iv || !vec.assoc || !vec.ptext || !vec.ctext) {
2234		err = -ENOMEM;
2235		goto out;
2236	}
2237
2238	for (i = 0; i < fuzz_iterations * 8; i++) {
2239		generate_random_aead_testvec(generic_req, &vec,
2240					     maxkeysize, maxdatasize,
2241					     vec_name, sizeof(vec_name));
2242		generate_random_testvec_config(cfg, cfgname, sizeof(cfgname));
2243
2244		err = test_aead_vec_cfg(driver, ENCRYPT, &vec, vec_name, cfg,
2245					req, tsgls);
2246		if (err)
2247			goto out;
2248		err = test_aead_vec_cfg(driver, DECRYPT, &vec, vec_name, cfg,
2249					req, tsgls);
2250		if (err)
2251			goto out;
2252		cond_resched();
2253	}
2254	err = 0;
2255out:
2256	kfree(cfg);
2257	kfree(vec.key);
2258	kfree(vec.iv);
2259	kfree(vec.assoc);
2260	kfree(vec.ptext);
2261	kfree(vec.ctext);
2262	crypto_free_aead(generic_tfm);
2263	aead_request_free(generic_req);
2264	return err;
2265}
2266#else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
2267static int test_aead_vs_generic_impl(const char *driver,
2268				     const struct alg_test_desc *test_desc,
2269				     struct aead_request *req,
2270				     struct cipher_test_sglists *tsgls)
2271{
2272	return 0;
2273}
2274#endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
2275
2276static int test_aead(const char *driver, int enc,
2277		     const struct aead_test_suite *suite,
2278		     struct aead_request *req,
2279		     struct cipher_test_sglists *tsgls)
2280{
2281	unsigned int i;
2282	int err;
2283
2284	for (i = 0; i < suite->count; i++) {
2285		err = test_aead_vec(driver, enc, &suite->vecs[i], i, req,
2286				    tsgls);
2287		if (err)
2288			return err;
2289		cond_resched();
2290	}
2291	return 0;
2292}
2293
2294static int alg_test_aead(const struct alg_test_desc *desc, const char *driver,
2295			 u32 type, u32 mask)
2296{
2297	const struct aead_test_suite *suite = &desc->suite.aead;
2298	struct crypto_aead *tfm;
2299	struct aead_request *req = NULL;
2300	struct cipher_test_sglists *tsgls = NULL;
2301	int err;
2302
2303	if (suite->count <= 0) {
2304		pr_err("alg: aead: empty test suite for %s\n", driver);
2305		return -EINVAL;
2306	}
2307
2308	tfm = crypto_alloc_aead(driver, type, mask);
2309	if (IS_ERR(tfm)) {
2310		pr_err("alg: aead: failed to allocate transform for %s: %ld\n",
2311		       driver, PTR_ERR(tfm));
2312		return PTR_ERR(tfm);
2313	}
2314
2315	req = aead_request_alloc(tfm, GFP_KERNEL);
2316	if (!req) {
2317		pr_err("alg: aead: failed to allocate request for %s\n",
2318		       driver);
2319		err = -ENOMEM;
2320		goto out;
2321	}
2322
2323	tsgls = alloc_cipher_test_sglists();
2324	if (!tsgls) {
2325		pr_err("alg: aead: failed to allocate test buffers for %s\n",
2326		       driver);
2327		err = -ENOMEM;
2328		goto out;
 
2329	}
2330
2331	err = test_aead(driver, ENCRYPT, suite, req, tsgls);
2332	if (err)
2333		goto out;
2334
2335	err = test_aead(driver, DECRYPT, suite, req, tsgls);
2336	if (err)
2337		goto out;
2338
2339	err = test_aead_vs_generic_impl(driver, desc, req, tsgls);
2340out:
2341	free_cipher_test_sglists(tsgls);
2342	aead_request_free(req);
2343	crypto_free_aead(tfm);
2344	return err;
2345}
2346
2347static int test_cipher(struct crypto_cipher *tfm, int enc,
2348		       const struct cipher_testvec *template,
2349		       unsigned int tcount)
2350{
2351	const char *algo = crypto_tfm_alg_driver_name(crypto_cipher_tfm(tfm));
2352	unsigned int i, j, k;
2353	char *q;
2354	const char *e;
2355	const char *input, *result;
2356	void *data;
2357	char *xbuf[XBUFSIZE];
2358	int ret = -ENOMEM;
2359
2360	if (testmgr_alloc_buf(xbuf))
2361		goto out_nobuf;
2362
2363	if (enc == ENCRYPT)
2364	        e = "encryption";
2365	else
2366		e = "decryption";
2367
2368	j = 0;
2369	for (i = 0; i < tcount; i++) {
2370
2371		if (fips_enabled && template[i].fips_skip)
2372			continue;
2373
2374		input  = enc ? template[i].ptext : template[i].ctext;
2375		result = enc ? template[i].ctext : template[i].ptext;
2376		j++;
2377
2378		ret = -EINVAL;
2379		if (WARN_ON(template[i].len > PAGE_SIZE))
2380			goto out;
2381
2382		data = xbuf[0];
2383		memcpy(data, input, template[i].len);
2384
2385		crypto_cipher_clear_flags(tfm, ~0);
2386		if (template[i].wk)
2387			crypto_cipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2388
2389		ret = crypto_cipher_setkey(tfm, template[i].key,
2390					   template[i].klen);
2391		if (ret) {
2392			if (ret == template[i].setkey_error)
2393				continue;
2394			pr_err("alg: cipher: %s setkey failed on test vector %u; expected_error=%d, actual_error=%d, flags=%#x\n",
2395			       algo, j, template[i].setkey_error, ret,
2396			       crypto_cipher_get_flags(tfm));
2397			goto out;
2398		}
2399		if (template[i].setkey_error) {
2400			pr_err("alg: cipher: %s setkey unexpectedly succeeded on test vector %u; expected_error=%d\n",
2401			       algo, j, template[i].setkey_error);
2402			ret = -EINVAL;
2403			goto out;
2404		}
 
2405
2406		for (k = 0; k < template[i].len;
2407		     k += crypto_cipher_blocksize(tfm)) {
2408			if (enc)
2409				crypto_cipher_encrypt_one(tfm, data + k,
2410							  data + k);
2411			else
2412				crypto_cipher_decrypt_one(tfm, data + k,
2413							  data + k);
2414		}
2415
2416		q = data;
2417		if (memcmp(q, result, template[i].len)) {
2418			printk(KERN_ERR "alg: cipher: Test %d failed "
2419			       "on %s for %s\n", j, e, algo);
2420			hexdump(q, template[i].len);
2421			ret = -EINVAL;
2422			goto out;
2423		}
2424	}
2425
2426	ret = 0;
2427
2428out:
2429	testmgr_free_buf(xbuf);
2430out_nobuf:
2431	return ret;
2432}
2433
2434static int test_skcipher_vec_cfg(const char *driver, int enc,
2435				 const struct cipher_testvec *vec,
2436				 const char *vec_name,
2437				 const struct testvec_config *cfg,
2438				 struct skcipher_request *req,
2439				 struct cipher_test_sglists *tsgls)
2440{
2441	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
2442	const unsigned int alignmask = crypto_skcipher_alignmask(tfm);
2443	const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
2444	const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
2445	const char *op = enc ? "encryption" : "decryption";
2446	DECLARE_CRYPTO_WAIT(wait);
2447	u8 _iv[3 * (MAX_ALGAPI_ALIGNMASK + 1) + MAX_IVLEN];
2448	u8 *iv = PTR_ALIGN(&_iv[0], 2 * (MAX_ALGAPI_ALIGNMASK + 1)) +
2449		 cfg->iv_offset +
2450		 (cfg->iv_offset_relative_to_alignmask ? alignmask : 0);
2451	struct kvec input;
2452	int err;
2453
2454	/* Set the key */
2455	if (vec->wk)
2456		crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2457	else
2458		crypto_skcipher_clear_flags(tfm,
2459					    CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2460	err = crypto_skcipher_setkey(tfm, vec->key, vec->klen);
2461	if (err) {
2462		if (err == vec->setkey_error)
2463			return 0;
2464		pr_err("alg: skcipher: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
2465		       driver, vec_name, vec->setkey_error, err,
2466		       crypto_skcipher_get_flags(tfm));
2467		return err;
2468	}
2469	if (vec->setkey_error) {
2470		pr_err("alg: skcipher: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
2471		       driver, vec_name, vec->setkey_error);
2472		return -EINVAL;
2473	}
2474
2475	/* The IV must be copied to a buffer, as the algorithm may modify it */
2476	if (ivsize) {
2477		if (WARN_ON(ivsize > MAX_IVLEN))
2478			return -EINVAL;
2479		if (vec->generates_iv && !enc)
2480			memcpy(iv, vec->iv_out, ivsize);
2481		else if (vec->iv)
2482			memcpy(iv, vec->iv, ivsize);
2483		else
2484			memset(iv, 0, ivsize);
2485	} else {
2486		if (vec->generates_iv) {
2487			pr_err("alg: skcipher: %s has ivsize=0 but test vector %s generates IV!\n",
2488			       driver, vec_name);
2489			return -EINVAL;
2490		}
2491		iv = NULL;
2492	}
2493
2494	/* Build the src/dst scatterlists */
2495	input.iov_base = enc ? (void *)vec->ptext : (void *)vec->ctext;
2496	input.iov_len = vec->len;
2497	err = build_cipher_test_sglists(tsgls, cfg, alignmask,
2498					vec->len, vec->len, &input, 1);
2499	if (err) {
2500		pr_err("alg: skcipher: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n",
2501		       driver, op, vec_name, cfg->name);
2502		return err;
2503	}
2504
2505	/* Do the actual encryption or decryption */
2506	testmgr_poison(req->__ctx, crypto_skcipher_reqsize(tfm));
2507	skcipher_request_set_callback(req, req_flags, crypto_req_done, &wait);
2508	skcipher_request_set_crypt(req, tsgls->src.sgl_ptr, tsgls->dst.sgl_ptr,
2509				   vec->len, iv);
2510	if (cfg->nosimd)
2511		crypto_disable_simd_for_test();
2512	err = enc ? crypto_skcipher_encrypt(req) : crypto_skcipher_decrypt(req);
2513	if (cfg->nosimd)
2514		crypto_reenable_simd_for_test();
2515	err = crypto_wait_req(err, &wait);
2516
2517	/* Check that the algorithm didn't overwrite things it shouldn't have */
2518	if (req->cryptlen != vec->len ||
2519	    req->iv != iv ||
2520	    req->src != tsgls->src.sgl_ptr ||
2521	    req->dst != tsgls->dst.sgl_ptr ||
2522	    crypto_skcipher_reqtfm(req) != tfm ||
2523	    req->base.complete != crypto_req_done ||
2524	    req->base.flags != req_flags ||
2525	    req->base.data != &wait) {
2526		pr_err("alg: skcipher: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n",
2527		       driver, op, vec_name, cfg->name);
2528		if (req->cryptlen != vec->len)
2529			pr_err("alg: skcipher: changed 'req->cryptlen'\n");
2530		if (req->iv != iv)
2531			pr_err("alg: skcipher: changed 'req->iv'\n");
2532		if (req->src != tsgls->src.sgl_ptr)
2533			pr_err("alg: skcipher: changed 'req->src'\n");
2534		if (req->dst != tsgls->dst.sgl_ptr)
2535			pr_err("alg: skcipher: changed 'req->dst'\n");
2536		if (crypto_skcipher_reqtfm(req) != tfm)
2537			pr_err("alg: skcipher: changed 'req->base.tfm'\n");
2538		if (req->base.complete != crypto_req_done)
2539			pr_err("alg: skcipher: changed 'req->base.complete'\n");
2540		if (req->base.flags != req_flags)
2541			pr_err("alg: skcipher: changed 'req->base.flags'\n");
2542		if (req->base.data != &wait)
2543			pr_err("alg: skcipher: changed 'req->base.data'\n");
2544		return -EINVAL;
2545	}
2546	if (is_test_sglist_corrupted(&tsgls->src)) {
2547		pr_err("alg: skcipher: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n",
2548		       driver, op, vec_name, cfg->name);
2549		return -EINVAL;
2550	}
2551	if (tsgls->dst.sgl_ptr != tsgls->src.sgl &&
2552	    is_test_sglist_corrupted(&tsgls->dst)) {
2553		pr_err("alg: skcipher: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n",
2554		       driver, op, vec_name, cfg->name);
2555		return -EINVAL;
2556	}
2557
2558	/* Check for success or failure */
2559	if (err) {
2560		if (err == vec->crypt_error)
2561			return 0;
2562		pr_err("alg: skcipher: %s %s failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
2563		       driver, op, vec_name, vec->crypt_error, err, cfg->name);
2564		return err;
2565	}
2566	if (vec->crypt_error) {
2567		pr_err("alg: skcipher: %s %s unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
2568		       driver, op, vec_name, vec->crypt_error, cfg->name);
2569		return -EINVAL;
2570	}
2571
2572	/* Check for the correct output (ciphertext or plaintext) */
2573	err = verify_correct_output(&tsgls->dst, enc ? vec->ctext : vec->ptext,
2574				    vec->len, 0, true);
2575	if (err == -EOVERFLOW) {
2576		pr_err("alg: skcipher: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n",
2577		       driver, op, vec_name, cfg->name);
2578		return err;
2579	}
2580	if (err) {
2581		pr_err("alg: skcipher: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
2582		       driver, op, vec_name, cfg->name);
2583		return err;
2584	}
2585
2586	/* If applicable, check that the algorithm generated the correct IV */
2587	if (vec->iv_out && memcmp(iv, vec->iv_out, ivsize) != 0) {
2588		pr_err("alg: skcipher: %s %s test failed (wrong output IV) on test vector %s, cfg=\"%s\"\n",
2589		       driver, op, vec_name, cfg->name);
2590		hexdump(iv, ivsize);
2591		return -EINVAL;
2592	}
2593
2594	return 0;
2595}
2596
2597static int test_skcipher_vec(const char *driver, int enc,
2598			     const struct cipher_testvec *vec,
2599			     unsigned int vec_num,
2600			     struct skcipher_request *req,
2601			     struct cipher_test_sglists *tsgls)
2602{
2603	char vec_name[16];
2604	unsigned int i;
2605	int err;
2606
2607	if (fips_enabled && vec->fips_skip)
2608		return 0;
2609
2610	sprintf(vec_name, "%u", vec_num);
2611
2612	for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) {
2613		err = test_skcipher_vec_cfg(driver, enc, vec, vec_name,
2614					    &default_cipher_testvec_configs[i],
2615					    req, tsgls);
2616		if (err)
2617			return err;
2618	}
2619
2620#ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2621	if (!noextratests) {
2622		struct testvec_config cfg;
2623		char cfgname[TESTVEC_CONFIG_NAMELEN];
2624
2625		for (i = 0; i < fuzz_iterations; i++) {
2626			generate_random_testvec_config(&cfg, cfgname,
2627						       sizeof(cfgname));
2628			err = test_skcipher_vec_cfg(driver, enc, vec, vec_name,
2629						    &cfg, req, tsgls);
2630			if (err)
2631				return err;
2632			cond_resched();
2633		}
2634	}
2635#endif
2636	return 0;
2637}
2638
2639#ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2640/*
2641 * Generate a symmetric cipher test vector from the given implementation.
2642 * Assumes the buffers in 'vec' were already allocated.
2643 */
2644static void generate_random_cipher_testvec(struct skcipher_request *req,
2645					   struct cipher_testvec *vec,
2646					   unsigned int maxdatasize,
2647					   char *name, size_t max_namelen)
2648{
2649	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
2650	const unsigned int maxkeysize = tfm->keysize;
2651	const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
2652	struct scatterlist src, dst;
2653	u8 iv[MAX_IVLEN];
2654	DECLARE_CRYPTO_WAIT(wait);
2655
2656	/* Key: length in [0, maxkeysize], but usually choose maxkeysize */
2657	vec->klen = maxkeysize;
2658	if (prandom_u32() % 4 == 0)
2659		vec->klen = prandom_u32() % (maxkeysize + 1);
2660	generate_random_bytes((u8 *)vec->key, vec->klen);
2661	vec->setkey_error = crypto_skcipher_setkey(tfm, vec->key, vec->klen);
2662
2663	/* IV */
2664	generate_random_bytes((u8 *)vec->iv, ivsize);
2665
2666	/* Plaintext */
2667	vec->len = generate_random_length(maxdatasize);
2668	generate_random_bytes((u8 *)vec->ptext, vec->len);
2669
2670	/* If the key couldn't be set, no need to continue to encrypt. */
2671	if (vec->setkey_error)
2672		goto done;
2673
2674	/* Ciphertext */
2675	sg_init_one(&src, vec->ptext, vec->len);
2676	sg_init_one(&dst, vec->ctext, vec->len);
2677	memcpy(iv, vec->iv, ivsize);
2678	skcipher_request_set_callback(req, 0, crypto_req_done, &wait);
2679	skcipher_request_set_crypt(req, &src, &dst, vec->len, iv);
2680	vec->crypt_error = crypto_wait_req(crypto_skcipher_encrypt(req), &wait);
2681done:
2682	snprintf(name, max_namelen, "\"random: len=%u klen=%u\"",
2683		 vec->len, vec->klen);
2684}
2685
2686/*
2687 * Test the skcipher algorithm represented by @req against the corresponding
2688 * generic implementation, if one is available.
2689 */
2690static int test_skcipher_vs_generic_impl(const char *driver,
2691					 const char *generic_driver,
2692					 struct skcipher_request *req,
2693					 struct cipher_test_sglists *tsgls)
2694{
2695	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
2696	const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
2697	const unsigned int blocksize = crypto_skcipher_blocksize(tfm);
2698	const unsigned int maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN;
2699	const char *algname = crypto_skcipher_alg(tfm)->base.cra_name;
2700	char _generic_driver[CRYPTO_MAX_ALG_NAME];
2701	struct crypto_skcipher *generic_tfm = NULL;
2702	struct skcipher_request *generic_req = NULL;
2703	unsigned int i;
2704	struct cipher_testvec vec = { 0 };
2705	char vec_name[64];
2706	struct testvec_config *cfg;
2707	char cfgname[TESTVEC_CONFIG_NAMELEN];
2708	int err;
2709
2710	if (noextratests)
2711		return 0;
 
 
 
 
2712
2713	/* Keywrap isn't supported here yet as it handles its IV differently. */
2714	if (strncmp(algname, "kw(", 3) == 0)
2715		return 0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2716
2717	if (!generic_driver) { /* Use default naming convention? */
2718		err = build_generic_driver_name(algname, _generic_driver);
2719		if (err)
2720			return err;
2721		generic_driver = _generic_driver;
 
 
 
 
2722	}
2723
2724	if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */
2725		return 0;
 
 
 
2726
2727	generic_tfm = crypto_alloc_skcipher(generic_driver, 0, 0);
2728	if (IS_ERR(generic_tfm)) {
2729		err = PTR_ERR(generic_tfm);
2730		if (err == -ENOENT) {
2731			pr_warn("alg: skcipher: skipping comparison tests for %s because %s is unavailable\n",
2732				driver, generic_driver);
2733			return 0;
2734		}
2735		pr_err("alg: skcipher: error allocating %s (generic impl of %s): %d\n",
2736		       generic_driver, algname, err);
2737		return err;
2738	}
2739
2740	cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
2741	if (!cfg) {
2742		err = -ENOMEM;
2743		goto out;
2744	}
2745
2746	generic_req = skcipher_request_alloc(generic_tfm, GFP_KERNEL);
2747	if (!generic_req) {
2748		err = -ENOMEM;
2749		goto out;
2750	}
 
 
 
 
 
 
 
 
 
2751
2752	/* Check the algorithm properties for consistency. */
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2753
2754	if (tfm->keysize != generic_tfm->keysize) {
2755		pr_err("alg: skcipher: max keysize for %s (%u) doesn't match generic impl (%u)\n",
2756		       driver, tfm->keysize, generic_tfm->keysize);
2757		err = -EINVAL;
2758		goto out;
2759	}
2760
2761	if (ivsize != crypto_skcipher_ivsize(generic_tfm)) {
2762		pr_err("alg: skcipher: ivsize for %s (%u) doesn't match generic impl (%u)\n",
2763		       driver, ivsize, crypto_skcipher_ivsize(generic_tfm));
2764		err = -EINVAL;
2765		goto out;
2766	}
 
2767
2768	if (blocksize != crypto_skcipher_blocksize(generic_tfm)) {
2769		pr_err("alg: skcipher: blocksize for %s (%u) doesn't match generic impl (%u)\n",
2770		       driver, blocksize,
2771		       crypto_skcipher_blocksize(generic_tfm));
2772		err = -EINVAL;
2773		goto out;
2774	}
 
 
 
 
 
 
 
 
 
 
2775
2776	/*
2777	 * Now generate test vectors using the generic implementation, and test
2778	 * the other implementation against them.
2779	 */
2780
2781	vec.key = kmalloc(tfm->keysize, GFP_KERNEL);
2782	vec.iv = kmalloc(ivsize, GFP_KERNEL);
2783	vec.ptext = kmalloc(maxdatasize, GFP_KERNEL);
2784	vec.ctext = kmalloc(maxdatasize, GFP_KERNEL);
2785	if (!vec.key || !vec.iv || !vec.ptext || !vec.ctext) {
2786		err = -ENOMEM;
2787		goto out;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2788	}
2789
2790	for (i = 0; i < fuzz_iterations * 8; i++) {
2791		generate_random_cipher_testvec(generic_req, &vec, maxdatasize,
2792					       vec_name, sizeof(vec_name));
2793		generate_random_testvec_config(cfg, cfgname, sizeof(cfgname));
2794
2795		err = test_skcipher_vec_cfg(driver, ENCRYPT, &vec, vec_name,
2796					    cfg, req, tsgls);
2797		if (err)
2798			goto out;
2799		err = test_skcipher_vec_cfg(driver, DECRYPT, &vec, vec_name,
2800					    cfg, req, tsgls);
2801		if (err)
2802			goto out;
2803		cond_resched();
2804	}
2805	err = 0;
2806out:
2807	kfree(cfg);
2808	kfree(vec.key);
2809	kfree(vec.iv);
2810	kfree(vec.ptext);
2811	kfree(vec.ctext);
2812	crypto_free_skcipher(generic_tfm);
2813	skcipher_request_free(generic_req);
2814	return err;
2815}
2816#else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
2817static int test_skcipher_vs_generic_impl(const char *driver,
2818					 const char *generic_driver,
2819					 struct skcipher_request *req,
2820					 struct cipher_test_sglists *tsgls)
2821{
2822	return 0;
2823}
2824#endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
2825
2826static int test_skcipher(const char *driver, int enc,
2827			 const struct cipher_test_suite *suite,
2828			 struct skcipher_request *req,
2829			 struct cipher_test_sglists *tsgls)
2830{
2831	unsigned int i;
2832	int err;
2833
2834	for (i = 0; i < suite->count; i++) {
2835		err = test_skcipher_vec(driver, enc, &suite->vecs[i], i, req,
2836					tsgls);
2837		if (err)
2838			return err;
2839		cond_resched();
2840	}
2841	return 0;
2842}
2843
2844static int alg_test_skcipher(const struct alg_test_desc *desc,
2845			     const char *driver, u32 type, u32 mask)
2846{
2847	const struct cipher_test_suite *suite = &desc->suite.cipher;
2848	struct crypto_skcipher *tfm;
2849	struct skcipher_request *req = NULL;
2850	struct cipher_test_sglists *tsgls = NULL;
2851	int err;
2852
2853	if (suite->count <= 0) {
2854		pr_err("alg: skcipher: empty test suite for %s\n", driver);
2855		return -EINVAL;
2856	}
2857
2858	tfm = crypto_alloc_skcipher(driver, type, mask);
2859	if (IS_ERR(tfm)) {
2860		pr_err("alg: skcipher: failed to allocate transform for %s: %ld\n",
2861		       driver, PTR_ERR(tfm));
2862		return PTR_ERR(tfm);
2863	}
2864
2865	req = skcipher_request_alloc(tfm, GFP_KERNEL);
2866	if (!req) {
2867		pr_err("alg: skcipher: failed to allocate request for %s\n",
2868		       driver);
2869		err = -ENOMEM;
2870		goto out;
2871	}
2872
2873	tsgls = alloc_cipher_test_sglists();
2874	if (!tsgls) {
2875		pr_err("alg: skcipher: failed to allocate test buffers for %s\n",
2876		       driver);
2877		err = -ENOMEM;
2878		goto out;
 
2879	}
2880
2881	err = test_skcipher(driver, ENCRYPT, suite, req, tsgls);
2882	if (err)
2883		goto out;
2884
2885	err = test_skcipher(driver, DECRYPT, suite, req, tsgls);
2886	if (err)
2887		goto out;
2888
2889	err = test_skcipher_vs_generic_impl(driver, desc->generic_driver, req,
2890					    tsgls);
2891out:
2892	free_cipher_test_sglists(tsgls);
2893	skcipher_request_free(req);
2894	crypto_free_skcipher(tfm);
2895	return err;
2896}
2897
2898static int test_comp(struct crypto_comp *tfm,
2899		     const struct comp_testvec *ctemplate,
2900		     const struct comp_testvec *dtemplate,
2901		     int ctcount, int dtcount)
2902{
2903	const char *algo = crypto_tfm_alg_driver_name(crypto_comp_tfm(tfm));
2904	char *output, *decomp_output;
2905	unsigned int i;
 
2906	int ret;
2907
2908	output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
2909	if (!output)
2910		return -ENOMEM;
2911
2912	decomp_output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
2913	if (!decomp_output) {
2914		kfree(output);
2915		return -ENOMEM;
2916	}
2917
2918	for (i = 0; i < ctcount; i++) {
2919		int ilen;
2920		unsigned int dlen = COMP_BUF_SIZE;
2921
2922		memset(output, 0, COMP_BUF_SIZE);
2923		memset(decomp_output, 0, COMP_BUF_SIZE);
2924
2925		ilen = ctemplate[i].inlen;
2926		ret = crypto_comp_compress(tfm, ctemplate[i].input,
2927					   ilen, output, &dlen);
2928		if (ret) {
2929			printk(KERN_ERR "alg: comp: compression failed "
2930			       "on test %d for %s: ret=%d\n", i + 1, algo,
2931			       -ret);
2932			goto out;
2933		}
2934
2935		ilen = dlen;
2936		dlen = COMP_BUF_SIZE;
2937		ret = crypto_comp_decompress(tfm, output,
2938					     ilen, decomp_output, &dlen);
2939		if (ret) {
2940			pr_err("alg: comp: compression failed: decompress: on test %d for %s failed: ret=%d\n",
2941			       i + 1, algo, -ret);
2942			goto out;
2943		}
2944
2945		if (dlen != ctemplate[i].inlen) {
2946			printk(KERN_ERR "alg: comp: Compression test %d "
2947			       "failed for %s: output len = %d\n", i + 1, algo,
2948			       dlen);
2949			ret = -EINVAL;
2950			goto out;
2951		}
2952
2953		if (memcmp(decomp_output, ctemplate[i].input,
2954			   ctemplate[i].inlen)) {
2955			pr_err("alg: comp: compression failed: output differs: on test %d for %s\n",
2956			       i + 1, algo);
2957			hexdump(decomp_output, dlen);
2958			ret = -EINVAL;
2959			goto out;
2960		}
2961	}
2962
2963	for (i = 0; i < dtcount; i++) {
2964		int ilen;
2965		unsigned int dlen = COMP_BUF_SIZE;
2966
2967		memset(decomp_output, 0, COMP_BUF_SIZE);
2968
2969		ilen = dtemplate[i].inlen;
2970		ret = crypto_comp_decompress(tfm, dtemplate[i].input,
2971					     ilen, decomp_output, &dlen);
2972		if (ret) {
2973			printk(KERN_ERR "alg: comp: decompression failed "
2974			       "on test %d for %s: ret=%d\n", i + 1, algo,
2975			       -ret);
2976			goto out;
2977		}
2978
2979		if (dlen != dtemplate[i].outlen) {
2980			printk(KERN_ERR "alg: comp: Decompression test %d "
2981			       "failed for %s: output len = %d\n", i + 1, algo,
2982			       dlen);
2983			ret = -EINVAL;
2984			goto out;
2985		}
2986
2987		if (memcmp(decomp_output, dtemplate[i].output, dlen)) {
2988			printk(KERN_ERR "alg: comp: Decompression test %d "
2989			       "failed for %s\n", i + 1, algo);
2990			hexdump(decomp_output, dlen);
2991			ret = -EINVAL;
2992			goto out;
2993		}
2994	}
2995
2996	ret = 0;
2997
2998out:
2999	kfree(decomp_output);
3000	kfree(output);
3001	return ret;
3002}
3003
3004static int test_acomp(struct crypto_acomp *tfm,
3005			      const struct comp_testvec *ctemplate,
3006		      const struct comp_testvec *dtemplate,
3007		      int ctcount, int dtcount)
3008{
3009	const char *algo = crypto_tfm_alg_driver_name(crypto_acomp_tfm(tfm));
3010	unsigned int i;
3011	char *output, *decomp_out;
3012	int ret;
3013	struct scatterlist src, dst;
3014	struct acomp_req *req;
3015	struct crypto_wait wait;
3016
3017	output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
3018	if (!output)
3019		return -ENOMEM;
3020
3021	decomp_out = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
3022	if (!decomp_out) {
3023		kfree(output);
3024		return -ENOMEM;
3025	}
3026
3027	for (i = 0; i < ctcount; i++) {
3028		unsigned int dlen = COMP_BUF_SIZE;
3029		int ilen = ctemplate[i].inlen;
3030		void *input_vec;
3031
3032		input_vec = kmemdup(ctemplate[i].input, ilen, GFP_KERNEL);
3033		if (!input_vec) {
3034			ret = -ENOMEM;
3035			goto out;
3036		}
3037
3038		memset(output, 0, dlen);
3039		crypto_init_wait(&wait);
3040		sg_init_one(&src, input_vec, ilen);
3041		sg_init_one(&dst, output, dlen);
3042
3043		req = acomp_request_alloc(tfm);
3044		if (!req) {
3045			pr_err("alg: acomp: request alloc failed for %s\n",
3046			       algo);
3047			kfree(input_vec);
3048			ret = -ENOMEM;
3049			goto out;
3050		}
3051
3052		acomp_request_set_params(req, &src, &dst, ilen, dlen);
3053		acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3054					   crypto_req_done, &wait);
3055
3056		ret = crypto_wait_req(crypto_acomp_compress(req), &wait);
3057		if (ret) {
3058			pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
3059			       i + 1, algo, -ret);
3060			kfree(input_vec);
3061			acomp_request_free(req);
3062			goto out;
3063		}
3064
3065		ilen = req->dlen;
3066		dlen = COMP_BUF_SIZE;
3067		sg_init_one(&src, output, ilen);
3068		sg_init_one(&dst, decomp_out, dlen);
3069		crypto_init_wait(&wait);
3070		acomp_request_set_params(req, &src, &dst, ilen, dlen);
3071
3072		ret = crypto_wait_req(crypto_acomp_decompress(req), &wait);
3073		if (ret) {
3074			pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
3075			       i + 1, algo, -ret);
3076			kfree(input_vec);
3077			acomp_request_free(req);
3078			goto out;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3079		}
3080
3081		if (req->dlen != ctemplate[i].inlen) {
3082			pr_err("alg: acomp: Compression test %d failed for %s: output len = %d\n",
3083			       i + 1, algo, req->dlen);
3084			ret = -EINVAL;
3085			kfree(input_vec);
3086			acomp_request_free(req);
3087			goto out;
3088		}
3089
3090		if (memcmp(input_vec, decomp_out, req->dlen)) {
3091			pr_err("alg: acomp: Compression test %d failed for %s\n",
3092			       i + 1, algo);
3093			hexdump(output, req->dlen);
3094			ret = -EINVAL;
3095			kfree(input_vec);
3096			acomp_request_free(req);
3097			goto out;
3098		}
3099
3100		kfree(input_vec);
3101		acomp_request_free(req);
3102	}
3103
3104	for (i = 0; i < dtcount; i++) {
3105		unsigned int dlen = COMP_BUF_SIZE;
3106		int ilen = dtemplate[i].inlen;
3107		void *input_vec;
3108
3109		input_vec = kmemdup(dtemplate[i].input, ilen, GFP_KERNEL);
3110		if (!input_vec) {
3111			ret = -ENOMEM;
3112			goto out;
3113		}
3114
3115		memset(output, 0, dlen);
3116		crypto_init_wait(&wait);
3117		sg_init_one(&src, input_vec, ilen);
3118		sg_init_one(&dst, output, dlen);
3119
3120		req = acomp_request_alloc(tfm);
3121		if (!req) {
3122			pr_err("alg: acomp: request alloc failed for %s\n",
3123			       algo);
3124			kfree(input_vec);
3125			ret = -ENOMEM;
3126			goto out;
3127		}
3128
3129		acomp_request_set_params(req, &src, &dst, ilen, dlen);
3130		acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3131					   crypto_req_done, &wait);
3132
3133		ret = crypto_wait_req(crypto_acomp_decompress(req), &wait);
3134		if (ret) {
3135			pr_err("alg: acomp: decompression failed on test %d for %s: ret=%d\n",
3136			       i + 1, algo, -ret);
3137			kfree(input_vec);
3138			acomp_request_free(req);
3139			goto out;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3140		}
3141
3142		if (req->dlen != dtemplate[i].outlen) {
3143			pr_err("alg: acomp: Decompression test %d failed for %s: output len = %d\n",
3144			       i + 1, algo, req->dlen);
3145			ret = -EINVAL;
3146			kfree(input_vec);
3147			acomp_request_free(req);
3148			goto out;
3149		}
3150
3151		if (memcmp(output, dtemplate[i].output, req->dlen)) {
3152			pr_err("alg: acomp: Decompression test %d failed for %s\n",
3153			       i + 1, algo);
3154			hexdump(output, req->dlen);
3155			ret = -EINVAL;
3156			kfree(input_vec);
3157			acomp_request_free(req);
3158			goto out;
3159		}
3160
3161		kfree(input_vec);
3162		acomp_request_free(req);
3163	}
3164
3165	ret = 0;
3166
3167out:
3168	kfree(decomp_out);
3169	kfree(output);
3170	return ret;
3171}
3172
3173static int test_cprng(struct crypto_rng *tfm,
3174		      const struct cprng_testvec *template,
3175		      unsigned int tcount)
3176{
3177	const char *algo = crypto_tfm_alg_driver_name(crypto_rng_tfm(tfm));
3178	int err = 0, i, j, seedsize;
3179	u8 *seed;
3180	char result[32];
3181
3182	seedsize = crypto_rng_seedsize(tfm);
3183
3184	seed = kmalloc(seedsize, GFP_KERNEL);
3185	if (!seed) {
3186		printk(KERN_ERR "alg: cprng: Failed to allocate seed space "
3187		       "for %s\n", algo);
3188		return -ENOMEM;
3189	}
3190
3191	for (i = 0; i < tcount; i++) {
3192		memset(result, 0, 32);
3193
3194		memcpy(seed, template[i].v, template[i].vlen);
3195		memcpy(seed + template[i].vlen, template[i].key,
3196		       template[i].klen);
3197		memcpy(seed + template[i].vlen + template[i].klen,
3198		       template[i].dt, template[i].dtlen);
3199
3200		err = crypto_rng_reset(tfm, seed, seedsize);
3201		if (err) {
3202			printk(KERN_ERR "alg: cprng: Failed to reset rng "
3203			       "for %s\n", algo);
3204			goto out;
3205		}
3206
3207		for (j = 0; j < template[i].loops; j++) {
3208			err = crypto_rng_get_bytes(tfm, result,
3209						   template[i].rlen);
3210			if (err < 0) {
3211				printk(KERN_ERR "alg: cprng: Failed to obtain "
3212				       "the correct amount of random data for "
3213				       "%s (requested %d)\n", algo,
3214				       template[i].rlen);
3215				goto out;
3216			}
3217		}
3218
3219		err = memcmp(result, template[i].result,
3220			     template[i].rlen);
3221		if (err) {
3222			printk(KERN_ERR "alg: cprng: Test %d failed for %s\n",
3223			       i, algo);
3224			hexdump(result, template[i].rlen);
3225			err = -EINVAL;
3226			goto out;
3227		}
3228	}
3229
3230out:
3231	kfree(seed);
3232	return err;
3233}
3234
3235static int alg_test_cipher(const struct alg_test_desc *desc,
3236			   const char *driver, u32 type, u32 mask)
3237{
3238	const struct cipher_test_suite *suite = &desc->suite.cipher;
3239	struct crypto_cipher *tfm;
3240	int err;
3241
3242	tfm = crypto_alloc_cipher(driver, type, mask);
3243	if (IS_ERR(tfm)) {
3244		printk(KERN_ERR "alg: cipher: Failed to load transform for "
3245		       "%s: %ld\n", driver, PTR_ERR(tfm));
3246		return PTR_ERR(tfm);
3247	}
3248
3249	err = test_cipher(tfm, ENCRYPT, suite->vecs, suite->count);
3250	if (!err)
3251		err = test_cipher(tfm, DECRYPT, suite->vecs, suite->count);
3252
3253	crypto_free_cipher(tfm);
3254	return err;
3255}
3256
3257static int alg_test_comp(const struct alg_test_desc *desc, const char *driver,
3258			 u32 type, u32 mask)
3259{
3260	struct crypto_comp *comp;
3261	struct crypto_acomp *acomp;
3262	int err;
3263	u32 algo_type = type & CRYPTO_ALG_TYPE_ACOMPRESS_MASK;
3264
3265	if (algo_type == CRYPTO_ALG_TYPE_ACOMPRESS) {
3266		acomp = crypto_alloc_acomp(driver, type, mask);
3267		if (IS_ERR(acomp)) {
3268			pr_err("alg: acomp: Failed to load transform for %s: %ld\n",
3269			       driver, PTR_ERR(acomp));
3270			return PTR_ERR(acomp);
3271		}
3272		err = test_acomp(acomp, desc->suite.comp.comp.vecs,
3273				 desc->suite.comp.decomp.vecs,
3274				 desc->suite.comp.comp.count,
3275				 desc->suite.comp.decomp.count);
3276		crypto_free_acomp(acomp);
3277	} else {
3278		comp = crypto_alloc_comp(driver, type, mask);
3279		if (IS_ERR(comp)) {
3280			pr_err("alg: comp: Failed to load transform for %s: %ld\n",
3281			       driver, PTR_ERR(comp));
3282			return PTR_ERR(comp);
3283		}
3284
3285		err = test_comp(comp, desc->suite.comp.comp.vecs,
3286				desc->suite.comp.decomp.vecs,
3287				desc->suite.comp.comp.count,
3288				desc->suite.comp.decomp.count);
3289
3290		crypto_free_comp(comp);
3291	}
3292	return err;
3293}
3294
3295static int alg_test_crc32c(const struct alg_test_desc *desc,
3296			   const char *driver, u32 type, u32 mask)
3297{
3298	struct crypto_shash *tfm;
3299	__le32 val;
3300	int err;
3301
3302	err = alg_test_hash(desc, driver, type, mask);
3303	if (err)
3304		return err;
3305
3306	tfm = crypto_alloc_shash(driver, type, mask);
3307	if (IS_ERR(tfm)) {
3308		if (PTR_ERR(tfm) == -ENOENT) {
3309			/*
3310			 * This crc32c implementation is only available through
3311			 * ahash API, not the shash API, so the remaining part
3312			 * of the test is not applicable to it.
3313			 */
3314			return 0;
3315		}
3316		printk(KERN_ERR "alg: crc32c: Failed to load transform for %s: "
3317		       "%ld\n", driver, PTR_ERR(tfm));
3318		return PTR_ERR(tfm);
3319	}
3320
3321	do {
3322		SHASH_DESC_ON_STACK(shash, tfm);
3323		u32 *ctx = (u32 *)shash_desc_ctx(shash);
3324
3325		shash->tfm = tfm;
3326
3327		*ctx = 420553207;
3328		err = crypto_shash_final(shash, (u8 *)&val);
3329		if (err) {
3330			printk(KERN_ERR "alg: crc32c: Operation failed for "
3331			       "%s: %d\n", driver, err);
3332			break;
3333		}
3334
3335		if (val != cpu_to_le32(~420553207)) {
3336			pr_err("alg: crc32c: Test failed for %s: %u\n",
3337			       driver, le32_to_cpu(val));
3338			err = -EINVAL;
3339		}
3340	} while (0);
3341
3342	crypto_free_shash(tfm);
3343
3344	return err;
3345}
3346
3347static int alg_test_cprng(const struct alg_test_desc *desc, const char *driver,
3348			  u32 type, u32 mask)
3349{
3350	struct crypto_rng *rng;
3351	int err;
3352
3353	rng = crypto_alloc_rng(driver, type, mask);
3354	if (IS_ERR(rng)) {
3355		printk(KERN_ERR "alg: cprng: Failed to load transform for %s: "
3356		       "%ld\n", driver, PTR_ERR(rng));
3357		return PTR_ERR(rng);
3358	}
3359
3360	err = test_cprng(rng, desc->suite.cprng.vecs, desc->suite.cprng.count);
3361
3362	crypto_free_rng(rng);
3363
 
 
3364	return err;
3365}
3366
3367
3368static int drbg_cavs_test(const struct drbg_testvec *test, int pr,
3369			  const char *driver, u32 type, u32 mask)
3370{
3371	int ret = -EAGAIN;
3372	struct crypto_rng *drng;
3373	struct drbg_test_data test_data;
3374	struct drbg_string addtl, pers, testentropy;
3375	unsigned char *buf = kzalloc(test->expectedlen, GFP_KERNEL);
3376
3377	if (!buf)
3378		return -ENOMEM;
3379
3380	drng = crypto_alloc_rng(driver, type, mask);
3381	if (IS_ERR(drng)) {
3382		printk(KERN_ERR "alg: drbg: could not allocate DRNG handle for "
3383		       "%s\n", driver);
3384		kzfree(buf);
3385		return -ENOMEM;
3386	}
3387
3388	test_data.testentropy = &testentropy;
3389	drbg_string_fill(&testentropy, test->entropy, test->entropylen);
3390	drbg_string_fill(&pers, test->pers, test->perslen);
3391	ret = crypto_drbg_reset_test(drng, &pers, &test_data);
3392	if (ret) {
3393		printk(KERN_ERR "alg: drbg: Failed to reset rng\n");
3394		goto outbuf;
3395	}
3396
3397	drbg_string_fill(&addtl, test->addtla, test->addtllen);
3398	if (pr) {
3399		drbg_string_fill(&testentropy, test->entpra, test->entprlen);
3400		ret = crypto_drbg_get_bytes_addtl_test(drng,
3401			buf, test->expectedlen, &addtl,	&test_data);
3402	} else {
3403		ret = crypto_drbg_get_bytes_addtl(drng,
3404			buf, test->expectedlen, &addtl);
3405	}
3406	if (ret < 0) {
3407		printk(KERN_ERR "alg: drbg: could not obtain random data for "
3408		       "driver %s\n", driver);
3409		goto outbuf;
3410	}
3411
3412	drbg_string_fill(&addtl, test->addtlb, test->addtllen);
3413	if (pr) {
3414		drbg_string_fill(&testentropy, test->entprb, test->entprlen);
3415		ret = crypto_drbg_get_bytes_addtl_test(drng,
3416			buf, test->expectedlen, &addtl, &test_data);
3417	} else {
3418		ret = crypto_drbg_get_bytes_addtl(drng,
3419			buf, test->expectedlen, &addtl);
3420	}
3421	if (ret < 0) {
3422		printk(KERN_ERR "alg: drbg: could not obtain random data for "
3423		       "driver %s\n", driver);
3424		goto outbuf;
3425	}
3426
3427	ret = memcmp(test->expected, buf, test->expectedlen);
 
 
3428
3429outbuf:
3430	crypto_free_rng(drng);
3431	kzfree(buf);
3432	return ret;
3433}
3434
3435
3436static int alg_test_drbg(const struct alg_test_desc *desc, const char *driver,
3437			 u32 type, u32 mask)
3438{
3439	int err = 0;
3440	int pr = 0;
3441	int i = 0;
3442	const struct drbg_testvec *template = desc->suite.drbg.vecs;
3443	unsigned int tcount = desc->suite.drbg.count;
3444
3445	if (0 == memcmp(driver, "drbg_pr_", 8))
3446		pr = 1;
3447
3448	for (i = 0; i < tcount; i++) {
3449		err = drbg_cavs_test(&template[i], pr, driver, type, mask);
3450		if (err) {
3451			printk(KERN_ERR "alg: drbg: Test %d failed for %s\n",
3452			       i, driver);
3453			err = -EINVAL;
3454			break;
3455		}
3456	}
3457	return err;
3458
 
 
 
 
 
 
 
3459}
3460
3461static int do_test_kpp(struct crypto_kpp *tfm, const struct kpp_testvec *vec,
3462		       const char *alg)
3463{
3464	struct kpp_request *req;
3465	void *input_buf = NULL;
3466	void *output_buf = NULL;
3467	void *a_public = NULL;
3468	void *a_ss = NULL;
3469	void *shared_secret = NULL;
3470	struct crypto_wait wait;
3471	unsigned int out_len_max;
3472	int err = -ENOMEM;
3473	struct scatterlist src, dst;
3474
3475	req = kpp_request_alloc(tfm, GFP_KERNEL);
3476	if (!req)
3477		return err;
3478
3479	crypto_init_wait(&wait);
3480
3481	err = crypto_kpp_set_secret(tfm, vec->secret, vec->secret_size);
3482	if (err < 0)
3483		goto free_req;
3484
3485	out_len_max = crypto_kpp_maxsize(tfm);
3486	output_buf = kzalloc(out_len_max, GFP_KERNEL);
3487	if (!output_buf) {
3488		err = -ENOMEM;
3489		goto free_req;
3490	}
3491
3492	/* Use appropriate parameter as base */
3493	kpp_request_set_input(req, NULL, 0);
3494	sg_init_one(&dst, output_buf, out_len_max);
3495	kpp_request_set_output(req, &dst, out_len_max);
3496	kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3497				 crypto_req_done, &wait);
3498
3499	/* Compute party A's public key */
3500	err = crypto_wait_req(crypto_kpp_generate_public_key(req), &wait);
3501	if (err) {
3502		pr_err("alg: %s: Party A: generate public key test failed. err %d\n",
3503		       alg, err);
3504		goto free_output;
3505	}
3506
3507	if (vec->genkey) {
3508		/* Save party A's public key */
3509		a_public = kmemdup(sg_virt(req->dst), out_len_max, GFP_KERNEL);
3510		if (!a_public) {
3511			err = -ENOMEM;
3512			goto free_output;
3513		}
3514	} else {
3515		/* Verify calculated public key */
3516		if (memcmp(vec->expected_a_public, sg_virt(req->dst),
3517			   vec->expected_a_public_size)) {
3518			pr_err("alg: %s: Party A: generate public key test failed. Invalid output\n",
3519			       alg);
3520			err = -EINVAL;
3521			goto free_output;
3522		}
3523	}
3524
3525	/* Calculate shared secret key by using counter part (b) public key. */
3526	input_buf = kmemdup(vec->b_public, vec->b_public_size, GFP_KERNEL);
3527	if (!input_buf) {
3528		err = -ENOMEM;
3529		goto free_output;
3530	}
3531
3532	sg_init_one(&src, input_buf, vec->b_public_size);
3533	sg_init_one(&dst, output_buf, out_len_max);
3534	kpp_request_set_input(req, &src, vec->b_public_size);
3535	kpp_request_set_output(req, &dst, out_len_max);
3536	kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3537				 crypto_req_done, &wait);
3538	err = crypto_wait_req(crypto_kpp_compute_shared_secret(req), &wait);
3539	if (err) {
3540		pr_err("alg: %s: Party A: compute shared secret test failed. err %d\n",
3541		       alg, err);
3542		goto free_all;
3543	}
3544
3545	if (vec->genkey) {
3546		/* Save the shared secret obtained by party A */
3547		a_ss = kmemdup(sg_virt(req->dst), vec->expected_ss_size, GFP_KERNEL);
3548		if (!a_ss) {
3549			err = -ENOMEM;
3550			goto free_all;
3551		}
3552
3553		/*
3554		 * Calculate party B's shared secret by using party A's
3555		 * public key.
3556		 */
3557		err = crypto_kpp_set_secret(tfm, vec->b_secret,
3558					    vec->b_secret_size);
3559		if (err < 0)
3560			goto free_all;
3561
3562		sg_init_one(&src, a_public, vec->expected_a_public_size);
3563		sg_init_one(&dst, output_buf, out_len_max);
3564		kpp_request_set_input(req, &src, vec->expected_a_public_size);
3565		kpp_request_set_output(req, &dst, out_len_max);
3566		kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3567					 crypto_req_done, &wait);
3568		err = crypto_wait_req(crypto_kpp_compute_shared_secret(req),
3569				      &wait);
3570		if (err) {
3571			pr_err("alg: %s: Party B: compute shared secret failed. err %d\n",
3572			       alg, err);
3573			goto free_all;
3574		}
3575
3576		shared_secret = a_ss;
3577	} else {
3578		shared_secret = (void *)vec->expected_ss;
 
 
3579	}
3580
3581	/*
3582	 * verify shared secret from which the user will derive
3583	 * secret key by executing whatever hash it has chosen
3584	 */
3585	if (memcmp(shared_secret, sg_virt(req->dst),
3586		   vec->expected_ss_size)) {
3587		pr_err("alg: %s: compute shared secret test failed. Invalid output\n",
3588		       alg);
3589		err = -EINVAL;
3590	}
3591
3592free_all:
3593	kfree(a_ss);
3594	kfree(input_buf);
3595free_output:
3596	kfree(a_public);
3597	kfree(output_buf);
3598free_req:
3599	kpp_request_free(req);
3600	return err;
3601}
3602
3603static int test_kpp(struct crypto_kpp *tfm, const char *alg,
3604		    const struct kpp_testvec *vecs, unsigned int tcount)
3605{
3606	int ret, i;
3607
3608	for (i = 0; i < tcount; i++) {
3609		ret = do_test_kpp(tfm, vecs++, alg);
3610		if (ret) {
3611			pr_err("alg: %s: test failed on vector %d, err=%d\n",
3612			       alg, i + 1, ret);
3613			return ret;
3614		}
3615	}
3616	return 0;
3617}
3618
3619static int alg_test_kpp(const struct alg_test_desc *desc, const char *driver,
3620			u32 type, u32 mask)
3621{
3622	struct crypto_kpp *tfm;
3623	int err = 0;
3624
3625	tfm = crypto_alloc_kpp(driver, type, mask);
3626	if (IS_ERR(tfm)) {
3627		pr_err("alg: kpp: Failed to load tfm for %s: %ld\n",
3628		       driver, PTR_ERR(tfm));
3629		return PTR_ERR(tfm);
3630	}
3631	if (desc->suite.kpp.vecs)
3632		err = test_kpp(tfm, desc->alg, desc->suite.kpp.vecs,
3633			       desc->suite.kpp.count);
3634
3635	crypto_free_kpp(tfm);
3636	return err;
3637}
 
 
3638
3639static u8 *test_pack_u32(u8 *dst, u32 val)
3640{
3641	memcpy(dst, &val, sizeof(val));
3642	return dst + sizeof(val);
3643}
3644
3645static int test_akcipher_one(struct crypto_akcipher *tfm,
3646			     const struct akcipher_testvec *vecs)
3647{
3648	char *xbuf[XBUFSIZE];
3649	struct akcipher_request *req;
3650	void *outbuf_enc = NULL;
3651	void *outbuf_dec = NULL;
3652	struct crypto_wait wait;
3653	unsigned int out_len_max, out_len = 0;
3654	int err = -ENOMEM;
3655	struct scatterlist src, dst, src_tab[3];
3656	const char *m, *c;
3657	unsigned int m_size, c_size;
3658	const char *op;
3659	u8 *key, *ptr;
3660
3661	if (testmgr_alloc_buf(xbuf))
3662		return err;
3663
3664	req = akcipher_request_alloc(tfm, GFP_KERNEL);
3665	if (!req)
3666		goto free_xbuf;
3667
3668	crypto_init_wait(&wait);
3669
3670	key = kmalloc(vecs->key_len + sizeof(u32) * 2 + vecs->param_len,
3671		      GFP_KERNEL);
3672	if (!key)
3673		goto free_xbuf;
3674	memcpy(key, vecs->key, vecs->key_len);
3675	ptr = key + vecs->key_len;
3676	ptr = test_pack_u32(ptr, vecs->algo);
3677	ptr = test_pack_u32(ptr, vecs->param_len);
3678	memcpy(ptr, vecs->params, vecs->param_len);
3679
3680	if (vecs->public_key_vec)
3681		err = crypto_akcipher_set_pub_key(tfm, key, vecs->key_len);
3682	else
3683		err = crypto_akcipher_set_priv_key(tfm, key, vecs->key_len);
3684	if (err)
3685		goto free_req;
3686
3687	/*
3688	 * First run test which do not require a private key, such as
3689	 * encrypt or verify.
3690	 */
3691	err = -ENOMEM;
3692	out_len_max = crypto_akcipher_maxsize(tfm);
3693	outbuf_enc = kzalloc(out_len_max, GFP_KERNEL);
3694	if (!outbuf_enc)
3695		goto free_req;
3696
3697	if (!vecs->siggen_sigver_test) {
3698		m = vecs->m;
3699		m_size = vecs->m_size;
3700		c = vecs->c;
3701		c_size = vecs->c_size;
3702		op = "encrypt";
3703	} else {
3704		/* Swap args so we could keep plaintext (digest)
3705		 * in vecs->m, and cooked signature in vecs->c.
3706		 */
3707		m = vecs->c; /* signature */
3708		m_size = vecs->c_size;
3709		c = vecs->m; /* digest */
3710		c_size = vecs->m_size;
3711		op = "verify";
3712	}
3713
3714	if (WARN_ON(m_size > PAGE_SIZE))
3715		goto free_all;
3716	memcpy(xbuf[0], m, m_size);
3717
3718	sg_init_table(src_tab, 3);
3719	sg_set_buf(&src_tab[0], xbuf[0], 8);
3720	sg_set_buf(&src_tab[1], xbuf[0] + 8, m_size - 8);
3721	if (vecs->siggen_sigver_test) {
3722		if (WARN_ON(c_size > PAGE_SIZE))
3723			goto free_all;
3724		memcpy(xbuf[1], c, c_size);
3725		sg_set_buf(&src_tab[2], xbuf[1], c_size);
3726		akcipher_request_set_crypt(req, src_tab, NULL, m_size, c_size);
3727	} else {
3728		sg_init_one(&dst, outbuf_enc, out_len_max);
3729		akcipher_request_set_crypt(req, src_tab, &dst, m_size,
3730					   out_len_max);
3731	}
3732	akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3733				      crypto_req_done, &wait);
3734
3735	err = crypto_wait_req(vecs->siggen_sigver_test ?
3736			      /* Run asymmetric signature verification */
3737			      crypto_akcipher_verify(req) :
3738			      /* Run asymmetric encrypt */
3739			      crypto_akcipher_encrypt(req), &wait);
3740	if (err) {
3741		pr_err("alg: akcipher: %s test failed. err %d\n", op, err);
3742		goto free_all;
3743	}
3744	if (!vecs->siggen_sigver_test) {
3745		if (req->dst_len != c_size) {
3746			pr_err("alg: akcipher: %s test failed. Invalid output len\n",
3747			       op);
3748			err = -EINVAL;
3749			goto free_all;
3750		}
3751		/* verify that encrypted message is equal to expected */
3752		if (memcmp(c, outbuf_enc, c_size) != 0) {
3753			pr_err("alg: akcipher: %s test failed. Invalid output\n",
3754			       op);
3755			hexdump(outbuf_enc, c_size);
3756			err = -EINVAL;
3757			goto free_all;
3758		}
3759	}
3760
3761	/*
3762	 * Don't invoke (decrypt or sign) test which require a private key
3763	 * for vectors with only a public key.
3764	 */
3765	if (vecs->public_key_vec) {
3766		err = 0;
3767		goto free_all;
3768	}
3769	outbuf_dec = kzalloc(out_len_max, GFP_KERNEL);
3770	if (!outbuf_dec) {
3771		err = -ENOMEM;
3772		goto free_all;
3773	}
3774
3775	op = vecs->siggen_sigver_test ? "sign" : "decrypt";
3776	if (WARN_ON(c_size > PAGE_SIZE))
3777		goto free_all;
3778	memcpy(xbuf[0], c, c_size);
3779
3780	sg_init_one(&src, xbuf[0], c_size);
3781	sg_init_one(&dst, outbuf_dec, out_len_max);
3782	crypto_init_wait(&wait);
3783	akcipher_request_set_crypt(req, &src, &dst, c_size, out_len_max);
3784
3785	err = crypto_wait_req(vecs->siggen_sigver_test ?
3786			      /* Run asymmetric signature generation */
3787			      crypto_akcipher_sign(req) :
3788			      /* Run asymmetric decrypt */
3789			      crypto_akcipher_decrypt(req), &wait);
3790	if (err) {
3791		pr_err("alg: akcipher: %s test failed. err %d\n", op, err);
3792		goto free_all;
3793	}
3794	out_len = req->dst_len;
3795	if (out_len < m_size) {
3796		pr_err("alg: akcipher: %s test failed. Invalid output len %u\n",
3797		       op, out_len);
3798		err = -EINVAL;
3799		goto free_all;
3800	}
3801	/* verify that decrypted message is equal to the original msg */
3802	if (memchr_inv(outbuf_dec, 0, out_len - m_size) ||
3803	    memcmp(m, outbuf_dec + out_len - m_size, m_size)) {
3804		pr_err("alg: akcipher: %s test failed. Invalid output\n", op);
3805		hexdump(outbuf_dec, out_len);
3806		err = -EINVAL;
3807	}
3808free_all:
3809	kfree(outbuf_dec);
3810	kfree(outbuf_enc);
3811free_req:
3812	akcipher_request_free(req);
3813	kfree(key);
3814free_xbuf:
3815	testmgr_free_buf(xbuf);
3816	return err;
3817}
3818
3819static int test_akcipher(struct crypto_akcipher *tfm, const char *alg,
3820			 const struct akcipher_testvec *vecs,
3821			 unsigned int tcount)
3822{
3823	const char *algo =
3824		crypto_tfm_alg_driver_name(crypto_akcipher_tfm(tfm));
3825	int ret, i;
3826
3827	for (i = 0; i < tcount; i++) {
3828		ret = test_akcipher_one(tfm, vecs++);
3829		if (!ret)
3830			continue;
3831
3832		pr_err("alg: akcipher: test %d failed for %s, err=%d\n",
3833		       i + 1, algo, ret);
3834		return ret;
 
 
3835	}
3836	return 0;
3837}
3838
3839static int alg_test_akcipher(const struct alg_test_desc *desc,
3840			     const char *driver, u32 type, u32 mask)
3841{
3842	struct crypto_akcipher *tfm;
3843	int err = 0;
3844
3845	tfm = crypto_alloc_akcipher(driver, type, mask);
3846	if (IS_ERR(tfm)) {
3847		pr_err("alg: akcipher: Failed to load tfm for %s: %ld\n",
3848		       driver, PTR_ERR(tfm));
3849		return PTR_ERR(tfm);
3850	}
3851	if (desc->suite.akcipher.vecs)
3852		err = test_akcipher(tfm, desc->alg, desc->suite.akcipher.vecs,
3853				    desc->suite.akcipher.count);
3854
3855	crypto_free_akcipher(tfm);
3856	return err;
3857}
3858
3859static int alg_test_null(const struct alg_test_desc *desc,
3860			     const char *driver, u32 type, u32 mask)
3861{
3862	return 0;
3863}
3864
3865#define __VECS(tv)	{ .vecs = tv, .count = ARRAY_SIZE(tv) }
3866
3867/* Please keep this list sorted by algorithm name. */
3868static const struct alg_test_desc alg_test_descs[] = {
3869	{
3870		.alg = "adiantum(xchacha12,aes)",
3871		.generic_driver = "adiantum(xchacha12-generic,aes-generic,nhpoly1305-generic)",
3872		.test = alg_test_skcipher,
3873		.suite = {
3874			.cipher = __VECS(adiantum_xchacha12_aes_tv_template)
3875		},
3876	}, {
3877		.alg = "adiantum(xchacha20,aes)",
3878		.generic_driver = "adiantum(xchacha20-generic,aes-generic,nhpoly1305-generic)",
3879		.test = alg_test_skcipher,
3880		.suite = {
3881			.cipher = __VECS(adiantum_xchacha20_aes_tv_template)
3882		},
3883	}, {
3884		.alg = "aegis128",
3885		.test = alg_test_aead,
3886		.suite = {
3887			.aead = __VECS(aegis128_tv_template)
3888		}
3889	}, {
3890		.alg = "ansi_cprng",
3891		.test = alg_test_cprng,
3892		.suite = {
3893			.cprng = __VECS(ansi_cprng_aes_tv_template)
3894		}
3895	}, {
3896		.alg = "authenc(hmac(md5),ecb(cipher_null))",
3897		.test = alg_test_aead,
3898		.suite = {
3899			.aead = __VECS(hmac_md5_ecb_cipher_null_tv_template)
3900		}
3901	}, {
3902		.alg = "authenc(hmac(sha1),cbc(aes))",
3903		.test = alg_test_aead,
 
 
 
3904		.fips_allowed = 1,
3905		.suite = {
3906			.aead = __VECS(hmac_sha1_aes_cbc_tv_temp)
3907		}
3908	}, {
3909		.alg = "authenc(hmac(sha1),cbc(des))",
3910		.test = alg_test_aead,
3911		.suite = {
3912			.aead = __VECS(hmac_sha1_des_cbc_tv_temp)
3913		}
3914	}, {
3915		.alg = "authenc(hmac(sha1),cbc(des3_ede))",
3916		.test = alg_test_aead,
3917		.fips_allowed = 1,
3918		.suite = {
3919			.aead = __VECS(hmac_sha1_des3_ede_cbc_tv_temp)
3920		}
3921	}, {
3922		.alg = "authenc(hmac(sha1),ctr(aes))",
3923		.test = alg_test_null,
3924		.fips_allowed = 1,
3925	}, {
3926		.alg = "authenc(hmac(sha1),ecb(cipher_null))",
3927		.test = alg_test_aead,
3928		.suite = {
3929			.aead = __VECS(hmac_sha1_ecb_cipher_null_tv_temp)
3930		}
3931	}, {
3932		.alg = "authenc(hmac(sha1),rfc3686(ctr(aes)))",
3933		.test = alg_test_null,
3934		.fips_allowed = 1,
3935	}, {
3936		.alg = "authenc(hmac(sha224),cbc(des))",
3937		.test = alg_test_aead,
3938		.suite = {
3939			.aead = __VECS(hmac_sha224_des_cbc_tv_temp)
3940		}
3941	}, {
3942		.alg = "authenc(hmac(sha224),cbc(des3_ede))",
3943		.test = alg_test_aead,
3944		.fips_allowed = 1,
3945		.suite = {
3946			.aead = __VECS(hmac_sha224_des3_ede_cbc_tv_temp)
3947		}
3948	}, {
3949		.alg = "authenc(hmac(sha256),cbc(aes))",
3950		.test = alg_test_aead,
 
 
 
3951		.fips_allowed = 1,
3952		.suite = {
3953			.aead = __VECS(hmac_sha256_aes_cbc_tv_temp)
3954		}
3955	}, {
3956		.alg = "authenc(hmac(sha256),cbc(des))",
3957		.test = alg_test_aead,
3958		.suite = {
3959			.aead = __VECS(hmac_sha256_des_cbc_tv_temp)
3960		}
3961	}, {
3962		.alg = "authenc(hmac(sha256),cbc(des3_ede))",
3963		.test = alg_test_aead,
3964		.fips_allowed = 1,
3965		.suite = {
3966			.aead = __VECS(hmac_sha256_des3_ede_cbc_tv_temp)
3967		}
3968	}, {
3969		.alg = "authenc(hmac(sha256),ctr(aes))",
3970		.test = alg_test_null,
3971		.fips_allowed = 1,
3972	}, {
3973		.alg = "authenc(hmac(sha256),rfc3686(ctr(aes)))",
3974		.test = alg_test_null,
3975		.fips_allowed = 1,
3976	}, {
3977		.alg = "authenc(hmac(sha384),cbc(des))",
3978		.test = alg_test_aead,
3979		.suite = {
3980			.aead = __VECS(hmac_sha384_des_cbc_tv_temp)
3981		}
3982	}, {
3983		.alg = "authenc(hmac(sha384),cbc(des3_ede))",
3984		.test = alg_test_aead,
3985		.fips_allowed = 1,
3986		.suite = {
3987			.aead = __VECS(hmac_sha384_des3_ede_cbc_tv_temp)
3988		}
3989	}, {
3990		.alg = "authenc(hmac(sha384),ctr(aes))",
3991		.test = alg_test_null,
3992		.fips_allowed = 1,
3993	}, {
3994		.alg = "authenc(hmac(sha384),rfc3686(ctr(aes)))",
 
 
 
3995		.test = alg_test_null,
3996		.fips_allowed = 1,
3997	}, {
3998		.alg = "authenc(hmac(sha512),cbc(aes))",
 
3999		.fips_allowed = 1,
 
 
 
 
 
 
 
 
4000		.test = alg_test_aead,
 
4001		.suite = {
4002			.aead = __VECS(hmac_sha512_aes_cbc_tv_temp)
 
 
 
 
 
 
 
 
 
4003		}
4004	}, {
4005		.alg = "authenc(hmac(sha512),cbc(des))",
4006		.test = alg_test_aead,
 
4007		.suite = {
4008			.aead = __VECS(hmac_sha512_des_cbc_tv_temp)
 
 
 
 
 
4009		}
4010	}, {
4011		.alg = "authenc(hmac(sha512),cbc(des3_ede))",
4012		.test = alg_test_aead,
4013		.fips_allowed = 1,
4014		.suite = {
4015			.aead = __VECS(hmac_sha512_des3_ede_cbc_tv_temp)
 
 
 
 
 
 
 
 
 
4016		}
4017	}, {
4018		.alg = "authenc(hmac(sha512),ctr(aes))",
4019		.test = alg_test_null,
4020		.fips_allowed = 1,
 
 
 
 
 
 
 
 
4021	}, {
4022		.alg = "authenc(hmac(sha512),rfc3686(ctr(aes)))",
4023		.test = alg_test_null,
4024		.fips_allowed = 1,
 
 
 
 
 
 
 
 
4025	}, {
4026		.alg = "cbc(aes)",
4027		.test = alg_test_skcipher,
4028		.fips_allowed = 1,
4029		.suite = {
4030			.cipher = __VECS(aes_cbc_tv_template)
4031		},
 
 
 
 
 
 
 
 
 
4032	}, {
4033		.alg = "cbc(anubis)",
4034		.test = alg_test_skcipher,
4035		.suite = {
4036			.cipher = __VECS(anubis_cbc_tv_template)
4037		},
 
 
 
 
 
 
 
 
 
4038	}, {
4039		.alg = "cbc(blowfish)",
4040		.test = alg_test_skcipher,
4041		.suite = {
4042			.cipher = __VECS(bf_cbc_tv_template)
4043		},
 
 
 
 
 
 
 
 
 
4044	}, {
4045		.alg = "cbc(camellia)",
4046		.test = alg_test_skcipher,
4047		.suite = {
4048			.cipher = __VECS(camellia_cbc_tv_template)
4049		},
 
 
 
 
 
 
 
 
 
4050	}, {
4051		.alg = "cbc(cast5)",
4052		.test = alg_test_skcipher,
4053		.suite = {
4054			.cipher = __VECS(cast5_cbc_tv_template)
4055		},
 
 
 
 
 
 
 
 
 
4056	}, {
4057		.alg = "cbc(cast6)",
4058		.test = alg_test_skcipher,
4059		.suite = {
4060			.cipher = __VECS(cast6_cbc_tv_template)
4061		},
 
 
 
 
 
 
 
 
 
4062	}, {
4063		.alg = "cbc(des)",
4064		.test = alg_test_skcipher,
4065		.suite = {
4066			.cipher = __VECS(des_cbc_tv_template)
4067		},
 
 
 
 
 
 
 
 
 
4068	}, {
4069		.alg = "cbc(des3_ede)",
4070		.test = alg_test_skcipher,
4071		.fips_allowed = 1,
4072		.suite = {
4073			.cipher = __VECS(des3_ede_cbc_tv_template)
4074		},
4075	}, {
4076		/* Same as cbc(aes) except the key is stored in
4077		 * hardware secure memory which we reference by index
4078		 */
4079		.alg = "cbc(paes)",
4080		.test = alg_test_null,
4081		.fips_allowed = 1,
4082	}, {
4083		/* Same as cbc(sm4) except the key is stored in
4084		 * hardware secure memory which we reference by index
4085		 */
4086		.alg = "cbc(psm4)",
4087		.test = alg_test_null,
4088	}, {
4089		.alg = "cbc(serpent)",
4090		.test = alg_test_skcipher,
4091		.suite = {
4092			.cipher = __VECS(serpent_cbc_tv_template)
4093		},
4094	}, {
4095		.alg = "cbc(sm4)",
4096		.test = alg_test_skcipher,
4097		.suite = {
4098			.cipher = __VECS(sm4_cbc_tv_template)
 
 
 
4099		}
4100	}, {
4101		.alg = "cbc(twofish)",
4102		.test = alg_test_skcipher,
4103		.suite = {
4104			.cipher = __VECS(tf_cbc_tv_template)
4105		},
4106	}, {
4107		.alg = "cbcmac(aes)",
4108		.fips_allowed = 1,
4109		.test = alg_test_hash,
4110		.suite = {
4111			.hash = __VECS(aes_cbcmac_tv_template)
 
 
4112		}
4113	}, {
4114		.alg = "ccm(aes)",
4115		.generic_driver = "ccm_base(ctr(aes-generic),cbcmac(aes-generic))",
4116		.test = alg_test_aead,
4117		.fips_allowed = 1,
4118		.suite = {
4119			.aead = __VECS(aes_ccm_tv_template)
 
 
 
 
 
 
 
 
 
4120		}
4121	}, {
4122		.alg = "cfb(aes)",
4123		.test = alg_test_skcipher,
4124		.fips_allowed = 1,
4125		.suite = {
4126			.cipher = __VECS(aes_cfb_tv_template)
4127		},
4128	}, {
4129		.alg = "chacha20",
4130		.test = alg_test_skcipher,
4131		.suite = {
4132			.cipher = __VECS(chacha20_tv_template)
4133		},
4134	}, {
4135		.alg = "cmac(aes)",
4136		.fips_allowed = 1,
4137		.test = alg_test_hash,
4138		.suite = {
4139			.hash = __VECS(aes_cmac128_tv_template)
 
 
 
4140		}
4141	}, {
4142		.alg = "cmac(des3_ede)",
4143		.fips_allowed = 1,
4144		.test = alg_test_hash,
4145		.suite = {
4146			.hash = __VECS(des3_ede_cmac64_tv_template)
 
 
 
4147		}
4148	}, {
4149		.alg = "compress_null",
4150		.test = alg_test_null,
4151	}, {
4152		.alg = "crc32",
4153		.test = alg_test_hash,
4154		.fips_allowed = 1,
4155		.suite = {
4156			.hash = __VECS(crc32_tv_template)
4157		}
4158	}, {
4159		.alg = "crc32c",
4160		.test = alg_test_crc32c,
4161		.fips_allowed = 1,
4162		.suite = {
4163			.hash = __VECS(crc32c_tv_template)
 
 
 
4164		}
4165	}, {
4166		.alg = "crct10dif",
4167		.test = alg_test_hash,
4168		.fips_allowed = 1,
4169		.suite = {
4170			.hash = __VECS(crct10dif_tv_template)
 
 
 
4171		}
4172	}, {
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4173		.alg = "ctr(aes)",
4174		.test = alg_test_skcipher,
4175		.fips_allowed = 1,
4176		.suite = {
4177			.cipher = __VECS(aes_ctr_tv_template)
 
 
 
 
 
 
 
 
 
4178		}
4179	}, {
4180		.alg = "ctr(blowfish)",
4181		.test = alg_test_skcipher,
4182		.suite = {
4183			.cipher = __VECS(bf_ctr_tv_template)
 
 
 
 
 
 
 
 
 
4184		}
4185	}, {
4186		.alg = "ctr(camellia)",
4187		.test = alg_test_skcipher,
4188		.suite = {
4189			.cipher = __VECS(camellia_ctr_tv_template)
 
 
 
 
 
 
 
 
 
4190		}
4191	}, {
4192		.alg = "ctr(cast5)",
4193		.test = alg_test_skcipher,
4194		.suite = {
4195			.cipher = __VECS(cast5_ctr_tv_template)
 
 
 
 
 
 
 
 
 
4196		}
4197	}, {
4198		.alg = "ctr(cast6)",
4199		.test = alg_test_skcipher,
4200		.suite = {
4201			.cipher = __VECS(cast6_ctr_tv_template)
 
 
 
 
 
 
 
 
 
4202		}
4203	}, {
4204		.alg = "ctr(des)",
4205		.test = alg_test_skcipher,
4206		.suite = {
4207			.cipher = __VECS(des_ctr_tv_template)
 
 
 
 
 
 
 
 
 
4208		}
4209	}, {
4210		.alg = "ctr(des3_ede)",
4211		.test = alg_test_skcipher,
4212		.fips_allowed = 1,
4213		.suite = {
4214			.cipher = __VECS(des3_ede_ctr_tv_template)
 
 
 
 
 
 
 
 
 
4215		}
4216	}, {
4217		/* Same as ctr(aes) except the key is stored in
4218		 * hardware secure memory which we reference by index
4219		 */
4220		.alg = "ctr(paes)",
4221		.test = alg_test_null,
4222		.fips_allowed = 1,
4223	}, {
4224
4225		/* Same as ctr(sm4) except the key is stored in
4226		 * hardware secure memory which we reference by index
4227		 */
4228		.alg = "ctr(psm4)",
4229		.test = alg_test_null,
4230	}, {
4231		.alg = "ctr(serpent)",
4232		.test = alg_test_skcipher,
4233		.suite = {
4234			.cipher = __VECS(serpent_ctr_tv_template)
4235		}
4236	}, {
4237		.alg = "ctr(sm4)",
4238		.test = alg_test_skcipher,
4239		.suite = {
4240			.cipher = __VECS(sm4_ctr_tv_template)
 
 
 
4241		}
4242	}, {
4243		.alg = "ctr(twofish)",
4244		.test = alg_test_skcipher,
4245		.suite = {
4246			.cipher = __VECS(tf_ctr_tv_template)
 
 
 
 
 
 
 
 
 
4247		}
4248	}, {
4249		.alg = "cts(cbc(aes))",
4250		.test = alg_test_skcipher,
4251		.fips_allowed = 1,
4252		.suite = {
4253			.cipher = __VECS(cts_mode_tv_template)
 
 
 
 
 
 
 
 
 
4254		}
4255	}, {
4256		/* Same as cts(cbc((aes)) except the key is stored in
4257		 * hardware secure memory which we reference by index
4258		 */
4259		.alg = "cts(cbc(paes))",
4260		.test = alg_test_null,
4261		.fips_allowed = 1,
4262	}, {
4263		.alg = "deflate",
4264		.test = alg_test_comp,
4265		.fips_allowed = 1,
4266		.suite = {
4267			.comp = {
4268				.comp = __VECS(deflate_comp_tv_template),
4269				.decomp = __VECS(deflate_decomp_tv_template)
 
 
 
 
 
 
4270			}
4271		}
4272	}, {
4273		.alg = "dh",
4274		.test = alg_test_kpp,
4275		.fips_allowed = 1,
4276		.suite = {
4277			.kpp = __VECS(dh_tv_template)
4278		}
4279	}, {
4280		.alg = "digest_null",
4281		.test = alg_test_null,
4282	}, {
4283		.alg = "drbg_nopr_ctr_aes128",
4284		.test = alg_test_drbg,
4285		.fips_allowed = 1,
4286		.suite = {
4287			.drbg = __VECS(drbg_nopr_ctr_aes128_tv_template)
4288		}
4289	}, {
4290		.alg = "drbg_nopr_ctr_aes192",
4291		.test = alg_test_drbg,
4292		.fips_allowed = 1,
4293		.suite = {
4294			.drbg = __VECS(drbg_nopr_ctr_aes192_tv_template)
4295		}
4296	}, {
4297		.alg = "drbg_nopr_ctr_aes256",
4298		.test = alg_test_drbg,
4299		.fips_allowed = 1,
4300		.suite = {
4301			.drbg = __VECS(drbg_nopr_ctr_aes256_tv_template)
4302		}
4303	}, {
4304		/*
4305		 * There is no need to specifically test the DRBG with every
4306		 * backend cipher -- covered by drbg_nopr_hmac_sha256 test
4307		 */
4308		.alg = "drbg_nopr_hmac_sha1",
4309		.fips_allowed = 1,
4310		.test = alg_test_null,
4311	}, {
4312		.alg = "drbg_nopr_hmac_sha256",
4313		.test = alg_test_drbg,
4314		.fips_allowed = 1,
4315		.suite = {
4316			.drbg = __VECS(drbg_nopr_hmac_sha256_tv_template)
4317		}
4318	}, {
4319		/* covered by drbg_nopr_hmac_sha256 test */
4320		.alg = "drbg_nopr_hmac_sha384",
4321		.fips_allowed = 1,
4322		.test = alg_test_null,
4323	}, {
4324		.alg = "drbg_nopr_hmac_sha512",
4325		.test = alg_test_null,
4326		.fips_allowed = 1,
4327	}, {
4328		.alg = "drbg_nopr_sha1",
4329		.fips_allowed = 1,
4330		.test = alg_test_null,
4331	}, {
4332		.alg = "drbg_nopr_sha256",
4333		.test = alg_test_drbg,
4334		.fips_allowed = 1,
4335		.suite = {
4336			.drbg = __VECS(drbg_nopr_sha256_tv_template)
4337		}
4338	}, {
4339		/* covered by drbg_nopr_sha256 test */
4340		.alg = "drbg_nopr_sha384",
4341		.fips_allowed = 1,
4342		.test = alg_test_null,
4343	}, {
4344		.alg = "drbg_nopr_sha512",
4345		.fips_allowed = 1,
4346		.test = alg_test_null,
4347	}, {
4348		.alg = "drbg_pr_ctr_aes128",
4349		.test = alg_test_drbg,
4350		.fips_allowed = 1,
4351		.suite = {
4352			.drbg = __VECS(drbg_pr_ctr_aes128_tv_template)
4353		}
4354	}, {
4355		/* covered by drbg_pr_ctr_aes128 test */
4356		.alg = "drbg_pr_ctr_aes192",
4357		.fips_allowed = 1,
4358		.test = alg_test_null,
4359	}, {
4360		.alg = "drbg_pr_ctr_aes256",
4361		.fips_allowed = 1,
4362		.test = alg_test_null,
4363	}, {
4364		.alg = "drbg_pr_hmac_sha1",
4365		.fips_allowed = 1,
4366		.test = alg_test_null,
4367	}, {
4368		.alg = "drbg_pr_hmac_sha256",
4369		.test = alg_test_drbg,
4370		.fips_allowed = 1,
4371		.suite = {
4372			.drbg = __VECS(drbg_pr_hmac_sha256_tv_template)
4373		}
4374	}, {
4375		/* covered by drbg_pr_hmac_sha256 test */
4376		.alg = "drbg_pr_hmac_sha384",
4377		.fips_allowed = 1,
4378		.test = alg_test_null,
4379	}, {
4380		.alg = "drbg_pr_hmac_sha512",
4381		.test = alg_test_null,
4382		.fips_allowed = 1,
4383	}, {
4384		.alg = "drbg_pr_sha1",
4385		.fips_allowed = 1,
4386		.test = alg_test_null,
4387	}, {
4388		.alg = "drbg_pr_sha256",
4389		.test = alg_test_drbg,
4390		.fips_allowed = 1,
4391		.suite = {
4392			.drbg = __VECS(drbg_pr_sha256_tv_template)
4393		}
4394	}, {
4395		/* covered by drbg_pr_sha256 test */
4396		.alg = "drbg_pr_sha384",
4397		.fips_allowed = 1,
4398		.test = alg_test_null,
4399	}, {
4400		.alg = "drbg_pr_sha512",
4401		.fips_allowed = 1,
4402		.test = alg_test_null,
4403	}, {
4404		.alg = "ecb(aes)",
4405		.test = alg_test_skcipher,
4406		.fips_allowed = 1,
4407		.suite = {
4408			.cipher = __VECS(aes_tv_template)
 
 
 
 
 
 
 
 
 
4409		}
4410	}, {
4411		.alg = "ecb(anubis)",
4412		.test = alg_test_skcipher,
4413		.suite = {
4414			.cipher = __VECS(anubis_tv_template)
 
 
 
 
 
 
 
 
 
4415		}
4416	}, {
4417		.alg = "ecb(arc4)",
4418		.generic_driver = "ecb(arc4)-generic",
4419		.test = alg_test_skcipher,
4420		.suite = {
4421			.cipher = __VECS(arc4_tv_template)
 
 
 
 
 
 
 
 
 
4422		}
4423	}, {
4424		.alg = "ecb(blowfish)",
4425		.test = alg_test_skcipher,
4426		.suite = {
4427			.cipher = __VECS(bf_tv_template)
 
 
 
 
 
 
 
 
 
4428		}
4429	}, {
4430		.alg = "ecb(camellia)",
4431		.test = alg_test_skcipher,
4432		.suite = {
4433			.cipher = __VECS(camellia_tv_template)
 
 
 
 
 
 
 
 
 
4434		}
4435	}, {
4436		.alg = "ecb(cast5)",
4437		.test = alg_test_skcipher,
4438		.suite = {
4439			.cipher = __VECS(cast5_tv_template)
 
 
 
 
 
 
 
 
 
4440		}
4441	}, {
4442		.alg = "ecb(cast6)",
4443		.test = alg_test_skcipher,
4444		.suite = {
4445			.cipher = __VECS(cast6_tv_template)
 
 
 
 
 
 
 
 
 
4446		}
4447	}, {
4448		.alg = "ecb(cipher_null)",
4449		.test = alg_test_null,
4450		.fips_allowed = 1,
4451	}, {
4452		.alg = "ecb(des)",
4453		.test = alg_test_skcipher,
 
4454		.suite = {
4455			.cipher = __VECS(des_tv_template)
 
 
 
 
 
 
 
 
 
4456		}
4457	}, {
4458		.alg = "ecb(des3_ede)",
4459		.test = alg_test_skcipher,
4460		.fips_allowed = 1,
4461		.suite = {
4462			.cipher = __VECS(des3_ede_tv_template)
 
 
 
 
 
 
 
 
 
4463		}
4464	}, {
4465		.alg = "ecb(fcrypt)",
4466		.test = alg_test_skcipher,
4467		.suite = {
4468			.cipher = {
4469				.vecs = fcrypt_pcbc_tv_template,
4470				.count = 1
 
 
 
 
 
 
4471			}
4472		}
4473	}, {
4474		.alg = "ecb(khazad)",
4475		.test = alg_test_skcipher,
4476		.suite = {
4477			.cipher = __VECS(khazad_tv_template)
 
 
 
 
 
 
 
 
 
4478		}
4479	}, {
4480		/* Same as ecb(aes) except the key is stored in
4481		 * hardware secure memory which we reference by index
4482		 */
4483		.alg = "ecb(paes)",
4484		.test = alg_test_null,
4485		.fips_allowed = 1,
4486	}, {
4487		.alg = "ecb(seed)",
4488		.test = alg_test_skcipher,
4489		.suite = {
4490			.cipher = __VECS(seed_tv_template)
 
 
 
 
 
 
 
 
 
4491		}
4492	}, {
4493		.alg = "ecb(serpent)",
4494		.test = alg_test_skcipher,
4495		.suite = {
4496			.cipher = __VECS(serpent_tv_template)
4497		}
4498	}, {
4499		.alg = "ecb(sm4)",
4500		.test = alg_test_skcipher,
4501		.suite = {
4502			.cipher = __VECS(sm4_tv_template)
 
 
 
4503		}
4504	}, {
4505		.alg = "ecb(tea)",
4506		.test = alg_test_skcipher,
4507		.suite = {
4508			.cipher = __VECS(tea_tv_template)
 
 
 
 
 
 
 
 
 
4509		}
4510	}, {
4511		.alg = "ecb(tnepres)",
4512		.test = alg_test_skcipher,
4513		.suite = {
4514			.cipher = __VECS(tnepres_tv_template)
 
 
 
 
 
 
 
 
 
4515		}
4516	}, {
4517		.alg = "ecb(twofish)",
4518		.test = alg_test_skcipher,
4519		.suite = {
4520			.cipher = __VECS(tf_tv_template)
 
 
 
 
 
 
 
 
 
4521		}
4522	}, {
4523		.alg = "ecb(xeta)",
4524		.test = alg_test_skcipher,
4525		.suite = {
4526			.cipher = __VECS(xeta_tv_template)
 
 
 
 
 
 
 
 
 
4527		}
4528	}, {
4529		.alg = "ecb(xtea)",
4530		.test = alg_test_skcipher,
4531		.suite = {
4532			.cipher = __VECS(xtea_tv_template)
4533		}
4534	}, {
4535		.alg = "ecdh",
4536		.test = alg_test_kpp,
4537		.fips_allowed = 1,
4538		.suite = {
4539			.kpp = __VECS(ecdh_tv_template)
4540		}
4541	}, {
4542		.alg = "ecrdsa",
4543		.test = alg_test_akcipher,
4544		.suite = {
4545			.akcipher = __VECS(ecrdsa_tv_template)
4546		}
4547	}, {
4548		.alg = "essiv(authenc(hmac(sha256),cbc(aes)),sha256)",
4549		.test = alg_test_aead,
4550		.fips_allowed = 1,
4551		.suite = {
4552			.aead = __VECS(essiv_hmac_sha256_aes_cbc_tv_temp)
4553		}
4554	}, {
4555		.alg = "essiv(cbc(aes),sha256)",
4556		.test = alg_test_skcipher,
4557		.fips_allowed = 1,
4558		.suite = {
4559			.cipher = __VECS(essiv_aes_cbc_tv_template)
 
 
4560		}
4561	}, {
4562		.alg = "gcm(aes)",
4563		.generic_driver = "gcm_base(ctr(aes-generic),ghash-generic)",
4564		.test = alg_test_aead,
4565		.fips_allowed = 1,
4566		.suite = {
4567			.aead = __VECS(aes_gcm_tv_template)
 
 
 
4568		}
4569	}, {
4570		.alg = "ghash",
4571		.test = alg_test_hash,
4572		.fips_allowed = 1,
4573		.suite = {
4574			.hash = __VECS(ghash_tv_template)
 
 
 
4575		}
4576	}, {
4577		.alg = "hmac(md5)",
4578		.test = alg_test_hash,
4579		.suite = {
4580			.hash = __VECS(hmac_md5_tv_template)
 
 
 
4581		}
4582	}, {
4583		.alg = "hmac(rmd128)",
4584		.test = alg_test_hash,
4585		.suite = {
4586			.hash = __VECS(hmac_rmd128_tv_template)
 
 
 
4587		}
4588	}, {
4589		.alg = "hmac(rmd160)",
4590		.test = alg_test_hash,
4591		.suite = {
4592			.hash = __VECS(hmac_rmd160_tv_template)
 
 
 
4593		}
4594	}, {
4595		.alg = "hmac(sha1)",
4596		.test = alg_test_hash,
4597		.fips_allowed = 1,
4598		.suite = {
4599			.hash = __VECS(hmac_sha1_tv_template)
 
 
 
4600		}
4601	}, {
4602		.alg = "hmac(sha224)",
4603		.test = alg_test_hash,
4604		.fips_allowed = 1,
4605		.suite = {
4606			.hash = __VECS(hmac_sha224_tv_template)
 
 
 
4607		}
4608	}, {
4609		.alg = "hmac(sha256)",
4610		.test = alg_test_hash,
4611		.fips_allowed = 1,
4612		.suite = {
4613			.hash = __VECS(hmac_sha256_tv_template)
4614		}
4615	}, {
4616		.alg = "hmac(sha3-224)",
4617		.test = alg_test_hash,
4618		.fips_allowed = 1,
4619		.suite = {
4620			.hash = __VECS(hmac_sha3_224_tv_template)
4621		}
4622	}, {
4623		.alg = "hmac(sha3-256)",
4624		.test = alg_test_hash,
4625		.fips_allowed = 1,
4626		.suite = {
4627			.hash = __VECS(hmac_sha3_256_tv_template)
4628		}
4629	}, {
4630		.alg = "hmac(sha3-384)",
4631		.test = alg_test_hash,
4632		.fips_allowed = 1,
4633		.suite = {
4634			.hash = __VECS(hmac_sha3_384_tv_template)
4635		}
4636	}, {
4637		.alg = "hmac(sha3-512)",
4638		.test = alg_test_hash,
4639		.fips_allowed = 1,
4640		.suite = {
4641			.hash = __VECS(hmac_sha3_512_tv_template)
4642		}
4643	}, {
4644		.alg = "hmac(sha384)",
4645		.test = alg_test_hash,
4646		.fips_allowed = 1,
4647		.suite = {
4648			.hash = __VECS(hmac_sha384_tv_template)
 
 
 
4649		}
4650	}, {
4651		.alg = "hmac(sha512)",
4652		.test = alg_test_hash,
4653		.fips_allowed = 1,
4654		.suite = {
4655			.hash = __VECS(hmac_sha512_tv_template)
4656		}
4657	}, {
4658		.alg = "hmac(streebog256)",
4659		.test = alg_test_hash,
4660		.suite = {
4661			.hash = __VECS(hmac_streebog256_tv_template)
4662		}
4663	}, {
4664		.alg = "hmac(streebog512)",
4665		.test = alg_test_hash,
4666		.suite = {
4667			.hash = __VECS(hmac_streebog512_tv_template)
4668		}
4669	}, {
4670		.alg = "jitterentropy_rng",
4671		.fips_allowed = 1,
4672		.test = alg_test_null,
4673	}, {
4674		.alg = "kw(aes)",
4675		.test = alg_test_skcipher,
4676		.fips_allowed = 1,
4677		.suite = {
4678			.cipher = __VECS(aes_kw_tv_template)
4679		}
4680	}, {
4681		.alg = "lrw(aes)",
4682		.generic_driver = "lrw(ecb(aes-generic))",
4683		.test = alg_test_skcipher,
4684		.suite = {
4685			.cipher = __VECS(aes_lrw_tv_template)
 
 
 
 
 
 
 
 
 
4686		}
4687	}, {
4688		.alg = "lrw(camellia)",
4689		.generic_driver = "lrw(ecb(camellia-generic))",
4690		.test = alg_test_skcipher,
4691		.suite = {
4692			.cipher = __VECS(camellia_lrw_tv_template)
 
 
 
 
 
 
 
 
 
4693		}
4694	}, {
4695		.alg = "lrw(cast6)",
4696		.generic_driver = "lrw(ecb(cast6-generic))",
4697		.test = alg_test_skcipher,
4698		.suite = {
4699			.cipher = __VECS(cast6_lrw_tv_template)
 
 
 
 
 
 
 
 
 
4700		}
4701	}, {
4702		.alg = "lrw(serpent)",
4703		.generic_driver = "lrw(ecb(serpent-generic))",
4704		.test = alg_test_skcipher,
4705		.suite = {
4706			.cipher = __VECS(serpent_lrw_tv_template)
 
 
 
 
 
 
 
 
 
4707		}
4708	}, {
4709		.alg = "lrw(twofish)",
4710		.generic_driver = "lrw(ecb(twofish-generic))",
4711		.test = alg_test_skcipher,
4712		.suite = {
4713			.cipher = __VECS(tf_lrw_tv_template)
4714		}
4715	}, {
4716		.alg = "lz4",
4717		.test = alg_test_comp,
4718		.fips_allowed = 1,
4719		.suite = {
4720			.comp = {
4721				.comp = __VECS(lz4_comp_tv_template),
4722				.decomp = __VECS(lz4_decomp_tv_template)
4723			}
4724		}
4725	}, {
4726		.alg = "lz4hc",
4727		.test = alg_test_comp,
4728		.fips_allowed = 1,
4729		.suite = {
4730			.comp = {
4731				.comp = __VECS(lz4hc_comp_tv_template),
4732				.decomp = __VECS(lz4hc_decomp_tv_template)
4733			}
4734		}
4735	}, {
4736		.alg = "lzo",
4737		.test = alg_test_comp,
4738		.fips_allowed = 1,
4739		.suite = {
4740			.comp = {
4741				.comp = __VECS(lzo_comp_tv_template),
4742				.decomp = __VECS(lzo_decomp_tv_template)
4743			}
4744		}
4745	}, {
4746		.alg = "lzo-rle",
4747		.test = alg_test_comp,
4748		.fips_allowed = 1,
4749		.suite = {
4750			.comp = {
4751				.comp = __VECS(lzorle_comp_tv_template),
4752				.decomp = __VECS(lzorle_decomp_tv_template)
4753			}
4754		}
4755	}, {
4756		.alg = "md4",
4757		.test = alg_test_hash,
4758		.suite = {
4759			.hash = __VECS(md4_tv_template)
 
 
 
4760		}
4761	}, {
4762		.alg = "md5",
4763		.test = alg_test_hash,
4764		.suite = {
4765			.hash = __VECS(md5_tv_template)
 
 
 
4766		}
4767	}, {
4768		.alg = "michael_mic",
4769		.test = alg_test_hash,
4770		.suite = {
4771			.hash = __VECS(michael_mic_tv_template)
4772		}
4773	}, {
4774		.alg = "nhpoly1305",
4775		.test = alg_test_hash,
4776		.suite = {
4777			.hash = __VECS(nhpoly1305_tv_template)
4778		}
4779	}, {
4780		.alg = "ofb(aes)",
4781		.test = alg_test_skcipher,
4782		.fips_allowed = 1,
4783		.suite = {
4784			.cipher = __VECS(aes_ofb_tv_template)
 
 
 
 
 
 
 
 
 
4785		}
4786	}, {
4787		/* Same as ofb(aes) except the key is stored in
4788		 * hardware secure memory which we reference by index
4789		 */
4790		.alg = "ofb(paes)",
4791		.test = alg_test_null,
4792		.fips_allowed = 1,
4793	}, {
4794		.alg = "pcbc(fcrypt)",
4795		.test = alg_test_skcipher,
4796		.suite = {
4797			.cipher = __VECS(fcrypt_pcbc_tv_template)
4798		}
4799	}, {
4800		.alg = "pkcs1pad(rsa,sha224)",
4801		.test = alg_test_null,
4802		.fips_allowed = 1,
4803	}, {
4804		.alg = "pkcs1pad(rsa,sha256)",
4805		.test = alg_test_akcipher,
4806		.fips_allowed = 1,
4807		.suite = {
4808			.akcipher = __VECS(pkcs1pad_rsa_tv_template)
4809		}
4810	}, {
4811		.alg = "pkcs1pad(rsa,sha384)",
4812		.test = alg_test_null,
4813		.fips_allowed = 1,
4814	}, {
4815		.alg = "pkcs1pad(rsa,sha512)",
4816		.test = alg_test_null,
4817		.fips_allowed = 1,
4818	}, {
4819		.alg = "poly1305",
4820		.test = alg_test_hash,
4821		.suite = {
4822			.hash = __VECS(poly1305_tv_template)
4823		}
4824	}, {
4825		.alg = "rfc3686(ctr(aes))",
4826		.test = alg_test_skcipher,
4827		.fips_allowed = 1,
4828		.suite = {
4829			.cipher = __VECS(aes_ctr_rfc3686_tv_template)
 
 
 
 
 
 
 
 
 
4830		}
4831	}, {
4832		.alg = "rfc4106(gcm(aes))",
4833		.generic_driver = "rfc4106(gcm_base(ctr(aes-generic),ghash-generic))",
4834		.test = alg_test_aead,
4835		.fips_allowed = 1,
4836		.suite = {
4837			.aead = __VECS(aes_gcm_rfc4106_tv_template)
 
 
 
 
 
 
 
 
 
4838		}
4839	}, {
4840		.alg = "rfc4309(ccm(aes))",
4841		.generic_driver = "rfc4309(ccm_base(ctr(aes-generic),cbcmac(aes-generic)))",
4842		.test = alg_test_aead,
4843		.fips_allowed = 1,
4844		.suite = {
4845			.aead = __VECS(aes_ccm_rfc4309_tv_template)
 
 
 
 
 
 
 
 
 
4846		}
4847	}, {
4848		.alg = "rfc4543(gcm(aes))",
4849		.generic_driver = "rfc4543(gcm_base(ctr(aes-generic),ghash-generic))",
4850		.test = alg_test_aead,
4851		.suite = {
4852			.aead = __VECS(aes_gcm_rfc4543_tv_template)
4853		}
4854	}, {
4855		.alg = "rfc7539(chacha20,poly1305)",
4856		.test = alg_test_aead,
4857		.suite = {
4858			.aead = __VECS(rfc7539_tv_template)
4859		}
4860	}, {
4861		.alg = "rfc7539esp(chacha20,poly1305)",
4862		.test = alg_test_aead,
4863		.suite = {
4864			.aead = __VECS(rfc7539esp_tv_template)
4865		}
4866	}, {
4867		.alg = "rmd128",
4868		.test = alg_test_hash,
4869		.suite = {
4870			.hash = __VECS(rmd128_tv_template)
 
 
 
4871		}
4872	}, {
4873		.alg = "rmd160",
4874		.test = alg_test_hash,
4875		.suite = {
4876			.hash = __VECS(rmd160_tv_template)
 
 
 
4877		}
4878	}, {
4879		.alg = "rmd256",
4880		.test = alg_test_hash,
4881		.suite = {
4882			.hash = __VECS(rmd256_tv_template)
 
 
 
4883		}
4884	}, {
4885		.alg = "rmd320",
4886		.test = alg_test_hash,
4887		.suite = {
4888			.hash = __VECS(rmd320_tv_template)
4889		}
4890	}, {
4891		.alg = "rsa",
4892		.test = alg_test_akcipher,
4893		.fips_allowed = 1,
4894		.suite = {
4895			.akcipher = __VECS(rsa_tv_template)
4896		}
4897	}, {
4898		.alg = "salsa20",
4899		.test = alg_test_skcipher,
4900		.suite = {
4901			.cipher = __VECS(salsa20_stream_tv_template)
 
 
 
 
 
4902		}
4903	}, {
4904		.alg = "sha1",
4905		.test = alg_test_hash,
4906		.fips_allowed = 1,
4907		.suite = {
4908			.hash = __VECS(sha1_tv_template)
 
 
 
4909		}
4910	}, {
4911		.alg = "sha224",
4912		.test = alg_test_hash,
4913		.fips_allowed = 1,
4914		.suite = {
4915			.hash = __VECS(sha224_tv_template)
 
 
 
4916		}
4917	}, {
4918		.alg = "sha256",
4919		.test = alg_test_hash,
4920		.fips_allowed = 1,
4921		.suite = {
4922			.hash = __VECS(sha256_tv_template)
4923		}
4924	}, {
4925		.alg = "sha3-224",
4926		.test = alg_test_hash,
4927		.fips_allowed = 1,
4928		.suite = {
4929			.hash = __VECS(sha3_224_tv_template)
4930		}
4931	}, {
4932		.alg = "sha3-256",
4933		.test = alg_test_hash,
4934		.fips_allowed = 1,
4935		.suite = {
4936			.hash = __VECS(sha3_256_tv_template)
4937		}
4938	}, {
4939		.alg = "sha3-384",
4940		.test = alg_test_hash,
4941		.fips_allowed = 1,
4942		.suite = {
4943			.hash = __VECS(sha3_384_tv_template)
4944		}
4945	}, {
4946		.alg = "sha3-512",
4947		.test = alg_test_hash,
4948		.fips_allowed = 1,
4949		.suite = {
4950			.hash = __VECS(sha3_512_tv_template)
4951		}
4952	}, {
4953		.alg = "sha384",
4954		.test = alg_test_hash,
4955		.fips_allowed = 1,
4956		.suite = {
4957			.hash = __VECS(sha384_tv_template)
 
 
 
4958		}
4959	}, {
4960		.alg = "sha512",
4961		.test = alg_test_hash,
4962		.fips_allowed = 1,
4963		.suite = {
4964			.hash = __VECS(sha512_tv_template)
4965		}
4966	}, {
4967		.alg = "sm3",
4968		.test = alg_test_hash,
4969		.suite = {
4970			.hash = __VECS(sm3_tv_template)
4971		}
4972	}, {
4973		.alg = "streebog256",
4974		.test = alg_test_hash,
4975		.suite = {
4976			.hash = __VECS(streebog256_tv_template)
4977		}
4978	}, {
4979		.alg = "streebog512",
4980		.test = alg_test_hash,
4981		.suite = {
4982			.hash = __VECS(streebog512_tv_template)
4983		}
4984	}, {
4985		.alg = "tgr128",
4986		.test = alg_test_hash,
4987		.suite = {
4988			.hash = __VECS(tgr128_tv_template)
 
 
 
4989		}
4990	}, {
4991		.alg = "tgr160",
4992		.test = alg_test_hash,
4993		.suite = {
4994			.hash = __VECS(tgr160_tv_template)
 
 
 
4995		}
4996	}, {
4997		.alg = "tgr192",
4998		.test = alg_test_hash,
4999		.suite = {
5000			.hash = __VECS(tgr192_tv_template)
 
 
 
5001		}
5002	}, {
5003		.alg = "vmac64(aes)",
5004		.test = alg_test_hash,
5005		.suite = {
5006			.hash = __VECS(vmac64_aes_tv_template)
 
 
 
5007		}
5008	}, {
5009		.alg = "wp256",
5010		.test = alg_test_hash,
5011		.suite = {
5012			.hash = __VECS(wp256_tv_template)
 
 
 
5013		}
5014	}, {
5015		.alg = "wp384",
5016		.test = alg_test_hash,
5017		.suite = {
5018			.hash = __VECS(wp384_tv_template)
 
 
 
5019		}
5020	}, {
5021		.alg = "wp512",
5022		.test = alg_test_hash,
5023		.suite = {
5024			.hash = __VECS(wp512_tv_template)
 
 
 
5025		}
5026	}, {
5027		.alg = "xcbc(aes)",
5028		.test = alg_test_hash,
5029		.suite = {
5030			.hash = __VECS(aes_xcbc128_tv_template)
 
 
 
5031		}
5032	}, {
5033		.alg = "xchacha12",
5034		.test = alg_test_skcipher,
5035		.suite = {
5036			.cipher = __VECS(xchacha12_tv_template)
5037		},
5038	}, {
5039		.alg = "xchacha20",
5040		.test = alg_test_skcipher,
5041		.suite = {
5042			.cipher = __VECS(xchacha20_tv_template)
5043		},
5044	}, {
5045		.alg = "xts(aes)",
5046		.generic_driver = "xts(ecb(aes-generic))",
5047		.test = alg_test_skcipher,
5048		.fips_allowed = 1,
5049		.suite = {
5050			.cipher = __VECS(aes_xts_tv_template)
 
 
 
 
 
 
 
 
 
5051		}
5052	}, {
5053		.alg = "xts(camellia)",
5054		.generic_driver = "xts(ecb(camellia-generic))",
5055		.test = alg_test_skcipher,
5056		.suite = {
5057			.cipher = __VECS(camellia_xts_tv_template)
 
 
 
 
 
 
 
 
 
5058		}
5059	}, {
5060		.alg = "xts(cast6)",
5061		.generic_driver = "xts(ecb(cast6-generic))",
5062		.test = alg_test_skcipher,
5063		.suite = {
5064			.cipher = __VECS(cast6_xts_tv_template)
 
 
 
 
 
 
 
 
 
5065		}
5066	}, {
5067		/* Same as xts(aes) except the key is stored in
5068		 * hardware secure memory which we reference by index
5069		 */
5070		.alg = "xts(paes)",
5071		.test = alg_test_null,
5072		.fips_allowed = 1,
5073	}, {
5074		.alg = "xts(serpent)",
5075		.generic_driver = "xts(ecb(serpent-generic))",
5076		.test = alg_test_skcipher,
5077		.suite = {
5078			.cipher = __VECS(serpent_xts_tv_template)
 
 
 
 
 
 
 
 
 
5079		}
5080	}, {
5081		.alg = "xts(twofish)",
5082		.generic_driver = "xts(ecb(twofish-generic))",
5083		.test = alg_test_skcipher,
5084		.suite = {
5085			.cipher = __VECS(tf_xts_tv_template)
5086		}
5087	}, {
5088		.alg = "xts4096(paes)",
5089		.test = alg_test_null,
5090		.fips_allowed = 1,
5091	}, {
5092		.alg = "xts512(paes)",
5093		.test = alg_test_null,
5094		.fips_allowed = 1,
5095	}, {
5096		.alg = "xxhash64",
5097		.test = alg_test_hash,
5098		.fips_allowed = 1,
5099		.suite = {
5100			.hash = __VECS(xxhash64_tv_template)
5101		}
5102	}, {
5103		.alg = "zlib-deflate",
5104		.test = alg_test_comp,
5105		.fips_allowed = 1,
5106		.suite = {
5107			.comp = {
5108				.comp = __VECS(zlib_deflate_comp_tv_template),
5109				.decomp = __VECS(zlib_deflate_decomp_tv_template)
5110			}
5111		}
5112	}, {
5113		.alg = "zstd",
5114		.test = alg_test_comp,
5115		.fips_allowed = 1,
5116		.suite = {
5117			.comp = {
5118				.comp = __VECS(zstd_comp_tv_template),
5119				.decomp = __VECS(zstd_decomp_tv_template)
 
 
 
 
 
 
5120			}
5121		}
5122	}
5123};
5124
5125static void alg_check_test_descs_order(void)
 
 
5126{
5127	int i;
5128
 
 
 
 
 
 
5129	for (i = 1; i < ARRAY_SIZE(alg_test_descs); i++) {
5130		int diff = strcmp(alg_test_descs[i - 1].alg,
5131				  alg_test_descs[i].alg);
5132
5133		if (WARN_ON(diff > 0)) {
5134			pr_warn("testmgr: alg_test_descs entries in wrong order: '%s' before '%s'\n",
5135				alg_test_descs[i - 1].alg,
5136				alg_test_descs[i].alg);
5137		}
5138
5139		if (WARN_ON(diff == 0)) {
5140			pr_warn("testmgr: duplicate alg_test_descs entry: '%s'\n",
5141				alg_test_descs[i].alg);
5142		}
5143	}
5144}
5145
5146static void alg_check_testvec_configs(void)
5147{
5148	int i;
5149
5150	for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++)
5151		WARN_ON(!valid_testvec_config(
5152				&default_cipher_testvec_configs[i]));
5153
5154	for (i = 0; i < ARRAY_SIZE(default_hash_testvec_configs); i++)
5155		WARN_ON(!valid_testvec_config(
5156				&default_hash_testvec_configs[i]));
5157}
5158
5159static void testmgr_onetime_init(void)
5160{
5161	alg_check_test_descs_order();
5162	alg_check_testvec_configs();
5163
5164#ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
5165	pr_warn("alg: extra crypto tests enabled.  This is intended for developer use only.\n");
5166#endif
5167}
5168
5169static int alg_find_test(const char *alg)
5170{
5171	int start = 0;
5172	int end = ARRAY_SIZE(alg_test_descs);
5173
5174	while (start < end) {
5175		int i = (start + end) / 2;
5176		int diff = strcmp(alg_test_descs[i].alg, alg);
5177
5178		if (diff > 0) {
5179			end = i;
5180			continue;
5181		}
5182
5183		if (diff < 0) {
5184			start = i + 1;
5185			continue;
5186		}
5187
5188		return i;
5189	}
5190
5191	return -1;
5192}
5193
5194int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
5195{
5196	int i;
5197	int j;
5198	int rc;
5199
5200	if (!fips_enabled && notests) {
5201		printk_once(KERN_INFO "alg: self-tests disabled\n");
5202		return 0;
5203	}
5204
5205	DO_ONCE(testmgr_onetime_init);
5206
5207	if ((type & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_CIPHER) {
5208		char nalg[CRYPTO_MAX_ALG_NAME];
5209
5210		if (snprintf(nalg, sizeof(nalg), "ecb(%s)", alg) >=
5211		    sizeof(nalg))
5212			return -ENAMETOOLONG;
5213
5214		i = alg_find_test(nalg);
5215		if (i < 0)
5216			goto notest;
5217
5218		if (fips_enabled && !alg_test_descs[i].fips_allowed)
5219			goto non_fips_alg;
5220
5221		rc = alg_test_cipher(alg_test_descs + i, driver, type, mask);
5222		goto test_done;
5223	}
5224
5225	i = alg_find_test(alg);
5226	j = alg_find_test(driver);
5227	if (i < 0 && j < 0)
5228		goto notest;
5229
5230	if (fips_enabled && ((i >= 0 && !alg_test_descs[i].fips_allowed) ||
5231			     (j >= 0 && !alg_test_descs[j].fips_allowed)))
5232		goto non_fips_alg;
5233
5234	rc = 0;
5235	if (i >= 0)
5236		rc |= alg_test_descs[i].test(alg_test_descs + i, driver,
5237					     type, mask);
5238	if (j >= 0 && j != i)
5239		rc |= alg_test_descs[j].test(alg_test_descs + j, driver,
5240					     type, mask);
5241
5242test_done:
5243	if (rc && (fips_enabled || panic_on_fail)) {
5244		fips_fail_notify();
5245		panic("alg: self-tests for %s (%s) failed in %s mode!\n",
5246		      driver, alg, fips_enabled ? "fips" : "panic_on_fail");
5247	}
5248
5249	if (fips_enabled && !rc)
5250		pr_info("alg: self-tests for %s (%s) passed\n", driver, alg);
 
5251
5252	return rc;
5253
5254notest:
5255	printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver);
5256	return 0;
5257non_fips_alg:
5258	return -EINVAL;
5259}
5260
5261#endif /* CONFIG_CRYPTO_MANAGER_DISABLE_TESTS */
5262
5263EXPORT_SYMBOL_GPL(alg_test);